Cyber terrorism: no longer fiction; the threat of cyber terrorism became much more real after Sept. 11. Here's how states are trying to reduce the risks.

On the morning of Sept. 11, 2001, New York Senator Michael Balboni was on his way from Long Island to deliver a lecture in midtown Manhattan when he heard about the terrorist attacks on the World Trade Center.

As a native New Yorker whose district hugs the northern shore of Long Island, across the East River from what would soon be universally known as "Ground Zero," Balboni was grief-stricken by the day's events.

But he quickly realized that the tragedy might serve as a wake-up call not only to his fellow New Yorkers, but to members of the Legislature. His earlier pleas there asking that terrorism, bioterrorism and cyber terrorism be given a legal definition had received a less than enthusiastic response.

"Before 9/11, my bill on terrorism had little or no traction in the New York Senate," says Balboni. A former senator had told him "the only weapon of mass destruction we have in New York City is the assault weapon."

In February of this year, New York Governor George Pataki signed into law the Omnibus Governors' Program Bill, which created legal definitions for a wide array of terrorist crimes. It also strengthens the authority of law enforcement to investigate and prosecute terrorists.

But it was a second measure, SB 1627, that Balboni, who currently serves as chairman of the Senate Committee on Veterans, Homeland Security and Military Affairs, particularly enjoyed seeing made into law.

That measure created a legal definition for the act of cyber terrorism in New York, making it a Class B felony to launch an attack on any local, state or federal government computer network.

"Until now, New York, like many other states, has simply not officially recognized or acknowledged what the computer experts have said is a very real threat, what they call a 'denial of service' attack," says Balboni.

WREAKING HAVOC

Simply put, a hacker or terrorist could bombard a state agency site with millions of "requests for information," thus causing the site to overload and shut down.

Similarly, an intruder--via the Internet--could potentially invade a system designed to control a city's water supply or air transportation systems and wreak havoc.

Such scenarios, to many, seem improbable. And maybe they are. "The real question is: What CAN happen?" asks Michael Vatis, director of the Institute for Security Technology Studies at Dartmouth College. "What is it possible to do?"

In the fall of 2001, just days after the 9/11 attack, Vatis sought to answer his own question. His report, "Cyber Attacks During the War on Terrorism," was quickly scooped up and devoured by the nation's computer security community. In it, Vatis says the "potential exists for much more devastating cyber attacks following any U.S.-led retaliation to the terrorist attacks on America."

"It was the honest thing to say," Vatis now maintains. "If you study this matter at all, you quickly have to conclude that a major cyber attack on the nation's information infrastructure could very well take place. If it went the way the attackers hoped, it would probably be devastating."

For cyber security experts the advent of a major cyber attack had always centered on whether or not it was possible. The question of what was probable--as was repeatedly noted by critics--was not addressed.

WHEN THE IMPOSSIBLE HAPPENS

What happened on the morning of Sept. 11 changed that.

"If, on the day before that day, I asked you what the odds were that four people were going to hijack four planes. And three of them would hit prominent buildings and that both towers of the World Trade Center would collapse--you would have said such a risk is minimal," says Scott Charney, the chief security strategist for Microsoft.

"After Sept. 11, that very afternoon, in fact," he says, "you would have said there was a 100 percent chance that something like the attacks of that morning could occur.

The reason for the sudden change in perception, of course, is that the highly improbable did happen. But just as important was the fact that everyone saw it happen on live national television, reinforcing the very real transformation of the highly improbable into decidedly possible.

Moreover, many of those same experts believe the states should now consider information systems security as not only a necessary, but a regular part of their budgets.

"It is difficult to come up with any exact hard numbers because there are so many variables," says Larry Kettlewell, chief information security officer for Kansas and a member of the National Association of State Information Executives (NASCIO) security and liability team.

"What type of system does a state have? How much money is alloted to its information system? There're nearly 50 different answers to these questions.

"But, generally, it is thought that the average amount of resources dedicated to IT systems is about 4 percent to 6 percent of a state's budget," says Kettlewell. "The amount of money spent on securing those systems is a fraction of that percentage."

But before any efforts can be made to enhance either security budgets or security systems, says Charney, the experts have to come to an agreement on terms, Just what is cyber terrorism? And how is it different from cyber hacking, the Number 1 systems intrusion crime in the United States?

Officially, cyber terrorism is regarded as any major computer-based attack that is premeditated, politically motivated and designed both to call attention to a cause and to create panic, through the breakdown of a widely used information system.

ELECTRONIC PEARL HARBOR 

Experts say such attacks, first labeled an "electronic Pearl Harbor" by former Senator Sam Nunn in 1998, could cripple communications in heavily populated areas and lead to social chaos, as well as death.

"Until we secure our cyber infrastructure, a few keystrokes and an Internet connection is all one needs to disable the economy and endanger lives," said Congressman Lamar Smith of Pennsylvania when the Cyber Security Enhancement Act was passed last year. Then he added an unforgettable thought: "A mouse can be just as dangerous as a bullet or a bomb."

But as the shock of 9/11 began to fade in the months after the attack, many cyber security experts again raised the issue of probability, most notably Dorothy Denning, whose work as a cyber security professor at Georgetown University has won her a national reputation.

"I thought the talk about the cyber threats were being overstated," says Denning. "I just didn't subscribe to the 'sky-is-falling' scenarios."

Denning, in fact, pointed out what other critics have long emphasized-even though there have been thousands of documented cases of cyber intrusions, "there hasn't been one instance of a cyber terrorist attack."

It has been the hackers, she says, who have been breaking into systems, sometimes just to show they can do it and other times to steal access to money.

Such intrusions, Denning admits, "of course, cost money and have to be regarded seriously. But they are not cyber terrorism."

NO SUCH THING

Similarly, Washington Monthly magazine explored the sometimes alarmist talk about the advent of cyber terrorism, and noted, "There is no such thing as cyber terrorism--no instance of anyone ever having been killed by a terrorist or anyone else using a computer."

For Howard Schmidt, chairman of the President's Critical Infrastructure Protection Board, the debate on what is and isn't cyber terrorism became so problematic that he decided to ban the use of the words 'cyber terrorism' in his office.

"The simple fact of the matter is that none of us really knows what the motivation is behind an act," says Schmidt, "I like to joke that a cyber attack could come from the Middle East or the Midwest. Who knows what the motivation is behind it?"

But whatever name it goes by, the invasion of any computer system, insists Schmidt, is a "very serious thing. And we would be very wrong not to treat it as such."

Even without an agreed-upon moniker, cyber intrusions exist, and, according to the Computer Security Institute, are growing.

Last year, surveying more than 500 computer security practitioners across the country, the Computer Security Institute discovered that more than "90 percent of the respondents (primarily large corporations and government agencies) detected computer security breaches within the last 12 months."

The CSI study added that those intrusions accounted for more than $455 million in losses to those same corporations and government agencies.

"It doesn't matter what you call it," contends Representative Dan Gelber of Florida, author of a 2002 bill signed into law by Governor Jeb Bush that allows law enforcement officials to investigate attacks on protected computers owned by the government, "the issues of cyber security get larger by the day.

"In fact, there is no area of our public or private infrastructure that is in the interconnected world that has not suffered intrusions or disruptions," says Gelber.

Usually cyber security experts cite the possibility of a terrorist disrupting a utility service or overloading a government Web site as the most likely kinds of criminal activity bordering on terrorism in cyber space.

TARGET: INFORMATION

But those same experts also note that virtually every government department or agency is vulnerable to a cyber attack, primarily because most contain the one thing that hackers most desire--information.

"Take a department that issues benefits to people," says Charney of Microsoft. "That is an agency that is going to have a large amount of personally identifiable information. Protecting that information is critical because otherwise you are going to be facing a huge risk with things like identity theft."

Even worse, because most government agencies today are interconnected with other agencies, the potential for invading one system through another has never been greater. This makes it essential, says Dave Morrow, a deputy director of privacy services at EDS, that state and local governments conduct what he calls an "enterprise-wide assessment of their security needs."

"That is the only way that you can satisfy or protect the data elements you have that are sensitive," Morrow continues.

In his own talks with state cyber security experts, Schmidt emphasizes the idea that "no one part of a state network truly stands alone."

"You may go to great lengths to secure your system," Schmidt says, "but you are going to be interconnected to some other agency, a vendor of some sort. If they are not at the same level of security that you are, they can become a gateway for an intrusion into your system." Training is also important, says NASCIO's Kettlewell.

"There are not that many states that have, on staff, people with the level of expertise needed to keep up with the latest systems, and, along with that, who know how to make those systems secure," he says.

"When you take into consideration something like Microsoft's Windows 2000, with servers that are the next technological step up," continues Kettlewell, "there are not that many states with on-staff technicians who have the training or background to understand these systems from beginning to end. And that kind of understanding is essential."

Equally important is the need to "eliminate the boundaries between the cyber world and the physical world," maintains William Pelgrin, director of the New York State Cyber Security and Critical Infrastructures Coordinating Initiative. Founded in 2002, the group now includes representatives from the 10 states that make up the Northeastern quadrant from Maine to Pennsylvania. Pelgrin hopes the group will eventually draw representatives from all 50 states.

"The idea is to combine the cyber and physical security issues in your state, to realize that they are one and the same," continues Pelgrin.

That means, explains Pelgrin, that policing a dock or a public waterworks to ensure its 24-hour security goes hand-in-hand with monitoring and protecting the computer systems that serve those facilities.

"One affects the other," says Pelgrin. He also advises those in charge of protecting physical infrastructure to meet regularly and coordinate their activities with the people in charge of a state's cyber security.

BACK TO THE '50s

For those old enough to recall the Cold War, the last time the nation lived on the tenterhooks of day-to-day security checks, add one more throwback to the 1950s--the preparedness drill.

Then, of course, most drills centered on the time it took the entire family to find its way to the nearest fallout shelter in the event of an atomic war. And there was the legendary "duck and cover" exercises that many school children endured, crouching under their desks as they imagined an imminent Soviet arrival.

Today's drills, by contrast, will be nearly entirely conducted in cyber space.

"There needs to be planning for what needs to be done in the event of a major cyber attack," says Vatis. "What do you do if a critical part of your system has been knocked out or you're left without a major part of your communications?"

Only through such exercises, which should include a "central state entity" for analysis and response, adds Vatis, "can we understand in advance what should happen, the role that law enforcement will play and how we should respond if a cyber terrorist attack proves successful."

Ironically, many state governments have been here before with Y2K. In the months and weeks leading up to New Year's Eve 2000, fears were rampant that a large number of state utility systems' computers unable to digest the numbers 2000, would simply turn themselves off.

"Some people think that all of the preparations for Y2K were pointless because nothing happened," says Denning. "But the opposite is true--nothing happened because of all of the preparations."

Denning says the same thing now applies to cyber security tests and evaluations--the more they are conducted, the less likely it is that something will happen.

NEW LAWS INTRODUCED

Meanwhile, lawmakers in at least 16 states have introduced legislation designed to strengthen information technology security.

The new laws include felony penalties for using the Internet to disrupt critical infrastructures in Michigan; an Omnibus Terrorism Protection and Homeland Defense Act in South Carolina that makes it a crime to introduce a virus or a worm to a system; and a legal definition of terrorism in Virginia that includes electronic threats in the commission of an act of terrorism.

Schmidt says any state effort to update criminal codes to reflect the era of cyber threats is a welcome one. "Every state has laws that say you cannot break into a business or trespass on private property," he says.

"But those laws have to be addressed within the cyber realm, so that there will not only be some consistency with the new federal laws in this area, but international law, as well."

Yet in the rush to introduce new cyber security legislation, some lawmakers worry about the risk of doing too much, too soon and of going too far.

Last year, Minnesota legislators were unable to reach an agreement over a bill that would have required background checks on all employees with access to sensitive data. A similar bill passed in Kansas.

"We were worried that we might be going over some sort of line," says Minnesota Senator Steve Kelley.

Kelley specifically remembers one proposal that would have transformed Internet service providers into what he called "anti-terrorist vigilantes." It would have required them to turn over any suspicious information about their users to the government.

"Law enforcement officials told us it would make tracking down people easier," says Kelley. "But we thought it would also create an unfair burden for innocent people.

"The issue of cyber security is complicated enough. When you get into people's constitutional rights, then you really have to be careful," Kelley says.

RELATED ARTICLE: WHITE HOUSE HAS IDEAS FOR REDUCING RISKS IN CYBERSPACE

A White House report is encouraging industry, government agencies and citizens to reduce cyberspace risks wherever practical and gives advice on how to do it.

National Strategy to Secure Cyberspace is part of President Bush's larger National Strategy for Homeland Security. It sets up five major national priorities: to create a cyberspace security response system, to establish a threat and vulnerability reduction program, to improve security training and awareness, to secure the government's own systems, and to work internationally to solve security issues.

The plan depends on coordinated and cooperative efforts from federal, state and local governments, businesses and citizens. Unlike the previous draft version that mandated businesses to adopt certain measures, the new strategy encourages state and local governments and the private businesses to reduce threats and vulnerabilities incrementally with a number of recommendations.

Infrastructure sectors, for example, are encouraged to establish mutual assistance programs for cyber emergencies. Corporations are encouraged to regularly review and exercise IT continuity plans and consider active involvement in sharing critical IT information. State and local governments are persuaded to work closely with the federal government and Department of Homeland Security in establishing IT security programs that include awareness, audits and standards in the combat against cyber threats and attacks.

The Department of Homeland Security (DHS) is in charge of creating a comprehensive national strategy to secure "key resources and critical infrastructure of the United States." The DHS will also be responsible for responding in the event of a crisis, supplying technical assistance to the government and private businesses, coordinating efforts between agencies, and conducting and funding research to support homeland security.

Janna Goodwin, NCSL 

FEDS TIGHTEN COMPUTER CRIME ACTS

The federal government has had a computer crime law, the Computer Fraud and Abuse Act, since 1986. But as recent events have encouraged heightened security, computer law has been amended on the federal level to guard against cyber theft or disruption.

The 1986 act addressed hacking information involving national secrecy with the intent to injure the United States, as well as unauthorized access to a federal government computers.

The act has been amended several times to keep pace with advancing technology. Increased penalties for hackers who damage protected computers were included in the 2001 Patriot Act, passed in the wake of the Sept. 11 terrorist attacks. The Patriot Act also specified that a hacker need only intend damage for criminal penalties to apply.

The act added a new offense for damaging computers used for national security or criminal justice and also included computers in foreign countries if they affect American interstate or foreign commerce.

Last year's Cyber Security Enhancement Act, slipped into the Homeland Security Bill at the last moment, expands police powers to conduct Internet or telephone eavesdropping without a court order. It also gives Internet providers more latitude in reporting information to the police.

Currently, all 50 states have laws on hacking and unauthorized access to computer systems. Lawmakers have amended existing criminal statutes or created new laws to deal with computer-related offenses. Nearly all include financial institutions, businesses and the general public who use computers. Arizona prohibits unleashing a computer contaminant," such as a virus or worm.

Janna Goodwin, NCSL

Garry Boulard, a frequent contributor to State Legislatures, is a free-lance writer in New Orleans.