Page 52 - the SyI Quarterly 13 - (V4)

Cyber Updates
The Changing Landscape of Terrorism
- By Ross Harvey MSyI
Terrorism is a wide-ranging term in the 21st century. It
has both political and legal definitions but simply put into
context, it is the use of criminal acts intended or calculated
to provoke a state of terror in the general public or a
group of persons for political purposes and are in any
circumstance, unjustifiable, whatever the considerations of
a political, philosophical, ideological, racial, ethnic, religious
or any other nature that may be invoked to justify them.
(Source: Department of Emergency and Military Affairs.
(1994). Various Definitions of Terrorism).
Acts of terrorism have changed dramatically over the
last number of decades as we all associate terrorism
with loss of life, destruction and disarray, and mostly this
is the case. 9/11, the 2005 London bombings and the
Lockerbie bombing (1988) are all prime examples of what
we associate with terrorism, carrying the assumption
that terrorism is only carried out by obscure groups of
individuals, but this is not the typical definition of the
threats we face today.
The core fundamentals of terrorism are of course the
same as they always have been but the methods in
which acts can be carried out have become significantly
more diverse, and cyber-attacks have become frequently
chosen as a preferred method in which to carry out acts of
terrorism, which can still have the same dramatic affects
and cause significant damage and destruction. The role
of cyber-attacks in today’s risk spectrum continues to
increase and the attack methodologies are becoming
increasingly sophisticated as time passes.
An example of a recent cyber-attack was the SolarWinds
cyber-attack in 2020, where it is believed a state
sponsored attack took place. Over the following months
the injected software code was disseminated, via updates,
to all SolarWinds client’s systems, some of which were the
Pentagon, the Department of Energy, Homeland Security
as well as the National Nuclear Security Administration.
52
Tom Bossert, former President Trump’s Homeland Security Advisor was quoted saying that “it could be
years before networks could be secure again, and with access to the government networks, hackers could,
destroy, alter data, and impersonate legitimate people.” (Source: Jibilian, I and Canales, K. (2020). The US is
readying sanctions against Russia over Solarwinds cyberattack).
So, what does this mean in the real world? The implications of the above type of penetration or attack can
be wide ranging and life threatening. Today’s world is one of interconnectivity and autonomy, and with our
data, machinery and weapons all controlled by computer systems the requirement for high level security
on these systems is ever more prevalent. Some implications of this type of breach could lead to significant
disruption such as economic destabilisation, wide-spread blackouts, traffic control systems failure, air
traffic control failure or a nuclear power station or other forms of critical infrastructure being breached.
The laptop has become the new IED for terrorists of all types, regardless of their motivations or origins, but
we still experience the ‘traditional style’ attacks daily and on a global scale.
In the last two decades we have also seen multiple highly organised state sponsored attacks using
chemical, biological and radiological materials. The high-profile attacks of Sergei Skripal (2018) and
Alexander Litvinenko (2006) share many similarities in respect of perpetrating state, location of attack
(UK) and similar backgrounds of the targets but had one major difference in each scenario. This was
the materials used. Novichok & Polonium 210, two very powerful agents of destruction, but it was the
disregard for human life in the 2018 attack that was most notable as Novichok could have caused
widespread death to unsuspecting individuals and although the initial targets were significantly affected,
it was an innocent bystander some four months later that lost their life due to the Novichok attack. This
attack saw a significant shift in terrorism as on these occasions we saw a state carryout these acts on UK
soil showing not only disregard for life but also disregard for geopolitics and state relationships.
Regardless of motivation, perpetrator or act carried out, the fundamental desired outcomes never change
and as discussed in my opening paragraph all the above examples have all achieved a level of disruption
or loss of life that achieve the generalised objectives of terrorism.
Cyber-attacks have exponentially grown in recent years and the impact of events have also risen in line.
In the coming years, I expect that cyber-attacks will continue to become more and more complex, both
governments and private corporations will never be fully secure and will still be susceptible to attack. Cyber
security has never been so widely discussed as it has been in recent years but admittedly most agencies
agree that it is an ever-changing landscape which is very hard to protect to the fullest. I believe that we
should be promoting cyber security as a lead element of security management moving forward and
encouraging the incorporation of cyber elements into security related courses of any nature. For aspiring
security managers of the future, we now need to take action to prepare them for what the future holds.
53