<%-- Page Title--%> Technology <%-- End Page Title--%>

<%-- Volume Number --%> Vol 1 Num 127 <%-- End Volume Number --%>

October 17, 2003

<%-- Navigation Bar--%>
<%-- Navigation Bar--%>
<%-- 5% Text Table--%>

Cyber Terrorism

S. M. Anwar Hossain

Why would a terrorist decide to use the Internet, rather than using the usual methods of assassination, hostage--taking and guerrilla warfare? Part of the problem is that terrorists may come to realise that removing one official from office only causes another to take the first officials place, which may not cause the result the terrorist wishes to achieve. By using the Internet, the terrorist can affect much wider damage or change to a country than one could by killing people. From disabling a country's military defense to shutting off the power in a large area, the terrorist can affect more people at less risk to him or herself, than through other means.

Cyber terrorism takes many forms. One of the more popular is to threaten a large bank. The terrorists hack into the system and then leave an encrypted message for senior directors, which threaten the bank. In essence, the message says that if they do not pay a set amount of money the terrorists will use anything from logic bombs to electromagnetic pulses and high-emission radio frequency guns to destroy the banks files. What adds to the difficulty in catching the criminals is that the criminals may be in another country. A second difficulty is that most banks would rather pay the money than have the public know how vulnerable they are.

Cyber-terrorists often commit acts of terrorism simply for personal gain. Such a group, known as the Chaos Computer Club, was discovered in 1997. They had created an Active X Control for the Internet that can trick the Quicken accounting program into removing money from a user's bank account. This could easily be used to steal money from users all over the world that have the Quicken software installed on their computer. This type of file is only one of thousands of types of viruses that can do everything from simply annoy users, to disable large networks, which can have disastrous, even life and death, results.

Cyber-terrorists are mainly interested in gaining publicity in any way possible . For example, information warfare techniques like Trojan horse viruses and network worms are often used to not only do damage to computing resources, but its also a way for the designer of the viruses to "show off." This is a serious ethical issue because many people are affected by these cases. For one, the viruses can consume system resources until networks become useless, costing companies lots of time and money. Also, depending on the type of work done on the affected computers, the damage to the beneficiaries of that work could be lethal. Even if the person never meant to harm someone with their virus, it could have unpredictable effects that could have terrible results.

In one of its more unusual forms, cyber-terrorism can be used for assassination. In one case, a mob-leader was shot but survived the shooting. That night while he was in the hospital, the assassins hacked into the hospital computer and changed his medication so that he would be given a lethal injection. He was dead a few hours later. They then changed the medication order back to its correct form, after it had been incorrectly administered, to cover their tracks so that the nurse would be blamed for the "accident". There are many ethical issues involved in a case like this. Most obviously, a man was killed by the hackers' actions. Also, the life of the nurse was probably ruined, along with the reputation of the hospital and all its employees. Thus, there are often more stakeholders in a terrorist situation that the immediate recipient of the terrorism.

Terrorism can also come in the form of misinformation. Terrorists can say what they please without fear of reprisal from authorities or of accountability for what they say. In a recent incident, the rumor that a group of people was stealing people's kidneys for sale was spread via the Internet. The rumor panicked thousands of people. This is an ethical issue similar to screaming 'Fire' in a crowded theater. In case like this, the number of people affected is unlimited. Thousands of people were scared by this and could have suffered emotionally.

Minor attacks come in the form of "data diddling", where information in the computer is changed. This may involve changing medical or financial records or stealing of passwords. Hackers may even prevent users who should have access from gaining access to the machine. Ethical issues in this case include things like invasion of privacy and ownership conflicts. It could be even more serious if, for instance, the person who needed access to the machine was trying to save someone's life in a hospital and couldn't access the machine. The patient could die waiting for help because the computer wouldn't allow the necessary access for the doctor to save his or her life.

Who is at risk of an attack?
Most feel that military installations, power plants, air traffic control centres, banks and telecommunication networks themselves are the most likely targets. Other targets include police, medical, fire and rescue systems, which could be hurt, along with stock exchanges, water systems, etc.

Who are the terrorists?
The graph above shows that amateur hackers are by far the biggest threat on the Internet at the current time. They are responsible for about 90% of all hacking activity.
Cyber terrorism does not have to come from the average hacker or even online terrorists. The US Govt. carried out a series of its own attacks on itself, in order to test its own defenses against online-based attacks. The Defense Information Security Agency (DISA) found that 88% of the 3000 defense computer systems that were attacked were "easily penetrable". Of the systems that were illegally entered, 96% of the entries were not detected. Of the 4% that were detected, only 5% of them were reported or investigated.

How can we protect ourselves?
Currently there are no foolproof ways to protect a system. The completely secure system can never be accessed by anyone. Most of the militaries classified information is kept on machines with no outside connection, as a form of prevention of cyber terrorism. Apart from such isolation, the most common method of protection is encryption. The wide spread use of encryption is inhibited by the governments ban on its exportation, so intercontinental communication is left relatively insecure. The Clinton administration of US and the FBI oppose the export of encryption in favour of a system where by the government can gain the key to an encrypted system after gaining a court order to do so. The director of the FBI's stance is that the Internet was not intended to go unpolished and that the police need to protect people's privacy and public-safety rights there. Encryption's draw back is that it does not protect the entire system, an attack designed to cripple the whole system, such as a virus, is unaffected by encryption.

Others promote the use of firewalls to screen all communications to a system, including e-mail messages, which may carry logic bombs. Firewall is a relatively generic term for methods of filtering access to a network. They may come in the form of a computer, router other communication devices or in the form of a network configuration. Firewalls serve to define the services and access that are permitted to each user. One method is to screen user requests to check if they come from a previously defined domain or Internet Protocol (IP) address. Another method is to prohibit Telnet access into the system.

The ethical issues involved in cyber-terrorism are manifold. Spreading disinformation is unethical in its lack of regard for the truth, as well as for the safety of and consequences on others who believe the misinformation. Altering, destroying, or stealing others data is a violation of their privacy. The ordinary hacker is guilty of lack of regard for the privacy of the peoples systems that he or she would enter. Hacking-for-hire is additionally illicit because they openly sell their services to break into others systems.

Few key things to remember to protect you from cyber-terrorism:

- All accounts should have passwords and the passwords should be unusual, difficult to guess,
- Change the network configuration when defects become know,
- Check with venders for upgrades and patches.
- Audit systems and check logs to help in detecting and tracing an intruder,
- If you are ever unsure about the safety of a site, or receive suspicious email from an unknown address, don't access it. It could be trouble.



(C) Copyright The Daily Star. The Daily Star Internet Edition, is published by The Daily Star