Will the Apocalypse Arrive Online?

How fear of cyber attack could take down your liberties and the Constitution

by Karen J. Greenberg, October 22, 2012

First the financial system collapses and it’s impossible to access one’s money. Then the power and water systems stop functioning. Within days, society has begun to break down. In the cities, mothers and fathers roam the streets, foraging for food. The country finds itself fractured and fragmented — hardly recognizable.

It may sound like a scene from a zombie apocalypse movie or the first episode of NBC’s popular new show “Revolution,” but it could be your life — a nationwide cyber-version of Ground Zero.

Think of it as 9/11/2015. It’s Secretary of Defense Leon Panetta’s vision of the future — and if he’s right (or maybe even if he isn’t), you better wonder what the future holds for erstwhile American civil liberties, privacy, and constitutional protections.

Last week, Panetta addressed the Business Executives for National Security, an organization devoted to creating a robust public-private partnership in matters of national security. Standing inside the Intrepid, New York’s retired aircraft-carrier-cum-military-museum, he offered a hair-raising warning about an imminent and devastating cyber strike at the sinews of American life and well-being.

Yes, he did use that old alarm bell of a “cyber Pearl Harbor,” but for anyone interested in American civil liberties and rights, his truly chilling image was far more immediate. “A cyber attack perpetrated by nation states or violent extremist groups,” he predicted, “could be as destructive as the terrorist attack of 9/11.”

Panetta is not the first Obama official to warn that the nation could be facing a cyber catastrophe, but he is the highest-ranking to resort to 9/11 imagery in doing so. Going out on a limb that previous cyber doomsayers had avoided, he mentioned September 11th four times in his speech, referring to our current vulnerabilities in cyber space as “a pre-9/11 moment.”

Apocalypse Soon

Since the beginning of the Obama presidency, warnings of cyber menaces from foreign enemies and others have flooded the news. Politicians have chimed in, as have the experts — from respected security professionals like President George Bush’s chief counterterrorism adviser Richard Clarke to security policymakers on the Hill like Senators Joe Lieberman and Susan Collins. Even our no-drama president has weighed in remarkably dramatically on the severity of the threat. “Taking down vital banking systems could trigger a financial crisis,” he wrote in the Wall Street Journal. “The lack of clean water or functioning hospitals could spark a public health emergency. And as we’ve seen in past blackouts, the loss of electricity can bring businesses, cities, and entire regions to a standstill.”

Panetta’s invocation of 9/11 was, however, clearly meant to raise the stakes, to sound a wake up call to the business community, Congress, and the nation’s citizens. The predictions are indeed frightening. According to the best experts, the consequences of a massive, successful cyber attack on crucial U.S. systems could be devastating to life as we know it.

It’s no longer just a matter of intellectual property theft, but of upending the life we lead. Imagine this: instead of terrorists launching planes at two symbolic buildings in the world’s financial center, cyber criminals, terrorists, or foreign states could launch viruses into major financial networks via the Internet, or target the nation’s power grids, robbing citizens of electricity (and thus heat in the middle of winter), or disrupt the systems that run public transportation, or contaminate our water supply.

Any or all of these potential attacks, according to leading cyber experts, are possible. Though they would be complex and difficult operations, demanding technical savvy, they are nonetheless within the realm of present possibility. Without protections, American citizens could be killed outright (say on a plane or a train) or left, as the president warned, without food, fuel, water and the mechanisms for transacting daily business.

For those of us who have lived inside the national security conversation for more than a decade now, such early warnings of dire consequences might sound tediously familiar, just another example of the (George W.) Bush who cried wolf. After all, in the wake of the actual 9/11 attacks, governmental overreach became commonplace, based on fear-filled scenarios of future doom. Continual hysteria over a domestic terror threat and (largely nonexistent) al-Qaeda “sleeper cells” bent on chaos led to the curtailing of the civil liberties of large segments of the American Muslim population and, more generally, far greater surveillance of Americans. That experience should indeed make us suspicious of doomsday predictions and distrustful of claims that extraordinary measures are necessary to protect “national security.”

For the moment, though, let’s pretend that we haven’t been through a decade in which national security needs were used and sometimes overblown to trump constitutional protections. Instead, let’s take the recent cyber claims at face value and assume that Richard Clarke, who prior to 9/11 warned continuously of an impending attack by al-Qaeda, is correct again.

And while we’re not dismissing these apocalyptic warnings, let’s give a little before-the-fact thought not just to the protection of the nation’s resources, information systems, and infrastructure, but to what’s likely to happen to rights, liberties, and the rule of law once we’re swept away by cyber fears. If you imagined that good old fashioned rights and liberties were made obsolete by the Bush administration’s Global War on Terror, any thought experiment you perform on what a response to cyber war might entail is far worse.

Remember former White House Council Alberto Gonzales telling us that, when it came to the interrogation of suspected terrorists, the protections of the U.S. Constitution were “quaint and obsolete”? Remember the argument, articulated by many, that torture, Guantanamo, and warrantless wiretapping were all necessary to prevent another 9/11, whatever they did to our liberties and laws?

Now, fast forward to the new cyber era, which, we are already being told, is at least akin to the threat of 9/11 (and possibly far worse). And keep in mind that, if the fears rise high enough, many of the sorts of moves against rights and constitutional restraints that came into play only after 9/11 might not need an actual cyber disaster. Just the fear of one might do the trick.

Not surprisingly, the language of cyber defense, as articulated by Panetta and others, borrows from the recent lexicon of counterterrorism. In Panetta’s words, “Just as [the Pentagon] developed the world’s finest counterterrorism force over the past decade, we need to build and maintain the finest cyber operators.”

The Cyber Threat to American Rights and Liberties

Cyber is “a new terrain for warfare,” Panetta tells us, a “battlefield of the future.” So perhaps it’s time to ask two questions: In a world of cyber fear, what has the war on terror taught us about protecting ourselves from the excesses of government? What do policymakers, citizens, and civil libertarians need to think about when it comes to rights that would potentially be threatened in the wake of, or even in anticipation of, a cyber attack?

Here, then, are several potential threats to constitutional liberties, democratic decision-making processes, and the rule of law to watch out for in this new cyber war era:

The Threat to Privacy: In the war on terror, the government — thanks to the Patriot Act and the warrantless surveillance program, among other efforts — expanded its ability to collect information on individuals suspected of terrorism. It became a net that could snag all sorts of Americans in all sorts of ways. In cyber space, of course, the potential for collecting, sharing, and archiving data on individuals, often without a warrant, increases exponentially, especially when potential attacks may target information itself.

A recent FBI investigation illustrates the point. The Coreflood Botnet utilized viruses to steal personal and financial information from millions of Internet users, including hospitals, banks, universities, and police stations. The focus of the Coreflood threat — which also means its interface with the government — was private information. The FBI got warrants to seize the command-and-control servers that acted as an intermediary for the stolen information. At that point, the government was potentially in possession of vast amounts of private information on individual American citizens. The FBI then offered assurances that it would not access or make use of any of the personal information held on those servers.

But in an age that has become increasingly tolerant of — or perhaps resigned to — the government’s pursuit of information in violation of privacy rights, the prospects for future cyber-security policy are worrisome. After all, much of the information that might be at risk in so many potential cyber attacks — let’s say on banks — would fall into the private sphere. Yet the government, citing national security, could persuade companies to turn over that that data, store it, and use it in various ways, all the while claiming that its acts are “preventive” in nature and so not open to debate or challenge. And as in so many post-9/11 cases, the courts might back such claims up.

Once the information has been shared within the government, who’s to say how long it will be held and how it will be used in the future? Or what agency guidelines exist, if any, to ensure that it won’t be warehoused for future uses of quite a different sort? As former Department of Homeland Security head Michael Chertoff put it, “You need to have a certain amount of accountability so government doesn’t run roughshod [over people’s right to privacy] and that’s been a hard thing to architect.”

Enemy Creep: If you think it’s been difficult to reliably distinguish enemies from the rest of us in the war on terror (as in the 600 Guantanamo detainees that the Bush administration finally declared “no longer enemy combatants” and sent home), try figuring it out in cyber space. Sorting out just who launched an attack and in whose name can be excruciatingly difficult. Even if, for example, you locate the server that introduced the virus, how do you determine on whose behalf such an attack was launched? Was it a state or non-state actor? Was it a proxy or an original attack?

The crisis of how to determine the enemy in virtual space opens up a host of disturbing possibilities, not just for mistakes, but for convenient blaming. After all, George W. Bush’s top officials went to war in Iraq labeling Saddam Hussein an ally of al-Qaeda, even when they knew it wasn’t true. Who is to say that a president won’t use the very difficulty of naming an online enemy as an excuse to blame a more convenient target?

War or Crime?: And what if that enemy is domestic rather than international? Will its followers be deemed “enemy combatants” or “lawbreakers”? If this doesn’t already sound chillingly familiar to you, it should. It was an early theme of the war on terror where, beginning with its very name, “war” won out over crime.

Cyber attacks will raise similar questions, but the stakes will be even higher. Is a hacker attempting to steal money working on his own or for a terrorist group, or is he essentially a front for an enemy state eager to take down the U.S.? As Kelly Jackson Higgins, senior editor at the information security blog Dark Reading, reminds us, “Hackers posing as other hackers can basically encourage conflict among other nations or organizations, experts say, and sit back and watch.”

Expanding Presidential Fiat: National security professionals like Defense Secretary Panetta are already encouraging another cyber development that will mimic the war on terror. Crucial decisions, they argue, should be the president’s alone, leaving Congress and the American people out in the cold. President Bush, of course, reserved the right to determine who was an enemy combatant. President Obama has reserved the right to choose individuals for drone assassination on his own.

Now, an ever less checked-and-balanced executive is going to be given war powers in cyber space. In fact, we know that this is already the case, that the last two administrations have launched the first state cyber war in history — against Iran and its nuclear program. Going forward, the White House is likely to be left with the power of deciding who is a cyber attacker, and when and how such enemies should be attacked. In Panetta’s words, “If we detect an imminent threat of attack that will cause significant, physical destruction in the United States or kill American citizens, we need to have the option to take action against those who would attack us to defend this nation when directed by the president.”

Given the complex and secretive world of cyber attacks and cyber war, who is going to cry foul when the president alone makes such a decision? Who will even know?

Secrecy Creep: While government officials are out in full force warning of the incipient cyber threat to our way of life, it’s becoming ever clearer that the relationship between classified information, covert activities, and what the public can know is being further challenged by the new cyber world. In the war on terror years, a cult of government secrecy has spread, while Obama administration attacks on government leakers have reached new heights. On the other hand, Julian Assange and WikiLeaks made the ability to access previously classified information a household premise.

So the attempt to create an aura of secrecy around governmental acts is on the rise and yet government secrets seem ever more at risk. For example, the U.S. intended to keep the Stuxnet virus, launched anonymously against Iranian nuclear facilities, a secret. Not only did the attacks themselves become public knowledge, but eventually the American-Israeli ownership of the attack leaked out as well. The old adage “the truth will out” certainly seems alive today and yet the governmental urge for secrecy still remains ascendant.

The question is: Will there be a heightened call — however futile — for increased secrecy and the ever more draconian punishment of leakers, as has been the case in the war on terror? Will the strong arm of government threaten, in an ever more draconian manner, the media, leakers, and those demanding transparency in the name of exposing lawless policies — as has happened with CIA leaker John Kiriakou, New York Times reporter James Risen, and others?

Facing the Cyber Age

When it comes to issues like access to information and civil liberties protections, it could very well be that the era of Big Brother is almost upon us, whether we like it or not, and that fighting against it is obsolete behavior. On the other hand, perhaps we’re heading into a future in which the government will have to accept that it cannot keep secrets as it once did. Whatever the case, most of us face enormous unknowns when it comes to how the cyber world, cyber dangers, and also heightened cyber fears will affect both the nation’s security and our liberties.

On the eve of the presidential election, it is noteworthy that neither presidential candidate has had the urge to discuss cyber security lately. And yet the U.S. has launched a cyber war and has seemingly recently experienced the first case of cyber blowback. The websites of several of the major banks were attacked last month, presumably by Iran, interrupting online access to accounts.

With so little reliable information in the public sphere and so many potential pitfalls, both Obama and Romney seem to have decided that it’s just not worth their while to raise the issue. In this, they have followed Congress’s example. The failure to pass regulatory legislation this year on the subject revealed a bipartisan unwillingness of our representatives to expose themselves to political risk when it comes to cyber legislation.

Whether officials and policymakers are willing to make the tough decisions or not, cyber vulnerabilities are more of a reality than was the threat of sleeper cells after 9/11. It may be a stretch to go from cynicism and distrust in the face of color-coded threat levels to the prospect of cyber war, but it’s one that needs to be taken.

Given what we know about fear and the destructive reactions it can produce, it would be wise to jump-start the protections of law, personal liberties, and governmental accountability. Whoever our next president may be, the cyber age is upon us, carrying with it a new threat to liberty in the name of security. It’s time now — before either an actual attack or a legitimate fear of such an attack — to protect what’s so precious in American life, our liberties.

Karen Greenberg is the director of the Center on National Security at Fordham Law School, a TomDispatch regular, and the author of The Least Worst Place: Guantanamo’s First One Hundred Days, as well as the editor of The Torture Debate in America. Research assistance for this article was provided by Jason Burke and Martin West.

Follow TomDispatch on Twitter @TomDispatch and join us on Facebook.

Copyright 2012 Karen J. Greenberg

This article originally appeared at TomDispatch.com. To stay on top of important articles like these, sign up to receive the latest updates from TomDispatch.com.

Read more by Tom Engelhardt