Report warns of U.S. information security weakness

As U.S. forces launch military strikes to lessen the threat of Iraqi nuclear, biological and chemical weapons, a new report warns that the nation must strengthen efforts to lessen another looming threat: cyberwarfare.

Cyberattacks are just as much a threat to U.S. security as other weapons of mass destruction, the Center for Strategic and International Studies said in a report released this week. But federal efforts to prepare for information warfare have been inadequate, the report contended.

"Security is no longer defined by armed forces standing between the aggressor and the homeland. The weapons of information warfare can outflank and circumvent military establishments and compromise the common underpinnings of both U.S. military and civilian infrastructure, which is now one and the same," the report said. "To date, no U.S. policy review has considered how the information revolution has affected the country's beliefs about security or proper preparations for dealing with such threats."

More than 20 nations have already successfully penetrated U.S. information systems, according to the report, "Cybercrime, Cyberterrorism, Cyberwarfare: Averting an Electronic Waterloo." Former FBI and CIA director William H. Webster headed the team that wrote the report.

Information warfare specialists at the Pentagon estimate that 30 computer experts with a budget of $10 million could launch a coordinated attack against the U.S. information infrastructure, disrupting or shutting down vital services, including electronic power grids and air traffic control centers.

Computer networks have developed without enough attention to network security, the report said. Federal agencies are only beginning to adjust to a world where information warfare is a threat.

For example, the Defense Information Systems Agency launched 38,000 test attacks against its own systems to check the agency's vulnerabilities, the report said. Only four percent of the people in charge of the systems realized they were under attack. Of those, only 1 in 150 reported the intrusion to their bosses.

At the National Security Agency, a 23-year-old GS-14 is responsible for protecting the agency's ground stations from electronic attacks, the report noted.

"Tomorrow's front-line commanders will be drawn from the ranks of computer wizards. The sandal culture is challenging the wingtips," the report said.

In May, President Clinton established the Critical Infrastructure Assurance Office to coordinate federal efforts to protect the nation's computer systems and other infrastructures. The National Security Council has also appointed a national coordinator for security, infrastructure protection and counterterrorism.

But the administration needs to do more, the report warned. The President should issue an executive order calling for a complete review of federal policy and systems, establishing a policy for the offensive use of information warfare, and defining the roles of federal agencies and departments for protecting the nation's computer infrastructure.

The government, the report argued, must also make sure it can continue to provide essential services during information warfare attacks.

"Government officials need to identify those functions that only government can perform and ensure that government has secure information systems and processes to maintain these functions," the report said. "This requires updating and expanding government plans for the information age and securing the essential infrastructures upon which all levels of government depend."

Pentagon spokesman Kenneth H. Bacon said the military takes information warfare very seriously.

"The threat of an electronic Pearl Harbor or the threat of cyber-terrorism-which could be much less hyperbolic than an electronic Pearl Harbor-is clearly one that's getting increasing attention in this building and throughout the government," Bacon said on Tuesday. "I think it's an area in which it's very difficult to say that enough attention is being paid, in part because the question always arises, 'How much is enough?' But clearly, it's one that's of growing concern to the military and growing concern to this administration as well."