New Forms of Confrontation  
Cyber-Terrorism and Cyber-Crime

AHMAD KAMAL
Senior Fellow, United Nations Institute of Training and Research

There are many reasons why we must analyse new forms of confrontation, but the impending threats of cyber-terrorism and cyber-crime are two of the most important ones.  
Cyber-terrorism lurks around the corner, as everybody warns us, but its dangers have to be placed in context.  
Even though many countries around the world had faced terrorism through history, the attack of 11 September 2001 brought home, with brutal force, a new face of terrorism in the world.  It marked a sea change in our thinking, and shook the complacency, which had marked the times prior to that tragedy.  Its ripple effect has been felt far and wide around the world, and will continue to be felt for years to come.
The event signaled two profound changes in terrorism; first, the motivation of the attackers; and second, the extensive use of the information technology, primarily the Internet, in planning and communicating the attacks.  
In a sense, the event was unique, because of this quantum jump that it signaled in the technique of terrorism.  Almost all our analyses in the past had been based on the theory that traditional weapons – daggers, poisons, guns, bombs, etc. – were the only means to be used by terrorists.  As a result, almost all our counter-measures were focused on detecting and preventing the possession and movement of these weapons.  
Now, for the first time, the weapon used was “motivation”, or a willingness to die in whatever causes these perpetrators were fighting for.  
As we know all too well, it is difficult enough to detect and prevent the possession and movement of weapons, it is virtually impossible to do the same with motivations.  The latter are universal and invisible, and largely undetectable.  That difficulty in detecting the undetectable underlies the fact that sophisticated intelligence services were unable to set off warning bells despite the extended periods of preparation that were spent in the planning and execution of the events of 11 September 2001.  
It is necessary, of course, to try to examine the root causes of this new terrorism.  Most of them are known, and most of them arise from problems to which there are no easy solutions.  Bottom-up solutions, which address the root causes, are not likely to be followed, and it is the top-down approach that will determine the actual course of action in the foreseeable future. 
Nevertheless, the motivation has to be analysed, and its psychology dissected.  It is after all highly abnormal for relatively educated individuals to lay their lives on the line for suicidal missions.  The inherent frustrations cannot be easily explained away by facile talk of “brain-washing”, as many of these individuals do not fit into that profile.
A problem lies also in the fact that motivated individuals are highly creative.  That creativity remains visible even in their motivations.  That is why the motivation of the thief is always greater than the motivation of the detective.  The criminal is always a couple of jumps ahead of the policeman.  As and when the law plugs any of its numerous loopholes, the motivated criminal will always discover new cracks in the armor.  
In the case of terrorism, it is essential to note that the objective of the terrorist is not so much to create damage, as to create panic.  The damage is really collateral, and comes from the panic, the loss of confidence, the injection of doubts and hesitations, and the absence of trust, all of which are the primary factors on which the fabric of modern society is constructed.  The success of the terrorist’s effort comes from the fact that the damage caused is totally out of proportion to the effort expended in the planning and execution of the terrorist act.  
Terrorism, as with any war, is not won by simply overwhelming the enemy with superior force.  If the absolute size of forces were the only deciding factor, the more powerful would always win, and that is not so.  It is the intelligent and accurate analysis of ones own assets and the other’s vulnerability, and then of concentrating one’s own forces on that vulnerability, that wins wars.  History is replete with examples of how smaller forces have won wars by using this obvious technique.  
The most important defense, therefore, is one, to begin with a correct analysis of one’s own vulnerabilities, because this is where cyber-terrorists will attack, and two, try to determine the opponents motivations.  
Vulnerability and motivation are then the two keys to a correct understanding of and reaction to the dangers of cyber-terrorism.  
The wide and pervasive integration of computers and embedded chips into modern society is what makes it vulnerable to cyber-attacks.  Computers are now deeply integrated into the management and processing of our daily actions, and embedded chips are so omni-present today that it is virtually impossible to determine even their actual numbers and locations.  This became abundantly clear during the Y2K exercise, when businesses and governments spent billions to make sure computer systems would work when the year 2000 began.  
This profound integration of computers and information technology is obviously the strength of modern life, but it is also its vulnerability.  The greater the vulnerability the greater the ease with which it can be exploited.  Vulnerability also arises from the finite number of nodal exchange points on the Internet network.  While the permutations and combinations of routes that they offer is infinite, the exchange points themselves rank no more than a hundred or so, and their existence and location is public knowledge.  
The motivation to commit cyber-crime is also increasing exponentially.  The number of reported incidents has gone up from just 8 in 1988 to almost 53,000 in 2001, and the graph shows a constantly steepening increase.  The first half of the year 2002 shows a 26 percent increase over the same period of the previous year.  
Add to that the simple fact of its tempting results.  Where the average bank hold-up brings in no more than $ 14,000, the average computer technology theft is of the order of magnitude of no less than $ 2 million.  The temptation is just too great.  
The status of how much is lost annually as the result of cyber-crime is unclear.  Only a minute portion of computer crime gets reported.  Most corporations have a well-defined tendency to conceal the manner and depth of the attacks on their facilities, for fear of the panic effect that this information would create on their image and stock prices.  
In short, reported incidents are just the tip of the iceberg.  The true cyber-criminal has no interest in advertising his successes, and the victims are afraid of reporting them also.  So the environment is entirely propitious for further damage.  
A distinguishing feature of cyber-crime lies in the fact that the single unattached criminal – the hacker, or the virus spreader, or even the disgruntled insider – is really not the main danger.  That is of course what hits the tabloids, partly because of the Robin Hood syndrome, and partly because it is considered “fun” among the software-literate youth.  The actual minefield lies, however, in “organized” cyber-crime and cyber-terrorism, where the technical competence of youth is exploited and channeled by organised elements towards criminal and politically motivated ends.  
Whereas the single hacker can work alone, organised crime requires proper networking through lines of communication between component elements.  The essential need for those lines of communication are its vulnerability in turn, so that is where the counter-terrorism efforts will have to concentrate.  
It is therefore essential to spotlight the techniques that cyber-criminals are likely to use as their primary means of communication in the current state of the technology.  Most of them are known – untraceable emails, encryption, digital compression, steganography – but others will turn up as the technology evolves, as it inevitably will.  All these loop-holes will have to be plugged.  
The response of the law-abiding society will not be easy.  The cyber world is ethereal in its nature, and largely uncontrollable in its anarchy.  The Internet was after all designed initially as a non-linear means of communication that would survive any nuclear attack.  That is what makes it indestructible.  By the same token, that is what makes it uncontrollable, and thus a tempting asset for criminal exploitation.  
Although many nations have written legislation against crimes committed over the Internet, such as hacking, illegal transfers of funds, identity theft, etc., the laws just cannot keep up with the technological advancements.  The lure of the criminal mind and the opportunities are just too great.  Add the fact that in many recent cases, the sentences have been minimal.  It would be useful to remember that the young hacker who caused billions of dollars of damage around the world with the “I love you” virus, spent no more than a few months in jail.  Cyber-space is virgin territory for the individual criminal, and even more attractive territory for the organized criminal.  
Then there is the disturbing fact that intelligent cyber-crime is virtually undetectable.  This is, in many ways, a “stealth” activity, where the motivated and organized criminal can slowly and painstakingly plant “sleeper” corruptions and viruses into critical databases and systems, and not pull the plug until much later.  In fact, the plug does not need to be pulled at all; the mere threat of exploding such a “logical bomb” may be enough to disrupt all peace of mind and create mass panic.  
Every technical advance in human history has been mirrored in the techniques used by criminals.  The expansion of human effort into the cyber-sphere will be no different.  Cyber-crime and cyber-terrorism will be an inevitable part of our future landscape.  
The question then is, where do we go from here.  Are we condemned to a future of fear and uncertainty, or can something be done about this new danger to society.
We are not completely without tools and solutions.  There are some steps that need to be taken immediately.  
The first, and by far the most important, is to begin to correctly analyse the vulnerability.  This would be best done by using a team of trustworthy “ethical hackers”, who would be given the job of conducting war-games aimed at penetrating existing systems.  Many of our  vulnerabilities, and many of the solutions to these vulnerabilities would be identified by this simple methodology.  
The second, would be to encourage all governments around the world to allot due priority to the need for deterrent legislation, not just against software piracy, but against the larger danger of cyber-crime and cyber-terrorism.  At the moment, despite some tentative movement in the Council of Europe, such legislation is either sadly lacking, or completely insufficient.  In fact, almost no information exists or is available about the “ownership” or responsibilities of cyber-space, or about the rights and obligations of countries, or about the rights and obligations of individuals.  Sooner or later, and sooner rather than later, action will have to be taken to draft and enact a Law of Cyber-Space, as was the case in the negotiation and passage of the nearest equivalent, namely, the Law of the Sea.  
The  third, would be to identify and establish a forum for this universal effort.  This is not a task that can be undertaken by individual countries working in isolation, as any weak link in any one part of the world would be immediately exploited by the determined criminal.  It cannot be left to private societies either, as the latter have no legal jurisdiction and sanction over transgressions.  It must, therefore, be a global effort at a global forum in the search for a global consensus.
 It can be done.  It may take time, but it can be done.  We just have to start the ball rolling.  That message can usefully be initiated here in Erice.