Cyber-Attacks by Al Qaeda Feared

The devices are called distributed control systems, or DCS, and supervisory control and data acquisition, or SCADA, systems. The simplest ones collect measurements, throw railway switches, close circuit-breakers or adjust valves in the pipes that carry water, oil and gas. More complicated versions sift incoming data, govern multiple devices and cover a broader area.

What is new and dangerous is that most of these devices are now being connected to the Internet -- some of them, according to classified "Red Team" intrusion exercises, in ways that their owners do not suspect.

Because the digital controls were not designed with public access in mind, they typically lack even rudimentary security, having fewer safeguards than the purchase of flowers online. Much of the technical information required to penetrate these systems is widely discussed in the public forums of the affected industries, and specialists said the security flaws are well known to potential attackers.

Until recently, said Director John Tritak of the Commerce Department's Critical Infrastructure Assurance Office, many government and corporate officials regarded hackers mainly as a menace to their e-mail.

"There's this view that the problems of cyberspace originate, reside and remain in cyberspace," Tritak said. "Bad ones and zeros hurt good ones and zeros, and it sort of stays there. . . . The point we're making is that increasingly we are relying on 21st century technology and information networks to run physical assets." Digital controls are so pervasive, he said, that terrorists might use them to cause damage on a scale that otherwise would "not be available except through a very systematic and comprehensive physical attack."

The 13 agencies and offices of the U.S. intelligence community have not reached consensus on the scale or imminence of this threat, according to participants in and close observers of the discussion. The Defense Department, which concentrates on information war with nations, is most skeptical of al Qaeda's interest and prowess in cyberspace.

"DCS and SCADA systems might be accessible to bits and bytes," Assistant Secretary of Defense John P. Stenbit said in an interview. But al Qaeda prefers simple, reliable plans and would not allow the success of a large-scale attack "to be dependent on some sophisticated, tricky cyber thing to work."

"We're thinking more in physical terms -- biological agents, isotopes in explosions, other analogies to the fully loaded airplane," he said. "That's more what I'm worried about. When I think of cyber, I think of it as ancillary to one of those."

White House and FBI analysts, as well as officials in the Energy and Commerce departments with more direct responsibility for the civilian infrastructure, describe the threat in more robust terms.

"We were underestimating the amount of attention [al Qaeda was] paying to the Internet," said Roger Cressey, a longtime counterterrorism official who became chief of staff of the President's Critical Infrastructure Protection Board in October. "Now we know they see it as a potential attack vehicle. Al Qaeda spent more time mapping our vulnerabilities in cyberspace than we previously thought. An attack is a question of when, not if."

Ron Ross, who heads a new "information assurance" partnership between the National Security Agency and the National Institute of Standards and Technology, reminded the Infraguard delegates in Niagara Falls that, after the Sept. 11 attacks, air traffic controllers brought down every commercial plane in the air. "If there had been a cyber-attack at the same time that prevented them from doing that," he said, "the magnitude of the event could have been much greater."

"It's not science fiction," Ross said in an interview. "A cyber-attack can be launched with fairly limited resources."