Crime Law Soc Change DOI 10.1007/s10611-007-9061-9 Cyber terrorism: a clear and present danger, the sum of all fears, breaking point or patriot games? Michael Stohl # Springer Science + Business Media B.V. 2007 Abstract Over the past two decades there has developed a voluminous literature on the problem of cyber terrorism. The themes developed by those writing on cyber terrorism appear to spring from the titles of Tom Clancy’s fiction, such as Clear and Present Danger, The Sum of All Fears and Breaking Point, or somewhat more cynically, Patriot Games. This essay examines both the gap between the presumed threat and the known cyber terror behaviors and the continuing literature which suggests an attack is imminent. It suggests that at least part of the explanation lies both in the continuing failure to distinguish between what Denning (Activism, hacktivism, and cyber terrorism: The internet as a tool for influencing foreign policy, 1999) referred to as hactivism and cyberterrorism and also the failure to distinguish between the use of digital means for organizational purposes (information, communication, command and control) and the use of digital communications to actually commit acts of terror. Introduction Over the past two decades there has developed a voluminous literature on the problem of cyber terrorism. The themes developed by those writing on cyber terrorism appear to spring from the titles of Tom Clancy’s fiction, such as Clear and Present Danger, The Sum of All Fears and Breaking Point, or somewhat more cynically, Patriot Games. But perhaps, as we shall see, the appropriate Tom Clancy titles to describe the state of the cyber terrorism literature should be State of Siege, Without Remorse and Hidden Agendas; to distinguish between the literature and the empirical reality of cyber terror. M. Stohl (*) Department of Communication, University of California, Santa Barbara, CA 93106, USA e-mail: [email protected] M. Stohl Much before 9/11 there had been great angst about the possibilities of cyber terrorism, including oft stated fears about a digital Pearl Harbor.1 This fear was further enhanced by the Y2K problem often referred to as the millennium bug by those who sought to dramatize the threat.2 Despite the fact that these fears have yet to be matched by real events,3 in the context of the post 9/11 concern with terrorism and the global war on terrorism, the threat of cyber terrorism remains high on the list of public and professional fears.4 In the post 9/11 world, journalists and governmental officials have often tied the threat of cyber terror to Al Qaeda and other terrorist organizations to obtain maximum effect. For example Lenzner and Vardi  write, “Four years ago al Qaeda operatives were taking flying lessons. Today they are honing a new skill: hacking.” However, “[t]here is little concrete evidence of terrorists preparing to use the Internet as a venue for inflicting grave harm (:24). In summary, there have been no instances where cyber terrorism has mirrored a catastrophic loss of life or physical destruction associated with the most violent acts of “conventional” terrorism. The study of terrorism routinely exaggerates both the threat of WMD terrorism and the spectacular and deadly events that have infrequently occurred. It creates an assumption that most terrorism events involve large numbers of deaths and enormous property damage. However, the spectacular events actually account for a relatively small portion of what occurs within the rubric of the terrorism experience and while enormously important and correctly feared, must not stop us from looking at the overall problem and the entirety of the threat.5 The same is true with respect to cyber terrorism. It is thus important to examine both the divergence from reality with respect to cyber terrorism prevalent in the literature and to consider why there appears to be such a large gap between the presumed threat and the known behaviors. 1 “The most popular term, ‘electronic Pearl Harbor,’ was coined in 1991 by an alarmist tech writer named Winn Schwartau to hype a novel. For a while, in the mid-1990s, ‘electronic Chernobyl’ was in vogue. Earlier this year, Sen. Charles Schumer (D-N.Y.) warned of a looming ‘digital Armageddon.’ And the Center for Strategic and International Studies, a Washington think tank, has christened its own term,”digital Waterloo . http://www.washingtonmonthly.com/features/2001/0211.green.html See also Debrix . “Cyberterror and Media-Induced Fears: The Production of Emergency Culture,” Strategies: Journal of Theory, Culture and Politics, Vol. 14, No. 1, 149–168. 2 Of course the millennium bug was not the result of a terrorist threat but rather the result of an outdated programming system which had not accounted for the transition from 1999 to 2000. See for example http:// www.soci.niu.edu/~crypt/other/harbor.htm. By 1999 Crypt newsletter noted that “Electronic Pearl Harbor” and variations on it, could be found in over 500 citations for the phrase in on-line news archives, military research papers and press releases. Simpson  writes “The nearest thing to cyber terror involved the March 2000 case of Vitek Boden, who infiltrated the systems of a sewage treatment plant in Australia. His attacks resulted in the release of an estimated 265,000 gallons of untreated sewage into local water courses... ...Boden had been employed by the company that installed the control network and his laptop contained a software application needed to access the system. The motive was revenge for rejection of his job application by the local authority in Queensland.” 3 4 “The consensus among security experts is that there has never been a recorded act of cyberterrorism pre- or post-September11” (:388). 5 Whether or not this appreciation of terrorism actually receives its due in the formulation of counter terrorist policy, particularly in the post 9/11 environment, it was clearly articulated in the 1999 State Department report on global terrorism. “Furthermore, terrorist acts are part of a larger phenomenon of politically inspired violence, and at times the line between the two can be difficult to draw” (2000:5). Cyber terrorism State of siege It is clear that despite the continuing reality that cyber terror remains a potential threat rather than an ongoing series of events, there has not developed a sense of security, comfort or complaisance in the popular press but rather a fear that this year or next is “in fact” the year of maximum danger. The public is constantly reminded that “we” remain vulnerable to cyber attack and that it is only a question of time before we are surprised by the still lurking digital Pearl Harbor. Many different factors converge to keep the concept of cyber terrorism on the public agenda. Cyber terror concerns serve many different and often unconnected actors, whose collective needs are served by keeping the threat on the public’s list of concerns. Underlying much of the concern with the misunderstood nature of the threat of cyber terrorism is a combination of fear and ignorance.6 Embar-Seddon citing Richard Lazarus (“An unknown threat is perceived as more threatening than a known threat.”) argues that The most destructive forces working against an understanding of the threat of Cyber terrorism are a fear of the unknown and a lack of information or, worse, too much misinformation. The word cyber terrorism brings together two significant modern fears: the fear of technology and the fear of terrorism. Both technology and terrorism are significant unknowns (:1034). Likewise, Weimann argues “from a psychological perspective, two of the greatest fears of modern time are combined in the term ‘cyber terrorism’ (:131).” Thomas (:115– 116) elaborates further The Internet produces an atmosphere of virtual fear or virtual life.People are afraid of things that are invisible and things they don’t understand. The virtual threat of computer attacks appears to be one of those things. Cyberfear is generated by the fact that what a computer attack could do (bring down airliners, ruin critical infrastructure, destroy the stock market, reveal Pentagon planning secrets, etc.) is too often associated with what will happen (emphases in original). There is a regular cycle of cyber sector and government press releases which are eagerly reported by both the mainstream press and trade sector publications. The vast majority of these releases discuss the threat and the precautions, investments and critical needs of the cyber sector. Rarely, do such releases call attention to the lack of actual cyber terror events, as opposed to, cyber crime, hacking or hoaxes and rarely do they inform the reader that the same type of threat and the same “crisis mode” of release appeared in each of the previous years since the early 1990s. The cycles and concerns mirror the types of competition between administrations and their opposition that took place in the 1950s and 1960s with respect to nuclear weapons and the arms race. Both incumbents and challengers sought to demonstrate potential weaknesses and emerging threats and the need therefore to remain vigilant and invest in preventive measures and improved systems. What we find therefore are systematic leaks tied to the budgetary cycles of various states and systematic leaks tied to the election cycle. Governments also engage in the creation of systematic studies and blue ribbon panels, none of which are likely to report that they can guarantee that no threat exists and that it 6 This fear of cyberterror mirrors the fear of crime found in many studies during the past quarter century. (See Glassner ; Gerbner and Gross ; Altheide ) M. Stohl won’t grow larger in the future for fear of looking weak or contributing to a state of unpreparedness (see Barnett ). In the cyber terrorism realm, Richard J. Clarke emerged from bureaucratic obscurity and became a media favorite when he resigned from and authored his critique of the Bush administration’s handling of the terrorism threat. Clarke, who had long been acknowledged within Washington as a capable bureaucratic infighter, had for many years regularly referenced the threat of an electronic Pearl Harbor at budget time and kept the issue “boiling” during much of the rest of the year.7 After 9/11 Clarke incorporated the concept of the post 9/11 world to continue to advance his agenda. Thus Weimann :133) argues that “Following an October 2001 meeting with high-tech executives, including several from the security firm Network Associates, President Bush appointed Richard Clarke as his first special advisor on cyberspace security. After 11 September, Clarke created for himself the position of cybersecurity czar and continued heralding the threat of cyberattack. Understanding that in Washington attention leads to resources and power, Clarke quickly raised the issue’s profile. “Dick has an ability to scare the bejesus out of everybody and to make the bureaucracy jump,” says a former colleague.” After another of the Clarke briefings, Squitieri , writing in USA today wrote: The vast array of potential targets and the lack of adequate safeguards have made addressing the threat daunting. Among the recent targets that terrorists have discussed, according to people with knowledge of intelligence briefings: & & & & & & The Centers for Disease Control and Prevention, based in Atlanta. It is charged with developing the nation’s response to potential attacks involving biological warfare. The nation’s financial network, which could shut down the flow of banking data. The attack would focus on the FedWire, the money-movement clearing system maintained by the Federal Reserve Board. Computer systems that operate water-treatment plants, which could contaminate water supplies. Computer networks that run electrical grids and dams. As many targets as possible in a major city. Los Angeles and San Francisco have been mentioned by terrorists, intelligence officials say. Facilities that control the flow of information over the Internet. Richard Clarke, the White House special adviser on cybersecurity, says such sites, of which there are 20 to 25, are “only secure in their obscurity.” For example see Ryter . “You might say 1999 – the year of the Y2K fears – was ‘the year of the Clarke.’ For a very brief period, Clarke became a second tier player with a first string chorus – but only because it served the interests of the Clinton–Gore Administration to promote Clark’s fantasies about cyberarmageddon. It helped Clinton and the liberals in Congress push through a legislative agenda that likely could never have been enacted without the Y2K fantasy fodder fed by Clarke. And Clarke enjoyed the limelight.” “Can we trust the guy who gave us Y2K??” Jon Christian Ryter March 27, 2004 NewsWith Views.com. Retrieved on February 1, 2006 from http://www.newswithviews.com/Ryter/jon28.htm and George Smith Crypt Newsletter 1999 Like old Jacob Marley, Richard Clarke – the broken record of the National Security Council – is produced to rattle his electronic chains and howl menacingly for the rubes. “... Richard A. Clarke of the National Security Council, repeatedly warns them that ‘cyberterrorists’ could launch computer attacks ‘shutting down a city’s electricity, shutting down 911 systems, shutting down telephone networks and transportation systems,’ as he said in a recent interview.” http://www.soci.niu.edu/~crypt/other/ harbor.htm 7 Cyber terrorism & & The nation’s communications network, including telephone and 911 call centers. Air traffic control, rail and public transportation systems. But it was not simply Richard Clarke who was interested in the use of the cyber terror threat within the Bush administration. Stanton (:1020) recounts the story of the Code Red Scare in the July–August 2001 period. He characterizes the campaign as “an example of either an ongoing government disinformation campaign designed to demonize the Internet and frighten the public or just plain government ignorance and fear of how the Internet might be used by the public.” (W. Madsen, personal communication, June 2001)8 Hidden agendas Further, there are also many security firms that have services to sell which are designed to protect us from “them.” Since 1997 the Computer Security Institute (CSI) has produced an annual survey which “documents” the increasing number of attacks against corporate networks and the increasing dollars placed at risk because of these attacks. The Institute asks respondents to report on various security issues and to estimate the costs of protection and the costs of the attacks. These include various forms of system penetration from the outside, detected denial of service attacks, and detected computer viruses. Despite numerous methodological problems (including a non-random sample of respondents), CSI has been particularly adept at obtaining widespread media coverage. The media, for their part, report but do not evaluate the methodology or the calculations. In addition other security firms have been quick to build upon the survey for their own benefit. After this year’s release the following appeared: IBM has released a new product that tackles internal network security threats... In a 2005 survey by the FBI and US Computer Security Institute it was found that 56% of US firms had reported internal security breaches . and there followed software fixes advertised by other enterprising organizations. As has been noted many times (see e.g., Weimann , Green , Flemming and Stohl ) there are many incentives for security firms to advertise vulnerabilities and sell “solutions” as the number of digital users increases and the importance of digital transactions expands to every sector of our daily lives. Patriot games As with the exploitation of legitimate and expanding concerns with digital transactions in the private sector, there are also opportunities beyond simply improving bureaucratic material and influence resources within the governmental sector. As with the debates about national security during the cold war, the discussion about cyber security also involves 8 Stanton continues “Why the Code Red Scare? Well, maybe its just coincidence, but sometime over the next couple of months President Bush is expected to issue a new Executive Order on Cybersecurity and, of course, the new budget cycle starts. He will appoint an interagency cybersecurity and Continuity of Operations Board. Soon after the hype surrounding Code Red, [then head of the] National Information Infrastructure Protection Commission, Ron Dick, got a jump start on things with a press conference on cybersecurity at the National Press Club. Hyping Code Red was a sure fire way to ensure the conference was covered by all the talking head networks. And it didn’t hurt that Code Red provided a convenient backdrop while then-FBI Director designate Robert Mueller was fielding some questions during his Senate conformation hearings on what the FBI will do on cybersecurity during his watch.” M. Stohl some misinformation (also called disinformation within the foreign policy realm) and exploitation of fears and risk. After 9/11 the discussion of cyber security and cyber terrorism has been no exception. Much investigation and analysis has been conducted with respect to the development of the Bush administration case against Iraq as a justification to declare war in 2003, and in addition to its case with respect to WMD it is important to remember there was also an attempt to tie Saddam Hussein to Al Qaeda and the “Global terror network.” Those terror ties were not limited only to what many refer to as the BTKP (Break things, kill people) forms of terrorism (see ). Some “packaged” Saddam and Hussein within the cyber frame. In the Fall of 2001 when the Bush administration began to trumpet the connection between Saddam Hussein and Al Qaeda, Joshua Dean reported the assertions of terrorism analyst Yonah Alexander of the Potomac Institute connecting Iraq and cyber terrorism. Iraq has quietly been developing a cyber arsenal called Iraq Net since the mid-1990s. Alexander said it consists of a series of more than 100 Web sites located in domains throughout the world. Iraq Net, he said, is designed to overwhelm cyber-based infrastructures by distributed denial of service and other cyber attacks. “Saddam Hussein would not hesitate to use the cyber tool he has,” Alexander said. “It is not a question of if but when. Like the assertions of Iraq’s cache of WMD, the existence of Iraq Net has yet to be proven (:134).9 Six months later FBI officials and Richard Clarke discussed their fears that Al Qaeda would employ the web as a “Tool of Bloodshed.” Gellman  reported, “Cyber-Attacks by Al Qaeda Feared, Terrorists at Threshold of Using Internet as Tool of Bloodshed, Experts Say.” And the media, when they report the possibilities raised by various governmental officials, bureaucrats as well as elected officials, don’t necessarily discriminate between those threats which are possible and/or possible and those which are not. These articles persistently remind the public of the continued danger of, and the lack of preparations to defend against, cyber attacks and the continuing emergence of ever greater threats, even while all the old threats such as a digital Pearl Harbor never disappear. As Weimann (:132) reminds us, they also frequently fail to distinguish between hacking and cyber terrorism and exaggerate the threat of the latter by reasoning from false analogies such as the following: “If a 16-year old could do this, then what could a well-funded terrorist group do?”10 9 “Until recently, Ridge has seemed basically levelheaded about the real dangers of cyberterrorism. Someone who’s close to Ridge told me that the secretary simply doesn’t care that much about the topic, which would explain his silence. But now that agency budgets are up for review, Ridge seems to be treading the same alarmist path as did his former cybersecurity deputy, Richard Clarke, who quit in January. Clarke was a professional paranoiac, a modern-day Chicken Little blinkered by a career spent in the cloistered intelligence community. It didn’t help that Clarke’s résumé featured such harrowing tasks as planning for the ‘continuity of government’ after a nuclear strike on Washington – a job where no precaution is too extreme. Soon after President Clinton appointed him to a ‘national coordinator’ post in 1998, Clarke became infamous for darkling warnings about the spectre of a ‘digital Pearl Harbor’ that would snarl computers and roil the world’s economy.” Declan McCullagh Cyberterror and professional paranoiacs March 24, 2003 retrieved on 1 February 2006 from http://www.crime-research.org/news/2003/03/Mess2502.html 10 See also Lemos et al. . It is also useful to recognize that all “cyberspace-based threats.” are not terrorism. Rand analysts Hundley and Anderson (:1) consider these as, “adverse actions involving and mediated by computer and telecommunications systems and networks.” Accordingly, there are a wide spectrum of possibilities for “evil actions” in cyberspace. “These include attacks on the data contained within the systems, the programs and processing hardware running those systems, and the environment (communications, networks, etc.) in which they operate” (:12). Cyber terrorism There can be no denial that the continuing expansion of the role of cyber activities in every dimension of organizational and personal life creates both increasing possibilities of potential harm and continuing pressures to alleviate potential threats and opportunities for harm. The increasingly digital environment has and will continue to transform how people interact, how they maintain connections, form groups and organize. Digital technologies thus offer contemporary terrorists and terrorist organizations a wide range of opportunities to support their campaigns of violence and if they are proficient, significantly further their political objectives.11 Therefore, some label any use of digital technology by terrorist organizations as cyber terrorism; some are even more expansive and label any use of digital networks which can damage critical infrastructure as terrorism. For example, Weimann (: 130) argues that Cyber terrorism is “the use of computer network tools to harm or shut down critical national infrastructures (such as energy, transportation, government operations).” However, this expansive definition does not serve us well. It still remains important that we distinguish among cyber terror, cyber attack, and cyber crime as well as many other possibilities. Rollins and Wilson (: 3) argue that At least two views exist for defining the term Cyber terrorism: Effects-based: Cyber terrorism exists when computer attacks result in effects that are disruptive enough to generate fear comparable to a traditional act of terrorism, even if done by criminals. Intent-based: Cyber terrorism exists when unlawful or politically motivated computer attacks are done to intimidate or coerce a government or people to further a political objective, or to cause grave harm or severe economic damage. I would maintain that it continues to be very important to distinguish between cyber crime and cyber terror and that we restrict cyber terrorism to activities which in addition to their cyber component have the commonly agreed upon components of terrorism. In previous work (, forthcoming) I have argued that all the definitions include some form of intimidate, coerce, influence as well as violence or its threat. To illustrate, Stohl (:3) defines terrorism as The purposeful act or the threat of the act of violence to create fear and/or compliant behavior in a victim and/or audience of the act or threat.12 11 In addition, using the web, while it provides additional organizational opportunities, also introduces potential threats. As Conway (:20–21) argues The more terrorist groups use the Internet to move information, money, and recruits around the globe, the more data that is available with which to trail them. Since 9/11 a number of groups have undertaken initiatives to disrupt terrorist use of the Internet, although a small number of such efforts were also undertaken previous to the attacks. .. Perhaps most importantly, however, the Internet and terrorist Web sites can serve as a provider of open source intelligence for states’ intelligence agencies. Although spy agencies are loathe to publicly admit it, it is generally agreed that the Web is playing an ever-growing role in the spy business. In addition Warner argues that Intelligence agencies are also said to be deploying the classic spy tactic of establishing so-called ‘honey pots’ with a high-tech twist: in this case, setting up bogus Web sites to attract those people they are seeking to monitor (Warner ). 12 Similarly the United States Department of State since 1983 has the same elements but restricts the target to noncombatants and the perpetrators to subnational groups or clandestine agents Premeditated, politically motivated violence perpetrated against noncombatant* targets by subnational groups or clandestine agents, usually intended to influence an audience.” M. Stohl Thus, there is no good theoretical or practical argument for rejecting the approach advocated by Denning  who argued that: Cyber terrorism is the convergence of terrorism and cyberspace. It is generally understood to mean unlawful attacks and threats of attack against computers, networks, and the information stored therein when done to intimidate or coerce a government or its people in furtherance of political or social objectives. Further, to qualify as cyber terrorism, an attack should result in violence against persons or property, or at least cause enough harm to generate fear. Attacks that lead to death or bodily injury, explosions, plane crashes, water contamination, or severe economic loss would be examples. Serious attacks against critical infrastructures could be acts of cyber terrorism, depending on their impact. Attacks that disrupt nonessential services or that are mainly a costly nuisance would not.13 As indicated above, scholarly analyses of cyber terrorism, as opposed to sensational news stories and futurist scenarios concur that at present cyber terrorist events as defined by Denning have yet to occur. But there is no doubt that cyber technology has dramatically influenced how terrorists may choose to organize, communicate amongst themselves and transmit their messages. Conway (:3) argues that there are five core terrorist uses of the Internet: information provision, financing, networking, recruitment, and information gathering. Grabosky and Stohl  cite intelligence, communications, propaganda, psychological warfare, fund raising, recruitment and training, while Thomas  identifies 16 different ways that the internet can be used for cyber planning and organizational activities which offer further elaborations of the uses mentioned above. In short, terrorist groups increasingly use computer technology (as many political, commercial and criminal entities do) to secure many of their organizational goals.14 It is to be expected that organizations will adopt those aspects of digital technology that will enable them to operate and grow with a greater degree of efficiency. In this sense, terrorist groups are simply exploiting modern tools to accomplish the same goals they sought in the past. Terrorist thus might employ digital technologies to enhance ease of operations; information acquisition and distribution; and increase the ease of anonymous communication. None of these activities are easily detected or countered (but as we shall see below, they do lead to other interesting counterterrorism and information gathering possibilities) and therefore 13 See also Bruce Schneier, Beyond Fear: Thinking Sensibly about Security in an Uncertain World (New York: Copernicus Book 2003); Joshua Green, “The Myth of Cyberterrorism,” Washington Monthly, November 2002, available at (http://www.washingtonmonthly.com/features/2001/0211.green.html);Andrew Donoghue “Cyberterror: Clear and present danger or phantom menace?,” ZDNet, 2004, available at (http://insight.zdnet.co.uk/ specials/networksecurity/0,39025061,39118365-2,00.htm).Lewis, James, “Assessing the Risk of Cyber Terrorism, Cyber War and Other Cyber Threats” (Washington,DC: Center for Strategic and International Studies, December 2002), available at (http://www.csis.org/ tech/0211_lewis.pdf) and Dorothy Denning, “Is Cyber Terror Next?” In Understanding September 11, edited by C. Calhoun, P. Price, and A. Timmer (2001), available at ( http://www.ssrc.org/sept11/ essays/denning.htm). 14 The Report of the National Commission on Terrorism (:12) concurs suggesting that “[t]errorists are using the same modern technology as the rest of us....” Likewise, Denning  argues Terrorists do use cyberspace to facilitate traditional forms of terrorism such as bombings. They put up Web sites to spread their messages and recruit supporters, and they use the Internet to communicate and coordinate action. However, there are few indications that they are pursuing cyber terrorism, either alone or in conjunction with acts of physical violence. Cyber terrorism terrorist groups may use digital technology to great advantage in furthering their tactical and strategic goals on a more global as well as local basis.15 Specific examples of the facilitation of terrorism through the use of digital technology illustrate the appeal this technology has for terrorist groups interested in advancing their particular agendas. The use of the Internet for propaganda and disinformation purposes is an especially popular one. Rathmell recounts the exploitation of the web by exiled political opposition groups emanating from such states as Iran, Iraq, Mexico, Northern Ireland and Saudi Arabia (:4–5). In Western Europe and the United States, Neo-Nazi groups  have been major users of the web as have the Colombian ELN, Hezbollah and Zapatistas (:1) all of whom have also adopted similar tactics.16 Broadcasting videos via web sites has become a favorite tool. One of the first examples involved the December, 1996 takeover of the Japanese Ambassador’s residence in Lima, Peru by the Tupac Amaru Revolutionary Movement (MRTA). The MRTA not only employed the Web to communicate their revolutionary message via a European website, they even offered a video clip of its members preparing for their mission (:216).17 More recently, groups have added even the most gruesome videos to their websites, to horrifying effect. The beheadings of Wall Street Journal Reporter Daniel Pearl in February 20-04 and Nick Berg, an American seeking employment in Iraq in May 2004, were broadcast via videos posted on Islamic Web sights and then broadcast and reported via the mainstream media. In August 2005, the self proclaimed “Jihad Brigades in Palestine” claimed missile attack on a Jewish settlement in Gaza by posting a video to a German server that allows visitors to upload materials and also shows apparent members setting up a missile, readying it for launch and firing it off.18 The Web thus enables sometimes previously anonymous groups to establish a presence and perhaps exploit their activities far beyond the impact of previous terrorist organizations with far less danger. Thomas (: 115–116) argues that the Web thus empowers small groups and makes them appear much more capable than they might actually be, even turning bluster into a type of virtual fear. The net allows terrorists to amplify the consequences of their activities with follow-on messages and threats directly to the population at large, even though the terrorist group may be totally impotent. In effect, the Internet allows a person or group to appear to be larger or more important or threatening than they really are.” When mainstream news then incorporates the reporting of events via these web sites, they also often then repeat the major themes of their campaigns and thus increase the propaganda message’s reach. Organizations employing terrorism have also brought materials which in the past could only be distributed clandestinely and often with much danger to the attention of not only current members but future recruits and anyone else who might “benefit” from the 15 As early as the 1998 (1999:17) report on terrorism in the United States, the Federal Bureau of Investigation finds: “Terrorists are known to use information technology and the Internet to formulate plans, raise funds, spread propaganda, and communicate securely.” 16 In the case of the Zapatistas, group of supporters called the Electronic Disturbance Theater (EDT) have used the Internet stage disturbances as a means of on-line protest (, 2). 17 Internet sites were also established in Canada and the United States in support of the MRTA’s activity (Anti-Defamation League :1). 18 See http://www.adl.org/main_Terrorism/jihad_brigades_80805.htm M. Stohl destructive capabilities which are taught. Thus, training videos featuring instructions on how to build explosive devices and prepare gunpowder have recently appeared on several Web sites regularly used by militant Islamic groups. These sites also feature tips on money laundering and many other organizational needs.19 Some organizations also use the web to provide recruitment videos. Thus Al Qaeda in Iraq, an Al Qaeda affiliated terrorist group led by Abu Musab al-Zarqawi, posted the second edition of its recruitment magazine on the Internet in June 2005 (see http://www.adl.org/ main_Terrorism/qaedamag_2_62005.htm).20 Terrorist groups using computers for communication are likely to move beyond hierarchical organizational structures and employ networked ones.21 The foregoing notwithstanding, we must reemphasize the conclusions of Denning , Flemming and Stohl  and subsequently Weimann (:133) that “Terrorist use of computers as a facilitator of their activities, whether for propaganda, recruitment, datamining, communication, or other purposes, is simply not cyber terrorism.” Focusing upon the types of activities that the cited authors above would argue fall under the rubric of cyber terrorism, such as attacks on critical infrastructure it is important to investigate the conditions under which terrorists would choose to employ digital means to advance their cause over conventional methods. Denning  suggests that To understand the potential threat of cyber terrorism, two factors must be considered: first, whether there are targets that are vulnerable to attack that could lead to violence or severe harm, and second, whether there are actors with the capability and motivation to carry them out. To determine motivation we have to ask not simply if they desire to cause harm and exploit fear but also if the investments needed to create the event are more or less “costly” than traditional means of terror. An expected utility approach provides useful insights into the process of understanding why oppositional organizations might choose not only terrorism as a tactic or strategy and which groups are more likely to do so as well as the conditions under which it would make sense (from their perspective) to employ digital rather than conventional tools to accomplish their ends. Duvall and Stohl  argued that that an expected utility model is useful for understanding the choice of terrorism as a tactic or strategy in domestic affairs and Stohl  argued that it could be applied to behaviors in the international realm as well. Such an approach calculates the benefit thought possible from the desired outcome, the believed probability with which the action will bring about the desired state of affairs and the believed probable cost of engaging in the action. Two kinds of costs, response costs and productions costs, can be distinguished. Response costs are those costs which might be imposed by the target group and/or sympathetic or offended bystanders. The bystanders 19 (See http://abcnews.go.com/WNT/IraqCoverage/story?id=766276&page=1 and http://www.pbs.org/wgbh/ pages/frontline/shows/front/special/tech.html). 20 For many other earlier examples see Damphousse and Smith ; Arquilla et al. :91–92, Stanton  for many other examples. 21 See Arquilla, Ronfeldt and Zanini  for a detailed discussion of this point especially as it relates to Al Qaeda and Stohl and Stohl (, forthcoming) on network research on terrorism since 2001. Cyber terrorism may include domestic and foreign audiences and the target audience may be wider than the attacking party may have intended when choosing the victims and the actions. Production costs are the costs of taking the action regardless of the reactions of others. In addition to the economic and organizational costs – paying the participants, acquiring the weapons and the like, there is the psychological cost of behaving in a manner which most individuals would, under normal conditions, characterize as unacceptable behavior. More recently Giacomello (:390) argued: The terrorists are faced with budget constraints that depend on the cost of cyber terrorism and other activities. Assuming that terrorists are rational actors, the shape of the indifference curve is determined by (a) the preferences of terrorists and also (b) the effectiveness of cyber terrorism in achieving the terrorists’ goals. The moment of calculating costs, risks, and advantages is the focus of this analysis, supposing that a terrorist organization is about to consider cyber terrorism as a more efficient alternative compared, for example, with suicidal bombs. Thus as Flemming and Stohl  argued: “at one level, the use of cyber technology for inflicting harm on a victim requires a greater level of sophistication than merely using the same technology for communication or propaganda. Not only, must there be some level of expertise in translating the “raw” cyber technology into a weapon of destruction, there must be a recognition that the effectiveness of this alternative supersedes conventional options. Simply stated, a cyber attack against an opponent should produce similar or greater results22 for less effort than a conventional one.23 In other words we are asking if the cyber disruption of an air traffic control system (with the intent of endangering civilian air traffic) can be undertaken with less effort, the same chances of detection, produce the same results and have a greater likelihood of success than an attack on the same system by conventional means (armed attack, or bombing), or a conventional attack that bypasses the air traffic control system in favor of a direct attack on an airliner? When the answer is yes, there is room to believe that cyber terrorism would be a rational choice of terrorist groups. When the answer is no, terrorists would be more likely to remain tied to their traditional methods. Denning  argues Further, terrorists may be disinclined to try new methods unless they see their old ones as inadequate, particularly when the new methods require considerable knowledge and skill to use effectively. Terrorists generally stick with tried and true methods. Novelty and sophistication of attack may be much less important than assurance that a mission will be operationally successful. Indeed, the risk of operational failure could be a deterrent to terrorists. For now, the truck bomb poses a much greater threat than the logic bomb. 22 23 These can be thought of as a greater degree of terror or longer lasting fear on the part of the victim. Less effort is defined in terms of fewer resources, less manpower and quicker/easier planning, all of which should translate into reduced risk/greater likelihood of logistical success. M. Stohl The second consideration influencing the choice of cyber means is tied to its ability to effectively terrorize an opponent.24 Embar-Seddon (:1038) argues As a terrorist tactic, cyber terrorism differs from the more traditional tactics, which entail a more direct threat of violence. However, the directness of the threat of violence does not correspond to the level of fear that an action creates, and it is the fear that a terrorist act engenders that is important. In this respect, cyber terrorism can be at least as terrifying as the more traditional terrorist tactics. The level of fear that would result from the threat of shutting down a large portion of the power grid would very likely be as great as, if not greater than, the level of fear that would result from the threat of downing an airliner. However, people react very differently to the downing of an airliner which often provides and easily conjures up images of death and destruction far different than the images of shutting down a power grid. We also have “real world” reactions to the shutting down of power grids that have occurred. The outpouring of emotions is very different than what occurs when for example an airliner crashes (regardless of the cause). The failure of the entire northeast power grid in 1965, for example, did not lead to widespread fear and anger. Nor did the Northeast blackout of 2003 despite the initial concern that it had been caused by terrorists.25 The same response occurred in 2003. Cyber terror was at first suspected in the 2003 Northeast blackout. The cause turned out to be incompetence and falling trees. The widespread blackout did not degrade U. S. military capabilities, did not damage the economy, and caused neither casualties nor terror . From the audience perspective then the taking down of a power grid – what happens in a blackout – is not likely to cause the same type of immediate fear and emotion and conjures up very different images than does a plane crash or the bombing of buildings. Further we have evidence from experimental work that people react very differently to different types of events depending upon the types of emotions that these events instill in them. Nabi  argues “Results suggested that anger promotes deeper information 24 As Giacomello (:391) argues Professional military around the world are used to judge the effectiveness of weapons systems according to the “break things, kill people” principle. Projectiles or germs, kinetic or chemical– biological agents are normally required to achieve a BTKP outcome. He then goes on to argue that Under certain circumstances, however, even employing bytes (the basic units of all CNO) may lead to the same results. If CNO target the critical application software of certain infrastructures, they may well yield a BTKP outcome.... If the main outcome of those attacks had been the SCADA (Supervisory Control and Data Acquisition) management systems of critical infrastructure, the potential physical damage would have been considerable. However, thus far, there is no conclusive evidence that this is indeed possible. 25 The 1965 blackout in fact led to a sense of community and was the subject of many humorous tales including the 1968 Hollywood film Where Were You When the Lights Went Out? Cyber terrorism processing than fear, and a main effect for reassurance certainty level, with uncertainty promoting deeper information processing.” And Lerner et al.  found that respondents exposed to a fear-inducing manipulation assigned, on average, a higher probability to five negative consequences of terror than did respondents exposed to an anger-inducing manipulation. The specter of the grid blowing up, bombs falling, etc., might create that fear but not the throwing of a switch. The effects would be the same but it would be a different type of act. With the growing interconnectedness of infrastructures relying on cyber technology, the targeting selection of cyber terrorism is likely to be significantly influenced by those targets that allow for a maximum level of disruption. The same, however, is not necessarily true with respect to the mode of attack. Cyber technology allows for an additional variable to be introduced into tactical equations, but clearly represents a single choice in terms of overall modes of operation. Furthermore, Denning  argues that Cyber terrorism also has its drawbacks. Systems are complex, so it may be harder to control an attack and achieve a desired level of damage than using physical weapons. Unless people are injured, there is also less drama and emotional appeal. Thus we must ask what else might be inhibiting terrorist groups from doing so beyond the simple cost benefit analysis. Part of the answer lies in their understanding of audience reactions. Many of these groups, such as Al Qaeda, are quite sophisticated in terms of their understanding of audience reactions and use their resources with great calculation.26 Conclusion: breaking point or without remorse? assessing the cyber terror threat Speaking to the Special Oversight Panel on Terrorism of the Committee on Armed Services of the U.S. House of Representatives Dorothy Denning  concluded: Thus, at this time, cyber terrorism does not seem to pose an imminent threat. This could change. For a terrorist, it would have some advantages over physical methods. It could be conducted remotely and anonymously, and it would not require the handling of explosives or a suicide mission. It would likely garner extensive media coverage, as journalists and the public alike are fascinated by practically any kind of computer attack. Indeed cyber terrorism could be immensely appealing precisely because of the tremendous attention given to it by the government and media. 26 This sophisticated audience analysis is seen in the letter sent in July 2005 by Ayman al-Zawahri, purportedly the number 2 in al Qaeda to Abu Musab al-Zarqawi, leader of the organization now named al Qaeda in Iraq. In the absence of this popular support, the Islamic mujahed movement would be crushed in the shadows, far from the masses who are distracted or fearful, and the struggle between the Jihadist elite and the arrogant authorities would be confined to prison dungeons far from the public and the light of day. This is precisely what the secular, apostate forces that are controlling our countries are striving for. These forces don't desire to wipe out the mujahed Islamic movement, rather they are stealthily striving to separate it from the misguided or frightened Muslim masses.....Therefore, the mujahed movement must avoid any action that the masses do not understand or approve, if there is no contravention of Sharia in such avoidance, and as long as there are other options to resort to, meaning we must not throw the masses-scant in knowledgeinto the sea before we teach them to swim. M. Stohl Thus far as indicated above, terrorists either continue to find the allure of cyber terrorism unappealing or they remain incapable of mounting significant attacks. Yet the fear of cyber terror remains and the willingness of the authorities and the private sector to use the fear of potential catastrophic harm.27 Part of the explanation lies in the continuing failure to distinguish between what Denning  referred to as hactivism and cyberterrorism. “Hacktivism,” describes the marriage of hacking with political activism. (“Hacking” is here understood to mean activities conducted online and covertly that seek to reveal, manipulate, or otherwise exploit vulnerabilities in computer operating systems and other software.) Hacktivists have four main weapons at their disposal: virtual sit-ins and blockades; automated e-mail bombs; web hacks and computer break-ins; and computer viruses and worms. Arquilla and Ronfeldt further muddy the waters with their concept of netwar, which they defined originally (1996: 5) as conflict and crimes at societal levels that are measures short of war or protagonists who rely on network forms of organization, doctrine, strategy and communication. Thus many then confuse more general organizational uses of digital technology with acts of terror. This confusion continues to this day as the following headline and introductory paragraph in the aftermath of the Danish cartoon controversy illustrates Cyber Terrorists Target Danish Websites Peter Diversi – Thursday, 9 February 2006 The cyber terrorists have defaced over 500 Danish Websites, however Danish Internet security companies say the Website owners are fighting back relatively easy. Cyberspace is a new front to attack; a form of protest by what a Danish Internet security expert called “scriptkiddies.” These scriptkiddies, who could be compared to the incensed rock-hurlers seen in real-life protests, attack Websites with weak security. Finally, the spectre of the digital Pearl Harbor remains. On the same day as the Danish cartoon story above, news stories across the United States, Australia, Canada and the U.K. reported the lead that the Department of Homeland Security had provided: – It had the makings of a “digital Pearl Harbor (my emphasis),” a potentially catastrophic computer attack that crossed oceans and continents to target governments, companies and the infrastructure that underpins them . The debate will continue with respect to the degree of cyber threat that actually exists today, or in the near future. The confusion between cyber criminal activity and cyber terror 27 Schwarts, 2003 New vulnerabilities that could leave the way open to a cyberattack are being discovered all the time: according to Symantec, one of the world’s corporate leaders in the field of cyber security, the number of “software holes” (software security flaws that allow malicious hackers to exploit the system) reported in the nation’s computer networks grew by 80 percent in 2002. Still, the company says it has yet to record a single cyberterrorist attack – by its definition, one originating in a country on the State Department’s terror watch list. That could be because those inclined to commit terrorist acts do not yet have the know-how to inflict significant damage, or perhaps because hackers and adept viruswriters are not sympathetic to the goals of terrorist organizations. However, should the two groups find common ground, the results could be devastating. Cyber terrorism will also continue. Future events will determine the costs of this confusion. There is no doubt that cyber criminals will become more sophisticated and, in the absence of continuing investments in cyber security, will cause more damage. But in the meantime how we prepare, and how we talk about our preparations are important. Building defenses against criminals and terrorists are essential. But we must remember that generating an unwarranted fear of potential attack, even while preparing to defend against it, serves the cause of the terrorist even if the security precautions are ultimately successful. Unlike the criminal who simply wishes to succeed in their operations, the terrorist also wishes to undermine confidence in the political structure and create difficulty within the body politic. References 1. Altheide, D. (1997). The news media, the problem frame and the production of fear. The Sociological Quarterly, 38(4), 647–668. 2. Anti-Defamation League (1999). CyberTerrorism – Terrorism update. Retrieved March 1, 2006, from http://www.adl.org/terror/focus/16_focus_a.asp. 3. Arquilla, J., Ronfeldt, D., & Zanini, M. (1999). Networks, netwar and information-age terrorism. In Z. M. Khalilzhad & J. P. White (Eds.), The changing role of information in warfare. Santa Monica, CA: Rand. 4. Barnett, R. J. (1973). Roots of war: The men and institutions behind U.S. foreign policy. Baltimore: Penguin Books. 5. Conway, M. (2005). Terrorist “use” of the internet and fighting back. Paper prepared for presentation at the conference Cybersafety: Safety and security in a networked world: Balancing cyber-rights and responsibilities. Oxford Internet Institute (OII), Oxford University, UK, 8–10 September, 2005. Retrieved February 1, 2006, from http://www.oii.ox.ac.uk/research/cybersafety/extensions/pdfs/papers/ maura_conway.pdf. 6. Damphousse, K. R., & Smith, B. L. (1998). The internet: A terrorist medium for the 21st century. In H. W. Kushner (Ed.), The future of terrorism: Violence in the new millennium. Thousand Oaks, CA: SAGE. 7. Debrix, F. (2001). Cyberterror and Media-Incluced fears: The production of emergency culture, Strategies: Journal of Theory, Culture and Politics, 14(1), 149–168. 8. Denning, D. E. (1999). Activism, hacktivism, and cyber terrorism: The internet as a tool for influencing foreign policy.” Presented to “The Internet and International Systems:Information Technology and American Foreign Policy Decision Making,” The World Affairs Council, San Francisco, December 10, 1999. Retrieved February 1, 2006, from http://www.rand.org/pubs/monograph_reports/MR1382/ MR1382.ch8.pdf. 9. Denning, D. E. (2000). Cyberterrorism. Testimony before the Special Oversight Panel on Terrorism Committee on Armed Services U.S. House of Representatives, May 23, 2000. Retrieved February 1, 2006, from http://www.cs.georgetown.edu/~denning/infosec/cyberterror.html. 10. Duvall, R. D., & Stohl, M. (1983). Governance by terror, chapter six. In M. Stohl (Ed.), The politics of terrorism (2nd ed., pp. 179–219). New York: Marcel Dekker. 11. Embar-Seddon, A. (2002). Cyber terrorism: Are we under siege? American Behavioral Scientist, 45(6), 1033–1043. 12. Flemming, P., & Stohl, M. (2001). Myths and realities of cyber terrorism. In A. P. Schmid (Ed.), Countering terrorism through international cooperation (pp. 70–105). Vienna, Austria: ISPAC (International Scientific and Professional Advisory Council of the United Nations Crime Prevention and Criminal Justice Program. 13. Gellman, B. (2002). Cyber-attacks by Al Qaeda feared: Terrorists at threshold of using internet as tool of bloodshed, experts say,” Washington Post June 27: A01. Retrieved December 1, 2005, from http://www. washingtonpost.com/ac2/wp-dyn/A50765-2002Jun26. 14. Gerbner, G., & Gross, L. (1976). The scary world of tv’s heavy Viewer. Psychology Today, 89–91, April. 15. Giacomello, G. (2004). Bangs for the buck: A cost-benefit analysis of cyber terrorism. Studies in Conflict and Terrorism, 27, 387–408. 16. Glassner, B. (1999). The culture of fear: Why Americans are afraid of the wrong things. New York: Basic Books. 17. Grabosky, P. N., & Stohl, M. (2003). Cyberterrorism Reform 82, Autumn:8–13. Retrieved September 15, 2005 from http://www.alrc.gov.au/reform/summaries/82.htm. M. Stohl 18. Green, J. (2002). The myth of cyber terrorism. Washington Monthly, November. Retrieved February 1, 2006, from http://www.washingtonmonthly.com/features/2001/0211.green.html. 19. Hoffman, L. (2006). ‘Cyber Storm’ simulation aims to head off computer assault, February 9, 2006. Retrieved March 1, 2006, from http://shns.abc15.com/shns/story.cfm?pk=CYBERSTORM-02-0906&cat=WW. 20. Hundley, R. O., & Anderson, R. H. (1996). A qualitative methodology for the assessment of cyberspacerelated risks. Santa Monica: Rand. 21. Lemos, R., Borland, J., Bowman, L., & Junnarkar, S. (2002). E terrorism-threats. Have Digital Myths Diverted Attention from True Threats?” CNET News.com. Retrieved August 26, 2002, from http://news. com.com/E-terrorism+Digital+myth+or+true+threat/2009-1001_3-954728.html?tag=nl. 22. Lenzner, R., & Vardi, N. (2004). Cyber-nightmare. Forbes. Retrieved September 20, 2004, from http:// www.forbes.com/global/2004/0920/104_print.html. 23. Lerner, J. S., Gonzalez, R. M., Small, D. A., & Fischhoff, B. (2003). Emotion and perceived risks of terrorism: A national field experiment. Psychological Science, 14, 144–150. 24. Lewis, J. A. (2006). The war on hype: The deadly terror lurking around the corner may not be such a big, ominous threat after all. San Francisco Chronicle, February 19, 2006. Retrieved March 1, 2006, from http://www.sfgate.com/cgi-bin/article.cgi?file=/chronicle/archive/2006/02/19/INGDDH8E2V1.DTL. 25 Nabi, R. L. (2002). Anger, fear, uncertainty, and attitudes: A test of the Cognitive-Functional Model. Communication Monographs, 69(3), 204–216. 26. National Commission on Terrorism. (1998). Countering the Changing Threat of International Terrorism. Report of the National Commission on Terrorism, http://www.fas.org/irp/threat/commission.html. 27. Rathmell, A. (1997). Cyber-terrorism: The shape of future conflict. Royal United Service Institute Journal. October, 40–46. Retrieved March 1, 2006, from http://www.kcl.ac.uk/orgs/icsa/Old/rusi.html. 28. Rollins, J., & Wilson, C. (2005). Terrorist capabilities for cyberattack: Overview and Policy Issues, Congressional Research Service, October 20, 2005. Retrieved February 1, 2006, from http://www.fas. org/sgp/crs/terror/RL33123.pdf. 29 Ryter J. C. (2004). Can we trust the guy who gave us Y2K?? Jon Christian Ryter March 27, 2004 NewsWithViews.com retrieved on February 1, 2006 from http://www.newswithviews.com/Ryter/jon28. htm. 30. Savas, A. (2006). IBM launches internal network protection. Computer weekly. Com, Monday, 27 February 2006. Retrieved March 1, 2006, from http://www.computerweekly.com/Articles/2006/02/27/ 214429/IBMlaunchesinternalnetworkprotection.htm. 31. Schwartz, J. (2003). Decoding computer intruders. The New York Times, April 24, 2003. Retrieved March 1, 2006, from http://tech2.nytimes.com/mem/technology/techreview.html?res=9C02E3D71F3A F937A15757C0A9659C8B63. 32. Simpson, P. (2005). Don’t fear e-terror hype Computer Weekly March 7. Retrieved February 1, 2006, from http://www.computerweekly.com/Articles/2005/04/26/209612/Don’tfeare-terrorhype.htm. 33. Squitieri, T. (2002). Cyberspace full of terror targets , USA Today, May 5, 2002. Retrieved February 1, 2006, from http://www.usatoday.com/tech/news/2002/05/06/cyber-terror.htm. 34. Stanton, J. J. (2002). Terror in cyberspace terrorists will exploit and widen the gap between governing structures and the public. American Behavioral Scientist, 45(6), 1017–1032. 35. Stohl, M. (1986). The superpowers and international terrorism. In M. Stohl & G. Lopez (Eds.), Government violence and repression: An agenda for research. Greenwood Press, 207–228. 36. Stohl, M. (1988a). Demystifying terrorism: The myths and realities of contemporary political terrorism. In M. Stohl (Ed.), The politics of terrorism (3rd ed.). New York: Marcel Decker. 37. Stohl, M. (2006). Knowledge claims and the study of terrorism. In S. Melnick & J. Victoroff (Eds.), Psychology and terrorism. Amsterdam, the Netherlands: Ios Press (forthcoming). 38. Stohl, C., & Stohl, M. (2007). Networks of terror: Theoretical assumptions and pragmatic consequences, Communication Theory. (forthcoming). 39. Thomas, T. L. (2003). Al Qaeda and the internet: The danger of “cyberplanning.” Parameters, 33(1), 112–23. Retrieved February 1, 2006, from Carlisle http://www.army.mil/usawc/Parameters/03spring/ thomas.pdf. 40. Warner, B. (2003). Intelligence experts comb web for terror clues. Reuters News Service, November 12. Retrieved March 1, 2006, from http://www.chron.com/disp/story.mp1/special/iraq/2218091.html. 41. US News and World Report. (1998). Terrorists on the web: Electronic ‘safe haven’ guerrillas use guns, bombs and home pages. 124(24), 46, June 22. 42. Weimann, G. (2005). Cyber terrorism: The sum of all fears? Studies in Conflict and Terrorism, 28, 129–149. 43. White, C., K., C. (1998). Cyber-terrorism: Modem mayhem. Carlisle Barracks, Pennsylvania: U.S. Army War College. Retrieved March 1, 2006, from http://stinet.dtic.mil/dticrev/a345705.pdf.
© Copyright 2020