## 4 Cyber-Terrorism  
I have been writing about the prospects of cyber-terrorism since the late 1990s, always coming to the conclusion that it was not yet here, but leaving open the possibility that we would see it in the future and acknowledging that cyber-threats overall were serious, growing, and in need of being addressed. In my most recent article, a follow-up to one I had written right after al-Qaeda's 11 September 2001 terrorist attacks, I wrote: \"Thus, the decade following 9.11 closes in much the same state as it began. Al-Qaeda and other terrorist groups still prefer bombs to bytes, and cyber terrorism remains a hypothetical threat even as the overall threat level in cyberspace has increased\" [21]. This does not mean that terrorists and jihadists aligning themselves with al-Qaeda have never conducted a cyber-attack. Indeed, they have defaced and conducted low-level denial-of-service (DOS) attacks against websites they believe are harmful to Islam. But none of these attacks has risen to the level of cyber-terrorism. For a politically-motivated cyber-attack to be considered an act of cyber-terror, it would have to be serious enough to actually incite terror on a par with violent, physical acts of terrorism such as bombings. Attacks that caused major blackouts, gas pipeline explosions, train derailments, plane crashes, large financial losses, and the like would fall in that category. Attacks that merely disrupt access to a public website do not. In another paper, I offered three indictors that might precede a successful incident of cyber-terrorism [22]:  
* Failed cyber-attacks against critical infrastructures, particularly the ICS devices that are used to monitor and control these infrastructures. I thought it unlikely that a first attempt would succeed with the desired effect, given the novelty of such an attack and uncertainty about how it would play out. Stuxnet might be considered an exception to this, but terrorists would not have the capabilities and resources of nation-states such as Israel and the United States, and thus more difficulty getting it right the first time. Even their kinetic attacks frequently fail. * Research and training labs, where terrorists simulate the effects of cyber-attacks against critical infrastructures, develop methods and tools to attack ICSs, and train people on how to conduct such attacks. I reasoned that it is hard to perform controlled experiments and analyze the consequences without a lab, as Israel appeared to have had for Stuxnet at their Dimona complex. Absent special facilities, I expected to at least see training materials showing terrorists how to conduct damaging attacks against ICSs and software tools designed to facilitate such attacks. * Extensive discussions and planning relating to acts of cyber-terror against critical infrastructures, not just attacks against websites and attacks aimed at making money. When Stuxnet came along, at least one jihadist took notice. A posting to the popular al-Shamukh jihadist forum in late 2010 called for attacks against SCADA systems, claiming they could be used to cause a massive explosion in a power plant, even a nuclear one, among other things. However, while giving a broad overview of SCADA systems and pointing to Stuxnet, the Australian sewage overflows, and other incidents affecting critical infrastructures, the posting offered no details for executing such attacks. Further, the premier jihadist English-language publication, _Inspire_, which has published nine issues as of May 2012, has focused exclusively on physical acts of violence. Readers can learn how to \"make a bomb in the kitchen of your mom,\" but not how to conduct even rudimentary cyber-attacks. Although jihadist websites and forums have offered tutorials and tools for rudimentary hacking, I have not seen jihadist materials for specifically attacking an ICS or any information suggesting that jihadists have access to a lab with ICS equipment and software, or that they have even attempted cyber-attacks against an ICS.