Paul de Souza: Defining Cyber Terrorism

The primary purpose of covering this topic is to be able to effectively provide national security professionals with a better understanding of cyber terrorism by compiling and extracting sound knowledge from scholars of the subject in an effort to determine an appropriate, comprehensive definition of cyber terrorism. It is vital to present a clearer view of cyber terrorism as a practical contribution to the national security community.

A study covering current definitions of cyber terrorism by different organization and how they complement one another can lead the national security professionals to have a better understanding of the reality of cyber terrorism. Finding the cause of such variety of definitions and lack of doctrinal documentation on the subject of cyber terrorism alone can be challenging. This becomes even more challenging when linked to the American national security apparatus and how the various agencies deal with the alleged threat of cyber terrorism.

The United States of America has been challenged with new terror tactics in cyberspace from its adversaries. Many of these new tactics have never been seen before, which means they are not very well understood, particularly when they become increasingly sophisticated. “The modern thief can steal more with a computer than with a gun. Tomorrow’s terrorist may be able to do more damage with a keyboard than with a bomb” (National Research Council, 1991, pg. 7). The notion of cyber terrorism goes back to the early nineties, which can be quite surprising. Much progress has been made in cyberspace not only as a way to communicate but also as a way to cause physical damage to systems and people. The National Research Council does not use the term “cyber terrorism” per se, but it gives the reader a look into the future of terrorists using the keyboard to do damage. Cyber terrorism is an unpredictableact. Much like what can be seen in the physical domain when referring to terrorism, the same reality can apply to the cyber domain in terms of unpredictability. However, in the physical domain, a better understanding exists on how to predict and/or counter physical terror attacks, which is often due to the knowledge provided from intelligence sharing. Although strides are being made daily, this type of intelligence collaboration does not really apply yet to the cyber environment as it relates to terrorism, and in order to have better situational awareness, first of all, there needs to be a better, clearer, more concise definition of what cyber terrorism would be, and just as important, there needs to be an understanding of how such definitions can be used in a court of law for prosecution.

Much talk about cyber terrorism exists in the cyber security community as well as in the intelligence community. The use of cyberspace for power projection is already well defined by the Department of Defense, but not much doctrine can be found on the subject of cyber terrorism. The definition of cyber terrorism seems to be very fluid, and determining how much fear or loss of life cyber attacks can create on the American populace is a difficult task. Having a better understanding of cyber terrorism and how it relates to American national security would be beneficial to readers and professionals dealing with terrorism in general.

The Japanese people seem to show an increasing interest in the phenomena of cyber terrorism. Japan prosecuted Yusuke Katayama, a Japanese citizen who posted threats online to commit a massacre at a convention in Japan. The courts in Japan were able to prosecute him as a cyber terrorist. The online threat was enough to qualify this case as cyber terrorism. The fear of North Korea’s cyber capabilities can also contribute to the creation of cyber terror laws. The Sony incident is a clear case of this posture from Japan. The intense Google search of the phrase cyber terrorism in Japanese is a clear indication of a shift in the way an entire nation sees cyber terrorism.

The following is from INTERPOL’s (2014) 83rdGeneral Assembly ministerial meeting regarding Japan:

The Japanese police in dealing with cyber intelligence and cyber terrorism. Recently in our country, growing number of cyber intelligence cases are being detected. In these cases, attempts are made to steal confidential information from governments, private enterprises, and other organizations. Throughout the world, there has also been a rash of cyber terrorism targeting the core systems of governments and critical infrastructures. These kinds of attacks pose serious threats to the security and economy of each nation. (pg.2)

Cyber attacks causing loss of life and destruction of critical infrastructure seem to qualify the courts in Japan to prosecute people and organizations involved in such activities.

Poland has also shown tremendous commitment to the creation of anti cyber terrorism laws, as stated by Poland’s Ministry of Foreign Affairs (2012):

“The cyberspace of the Republic of Poland includes systems, networks and data communication services of particular relevance for the internal security of the country, operated, among others, by state and local government institutions, the banking system as well as systems to ensure the functioning of the country’s transport, communications, energy, water and gas infrastructure and health care IT systems, where their destruction or damage may pose a considerable threat to human life or health, national heritage and environment or cause serious damage.” (para. 1)

Poland considers cyber attacks against human life or health, to include national heritage as cyber terrorism, making its anti-cyber terror laws even more comprehensive than the Japanese laws.

Sec.66F from India’s cyber laws and the Information Technology Act is very comprehensive and covers more ground than Japan and Poland combined:

*[66F. Punishment for cyber terrorism.

(1) Whoever,-

(A) with intent to threaten the unity, integrity, security or sovereignty of India or to strike terror in the people or any section of the people by –

(i) denying or cause the denial of access to any person authorized to access computer resource; or

(ii) attempting to penetrate or access a computer resource without authorisation or exceeding authorized access; or

(iii) introducing or causing to introduce any Computer Contaminant and by means of such conduct causes or is likely to cause death or injuries to persons or damage to or destruction of property or disrupts or knowing that it is likely to cause damage or disruption of supplies or services essential to the life of the community or adversely affect the critical information infrastructure specified under section 70, or

(B) knowingly or intentionally penetrates or accesses a computer resource without authorization or exceeding authorized access, and by means of such conduct obtains access to information, data or computer database that is restricted for reasons of the security of the State or foreign relations; or any restricted information, data or computer database, with reasons to believe that such information, data or computer database so obtained may be used to cause or likely to cause injury to the interests of the sovereignty and integrity of India, the security of the State, friendly relations with foreign States, public order, decency or morality, or in relation to contempt of court, defamation or incitement to an offence, or to the advantage of any foreign nation, group of individuals or otherwise, commits the offence of cyber terrorism.

(2) Whoever commits or conspires to commit cyber terrorism shall be punishable with imprisonment which may extend to imprisonment for life. (Centre, 2000)

The Indian courts go beyond loss of life and destruction of infrastructure through cyber means as an act of cyber terrorism. Defamation and injuries to the sovereignty of the state of India by hackers can qualify the offender as a cyber terrorist.

One can also see the uptick of searches of the term cyber terrorism in the United States. What makes America and cyber terrorism an interesting case is the obscure lack of definition by the courts of cyber terrorism. The United States seems to be behind in terms of creating awareness on the subject.

Another interesting activity in government as it relates to regulation, law, and policy covering cyber terrorism as a threat to national security comes from bills proposed in the US Congress. Currently there are three proposed bills mentioning the words “cyber terrorism” with little explanation of the meaning of cyber terrorism.

Passing bills on cyber terrorism with updated definitions may aid the prosecution of cyber terrorism domestically and internationality. A curious aspect of these proposed bills is the main drive for the bills being proposed based on North Korean activities.

S.1747 – North Korea Sanctions Enforcement Act of 2015

Sponsor:          Sen. Menendez, Robert [D-NJ] (Introduced 07/09/2015)

Committees:    Senate – Foreign Relations

S.2144 – North Korea Sanctions and Policy Enhancement Act of 2015

Sponsor:          Sen. Gardner, Cory [R-CO] (Introduced 10/06/2015)

Committees:    Senate – Foreign Relations

H.R.5208 – North Korea State Sponsor of Terrorism Designation Act of 2016

Sponsor:          Rep. Poe, Ted [R-TX-2] (Introduced 05/12/2016)

Committees:    House – Foreign Affairs

The H.R.5208, sponsored by Poe (2016) is one of the most recent updates regarding North Korean activities:

In March 2015, the South Korean government publicly accused North Korea of responsibility for a December 2014 cyber attack against multiple nuclear power plants in South Korea, stated that the attacks were intended to cause a malfunction at the plants’ reactors, and described the attacks as acts of “cyber-terror targeting our country.” (para. 27)

The term “cyber terror” was coined by Barry C. Collin in the 1980s. Barry Collin was able to identify the relation between electrons in the virtual domain and the possible consequences of how such electrons could be used to disrupt, destroy, degrade, deny, and deceive systems to cause real physical effects. Collin seemed to be ahead of his time in the 80s to even imagine such a reality. Collin runs the Institute for Security and Intelligence—a non-profit organization dedicated to man-made disasters awareness. The term “cyber terror” was not even recognized by the FBI in the 1980s as a possible reality with which the agency would have to deal. There are many security professionals who started the discussion surrounding cyber terrorism even before agencies and the international community started to officially define the term cyber terrorism. Why does it matter to have a more adequate definition of cyber terrorism? Would definitions stop cyber terrorism or help suppress such activities?

Definitions can become doctrinal in nature, and the enforcement of such could change the way that agencies would recognize cyber terrorism and respond to it. International courts will possibly refer to definitions that could fit a given criminal case. The excessive number of definitions of cyber terrorism could create too much room for discretionary actions and even some loopholes when prosecuting cyber terrorists.

The author would like to propose unique groups and their definitions of cyber terrorism broken down into the following: law enforcement, military, intelligence community, international organizations, think tanks, and known security experts. These six categories can offer a variety of views into cyber terrorism and how one could, through careful analysis, coin his or her own definition of cyber terrorism. This form of exercise can improve the understanding of cyber terrorism and support the effort of defining a more modern use of cyber terrorism.

1-   Law Enforcement

Law Enforcement relies heavily on the court systems in order to respond accordingly to an act of terror in cyberspace. Judges, legal frameworks, and the public become part of a legal system that has the ultimate goal of apply justice and restore order.

Too broad of a definition can give room to speculation and hearsay to take place, while a too narrow definition may not have enough width and depth for a solid prosecution.

First one should understand the US legal code as it applies to terrorism itself. 18 U.S.C. § 2331 defines “international terrorism” and “domestic terrorism” for purposes of Chapter 113B of the Code, entitled “Terrorism”:

“International terrorism” means activities with the following three characteristics:

▪      Involve violent acts or acts dangerous to human life that violate federal or state law;

▪      Appear to be intended (i) to intimidate or coerce a civilian population; (ii) to influence the policy of a government by intimidation or coercion; or (iii) to affect the conduct of a government by mass destruction, assassination, or kidnapping; and

▪      Occur primarily outside the territorial jurisdiction of the U.S., or transcend national boundaries in terms of the means by which they are accomplished, the persons they appear intended to intimidate or coerce, or the locale in which their perpetrators operate or seek asylum.

“Domestic terrorism” means activities with the following three characteristics:

▪      Involve acts dangerous to human life that violate federal or state law;

▪      Appear intended (i) to intimidate or coerce a civilian population; (ii) to influence the policy of a government by intimidation or coercion; or (iii) to affect the conduct of a government by mass destruction, assassination. or kidnapping; and

▪      Occur primarily within the territorial jurisdiction of the U.S. (GPO, 2012)

The FBI (2016) refers to 18 U.S.C. § 2332b and how it defines the term “federal crime of terrorism” as an offense that meets the following criteria:

▪      Is calculated to influence or affect the conduct of government by intimidation or coercion, or to retaliate against government conduct; and

▪      Is a violation of one of several listed statutes, including § 930(c) (relating to killing or attempted killing during an attack on a federal facility with a dangerous weapon); and § 1114 (relating to killing or attempted killing of officers and employees of the U.S.).

FISA defines“international terrorism” in a nearly identical way, replacing “primarily” outside the U.S. with “totally” outside the U.S. 50 U.S.C. § 1801(c). (para. 3)

The FBI maintains the official cyber terrorism definition in the US “Premeditated, politically motivated attack against computer systems, computer programs, and data which results in violence against non-combatant targets by sub-national groups or clandestine [hidden, illegal] agents” (Dimov, 2014, para. 3) According to the author’s research the FBI leads the anti cyber terrorism efforts in the US following its definition.

The cyber terrorism definition provided by the U.S Federal Bureau of Investigation makes the link between politics, cyber, nationality, and military/civilian targets. The US code on terrorism has a clear focus on International and domestic terrorism covering “intent” which can be translated or interpreted as “premeditation” as per the FBI’s cyber terrorism definition.

The political aspect of 18 U.S.C. § 2332b reads “calculated to influence or affect the conduct of government by intimidation or coercion” whereas the FBI’s definition “politically motivated attack” seems to focus on the motivation of the attack being political and not the attack itself applying coercion onto a political system seeking to destroy it. The FBI’s cyber terrorism definition covers violence as a result of a cyber attack against a certain group of individuals in society: “non-combatant targets”, i.e., civilians and not military targets. This brings an interesting jurisdiction statement. The FBI’s cyber terrorism definition applies to domestic targets only. The cyber terrorists could be “sub-national groups or clandestine [hidden, illegal] agents” (Dimov, 2014, para. 3). Interestingly enough the cyber terrorist could well be an FSB agent conducting a Supervisory Control and Data Acquisition (SCADA)attack against a US dam operated by the US Army Corp of Engineers. The FBI’s definition of cyber terrorism would not apply to this hidden agent because the attack has not resulted in “violence.” According to the American US code covering terrorism, such FSB agent would be prosecuted, if on American soil, due the fact that it is a “dangerous act to human life” with “intent” to kill. The FSB agent would know that by overflowing a dam human lives could be put at risk and casualties could occur through a cyber attack. The FBI’s cyber terrorism definition would have to result in violence, and not necessarily loss of human life. The US code definition of terrorism seems to be easy to apply to an act of a person or a group attempting to commit a dangerous act against human lives with political motivation. When comparing the FBI’s terrorism definition to the definition of terrorism by the US Legal Code one can see that the FBI’s definition can lose ground in court, as it lacks coverage as it relates to the art of the possible in the domain of offensive cyberspace operations. The FBI’s definition also shows a bit of redundancy when covering data and programs. Programs can be explained as organized data in a given programing language (software).

2-   Military (US Department of Defense Focus)

A definition of cyber terrorism is not currently found in the Department of Defense Dictionary of Military and Associated Terms, Joint Publication 1-02. More research on military documentation is needed in order to maybe find a definition of cyber terrorism.

3-   Intelligence Community (Intelligence Agencies)

The U.S. Department of Homeland Security/Office of Cyber and Infrastructure Analysis (DHS/OCIA) OCIA defines cyberterrorism as politically motivated use of ICT with the intent to influence government policies; coerce civilian populations; sabotage infrastructure; affect economic decisions; or otherwise intimidate commercial, public, or government entities.

This is the only definition of cyber terrorism from the IC found on the Internet by the DHS/OCIA. The IC uses the words cyber terrorism quite often with no official definition of cyber terrorism publicly known.

4-   International Organizations (NATO)

NATO maintains a list of articles on the topic of cyber terrorism published from a variety of authors and organizations but NATO itself has not officially provided a definition of cyber terrorism. Some of the authors and organizations found on NATO’s website include (but are not limited to) the following:

·     Barry C. Collin,

·     Dorothy E. Denning, Georgetown University,

·     James A Lewis, Center for Strategic and International Studies, and

·     Mark M. Pollitt, FBI Laboratory.

Cyber Terrorism Defined Around the Globe

Since President George W. Bush signed into law the Authorization for Use of Military Force (AUMF) of 2001, the United States has been engaged in what has since become colloquially known as the “Global War on Terror” (U.S Congress, 2001). Hobart Richey (2016), a government relations associate for the Cyber Security Forum Initiative explains part of the evolution and significance of terrorism and cyber terrorism:

The subsequent military campaign began with the hunt for Osama bin Laden and removal of Al-Qaeda from power in Afghanistan, but over the years spread in scope as the Middle East further destabilized and terrorist groups thrived in the chaos. Fifteen years later this same piece of legislation has been used to carry out operations against the ascendant Islamic State terrorist group. Clearly, the threat of global terrorism will not diminish in the near future, nor will these terrorist groups’ methods grow less sophisticated. The Islamic State is a lesson that the “JV” team can quickly gain territory, funding, and robust organization given the proper geo-political conditions. The potential for terrorist groups to gain access or already have access to significant military capabilities, including offensive cyberspace operations, cannot be dismissed. (pg. 1)

There is a real threat of cyber terrorism, especially as it relates to critical infrastructure, which has been discussed at length by professionals, military leaders, politicians, and the media, but if one were to peruse the US legal code looking for any references to cyber terrorism or relevant provisions, the search would be fruitless (Theohary and Rollins, 2015). The Cyber Fraud and Abuse Act currently governs the prosecution of cybercrime, but right now it serves as one of the only tools available for law enforcement to go after “the bad guys” in cyberspace, which includes terrorists (LII, 2010). “In short, this legislation would only be relevant to the ‘hacking’ aspect of cyber terrorism, leaving a large legal hole for suspected terrorists to slip through” (Richey, 2016, pg 2). If charges of terrorism fail to stick in a trial, a suspect or group could walk away with relatively minor charges (such as “computer trespassing”), even if their actions caused significant damage (LII, 2010). This is why the United States is long overdue to have a defined official and legal answer to the question of cyber terrorism.

This section will delve into the laws and other official documentation available from other countries who currently have official definitions and/or laws regarding cyber terrorism.

Pakistani Definition of Cyber Terrorism

Current and historical geopolitical circumstances have placed Pakistan in the position of being one of the first nations to adopt official legislation outlining the definition of and punishment for cyber terrorism. “Pakistan cut its teeth in cyber warfare during the early aughts in conflict with neighbor and rival, India. Both nations engaged in offensive cyberspace operations to disrupt military and civilian information services through non-state hacking groups, a tactic which blurs the lines between cyber warfare, cyber crime, and cyber terrorism (Puran, 2003)” (Richey, 2016, pg 2). Pakistan also harbors various terrorist groups, stimulated by its open borders with Iran and Afghanistan as well as the disposition of its intelligence services, which have been engaged with these groups for years (Chaudhury, 2016). These circumstances lead to the adoption of the Prevention of Cyber Crimes Law of 2007 (Rizvi, 2009).

Regarding Pakistani laws, Richey (2016) continues to discuss the concerns of cyber-related crimes and terrorism:

The harsh sentence of capital punishment for cyber terrorism raised eyebrows amongst the global news media, but that is by no means the most important aspect of this ground-breaking legislation (Shachtman, 2008). First and foremost, the section on Cyber Terrorism gives a clear definition for what constitutes such an act:

17. Cyber terrorism.-

(1) Any person, group or organization who, with terroristic intent utilizes, accesses or causes to be accessed a computer or computer network or electronic system or electronic device or by any available means, and thereby knowingly engages in or attempts to engage in a terroristic act commits the offence of cyber terrorism. (Government, 20015).

Under this definition, there is a differentiating factor from the common “cyber crime” designation which generally deals with the how of the commission of a crime as opposed to the why. Here there is a link between the how of it (accessing a network or system) linked to the why of it (with terroristic intent). This is revolutionary, especially compared to current US statutes on cyber terrorism, or the lack thereof. As mentioned above, in the US the charge of terrorism is its own separate item without specific provisions for cyber related offenses. The second factor of the Pakistani legislation that improves on this is its clear enumeration of the offenses which fall under cyber terrorism. (pg. 3)

Naturally, upon establishing a clear statement of what cyber terrorism is, two more definitions became critical to the enforcement of the legislation: that of “terroristic intent” and that of “terroristic act” (Government, 2015). “Terroristic intent refers to the nature of the crime: that it is carried out in order to cause fear or targets the general population or Government entities. It is a simple clarification that enables prosecution by pointing to the targets as a determinant factor of terroristic intent.” (Richey, 2016 pg. 4). While it may be difficult to prove the intent of any particular attack was to cause fear, it may be very possible to prove the intended target of an attack. “Already, the legislation does well in covering the potential pitfalls associated with prosecuting terrorism, and the following section on the definition of a terroristic act helps resolve the common issue of ambiguity in cyber crime legislation” (Richey, 2016, pg. 4).

Richey (2016) further describes the Pakistani views on terrorism and cyber terrorism:

Included within the category of terroristic act are: stealing of information related to the manufacturing of weapons of mass destruction, disrupting operation of government or public service systems, and aiding in the commission of a terrorist attack. The key to this section is that it also grants the authorities the ability to be proactive by stating it does not matter whether the act is ultimately carried out, what matters is the intent and the simple attempt to aid and abet an act of cyber terror (Government, 2015). Thus it is usefully separated from the basic regulations on non-terror cyber crime and covers scenarios in which the perpetrators may be striving to achieve a lighter sentence under those regulations. Overall, it is a strong first step to addressing the looming threat of cyber terror legally. (pg. 4-5)

South Korean Definition of Cyber Terrorism

As contentions between North and South Korea remain even more than sixty years after the Korean War, the domains and tactics involved in the cold conflict have grown and evolved over time. Richey (2016) explains how South Korea felt the need to develop official documentation on cyber terrorism:

Much of the agitation between the two nations has been playing out in the cyber domain, and in response to this there was a strong push by South Korea’s parliament to enact legislation to deal with cyber terror, culminating in the passage of the National Anti-Cyberterrorism Act of 2016 (Kim, 2016). Now, this legislation charts a different course from that implemented in Pakistan due to the nature of Korea’s cyber-terror threat landscape. (pg. 5)

Regional terror cells provide a major threat in Pakistan, but South Korea faces the terrorism threat directly originating by state actors from North Korea. “Therefore, the line for South Korea between cyber warfare and cyber terror is blurred such that cyber terror is more of a military intelligence concern than a criminal one” (Richey, 2016, pg. 5). For this reason, the legislation is marked not much by a focus on punishment for cyber terrorism, but with a large proportion of the official text focusing on creating a new cyber terror office under the National Intelligence Service (NIS) and the efforts the new division would take with the current Government in the event of such a cyber crisis (James, 2013).

Richey (2016) continues to further describe the sense of urgency South Korea feels in dealing with the issue of cyber terrorism:

In this case, it is fair to say that cyber terror conducted on the part of North Korea would likely end in military conflict between the two nations rendering the legal punishment for the most part irrelevant, but the definition of cyber terror established by this bill will play in an important role in conflict escalation should it come to that.

South Korea casts a wide net with its definition of cyber terrorism. The relevant statute is as follows:

1. “Cyber Terrorism” refers to all offensive actions that intrude, disturb, paralyze, or destroy information telecommunication infrastructure, or actions related to information theft, damage and dissemination of distorted information by electronic means such as hacking, computer virus, denial of service, and electromagnetic wave (James, 2013).

Unlike the Pakistani legislation, there a lack of clarifying definitions or qualifications that would make the act of cyber terror something well defined in relation to cyber crime or cyber warfare. The conflation of “all offensive actions” in the definition is understandable given the geopolitical context where most likely it will be the North Korean government engaging in offensive cyber operations, but the inclusion of information theft in general leaves this definition wide open, exposing one major flaw: there is no provision for intent. One of the major features of the Pakistani definition’s language is the notion of terroristic intent. The intent clause serves the dual purpose of enabling prosecution of cases where a cyber terror incident is thwarted and differentiating terror from general cyber crimes. This places South Korea in the opposite situation from the US Instead of terrorists getting away as cyber criminals, petty cyber criminals can be prosecuted as terrorists. Fortunately for any would be terrorists, the penalties are relatively slim, including only prison time of sentences not exceeding 20 years, further indicating that South Korea’s concern in passing this legislation is military rather than civil. (pg. 5-6)

Israeli Definition of Cyber Terrorism

Israel is one of the most recent nations to adopt official legislation addressing cyber terrorism, most likely due to being in in a similar geopolitical situation as Pakistan with the added pressure of unfriendly border nations, much like the previously described position of South Korea. Following in the ways of Pakistan and South Korea, Israel has also felt the need to officially address the issue of cyber terrorism, as explained by Richey (2016):

Unlike these nations, Israel’s new cyber terror prosecutions statutes are an indirect effect of the passage of a broader counterterrorism bill called the Combating Terrorism Law of 2016 (Fidler, 2016). In a way, the law is similar to Pakistan’s because it focuses on the terroristic intent involved in potential terrorist actions, but most importantly, the relevant sections of the legislation deal with a third, distinct aspect of cyber terrorism largely unmentioned in either the Pakistani or South Korean legislation: the use of cyberspace as a recruitment tool. (pg. 7)

Israel uses a catch-all language to clearly state the necessary criteria to be met in order for an event to be considered an act of terrorism: a religious/ideological intent, the goal being to instill fear in the public, the credible threat of severe harm, and the target being a person, important part of society, or critical infrastructure (Levush, 2016). This is a broad description that casts a wide net, especially with the inclusion of attacks on an individual included under the definition, but this span has to do with the wide scope of the bill. For the Israeli prosecution of cyber terror, the key is relying on language that takes into account intent, as described in the definition, as well as indirect support, as is laid out under the section on terrorist offenses and penalties:

1.    leading and directing a terrorist organization, punishable on conviction by 25 years of imprisonment or life imprisonment if the organization’s activity includes murder (§ 20);

2.    being a member of or recruiting members for a terrorist organization, punishable by five to seven years’ imprisonment (§ 22); expressing support for or inciting to conduct terrorist acts, punishable by three years’ imprisonment (§ 24); (Levush, 2016).

Respectively, these can be thought of as a “mastermind” clause and a social media clause. While the major act of cyber terrorism against critical infrastructure, national key resources, or a public utility has yet to manifest significantly on the global stage, it has become increasingly clear that the use of social media by terrorists to recruit, radicalize and orchestrate has been an undeniable contributor to global terrorism (Chachko, 2016). These two official clauses give Israel the established power it would need to bring to a halt this very real cyber terror threat by imposing harsh sentences for those who typically are not involved in the actual commission of terror and to crack down on terrorist activities that are speech-based rather than materially harmful in the short run (Harkov, 2016). This broad method of enabling prosecution of cyber terror is a simple enough catch-all model that could be used as an inspirational model for the US to consider in lieu of an explicit, complicated legal answer to cyber terror.

The following is an Israeli view of the term cyber terrorism according to the Institute for National Security Studies (INSS): “The use of the term cyber terrorism… refers to the use of cyber tools liable to be used by terrorist organizations to attack economic infrastructures and civilian systems in targeted nations” (Schweitzer, 2011, pg. 46).

The Center for Strategic and International Studies (CSIS) adds onto the Israeli definition going beyond the destruction of critical infrastructure by introducing cyber capabilities as a way to create “intimidation” of civilian systems with the intent to create change. Much of this view is focused on systems owned by the private sector and not necessarily covering the human element, as described in a law enforcement bulletin about “cyber terror” from the Federal Bureau of Investigation:

Cyber terror… was coined in the 1980s by Barry Collin who discussed this dynamic of terrorism as transcendence from the physical to the virtual realm and the intersection, the convergence of these two worlds…. The Center for Strategic and International Studies (CSIS) has defined it as the use of computer network tools to shut down critical national infrastructures (e.g., energy, transportation, government operations) or to coerce or intimidate a government or civilian population. The author defines cyber terror as the intimidation of civilian enterprise through the use of high technology to bring about political, religious, or ideological aims, actions that result in disabling or deleting critical infrastructure data or information. (Tafoya, 2011, para. 6)

The man often credited with coining the term “cyber terror” is Barry Collin, “one of the nation’s most documented experts on the integrity of the industrial internet. His work is cited or chronicled in several hundred books and is taught in university courses globally…” (Collin Group, 2016).

US Definition of Cyber Terrorism

As previously mentioned, the US has no official documentation providing a legal definition of cyber terrorism. Of all the military and law enforcement agencies within the US government, the State Department via the FBI has the only working definition of cyber terrorism in the country, but it dates back to 1996: “The premeditated, politically motivated attack against information, computer systems, computer programs, and data which result in violence against noncombatant targets by sub-national groups or clandestine agents” (Pollitt, 1997). The US is behind several other nations when it comes to officially defining one of the fastest growing threats it currently faces. Compared with the pieces of legislation from other countries detailed above, this 20 year old definition leaves much to be desired.

“Amongst the numerous current pieces of legislation pertaining to cyber security in the United States, the term cyber terror, and permutations thereof, is conspicuously absent. Most legislation up for consideration deals with the sharing of cyber threat indicators amongst agencies and between the public and private sectors” (Richey, 2016, pg. 9). The only legislation to actually use the term “cyber terror” is from Representative Ted Poe (TX-2) in the North Korea State Sponsor of Terrorism Act of 2016 (US Congress, 2016). This bill still has a ways to go from being introduced to actually becoming a law, and it offers the “sense of Congress” that North Korea should be designated a state sponsor of terror. However, the legislation does not even include a definition (official or otherwise) of cyber terror; so if Congress is take cyber terrorism more seriously, it could look to the earlier adopters of official cyber terror legislation.

Pakistan’s cyber terror legislation is an interesting achievement and includes various provisions that could be worth emulating in future American legislation, but it also includes some downsides that would need to be refined and addressed if the US were to adopt similar rules. In light of several incidents within the past decade, the current political climate in the US has been one of mistrust with respect to the intelligence community, especially when it comes to operations within cyberspace. Following the leaks by Edward Snowden of the NSA’s large-scale mass-surveillance and collection of electronic records and metadata, the oft maligned “do-nothing” Congress was motivated to reform the allowed method of operations and passed the USA Freedom Act reforms of the PATRIOT act under which the program was originally created (Froomkin, 2015). Richey (2016) provides this observation:

This is concrete evidence of the political animus in the US to protect privacy and civil liberties over security, especially when it comes to the relatively unregulated realm of cyberspace. As such, the relatively wide net cast by the Pakistani legislation when it comes to criteria for the prosecution of a cyber crime may be unpalatable for US legislators. In Pakistan itself, the legislation came under fire due to potential abuse by those in power to persecute political opponents and dissidents by accusing and convicting them of cyber terrorism charges under the new law (Bhutto, 2009). The same criticism has been levied against the Israeli legislation, which is even broader in scope and has ramification well beyond the realm of cyber terror (Lis, 2016). South Korea’s legislation provides the most palatable model for a US legislative effort by keeping the focus on laying out what cyber terror is and how the government will respond, but it does leave open that indirect or non-blatant aid of terrorists falls outside the scope of the law. (pg. 9-10)

Recent Cases

The UN follows suit by not providing an official definition of cyber terrorism either. This flawed policy from both NATO and the UN can cause confusion internationally when possible cases of cyber terrorism are presented at their courts. Decisions to invoke certain articles of conflict can be blurred by such lack of a definitions.

This paper will cover current events considered to be cyber terrorism in nature to include Stuxnet and the Sony attack by North Korea. The cyber terrorism definitions will be dissected and fused with such occurrences.

Stuxnet 

The Stuxnet attack supposedly deployed in collaboration by the US, Israel, allies, and industry clearly changed the way security professionals see and understand cyber terrorism. There is not yet an official confirmation that such attack was indeed deployed by Americans and Israelis. Unofficial statements from members of the IC attribute the attack to USCYBERCOM and Unit 8200 from Israel. The Iranian nuclear facility had hundreds of centrifuges spinning at the wrong rate that caused physical destruction of national critical infrastructure. The cyber attack against the Iranian nuclear power was well coordinated following a cyber kill chain and military planning. According to the definitions of cyber terrorism being covered in this paper such act could be identified as an act of terrorism and possibility and act of war. The case would have had been brought to the international courts to include the possible invocation of article 5. There are hundreds of articles covering STUXNET. The Cyber Security Forum Initiative (CSFI) was one of the first organizations to decompose STUXNET and produce a video showing details of how the weaponization process and countermeasures dealing with this SCADA attack. The cruel reality of deploying the kill chain methodology in cyber terrorism (recon, weaponize, deliver, exploit, install, C2, and action) is the fact that code can be mutated and reintegrated into the kill chain for further unique exploitation of systems. In the domain of cyber terrorism this is a fairly common MO. Law and Policy should take into account the tactical details of such operations when defining cyber terrorism in support of prosecution.

Sony 

The Sony cyber attack deployed by North Korea opened the doors to the reality of a nation state causing financial damage to a private organization by causing fear, doubt, and uncertainty through cyber means. Many Americans were scared of going to the movies to watch the “Interview” due to coercion being exercised by the North Koreans.  Journalist Allie Conti (2014) wrote about how the hacker group known as “guardians of Peace” dumped a message on Pastebin that read the following:

We will clearly show it to you at the very time and places “The Interview” be shown, including the premiere, how bitter fate those who seek fun in terror should be doomed to.

Soon all the world will see what an awful movie Sony Pictures Entertainment has made.

The world will be full of fear.

Remember the 11th of September 2001.

We recommend you to keep yourself distant from the places at that time.

(If your house is nearby, you’d better leave.)

Whatever comes in the coming days is called by the greed of Sony Pictures Entertainment.

All the world will denounce the SONY. (para. 3)

As a result of such a strong threat, Regal and AMC theatres decided not to show the movie as investigations took place. This is a great example of cyber being used to manipulate the way of life of millions of people through fear, manipulation, and intimidation. To some this could be deemed as a sign of terrorism coming from a politically motivated group or from a state actor.

FireEye, NORSE, and many other cyber threat organizations became involved running investigations to prove attribution. This cyber attack by North Korea catapulted legislation efforts in Japan, South Korean, and in the US to cover cyber terrorism. In America there are currently three proposed bills covering the topic of cyber terrorism, as it related to North Korea’s sanctions. The phrase cyber terrorism is present in the bills, but no clear definition is provided.

The main title of this paper being “Defining Cyber Terrorism” leads discussions in terms of what definition would be most likely to yield most freedom of action to respond to cyber terrorism, and what possible implementations could be added to already known definitions of cyber terrorism.

The author will also cover some possibilities of cyber terrorism activities where the nexus of cyber converges with the Physical. What are some of the possibilities of cyber terrorism based on the current definitions of cyber terrorism?

Cyber Terrorism and the Art of the Possible

Cyber terrorism should basically touch on two main targets in order to be called a cyber terrorism activity: loss of life and destruction of national critical infrastructure with enough disruption and destruction of systems and information to cause a nation to stop functioning in the service of its citizens. One important element of cyber terrorism is fear. Fear should be a core element of cyber terrorism. Much like North Korea threatening movie goers in America through cyber means not to go see the movie “The Interview” with the consequence of people being killed at the movie theaters. In this example, there is a nation, North Korea, making use of cyberspace to compromise systems from Sony (a Japanese company) and making use of cyberspace to disrupt the way of life of Americans. The use of cyberspace as a tool of terror can be identified as a tool of terror. There are many examples of critical infrastructure being attacked by hackers with the intent of disruption and possibility destruction. The next step up and the threshold that would make these attacks cyber terrorism would be ultimately the loss of life.

Cyber Terrorists would need to follow a similar strategy followed by the US military and US Agencies to be able to deploy their cyber attacks with the intent to cause terror. These skills and preparations are in the art of the possible by nation states and even smaller terror groups. Cyber terrorists would need to consider the following:

·     Train to acquire the needed skill sets across all levels of organizational responsibility, from applier to manager.

·     Training needs to include integrating all cyber terrorist skill sets into a cohesive, mutually reinforcing effort.

Leadership (management) is the glue that holds cyber terrorists together and drives them to reach the desired end state: to deploy cyber attacks in order to destroy and disrupt critical infrastructure, with the intent of killing or injuring people (soft targets), to ultimately cause fear which leads society to change their normal life activities.

The cyber training and capabilities to accomplish such tasks are available to anyone globally with enough technologies to make it all non-attributable. The threat is real but the response to the threat should be equally real and at the current political stage in the United States legislation is behind technology.

The author participated as a panelist during a cyber security related conference at a panel organized by George Washington University and the Cyber Security Forum Initiative entitled “Breaking the National Security Backbone, Signaling System 7 (SS7) Vulnerabilities, and Nation State Signals Intelligence” on August 29, 2016. In the designated room MPA B-07 at the George Washington University’s Foggy Bottom Campus, a group of experts discussed a scenario illustrating the reality of terrorism through the exploitation of SS7. The main discussion was around the interception of cell phone communications based on vulnerabilities found on the SS7 protocol used by the telecommunications companies worldwide.  The author would like to point out the main details of the scenario:

A state sponsored terror organization located in the Middle East, through a coordinated intelligence gathering program is able to exploit recent sensitive information obtained through sophisticated Offensive Cyberspace Operations by a state actor located in the Asia Pacific region. The database of classified information mined through modern collections tools to find the phone numbers of American officers involved in covert operations overseas and at home. The terror group has intimate knowledge of the how cellular networks are linked via the insecure Common Channel Signaling System 7 (SS7) communications protocol.

The terror group operators target US government officials and covert agents by using the SS7 protocol’s international roaming agreements to access the location, messages, and calls of their targets giving the terrorists the ability to intercept communications from across the world.

Current cyber security strategies do not take into account the vulnerabilities discovered on the cellular networks operating within the United States of America. Worldwide teams are being established to evaluate how vulnerable networks are to remote hacking by unsupervised roaming partners, but this is a working in progress with many law and policy hurdles. The information collected by the terrorists provides critical actionable intelligence of possible targets of interest to include the movements of high profile government officials in Washington, DC.

The terror group plans to launch coordinated attacks on soft targets in the DC area to kill US government employees as the terrorists in real time are tracking them. In order to intensify the attacks the terror group will deploy an International Mobile Subscriber Identity (IMSI) Catcher system functioning as mobile cellular telephone eavesdropping device outside a nuclear plant. The IMSI- catcher subjects the subscriber-station (SS) cell phones in the immediate area to a man-in-the-middle-attack, appearing to SS cell phones as being a local legitimate base station (BS).

The terror group obtains phone numbers for all those who work on site and also collects the phone numbers for all the GSM SCADA terminals (GSM Control Modems) used across the plant for monitoring critical cooling systems and power. Using a SS7 based network attack the terror group sends commands to the terminals instructing them to change settings to cause a catastrophic failure to the power reactors.

To make things worse the terror group manages to compromise the European Rail Traffic Management System (ERTMS) through the disruption of the Global System for Mobile Communications-Railway (GSM-R) network directly connected to ERTMS causing a European train to crash causing hundreds of casualties.

The rail drivers received speed, stopping and routing instructions from the terrorists via GSM-R. Although GSM-R features an additional layer of encryption and faster switching to match high-speed trains, the basic SS7 vulnerabilities and denial of service attacks still apply.

Within a GSM cellular communications network there exists a Network & Switching Subsystem (NSS). The current location of a SS or mobile station (MS) is usually maintained by the HLR (Home Location Register) and VLR (Visitor Location Register). When an MS moves to the Home System to Visited system, its location is registered at the VLR of the visited network.

With the terrorists knowing only the phone number of the target (could be a train driver, conductor, traffic controller, etc.), it is possible to obtain the current VLR and the current cell ID directly from the HLR. The actual destination number of so-called functional numbers, a GSM-R concept that allows the adversary to e.g. address a train driver on a specific track segment without having to know the individual number, can be changed, re-registered, read and deleted. This also applies to call forwarding. The HLR will also reveal all individual data (e.g. permissions, priority classes, call diverts, etc.) if the attacker uses the right SS7 commands.

What that means is that an attacker has wide-ranging capabilities for remote control of a cab radio on board a train (for example). The attacker can block, change or activate railway-specific services for a specific subscriber, re-route or block calls and messages, downgrade a subscriber’s privileges and priority classes, etc.

In other words, the matter needs to be addressed urgently to protect the railway infrastructure from potentially devastating damage caused by a targeted attack on the GSM-R network. The proposed possible attacks played out in the scenario were well coordinated, ranging from data collection through cyber means to the use for Offensive Cyberspace Operations to cause effect and project power.

The scenario is fictitious, but the technologies mentioned and the reality of its exploitation is real. Such exploitation was already tested on Congressman Ted Lieu’s cell phone and featured on the 60 Minutes Show. The author of this paper received a letter from Congress thanking the effort of organizing such an important national security panel. As demonstrated with the experiment on the cell phone of Congressman Ted Lieu from California, many others could also become a victim of cyber terrorism through the very same exploitation techniques.

One can only imagine the art of the possible in terms of the recent Office of Personnel Management (OPM) hack regarding the phone numbers stored on the SF86 forms and how those numbers can be bugged, tracked, and exploited through SS7 vulnerabilities. The Telecommunications companies would have to spend billions of dollars in order to create the necessary security controls to protect America and its allies from such forms of cyber attacks.

The author of this paper would like to share the contents of Congressman Ted Lieu’s letter. Although the representatives from the telecommunications industry who were present at the panel were not so thrilled at the exposure of the SS7 vulnerability, Congressman Lieu (2016) agreed that this issue is something that needs to be addressed:

I was thrilled to learn that the Cyber Security Form Initiative had organized a panel on the critical and timely subject of SS7 vulnerabilities. While I am regretfully unable to be in Washington to attend today’s panel in person, I commend your organization and appreciate you giving me the opportunity to address the audience with a written statement.

Many months after the SS7 security vulnerability was propelled onto the national stage by a 60 Minutes report featuring the interception of my phone calls and messages by a team in Germany, our government has little to show for a response. Executive Branch agencies have not made any announcements related to the SS7 vulnerabilities. Congress has declined to hold a hearing, instead opting for a single meeting between Members of Congress and senior executives with the major telecommunications companies that was interrupted by votes. The Federal Communications Commission has only recently set up a working group.

The reason this matters is that the SS7 vulnerability is no longer a theoretical threat. Thanks to the recent hacks of the Democratic National Committee, we now have the mass release of cell phone numbers of Members of Congress likely caused by a Russian government that has full access to exploit the SS7 flaw to spy on U.S. officials.

Our state adversaries, such as North Korea and Iran, could also take this information and acquire the cell phone voice and text data of multiple Members of Congress. The ramifications of the SS7 flaw can be severe, both for our national security and the integrity of American elections.

Globally, there is ample evidence that the SS7 vulnerability is being exploited. What we lack is empirical data on how vulnerable we are here in the U.S. The telecommunications industry has made broad claims about the ability U.S. carriers to protect against SS7 exploits. Many security experts beg to differ. And until the telecommunications companies conduct penetration testing that they share with the U.S. Government, we cannot trust that we are safe from this very real threat to our national security.

Thank you to Rear Admiral Norman Hayes, Mark Kelton, Les Goldsmith, Connie Utthoff, Paul de Souza, the George Washington University and the entire CSFI team for lending your considerable expertise and resources to this endeavor, and I encourage everyone here to continue the dialogue.

Sincerely,

Ted W. Lieu

Member of Congress (pg. 1-2)

The need for a solid cyber terrorism definition and the legal framework to deal with such a reality is urgently needed. What if a terror group had truly followed the fictitious scenario presented by the CSFI/GW panel? It seems at this point in time that countries like Israel, Poland, Pakistan, India, and South Korea would have a faster way to prosecute cyber terrorists that the United States of America. All court systems have their level of fairness and justice, but very little can be done in terms of prosecution if solid definitions of cyber terrorism are not in place.

Proposed Cyber Terrorism Definition

Based on the author’s observations and research a more appropriate recommended definition of cyber terrorism should follow some core components:

·     A better explanation of cyberspace as a conduit of terror activities.

·     A clear identification of how cyberspace can be used to cause destruction, interception and disruption of national critical infrastructure with the appropriate definition of CI (critical infrastructure) by actors with the intent of causing terror and disruption of societal normal activities.

·     How indicators of cyber terrorism should be shared with vetted parties and allies.

·     How standard US code for domestic and international cyber terrorism applies to cyber.

Military Response

From the Department of Defense’s side of the house, cyber terrorism should be seen as any other cyber aggression from a nation state or individual(s) against the DODIN or national critical infrastructure following the normal Title 10 response with all its legal approvals and authorities. A better definition of cyber terrorism can help the DOD augment its responses kinetically or through the wire in the form of cyberspace operations. The DoD in partnership with the IC should be able to leverage Title 50 to take full advantage of a more swift response to cyber terrorism. The FBI and law enforcement agencies should be included as part of the effort thus creating the whole-of-government approach.

Conclusions

The research question (“In the Framework of US National Security, What is the Most Appropriate Definition of Cyber Terrorism?”) indicates a possible delayed unity of effort regarding the development of a framework of US national security as it relates to legislation covering more detailed definitions cyber terrorism that would empower the courts to prosecute domestic and international cyber terrorists. This paper has covered some nations as India and Poland who are currently proactively engaged in creating anti cyber terrorism laws that are very specific. In response to India’s anti cyber terrorism laws, Pakistan is also engaged in the development of similar laws, as has South Korea.

The US is a massive target for both terrorism and cyber attacks, and the time to modernize the legal code of the US to engage with cybersecurity in a capacity beyond cyber crime has long since past. Multiple allies have adopted legislation to address the issue, and the sum of their legal efforts should be used to help shape, define, and re-define US cyber terror policy. Pakistan, South Korea, and Israel each approach the issue differently from within the context of their geopolitical realities, but there are common themes that could be applied to the US in order to adapt to the changing battlefield. First, the definition of what constitutes an incident of “cyber terror” needs to be clearly outlined, and it should be defined in a way so that it is differentiated from acts of war and common crimes. Second, the US must include provisions that account for the intent of the actors responsible for such incidents. “Without such considerations, it would be easy for potential cyber terrorists to slip away just as they would under current cyber crime law” (Richey, 2016, pg. 12). Last, the domestic affairs of the US require a more nuanced touch when it comes to both the prosecution and the punishment of those who commit acts of cyber terror.

“The First Amendment’s guarantee of free speech is held even more sacred in the wake of the various intelligence agencies’ data collection scandals. Thus, it is imperative that civilians, whistleblowers, and dissenters are protected from undue attention under cyber terror regulations” (Richey, 2016, pg. 12). One of the saving graces for the US is that it is not geographically positioned such that major terrorist organizations are present in large numbers. “By including strong controls on what people and groups can be considered terrorists such that the designation deals mostly with foreign groups and their proxy soldiers, this free speech issue can be addressed” (Richey, 2016, pg. 12). As this nation fights its enemies abroad on the authority of fifteen years ago, so does the legal code engage with cyber terrorism in the outdated terms of years past. This is why it is imperative and urgent that the US adopt robust provisions that define and address the real, modern threat of cyber terrorism.

This article touched on a sensitive subject that seems to be forgotten by the government of the United States of America as a reality with physical consequences to include loss of life, national security secrets being stolen, destruction of critical infrastructure, and (arguably most importantly) the destruction of the American way of life. After much pondering and research on the subject, the author would like to offer recommendations regarding the definition of cyber terrorism.

The first step is the acceptance by governments that terror can be created through cyber means. Cyberspace is a war-fighting domain, contested, and not normalized. It is only natural to understand that very serious physical effects can be caused through cyber means. Once such reality is understood by the appropriate leaders, then Congress, the Senate, and the military along with all intelligence and law enforcement agencies must agree on one solid definition of cyber terrorism and make such a definition public. The points that should be considered when formulating the definition should be related to effects that can cause loss of life, destruction of national critical infrastructure, military assets, and any form of effect through the use of cyberspace with the intent of causing fear and altering the way of life of the people. The author will continue to work with the private and public sectors to help achieve these goals.

In the words of Patrick J. Kennedy, former United States Representative, “Terrorism is a psychological warfare. Terrorists try to manipulate us and change our behavior by creating fear, uncertainty, and division in society.” The change of behavior of society if the ultimate goal of terrorists; if they can achieve that through cheap means such as cyber, they will certainly do so. It is the American responsibility, as the creators of the Internet, to understand it and to create and continually develop the necessary protections against cyber terrorism.

About the author:

Mr. Paul de Souza is the co-author of the book Strategic Intelligence Management (National Cyber Defense Strategy), he serves as an advisor for the Military Cyber Professionals Association (MCPA), and he is a recipient of the Order of Thor Medal. Paul serves as a Centre of Excellence in Terrorism, Resilience, and Intelligence & Organized Crime Research (CENTRIC) Visiting Researcher at Sheffield Hallam University in the UK, Guest Lecturer at The Swedish Defence University (SEDU) Försvarshögskolanand, Institute of World Politics (IWP) Board of Advisors for The Cyber Intelligence Initiative (CII) in Washington, DC, and served as a Visiting Research Fellow at the Institute for National Security Studies (INSS) Israel – Cyber Security and Military & Strategic Affairs Programs, completed the Executive Certificate Program in Counter-Terrorism Studies from IDC Herzliya, Israel. Mr. de Souza has over 18 years of cyber security experience and has worked as the Chief Security Engineer for AT&T, where he designed and approved secure networks for MSS (Managed Security Services). Mr. de Souza also worked for Computer Sciences Corporation (CSC) and US Robotics as a security engineer. He was the winner and recipient of the International Cyber Security & Intelligence Conference (ICSIC) 2017 Award from Ontario, Canada.

Paul de Souza (Golan Heights, Israel)

References

Bhutto, Fatima. (February 11, 2009). Online crimes. The Guardian. Retrieved from https://www.theguardian.com/commentisfree/2009/feb/10/pakistan-cyber-terrorism-law.

Centre for Internet and Society. (2000). Section 66F of the Information Technology Act, 2000. CIS-India.org. Retrieved from http://cis-india.org/internet-governance/resources/section-66f-of-the-i-t-act-2000.

Chachko, Elena. (July 13, 2016). Israel’s New Counterterrorism Law. Lawfare. Retrieved from https://www.lawfareblog.com/israels-new-counterterrorism-law.

Chaudhury, Dipanjan Roy. (August 20, 2016). Pakistan Harbours Terrorism, has Lot to Answer: Bangladesh. Economic Times. Retrieved from http://economictimes.indiatimes.com/news/politics-and-nation/pakistan-harbours-terrorism-has-lot-to-answer-bangladesh/articleshow/53778858.cms.

Collin Group. (2016). About Barry C. Collin. Collin Group, Inc. Retrieved from http://collingroup.com/about/about-barry/.

Conti, Allie. (December 17, 2014). Hackers have Scared Movie Theaters into Not Showing “The Interview.” Vice. Retrieved from http://www.vice.com/read/hackers-have-scared-movie-theaters-into-not-showing-the-interview.

Dimov, Ivan. (July 21, 2014). Explaining Cyberterrorism. Infosec Institute. Retrieved from http://resources.infosecinstitute.com/explaining-cyberterrorism/.

FBI. (2016). Terrorism. FBI: What We Investigate. Retrieved from https://www.fbi.gov/investigate/terrorism.

Fidler, David. (August 22, 2016). Israel’s New Counter-Terrorism Law and Terrorism in Cyberspace. Council on Foreign Relations. Retrieved from http://blogs.cfr.org/cyber/2016/08/22/israels-new-counter-terrorism-law-and-terrorism-in-cyberspace/.

Froomkin, Dan. (June 2, 2015). USA Freedom Act: Small Step for Post-Snowden Reform, Giant Leap for Congress. The Intercept. Retrieved from https://theintercept.com/2015/06/02/one-small-step-toward-post-snowden-surveillance-reform-one-giant-step-congress/.

Government of Pakistan. (2015). Ordinance No. LXXII of 2007. Bolobhi.org. Retrieved from http://bolobhi.org/wp-content/uploads/2015/04/PECO-20072.pdf.

GPO. (January 3, 2012). 18 U.S.C. 2311 – Definitions. U.S. Government Publishing Office. Retrieved from https://www.gpo.gov/fdsys/search/pagedetails.action?packageId=USCODE-2011-title18&granuleId=USCODE-2011-title18-partI-chap113B-sec2331&bread=true&collectionCode=USCODE&browsePath=Title+18%2FPart+I%2FChapter+113b%2FSec.+2331&collapse=true&fromBrowse=true.

Harkov, Lahav. (June 15, 2016). Terror Bill Passes into Law. The Jerusalem Post. Retrieved from http://www.jpost.com/Israel-News/Terror-bill-passes-into-law-456857.

INTERPOL. (November 2014). Ministerial Meeting – Panel #4 – Japan. 83rdGeneral Assembly – INTERPOL. Retrieved from http://www.interpol.int/Media/Files/General-Assembly/83rd-General-Assembly/INTERPOL-Ministerial-Meeting/P4.4-Japan.

James, Joshua [trans]. (April 9, 2013). National Anti-Cyberterrorism Act (Legislative Bill). Cybercrime Technologies. Retrieved from http://www.cybercrimetech.com/2013/04/south-korean-national-cyber-terrorism_13.html.

Kim, Jack. (February 18, 2016). South Korea Cites North Threat in Calling for Tough ‘Terror’ Law. Reuters. Retrieved from http://www.reuters.com/article/us-southkorea-security-idUSKCN0VR0WJ.

Levush, Ruth. (July 15, 2016). Israel: New comprehensive Counterterrorism Legislation Adopted. Global Legal Monitor. Retrieved from http://www.loc.gov/law/foreign-news/article/israel-new-comprehensive-counterterrorism-legislation-adopted/.

Lieu, Ted W. (August 29, 2016). Statement – Cyber Security Forum Initiative: SS7 Event. Congress of the United States. Retrieved from https://paulcsfi.files.wordpress.com/2016/09/rep-ted-lieu-statement-cybrsecurity-forum-intiative-ss7-event-2016-08-29.pdf.

LII (2010.) 18 U.S. Code § 1030 – Fraud and Related Activity in Connection with Computers. Legal Information Institute: Cornell University Law School. Retrieved from https://www.law.cornell.edu/uscode/text/18/1030.

Lis, Jonathan. (June 15, 2016). Knesset Passes Sweeping Anti-Terrorism Law. June 15, 2016. Retrieved from http://www.haaretz.com/israel-news/1.725225.

Ministry of Foreign Affairs. (2012). Countering Cyber-Terrorism. Republic of Poland. Retrieved from http://www.mfa.gov.pl/en/foreign_policy/security_policy/international_terrorism/countering_cyber_terrorism/.

Poe, Ted. (May 12, 2016). H.R.5208 – North Korea State Sponsor of Terrorism Designation Act of 2016. House – Foreign Affairs. Retrieved from https://www.congress.gov/bill/114th-congress/house-bill/5208/text.

Pollit, Mark M. (1997). A Cyberterrorism Fact or Fancy? Proceedings of the 20th National Information Systems Security Conference, 1997, pp. 285-289.

Puran, Rajeev C. (February 28, 2003). Beyond Conventional Terrorism… The Cyber Assault.  SANS Institute. Retrieved from https://www.sans.org/reading-room/whitepapers/threats/conventional-terrorismthe-cyber-assault-931.

Richey, Hobart. (September 17, 2016). Global Definitions of Cyber Terrorism: Models for the U.S. Cyber Security Forum Initiative. Retrieved via email communication with the author.

Rizvi, Syeda Sultana. (February 24, 2009). This is Not Censorship. It’s Security. The Guardian. Retrieved from https://www.theguardian.com/commentisfree/2009/feb/24/pakistan-terrorism.

Schweitzer, Yoram, Gabi Siboni, and Eidav Yogev. (December 2011). Cyberspace and Terrorist Organizations. Military and Strategic Affairs. Retrieved from http://www.inss.org.il/uploadimages/Import/(FILE)1333532806.pdf.

Shachtman, Noah. (November 17, 2008). Pakistan Declared Death Penalty for “Cyber Terror”. Wired. Retrieved from https://www.wired.com/2008/11/cyber-terror/.

Tafoya, William L. (November 2011). Cyber Terror. Federal Bureau of Investigation Law Enforcement Bulletin. Retrieved from https://leb.fbi.gov/2011/november/cyber-terror.

Theohary, Catherine A. and John W. Rollins. (March 27, 2015). Cyberwarfare and Cyberterrorism: In Brief. Congressional Research Service: CRS Report R43955. Washington, DC: Library of Congress. Retrieved from https://fas.org/sgp/crs/natsec/R43955.pdf.

US Congress. (September 18, 2001). Authorization for Use of Military Force. Joint Resolution. 107th Cong., 1st sess., 2001. S.J. Res 23 (H.J. Res 64). Retrieved from https://www.gpo.gov/fdsys/pkg/PLAW-107publ40/pdf/PLAW-107publ40.pdf.

US Congress. (2016). North Korea State Sponsor of Terrorism Act of 2016. 114th Cong., 2nd sess., 2016. H.R. 5208. Retrieved from https://www.congress.gov/bill/114th-congress/house-bill/5208/text.