What is cyber-terrorism, and is it a threat to U.S. national security?

What is cyber-terrorism, and is it a threat to U.S. national security?

by Christopher O’Brien

Abstract

The primary defense and security concerns of the 21^st-century have been and will continue to be driven by the strategic phenomena of cyberspace and terrorism.[i] However, there are several competing definitions of both cyberspace and terrorism, and there is no universally accepted definition for many cyber-related activities (i.e. cyber-terrorism, cyber-warfare, and cyber-crime). Cyber-terrorism is often loosely defined as the “convergence of terrorism and cyberspace,” which allows for a wide range of interpretation and confusion.[ii] This paper provides a more pragmatic definition of cyber-terrorism by addressing the nuances of previously proposed definitions in order to help the U.S. national security apparatus address current and future threats. Additionally, it will discuss what constitutes a cyber-terror attack and how it differs from other cyber-crimes. Lastly, it will then determine what threat, if any, cyber-terrorism poses to U.S. national security. To do so, I will first provide definitions for both cyberspace and terrorism which are helpful for understanding the distinct phenomenon of cyber-terrorism.

Keywords

Terrorism, Cyberspace, Cyber-terrorism

Defining Terrorism and Cyberspace

Terrorism

Many scholars agree “there is no globally agreed, unambiguous definition or description of terrorism – popular, academic, or legislative.”[iii] Deborah Housen-Couriel, of the International Counter-Terrorism Review, posits that “terrorism differs in a crucial way from other criminal activity because of the determination of its perpetrators to cause widespread fear and panic,” but nevertheless, “precise, legally-enforceable definitions of terrorism so far elude legal experts and policymakers.”[iv] Tamar Meisels argues that this is partly due to the different objectives individuals have for defining terrorism: “lawyers desperately require definitions in order to prosecute and sanction ‘terrorists’… social scientists aim to describe this phenomenon in a way which will better our sociological and psychological understanding of it and enable us to face this modern challenge more successfully… [and] heads of state and politicians often adopt definitions that serve their national, political, or ideological agendas.”[v] Rather than providing self-serving definitions that further obscure the term terrorism, Meisels offers a strict definition of terrorism as a tactical action. This narrow definition focuses on the specific tactic being employed, and not the character of the perpetrator or the justness of their cause.[vi] She posits that “the object of definitions is to distinguish the particular from seemingly similar phenomena.”[vii] Therefore, “only a definition that aspires to isolate terrorism from other forms of violence and identify its objectionable features can be normatively illuminating.”[viii] This critical definition articulates exactly what criteria is needed for a particular act to be considered terrorism in an effort to influence future U.S. national security policy while minimizing political bias. Meisels argues that terrorism should be strictly defined as “the intentional random murder of defenseless non-combatants, with the intent of instilling fear of mortal danger amidst a civilian population as a strategy designed to advance political ends.”[ix] Her goal was to provide a definition “without reference to the nature of the perpetrators of such a tactic or the justness of their goal and without rendering it morally and politically unjustifiable.”[x] As a result, this activity could be carried out by both non-state and state-sponsored actors. For the sake of clarity, this paper adopts Meisels’s definition because it clearly identifies the target, tactic, and motive of terrorism.

Meisels’s definition also omits a particular aspect associated with terrorism that many other definitions include, which is the preparation or planning of an attack. There is a key distinction between the definition of a particular event that actually occurs and the definition of particular actions that are taken prior to pinnacle moment when the event occurs. This is an important nuance to address because the planning or preparation of a terrorist attack is not in and of itself terrorism, it is in fact just the preliminaries of an act terrorism. The purpose is to have a clear and precise definition of the action so the U.S. national security apparatus can easily identify when an act of terrorism has been committed in full.

Cyberspace

As the concept of cyberspace has evolved over the past few years, there has been a debate over how to define the emerging domain in relation to traditional operational domains (i.e. land, sea, air, and space). Again, for the sake of clarity, this paper will refer to Erik M. Mudrinich’s definition of cyberspace as “an operational domain located simultaneously at logical and physical layers whose unique architecture is framed by the use of electronics and the electromagnetic spectrum to create, store, modify, exchange, and exploit information via interconnected networks which seamlessly intersect other domains as well as geographic and recognized political boundaries.”[xi] Here, he makes an important distinction that cyberspace has both logical and physical layers. This means that cyberspace can be both weaponized (i.e. the information can be used to cause physical damage) and targeted (i.e. the physical infrastructure associated with the domain can be damaged) by a terrorist or organization.

This definition also identifies the interconnectedness of cyberspace and the traditional domains, or, as General Larry Welch (Ret.) describes it, “cyberspace is embedded in all domains and operation in all domains is dependent on operation in cyberspace.”[xii] Mundrinich believes that “a modern society … cannot effectively operate without cyberspace,” arguing, “if cyber capabilities are denied, we could descend quickly from a digital-age to a dark-age in a matter of moments.”[xiii] The domain of cyberspace has risen to a level of critical importance, yet “it has evolved without the advantage of time, theory, and pontification afforded to the other domains.”[xiv] As a result, Colonel Simpson argues “the exponential growth of cyber interest and technologies has complicated common understanding and limited synchronization across the government and private sectors.”[xv] This gap in understanding would be eliminated by adopting Mundrinich’s proposed definition of cyberspace.

Additionally, operations and actions in cyberspace can create intended physical effects, just as they can in the traditional domains.[xvi] Cyberspace is unique, in that it is a domain that was “constructed by man and constantly under construction.”[xvii] These man-made segments of cyberspace are both logical and physical, and they have real-world implications for operations and activities in land, air, sea, and space.

Problems with defining cyber-terrorism

In the 1980s, Barry C. Collin, a senior research fellow at the Institute for Security and Intelligence in California, first introduced the phrase “cyber terror.” At the time, Collin defined cyber terror as “the convergence of cybernetics and terrorism.”[xviii] Since then there have been many different definitions of cyber-terrorism, and as Jonalan Brickey argued in 2012, “experts have not formed a consensus definition of terrorism,” let alone an agreed-upon definition of cyber-terrorism.[xix] Eric Luiijf argues that the reason there are so many definitions of cyber-terrorism is due to “the fact that their origin lay in quite different expert fields such as law enforcement, international studies, anti-terror, information security, and information operations.”[xx] This is similar to the issue Meisels raised regarding the trouble with defining terrorism.

Another problem that arises when trying to define cyber-terrorism is clarifying how the term should be used properly. Luiijf points out that “terrorists use cyberspace for their command and control, global information exchange and planning, fundraising and attempts to increase their support, community, propaganda, recruitment, and information operations… to influence the public opinion.”[xxi] Although these are examples of terrorists utilizing and operating in cyberspace, they fall short of being defined as an act of cyber-terrorism. These are examples of activities that can augment and subsidize cyber-terrorism, but they are not inherently an act of cyber-terrorism.

In her article “The Evolving Law on Cyber Terrorism: Dilemmas in International Law and Israeli Law,” Deborah Housen-Couriel argues “the legal and policy complexities of defining “cyber terrorism” in order to serve the aims of deterrence, operational prevention and enforcement are burdened with two interlocking sets dilemmas.”[xxii] The two sets are parallel to the two issues discussed previously, “the first set consists of those surrounding the definition and prohibition of ‘terrorism’ itself; and the second encompasses the additional complexities around the new threats posed by state and non-state actors in cyber space.”[xxiii] The first dilemma is addressed by referring to Meisels’s strict definition of terrorism, and the latter requires terrorism, espionage, and other crimes to be defined through the lens of cyberspace.

Some definitions of cyber-terrorism, like Luiijf’s, include the phrase “making preparations for” when defining what constitutes an act of cyber-terrorism. However, as was discussed when defining terrorism, the act of preparing or planning cannot alone be considered cyber-terrorism because the act never came to fruition. This is analogous to the differences between conspiracy to commit a crime (i.e. the agreement and preparation) and the actual crime being committed. Both acts may be considered unlawful, but they are not indistinguishable. The U.S. national security apparatus would benefit from distinguishing these different acts because they require different countermeasures and responses to help ensure a robust national security effort.    

Proposed definitions of cyber-terrorism

Proposed definitions of cyber-terrorism generally fall into either the broad or narrow category, the former is target-oriented and the latter is tool-oriented.[xxiv] Target-oriented definitions label cyber-terrorism as “all politically or socially motivated attacks against computers, networks and information, whether conducted through other computers or physically, when causing injuries, bloodshed, or serious damage, or fear.”[xxv] Conversely, tool-oriented definitions label “all actions using the Internet or computers to organize and complete terrorist actions as cyberterrorism,” and therefore “activities as diverse as fundraising, reconnaissance, communications, and propagandizing all potentially qualify as cyberterrorism if conducted online for the purposes of terrorism.”[xxvi] These tool-oriented definitions of cyber-terrorism are less prevalent in academia than target-oriented ones, and they are more closely associated with “other kinds of computer abuse such as computer crime, economic espionage, or information warfare.”[xxvii]

However, there have been proposed definitions that include aspects of both target- and tool-oriented understandings of cyber-terrorism. Dorothy Denning, a cyber expert and Distinguished Professor at the Naval Postgraduate School, postulated a definition of cyber-terrorism that has “a focus on information technologies as the immediate target of an attack,” and clarifies “these technologies serve also as the instrument of cyberterrorism.”[xxviii] Her definition requires that “an attack must have an offline or ‘real world’ consequences that extend beyond damage to information technologies or data.”[xxix]

A more recent definition posited by Gross et. al. states that “in contrast to conventional terrorism, cyberterrorism employs malicious computer technology rather than kinetic force. But like conventional terrorism, cyberterrorism aims to further political, religious, or ideological goals by harming civilians physically or psychologically.”[xxx] This definition introduces the aspect of psychological harm as a metric for determining what qualifies as cyber-terrorism. This broader definition asserts that perpetrators of cyber-terrorism “aim to impair public confidence, disrupt civil society and seed anxiety and insecurity by crippling digital and financial resources, undermining the institutions of governance and disrupting social networks.”[xxxi]

Additionally, there is the proposed definition in the 2013 Tallinn Manual on the International Law Applicable to Cyber Warfare (Tallinn 1.0) and the new 2017 Tallinn Manual on the International Law Applicable to Cyber Operations (Tallinn 2.0), which was facilitated by the North Atlantic Treaty Organization’s (NATO) Cooperative Cyber Defense Center of Excellence (CCDCOE). This was done in response to the prevalence of cyber events that posed an increased risk to individual states and the international community as a whole.[xxxii] Rule 36 in Tallinn 1.0 addressed terror attacks and was updated in Tallinn 2.0 to define cyber-terrorism as “cyber attacks, or the threat thereof, the primary purpose of which is to spread terror among the civilian population, are prohibited.”[xxxiii] Tallinn 2.0 also provides a distinct definition of a cyber attack in Rule 92 by stating, “a cyber attack is a cyber operation, whether offensive or defensive, that is reasonably expected to cause injury or death to persons or damage or destruction to objects.”[xxxiv] Tallinn 2.0 provides a narrow definition of cyber-terrorism, clearly identifying the targeted population and what needs to occur in order to be considered an attack. It isolates the civilian population from the military, and it requires the attack to have real-world physical implications. However, this definition differs from most of the previous definitions because it omits the requirement that the act be politically or ideologically motivated. This definition is insufficient because the objective of advancing one’s political ends is a critical component of the definition of terrorism. Additionally, the Tallinn Manual is merely an academic text that is not legally binding, and the authors emphasize that the document does not represent the CCDCOE or NATO.[xxxv]

In 2020, Tim Stevens posited a definition of cyber-terrorism that was based on the data collected in Jarvis and Macdonald’s 2017 survey, which generated 118 responses from researchers in 24 different countries.[xxxvi] The survey consisted of twenty closed and open-ended questions, chosen to generate both qualitative and quantitative data, which focused on: “demographic information; definitional issues around terrorism and cyberterrorism; the cyberterrorism threat; countering cyberterrorism; and views of current research on this phenomenon, including the major challenges facing contemporary scholars.”[xxxvii] Although they fall short of categorically defining cyber-terrorism, he believes that there are three necessary components of cyber-terrorism: 1) political or ideological motive, 2) fear as an outcome, and 3) digital means or targets.[xxxviii]  Stevens argues “it is adequate to define cyberterrorism as an act of terrorism carried out through digital means or against digital targets, with the intention of causing fear in order to pursue religious, political or ideological ends.”[xxxix] Compared to traditional terrorism, the digital aspect of cyber-terrorism is an important distinguishing characteristic.

Cyber-terrorism

It is evident that there is no consensus among scholars, policymakers, and practitioners as to what constitutes cyber-terrorism. In order to reach an agreed-upon definition, there must first be a universally accepted definition of the fundamental terminology, terrorism and cyberspace. This paper recommended a definition the best outlines the domain of cyberspace, as well as one that best designates what qualifies as terrorism. This helps create a foundation from which a definition of cyber-terrorism can be postulated.

After addressing the nuances of previously suggested definitions, I argue that cyber-terrorism is best defined as the killing or harming of defenseless innocent non-combatants, or the destruction of civilian objects (i.e. cyber-controlled critical infrastructure) to cause physical harm, through the means of cyber-attacks or cyber-operations by state, non-state, or individual actors with the intent to precipitate fear in order to advance political, religious, or ideological ends. This narrowly defined definition is necessary because it differentiates cyber-terrorism from all other forms of cyber-crimes (i.e. state or non-state sponsored hacking, ransomware attacks, intellectual property theft), and it explicitly requires real-world results that cause death or physical harm to defenseless innocent non-combatants (i.e. U.S. citizens). In the physical world, there are distinct definitions for each different type of crime, which help identify one from another. This is done to help determine the scope, severity, and appropriate response/punishment associated with that act. Requiring this same level of specificity for actions taken in cyberspace is critical for developing stability in an emerging domain, particularly at a time when there has been an increase in malign activities by state and non-state actors in cyberspace. This definition also allows policymakers and lawyers to better formulate actionable policy that dictates how to respond to these events in the future.

A Cyber-terror attack

According to this definition, a cyber-terror attack would have to originate in cyberspace and then manifest in the physical world causing death or serious damage that instills fear in the civilian population. However, it is extremely rare for recognized terrorist groups to use the internet as a means for carrying out attacks.[xl] A cyber-terror attack would need to have real-world consequences by killing or physically harming non-combatants, or by “affecting the interface between computer systems and the real-world material objects they operate.”[xli] An example of such an attack would be a cyber-attack that hijacks the computer operations of a commuter train with the intention of inflicting mass-casualties by causing it to derail, or a scenario where “a remote cyber-attack could alter the formulas of medication in the production of medicines, again killing many.”[xlii]

Scholars argue that there are seven different categories for which terrorist activity in cyberspace and on the internet can be broken down into: “internal communication, external communication, propaganda, recruiting, fund-raising, intelligence gathering, [and] information warfare.”[xliii] These activities all fall short of the cyber-terrorism threshold, and, as of 2018, there were no known incidents of cyber-attacks perpetrated by non-state actors that targeted critical infrastructure.[xliv] This changed in May 2021 when DarkSide, a non-state hacker group, conducted a cyberattack that shut down approximately 5,500 miles of Colonial Pipeline’s gas delivery system in the United States.[xlv] This attack had a significant impact of the gas supply chain across the Southeastern United States, but even a ransomware attack of this magnitude fails to incite a level of fear amongst the country’s population on the same way that a violent terrorist attack would with physical violence or death. The key element of the definition of a cyber-terror attack that separates it from other cyber-crimes is the requirement of the physical world aspect in which those actions cause death or serious damage that instills fear of mortal danger in the civilian population.

A threat to U.S. national security?

An act of cyber-terrorism, as defined previously, has yet to occur and poses a minuscule threat to U.S. national security. Currently, terrorist attacks principally occur in the physical domain rather than the cyber domain, or cyberspace, where information communications technologies would be the primary targets.[xlvi] Scholars question why the “obvious attraction to terrorists of subverting, disrupting or degrading the information systems upon which the contemporary world relies, and of the post-9/11 ‘almost paranoid emphasis on the potentially catastrophic threats posed by cyberterrorism,” have not motivated larger organizations to take action.[xlvii] Tim Stevens argues that a few strategic problems are facing terrorist organizations that have prevented this type of attack from occurring.[xlviii] One problem is that terrorist organizations, even the larger and more sophisticated ones, lack the high-end capabilities that are necessary for launching an attack on cyber-oriented critical infrastructure that would cause destruction.[xlix] There is the possibility “that terrorists could rent or purchase capabilities and technical support (‘crimeware-as-a-service’, CaaS) from cybercriminals but these would most likely be used for fraud, theft and deception activities in support of terrorism.”[l] Nevertheless, these actions would still not be considered as an act of cyber-terrorism.

A second problem is that it would be difficult for a cyber-terror attack to generate the same effect that occurs in the aftermath of a kinetic attack. As Stevens points out, “historically, terrorists have attempted to elicit emotional responses via spectacular violence, which requires an audience (or, more accurately, audiences) that can interpret this violence as a mode of political communication.”[li] This is more difficult to achieve via cyberattacks because “malware ‘does not come with an explosive charge’.”[lii] Stevens makes the point that “unlike bombs and bullets, which cause damage through the direct transfer of kinetic energy, malware must subvert the operations of a target system in order to produce malicious effects.”[liii]

Overall, the means necessary to carry out a cyber-terror attack “require significant resources to develop, effects are difficult to generate and control, and it is unclear how concessions can be extracted from one’s political opponents through cyber means.”[liv] In the context of twenty-first-century terrorism, it is reasonable to believe that cyber-terrorists would want to orchestrate a mass-casualty event with an even larger audience.[lv] That being said, a cyber-terror attack is not the most effective tactic for achieving those ends, and they pose little threat to U.S. national security.

Conclusion

This paper sought to define the phenomenon of cyber-terrorism and determine what threat, if any, it posed to U.S. national security. Based on my research, cyber-terrorism is best defined as the killing or harming of defenseless innocent non-combatants, or the destruction of civilian objects (i.e. cyber-controlled critical infrastructure) to cause physical harm, through the means of cyber-attacks or cyber-operations by state, non-state, or individual actors with the intent to precipitate fear in order to advance political, religious, or ideological ends. This definition was formulated by distilling the previously prescribed definitions of terrorism, cyberspace, and cyber-terrorism. I found that it was important to have cyber-terrorism narrowly defined in order to differentiate it from other cyber-crimes, which is done for the same reason traditional terrorism is differentiated from other crimes in the physical domain. Additionally, this type of definition makes it easier to identify when a cyber-terror attack has occurred, and it helps policymakers develop actionable policy for addressing cyber-terrorism moving forward.

Based on this definition, I found that an act of cyber-terrorism has yet to occur. Terrorist organizations have and will continue to utilize cyberspace and the Internet to augment their activities, but these behaviors fall short of being considered an act of cyber-terror. That being said, I believe that cyber-terrorism currently poses little threat to U.S. national security. Rather, there is a much more substantial threat present from cybercrimes like espionage, hacking, and malware.

Bibliography

Bosco, Francesca, Babak Akhgar, and Andrew Staniforth. Cyber Crime and Cyber Terrorism Investigator’s Handbook. Boston: Syngress, 2014. https://learning.oreilly.com/library/view/cyber-crime-and/9780128007433/Cover.xhtml

Brickey, Jonalan. “Defining Cyberterrorism: Capturing a Broad Range of Activities in Cyberspace.” Combating Terrorism Center at West Point 5, no. 8 (August 2012): 4-6.

Browne, Ryan. “Hackers behind Colonial Pipeline attack reportedly received $90 million in bitcoin before shutting down.” CNBC, May 18, 2021. https://www.chicagomanualofstyle.org/turabian/turabian-notes-and-bibliography-citation-quick-guide.html

Droogan, Julian and Lise Waldek. “Should we be afraid of cyber-terrorism?” International Journal of Electronic Security and Digital Forensics 10, no. 3 (2018): 242-254.

Gordon, Sarah and Richard Ford. “Cyberterrorism?” Computers & Security 21, no. 7 (2002): 636-647.

Gross, Michael L., Daphna Canetti and Dana R. Vashid. “Cyberterrorism: its effects on psychological well-being, public confidence and pollical attitudes.” Journal of Cybersecurity 3, no. 1 (2017): 49-58.

Housen-Couriel, Deborah. “The Evolving Law on Cyber Terrorism: Dilemmas in International Law and Israeli Law.” International Counter-Terrorism Review 1, no. 1 (February 2020): 1-30.

Iqbal, Mohammad. “Defining Cyberterrorism.” Journal of Computer & Information Law 22, no. 2 (Winter 2004): 397-408.

Jarvis, Lee and Stuart Macdonald. “What Is Cyberterrorism? Findings From a Survey of Researchers.” Terrorism and Political Violence 27, no. 4 (2015): 657-678. https://www-tandfonline-com.proxygw.wrlc.org/doi/pdf/10.1080/09546553.2013.847827?needAccess=true

Jensen, Eric Talbot. “The Tallinn Manual 2.0: Highlights and Insights.” Georgetown Journal of International Law 48, (2017): 736-777.

Jones, David Martin, Paul Schulte, Carl Ungerer, and M. L. R. Smith. Handbook of Terrorism and Counter Terrorism Post 9/11. Northampton: Edward Elgar Publishing, 2020.

Luca, Gabriela. “Manifestations of Contemporary Terrorism: Cyberterrorism.” Research and Science Today, no. 1 (Spring 2017): 20-25.

Luiijf, Eric. “Definitions of Cyber Terrorism.” In Cyber Crime and Cyber Terrorism Investigator’s Handbook, edited by Francesca Bosco et. al., Ch. 2. Boston: Syngress, 2014. https://learning.oreilly.com/library/view/cyber-crime-and/9780128007433/B9780128007433000025.xhtml

Macdonald, Stuart, Lee Jarvis and Simon M. Lavis. “Cyberterrorism Today? Findings From a Follow-on Survey of Researchers.” Studies in Conflict & Terrorism, (2019): 1-26.

McGuffin, Chris and Paul Mitchell. “On Domains: Cyber and the Practice of Warfare.” International Journal 69, no. 3 (2014): 394-412.

Meisels, Tamar. “Defining Terrorism – A Typology.” Critical Review of International Social and Political Philosophy 12, no. 3 (September 2009): 331-351.

Mudrinich, E.M. “Cyber 3.0: The Department of Defense Strategy for Operating in Cyberspace and the Attribution Problem.” The Air Force Law Review 68, no. 2 (2012): 167-206.

Pollitt, Mark M. “Cyberterrorism – Fact or Fancy?.” Computer Fraud & Security 1998, no. 2 (1998): 8-10.

Schmitt, Michael N. Tallinn Manual on the International Law Applicable to Cyber Warfare. Cambridge: Cambridge University Press, 2013.

Schmitt, Michael N. Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations. Cambridge: Cambridge University Press, 2017.

Sheldon, J.B.. “The Rise of Cyberpower.” In Strategy in the Contemporary World, edited by J. Baylis et. al., 282-296. Oxford University Press, 5^th edn, 2016.

Silke, Andrew. “The Internet & Terrorist Radicalization: The Psychological Dimension.” In Terrorism and the Internet, edited by H. Dienel, 27-39. Amsterdam: IOS Press, 2010.

Simpson, Michael S.. “Cyber Domain Evolving in Concept, But Stymied by Slow Implementation.” U.S. Army War College, (2010).

Stevens, Tim. “Strategic Cyberterrorism: problems of ends, ways and means.” In Handbook of Terrorism and Counterterrorism Post 9/11, edited by David Martin Jones, 42-52. Northampton: Edward Elgar Publishing, 2020.

Theohary, Catherine A. and John W. Rollins. “Cyberwarfare and Cyberterrorism: In Brief.” Congressional Research Service, March 27, 2025.

Welch, Larry D.. “Cyberspace – The Fifth Operational Domain.” Institute for Defense Analysis, (2011): 2-7.