
t
will happen because such an attack would have
devastating effects on a country's economy.
However, I see no reason for confining such an attack
to the United States. All that is necessary is to show
that it is possible and to demonstrate the magnitude of
the disruption. After that, all of the governments and
businesses will have to spend huge amounts of money to
harden the target. That will put an enormous strain on
the respective economies, and that is the primary goal
of many terrorist organizations. The attack on the
World Trade Center was an attack on the economic power
of the United States. All military power is actually a
form of economic power. - Robert Lunn, FocalPoint
Analytics/senior researcher, 2004 USC Digital Future
Project
t's already happened, several times,
in the form of maliciously disruptive viruses and
worms. - Reid Ashe, CEO Media General
hen World-Pay is off air for days on end
does that count as a devastating attack? When a major
hub (and the region it serves) is off air four hours on
end does it matter that the fire/power failure was
accidental or terrorist? When your ISP is off air for
hours on end during a series of DOS/DDOS is that a
devastating attack? Those running 2-hour, just-in-time
delivery services, let alone life-support services,
cannot afford to rely on the Internet. It is too
fragile (physical as well as logical). - Philip
Virgo, secretary general of EURIM, the UK-based
Parliament Industry Group/IMIS - UK-based professional
body for management of information systems
f we include economic devastation,
it's inevitable that we'll see a number of
companies and industries up-ended by cracking and by
other (more ambiguous) forms of online activity (like
file sharing, which arguably has already had
devastating economic consequences). If we mean
devastating in the sense of directly causing loss of
life or injury, it's much harder to predict. To
date there are no recorded instances of cyberterrorism
(defined by loss of life or harm to human health),
which calls into question all the dire predictions
about potential online attacks. - Alexandra Samuel,
Harvard University, Cairns Project (New York Law
School)
his cannot be disputed, and both the
network and the power grid will fall victim. In the
case of the former, software attack is as effective as
attacking the hardware infrastructure. In the case of
both, there is a huge quantity of hardware
infrastructure and outside plant is particularly
vulnerable. It is impossible to be completely secure
until after attack. The security of the internet is too
much reliant upon self policing and private sector
companies. Government-enforced minimum standards of
security are the answer, but I do not see governments
having the will or the means to do this. Attacking
physical infrastructure has been proven to be both easy
and effective and terrorists have targeted physical
infrastructure for as long as there has been such
infrastructure. The troubles in Northern Ireland, the
Basque region, the Red Army Faction and the Red
Brigades have all demonstrated how easy it is for
domestic terrorists to attack physical infrastructure
and foreign extremists, with no interest in self
preservation will find it even easier. Minimal
in-country support is required. Whilst the USA regards
itself under attack, its experience of terrorism is
nothing in comparison with Europe; getting hold of
firearms and explosives is simple, and its security
will be easy to breach. - Steve Coppins, broadband
manager, South East England Development Agency,
Siemens
his is the biggest vulnerability to
Western lifestyles. But the growth of grid computing
may mitigate the risk to networked information
infrastructure. The weak link remains power generation.
- Kate Carruthers, Carruthers Consulting
hese attacks occur daily from
advertisers, malware, spyware and other data-mining
techniques. If left unabated, the most influential
"attacks" will be from businesses that prey
on the uninformed, slowing computers down with
pernicious software and turning Internet exploration
into a dangerous activity. - Andy Opel, Ph.D, Dept.
of Communication, Florida State University
he Internet experiences a multitude of
attacks on a daily basis. They come from hackers who
enjoy disrupting the flow of information. Some of these
attacks have indeed been devastating to the targeted
individuals or institutions. However, attacking the
flow of information is different from attacking the
power grid. The power grid, while vulnerable to attack,
also contains robustness due to its immense size. -
Jorge Reina Schement, Penn State University
hen I interviewed John Koskinen,
President Clinton's Y2K advisor in 1999, he was
working overtime to see that the "rivets
didn't fall out of the Golden Gate Bridge of the
nation's technology infrastructure," both here
and abroad, in those jurisdictions in which he could
assert any control or recommendations that might be
adhered to. Thinking about the consequences of a
national or international IT infrastructure blackout
can be mind-boggling. Being prepared and persistently
vigilant can help. There are some bad elements out
there, they are a tiny percentage of the general
population, and over time, they have consistently
wreaked havoc on the rest, but need not ruin any
forward progress we achieve in humane directions.
It's been five years since Y2K scenarios washed
over and you're not just now climbing out of a
mountain shelter, are you? What we need to keep a
second eye on is the effect that such scenarios create
in terms of spooking entire populations. Sure, there
are wolves, but we need not be sheep. - Victor
Rivero, technology editor/writer/consultant
ot if "devastating" means
something like "no internet for 24 hours."
It's way too decentralized for that. - Fred
Hapgood, Output Ltd.
'm not sure what you mean by
"devastating." We see roughly one devastating
attack every 6-12 months. Do you mean an attack with
loss of life? - Simson Garfinkel, Sandstorm
Enterprises/Technology Review
here will be many such attacks - the war
on terrorism will never be won and will always be
fought. - Bob Metcalfe, Polaris Venture
Partners
overnment has not taken a leadership
role in safeguarding the infrastructure, so that
security measures are fragmented. Particularly in the
current political climate, I see no reason to expect
meaningful change in this area. It is not amenable to
the self-coordinated efforts of the private sector. It
requires not only governmental coordination, but
intergovernmental cooperation. Furthermore, the
greatest threats to security are not technological, but
human. Creating environments and training programs that
discourage lapses in security procedures has not been a
priority. I believe it is security guru Bruce Schneir
who has pointed out that security all comes down to
walls and guards and systems that "fail
well." Most of our systems have not been built
with these factors prominently in mind. - Lois
Ambash, Metaforix Incorporated
he Internet is important enough to
attack even now and will be even more significant in
the future. Terrorists, particularly of the nihilist
type now evident in places like Iraq, will see the
Internet as a good target for disrupting the Western
economy and society. - Stanley Chodorow, University
of California, San Diego
ultiple attacks on the networked
information infrastructure over the coming decade will
cause many people to disconnect and disengage from
today's Internet. This will be due to a wide range
of concerns, from privacy and security to erosion of
their trust in its availability and even to their
boredom and declining interest in needing to maintain
breaking systems. - Dan Ness, MetaFacts
don't think this is possible.
Although there are many individual organizations that
are poorly protected from attacks, most have good
defense in place. The power grid is not directly
related to the Internet. The power grid is a national
security manner. It has always been subject to attack,
and has always been heavily fortified and defended by
routing around breaks in the network. In the U.S.
specifically, the grid is not one grid, but about six
grids that are not interconnected. You could take out
one, but you would have to attack more than one to take
out the country. - Mike Weisman, Seattle
attorney/Reclaim the Media
t might occur, but not with necessity.
In assessing the accuracy of such predictions, one
needs to take into account the agenda that they serve.
They might want to increase the alertness of those
responsible to guard their systems against possible
attacks. And they might also want to nourish public
fear, in order to justify more restrictive handling of
public liberties. - Albrecht Hofheinz, University
of Oslo
he Internet is by its nature robust, so
the network will always survive: ''The Net
interprets censorship as damage, and routes around
it'' - John Gilmore. If the power grid is
attacked, that will not be the Internet's fault,
but based on how the power grid is established and
managed such as positioning of mission critical systems
on an insecure intranet. The Internet itself does not
have any inherent weaknesses that would endanger the
power grid. - William Stewart
LivingInternet.com
'm concerned that most local
governments (city/county level) in the U.S., and around
the world, are not cognizant of the need to maintain
cyber-security. Given the inter-connectedness of
government networks, I can visualize ways in which an
attack on a city system could cascade to take out
utility or public safety nets regionally or even nation
wide. - Tom Foss, UNC School of Government/Center
for Public Technology
LF, al-Qaeda, disgruntled
''patriots,'' enterprise crime groups
located outside the U.S., ''because we
can'' hackers, and (hello FirstEnergy; hello
all you corporations whose web sites have exposed
Social Security and credit card numbers and other
sensitive data) sheer stupidity within the corporate
world and its wholly-owned subsidiary, government, are
all suspects in the coming attacks. The larger Goliath
is, and the more we rely on him, the better a target he
is for sending a message. - Michael Buerger,
Bowling Green State University (Ohio), Police Futurists
International/Futures Working Group
orces in commerce and society fear the
distributed nature of the internet and are working
diligently to layer centralized control on top of the
internet. It is the centralized structures that are
vulnerable to attack and will be the ones to topple. Of
course, the rest of the internet will merrily chug
along. - Scott Moore, Charles and Helen Schwab
Foundation
his is too tempting a target, is used
for so many commercial transactions, and there are very
motivated crazy people out there who have demonstrated
their intention to disrupt and/or demolish our country.
I completely belief it is just a matter of time. I just
hope everyone has a backup file! - Taryn Tarantino,
MarketSource, an Internet marketing company
oss of power or information to tens or
hundreds of millions for days or weeks will be
psychologically more terrifying than the loss of tens
or hundreds of thousands of American lives. The
magnitude of power or information failure for days or
weeks is so great, it is likely to destabilize the
e-economy not to mention bring social breakdown to an
advanced information and technology society such as
ours. Consider what happened in New York City when the
lights went off for a day. - Stan Faryna, president
Faryna & Associates Inc. (technology, design,
communications)
challenge the way you ask the question.
The networked information infrastructure is not a
national infrastructure - for the U.S. or any nation.
The power grid of the U.S. may be able to work in
isolation from the rest of the world, but the U.S. is
unable to meet the demands for all kinds of energy with
domestic sources. Thus, power is a border-crossing
phenomenon as well. Strange that it seems to be so hard
for U.S. citizens to wrap their minds around. So the
real question is: Will one devastating attack occur in
the next 10 years on the networked information
infrastructure or an important source of energy. The
answer is that both are happening all the time. -
Charlie Breindahl, University of Copenhagen
errorism use a lot of networks and as
communications will be more and more important, they
will attack in this new environment. - Jerome
Jolion, State of Geneva - CTI
ith greater centralisation of internet
networks and the continued hegemony of software and
other technology of a few super-companies (including
Google), a single big virus or other security blow will
be enough to bring down much of the internet. -
Bornali Halder, World Development Movement
think there will be several different
types ranging from more sophisticated computer viruses,
morally questionable content bombarding youth,
electronic ''bank robberies'' as well
as attacks on the networked information infrastructure
or a country's power grid. Not just one, but many.
- Linda Hurt, systems analyst, Office of Personnel
Management
And the following are from predictors who
chose to remain anonymous: [Workplaces of respondents
whose reactions are listed below include the National
Association of Regulatory Utility Commissions, FAA,
RAND, Microsoft, Harvard, the Open Society Institute,
MIT, Internet2, AOL, the National Center for Technology
and Law, IBM, Sapient Corporation, Netcraft, Consumer
Reports WebWatch, U.S. Court of Appeals, Resource
Interactive, Venture Growth LLC, Google, Stanford
University, British Airways, Indiana University,
University of Michigan, Citigroup, Social Security
Administration, Navy, USDA Rural Development, U.S.
Department of Justice, Optiem, the University of Iowa
and others.]
We have already seen the release of a "zero
day" virus (a virus for which no patch is
available) whose aim was the theft of personal
financial information. Within the next decade, a
"zero day" virus will be launched which will
compromise the financial data of millions of users
within a very short period of time (a few hours or
less). Banks will scramble to contain the damage.
Well, in a sense I agree: I have seen large attacks
already happen, e.g. against the Microsoft servers. But
technology is not sitting still, and our defenses are
continuously improving. I am an optimist, and I believe
that defenses will improve quickly enough to ensure the
next attack is not "devastating".
I might disagree with the word
"devastating." I think there will be an
attack, but I am not convinced that the impact will be
as great as we might fear it will be.
There may indeed be attacks, but I doubt that
"devastating" will be the result. The net is
resilient - it was designed to be so. Now the power
grid may be a different story ...
Countries such as North Korea are already training
hackers for use in the national military.
Not if we can help it ... and we're trying.
As the value of the infrastructure increases, the
power to use it or disable it becomes a more
politically palpable tool for good or ill.
That's the next logical step for terrorism. Bring
this country to its knees with its cyberinfrastructure
vulnerability.
Security, and correctness of implementation more
generally, is not taken seriously by the computer
industry. Small wonder: taking correctness seriously
would increase the cost of everything computer-related
perhaps by an order of magnitude. Only catastrophic
attacks could change the attitude.
Definitely; probably on both.
There is considerable, and growing, redundancy and
resilience. An attack will very likely occur, but its
severity will be more like a typical hurricane or
earthquake - troublesome, repairable, but not
"devastating."
Fundamental Islam understands how the West works and
will seek to attack key economic and profile
targets.
Hundreds of thousands of attacks happen each week,
"devastating" means one is successful - one
is not likely to lose money on this bet!
Terrorists these days are smart and will go for the
basic infrastructures. Also, while computers are great
and help things work better, we need to not forget how
to survive without in the event of such an emergency.
We need a traditional non-computerized backup.
It's an obvious target for terrorits or hackers
... and as we know, it will take such an attack for the
"establishment" (especially lazy
tech/software companies) to fix the numerous security
problems that plague the net ... but ironically,
without the net, it is the small disenfranchised
groups, like small cults or terrorists who will be most
harmed ... since it provides them with vast power that
would otherwise be reserved for massive corporations or
governments ... if they take it down, they are likely
to go down with it.
Not if the network is designed well and has numerous
redundancies. The current mesh network is very robust
and was designed to deal with many types of grievous
attacks.
Given the current terrorist context we live in and the
interest in hackers to show off their skills this is
inevitable - as is the unfortunate human quality to
only fix the problem once it has occurred.
Depends on what you mean by devastating. If you mean
very costly, yes. If you mean a failure that cascades
to other segments of society, with widespread suffering
or loss of life, then no.
The question, though, is how we'll weather it.
Maybe it will just cause a holiday where we come,
blinking, out into the sunlight for an afternoon.
There will be power grid failures without
attacks.
There is no reason to assume that there will be a
devastating attack. The internet has already survived
the worst attack (911) on the U.S. Efforts continue to
harden the infrastucture. The power grid will also
benefit from IP infrastructure, as broadband over
powerlines is providing an excellent way to monitor and
manage network elements in the power grid.
We have worked to harden the network. That said, the
Internet was built to withstand a decentralized attack.
It remains an open issue as to what might happen if the
attack was more focused. The country is so reliant on
the network from a business and financial perspective
it is highly likely that such an attack will be
attempted. How effective it will be is another matter.
The redundancy that has been created will go a long way
toward diluting the potential impact.
I believe it will take that in order for governments,
companies and organizations to make the needed
investment in security.
This has been predicted for many years without
fulfillment, especially by Richard Clarke. However, the
same was true of megaterrorist attacks prior to 9-11. I
hope Clarke is wrong this time, but he's probably
not.
Well, it depends what you mean by "attack"
and by "devastating." We are just as
vulnerable to system failures as in the blackout of
East Central U.S. in 2003. I believe similar outages
are likely, and will create the same kind of chaos.
Will they be deliberate - quite possibly, and as likely
to be instigated by mischievous "hackers" as
any politically motivated group.
By attack, you may mean a technical meltdown (similar
to what we've seen in past decades) as well as a
hostile assault. I strongly agree that some problems
will arise... chaos theory almost assures such an
attack in the Internet structure... tectonic plates
will shift!
Security is non-existent. - Anonymous security
consultant
I think for those who are interested in carrying out
devastating attacks, there are easier, lower tech, and
higher media-value avenues.
I'd modify that to be ''attack or
event'' - I don't discount devastation as
the result of ineptitude or poor planning.
Control networks are not secure and they reflect
monolithic, siloed, closed, proprietary and
centralized/decentralized architectures. Control
networks are our largest vulnerability in the U.S., in
the WORLD: Critical Infrastructure Air, Sea, Land and
Space. 4th-generation computing and regulation can
help, but we have to get moving. Industry needs to lead
or be compelled.
These kinds of attacks, or at least the nascent form
of them, are probably already happening and we
don't hear anything about it for security
reasons.
[It is] inevitable that terrorists will attack the
infrastructure, since it is becoming a symbol of
Western cultural values.
The Internet, while it makes our lives so much easier
and productive makes us extremely vulnerable. When your
way of life is fully electronic...all one has to do is
cut the power and watch us flounder. A recent Yahoo!
Internet deprivation study showed how people
''lost'' their ability to manage
certain life tasks (like going to the phone book to
look up a number - give me a break!) when their access
to the Net was gone. Extreme reliance on the Net makes
us less resourceful as human beings - beware, this is
scary.
Setting aside the obvious threat of terrorism, in
terms of attempts at political or economic disruption,
I think it is highly likely that a
''hacker'' will launch a significant
attach to demonstrate our vulnerability. My
understanding is that of some members of the hacker
subculture are activists of a kind. They seek to reveal
the limitations of the technology in order to improve
it.
Our society's security is built on a high level of
trust. This is especially true of our information
infrastructure. If bitter enemies (like Al Qaeda) do
not succeed in attacking it, vandals (like hackers)
almost certainly will.
Power systems have already shown themselves to be
vulnerable, as seen in the 2002 power outage across the
NE United States. Communications systems are less
obvious fragile, but the increase in users of the
internet, without infrastructure development suggests
to me that this is likely to happen soon.
This will of course foster more thought of fault
tolerance and redundancy.
I think the systems are sufficiently adept to avoid a
situation that would be termed
''devastating.'' There may be incidents
but the likelier near term stress will be on the
capacity of the systems themselves. This gradual
pressure will be a greater force and factor to reckon
with than any single, momentary attack.
Whenever an unchecked power dominates, marginalized
communities take it upon themselves to challenge that
authority. The network infrastructure has become such a
powerful tool.
My only disagreement might be that I think the
''or'' is optimistic. I would predict
significant and successful attacks on both. The targets
are as symbolically significant as the World Trade
Center or the Pentagon. Attempts to thoroughly disrupt,
corrupt or dominate the information infrastructure seem
inevitable. The vulnerabilities are too well documented
and already seem to invite sociopaths, egomaniacs and
nihilists; how far behind can the terrorists be? Power
grids are tied to the nets, why not a combined attack?
The power grid is symbolic in another way as well,
reflecting the gluttony for energy and other natural
resources that is represented by the West. This attack
could come from Western ecoterrorists as easily as from
foreign sources.
Considering information infrastructural
''protection'' is largely left to the
free market private sector, it seems likely that there
will be at least some big companies that fail to invest
in their network stability ... and, certainly the
deregulated power grids have shown no great capacity to
keep up their technologies for the public interest ...
they'll let them rot as long as there's more
(short-term) profit in leaving them poorly
serviced.
We already know the terrorists have been thinking
about and planning this. Our power grids are based on
the 1890s infrastructure, without advanced security
updates for the modern information age. We are
vulnerable. And yet, congress and the president still
cannot agree on an energy policy to upgrade
everything.
Both are too decentralized to make it worth it, and
neither makes great press. Blood and gore and death
have greater emotional impact. Besides, why attack the
U.S.'s power grid when it is so poor as to black
out an entire section of the country on its own? (If
terrorists could figure out a weak point, sure, but
they want carnage.)
We have already seen a major problem with the
country's power grid; this one wasn't even an
attack. Imagine what someone really trying to cause
harm could do. As for the network infrastructure,
anything that we become increasingly dependent on will
be subject to danger.
It took 20-30 years for the theory of commerce warfare
to be implemented from theorization in France to
implementation by Germany in World War I. Ten years is
about half that and is likely appropriate.
Attacks on these structures may happen, but
''devastation'' is unlikely. I'm
still much more frightened of a typical truck bomb,
which is much easier to construct and deliver than a
complicated attack on a power grid or information
infrastructure - something that would cause frustration
and annoyance, rather than mass casualties.
My understanding is that disruption of the top-level
DNS servers could be devastating. If our top-level
infrastructure is decentralized and fail-over servers
are available, one hopes that disruption would be
minimal. Organized crime/terrorists must certainly be
considering cyber crime since our society is so reliant
on online systems.
There will be devastating attempts, but they will be
prevented by the InfoSec teams.
The toolsets are available to those who would like to
do so the monoculture of Microsoft environments does
nothing but encourage such an attack.
Commercial vendors have no interest in common security
solutions. The monopoly position of Microsoft will
emphasize the ease by which IT systems will be attacks
or compromised on a large scale.
Devastating for some, but not all or not for a long
time period, however. I believe a power supply grid
attack would likely devastate a region, but if that
region is later isolated, the rest would function
normally. A network information infrastructure attack
that was physical, would have similar impact as on the
power grid. A ''virtual'' network
attack could devastate a larger portion of the network,
but probably for a shorter time period.
It's inevitable: the Internet is the Mount Everest
of hackers, and terrorists are bound to find it more
irresistible the more dependent we become on
it.
Technology is simply moving to fast to allow for the
proactive protection of the infrastructure. Only
catastrophes bring the necessary attention to
''the grid,'' I wish it were otherwise,
but it's simple human nature.
|