By Dr. Robyn Torok
SECAU Security Research Centre
INTRODUCTION
There is no doubt that terrorism, in particular Islamic terrorism, remains for the foreseeable future an advanced persistent threat. Furthermore, links between terrorism and internet use are well established. Yet the key challenge remains of how we can develop resilience against such a threat. In order to proceed, there is a need to clearly define what an advanced persistent threat is and this will be developed using newly developed terminology of ‘cyber supported terrorism’. Barriers to developing policies of resilience will be discussed followed by an inspection of strategies used by several Western nations.
WHAT IS CYBER TERRORISM?
The term ‘cyber terrorism’ has been used to represent the threat posed by terrorists to information systems especially those connected to the internet. Such concerns have gained credence since the events of 9/11. Nevertheless, many researchers agree that the term ‘cyber terrorism’ has many varied definitions and is subject to exaggeration especially by media sources. One such example is to define cyber terrorism as terrorist activities carried out in the virtual world. Yet, this definition is both broad and problematic and is easily confused with other concepts such as: cyber crime, cyber attack, hacking or ‘hacktivist’. A simple example of a terrorist group hacking accounts to raise funds for its operations could hardly be termed cyber terrorism even if it does fit in with the above definition.
In trying to achieve a grasp of this term, the first point is to acknowledge that it involves a convergence between the physical world of terrorists and the virtual or cyber world. Overall, definitions recognise cyber terrorism as a threat against an information system. So the question arises, is cyber terrorism an advanced and persistent threat as opposed to a threat possibility? While aspects such as cyber crime, hacking, and cyber espionage are wide spread across the globe, cyber terrorism so far has been fairly isolated to small pockets such as Estonia. Consequently, at this stage, cyber terrorism cannot be accurately classed as an advanced and persistent threat. In addition, while there have been politically motivated cyber attacks such as those between Palestinian and Israeli hackers, these incidents fall well short of cyber terrorism. Despite this fact, as well as the often exaggerated threat of cyber terrorism, we cannot ignore cyber terrorism as a potential threat in the West. Nonetheless, guarding against a potential threat and developing resilience against an advanced persistent threat will require very different strategies and policy directions.
A NEW TERM – CYBER SUPPORTED TERRORISM
This article will introduce and argue for a new term ‘cyber supported terrorism’ to be classed as an advanced persistent threat. Such an introduction of an additional word may seem like semantics but it has significant ramifications for inclusions and exclusions which enable policy makers to better prioritise and frame directions. Therefore, ‘cyber supported terrorism’ will be defined as:
Any use of the internet that facilitates a direct terrorist attack or the cause and future operations of a terrorist group.
While this definition is very broad it provides an important paradigm shift from cyber terrorism where the internet is the target of an attack, to cyber supported terrorism where the internet becomes a facilitator of terrorism. A key advantage of keeping such a broad definition is that it allows policy makers to more readily view different cyber facilitated aspects as interrelated such as terrorism and organised crime. Terrorist groups like al-Qaeda have pioneered using the internet as a facilitator of terrorism to support their operations. More than this, the internet has in fact become central to a wide range of terrorist operations ranging from fundraising, co-ordination and command, to recruitment and propaganda.
One only needs to look at the writings of al-Qaeda’s chief architect of using the internet, al-Suri to see his plan of using the web to promote a global spirit of resistance amongst Muslims. In addition, al-Suri embraced the internet as a global facilitator of this movement and encouraged translations of key works into as many languages as possible. Clearly, the internet is an essential facilitator of terrorism making cyber supported terrorism an advanced persistent threat.
Some analysts propose that cyber terrorism may in fact be counter productive for al-Qaeda and associated terrorists groups who would rather use the internet as a tool to facilitate more traditional forms of terrorism. While not discounting the potential possibility of cyber terrorism, this assessment would seem reasonable given that any major form of cyber terrorism would provide a clear mandate for both policy and technical changes that could potentially undermine or at least limit certain internet freedoms that terrorists rely on for their operations.
BARRIERS TO DEVELOPING POLICIES OF RESILIENCE
Having contrasted the potential possibility of cyber terrorism against the well established and ongoing threat of cyber supported terrorism, it is important to look at barriers to developing policies of resilience to cyber supported terrorism prior to examining policy options.
Technical Issues
While the internet has many advantages such as speed, high levels of anonymity, access and ease of use; these also create issues when trying to develop resilience against terrorist’s using the internet as a central tool. In order to better appreciate these technical difficulties, it is important to have a brief look at some of the basic structural and governance features of the internet.
In 1998 the Internet Corporation for Assigned Names and Numbers (ICANN), a non-profit public-private partnership dedicated to preserving the operational stability of the Internet was established. Nonetheless, this is not a top down organisation with a clear system of governance, rather it is bottom up based on input and consensus from a wide range of stakeholders that include national governments but also private industry, transnational corporations and groups.
In addition to technical governance issues faced by ICANN, there are also issues faced by state and substate actors. Authoritarian or dictatorial governments are more willing to censor material compared to democratic governments. Substate actors such as internet service providers (ISP’s) are often unaware of radicalised or illegal content of their subscribers.
These structural features make the most common technical approach, shutting sites down, very difficult. Enhancing resilience to cyber supported terrorism by shutting sites down is largely regarded as ineffective. Although sites can be shut down in cooperation with ISP’s, the expansion of social media and free hosting sites have made it virtually impossible to permanently shut down terrorist related pages or sites as they can easily reappear on another site or under a different name. Consequently, technical issues provide a major barrier to enhancing resilience.
Issues of Privacy and Personal Freedoms
At the heart of democratic societies is the right to freedom of speech and freedom of expression. In the United States the First Amendment protects this right including the right to publish hate materials. Any policies related to enhancing resilience against the threat of cyber supported terrorism must respect a democratic societies’ right to personal freedoms and privacy.
Not only is the right to privacy and freedom of speech outlined in democratic constitutions, it is also reflected in Article 19 of the Universal Declaration of Human Rights (UDHR). Moreover, any attempts to implement security council resolutions related to terrorism such as UNSCR 1373 and UNSCR 1624 must comply with Article 19. Consequently, any attempts to curtail personal freedom of expression or limit privacy through online monitoring must satisfy a clear burden of proof relating to national security that exists with the state.
Organisations such as The Office of the Representative on Freedom of the Media argue that in an open and democratic society governments have no right to block or filter material. While this is an organisation that promotes civil liberties including right to privacy and free speech, it does nonetheless cite the protection of civil liberties as a key tenant of the Organization for Security and Co-operation in Europe (OSCE).
Transnational Issues
Perhaps one of the most significant challenges when trying to reduce the impact of cyber supported terrorism is the fact that the internet is a vast interconnected and global phenomenon. The White House in their national strategy for combating terrorism acknowledge that it is this transnational nature of terrorism and the reliance on the internet that makes it very challenging to combat. While some countries are active in the fight against cyber supported terrorism, others are not or lack the capability or will to take decisive action.
As an example, in Australia it is difficult to engage ISP’s and hosts in reducing radicalisation given that content may be legal in the hosted country but not in Australia. In this case, action is prevented by clear jurisdictional boundaries. Furthermore, it is not only legal issues across states but also political, cultural and economic differences that impact transnational cooperation in an attempt to gain a sense of governance over the internet. While places like Europe have the OSCE as a basis for transnational strategies in combating terrorism, many geographical areas lack such organisations or strategic initiatives.
Legal Issues
Legal issues are very much interrelated to the above two issues of freedom and transnational boundaries. Countries are varied in their legal frameworks to deal with cyber supported terrorism with some states having minimal and arguably ineffective frameworks. International legal frameworks are often not applied correctly or have loop holes exploited. In addition, countries have different judicial standards and procedures. A case in point is the greater willingness of the UK to prosecute cases of terrorist incitement on the internet compared to the US. Legislation also varies on the role of substate actors such as ISP’s with some countries holding them more liable for material than others. This is problematic given that such substate actors are not in a position to make legal judgements.
Not only do legal issues pose a challenge in the transnational context they also pose many quandaries within states. Legislation granting powers for surveillance must have clear boundaries as well as acknowledging potential pitfalls. Clear frameworks must be present in defining cyber supported terrorism. One particular obstacle is differentiating between radicalisation material that is objectionable or distasteful verses that which is illegal. In other words, at what point does propaganda material cross the line from freedom of expression to become illegal? Even when material is deemed illegal, there are often further challenges with the time needed to complete investigations coupled with issues of collecting and storing electronic evidence and putting it in a suitable format for trial.
In the APSM December issue, with cyber supported terrorism as the central threat, Part 2 will examine policy options for developing resilience, exploring what has been done as well as future possibilities and directions.
About the Author (Photo should be on file – ASM August 2011)
Dr. Robyn Torok is a researcher and analyst at SECAU Security Research Centre, Edith Cowan University with a focus on the discourses of terrorism: The role of internet technologies (social media and online propaganda) on Islamic radicalisation and extremism post 9/11.
