The American Cyber-Angst and the Real World – Any Link?

1. The American Cyber-Angst and the Real World – Any Link? Ralf Bendrath Internet Regulation & Legitimacy Project Collaborative Research Center "Transformations of the State" University of Bremen www.state.uni-bremen.de ralf.bendrath@sfb597.uni-bremen.de Forschungsgruppe Informationsgesellschaft und Sicherheitspolitik www.fogis.de

2. Overview • „Cyberthreats“ and reality(-making) • Discursive changes and turns • From Clinton to Bush and then… • Timeframe: End of 2000 to End of 2002 • Explanations? • Discurse and Reality(check)

3. „Cyberthreats“ and reality(-making) • Information society as risk society • Cyber risks especially hard to measure • No past experience • Nature of attackers unclear • Depending on technical sensors • Focus on techical means and options • „What could?“ is key • Constructions of the future, fact and fiction • „Security“: control of the future!

4. The Clinton Legacy • Oklahoma and WTC‘93 bombings • „infrastructure protection“ / CIP discourse • „terrorists“ as new cyber-enemy

5. The Clinton Legacy: Terrorism „One of the biggest threats to the future is going to be cyberterrorism -- people fooling with your computer networks, trying to shut down your phones, erase bank records, mess up airline schedules, do things to interrupt the fabric of life.“ Bill Clinton, foreign policy farewell lecture, December 2000

6. The Bush start: States! • March 2001: Defense Science Board report • “more than 20 states” are supposed to have information warfare capabilities • „China has made clear its intention to use Information Operations (warfare) as an asymmetric response in any conflict with the United States.“

7. „Deterrence“ Critical infrastructure protection is a core issue for security for the United States, and one that therefore sits squarely on the radar screen at the National Security Council. (…) In some ways, this is a classic deterrence mission. Condoleezza Rice, Internet Security Policy Forum, March 2001

8. „Warfare“ “Our United States and our allies ought to develop the capacity to address the true threats of the 21st century. The true threats are biological and informational warfare.” George W. Bush, Iowa speech, June 2001

9. Even more states! “Over 100 countries already have or are developing computer attack capabilities.” Keith A. Rhodes, CTO General Accounting Office, House of Representatives, August 2001

10. But then: Terrorism • 9/11 and its impact “While bin Laden may have his finger on the trigger, his grandson might have his finger on the mouse. Frank J. Cilluffo, CSIS project on Homeland Defense, at US Congress, November 2001

11. Convincing NATO • 9/11 and its international impact “We need to prepare, as an Alliance, for the full range of asymmetric threats: new forms of terrorism, to be certain, but also cyber-attacks, attacks on space assets and information networks.” Donald Rumsfeld, NATO council, December 2001

12. From Potential to Certainty “Islamic Cyberterror Not a matter of if but of when Al Qaeda terrorists interested in computer hacking are only a few clicks away from a crash course in digital sabotage.” Newsweek, 20 May 2002

13. From Certainty to Forecast “The U.S. government is due for a "major" cyber attack within the next 12 months and is unprepared to counter the threat” Internet News, 26 June 2002

14. It‘s already happening! “Al-Qaeda Wages Cyber War Against U.S. Osama bin Laden's al-Qaeda is making full use of the Internet in its all-out war against the United States” Agence France Press, 30 June 2002

15. Suicide cyber attacks! a pro-Arab hacker predicted “suicide cyber attacks” if the U.S. started a war against Iraq. “IT Director”, 12 September 2002

16. Ooops… • August 2002: “Digital Pearl Harbor” exercise • Naval War College and Gartner Group • Only nation-states would have the capability to attempt large-scale attacks. • But even governments with their resources not able to inflict serious damage.

17. Armies, not terrorists There are terrorist groups that are interested [in conducting cyber attacks]. We now know that al Qaeda was interested. But the real major threat is from the information-warfare brigade or squadron of five or six countries. Richard Clarke, head of the White House Office for Cyber Security, August 2002

18. 9/11 – no, 9/18 • “Wake-up call” Nimda Worm, not 9/11 • Nimda spread on 18 September 2001 • „National Strategy to Secure Cyberspace” released 18 September 2002 • More passive, hardening as major goal

19. Summary • Clinton: Cyberterror • Bush, first half 2001: Cyberwar • Bush after 9/11: Cyberterror • Bush, a year later: Cyberwar and Teenagers

20. Explanations? • Change in real world cyber threats?  no data proving this • Change in measuring standards?  quantity, not quality (terrorist ping?) • Hidden agendas?  sure, but with little influence  or agenda same for terrorism and war • So?

21. Explanation? • “Cyber” as a wildcard, added to the general threat estimates and discourses • Works as an amplifier • Explain general security discourse then • Cyber-Angst: No link to reality?  Yes, but not to reality of cyber-security!

22. It could be just junk mail, Colonel, or the beginning of a major enemy attack...