RE: [ISN] Cyber terrorism is 'fantasy'

From: InfoSec News (isnat_private)
Date: Sun Dec 02 2001 - 23:47:15 PST

  • Next message: InfoSec News: "[ISN] InfoSec News List Information"

    Forwarded from: Dan Verton <Dan_Vertonat_private>
    From: Dan Verton, senior writer, Computerworld, and former intelligence officer
    Rosenberger is right on many points. This is something I have been
    writing about for more than a year and have even put Mr. Clarke on the
    spot in a public forum and got him to reverse on the use of the term
    cyber-terrorism (see CNN
    I aired my concerns about the misguided use of language when it comes
    to discussions of cyber threats at the recent Black Hat briefings in
    Las Vegas. I watched as several so-called "visionaries" of the
    computer industry chuckled at my protestations that the phrase
    cyber-terrorism is a product of individuals with a vested interest in
    promoting fear and such a term demonstrates a profound ignorance of
    what terrorism is all about and what the future of terrorism is
    believed to hold.
    The more sophisticated view of national cyber security, however,
    accepts the possibility of a large-scale, surprise cyber hiccup or
    limited infrastructure attack (that, yes, may have a ripple effect on
    other sectors), but rejects the notion of planes falling out of the
    sky, nationwide train derailments or environmental disasters at the
    click of a mouse. Sophisticated observers also accept the threat of
    massive Internet-based bank fraud and the impact such incidents could
    have on the stock market. But they reject the notion that terrorists
    have all of a sudden come to value virtual bombs as opposed to the
    fear generated by images of bleeding children on the nightly news.
    Terrorism, as we in the U.S. have come to know it, is a form of
    violence that strikes fear in the hearts and minds of people because
    of its destructive power and its ability to wreak havoc and physical
    pain on unsuspecting, innocent people. Few people will ever forget the
    horrific scenes from Lockerbie, Scotland, where in 1988 a bomb ripped
    apart Pan Am Flight 103 in mid air, killing all 270 passengers.
    Likewise, the 1983 bombing of the U.S. Marine barracks in Beirut,
    Lebanon, that killed 241 Marines and Sailors, and more than 100
    others, serves as a timeless reminder of what the destructive forces
    of terrorism are all about. The same can be said of the 1995 bombing
    of the Alfred P. Murrah Federal Building in Oklahoma City, Oklahoma,
    which killed 168 and wounded more than 500.
    You would think with all of the talk about how much of a "surprise"
    Sept. 11 was (it was not) that our language surrounding so-called
    cyber-terrorism and information "warfare" would have evolved somewhat.
    The problem is that we have a large number of neophyte intelligence
    and warfare experts in the computer industry perpetuating the use of
    this misguided terminology. Its use does not advance our understanding
    of terrorism or warfare for that matter. It dilutes our understanding
    of the terrorist's intent -- intent is a concept that novices in
    intelligence and warfare do not readily grasp. Nor do they grasp the
    importance of building a capabilities matrix based on intent and
    intelligence requirements to conduct something like a cyber
    "terrorist" attack.
    What we are stuck with, however, is terminology that has been
    perpetuated by individuals with a vested interest in promoting fear --
    and that goes for both the government and industry.
    I'll end with this interesting observation on the problem: I just
    finished reading a book on Information warfare by an industry type who
    has no formal training in any aspect of warfare, intelligence or the
    like. Although the book attempted to take the military concept of IW
    and apply it to private industry, how can anybody pretend to do that
    without a serious understanding of the first part of that equation?
    There's our problem.
    Dan Verton
    InfoSec News <isnat_private> on 11/30/2001 07:14:50 AM
    Please respond to InfoSec News <isnat_private>
    To:   isnat_private
    cc:    (bcc: Dan Verton/Computerworld)
    Subject:  RE: [ISN] Cyber terrorism is 'fantasy'
    Forwarded from: Junkmail Rosenberger <junkmailat_private>
    I reject Knowles' argument out-of-hand.  He misses the point when he asserts
    "[who] would have thought that someone would have hijacked commercial
    jetliners and used them as cruise missiles."
    The simple fact is that terrorists *always* had the ability to turn planes
    into cruise missiles; their effectiveness as flying bombs merely grew in
    proportion to their fuel payload.  On the other hand, Cluley & I & others
    insist no one [yet] has the ability to destroy America with a computer virus
    (read for starters).  We can
    therefore sum up Knowles' misguided argument as follows:
       --> "commercial aircraft as bomb" is VERY feasible but NOT likely;
       --> "computer virus as bomb" is NOT feasible but VERY likely.
    Knowles & others (e.g. Michael Vatis, Richard Clarke) could validate their
    cyber-terrorism arguments with just one -- I repeat, ONE -- technologically
    feasible idea for destroying America with a computer virus.
    Rob Rosenberger, Vmyths editor
    Truth about computer virus hysteria
    [WK Note: One problem I have is occasionally I don't make myself clear
    in my commentary on ISN, this can be attributed to lack of sleep, lack
    of RedBull in the fridge, and the thought of business travel. There
    are others, but I'd have to sleep on that.
    > I guess Cluley thinks the same about landmines too, if one is not
    > careful where placing them and mapping their location, one could
    > also very well be a victim, but viruses like landmines make for
    > great force multipliers for a cyberterrorist."
    What I was meaning to say is that I don't expect the Internet to melt
    down over one virus, but that the tactical use of viruses would be one
    weapon of several that a cyberterrorist would likely use to create
    mayhem. Just as you would use landmines, razor wire, & interlocking
    fields of machinegun fire to slow your enenmy down.
    > I am not looking forward to the day of when we see a simultaneous
    > cross-platform, multiple vulnerability virus that would have the
    > AV companies pulling their hair out trying to find a solution, and
    > then able to push that software update onto networks severely
    > choked with a combination of DDoS attacks, virus traffic, network
    > outages, and major DNS servers down from repeated hacking attacks.
    I agree with Rob that Usama is not interested in melting your MP3's,
    Russian pr0n pics, or mailing out everyone in your Outlook address
    book 'I send this for your advice' with a virus, Usama wants you dead.
    I have yet to see anyone bring up cyberterrorism with regular
    terrorism, and that is another point that I should make clear here, I
    have always belived (along with a few others) that cyberterrorism
    would be used first before a large scale terrorist attack.
    Slowing down or stopping commerical, goverment, and military networks
    along with the interdependence of the Internet would cripple the basic
    command and control of government and first responders to a major
    terrorism event.
    But enough of me ranting on, I have to get some sleep and run to
    Costco for another case of RedBull.     - William Knowles 9.30.01]
    ISN is currently hosted by
    To unsubscribe email majordomoat_private with 'unsubscribe isn' in the BODY
    of the mail.
    ISN is currently hosted by
    To unsubscribe email majordomoat_private with 'unsubscribe isn' in the BODY
    of the mail.

    This archive was generated by hypermail 2b30 : Mon Dec 03 2001 - 01:23:43 PST