Academia.eduAcademia.edu

Cyber-terrorism: reality or paranoia?

2003, SA Journal of Information Management

Abstract

Information security may be the realm of specialists, but today it touches the lives and safety of millions in the developed world. In this column appears as attempt to sketch short profiles of the most pressing issues. Cyber-terrorism: reality or paranoia? The new millennium-if there ever was one in any scientific meaning of the term-has been ushered amid a media circus of a Y2K scare and predictions of total world paralysis. It did not realize, and we were all relieved for a while, short as it was, until something far more dark and sinister in the shape of two airplanes hit the World Trade Centre. The amount of vital data and information lost in that attack has brought home a new threat to haunt those responsible for information security: cyber-terrorism. Increasingly, the world depends on computers. The systems residing on them control power delivery, communications, aviation and financial services. They are used to store vital information, from medical records to business plans to criminal records. These computers are vulnerable to the effects of poor design and insufficient quality control, to accident, and perhaps most alarmingly, to deliberate attack. The modern thief can steal more with a computer than with a gun. Does it follow, then, that tomorrow's terrorist may be able to do more damage with a keyboard than with a bomb? New term, old game Terrorism is a much-used term with many definitions. The US Department of State defines it as 'premeditated, politically motivated violence perpetrated against non-combatant targets by sub-national groups or clandestine agents'. If we combine this definition with the term 'cyber', we end up with a working definition of cyber-terrorism: 'The premeditated, politically motivated attack against information, computer systems, computer programs and data which result in violence against non-combatant targets by sub-national groups or clandestine agents' (Politt 1998). For the term 'cyber-terrorism' to have any meaning, we must be able to differentiate it from other kinds of computer abuse such as computer crime, economic espionage or information warfare. Using this definition, a number of things that are often miss-associated with cyber-terrorism can be eliminated. For instance non-politically motivated computer crimes, like the 16-year-old hacker's 1994 crashes of 100 US defence systems, or the creation and release of the Nimda worm (or any other worm for that matter). These were not acts of cyber-terrorism, although both were serious incidents with the potential for great harm. They lacked the essential ingredients that would allow for the term 'terrorism'. Unlike a virus or computer attack that simply causes a prevention or delay of service, a cyber-terrorist attack leads to physical violence of some sort or extreme financial harm. Therefore, possible cyber-terrorism targets include the banking industry, military installations, power plants, air traffic control centers and water systems. Cyber-terrorists are not merely individuals seeking to cause harm or damage wherever they can. They are people or groups with political agendas.

Key takeaways

  • In 1991, the US National Research Council commissioned a book on computer security entitled Computers At Risk, but although terrorist use and abuse of computer networks were discussed, the council limited itself to the ambiguous 'computer crime'.
  • The resources to launch a cyber attack are commonplace; a computer and a connection to the Internet are all that is really needed to wreak havoc.
  • Because computers do things that used to be done by humans, there is a natural fear related to a loss of control.
  • on US government Web sites.
  • For a terrorist, cyber-terrorism would have some advantages over physical methods.