Often it is very difficult to determine if a cyber attack or intrusion is the work of a terrorist organization with the objective of doing harm, or a cyber criminal who wishes to steal information for purposes of monetary gain. Just as terrorists and violent extremists often rely on exploiting vulnerabilities of targets seen as soft and easy to access to support possible future cyber attacks, cyber criminals exploit these same vulnerabilities to gain access to information that may lead to monetary gain. Implementation of a stronger policy for domestic physical security has reduced the risk to some targets that may have previously been vulnerable to physical attacks. Also, it is suggested by numerous experts that terrorists may be enhancing their computer skills or forming alliances with cybercriminals that possess a high-level of telecommunications expertise. In addition, continuing publicity about Internet computer security vulnerabilities may encourage terrorists' interest in attempting a possible computer network attack, or cyberattack, against U.S. critical infrastructure. To date, the Federal Bureau of Investigation (FBI) reports that cyberattacks attributed to terrorists have largely been limited to unsophisticated efforts such as email bombing of ideological foes, or defacing of websites. However, it says their increasing technical competency is resulting in an emerging capability for network-based attacks. The FBI has predicted that terrorists will either develop or hire hackers for the purpose of complimenting large conventional attacks with cyberattacks. Recently, during the Annual Threat Assessment, FBI Director Mueller observed that "terrorists increasingly use the internet to communicate, conduct operational planning, proselytize, recruit, train and to obtain logistical and financial support. That is a growing and increasing concern for us." IBM has reported that, during the first half of 2005, criminal-driven computer security attacks increased by 50 percent, with government agencies and industries in the United States targeted most frequently. Cybercrime is now a major criminal activity, and it may become increasingly difficult to separate some forms of cybercrime from suspected terrorist activities. For example, in a recent report from the House Homeland Security Committee, FBI officials indicated that extremists have used identity theft and credit card fraud to support recent terrorist activities by Al Qaeda cells. Also, according to press reports Indonesian police officials believe the 2002 terrorist bombings in Bali were partially financed through online credit card fraud. This report reviews publications and government reports to explore the following: (1) examples of vulnerabilities that may raise the level of interest that terrorists might have in attempting a coordinated cyberattack; (2) effects of the War on Terror that are driving terrorists to use the Internet more; (3) inconsistent reporting about terrorists' cyber activities; and (4) ways that terrorists may be improving their cyber skills. Distinctions between crime, terrorism, and war tend to blur when attempting to describe a computer network attack (CNA) in ways that parallel the physical world. For example, if a nation state were to secretly sponsor non-state actors who initiate a CNA to support terrorist activities or to create economic disruption, the distinction between cybercrime and cyberwar becomes less clear. Because it is difficult to tell from where a cyberattack originates, an attacker may direct suspicion toward an innocent third party. Likewise, the interactions between terrorists and criminals who use computer technology may sometimes blur the distinction between cybercrime and cyberterrorism. It also may be the case that individuals providing computer expertise to a criminal or terrorist may not be aware of the intentions of the individual that requested the support. So far, it remains difficult to determine the sources responsible for most of the annoying, yet increasingly sophisticated attacks that plague the Internet. Given the difficulty in determining the originator of the cyber intrusions or attacks, some argue that unlike responding to traditional criminal acts, the focus should be on the act rather than the perpetrator and the threshold for launching defensive and offensive actions should be lowered. The Internet is now used as a prime recruiting tool for insurgents in Iraq. Insurgents have created many Arabic-language websites that are said to contain coded plans for new attacks. Some reportedly give advice on how to build and operate weapons, and how to pass through border checkpoints. Other news articles report that a younger generation of terrorists and extremists, such as those behind the July 2005 bombings in London, are learning new technical skills to help them avoid detection by law enforcement computer technology. Some observers feel that the term "Cyberterrorism" is inappropriate, because a widespread cyberattack may simply produce annoyances, not terror, as would a bomb, or other chemical, biological, radiological, or nuclear explosive (CBRN) weapon. However, others believe that the effects of a widespread computer network attack would be unpredictable and might cause enough economic disruption, fear, and civilian deaths, to qualify as terrorism. At least two views exist for defining the term Cyberterrorism: Effects-based : Cyberterrorism exists when computer attacks result in effects that are disruptive enough to generate fear comparable to a traditional act of terrorism, even if done by criminals. Intent-based : Cyberterrorism exists when unlawful or politically motivated computer attacks are done to intimidate or coerce a government or people to further a political objective, or to cause grave harm or severe economic damage. The Internet, whether accessed by a desktop computer or the many available handheld devices, is the medium through which a cyberattack would be delivered. However, for a targeted attack to be successful, the attackers usually require that the network itself remain more or less intact, unless the attackers assess that the perceived gains from shutting down the network would offset the accompanying loss of communication. A targeted cyberattack could be effective if directed against a portion of the U.S. critical infrastructure, and if timed to amplify the effects of a simultaneous conventional physical or chemical, biological, nuclear, or radiological (CBRN) terrorist attack. The objectives of a cyberattack include the following four areas: 1. Loss of integrity, such that information could be modified improperly; 2. Loss of availability, where mission critical information systems are rendered unavailable to authorized users; 3. Loss of confidentiality, where critical information is disclosed to unauthorized users; and, 4. Physical destruction, where information systems create actual physical harm through commands that cause deliberate malfunctions. According to Richard Clarke, former Administration Counter Terrorism Advisor and National Security Advisor, if terrorists were to launch a widespread cyberattack against the United States, the economy would be the intended target for disruption, while death and destruction might be considered collateral damage. Many security experts also agree that a cyberattack would be most effective if it were used to amplify a conventional bombing or CBRN attack. Such a scenario might include attempting to disrupt 911 call centers simultaneous with the detonating of an explosives devices. This type of example is usually contrasted to a widespread, coordinated cyberattack, unaccompanied by a physical attack, that would technically be very difficult to orchestrate and unlikely be effective in furthering terrorists' goals. Because such an attack cannot directly cause death and destruction, this may explain why there is no evidence that terrorist groups have undertaken a significant cyber attack. However, other observers say that, because of interdependencies among infrastructure sectors, a large-scale cyberattack that affected one sector could also have disruptive, unpredictable, and perhaps devastating effects on other sectors, and possibly long-lasting effects to the economy. These observers assert Al Qaeda and associated terrorist groups are becoming more technically sophisticated, and years of publicity about computer security weaknesses has made them aware that the U.S. economy could be vulnerable to a coordinated cyberattack. Publicity would be also one of the primary objectives for a terrorist attack. Extensive coverage has been given to the vulnerability of the U.S. information infrastructure and to the potential harm that could be caused by a cyberattack. This might lead terrorists to feel that even a marginally successful cyberattack directed at the United States may garner considerable publicity. Some suggest that were such a cyber attack by a terrorist organization to occur and become known to the general public, regardless of the level of success of the attack, concern by many citizens may lead to widespread withdrawal of funds and selling of equities. At the July 2005 Black Hat computer security conference (a private sector sponsored annual meeting of organizations focused on cyber-security technology and related issues) Las Vegas, a security expert demonstrated an exploit of what many consider to be a significant Internet security flaw, by showing how the most commonly used Internet routers; the computer's device that forwards data to a desired destination, could quickly be hacked. This router vulnerability could allow an attacker to disrupt selected portions of the Internet, or even target specific groups of banks or power stations. Security expert Bruce Schneier, a recent critic of the idea of cyberterrorism, reportedly agreed that the router flaw was a "major" Internet security vulnerability, and could allow criminals to steal identity information, or otherwise attack networks. The company released in April 2005 a software patch to fix the problem, but over the following four months, had apparently not notified its customers and government agencies, including DHS, about the seriousness of the vulnerability. The United States may provide ample economic targets vulnerable to cyberattack, thus tempting terrorist groups to increase their cyber skills. A February 2005 report by the President's Information Technology Committee (PITAC) stated that the information technology infrastructure of the United States, which is vital for communication, commerce, and control of the physical infrastructure, is highly vulnerable to terrorist and criminal attacks. The report also found that the private sector has an important role in protecting national security by deploying sound security products, and by adopting good security practices. However, a recent survey of 136,000 PCs used in 251 commercial businesses in North America found that a major security software patch, known as SP2, was installed on only nine percent of the systems, despite the fact that Microsoft advertized the importance of installing the security patch one year ago. The remaining 91 percent of commercial businesses surveyed will continue to be exposed to major security threats until they deploy the software patch throughout their organizations. This may bring into question the extent to which the private sector will self-protect without greater incentive.