Cyberterrorism

The term cyberterrorism was coined in the late twentieth century to denote security threats arising from acts of sabotage perpetrated via networked computers. Determining whether or not a cyberterrorist attack has ever taken place is controversial, because scholars, politicians, and members of the media do not always agree on what constitutes cyberterrorism. However, fears about cyberterrorism reached new heights after al-Qaeda’s terrorist attacks on the United States on September 11, 2001, and presidential administrations following George W. Bush's continued to claim protecting national cybersecurity as a major priority. Strategies concerning cybersecurity were consistently reassessed, especially after further high-profile cyberattacks such as those that occurred against the Democratic National Committee prior to the 2016 presidential election and against a crucial, large pipeline in 2021, among others. The chief advantages of cyberterrorism over traditional forms of terrorism are its inherent anonymity, the ability to do major damage from any distance to large areas or groups simultaneously, and the fact that it is relatively easy and inexpensive to carry out.

Background

The term cyberterrorism was coined in the 1980s by Barry Collin, a researcher at California’s Institute for Security and Intelligence. Since then, two predominate schools of thought on cyberterrorism have arisen. The first is represented by Dorothy Denning, a professor of computer science and an internationally renowned expert on information security. Denning has identified cyberterrorism as illegal and highly damaging attacks that target computers, networks, and digitally stored information for the purposes of causing harm to people or property or generating fear. The second school of thought includes the military, government officials, and others who define cyberterrorism as virtually any cyberattack that threatens computers and networks. Myriam Dunn-Cavelty, a security information expert and the head of Switzerland’s New Risks Research Unit at the Center for Security Studies, divides those who analyze cyberterrorism into “hypers”—those who believe that cyberattacks have occurred—and “de-hypers”—those who believe that no such attack has ever occurred.

The growth of personal computing in the 1990s made the World Wide Web available to individuals all over the world. Simultaneously, computer hackers began exploiting website and software security holes to gain access to information, chiefly targeting governments, banks, large corporations, academic institutions, and research centers. A 1991 report by the National Research Council and other agencies maintained in Computers at Risk: Safe Computing in the Information Age that cyberterrorists could wreak more havoc with a computer keyboard than with a bomb. In 2007 the Department of Homeland Security announced that more than 840 attempts had been made to hack into DHS computers over the past two years. Most of the DHS attacks involved failed attempts to access classified information.

Those like Denning who define cyberterrorism narrowly believe that cyberterrorism should not be confused with hacktivism, the term associated with computer hackers who insist they are motivated by politics rather than maliciousness or desire for financial gain. Activities carried out by hacktivists include denial of service (DoS) attacks, email attacks, hacking into computer networks to steal information and make it public, and destroying data through viruses and worms. Many would consider the activities of Wikileaks, the online organization founded by Australian Julian Assange that publishes secret information from anonymous sources, and Anonymous, a loose association of hackers who came to light after engaging in high-profile distributed DoS attacks, as hacktivism, not cyberterrorism.

Cyberterrorism Today

By the early twenty-first century, most nations acknowledged that the threat of cyberterrorism had become a major national security issue. Many were particularly alarmed about national power grids, which are especially vulnerable to cyberattacks and have the potential to cripple large areas if they go offline.

In a 2008 article for Information Security Journal: A Global Perspective, Jonathan Matusitz identifies seven types of cyberterrorist activity: destroying the machinery of an infrastructure, commandeering controls of nuclear power plants or hazardous waste facilities, using computers to control dams, hacking into power grids, using technology to commit sabotage, initiating protests that involve hacking into government computers, and compromising information illegally accessed through computers.

Incidences that are often cited as examples of cyberterrorist attacks include an incident in 1999 when NATO forces allegedly bombed the Chinese Embassy in Bombay by accident. In 2000, a Filipino man launched the so-called “Love Bug” virus that attacked the Pentagon, a number of government agencies, banks, and international corporations, causing millions of dollars in damages. Because the Philippines had no cyber laws, the perpetrator walked free. That same year, a disgruntled employee hacked into a local government system in Queensland, Australia, causing 264,000 gallons of raw sewage to contaminate rivers and parks.

The cyberterrorist attack usually identified as the event that focused international attention on cyberterrorism is the Stuxnet computer worm incident of July 2010. In what came to be known as “Iraq Net,” Iranian computers were hacked in order to destroy plutonium enrichment plants, thus hampering the country’s efforts to develop a nuclear bomb. It was widely rumored that the attacks were engineered through a joint effort between the United States and Israel. Allegedly, Iran responded by launching a cyberattack on US financial institutions. In 2007, the Eastern European nation of Estonia was hit with a massive DoS attack that affected government and corporate websites. Estonia blamed the Russian government, which denied responsibility.

Fears of cyberterrorism have been heightened through depictions in popular novels and movies. As early as 1983, the spotlight was turned on cyberterrorism with War Games, a film in which a young hacker breaks into a US military supercomputer and sets in motion a chain of events that will start World War III. Goldeneye, the seventeenth James Bond film, also dealt with cyberterrorism. Novels that feature cyberterrorism include Tom Clancy’s Net Force series, among others.

Efforts to pass federal legislation on cyberterrorism have typically led to partisan wrangling over increased government regulation, and Congress has repeatedly failed to pass them. On February 18, 2013, President Barack Obama responded to those failures by issuing an executive order titled “Improving Critical Infrastructure Cybersecurity,” which encouraged voluntary implementation of improved computer security measures among those involved in critical infrastructures.

In November 2014 US-based Sony Pictures Entertainment suffered a cyberattack in which its computer networks were hacked. A group calling itself Guardians of Peace leaked data from Sony’s computers, including embarrassing emails and personal information about its actors. The group also threatened movie theater chains that were planning to screen The Interview, a comedic satire about North Korea, with a September 11–style terror attack. In response, President Obama and the FBI blamed the attack on North Korea, which praised the cyberattack but refused to take responsibility for it. On January 2, 2015, Obama signed an executive order to impose largely symbolic sanctions on North Korean organizations and ten individuals.

National and international debate around cybersecurity next became more prominent in the lead-up to the 2016 presidential election, as it was discovered that an orchestrated cyberattack campaign had been employed by Russian hackers that had involved a breach of the Democratic National Committee's computer system as well as email accounts within Democratic candidate Hillary Clinton's campaign; other targeted attempts against some Republican politicians and organizations had also been made. The level of this cyberattack, in addition to questions regarding whether there had been any link between Republican candidate and eventual president-elect Donald Trump and the Russian interference in this democratic institution, resulted in lengthy federal investigations. In 2018, Trump, as president, signed a bill that established a new agency, the Cybersecurity and Infrastructure Security Agency (which rebranded the former National Protection and Programs Directorate launched in 2007), to put more emphasis on and resources toward cybersecurity. Between 2020 and mid-2021, a series of major cyberattacks hit different sectors. These included the technology sector with Microsoft's announcement that its software for its Exchange Server email, used worldwide by a number of businesses, had been hacked, and the energy sector with the report that Coastal Pipeline had been compelled to shut down its pipeline responsible for transporting a significant percentage of jet fuel and gasoline across the country due to a ransomware attack on its central networks. In May 2021, President Joe Biden signed an executive order that outlined specific actions to be taken to make the country's defenses against such attacks stronger. However, cyberattacks and cyberterrorism remained an area of concern.

There is no widespread consensus on how to fight cyberterrorism, and information experts tend to agree that the United States lacks the capability of preventing all such attacks. However, most accept that basic security measures, such as implementing defense mechanisms, identifying potential cyberterrorists, eliminating known threats, and instituting international cooperation designed to mitigate damage and bring perpetrators to justice, are necessary steps in battling cyberterrorism.

Bibliography

Abrams, Abigail. "Here's What We Know So Far about Russia's 2016 Meddling." Time, 18 Apr. 2019, time.com/5565991/russia-influence-2016-election/. Accessed 11 June 2021.

Assante, Mike. CyberSkills Task Force Report Fall 2012. Washington: Department of Homeland Security. Dept. of Homeland Security, 2012. PDF file.

Colarik, Andrew Michael. Cyber Terrorism: Political and Economic Implications.Hershey: IGI Global, 2006. Print.

Collin, Barry. “The Future of Cyberterrorism.” Crime and Justice International 13.2 (1997): 15–18. Print.

Conway, Maura. “Against Cyberterrorism.” Communications of the ACM 54.2 (2011): 26–28. Print.

Denning, Dorothy. “A View of Cyberterrorism Five Years Later.” Internet Security: Hacking, Counterhacking, and Society. Ed. Kenneth Elinor Himma. Sudbury: Jones, 2007. Print.

Dunn-Cavelty, Myriam. Cyber-Security and Threat Politics: U.S. Efforts to Secure the Information Age.New York: Routledge, 2008. Print.

Herbert, Lin. “A Virtual Necessity: Some Modest Steps toward Greater Cybersecurity.” Bulletin of the Atomic Scientists 68.5 (2012): 75–87. Print.

Matusitz, Jonathan. “Cyberterrorism: Postmodern State of Chaos.” Information Security Journal: A Global Perspective 17.4 (2008): 179–87. Print.

National Research Council, et al. Computers at Risk: Safe Computing in the Information Age.Washington: Natl. Acad., 1991. Print.

Ordoñez, Franco. "In Wake of Pipeline Hack, Biden Signs Executive Order on Cybersecurity." NPR, 12 May 2021, www.npr.org/2021/05/12/996355601/in-wake-of-pipeline-hack-biden-signs-executive-order-on-cybersecurity. Accessed 11 June 2021.

Sanger, David E., et al. "Cyberattack Forces a Shutdown of a Top U.S. Pipeline." The New York Times, 8 May 2021, www.nytimes.com/2021/05/08/us/politics/cyberattack-colonial-pipeline.html. Accessed 11 June 2021.

“Sony Cyber-Attack: North Korea Faces New US Sanctions.” BBC News. BBC, 3 Jan. 2015. Web. 19 June 2015.

Tafoya, William L. “Cyber Terror.” FBI Law Enforcement Bulletin. FBI, n.d. Web. 20 July 2013.

Weimann, Gabriel. “Cyberterrorism: How Real Is the Threat?” United States Institute of Peace. US Inst. of Peace, n.d. Web. 2 July 2013.

"What Is a Cyberattack?" IBM, www.ibm.com/topics/cyber-attack. Accessed 21 Nov. 2024.