Everything is under control. Everything...

New book "Freedom" from Daniel Suarez and his security website: http://www.thedaemon.com/index.html

 

The Ethical Hacker Network (Online Magazine)

Free online magazine for the security professional: http://www.ethicalhacker.net

As attacks increase, U.S. struggles to recruit computer security experts

By Ellen Nakashima and Brian Krebs

Washington Post Staff Writer
Wednesday, December 23, 2009


The federal government is struggling to fill a growing demand for skilled computer-security workers, from technicians to policymakers, at a time when network attacks are rising in frequency and sophistication.

Demand is so intense that it has sparked a bidding war among agencies and contractors for a small pool of special talent: skilled technicians with security clearances. Their scarcity is driving up salaries, depriving agencies of skills, and in some cases affecting project quality, industry officials said.

The crunch hits as the Pentagon is attempting to staff a new Cyber Command to fuse offensive and defensive computer-security missions and the Department of Homeland Security plans to expand its own "cyber" force by up to 1,000 people in the next three years. Even President Obama struggled to fill one critical position: Seven months after Obama pledged to name a national cyber-adviser, the White House announced Tuesday that Howard Schmidt, a former Bush administration official and Microsoft chief security officer, will lead the nation's efforts to better protect its critical computer networks.

The lack of trained defenders for these networks is leading to serious gaps in protection and significant losses of intelligence, national security experts said. The Government Accountability Office told a Senate panel in November that the number of scans, probes and attacks reported to the Department of Homeland Security's U.S. Computer Emergency Readiness Team has more than tripled, from 5,500 in 2006 to 16,840 in 2008.

"We know how we can be penetrated," said Sen. Benjamin L. Cardin (D-Md.), chairman of the Judiciary subcommittee on terrorism and homeland security. "We don't know how to prevent it effectively."

Indeed, the protection of critical computer systems and sensitive data, said former National Security Agency director William Studeman, may be the "biggest single problem" facing the national security establishment.

Agencies under attack

One evening in May 2006, a U.S. embassy employee in East Asia clicked on an innocent-looking e-mail attachment that opened the door to the most significant cyberattack the State Department has yet faced, allowing attackers operating through computers in China to send malicious computer code into the department's networks in the region.

State's cyber-emergency response team immediately went into action, working round-the-clock for two weeks to isolate the harmful code and craft a temporary patch that officials said prevented a massive data theft.

The department's response to the attack highlights how skills matter, experts said. In 2000, State had hired technicians -- the vast majority contractors -- who custom-built an intrusion detection system and trained people to identify malicious software and reverse-engineer it to determine an attack's goals and methods. As a result, department technicians in 2006 were able to contain the attack quickly, said Alan Paller of the SANS Institute, who has analyzed the case for the Center for Strategic and International Studies.

Unlike State, most government agencies and private companies lack the skills and resources to muster a robust containment effort.

Two months after the East Asia intrusion, the Commerce Department detected a similar attack -- but only after a deputy undersecretary was unable to log on to his computer. Contractor technicians were never able to identify the initial date of penetration into the computers of the Bureau of Industry and Security, which controls sensitive exports of technology that has both commercial and military uses.

It took eight days once the attack was discovered for technicians to install a filter to prevent leaks, and then they installed the wrong kind of filter, said Paller, sharing previously undisclosed findings about the incident, first reported in The Washington Post in October 2006.

Because of "operational security concerns," the Commerce Department declined to comment for this article. But a senior Commerce official told a House Homeland Security panel in 2007 that the agency had no evidence that data were compromised. Still, the department replaced hundreds of workstations and blocked employees from regular Internet use for more than a month.

Commerce is trying to improve, but it can take years to put the people, processes and technology in place to wage an effective defense, said Mischel Kwon, former director of the Department of Homeland Security's readiness team. For years, she said, most civilian agencies were forced by federal law to spend their cyber-funds on security audits as opposed to crafting a strong security program.

And most federal information technology managers do not know what advanced skills are needed to combat cyberattacks, said Karen Evans, information technology administrator in the Bush administration.

"Skills," Paller said, "are much more important than hardware."

The federal pay gap

A pillar of the federal government's effort to develop talent is the National Science Foundation's Scholarship for Service program, which pays for up to two years of college in exchange for an equal number of years of federal service. However, the program has placed fewer than 1,000 students since its inception in 2001.

The career of a 30-year-old computer scientist named Brian Denny shows how the government is often outbid by the private sector in recruiting cyber-warriors.

Denny earned a computer science masters degree in 2004 from Purdue University on an NSF scholarship. In return, he spent two years at the National Security Agency, identifying novel security flaws in computer systems and software. Then Booz Allen Hamilton, a major intelligence contractor, hired him at a 45 percent pay raise.

Today, Denny works for a small employee-owned firm that has federal government and private-sector contracts, and his pay is higher still. "You can still do a lot of cool national-security-related work as a contractor," said Denny, chief security architect for Ponte Technologies in Ellicott City, Md., near the NSA. "The pay difference is so dramatic now," he said, "you can't ignore it."

Recently, a military officer with 20 years' cybersecurity experience and a coveted security clearance sauntered out of a job interview with Northrop Grumman, a major defense contractor that is making an aggressive play for potentially billions of dollars in government cyber-business.

"It's mind-roasting," said the officer, who is about to retire. "I've had people call my house, recruiters for defense contractors . . . probably 20 calls."

The labor shortage is torquing up salaries, a cost that often gets passed on to the government. Some young people with three years' experience and a clearance are commanding salaries above $100,000. "Companies are paying people to jump from one company to another," said Ed Giorgio, a former NSA official and Ponte Technologies co-founder. The job-hopping can undermine the firm's performance on a contract, he said.

Philip Reitinger, deputy undersecretary of Homeland Security's National Protection and Programs Directorate, conceded that the government generally cannot match industry pay scales. "But in government, one can have a bigger ability to effect change at an earlier place in your career than anywhere else," he said. "And -- your country needs you."

Homeland Security officials acknowledged that hiring 1,000 people will be difficult, so they are also looking at training people already in the federal government.

Cybersecurity lawyers, researchers and policymakers are also in short supply. The Pentagon, for instance, lacks a career path to develop "expert decision-making in the cyber field," said Robert D. Gourley, a former Defense Intelligence Agency chief technology officer. "The great cyber-generals are few and far between."

Information Security Forum

https://www.securityforum.org/

Founded in 1989, the Information Security Forum (ISF) is an independent, not-for-profit organisation that supplies authoritative opinion and guidance on all aspects of information security. By harnessing our world-renowned expertise and the collective knowledge and experience of our 300 members, the ISF delivers practical solutions to overcome wide-ranging security challenges impacting business information today.

Four main areas of service are available to our Members:

	Tools and Methodologies, built using the collective expertise, insight, and knowledge of our Members worldwide		A comprehensive programme of Knowledge and Information Exchange, offering interactive peer-to-peer forums that give Members an opportunity to meet on a regular basis to share best practices, experiences and perspectives on a wide range of issues.
	An impressive library of Research and Report material, incorporating an unmatched degree of thought leadership in information security, information risk management and related topics.		The ISF Annual World Congress, our flagship global event which offers attendees an opportunity to discuss key security challenges and gain practical advice from peers and leading industry experts from around the world.

A comprehensive national broadband plan.

FCC digs into broadband controversies

by Marguerite Reardon

The Federal Communications Commission is taking on difficult and controversial issues as it works toward developing a comprehensive national broadband plan.

On Wednesday the agency heard from an FCC task force on the progress that it's making in writing that broadband plan, which will be presented to Congress in February.

The FCC has been tasked with developing a plan that will get broadband services to all Americans. In working to come up with a comprehensive policy, the FCC has tackled several controversial issues, most notably reforming the Universal Service Fund, reallocating wireless spectrum, and forcing more competition in the market for cable set-top boxes.

One of the top items on the FCC task force's to-do list is reforming the $7 billion rural phone subsidy program called the Universal Service Fund. This program, which also provides funding for schools and libraries through its E-rate program, is funded by consumers, who are charged extra fees on their long-distance phone bills. Specifically, the agency wants to expand the program to help fund broadband service in parts of the country where private industry doesn't find it profitable to invest.

The task force didn't provide long-term recommendations for transitioning USF into funding broadband deployments. But in the short term, it suggested extending some current programs such as life-line link-up to schools and other public areas to provide more access to unemployed people who may not have Internet connectivity at home. The idea is that these individuals can use broadband in these public areas to look for jobs.

FCC Chairman Julius Genachowski said it will take time to get reforms in place. He noted that the national broadband plan won't directly affect USF, but he said the program, once it's expanded, will eventually help fund and become a key part of helping get broadband to underserved parts of the country.

"It's tempting to kick the can [USF reform} further down the road," he said. "But for many reasons it's important to begin tackling these issues now. We must make sure that the fund fully supports the technology of today and tomorrow, not just the technology of the past."

But the process is going to be a long one, he said. And he wouldn't comment on whether true reform could be achieved in his term as chairman.

The FCC task force also reiterated its plans to re-evaluate spectrum issues. Genachowski has said publicly that one of his top priorities is reallocating and finding more spectrum that can be used to build wireless broadband services. Both he and the CTIA, a trade group representing the wireless industry, say there is a looming spectrum crisis that could result in dire consequences without adequate attention now.

During its report to the commission, the broadband task force said it is working with Congress to inventory and assess current spectrum usage in the U.S. It is calling for Congress to also require periodic review of spectrum uses and to find ways to clear spectrum bands that aren't serving other uses, such as wireless broadband.

The task force also said during its presentation Wednesday that it's looking at ways to spur more competition in the cable set-top box market. The group said that a lack of competition in the set-top box market has also resulted in a lack of innovation. The agency feels that more competition in this market would spur companies to develop new Internet applications and services that could be accessed via TVs.

The FCC is considering requiring paid TV providers, such as Comcast, Time Warner Cable, AT&T, and Verizon Communications to supply a low-cost network interface device that would allow people to access the Internet on their TVs and to access cable TV without using a cable box.

Interplanetary Internet. Whoa can IPv6 handle this?!?!?

From Wikipedia, the free encyclopedia

The Interplanetary Internet (IPN) is a conceived computer network in space, consisting of a set of network nodes which can communicate with each other.^[1][2] Communication would be greatly delayed by the great interplanetary distances, so the IPN needs a new set of protocolstechnology that are tolerant to large delays and errors.^[2] While the Internet as we know it tends to be a busy "network of networks" with high traffic, negligible delay and errors, and a wired backbone, the Interplanetary Internet is a store-and-forward "network of Internets" that is often disconnected, has a wireless backbone fraught with error-prone links and delays ranging to tens of minutes, even hours, even when there is a connection. and

Contents [hide] 1 Development 2 Implementation 3 See also 4 References 5 External links

[edit] Development

Space communication technology has steadily evolved from expensive, one-of-a-kind point-to-point architectures, to the re-use of technology on successive missions, to the development of standard protocols agreed upon by space agencies of many countries. This last phase has gone on since 1982 through the efforts of the Consultative Committee for Space Data Systems^[3] a body composed of the major space agencies of the world. It has 11 member agencies, 22 observer agencies, and over 100 industrial associates. (CCSDS),

The evolution of space data system standards has gone on in parallel with the evolution of the Internet, with conceptual cross-pollination where fruitful, but largely as a separate evolution. Since the late 1990s, familiar Internet protocols and CCSDS space link protocols have integrated and converged in several ways, for example, the successful FTP file transfer to Earth-orbiting STRV-1b on January 2 1996, which ran FTP over the CCSDS IPv4-like Space Communications Protocol Specifications (SCPS) protocols.^[4][5] Internet Protocol use without CCSDS has taken place on spacecraft, e.g., demonstrations on the UoSAT-12 satellite, and operationally on the Disaster Monitoring Constellation. Having reached the era where networking and IP on-board spacecraft have been shown to be feasible and reliable, a forward-looking study of the bigger picture was the next phase.

ICANN meeting, Los Angeles, USA, 2007. The marquee plays a humorous homage to the Ed Wood film Plan 9 from Outer Space, while namedropping Internet pioneer Vint Cerf.

The Interplanetary Internet study at NASA's Jet Propulsion Laboratory (JPL) was started by a team of scientists at JPL led by Vinton Cerf and Adrian Hooke.^[6] Cerf is one of the pioneers of the Internet on Earth, and currently holds the position of distinguished visiting scientist at JPL. Hooke is one of the directors of the CCSDS.

While IP-like SCPS protocols are feasible for short hops, such as ground station to orbiter, rover-to-lander, lander-to-orbiter, probe-to-flyby, and so on, delay-tolerant networking is needed to get information from one region of the solar system to another. It becomes apparent that the concept of a "region" is a natural architectural factoring of the InterPlanetary Internet.

A "region" is an area where the characteristics of communication are the same.^[7] Region characteristics include communications, security, the maintenance of resources, perhaps ownership, and other factors.^[7] The Interplanetary Internet is a "network of regional internets."

What is needed then, is a standard way to achieve end-to-end communication through multiple regions in a disconnected, variable-delay environment using a generalized suite of protocols. Examples of regions might include the terrestrial Internet as a region, a region on the surface of the moon or Mars, or a ground-to-orbit region.

The recognition of this requirement led to the concept of a "bundle" as a high-level way to address the generalized Store-and-Forward problem. Bundles are an area of new protocol development in the upper layers of the OSI model, above the Transport Layer with the goal of addressing the issue of bundling store-and-forward information so that it can reliably traverse radically dissimilar environments constituting a "network of regional internets."

Bundle Service Layering, implemented as the Bundling protocol suite for delay-tolerant networking, will provide general purpose delay-tolerant protocol services in support of a range of applications: custody transfer, segmentation and reassembly, end-to-end reliability, end-to-end security, and end-to-end routing among them. The Bundle Protocol was first tested in space on the UK-DMC satellite in 2008.^[8][9]

The Deep Impact mission

An example of one of these end-to-end applications flown on a space mission is CFDP, used on the comet mission, Deep Impact. CFDP is the CCSDS File Delivery Protocol^[10] an international standard for automatic, reliable file transfer in both directions. CFDP should not be confused with Coherent File Distribution Protocol, which unfortunately has the same acronym and is an IETF-documented experimental protocol for rapidly deploying files to multiple targets in a highly-networked environment.

In addition to reliably copying a file from one entity (i. e., a spacecraft or ground station) to another entity, the CCSDS CFDP has the capability to reliably transmit arbitrary small messages defined by the user, in the metadata accompanying the file, and to reliably transmit commands relating to file system management that are to be executed automatically on the remote end-point entity (i. e., a spacecraft) upon successful reception of a file.

[edit] Implementation

The dormant InterPlanetary Internet Special Interest Group of the Internet Society has worked on defining protocols and standards that would make the IPN possible.^[11] The Delay-Tolerant Networking Research Group (DTNRG) is the primary group researching Delay-tolerant networking which has several major arenas of application in addition to the Interplanetary Internet, including stressed tactical communications, sensor webs, disaster recovery, hostile environments, and remote outposts.^[12] As an example of a remote outpost, imagine an isolated Arctic village or a faraway island, with electricity, and one or more computers but no communication connectivity. With the addition of a simple wireless hotspot in the village, plus DTN-enabled devices on, say, dog sleds or fishing boats, a resident would be able to check their e-mail or click on a Wikipedia article, and have their requests forwarded to the nearest networked location on the sled's or boat's next visit, and get the replies on its return.

As of 2005, NASA has canceled plans to launch the Mars Telecommunications Orbiter in September 2009; it had the goal of supporting future missions to Mars and would have functioned as a possible first definitive Internet hub around another planetary body.^[update]

Since July of 2009 NASA have been testing DTN on board the ISS,^[13] in August or September there are plans to reload the DTN protocol on the Deep Impact probe. That later combined with another satellite and the ground node will produce a 4 node network.^[14]

[edit] See also

• InterPlaNet
• Delay-tolerant networking
• Intergalactic Computer Network

[edit] References

1. ^ IEEE Spectrum: The Interplanetary Internet
2. ^ ^{a b} Generation InterPlanetary Internet | SpaceRef — Your Space Reference
3. ^ http://public.ccsds.org
4. ^ The Space Technology Research Vehicles: STRV-1a, b, c and d, Richard Blott and Nigel Wells, AIAA Small Satellite Conference, Logan, Utah, 1996.
5. ^ Appendix F, CCSDS 710.0-G-0.3: Space Communication Protocol Specification (SCPS) - Rationale, Requirements, and Application Notes, Draft Green Book, Issue 0.3. April 1997.
6. ^ CCSDS.org — Meet the Area Directors — Adrian Hooke
7. ^ ^{a b} Interplanetary Internet
8. ^ Use of the Delay-Tolerant Networking Bundle Protocol from Space, L.Wood et al., Conference paper IAC-08-B2.3.10, 59th International Astronautical Congress, Glasgow, September 2008.
9. ^ UK-DMC satellite first to transfer sensor data from space using 'bundle' protocol, press release, Surrey Satellite Technology Ltd, 11 September 2008.
10. ^ CCSDS.org - CCSDS Recommendations and Reports - Space Internetworking Services Area
11. ^ InterPlanetary Internet
12. ^ Home - Delay-Tolerant Networking Research Group
13. ^ http://www.theregister.co.uk/2009/07/07/dtn_node/
14. ^ 3 oktober 2009. "Vint Cerf - The Internet Today". YouTube. http://www.youtube.com/watch?v=KeAIwLp9YmA#t=43m24s. Retrieved 2009-10-31.

[edit] External links

This article's external links may not follow Wikipedia's content policies or guidelines. Please improve this article by removing excessive or inappropriate external links.

• The Consultative Committee for Space Data Systems (CCSDS)
• CCSDS History
• Participation in CCSDS
• Proximity-1 links Mars Comms, Disney & Interplanetary Internet
• ISO Feature: Deep Impact
• ISO Feature: Mars and Prox-1
• NASA'S MESSENGER & CFDP
• The InterPlaNetary Internet Project IPN Special Interest Group
• Overview - Delay-Tolerant Networks - IPN Phase II: The Next Steps
• Delay-Tolerant Networking - An Approach to InterPlanetary Internet
• Delay-Tolerant Network Architecture: The Evolving Interplanetary Internet
• The Interplanetary Network: A Strategy for Building Re-Usable International Space Communications Infrastructure
• The Delay-Tolerant Networking Research Group (DTNRG)
• Burleigh, Scott, CCSDS File Delivery Protocol in Delay-Tolerant Networking, GSAW 2003
• Burleigh, Scott, Operating CFDP in the Interplanetary Internet

Retrieved from "http://en.wikipedia.org/wiki/Interplanetary_Internet"

Categories: Computer networks | CCSDS

A prophetic article written a few months after September 11th, 2001. "Is Cyber Terror Next"? by Dorothy E. Dennings

Is Cyber Terror Next?
Dorothy E. Denning, Professor of Computer Science; Director of the Georgetown Institute for Information Assurance, Georgetown University

Shortly after the September 11 terrorist attack against the United States, hackers took to the Internet to voice their rage. A group called the Dispatchers announced they would destroy Web servers and Internet access in Afghanistan and target nations that support terrorists. Led by a 21-year-old security worker "Hackah Jak" from Ohio, the group of 60 people worldwide defaced hundreds of Web sites and launched denial of service attacks against such targets as the Iranian Ministry of Interior, the Presidential Palace of Afghanistan, and Palestinian ISPs. Another group, called Young Intelligent Hackers Against Terror (YIHAT), claimed they penetrated the systems of two Arabic banks with ties to Osama bin Laden, although officials from the banks denied any security breaches occurred. The group, whose stated mission is to stop the money sources of terrorism, issued a plea on their Web site for corporations to make their networks available to group members for the purpose of providing the "electronic equivalent to terrorist training camps." Later, they took down their public Web site, apparently in response to attacks from other hackers.

One group of Muslim hackers attacking the YIHAT site said they stood by bin Laden, even as they condemned the attacks of September 11. "Osama bin Laden is a holy fighter, and whatever he says makes sense," GForce Pakistan wrote on a Web site it defaced. The modified Web page warned that the group planned to hit major US military and British Web sites and proclaimed an "Al-Qaeda Alliance Online." Another GForce defacement contained similar messages along with images of badly mutilated children who had been killed by Israeli soldiers.

The cyber attacks arising from the events of September 11 reflect a growing use of the Internet as a digital battleground. It is not at all unusual for a regional conflict to have a cyber dimension, where the battles are fought by self-appointed hackers operating under their own rules of engagement. A rash of cyber attacks have accompanied the conflict between Israel and the Palestinians, the conflict over Kashmir, and the Kosovo conflict, among others. According to iDefense, over 40 hackers from 23 countries participated in the Israeli-Palestenian cyber conflict during the period October 2000, when the cyber battles erupted, to January 2001. They also reported that two of the pro-Palestinian attackers had connections to terrorist organizations. One of these was UNITY, a Muslim extremist group with ties to Hezbollah. The hackers launched a coordinated, multi-phased denial of service attack, first against official Israeli government sites, second against Israeli financial sites, third against Israeli ISPs, and fourth, against "Zionist E-Commerce" sites. The other group, al-Muhajiroun, was said to have ties with a number of Muslim terrorist organizations as well as bin Laden. The London-based group directed their members to a Web page, where at the click of a mouse members could join an automated flooding attack against Israeli sites.

Cyber protests have emerged in a climate where computer network attacks have become a serious and growing threat. The Computer Emergency Response Team Coordination Center (CERT/CC), for example, reported 2,134 incidents in 1997. This number rose to 21,756 in 2000 and to almost 35,000 during the first three quarters of 2001 alone. Considering that many, perhaps most, incidents are never reported to CERT/CC or indeed to any third party, the numbers become even more significant. Further, each incident that is reported corresponds to an attack that can involve thousands of victims. The Code Red worm, which infected about a million servers in July and August and caused $2.6 billion in damages, was a single incident.

The rise in computer-based attacks can be attributed to several factors, including general growth of the Internet, with corresponding increase in the number of potential attackers and targets; a never-ending supply of vulnerabilities that, once discovered, are quickly exploited; and increasingly sophisticated hacking tools that allow even those with modest skills to launch devastating attacks. The tools used to launch massive denial of service assaults, for example, have advanced command and control capabilities. The attacker runs client software to direct and coordinate the actions of server software running on potentially thousands of previously compromised "zombie" computers. Computer worms like Code Red can be used to find potential zombies and automatically install the attack software.

Although cyber attacks have caused billions of dollars in damage and affected the lives of millions, few if any can be characterized as acts of terrorism: fraud, theft, sabotage, vandalism, and extortion – yes, but terrorism – no. Their effect, while serious and not to be taken lightly, pales in comparison to the horror we witnessed on September 11.

But is cyber terrorism coming? Given that at least some hackers sympathetic to bin Laden are engaging in cyber protests, will they or terrorists specifically trained in cyber methods conduct future operations using nothing more than a keyboard and mouse? And if they do, will their cyber bombs target critical infrastructures or cause death and destruction comparable to that from physical weapons? Or, will they use cyber terrorism as an ancillary tool to amplify the impact of a physical attack, for example, by jamming 911 services or shutting down electricity or telecommunications after blowing up a building or releasing toxic gases?

Before addressing these questions, it is important to understand what is meant by cyber terrorism. The term is generally understood to mean a computer-based attack or threat of attack intended to intimidate or coerce governments or societies in pursuit of goals that are political, religious, or ideological. The attack should be sufficiently destructive or disruptive to generate fear comparable to that from physical acts of terrorism. Attacks that lead to death or bodily injury, extended power outages, plane crashes, water contamination, or major economic losses would be examples. Depending on their impact, attacks against critical infrastructures such as electric power or emergency services could be acts of cyber terrorism. Attacks that disrupt nonessential services or that are mainly a costly nuisance would not.

To assess the potential threat of cyber terrorism, two factors must be considered: first, whether there are targets that are vulnerable to attack that could lead to severe harm, and second, whether there are actors with the capability and motivation to carry them out.

Looking first at vulnerabilities, several studies have shown that critical infrastructures are potentially vulnerable to a cyber terrorist attack This is not surprising, because systems are complex, making it effectively impossible to eliminate all weaknesses. New vulnerabilities are continually uncovered, and systems are configured or used in ways that make them open to attack. Even if the technology is adequately hardened, insiders, acting alone or in concert with other terrorists, may be able to exploit their access capabilities to wreak considerable harm.

Click here for the home page of CERT/CC.

Consultants and contractors are frequently in a position where they could cause grave harm. In March 2000, Japan's Metropolitan Police Department reported that a software system they had procured to track 150 police vehicles, including unmarked cars, had been developed by the Aum Shinryko cult, the same group that gassed the Tokyo subway in 1995, killing 12 people and injuring 6,000 more. At the time of the discovery, the cult had received classified tracking data on 115 vehicles. Further, the cult had developed software for at least 80 Japanese firms and 10 government agencies. They had worked as subcontractors to other firms, making it almost impossible for the organizations to know who was developing the software. As subcontractors, the cult could have installed Trojan horses to launch or facilitate cyber terrorist attacks at a later date.

If we take as given that critical infrastructures are vulnerable to a cyber terrorist attack, then the question becomes whether there are actors with the capability and motivation to carry out such an operation. While many hackers have the knowledge, skills, and tools to attack computer systems, they generally lack the motivation to cause violence or severe economic or social harm. Conversely, terrorists who are motivated to cause violence seem to lack the capability to cause that degree of damage in cyberspace. The methods of cyber terrorism are not, to the best of my knowledge, taught in the terrorist training camps of Afghanistan.

In August 1999, the Center for the Study of Terrorism and Irregular Warfare at the Naval Postgraduate School (NPS) in Monterey, California, issued a report entitled "Cyberterror: Prospects and Implications." Their objective was to assess the prospects of terrorist organizations pursuing cyber terrorism. They concluded that the barrier to entry for anything beyond annoying hacks is quite high and that terrorists generally lack the wherewithal and human capital needed to mount a meaningful operation. Cyber terrorism, they argued, was a thing of the future, although it might be pursued as an ancillary tool.

The NPS study examined five types of terrorist groups: religious, New Age, ethno-nationalist separatist, revolutionary, and far-right extremist. Of these, only the religious groups were thought likely to seek the most damaging capability level, as it would be consistent with their indiscriminate application of violence.

In October 2000, the NPS group issued a second report following a conference aimed at examining the decision making process that leads sub-state groups engaged in armed resistance to develop new operational methods. They were particularly interested in learning whether such groups would engage in cyber terrorism. In addition to academics and a member of the United Nations, the participants included a hacker and five practitioners with experience in violent sub-state groups. The latter included the PLO, the Liberation Tigers of Tamil Eelan (LTTE), the Basque Fatherland and Liberty-Political/Military (ETA-PM), and the Revolutionary Armed Forces of Colombia (FARC). The participants engaged in a simulation exercise based on the situation in Chechnya.

Only one cyber attack was authorized during the simulation, and that was against the Russian Stock Exchange. The attack was justified on the grounds that the exchange was an elite activity and thus disrupting it would not affect most Russians. Indeed, it might appeal to the average Russian. The group ruled out mass disruptions impacting e-commerce as being too indiscriminate and risking a backlash.

The findings from the meeting were generally consistent with the earlier study. Recognizing that their conclusions were based on a small sample, they concluded that terrorists have not yet integrated information technology into their strategy and tactics; that sub-state groups may find cyber terror attractive as a non-lethal weapon; that significant barriers between hackers and terrorists may prevent their integration into one group; and that politically motivated terrorists had reasons to target selectively and limit the effects of their operations, although they might find themselves in a situation where a mass casualty attack was a rational choice.

The NPS group also concluded that the information and communication revolution may lessen the need for violence by making it easier for sub-state groups to get their message out. Unfortunately, this conclusion does not seem to be supported by recent events. Many of the people in bin Laden’s network, including the suicide hijackers, have used the Internet but nevertheless engage in horrendous acts of violence. Groups that foster hate and aggression thrive on the Internet alongside those that promote tolerance and peace.

Although cyber terrorism is certainly a real possibility, for a terrorist, digital attacks have several drawbacks. Systems are complex, so controlling an attack and achieving a desired level of damage may be harder than using physical weapons. Unless people are killed or badly injured, there is also less drama and emotional appeal.

In assessing the threat of cyber terrorism, it is also important to look beyond the traditional terrorist groups and to the computer geeks who already possess considerable hacking skills. As noted at the beginning of this essay, some of these folks are aligning themselves with terrorists like bin Laden. While the vast majority of hackers may be disinclined towards violence, it would only take a few to turn cyber terrorism into reality.

Further, the next generation of terrorists will grow up in a digital world, with ever more powerful and easy-to-use hacking tools at their disposal. They might see greater potential for cyber terrorism than do the terrorists of today, and their level of knowledge and skill relating to hacking will be greater. Cyber terrorism could also become more attractive as the real and virtual worlds become more closely coupled, with automobiles, appliances, and other devices attached to the Internet. Unless these systems are carefully secured, conducting an operation that physically harms someone may be as easy as penetrating a Web site is today.

At least for now, hijacked vehicles, truck bombs, and biological weapons seem to pose a greater threat than cyber terrorism. However, just as the events of September 11 caught us by surprise, so could a major cyber assault. We cannot afford to shrug off the threat.

November 1, 2001

Dorothy E. Denning is the Patricia and Patrick Callahan Family Professor of Computer Science and Director of the Georgetown Institute for Information Assurance at Georgetown University. She has written extensively on information warfare and testified before Congress on cyberterrorism.