Overview
You can discover what your enemy fears most by observing the means he uses to frighten you.
Eric Hoffer
Terrorists have a very high success rate in meeting their immediate goals, but a terrible one in achieving any form of long−term success. That may well stem from their misunderstanding of how societies, as opposed to groups of people, work. But if you're in the middle of one of those short−term events, knowing that is small comfort.
This is a chilling topic, and descriptions of events or procedures may offend some readers. I do not apologize for this. Terror is literally a matter of life and death; your preparations to handle it must never discount that, in any sense.
Terror, as a method of warfare, is present throughout recorded history. The first change, in the modern era, was an escalation in the degree of violence used. Even then, this was a function of increasing technology as the Industrial Revolution gave us more capabilities, and the advances of science (especially chemistry and physics) led to a better understanding of what made bombs explode and how to further improve weapons technology. The terrorist's goal still tended to be a political change, and it was important for the terrorist not to alienate the general population, whom he claimed to serve and whose support he needed for concealment.
The United States government uses this definition of terrorism: the unlawful use of force or violence against persons or property to intimidate or coerce a government, the civilian population, or any segment thereof, in furtherance of political or social objectives. The dictionary defines terrorism as "the systematic use of terror, especially as a means of persuasion." Of course, we have to look up "terror." When we do, we find the first definition is "a state of intense fear," followed by other definitions, and culminating with "violence ... committed by groups in order to intimidate a population or government into granting their demands." Both of these definitions match the historical record, but recent changes in the use and users of terror may cause our understanding of the term to evolve. The Bremer Commission (named after its Chairman, Ambassador L. Paul Bremer), in its report submitted in June 2000, noted that the issuing of demands for political changes or the release of imprisoned terrorist comrades was no longer the norm; terrorism was being committed by fewer groups, but they did so for the sole goal of inflicting mass casualties on a target population for religious or ideological reasons. The commission also did not flinch from the fact that terrorists attacked American targets more than those of any other country.
Whether there is a political demand of any sort, terrorism still focuses on the use of premeditated, extreme (by the victims' standards) violence directed against symbolic targets, targets chosen for their emotional impact more than for any true military value. Why choose such targets? Two reasons: First, they are soft; they are not only generally not well−defended, they are almost impossible to truly defend. (Example: Think about the resources it would take to truly defend a hospital against a truck bomb; after all, ambulances and cars ferrying emergency patients drive right up to a wide−open door. And if this hospital is too well defended, then we can move on to another one, or a school, or a set of children's athletic fields—the concession stand usually has a substantial number of targets—that is, people—around it.) The second reason is that the terrorist wants the emotional impact of unsuspecting victims, people going about their ordinary lives. The message
sent by the successful attack on such a target is that you are not safe ... you will never be safe because I can reach out and kill you at my whim, on my schedule, for my reasons. You are not a civilian; you and everyone you care about are my enemy and therefore my targets.
The terrorist's definition of an enemy is not determined according to the rules of war, especially those developed in the European−North American culture. The modern terrorist's enemy is (often) that culture itself; therefore, everyone and everything associated with it are legitimate targets. There simply is no distinction between combatants and noncombatants, military and civilian, the government and the populace, men and women and children. In fact, those victims least likely to be considered targets are ideal because they demonstrate the reach—both the power and the will to use it—of the terrorist. They also emphasize the differences between them and us, playing into the cultural conflict. Therefore, women and children are better targets than men, the populace is better than the government, civilians and noncombatants are better than the military and other combatants (such as the police).
Targets should have symbolic value, collateral damage is a good thing, and the shock and horror of an unprepared victim are best. That makes a North American/Western European business location, preferably a trophy property, with Very Important People and lots of female staff, a wonderful physical target. That trophy property may well be your headquarters, the place where all your information flows, and, quite possibly, a major physical node on your network as well as its major delivery point.
One final point to be aware of: There are actually very few terrorist organizations, and their member population is not large. We can never really predict where they will choose to strike, though, because the number of possible targets that would make sense to them is so large. This leads to our needing to be prepared everywhere; universal preparation is hard to maintain because "everywhere" is never a target. Very few actual attacks occur, and there really are far, far more hoaxes (see Figure 7.1).
Figure 7.1: Terror events spectrum.
Because of this, we tend to relax our precautions and get sloppy in our measures to defend ourselves as time passes. This tends to result in an attack, when it does occur, that costs unnecessary damage and, especially, far too many lives.
Physical Attacks
Of course, you may not be the direct target. Instead, the physical targeting of a terrorist may have collateral damage that affects your network.
For instance, targeting a trophy property like New York's World Trade Center disrupted many, many networks because of the major switching centers located in or near that property (due to the volume of traffic in the area). Either way, you may lose physical connectivity to a major portion of your network, and you may lose additional critical assets, as well. Where, for instance, is your redundant storage? Some firms have it on a different subnet, on a different floor, but in the same building for good physical asset control. That's fine, until the entire building is a casualty.
Likewise, some firms in the World Trade Center had their redundant storage in the other tower; no one imagined a catastrophe so enormous it would take out both towers. Because of that, no one extrapolated what would happen if both towers came down (the construction engineers used the term pancaked for the type of collapse in place; it could have been worse, had they toppled sideways)—the surrounding buildings, which had been relatively fine until then, suffered enormous damage, which led to further collapses.
Or we could consider the Pentagon: a series of concentric rings connected by corridors. When a substantial blast hits a building, where do the fireball and concussion wave go? Through everything nearby, of course, but material objects absorb some of the energy, while corridors give that energy an easy path to keep going. An overhead photo of the Pentagon published in the days immediately following the attack showed what appeared to be soot or other smoke damage tracing out the corridor connections.
Depending on the building's fire suppression system, the smoke and heat that travel down the corridors may be enough to set off overhead sprinklers some distance away from the physical damage; how will overhead water affect your systems? (Even if you don't have overhead sprinklers in your equipment area, if they go off on the floor above, are you sure no water will come down through your ceiling?)
Bombs
Bombs have been a preferred terror weapon virtually since the beginning of modern terrorism, which most historians place in the late nineteenth century. Some form of bombing occurred in a strong majority of the attacks that have taken place in recent years; from 1994 to 1999, for instance, most attacks involving U.S. citizens or assets took place in Latin America, and the overwhelming majority were bombings. A total of 613 Americans were wounded; 64 were killed. On a global basis, businesses were the preferred target in this period (1,589 attacks versus 107 against government sites, 44 against military locations, and 584 against all other targets; likewise, American businesses had 133 casualties, compared to 9 each for military and diplomatic sites, 7 in government facilities, and 26 in all other types of facilities).
Bombs are not terribly difficult to construct (and the learning curve ensures there are no stupid bombers), they do not require large numbers of people to create or use (the fewer involved the better, from a security standpoint), and they have great effect. The heat and blast wave, perhaps carrying additional debris and/or shrapnel, does extensive damage. The function of a bomb is really nothing more complex than to cause a large, essentially instantaneous, transfer of energy into objects ill prepared to receive it. The innovation, if you wish to call it that, of September 11, 2001, was that the delivery vehicle itself was the bomb—a high−speed jet with a transcontinental fuel load delivered an enormous amount of energy to a specific target.
If the goal is property destruction, the bomb manufacture will emphasize heat and blast wave (concussion) effects. If the goal is to kill people, some of the energy will be absorbed by an extra payload—nails and other metal intended to be carried by the blast wave as high−energy projectiles. Both will cause physical destruction to buildings and their contents; the difference is in degree and in the additional casualties inflicted by the shrapnel payload.
Electromagnetic Pulse
At the time of this writing, an electromagnetic pulse (EMP) bomb has not been used, to my knowledge, by terrorists. The possibility has been discussed among network operators, however, and there really is no inexpensive protection against it. Where a conventional bomb causes damage to structures via the physical transmission of energy, an EMP bomb would cause damage to all electronic equipment—and only that equipment—within the range of its pulse.
For those not familiar with it, an electromagnetic pulse is a surge of electromagnetic force that transfers some of its energy to any electricity−carrying medium it passes through. If the pulse is large (which is the point), the circuitry can be melted, or even vaporized. If not, the electric circuit becomes a carrier for the pulse, which is no longer dissipating according to the inverse−square law. It flows down the circuit until it meets an interface incapable of carrying the load, at which point damage occurs (the cable may well be able to carry more power than the components of the circuit board to which it connects, for instance). EMP is generated, among other ways, by the detonation of a nuclear warhead. This need not be an exo−atmospheric detonation, though, if one of those were to occur, the effects would range over a continental−scale landmass (and network survival would become secondary to personal survival).
Most empirical data regarding EMP was developed before the bans on nuclear testing, so it is dated; some information is publicly available regarding the effects of a both an above−surface and a surface nuclear detonation. In the latter, a torus (whose dimensions would depend on the actual warhead size, type, and elevation at detonation) surrounding the blast point would be affected by EMP; this is beyond the area of shock and blast damage. Thus, a terrorist detonation of a nuclear device in a city might well have electronic effects that carry some distance away, ruining data and telephony switches, routers, and more.
It is not actually necessary to detonate a nuclear device to create an EMP. Any large and catastrophic discharge of electromagnetic energy would also act as an EMP. The principles are fundamental physics, and the implementation is electronics; testing of such weapons may have been done by the western militaries as early as the mid− to late 1980s. I found technical descriptions of such devices in a simple Internet search. Unfortunately, a like−minded terrorist could do the same.
Sabotage
Sabotage derives from the practice of disgruntled people throwing objects into the machinery during the early days of the Industrial Revolution in protest of the loss of work and disruption of their lives (the objects were, indeed, sometimes their sabots, wooden shoes, which would seriously damage the equipment). Sabotage can be a form of network attack, which we will address later in this chapter, but it can also be physical.
Consider a highly automated manufacturing facility; the automation is almost certainly controlled via software delivered by the network. The network can be the means of delivering the instructions that commit sabotage in such a facility. As an example of what could happen, recall the disaster at Bhopal, India.
Union Carbide built, in association with a local partner, a pesticide manufacturing plant outside the city of Bhopal. Squatters and slums developed in the area surrounding the plant (it was originally a little distance away from the population center). On the night of December 3, 1984, a cloud of methyl isocyanate (MIC) gas leaked from the plant and blew over a portion of the settlements. The Madhya Pradesh state government report cited approximately 3,800 deaths, 40 cases of total disability, and 2,680 persons permanently partially disabled. Other reports, usually provided by parties attempting to increase the payout from Union Carbide, cite much larger numbers in all categories. Union Carbide went through years of litigation, including continuing litigation after paying a $470 million final settlement in 1989 ($610.3 million in 2001 dollars).
The plant had a number of processes that had to be modified in order to create the MIC gas; physical sabotage was alleged but never proven. Likewise, a whole series of software−controlled safety systems had to be bypassed to run the infamous tests at Chernobyl (tests to which the on−site operators objected and were overruled). Does your company have a network that delivers operating instructions to physical processes? Could someone use the network to alter those processes?
It would not necessarily be a catastrophic event, though that is the likely outcome of a terror attack of this sort. And it has the same "elegance" as the use of the delivery vehicle as the weapon on September 11: It uses the culture's achievement as the means of inflicting great damage.
CBR Attacks
Chemical, biological, and/or radiological attacks are less likely, but they are not out of the question. They are also very hard to defend against. I've carried a gas mask in a pouch on my hip, but it had simple training filters in it. The wartime filters—the ones that could have actually defended me against a Warsaw Pact gas attack—were in secured storage (as they should have been—how many little things do we all lose track of?). Even so, at the first hint of the presence of gas, we were trained to don, clear, and then warn: pull the mask out of the pouch and unfold it, pull it over the head (taking off my glasses, a small delay), pull the elastic straps tight, press my hands tight over the intake zones, and exhale—with the breath I had left at this point because you do not inhale during any of this—hard enough to blow out any gas that was trapped inside by the donning process. Then, and only then, do you warn other people. The reason? If you delay to warn others, you may become incapacitated and the warning would not even be given—and you will have made a useless sacrifice.
To give troops an incentive, one exercise was held in a room filled with tear gas; the troops noticed how it was no problem at all, with the mask properly on. You learned to appreciate just how good the mask was when it became your turn to remove the mask, recite name, rank, and service number, and then don and clear your mask. I could not recite those fast enough to avoid getting some of the gas in my throat (via nose or mouth hardly matters); I was able to don and clear, but I coughed and gagged for some time, and my clothes reeked of it. That was simple tear gas (though a heavy amount for training purposes). How well could your people respond, without gas masks, to a simple tear gas attack?
Gas is difficult to do well; though heavier than air, finely atomized it will spread on the air currents, and so it dissipates rapidly unless confined to a space (such as a tight, weather−proofed modern building). A well−ventilated building will, unfortunately, disseminate the gas rapidly. Gas also needs to be at the appropriate concentration to do the level of damage desired (though if the desire is to kill, there is a great deal of room for error on the high side). There are four basic forms of gas agents: skin (blister) agents, choking agents, blood agents, and nerve agents.
Skin agents include tear gas, which is essentially an irritant to the mucous membranes (in the correct concentration; at higher levels it can be quite damaging). Other skin agents cause blistering from chemical burning of the skin, which is extremely painful. Such agents do severe damage if they contact the eyes or get into the respiratory system. They are, however, usually intended to debilitate rather than to kill.
Choking agents are intended to attack the respiratory system, leading to breathing difficulties, the filling of the lungs with fluid (edema—if severe enough, drowning in one's own body fluids), pneumonia, and so on. They are debilitating to fatal, depending on the degree of exposure.
Blood agents attack the circulatory system, usually penetrating the skin and then using the very system they attack to disseminate the weapon through the body. Blood agents prevent the transfer