Terror on the Internet hardly sounds like a book title to reassure public sector IT security organizations. But, ironically, it does.
Written by security researcher Gabriel Weimann and published by the United States Institute of Peace, the book acknowledges that war is being waged on the Internet but argues that the greatest threats are beyond the scope of system administrators and IT staff.
After years of study, Weimann concludes that there has never been a successful example of “cyberterrorism,” a pure electronic attack that caused physical injury or loss of life. On the other hand, he writes, the Internet has opened up other resources and opportunities for terrorists, and CIO organizations have little or no control over those threats.
One of the greatest benefits of the Internet to international terrorism, Weimann argues, has been its ability to broadcast unfiltered messages to audiences that would otherwise never see them; to organize geographically dispersed groups in an effective way; and to allow instant, secure transmission of operational information. When fund-raising, money transfers and recruiting join those activities, the result is virtual nation-states that exist everywhere and nowhere, able to materialize and vanish, divide and multiply almost at will. To accomplish most of their goals, they do not need to hack into government systems or crash networks.
Terror on the Internet provides a useful framework for understanding and analysing emerging security challenges, and framework is the correct term. The value of the Internet to terrorists lies in creative convergence: Digital media and the propaganda value of atrocity intersect when al Qaeda can disseminate videos of violence that conventional media have censored; e-learning leads to restaurant and car bomb explosions when online tutorials teach willing students how to use easily obtained materials to create bombs; and, the developed world’s commitment to open public information creates vast databases that terrorist planners can use to create bigger and better threats.
According to Weimann, we need look no further than the amazing success of Google in recent years to find the value of information technology for international terrorism, organized, accessible content. The true vulnerability for governments fighting terrorism is the information they so generously provide, intentionally or not. (The same day a review copy of Terror on the Internet arrived came news that detailed plans of Air Force One had been posted on the Internet, complete with details of its anti-missile systems, the seating plan for Secret Service personnel and the location of its vulnerable oxygen equipment).
There are literally millions of documents available on the Internet, waiting to be cross-referenced and analysed for vulnerabilities. The book quotes U.S. Secretary of Defence Donald Rumsfeld as saying, “Using public sources and without resorting to illegal means, it is possible to gather at least 80 per cent of all information required about the enemy.”
Weimann’s book includes a useful discussion of what “cyberterrorism” attacks really are and quotes a literal definition: They result in real physical damage to people or property, they generate fear, and they further political or social objectives. Attacks against non-essential services, even successful ones that cause economic damage, don’t count.
So what does all this mean for a public sector CIO organization? The real value of this book may be in sharpening the focus on what is really important in IT security. As this column went to press, news had just broken that U.S. military personnel with baskets of cash were going through the street markets outside the top secret Bagram air base in Afghanistan, buying back stolen flash and hard drives. Some still carried classified information.
No firewall or antivirus software can prevent that kind of breakdown. When the data on those devices isn’t encrypted, and much of it apparently wasn’t, there is no way to recover it. The solution may lie in understanding the importance of protecting the content on our desktops, networks and storage systems and not just the systems themselves.
For all its emphasis on the informational and organizational aspects of digital terrorism, Terror on the Internet does not rule out the possibility of catastrophic attacks. For example, as the book points out, we have not yet seen a “coupled” attack, in which a physical strike is combined with an Internet-based attack to multiply the damage or hinder the recovery. After all, our worst possible scenario is still someone’s top priority.
— Richard Bray (rbray@itworldcanada.com) is an Ottawa-based freelance journalist specialzing in high technology and security issues.
