In some senses the title is misleading – something that F-Secure’s Mikko Hyponnen hints at. Most people associate cyberterrorism with cyberattacks; but that is an area specifically excluded. One reason may be that many members of the UN are already engaged in such activity against other members (such as the US-sponsored Stuxnet attack agaiinst Iran), making it a difficult subject to tackle objectively. “While a considerable amount of attention has focused in recent years on the threat of cyberattacks by terrorists, that topic is beyond the scope of the present publication and, as such, will not be a subject of analysis,” notes the UNODC report. Hyponnen comments, “a little bit disappointingly the document does not go deeper into the potential of actual online attacks launched by such groups.”
The real purpose of the report is to discuss how the internet ‘supports and promotes’ terrorist activities rather than how it is used to deliver terrorist attacks. This is made clear in the foreword by Yury Fedotov, the executive director of the UN office on drugs and crime. The purpose of the report is, “first, to promote a better understanding of the ways in which communications technologies may be misused in furtherance of acts of terrorism and, second, to increase collaboration among Member States, so that effective criminal justice responses to this transnational challenge can be developed.”
It is, effectively, a justification for, followed by a description of, the type of legislation increasingly demanded by national governments. This too is made clear in that part of the foreword provided by Richard Barrett, co-chair of the working group, saying he is confident that the report “will help to identify the legislative areas in which the United Nations can assist... Member States.” The report itself thus neatly falls into two parts: a discussion on how the internet is used by terrorists (excluding cyberattacks), followed by a discussion on legislative (and self-regulatory agreements) that can be used to thwart such activities.
“In addition to using the Internet to plan and finance terrorist acts,” summarizes the report, “terrorists also use it to recruit and train new members; communicate, research or reconnoitre potential targets; disseminate propaganda; and incite others to carry out acts of terrorism.” The proposed response is to ensure the clear illegality of such activity, to give necessary communications interception capabilities a legal basis (while respecting citizens’ privacy and human rights), and to promote active international and intranational co-operation.
International co-operation is required between different nations and their law enforcement agencies. “Timely and effective international cooperation between law enforcement and intelligence agencies [is] an increasingly critical factor in the successful investigation and prosecution of many terrorism cases.”
Intranational co-operation is between law-enforcement and national internet stakeholders, including service providers. For example, “Recommended measures to be taken by law enforcement authorities pursuant to the guidelines” includes the comment that ISPs should provide a list “of which types of data could be made available for each service to law enforcement, upon receipt of a valid disclosure request.”
“We hope,” say the UK’s Simon Shercliff (counter terrorism ops) and Sue Hemming OBE (Crown Prosecution Service), that this report “will rapidly become a useful tool for legislators, law enforcement officials and criminal justice practitioners to develop and implement legal frameworks that will effectively disrupt terrorists’ activities online.”