cyber law

II World Congress on Informatics and Law

Madrid,

Spain

September 2002

Rohas Nagpal

President,

Asian School of Cyber Laws

rn@asianlaws.org

Rohas Nagpal -Cyber Terrorism- Abstract

2

Computer crime has hit mankind with unbelievable severity. In the past, hackers have taken

down national defense systems, taken control of a huge dam, shut down large segments of

America's power grid, silenced the command and control system of the US Pacific Command

in Honolulu, disrupted troop deployments during the Gulf War etc.

Technology savvy terrorists and organized crime syndicates are using 512-bit encryption and

digital steganography to secure their communication channels.

In light of this disturbing scenario, it is prudent to distinguish between cyber crime, a

domestic issue that may have international ramifications and cyber terrorism, an international

issue that may have domestic ramifications.

While a cyber crime can be described simply as an unlawful act wherein the computer is

either a tool or a target or both, cyber terrorism merits a more detailed definition.

The author has proposed the following definition of the term "cyber terrorism":

This paper first examines the tools and methodologies of cyber terrorism such as viruses,

worms, Trojans, denial of service attacks and cryptography. The paper then discusses the

proactive and reactive legislative measures undertaken by various countries to counter cyber

crime in general and cyber terrorism in particular.

Finally, the paper discusses some of the major incidents of cyber terrorism that have ravaged

the real and virtual worlds in the recent past.

Rohas Nagpal -Cyber Terrorism- Defining Cyber Terrorism

3

Computer crime has hit mankind with unbelievable severity. Computer viruses, worms,

Trojans, denial of service attacks, spoofing attacks and e-frauds have taken the real and

virtual worlds by storm.

However, all these pale in the face of the most dreaded threat – that of cyber terrorism. In

1998, a 12-year-old boy successfully hacked into the controls for the huge Roosevelt Dam on

the Salt River in Arizona, USA. He might have released floodwaters that would have

inundated Mesa and Tempe, endangering at least 1 million people.

Two cyber terrorist groups—the Unix Security Guards and the World Fantabulous

Defacers—made 111 digital attacks on Indian educational and business sites recently. A pro-

Islamic cyber-alliance now operates across the Internet against U.S., Israeli, and Indian

targets.

In light of this disturbing scenario, it is prudent to distinguish between cyber crime, a

domestic issue that may have international ramifications and cyber terrorism, an international

issue that may have domestic ramifications.

While a cyber crime can be described simply as an unlawful act wherein the computer is

either a tool or a target or both, cyber terrorism merits a more detailed definition.

The author has proposed the following definition of the term "cyber terrorism":

The underlying premise in this definition is that cyber crime and cyber terrorism differ only

on the basis of the motive and intention of the perpetrator.

towards any person in whom the target has an interest.

4

The term cyber space used here extends to the entire virtual world, i.e. the Internet, stand alone computers,

every bit of information stored in storage media - removable, non removable, physical and virtual.

5

The term intention implies the reason or purpose for which an act is committed, sought to be committed or

threatened to be committed.

not desire to do.

Rohas Nagpal -Cyber Terrorism- Tools of terror

4

Cyber terrorists use various tools and methods to unleash their terrorism. Some of the major

tools and methodologies are discussed below:

“Hacking” is a generic term for all forms of unauthorised access to a computer or a computer

network.

hacker hacked into a Liverpool hospital in 1994 and changed the medical prescriptions for the

patients. A nine-year-old patient who was "prescribed" a highly toxic mixture survived only

because a nurse decided to re-check his prescription. The hacker’s motive – he wanted to

know "what kind of chaos could be caused by penetrating the hospital computer"! Others

have not been so lucky. An underworld don who was only injured in a shoot out was killed

by an overdose of penicillin after a hacker broke into the hospital computers and altered his

prescription.

Each packet is identified by a header, which contains the source, destination, size of packet, total number of

packets, serial number of that packet, etc. If a hacker wants to see this information, he uses Packet Sniffing

technology that reconverts the data from hex to the original. This technology is like putting the equivalent of a

phone tap on a computer. Sniffing can be committed when a packet leaves the source or just before it reaches

the destination. For this, the hacker would need to know only the IP Address (the unique number that identifies

each computer on a network). A packet sniffer can log all the files coming from a computer. It can also be

programmed to give only a certain type of information – e.g. only passwords.

9

TEMPEST (Transient Electromagnetic Pulse Emanation Standard) technology allows someone not in the

vicinity to capture the electromagnetic emissions from a computer and thus view whatever is on the monitor. A

properly equipped car can park near the target area and pick up everything shown on the screen. There are some

fonts that remove the high-frequency emissions, and thus severely reduce the ability to view the text on the

screen from a remote location. This attack can be avoided by shielding computer equipment and cabling.

since Roman times. Internal to the computer, passwords have to be checked constantly. So, all computers try to

"cache" passwords in memory so that each time a password is needed the user does not need to be asked. If

someone hacks into the memory of a computer, he can sift the memory or page files for passwords.

Password crackers are utilities that try to ‘guess’ passwords. One way, the dictionary attack, involves trying out

all the words contained in a predefined dictionary of words. Ready-made dictionaries of millions of commonly

used passwords can be freely downloaded from the Internet. Another form of password cracking attack is ‘brute

force’ attack. In this attack, all possible combinations of letters, numbers and symbols are tried out one by one

till the password is found out.

way of hacking a computer. It involves input of excessive data into a computer. The excess data "overflows"

into other areas of the computer’s memory. This allows the hacker to insert executable code along with the

input, thus enabling the hacker to break into the computer.

Rohas Nagpal -Cyber Terrorism- Tools of terror

5

In the 12th century BC, Greece declared war on the city of Troy because the prince of Troy

abducted the queen of Sparta with a wish to make her his wife. The Greeks besieged Troy for

10 years but met with no success as Troy was very well fortified.

In their last effort, the Greeks pretended to be retreating, leaving behind a huge wooden

horse. The people of Troy saw the horse, and, thinking it was a present from the Greeks,

pulled the horse into their city, unaware that the hollow wooden horse had the best Greek

soldiers inside.

Under the cover of night, the Greek soldiers snuck out, opened the gates of the city, and later,

together with the rest of their army, killed the entire army of Troy.

Similar to the wooden horse, a Trojan horse program pretends to do one thing while actually

doing something completely different.

Trojans are of various types, the important ones being:

shut down his computer, open and close his CD-ROM tray etc.).

of the Trojan. There are Trojans for every kind of password. These Trojans usually send the information back to

the attacker via email.

king of the network as he has the maximum privileges on the network). They can either be bound into a

common system utility or pretend to be something harmless and even quite useful and appealing. Once the

administrator runs it, the Trojan will give the attacker more privileges on the system.

them on a file or email them to the attacker once in a while. Key loggers usually don't take much disk space and

can masquerade as important utilities, thus making them very hard to detect.

seem like joke programs, while they are actually destroying every file they encounter.

Rohas Nagpal -Cyber Terrorism- Tools of terror

6

A computer virus is a computer program that can infect other computer programs by

modifying them in such a way as to include a copy of it.

Viruses are very dangerous; they are spreading faster than they are being stopped, and even

the least harmful of viruses could be fatal. For example, a virus that stops a hospital lifesupport

computer could be fatal.

Over the years thousands of viruses have ravaged the information of computer users, the most

virus by itself was quite harmless. It merely inserted some text into a document at a specified time of the day.

What caused the maximum harm was that the virus would send itself to all the email addresses in the victim’s

address book. This generated enormous volume of traffic making servers all over the world crash.

June 1999, was not a virus but a Trojan. This means that it was incapable of replicating itself. Thus, the Melissa

virus had more far reaching presence. Also, ExploreZip was more active. It not only hijacked Microsoft Outlook

but also selected certain files and made their file size zero – reduced their data to nothing. Those files were then

of no use to the user and they could not be recovered.

Chernobyl, Ukraine, nuclear power plant tragedy. The virus wipes out the first megabyte of data from the hard

disk of a personal computer thus making the rest of the files of no use. Also, it also deletes the data on the

computer’s Basic Input-Output System (BIOS) chip so that the computer cannot function till a new chip is fitted

or the data on the old one is restored. Fortunately only those BIOSes, which can be changed or updated, face a

threat from this virus.

struck one in every five personal computers in the world. Losses incurred due to this virus were pegged at US $

10 billion. The virus used the addresses in the victim’s Microsoft Outlook and e-mailed itself to those addresses.

The email, which was sent out, had "ILOVEYOU" in its subject line. The attached file was named "LOVELETTER-

FOR-YOU.TXT.vbs". People wary of opening email attachments were conquered by the subject line

and those who had some knowledge of viruses, did not notice the tiny .vbs extension and believed the file to be

a text file. The message in the e-mail was "kindly check the attached LOVELETTER coming from me".

This virus has a destructive effect. Whereas Melissa merely inserts some text into the affected documents at a

particular instant during the day, this virus first selects certain files and then inserts its own code in lieu of the

original data contained in the file. This way it creates ever-increasing copies of itself.

PC is stoned. Legalize Marijuana.”

program designed to turn off the Num-Lock light on the user’s keyboard. In fact, what it did was to make the

characters on the screen drop in a heap to the bottom of the screen.

Rohas Nagpal -Cyber Terrorism- Tools of terror

7

The term “worm”, in relation to computers, was used for the first time by science fiction

author John Brunner in his book called “The Shockwave Rider”.

A computer worm is a self-contained program (or set of programs) that is able to spread

functional copies of itself or its segments to other computer systems (usually via network

connections). Unlike viruses, worms do not need to attach themselves to a host program.

The first computer worm was developed for the assistance of air traffic controllers in 1971.

This “worm” programme would notify air traffic controllers when the controls of a plane

moved from one computer to another. In fact, this worm named “creeper” would travel from

one computer screen to the other on the network showing the message, “I’m creeper! Catch

me if you can!” The difference was that this creeper did not reproduce itself.

The world has seen thousands of worms, the more (in)famous ones being the Internet

copy themselves to other computers. The original terminates itself after launching a copy on another host (so

there is only one copy running somewhere on the network at a given moment). They are also called "rabbits".

possibly performing different actions), using the network for several communication purposes. Network worms

that have one main segment, which coordinates the work of the other segments are sometimes called

"octopuses".

worm on a very large network in the area. This network was named Arpanet, which later became the Internet.

The worm managed to infect approximately three thousand computers during eight hours of activity.

The Internet worm disabled all those machines by making copies of itself and thus clogging them. During

repairs, many machines had to be completely taken off the network till all copies of the worm could be totally

removed.

found that it had system privileges, would change the system announcement message to “Worms against

Nuclear Killers!” The message was graphically shown as the first letters of each word and the last three letters

of the last word.

managed to paralyze the IBM network on Christmas day 1987. The worm was written in a language called

Exec. It asked the user to type the word “Christmas” on the screen. Then it drew a Christmas tree and sent itself

to all the names of people stored in the user files “Names” and “Netlog” and in this way propagating itself.

Rohas Nagpal -Cyber Terrorism- Tools of terror

8

Email has emerged as the world’s most preferred form of communication. Like any other

form of communication, email is also misused by criminals.

The ease, speed and relative anonymity of email has made it a powerful tool for criminals.

In January 2002, Cloud Nine, a UK based Internet Service Provider (ISP), was forced to shut

shop after a week-long Denial of Service attack (DoS) resulted in the complete stoppage of

its service.

Denial of Service (DoS) attacks are aimed at denying authorized persons access to a

computer or computer network. These attacks may be launched using a single computer or

millions of computers across the world. In the latter scenario, the attack is known as a

distributed denial of service (DDoS) attack.

The main reason for the vulnerability of computer systems to DoS attacks is the limited

nature of computer and network resources, be it bandwidth, processing power, storage

capacities or other resources.

DoS attacks pose another challenge, namely timely detection and source identification. These

attackers. All the attacker needs to do to launch a DDoS attack is install a Trojan in many

computers, gain control over them and then employ them in sending a lot of requests to the

target computer.

DDoS attacks are a very perturbing problem for law enforcement agencies mainly because

they are very difficult to trace. In addition, usually these attacks target sensitive systems or

networks sometimes even those that are vital to national security. Sometimes, even when the

perpetrators can be traced, international extradition laws may prove a hitch in bringing them

under the authority of the law.

source.

amateur hackers who like harassing their friends. What they are left unaware of is that these free Trojans that

they download are designed so as to give the creator absolute control over the computer systems of the users of

the Trojan and their intended victims. Such computers become innocent pawns in a denial of service attack.

Rohas Nagpal -Cyber Terrorism- Tools of terror

9

TCP/IP protocol is broken into packets at the origin and rejoined at the destination. Presuming that 3000 bytes

of data are being sent from X to Y, the transaction could look something like this:

Packet number 1 contains bytes number 0001 through 1000

Packet number 2 contains bytes number 1001 through 2000

Packet number 3 contains bytes number 2001 through 3000

In case of a teardrop attack, the transaction could be something like this:

Packet number 1 contains bytes number 0001 through 1000

Packet number 2 contains bytes number 0801 through 2000

Packet number 3 contains bytes number 1501 through 3000

This kind of repetition of bytes within data packets can cause the recipient system to crash / hang / reboot.

handshake, is something like this. (Note: SYN means Synchronization packet while ACK means

Acknowledgement packet).

X sends a SYN packet to Y. Y replies with a SYN ACK packet. X then replies with an ACK packet.

Only upon completion of these steps is the TCP/IP connection established.

In a SYN attack, numerous SYN packets, all having bad source IP addresses (e.g. non-existent IP address), are

sent to the target machine. The target machine responds to each SYN packet with a SYN ACK packet and waits

for the ACK packet. Since the source IP address in all these is bad, the ACK packet never comes. Meanwhile

the requests get added to the queue resulting in blockage of resources. A sufficiently large number of such SYN

packets can crash / hang / reboot the system.

Internet) to connect the ‘echo’ service on one machine to the ‘chargen’ service on another machine. Chargen

(character generator) is a server that “babbles”. When you connect to it, it produces characters in an endless

stream. Echo simply echoes back any data that is sent to it. These protocols are normally used for testing

purposes. The result is that the two services consume all available network bandwidth between them. The

network connectivity for the network may be affected.

system is used as the source IP address, thus creating an infinite loop.

directs them to the target network.

sometimes impossible for the system to operate.

bytes. When the receiving machine receives the packet it is in the form of small data packets. The receiving

computer then tries to reassemble the packet. When reassembled, the final packet proves to be excessively large

and causes a buffer overflow. This method (although no longer as much in use) can cause anything from system

hangs, crashes, or reboots in the victim machine.

Rohas Nagpal -Cyber Terrorism- Tools of terror

10

A disturbing trend that is emerging nowadays is the increasing use of encryption, highfrequency

organized crime cartels.

Strong encryption is the criminal’s best friend and the policeman’s worst enemy. If a criminal

were to use 512-bit symmetric encryption, how long would it take to decrypt the information

using brute force techniques?

millennia to search 1% of the key space of a 512-bit key. The universe is believed to have

Some of the (in) famous cases of criminals using encryption technologies are:

to hide text messages within image and audio files.

use steganography and 512-bit encryption to keep his communication channels secure.

Air in 1995

1995. Leary had developed his own algorithm for encrypting the files on his computer.

that distort voices, video phones which provide visual authentication of the caller's identity, and instruments for

scrambling transmissions from computer modems.

palmtop computers installed with Secure Device, a Dutch software product for encrypting data with IDEA. The

palmtops serve as an unmarked police / intelligence vehicles database.

killing 12 people and injuring 6,000 more. Members of the cult had developed many chemical and biological

weapons, including Sarin, VX, Mustard gas, Cyanide, botulism, anthrax and Q fever. It is believed that

preparations were underway to develop nuclear capability. The cult was also believed to be developing a "death

ray" that could destroy all life! The records of the cult had been stored in encrypted form (using RSA

asymmetric algorithm) on computers. The enforcement authorities were able to decrypt the information as the

relevant private key was found in a floppy disk seized from the cult’s premises. The encrypted information

related plans of the cult to cause mass deaths in Japan and USA.

Rohas Nagpal -Cyber Terrorism- Tools of terror

11

hideouts of the terrorists yielded information encrypted using symmetric encryption. A 12-hour brute force

attack resulted in the decryption of the information and subsequently led to one of the largest drug busts in

Bolivian history and the arrest of the terrorists.

included intimidating IRS officials, rewarding those who killed selected government employees and

contaminating an area outside IRS premises in many states of the USA with Mercaptan (a stink gas). After his

arrest, the investigators were able to decrypt PGP encrypted messages that he had received only because he

divulged the passphrase to his private key.

and hacked into the telephone network in order to determine whose phone was being tapped and to install his

own phone tapping devices. Poulson had encrypted files documenting everything from the phone tapping he had

discovered to the dossiers he had compiled about his enemies. The files had been encrypted several times using

the Data Encryption Standard. A US Department of Energy supercomputer took several months to find the key.

The result yielded nearly ten thousand pages of evidence.

Rohas Nagpal -Cyber Terrorism- Legal issues

12

The new law concept of unauthorised access is sometimes compared to the traditional law

concept of trespass. However, in most countries, this traditional law concept cannot be

stretched to protect information stored in computers.

To fill in this lacuna, several countries have enacted legislations pertaining to unauthorised

provisions against unauthorised access.

3126), the Computer Fraud and Abuse Act of 1984, 1986 (codified at 18 U.S.C. §§ 1029, 1030) as well as

various state laws.

certain consequences of the offence, e.g. as obstruction of business (Article 234-2 Penal Code) or theft of

electricity (Article 245, 235 Penal Code).

Rohas Nagpal -Cyber Terrorism- Legal issues

13

The laws relating to unauthorised access reflect divergent approaches ranging from

offence and the creation of qualified forms of access carrying more severe sanctions.

as "password swapping".

The fact that legal provisions developed for tangible property cannot be easily applied to

intangible property is made apparent by an analysis of the applicability of traditional trade

secret protection law to electronic records.

Theft of corporeal information (e.g. books, papers etc, CD ROMs, floppy disks) is easily

covered by traditional penal provisions. However, the problem begins when electronic record

are copied quickly, inconspicuously and often via telecommunication facilities. Here the

“original” information, so to say, remains in the “possession” of the “owner”.

(Section 49 Data Protection Act) and alteration of data (Section 126a Criminal Code) or at least attempt thereof

defraud traffics ... in any password or similar information through which a computer may be accessed without

authorisation". Californian Law penalises one who "knowingly and without permission provides or assists in

providing a means of accessing a computer"; see Californian Penal Code Section 502 (c) (6).

Rohas Nagpal -Cyber Terrorism- Legal issues

14

the traditional provisions on theft and embezzlement to the unauthorised "appropriation" of

electronic information, as they require that tangible property be taken away with the intention

of permanently depriving the victim of it.

includes the intent to use property only temporarily; nevertheless, Japanese law still requires

the taking of tangible property and cannot be applied if data are accessed via

telecommunication facilities e.g. the Internet.

possession of a person without his consent. Although this would apply to theft of electronic

information stored in tangible media (e.g. hard disks, CD ROMs etc), it would not apply to

data accessed via telecommunication facilities.

This problem in applying the general property law to cover electronic data is solved by

information, either by provisions of the penal code or by penal or civil provisions of acts

Code; for Germany, Sections 17, 18, 20 of the Act Against Unfair Competition; for Finland, chapter 30

Sections 4-6 of the Penal Code (as amended 1990); for France, Section 418 Criminal Code; for Italy.

Section 623 Penal Code; for Spain, Articles 278, 279, 280 Criminal Code 1995.

Rohas Nagpal -Cyber Terrorism- Legal issues

15

Traditional legal provisions for damage to property, vandalism and mischief were developed

to protect tangible objects and hence their application to electronic information poses several

challenges.

damaging the physical medium did not fall under the provisions of damage to property, since

electronic impulses are not considered to be "corporeal property" and interference with the

use of the physical medium is not thought of as "destruction".

destruction of information on tapes or discs as damage to property or vandalism.

This approach is based on the premise that the perpetrator either damages or interferes with

the function of the physical tape or disc upon which the information is stored.

Rohas Nagpal -Cyber Terrorism- Legal issues

16

However problems occur in cases in which data is not recorded on corporeal carriers but is

merely transmitted.

In these countries the statutes use different legislative techniques. Finland has amended the

traditional statutes on mischief, vandalism or damage to tangible property.

Japanese law covers all kinds of documents and not only computer-stored data. Austria,

Germany, France, India, Japan, the Netherlands, New Zealand, Spain, the United Kingdom

specifically protect the integrity of computer-stored data. Some legal systems also include

specific qualifications for computer sabotage leading to the obstruction of business or of

national security.

Independent statutes, which protect the integrity of computer-stored data, have the advantage

that they can include the destruction or erasure of computerised data and their alteration or

manipulation (a form of attack which is typical for information but not for tangible property),

as well as the interference with the lawful use or access of data.

Such comprehensive statutes can be found in Austria, Canada, Germany, India, Singapore,

Luxembourg and France.

Rohas Nagpal -Cyber Terrorism- Legal issues

17

the law provides for criminal liability for the introduction or insertion of a "computer virus",

a "destructive program" or a "computer contaminant". Minnesota and Nebraska have gone a

step further by criminalising the act of "distribution without authorisation and with intent to

damage or destroy any computer system or software or data".

broader provision and not only the "production of a malicious program" but also giving

denial of service would come under clauses relating to damage to computers or to data.

destroys, damages, degrades or adversely affects the performance of a computer resource or attaches itself to

another computer resource and operates when a programme, data or instruction is executed or some other event

takes place in that computer resource.

modify, destroy, record, transmit data or programme residing within a computer, computer system or computer

network; or (b) by any means to usurp the normal operation of the computer, computer system, or computer

network.

introduction, communication or passing on of a data processing program which was the purpose or the effect of

damaging a data processing or telecommunication system or its data or programs or of interrupting or altering its

operation.

any data which is meant to do damage by replicating itself in an automated system, however, shall not be an

offence to carry out the act ... with the object of limiting damage resulting from such data."

instructions to create programs, that he/she knows or has to presume to be used for, (unauthorised deleting,

modifying or rendering useless of electronically or similarity stored or transmitted data), will be punished".

Rohas Nagpal -Cyber Terrorism- Legal issues

18

The dissemination of racist statements, hate speech, and violence related information via the

Internet has raised numerous legal questions. The major issues that need to be examined are

in respect of the liability of the author of the material and the additional liability of the

network service provider.

A great diversity and variety of provisions can be found when examining provisions on

speech, stored on foreign server.

Rohas Nagpal -Cyber Terrorism- Legal issues

19

In such cases, not only is the place of commission taken into account, but also the place of

potential results.

In this context, this paper examines the provisions of the law of the USA, UK and India.

This section amends section 1030(a)(5) of title 18, United States Code.

South Korea, Vietnam

United States of America

for the mutual control of the export of strategic products and technical data from member countries to proscribed

destinations. The main goal of the COCOM regulations was to prevent cryptography from being exported to

"dangerous" countries - usually, the countries thought to maintain friendly ties with terrorist organizations (such

as Libya, Iraq, Iran, and North Korea). Exporting to other countries was usually allowed, although States often

required a license to be granted.

Technologies is signed by Argentina, Australia, Austria, Belgium, Canada, the Czech Republic, Denmark,

Finland, France, Germany, Greece, Hungary, Ireland, Italy, Japan, Luxembourg, the Netherlands, New Zealand,

Norway, Poland, Portugal, the Republic of Korea, Romania, the Russian Federation, the Slovak Republic,

Spain, Sweden, Switzerland, Turkey, UK, USA, Bulgaria and Ukraine. It controls the export of weapons and

dual-use goods (i.e. goods that can be used both for a military and for a civil purpose) like cryptography. The

initial provisions were largely the same as old COCOM regulations. The Wassenaar provisions are not directly

applicable: each member state has to implement them within national legislation for them to have effect.

Rohas Nagpal -Cyber Terrorism- Legal issues

20

The amended section punishes any person who causes unauthorised damage to a protected

(i) knowingly causing the transmission of a program, information, code, or

command, or

(ii) intentionally and unauthorisedly accessing a protected computer

$5,000 in value, or

(ii) the actual or potential modification or impairment of the medical examination,

diagnosis, treatment, or care of one or more individuals, or

(iii) physical injury to any person, or

(iv) a threat to public health or safety, or

furtherance of the administration of justice, national defense, or national security.

Section 816 of The Patriot Act is titled “Development and Support of Cyber security Forensic

Capabilities”. This section empowers the Attorney General to establish adequate regional

computer forensic laboratories and provide support to existing computer forensic

laboratories, in order that all such computer forensic laboratories have the capability to:

(1) provide forensic examinations with respect to seized or intercepted computer

evidence relating to criminal activity (including cyber terrorism),

Terrorism (USA PATRIOT ACT) Act of 2001.

the United States Government, or, in the case of a computer not exclusively for such use, used by or for a

financial institution or the United States Government and the conduct constituting the offense affects that use by

or for the financial institution or the Government; or (b) which is used in interstate or foreign commerce or

communication;

damage assessment, and restoring the data, program, system, or information to its condition prior to the offense,

and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service

entity, or legal or other entity.

includes loss resulting from a related course of conduct affecting 1 or more other protected computers).

Rohas Nagpal -Cyber Terrorism- Legal issues

21

(2) provide training and education for Federal, State, and local law enforcement

personnel and prosecutors regarding investigations, forensic analyses, and

prosecutions of computer related crime (including cyber terrorism),

(3) assist Federal, State, and local law enforcement in enforcing Federal, State,

and local criminal laws relating to computer-related crime,

(4) facilitate and promote the sharing of Federal law enforcement expertise and

information about the investigation, analysis, and prosecution of computerrelated

crime with State and local law enforcement personnel and prosecutors,

including the use of multi jurisdictional task forces, and

(5) carry out such other activities as the Attorney General considers appropriate.

that is

i. designed seriously to interfere with or seriously to disrupt an electronic system

ii. designed to influence the government or to intimidate the public or a section of the

public, and

iii. made for the purpose of advancing a political, religious or ideological cause.

Although the term “cyber terrorism” is absent from the terminology of the Indian law, section

69 of the Information Technology Act is a strong legislative measure to counter the use of

encryption by terrorists.

This section authorizes the Controller of Certifying Authorities (CCA) to direct any

Government agency to intercept any information transmitted through any computer

sought to be intercepted is liable for imprisonment up to 7 years.

(1) in the interest of the sovereignty or integrity of India (2) in the interest of the security of the State (3) in the

interest of friendly relations with foreign States (4) for preserving public order (5) for preventing incitement to

the commission of any cognizable offence.

steganographic images, encrypted information etc.

Rohas Nagpal -Cyber Terrorism- Incidents

22

Iraqi hackers disrupted troop deployments during the Gulf War.

In 1994, a 16-year-old English boy took down some 100 U.S. defense systems.

In 1997, 35 computer specialists used hacking tools freely available on 1,900 web sites to

shut down large segments of the US power grid. They also silenced the command and control

system of the Pacific Command in Honolulu.

Since December 1997, the Electronic Disturbance Theater (EDT) has been conducting web

sit-ins against various sites in support of the Mexican Zapatistas. At a designated time,

thousands of protestors point their browsers to a target site using software that floods the

target with rapid and repeated download requests. EDT's software has also been used by

animal rights groups against organizations said to abuse animals. Electrohippies, another

group of hacktivists, conducted web sit-ins against the WTO when they met in Seattle in late

1999.

In 1998, a 12-year-old boy successfully hacked into the controls for the huge Roosevelt Dam

on the Salt River in Arizona, USA. He was in a position to release flood waters that would

have inundated Mesa and Tempe, endangering at least 1 million people.

In 1998, Spanish protestors bombarded the Institute for Global Communications (IGC) with

thousands of bogus e-mail messages. E-mail was tied up and undeliverable to the ISP's users,

and support lines were tied up with people who couldn't get their mail. The protestors also

spammed IGC staff and member accounts, clogged their Web page with bogus credit card

orders, and threatened to employ the same tactics against organizations using IGC services.

They demanded that IGC stop hosting the web site for the Euskal Herria Journal, a New

York-based publication supporting Basque independence. Protestors said IGC supported

terrorism because a section on the Web pages contained materials on the terrorist group ETA,

which claimed responsibility for assassinations of Spanish political and security officials, and

attacks on military installations. IGC finally relented and pulled the site because of the "mail

bombings".

In 1998, ethnic Tamil guerrillas swamped Sri Lankan embassies with 800 e-mails a day over

a two-week period. The messages read, "We are the Internet Black Tigers and we're doing

this to disrupt your communications". Intelligence authorities characterized it as the first

known attack by terrorists against a country's computer systems.

During the Kosovo conflict in 1999, NATO computers were blasted with email bombs and

hit with denial of service attacks by hacktivists protesting the NATO bombings. In addition,

businesses, public organizations, and academic institutes received highly politicized virusladen

e-mails from a range of Eastern European countries, according to reports. Web

defacements were also common.

Rohas Nagpal -Cyber Terrorism- Incidents

23

In 2000, the Asian School of Cyber Laws was repeatedly attacked by Distributed Denial of

Service attacks by “hactivists” propagating the “right to pornography”. The Asian School of

Cyber Laws has spearheaded an international campaign against pornography on the Internet.

In 2001, in the back drop of the downturn in US-China relationships, the Chinese hackers

released the Code Red virus into the wild. This virus infected millions of computers around

the world and then used these computers to launch denial of service attacks on US web sites,

prominently the web site of the White House.

In 2001, hackers broke into the U.S. Justice Department's web site and replaced the

department's seal with a swastika, dubbed the agency the "United States Department of

Injustice" and filled the page with obscene pictures.

In the first six months of 2002 the hacker group GFORCE-Pakistan has conducted more than

150 reported cyber attacks against Indian targets to further its ideas on the Kashmir issue.

In 2002, numerous prominent Indian web sites were defaced. Messages relating to the

Kashmir issue were pasted on the home pages of these web sites. The Pakistani Hackerz

Club, led by “Doctor Neukar” is believed to be behind this attack.