Officials in government and industry now say that cybercrime and cyberattack services available for hire from criminal organizations are a growing threat to national security as well as to the U.S. economy. Some experts argue that the government of Estonia may have already experienced this type of cyberattack directed against their systems and websites in April, 2007. This report explores the possible connections between cybercriminals and terrorist groups that want to damage the U.S. economy or national security interests. The report also examines the effects of a coordinated cyberattack against the U.S. critical infrastructure, including use of cybercrime tools that could possibly take advantage of openly-publicized cyber vulnerabilities. However, in the near future, security experts believe that attackers may use new botnet architectures that are more sophisticated, and more difficult to detect and trace. Eventually, NATO and the United States sent computer security experts to Estonia to help recover from the attacks, and to analyze the methods used and attempt to determine the source of the attacks. Cybercriminals have made alliances with drug traffickers in Afghanistan, the Middle East, and elsewhere where illegal drug funds or other profitable activities such as credit card theft, are used to support terrorist groups. While describing possible offensive tactics for military cyber operations, DOD officials reportedly stated that the U.S. could confuse enemies by using cyberattack to open floodgates, control traffic lights, or scramble the banking systems in other countries. Why Cyberattacks Are Successful

Networked computers with exposed vulnerabilities may be disrupted or taken over by a hacker, or by automated malicious code. Issues for Congress

Policy issues for cybercrime and cyberterrorism include a need for the following:
increase awareness about changing threats due to the growing technical skills of extremists and terrorist groups; develop more accurate methods for measuring the effects of cybercrime; help to determine appropriate responses by DOD to a cyberattack; examine the incentives for achieving the goals of the National Strategy to Secure Cyberspace; search for ways to improve the security of commercial software products; explore ways to increase security education and awareness for businesses and home PC users; and find ways for private industry and government to coordinate to protect against cyberattack. Could terrorist groups find it advantageous to hire a cybercrime botnet tailored to attack specific targets, possibly including the civilian critical infrastructure of Western nations?
Cybercrime is becoming more organized and established as a transnational business. High technology online skills are now available for rent to a variety of customers, possibly including nation states, or individuals and groups that could secretly represent terrorist groups. The increased use of automated attack tools by cybercriminals has overwhelmed some current methodologies used for tracking Internet cyberattacks, and vulnerabilities of the U.S. critical infrastructure, which are acknowledged openly in publications, could possibly attract cyberattacks to extort money, or damage the U.S. economy to affect national security.
In April and May 2007, NATO and the United States sent computer security experts to Estonia to help that nation recover from cyberattacks directed against government computer systems, and to analyze the methods used and determine the source of the attacks. (See Larry Greenemeier, "Estonian Attacks Raise Concern Over Cyber 'Nuclear Winter,'" Information Week, May 24, 2007, at http://www.informationweek.com/news/showArticle.jhtml?articleID=199701774.) Some security experts suspect that political protestors may have rented the services of cybercriminals, possibly a large network of infected PCs, called a "botnet," to help disrupt the computer systems of the Estonian government. DOD officials have also indicated that similar cyberattacks from individuals and countries targeting economic, political, and military organizations may increase in the future. (See Jeanne Meserve, "Official: International Hackers Going After U.S. Networks," CNN.com, October 19, 2007, http://www.cnn.com/2007/US/10/19/cyber.threats/index.html. and Sebastian Sprenger, "Maj. Gen. Lord Is a Groundbreaker," Federal Computer Week, October 15, 2007, vol. 21, no. 34, p. 44.)
Cybercriminals have reportedly made alliances with drug traffickers in Afghanistan, the Middle East, and elsewhere where profitable illegal activities are used to support terrorist groups. In addition, designs for cybercrime botnets are becoming more sophisticated, and future botnet architectures may be more resistant to computer security countermeasures. (See Tom Espiner, "Security Expert: Storm Botnet 'Services' Could Be Sold," CnetNews.com, October 16, 2007, http://www.news.com/Security-expert-Storm-botnet-services-could-be-sold/2100-7349_3-6213781.html.)
This report discusses options now open to nation states, extremists, or terrorist groups for obtaining malicious technical services from cybercriminals to meet political or military objectives, and describes the possible effects of a coordinated cyberattack against the U.S. critical infrastructure. This report will be updated as events warrant.