ASEE Prism On-line, February 2000
Illustration by Michael Gibbs
Striking Back At Terrorism
Engineers are developing some surprising new defenses for a wr the nation hopes will never come
By Bruce Aster

There is only one way in. The lone door is always locked. The one window is secured. The ambitious thief is advised not to try to enter the room physically. Better, instead, to hack one's way in. Because inside the locked room are 30 computers, some of which contain the secrets of a fictitious company known as the 532 Corporation. It is a fair bet that somewhere inside the company, someone left an electronic door ajar, opening the entire enterprise to attack. Bet on this, too: 532 Corporation will be attacked because every semester at Iowa State University, professors Doug Jacobson and Jim Davis unleash 50 of their students, giving them three weeks to break into the firm, gather a crucial encrypted file, and leave without being detected. "What they're doing would be illegal if they left our little world," says Jacobson.

Oklahome City Federal Building - bombed in 1995

Thousands of search and rescue crews attend a memorial service in front of the Alfred E. Murrah Federal Building in Ocklahoma City. Rescue workers ended their search for victims of the car bombing attack after 16 days.

Iowa State is training a new generation to safeguard the nation's computers. The university is one of seven Centers of Excellence designated by the National Security Agency. The program—as well as similar ones at Purdue University, George Mason, and the University of Idaho—teaches students to break into computer networks so that they will learn how to keep real-world hackers—and computer terrorists—out. "I want them to think how an attacker would think," says Jacobson.

Already they are learning valuable lessons: that people are the weakest link in any system and that fancy technological fixes and Internet firewalls are of no use if employees choose passwords off the TV show Star Trek. Which, the professors testify, people all too often do. At project's end, students are asked to explain how they would fix what they learned to break. "We're producing the info warrior," says Jacobson. For the NSA, which cares deeply about information security, the program is essential.

Computer engineers at schools such as Iowa State are today's Minutemen, alerting and training a new generation of troops for a war the nation hopes never comes. The threat is unlike wars of the past, lacking any set battle lines or clear enemies. Never before has a challenge seemed so vividly real yet invisible. But at the Pentagon and throughout government, officials are imagining the unimaginable: Enemy states or terrorists not content to hack into Pentagon computers but eager instead to do real damage by attacking America's computer-dependent banking system, power stations, and transportation network. Or terrorists, allied with a rogue state, willing to unleash biological or chemical weapons against the American homeland.

These nontraditional threats have prompted a very traditional response. The federal government, just as it did in the Cold War and the Second World War—most dramatically with the Manhattan Project—wants scientists and engineers from industry and academia to find technical fixes that will blunt unconventional attacks. "We can prevail over terrorism by drawing on the very best in our free society: the skill and courage of our troops, the genius of our scientists and engineers, the strength of our factory workers, the determination and talents of our public servants, the vision of our leaders in every vital sector," President Clinton said last January, when he announced a series of new initiatives during a speech at the National Academy of Sciences.

Clear and Present Danger

The challenge is rich. And so is the budget to meet it. The president wants to spend $2.8 billion this year to defend against chemical, biological, and cyber threats, including $500 million for research on information security and $400 million for research to defend against chemical and biological attack. And dollars are by no means the only yardstick by which to measure the threat; one need only count the number of special commissions established to study these new dangers to realize how worried top officials are.

New York City's World Trade Center explosion victims 

Victims of the explosion at New York City's World Trade Center are aided by rescue workers.

Just last summer, a panel headed by former CIA director John Deutch confirmed what others had already reported, calling the chem-bio threat "a chilling new reality for our country." Before that came the Report of the President's Commission on Critical Infrastructure Protection, which documented physical and computer threats to transportation systems, oil and gas production facilities, the water supply, telecommunications, the banking and finance infrastructure, and the electric grid, among other critical elements of society.

The degree to which the American economy depends on computers—and the degree to which different infrastructures depend on each other—was one of the key conclusions of the critical infrastructure report. This past year two of every three companies in an Information Week survey reported being victimized by a virus attack. That corporate America is a target—not just the Pentagon or government agencies—is one reason the NSA is eager to bless programs such as the one at Iowa State, which produces graduates who may work in the private sector but will bring some expertise that can protect business from intrusion.

Of course, government and military computers are targets, too. Despite the secretive nature of much military business, the Defense Department hardly operates in a locked room. In 1998, about 95 percent of Pentagon "telecommunications requirements" came from private networks, according to Jeffrey Hunker, the director of the Critical Infrastructure Assurance Office. The most serious breach so far was a scheme dubbed Solar Sunrise that spooked the Pentagon at the very moment the military was set to launch an air attack against Iraq in 1998. What was unique about that event was that while the perpetrators turned out to be two teenagers from California, they routed their attack through the United Arab Emirates—a reminder that terrorists or enemy states bent on disrupting American information systems can conceal their identities. Cyber terrorists won't be spotted leaving the scene in a getaway car. "What worries me are state actors," says Michael Jacobs, a senior official at the National Security Agency. "They will be more sophisticated and they have no interest in claiming victory."

Interdependent Infrastructure

There is another challenge, related but distinct from the well-publicized threats of chemical and biological terror or information attack. "Where I see the real problem is system complexity," says Jennifer Nelson, a specialist on critical infrastructure issues at Sandia National Laboratories. "Infrastructures are becoming so interdependent that outages in one can cascade over and have effects in others."

Ted Kacynski, the Unabomber 

Ted Kacynski, wearing a white bullet-proof vest, is escorted by U.S. Marshalls into the federal courthouse. Kacynski kept a journal in which he admits to 17 of the bombings attributed to the "Unabomber."

We know, how easily the nation can be tied in knots: In 1998 a single satellite failed, knocking radio and television stations off the air, silencing pagers, disabling ATMs, and stalling credit card systems. Last winter, an ice storm in Washington, D.C., knocked out power for days. And late last summer, Hurricane Floyd knotted traffic along the eastern seaboard, illustrating again how choke points along highways can paralyze entire cities.

The Clinton administration's response to these new threats was formulated in 1998 when it issued two Presidential Decision Directives, or PDDs, that outline a plan of action for addressing the nation's vulnerability to computer and terror attack. The approach is wide-ranging: it calls for everything from the creation of a "cybercorps" of computer security experts to research on vaccines against biological agents to the creation of local medical teams ready to respond in a crisis.

But some critics believe the president has put too much emphasis on exotic scientific solutions and not enough on simple, common sense. "The quest for a silver bullet is misplaced," says Richard Falkenrath, a Harvard University professor of public policy and author of a book on biological and chemical weapons terrorism. "There are a lot of simpler, lower-tech steps that are not as glamorous. For me, the important stuff is organizational." For example, he argues that local police, fire, and medical units need more and more realistic training for possible chemical or biological weapons attack.

There remains, however, a remarkable range of promising research underway that has been generated in response to these new threats: from training computer engineers to prevent intrusion to training insects to detect chemicals. But for these areas of research and everything in between, there are some common threads: much of the engineering work being done today involves detecting threats (be they computer intrusions or biological attack) or minimizing the damage that a successful attack inflicts.

Early Warning System

Sensors are the next big thing. Without a clear understanding of what exactly the threat is, heroic response is impossible. Scientists at Sandia National Laboratories are developing tiny acoustic-wave chemical sensors that they call a "chem lab on a chip." When certain chemicals are absorbed by the sensor, acoustic waves are slowed. The lab expects, initially, that the chips could be built into a handheld device that would permit soldiers or others to detect chemicals. Down the road, the system could be connected to an alarm that would warn of the presence of a chemical.

Japan Subway gassing
Firefighters wearing gas masks and protective suits emerge after cleaning sarin nerve gas from subway cars at Tokyo's Kodemmacho station. A dozen people were killed and more than 50,000 others becme ill from the atack.

Detecting chemicals is one thing. A bigger challenge, however, is the detection of biological agents, an area where the nation is particularly weak. "Sensors are important in dealing with every aspect of the biological incident, from warning of the presence of an agent in the atmosphere to determining whether a building is fully decontaminated and safe to reenter," Frank Fernandez, director of the Defense Advanced Research Projects Agency, told Congress. Researchers at the Massachusetts Institute of Technology are examining different techniques for spotting and identifying agents such as anthrax. In one project, a fluorescence sensor uses a laser to light individual particles in the air, and then distinguishes naturally occurring dust or pollen from toxic agents. In just 30 seconds, it can sound an alarm. Another MIT project uses a bioelectric sensor; in this experiment, cells give off light when touched by a biological agent. Similar projects are being worked nationwide. The trick is to find sensors that can detect more than a single toxic agent, weigh less than five pounds, and can tell what they've found in less than a minute, say DARPA officials, which is why the agency is funding a wide-ranging "environmental biosensor" program.

One sensor that certainly weighs less than five pounds is the wasp. Researchers at Iowa State University, under the auspices of DARPA, are training the insects to locate chemicals. Wasps are able to detect a wide range of chemical compounds and can be trained to locate specific chemical cues. The goal is to raise them in large numbers for use as sentinels to warn about possible chemical attack. There is a second, more ambitious use of the wasps, according to DARPA's Controlled Biological Systems program. The agency wants to develop a biological sensor system "using wasp antennae interfaced with electronics or mounted on an unmanned automated vehicle" to detect production or storage sites for toxic compounds.

Foiling a biological weapons attack doesn't just mean waiting for it to occur and then trying to minimize the damage. Programs funded by the Defense Department aim to find scientific techniques for detecting and attacking weapons facilities and labs where the agents are made. Experts on seismology, electromagnetics, and spectroscopy will be called upon to study the acoustic, seismic, and other signatures of underground weapons facilities. DARPA hopes research may also help military officials perform "battle damage assessments" after an attack to determine whether a hit crippled the facility or not.

For all the high-tech solutions to the problems posed by new threats, there are more simple engineering fixes that, in many ways, may prove more useful and practical. One reason is that they are better matched to the threats of the moment. For all the scenarios conceived about biological or chemical attack, the fact remains that it is a difficult technical challenge to turn an agent produced in a lab into a deadly weapon that can be delivered to a target. It remains far simpler, and often as lethal, simply to rely on conventional explosives. The death toll in the chemical attack on the Tokyo subway was 12. Bombings at Oklahoma City and at the two American embassies in Africa killed hundreds. For a host of reasons, including ease of acquisition and of delivery, conventional explosives remain the weapon of choice for terrorists such as Osama bin Laden.

Protecting the Foundations

18 year old computer hacker Ehud Tenebaum
18-year-old Ehud Tenebaum, a.k.a. "Analyzer," an Israeli believed to be behind cyber attacks on Pentagon and university computers leaves a police station in Tel Aviv. The intrusion was "the most organized and systemcatic attack the Pentagon has seen to date," according to a Defense Department Official.

The engineering community is working to protect people from precisely those sorts of attacks. Building design is critical: Most of the people who died in the Oklahoma City blast were killed by falling concrete or flying glass. Consequently, researchers are looking for ways to make buildings themselves less lethal. One such effort is underway at Sandia National Laboratories in New Mexico, where the Architectural Surety program is an offspring of the Cold War. The Department of Energy relied on Sandia to design structures, which housed nuclear materials, strong enough to resist attack. Sandia is adapting the program to protect the infrastructures detailed in the president's critical infrastructure report: bridges, dams, buildings, and so on. So, for example, Sandia recently worked with the architect of a federal courthouse in Albuquerque to design a building less vulnerable to terrorist attack.

Continuing research at Sandia will focus on analyzing the effects of bomb blasts on buildings, as well as studying the ways in which glass shatters. The work on blasts will piggyback on Sandia's long-standing relationship with the Defense Department; blast simulations that will determine the effect of explosives on barrier walls and large, multistory buildings will be conducted with super computers in association with the government. The work on glass aims to identify ways to reduce the risk to people, including the use of film coatings, tempering, and lamination. "These efforts are designed to provide the technical basis for glass protection design standards and guidelines for anti-terrorism," according to a technical paper by the program's leaders, Rudolph Matalucci and Dennis Miyoshi.

Ironically, perhaps, the research to make safer glass is modeled on computers, and yet those computers themselves are vulnerable to attack. Protecting information was once the province of the government. Now, because computer networks are decentralized, vulnerability anywhere can mean vulnerability everywhere. "The world has changed," says the NSA's Mike Jacobs. "We no longer own the technology. We alone cannot train enough people to do the job on the job." And that is why NSA, despite its historic reputation for secrecy, is reaching out to the business and university communities to assist their efforts to secure information systems.

David L Smith, creator of the Melissa Virus that caused millions of dollars worth of damage to computers worldwide 

David L. Smith leaves the Monmouth County Courthouse in Freehold, N.J., after pleading guilty to a state charge of computer theft. Smith admitted to creating and distributing the "Melissa" virus and acknowledged that it caused millions of dollars of damage and disrupted e-mail systems worldwide.

NSA's sponsorship of programs at Iowa State and elsewhere is just one example. The agency has just put out the call for a second round of programs it intends to endorse as part of the Centers of Excellence program. NSA does not design the academic programs, and Jacobs admits that the NSA designation is "a bumper sticker," and little more, designed to certify that programs meet some basic standards. But it works: At Iowa State, Professor Jacobson reports that enrollment is way up. And that's exactly what NSA wants to see. The Commerce Department predicts that through 2006 there will be a shortfall of 1.3 million people in the information technology field.

Other efforts are shorter on symbolism and longer on substance. NSA is sharing case studies—the sort of information that not so long ago would have been illegal to disclose—with universities so they can model curricula on the latest information available to the government. There is also extensive research, much of which would go to engineering departments, on information assurance. Research fields include work on operating system technologies and ultra high-speed encryption.

And then there's research that raises the fair and obvious question: Why hasn't this been done before? The NSA endorses the use of formal methods for software development. Jacobs, who is the top official responsible for information assurance at the agency, observes that the next version of Windows NT will contain something more than 40 million lines of code. "How can anyone be sure of what's in there?" he asks. If the top security official at NSA can't, there's a problem waiting for a fix.

 

Bruce Auster is a freelance writer in Washington, D.C.

Navigation bar