Other

Lawhorn: Does Internet Terrorism Exist?

By Sandy Kendall

February 03, 2008 — CSO —

by Rick Lawhorn

As a CISO, I faced a daily uphill battle getting buy-in for the most basic security controls and services - so the notion of worrying about the potential risk of terrorism against my organization seemed to be the lowest priority. Interestingly, terrorism today seems to be an emerging concern in the commercial world, and many are actively pursuing methods and technology to help combat the problem. As a result, I began to research this trend to determine its drivers and its potential implications to information security.

I have been able to identify two main factors to date that play a part in the increased concern for businesses. First, governments all around the globe are spending vast amounts of money trying to track and contain Internet terrorism, and as former government security professionals are landing executive roles as CSOs and CISOs in the private sector, awareness and education about terrorism is increasing. Second, the news media is making Internet terrorism and the targeted attacks front-page news, which impacts a much larger audience. The combination of these factors propels companies and their leadership to ask the important questions in order to determine the risk it presents, especially in the critical industries like utilities and supply chains.

The Definition Problem
Understanding this threat and its impact on organizations today requires some background on how terrorism is defined. This is no easy task. Each of us has a pre-conceived notion of what terrorism means. I am confident that your definition differs from mine – though there are undoubtedly some common characteristics - since our definitions are shaped by our personal environment and experience. In fact, it might be impossible to arrive at a definitive answer because definitions fluctuate according to historical and geographical contexts. Some forms of terrorism are indistinguishable from crime, revolution, and war.

Even the US government is struggling with a consistent definition by evidence of the following chart:

State Department definition, Title 22 of the U.S. Code, Chapter 38, Section 2656f(d): premeditated, politically motivated violence perpetrated against noncombatant targets by subnational groups or clandestine agents, usually intended to influence an audience.

FBI definition: the unlawful use of force or violence against persons or property to intimidate or coerce a government, the civilian population, or any segment thereof, in furtherance of political or social objectives.

Defense Department definition: the calculated use, or threatened use, of force or violence against individuals or property to coerce or intimidate governments or societies, often to achieve political, religious, or ideological objectives.