Terror on the Internet hardly sounds like a book title to
reassure public sector IT security organizations. But, ironically,
it does.
Written by security researcher Gabriel Weimann and published by
the United States Institute of Peace, the book acknowledges that
war is being waged on the Internet but argues that the greatest
threats are beyond the scope of system administrators and IT
staff.
After years of study, Weimann concludes that there has never
been a successful example of "cyberterrorism," a pure electronic
attack that caused physical injury or loss of life. On the other
hand, he writes, the Internet has opened up other resources and
opportunities for terrorists, and CIO organizations have little or
no control over those threats.
One of the greatest benefits of the Internet to international
terrorism, Weimann argues, has been its ability to broadcast
unfiltered messages to audiences that would otherwise never see
them; to organize geographically dispersed groups in an effective
way; and to allow instant, secure transmission of operational
information. When fund-raising, money transfers and recruiting join
those activities, the result is virtual nation-states that exist
everywhere and nowhere, able to materialize and vanish, divide and
multiply almost at will. To accomplish most of their goals, they do
not need to hack into government systems or crash networks.
Terror on the Internet provides a useful framework for
understanding and analysing emerging security challenges, and
framework is the correct term. The value of the Internet to
terrorists lies in creative convergence: Digital media and the
propaganda value of atrocity intersect when al Qaeda can
disseminate videos of violence that conventional media have
censored; e-learning leads to restaurant and car bomb explosions
when online tutorials teach willing students how to use easily
obtained materials to create bombs; and, the developed world's
commitment to open public information creates vast databases that
terrorist planners can use to create bigger and better threats.
According to Weimann, we need look no further than the amazing
success of Google in recent years to find the value of information
technology for international terrorism, organized, accessible
content. The true vulnerability for governments fighting terrorism
is the information they so generously provide, intentionally or
not. (The same day a review copy of Terror on the Internet arrived
came news that detailed plans of Air Force One had been posted on
the Internet, complete with details of its anti-missile systems,
the seating plan for Secret Service personnel and the location of
its vulnerable oxygen equipment).
There are literally millions of documents available on the
Internet, waiting to be cross-referenced and analysed for
vulnerabilities. The book quotes U.S. Secretary of Defence Donald
Rumsfeld as saying, "Using public sources and without resorting to
illegal means, it is possible to gather at least 80 per cent of all
information required about the enemy."
Weimann's book includes a useful discussion of what
"cyberterrorism" attacks really are and quotes a literal
definition: They result in real physical damage to people or
property, they generate fear, and they further political or social
objectives. Attacks against non-essential services, even successful
ones that cause economic damage, don't count.
So what does all this mean for a public sector CIO organization?
The real value of this book may be in sharpening the focus on what
is really important in IT security. As this column went to press,
news had just broken that U.S. military personnel with baskets of
cash were going through the street markets outside the top secret
Bagram air base in Afghanistan, buying back stolen flash and hard
drives. Some still carried classified information.
No firewall or antivirus software can prevent that kind of
breakdown. When the data on those devices isn't encrypted, and much
of it apparently wasn't, there is no way to recover it. The
solution may lie in understanding the importance of protecting the
content on our desktops, networks and storage systems and not just
the systems themselves.
For all its emphasis on the informational and organizational
aspects of digital terrorism, Terror on the Internet does not rule
out the possibility of catastrophic attacks. For example, as the
book points out, we have not yet seen a "coupled" attack, in which
a physical strike is combined with an Internet-based attack to
multiply the damage or hinder the recovery. After all, our worst
possible scenario is still someone's top priority.
Richard Bray (rbray@itworldcanada.com)
is an Ottawa-based freelance journalist specialzing in high
technology and security issues.
icon.
