by smart, disciplined adversaries with ample resources. (Of course, measures taken to defend against catastrophic terrorism will likely have application in defending against less sophisticated attackers.)
Information technology is essential to virtually all of the nation’s critical infrastructures, from the air-traffic-control system to the aircraft themselves, from the electric-power grid to the financial and banking systems, and, obviously, from the Internet to communications systems. In sum, this reliance of all of the nation’s critical infrastructures on IT makes any of them vulnerable to a terrorist attack on their computer or telecommunications systems.
An attack involving IT can take different forms. The IT itself can be the target. Or, a terrorist can either launch or exacerbate an attack by exploiting the IT infrastructure, or use IT to interfere with attempts to achieve a timely response. Thus, IT is both a target and a weapon. Likewise, IT also has a major role in counterterrorism—it can prevent, detect, and mitigate terrorist attacks. For example, advances in information fusion and data mining may facilitate the identification of important patterns of behavior that help to uncover terrorists or their plans in time to prevent attacks.
While there are many possible scenarios for an attack on some element(s) of the IT infrastructure (which includes the Internet, the telecommunications infrastructure, embedded/real-time computing such as SCADA [supervisory control and data acquisition] systems, and dedicated computing devices such as desktop computers), the committee believes that the most devastating consequences would occur if an attack on or using IT were part of a multipronged attack with other, more physical components. In this context, compromised IT could expand terrorist opportunities to widen the damage of a physical attack, diminish timely responses to the attack, and heighten terror in the population by providing false information about the nature of the threat.
The likelihood of a terrorist attack against or through the use of the IT infrastructure must be understood in the context of terrorists. Like other organizations, terrorist groups are likely to utilize their limited resources in activities that maximize impact and visibility. A decision by terrorists to use IT, or any other means, in an attack depends on factors such as the kinds of expertise and resources available, the publicity they wish to gain, and the symbolic value of an attack. How terrorists weigh such factors is not known in advance. Those wanting to create immediate public fear