Cybercrime, Cyberwars, Cyberterrorism and Hacktivism – Part 1 - The truth behind cybercrime, cyberwarfare, cyberterrorism and hacktivism
This month (December 2010) has seen the mainstream media alive with stories of hacktivists attacking payment websites, including Visa, MasterCard and PayPal, in response to those organisations’ refusal to take payments in support of the WikiLeaks website. Every day we hear stories of cybercriminals stealing money and cyberterrorists causing mayhem, alongside state sponsored cyberwarfare as nations battle it out on line.
The reality is more complicated. Whilst these stories make good headlines the truth is often more disturbing; but what exactly is the truth behind cybercrime, cyberwarfare, cyberterrorism and hacktivism? What do you need to know and what do you need to do to deal with the problem?
Cyberspace, cybercrime, cyberterrorism, cyberwars and hacktivism
Most people would agree that the internet and the world wide web is generally a force for good. The free flow of information, ideas and commerce have taken a basic tool for sharing research data and propelled it into being a vital part of every day life. Hoever, like all aspects of life there is a darker side, and so it is with the internet. Criminals and malcontents are always looking for new ways to build income or conduct their activities and the internet gives them, on a plate, opportunities that few could have imagined.
Cyberspace is a term that was originally coined by William Gibson in 1982 and was made popular in his novel released two years later called Neuromancer. Cyber has now captured the public’s imagination as the term to use when referencing a whole host of activities taking place on the internet:
- Any crime that takes place within cyberspace is now deemed to be a cybercrime
- Interstate information battles are now deemed to be cyberwars
- …and terrorists are now able to conduct cyberterrorism from the comfort of their own homes
The scale of cybercrime is difficult to assess. What is certain is that for many people it is a real and present problem, but remains under-reported to the authorities for reasons of embarrassment, ignorance or a lack of faith in the authorities to investigate any possible offences. Some organisations have attempted to gauge the problem; in 2008 the ACPO (UK-based Association of Chief Police Officers organisation) National Strategic Assessment stated “Online fraud generated £52 billion worldwide in 2007” (ACPO, 2008) [1] and in 2004 the global cost of malware and viruses was estimated at “between $169bn and $204bn” [2] (BNAC, 2007)
In contrast, cyberterrorism has been defined by the US National Infrastructure Protection Centre, now part of the Department for Homeland Security as, ”a criminal act perpetrated through computers resulting in violence, death and/or destruction, and creating terror for the purpose of coercing a government to change its policies” [3] (Wilson, 2003).
Herein lays an interesting debate. I would suggest that we see very few criminal acts that truly fit into this definition. The often-cited examples of the Estonian and Georgian governments, attacked in 2007/8 as part of a ‘cyberwar’, could arguably be categorised as aggressive hacktivism rather than cyberterrorism as defined by the Department for Homeland Security—and certainly not cyberwar. Indeed, latest research indicates that the attacks, which affected some government agencies, emanated from hackers based in Russia acting on their own initiative rather than being a state sponsored punch up.
So when does cybercrime become cyberterrorism, and where does online protesting, often called hacktivism, come into play?
Hacktivism is a portmanteau word—combining hacking and activism in one term. It means the use of digital tools in the pursuit of political ends and normally results in a plethora of mainly annoying attacks such as defacement of websites and the stealing of low-level information. Rarely does it result in what could be described as cyberterrorism.
That said, there is no doubt that aggressive hacktivism is on the rise.
In January 2009 the United States Department of Homeland Security released an internal intelligence and assessment document entitled “Leftwing Extremists Likely to Increase Use of Cyber Attacks over the Coming Decade” that was subsequently put into the public domain by the Federation of American Scientists[4]. In this document is a very telling quote from an unnamed radical activist group, “…in today’s technological age, computer systems are the real front doors to companies. So instead of chaining ourselves together in the physical doorways of businesses we can achieve the same effect from the comfort [sic] our armchairs….”
Computers now form a new front line for such groups. As many in law enforcement know, when radical groups carry out direct action such as rushing through a targeted organisation’s front reception to access their offices the criminal damage that takes place is often a mask for a more sinister attack such as the planting of key logging devices or the download of data masked by the cacophony of the direct action.
Less visible are the attacks that these groups execute across the internet. We are now seeing political activists using the same hacking tools and technologies as cybercriminals. There are no boundaries to the use of technology to meet their objectives—the only limit appears to be the imagination of the criminal, hacktivist or terrorist group.
The next article in this series will cover the use of the internet by radical groups and the sinister use of open source intelligence gathering.
References
[1] ACPO. (2008). National Strategic Assessment. ACPO.[2] BNAC. (2007). British-North American Committee, Cyber Attack: A Risk Management Primer for CEOs and Directors. BNAC.
[3] Wilson, C. (2003). Computer Attack and Cyber Terrorism: Vulnerabilities and Policy Issues for Congress. CRS Web.
[4] Federation of American Scientists. Leftwing Extremists Likely to Increase Use of Cyber Attacks over the Coming Decade. Available at http://www.fas.org/irp/eprint/leftwing.pdf Last accessed 9th December 2010