An attack against a computer system or network is how PC Magazine defines a cyber-attack. A Cyber-attack can take many forms, for many reasons and can be executed on a small or large scale. Most cyber-attacks are criminal in nature. These cybercrimes are usually motivated by profit. Recent examples include the cyber-attacks on Visa/MasterCard and attacks on Google’s network by China. The cyber-attacks on Visa and MasterCard were part of “operation payback”, and were carried out by various loose nit groups that organized using social networking sites. “Operation payback” was retaliation against Visa and MasterCard for refusing to continue to do business with the website WikiLeaks. WikiLeaks posted leaked classified U.S. diplomatic communications on their website for the world to see. The United States felt this was a criminal act and pressured Visa and MasterCard to stop processing transactions for WikiLeaks. In response hackers launch “operation payback” which used distributed denial-of-service (DDoS) attacks to crash Visa and MasterCard Servers. Google recently exited the Chinese market. According to the New York Times, “Google linked its decision to sophisticated cyber-attacks on its computer systems that it suspected originated in China and that were aimed, at least in part, at the Gmail user accounts of Chinese human rights activists. The attacks were directed at some 34 companies or entities, most of them in Silicon Valley, California, according to people with knowledge of Google’s investigation into the matter. The attackers may have succeeded in penetrating elaborate computer security systems and obtaining crucial corporate data and software source codes.” Both of these attacks could be dismissed as everyday criminal cyber-attacks but they could be considered something much more serious. By some the attack against Visa and MasterCard maybe considered cyber terrorism and the attack against Google considered cyber warfare. The circumstances of the attack, politics, and the parties involved often determine what category an attack falls in. This paper will focus on cyber-attacks that the United States Government deems to be cyber terrorism or cyber warfare. We will explore the past, present, and future of these attacks and our nation’s current known defensive and offensive cyber-attack capabilities.
Cyber Terrorism
Distinctions between crime and terrorism may be blurry when attempting to describe a computer network attack (CNA). It can be difficult to determine if non-state actors who initiate a CNA are secretly sponsored by a nation state because it can be hard to determine where a cyberattack originated because attackers may direct suspicion toward an innocent third party. Interactions between terrorist and criminals who use computer technology may further blur the distinction between cyberterrorsim and cybercrime. It will remain difficult to determine the responsible party for most of the annoying, yet increasingly sophisticated CNA’s that infect the internet. Some observers feel that the term “Cyberterrorism” is inappropriate, because it doesn’t produce terror like a bomb, chemical, biological, radiological, or nuclear explosive would. They view it more as an annoyance. Others feel that the effect of a widespread computer network attack would be unpredictable and might cause enough economic disruption, fear, and civilian deaths, to qualify as terrorism. According to the CRS report for Congress the two views that exist for defining the term cyberterrorism are effects-based, and intent-based. “Effects-based cyberterrorism exists when computer attacks result in effects that are disruptive enough to generate fear comparable to a traditional act of terrorism, even if done by criminals. Intent-based cyberterrorism exists when unlawful or politically motivated computer attacks are done to intimidate or coerce a government or people to further a political objective, or to cause grave harm or severe economic damage.” According to Richard Clarke, former Administration Counter Terrorism Advisor and National Security Advisor, “if terrorists were to launch a widespread cyberattack against the United States, the economy would be the intended target for disruption, while death and destruction might be considered collateral damage.” Cyberattacks have not caused widespread panic because these attacks have not caused death and destruction, which is why many feel Terrorist don’t focus more effort on cyberattacks. Security experts warn that a Cyberterrorist attack would be most effective and attractive to terrorist organizations if used in conjunction with a conventional bomb, or other chemical, biological, radiological, or nuclear explosive (CBRN) attack. A disruption to 911 call centers simultaneous with the detonating of CBRN or explosive device would amplify the casualties and create more terror then a conventional terrorist attack alone. Terrorist organizations often state their goal is to bring down the U.S. government and they like publicity because it helps them recruit. The Media has reported extensively on the vulnerability of the U.S. information infrastructure and the potential harm that a cyberterrorist attack could cause. Terrorists may feel that even a marginally successful cyberattack against the United States would get extensive publicity. A large-scale cyberattack that affected one sector could have disruptive, unpredictable, and devastating effects on other sectors, and possibly long-lasting effects to the economy do to interdependencies among infrastructure sectors. Although cyberattacks don’t cause death and blood shed they can still garner publicity, cause significant damage to the American economy, and cause widespread panic.
After the Terrorist attacks on September 11, 2001 public concerns about the threat of a cyberattack from terrorist groups has been high even though security experts aren’t convinced that such an attack could be launched by terrorists against U.S. civilian critical infrastructure and doubt such an attack could seriously disrupt the U.S. economy. CRS report to Congress stated that “simulated cyberattacks, conducted by the U.S. Naval War College in 2002, indicated that attempts to cripple the U.S. telecommunications infrastructure would be unsuccessful because system redundancy would prevent damage from becoming too widespread. Many observers suggest that evidence from natural disasters shows that many of the critical infrastructure systems, including banking, power, water, and air traffic control, would likely recover rapidly from a possible cyberattack. To date, there has been no published report of a coordinated cyberattack launched against the critical infrastructure by a terrorist or terrorist group.” Dennis McGrath of the Institute of Security Technology Studies at Dartmouth College reportedly observed that, “We hear less and less about a digital Pearl Harbor. Cyberterrorism is not at the top of the list of discussions.”
The CRS report to Congress states that “In May 2005, the CIA reportedly conducted a classified war game, dubbed “Silent Horizon,” to practice defending against a simulated widespread cyberattack directed against the United States. The national security simulation was considered significant because many U.S. counterterrorism experts feel that far-reaching effects from a cyberattack are highly unlikely.” However, it is prudent to develop and test countermeasures even for unlikely events because if the event were to occur it could be devastating if we don’t have a plan to mitigate its affect.
CYBER WARFARE
Cyber warfare has been defined by government security expert Richard A. Clarke, in his book Cyber War May 2010, as "actions by a nation-state to penetrate another nation's computers or networks for the purposes of causing damage or disruption." The Economist describes cyber warfare as "the fifth domain of warfare," and William J. Lynn, U.S. Deputy Secretary of Defense, states that "as a doctrinal matter, the Pentagon has formally recognized cyberspace as a new domain in warfare which has become just as critical to military operations as land, sea, air, and space." Cyber Warfare may include defacing websites, distributed denial of service attacks, distributing propaganda, and gathering classified data over the Internet, however "there is no clear, internationally agreed upon definition of what would constitute a cyber-war. In fact, there is considerable confusion," said a report released at the Munich Security Conference by think tank The EastWest Institute. Its paper, titled Working Towards Rules for Governing Cyber Conflict, says that "the current ambiguity [about what constitutes cyber conflict] is impeding policy development and clouding the application of existing Convention requirements" and perhaps the idea of peace and war is too simple in the digital age when the world could find itself in a third, "other than war" mode.”
Just a few years ago the Central Intelligence Agency only mentioned Russia and China as possible cyber threats. Recently, declassified U.S. Navy documents “indicate that more than 20 countries have various kinds of information operations directed against the United States. The CIA testified more recently that adversaries are incorporating cyber warfare as a new part of their military doctrine. Russia, China, India, and Cuba as countries have acknowledged preparing for cyber warfare and are rapidly developing their capabilities. North Korea, Libya, Iran, Iraq, and Syria reportedly have some capability, and France, Japan, and Germany are active in this field.” These Nations see that cyber warfare provides many relatively anonymous, non-lethal options that can be utilized with relatively low risk of escalation to more direct forms of conflict. “It’s a way for others to wage an asymmetrical conflict against the United States. The likelihood of getting caught, let alone incurring U.S. military might, may seem low compared to the possible benefits. The appeal of cyber warfare to the United States could grow out of the larger U.S. trend over the past twenty years to minimize conflict casualties and maximize technological advantages while pursuing increasingly activist foreign and defense policy agendas.”
The U.S. Cyber Consequences Unit has recently issued a report documenting how Russia supplemented its conventional war against Georgia with a sustained, well-integrated, and pre-planned information warfare campaign against Georgia’s Internet structure. According to the report, from August 7, 2008 to August 16, 2008 Russian citizens launched an offensive that crippled dozens of Georgian websites. At first the Internet pages of the country’s main government institutions and new media were attacked so they could not inform the Georgian public and the international community of the Russian attack. Next other government and media sites as well as Georgian business, education, and financial institutions fell under attack. The Russian cyberattacks degraded Georgia’s national response to the Russian military assault.

The Russian’s developed a detailed campaign plan against the Georgian sites well before the conflict. They deployed specially designed software to attack them. Some of the software was created in March 2006 but saved for use until the August 2008 campaign. “The attackers also rapidly registered new domain names and established new Internet sites, further indicating they had already analyzed the target, written attack scripts, and perhaps even rehearsed the information warfare campaign in advance.” The Defense Department’s report on the Chinese military cyber attack capabilities released online August 16, 2009 reports that during 2009 cyber attacks around the world originated from China. These attacks targeted all U.S. defense and security agencies, NASA, large U.S. corporations, and even the United States power grid. The report states, "it remains unclear if these intrusions were conducted by, or with the endorsement of, the [People's Liberation Army] or other elements of the [People's Republic of China] government.” Chinese military doctrine seeks to establish "electromagnetic dominance" early during conflicts. Chinese military theorists use the term "integrated network electronic warfare" to describe operations conducted with "electronic warfare, computer network operations, and kinetic strikes to disrupt battlefield information systems that support an adversary's war fighting and power projection capabilities”. The Chinese military has units that develop viruses and protect domestic networks. “Some of those units are housed within the Chinese paramilitary militia, and that creates a link between civilian information technology professionals and the military network operators”, the report states. “The Chinese and U.S. militaries differ significantly in their approaches to the same operational requirements, including the Chinese approach to computer network exploitation that harvests huge volumes of data and an emphasis on offensive and defensive electronic warfare in recent years”. It is widely believed the Chinese military is conducting cyber espionage to steal U.S. military technology and identify weakness in the United States cyber info structure that they can exploit in the advent of a conflict.