Home > Security

IDG News Service - The cyberterrorism threat is overstated, an expert panel agreed today, because bombs are more effective at instilling fear than strikes against the Internet.
"Cyberterrorism is largely overblown," said Bruce Schneier, founder and chief technical officer of Counterpane Internet Security Inc. in Cupertino, Calif. Schneier spoke as part of a panel on cyberterrorism at the CeBIT technology trade show.
"I don't see a cyberattack as a terror attack of choice," Schneier said. "Dropping ATM networks and shutting down e-mail is not terrorism. If I can't get to my e-mail for a day, I am not terrorized. We are many years away from somebody being able to launch large-scale electronic attacks that have the effects of a bomb."
Other panelists, including executives from security software vendors RSA Security Inc. and Trend Micro Inc. and representatives from the European Union and the North Atlantic Treaty Organization, agreed. They blame the U.S. government, certain IT vendors and the media for creating cyberterrorism anxiety.
"Terrorists will use the Internet to communicate, which is different from an attack. We do not see a terrorist attack on the Internet happening," said Rainer Fahs, senior information security engineer of NATO's Air Command & Control Systems Management Agency.
Fueled by post-Sept. 11 fears, the U.S. government and its agencies warned of potential terrorist attempts to bring down the Internet or to use the network to topple critical infrastructure such as telecommunications and electric power grids; oil, gas and water systems; and transportation and emergency services.
Panelists had this to say about those warnings:

• "Critical systems don't run on the Internet; they are based on secure networks. We have protected our systems and do not rely on the Internet," Fahs said.


• "I don't want to belittle the threats [to the Internet], but they are not coming from terrorists. The threat from common criminals is understated," Schneier said.


• I think the threat of cyberterrorism is overstated," although general threats to IT systems are in some cases underestimated, said Arthur Coviello, president and CEO of RSA. He advised companies to assess risks and then apply security measures.


• "The U.S. government after Sept. 11 wanted a broader front to attack terrorism, and cyberterrorism is part of that. Some in the industry got headlines by calling a lot of attention to this," Coviello said.

Fahs said he understands the U.S. government's reasoning, but he warned that civil liberties may be at stake because of a push to fight a threat that isn't real. "This is something that was created, and I think there is a big risk thatthe liberty of people will be sacrificed for the sake of security," he said.
The panelists' opinions match a Symantec Corp. survey released last month that found that cyberterrorism is more fear than reality. None of the severe events detected by Symantec were traced to countries linked with terrorism, and less than 1% of all attack traffic came from such countries.