Anticipating the Nature and Likelihood of a Cyberterror Community

Max Kilger, Department of Cyber Security

Social Consequences of Emerging Technologies

• Emerging technologies are changing our social worlds in radically different and innovative ways

• There is a plethora of research and investigative effort being placed towards understanding the social impact in many areas

Social Consequences of Emerging Technologies

• One area where the impact has received somewhat less overall attention is in the study of the social impact of these emerging technologies on those who develop them

• Much of this research focus has been on the hacking community at large

What We Know – What We Don’t Know…

• While the hacking community has been around for at least 50 years social scientists seem to have gotten off to a “not so great start” in theory and analysis here

• More idiosyncratic research than perhaps we’d like…

What We’re Up to Here Today…

• Utilize a variant of New Social Movement Theory (Hara and Huang, 2011) to describe social forces within the technological community

• This paper suggests that there have been two epochs in the technological community as witnessed by the emergence of a dominant social movement for each epoch

The Appearance of Two Epochs

• The first epoch is characterized by the emergence and stabilization of the hacker community social movement

• The second epoch is signaled by the rise of a cybercrime community and social movement

The Potential Dawning of the Third Epoch

• The analysis of the first two epochs have the advantage of having already occurred historically

• We will need Hara and Huang (2011) to extend a “plank” out over the unknown abyss to examine the potential emergence of a third epoch – signaled by a cyberterror movement and communtiy

Tilly’s Classic Definition of a Social Movement

• “It consists of a sustained challenge to power holders in the name of a population living under the jurisdiction of those power holders by means of repeated public displays of that population’s worthiness, unity, numbers, and commitment.” (Tilly, 1999:257)

Does the Emergence of the Hacking Community Qualify as a Social Movement?

• Key Components to Tilly’s definition: Challenge to power holders

• McCarthy (2015) describes the one-sided control of information by corporate and government entities and the efforts of groups like Anonymous and Wikileaks to shake that power loose…

Does the Emergence of the Hacking Community Qualify as a Social Movement?

• Key Components to Tilly’s definition: Displays of numbers

• A number of hacking groups within the community – most notably Anonymous – use the quote “We are legion” to denote their strength in numbers

Does the Emergence of the Hacking Community Qualify as a Social Movement?

• Key Components to Tilly’s definition: Displays of unity and commitment

• Various organizations and hacking conferences serve to demonstrate unity and commitment both to society and themselves

Does the Emergence of the Cybercrime Community Qualify as a Social Movement?

• Key Components to Tilly’s definition: Challenge to power holders

• “Redistribution of wealth by proxy” - based upon theft of financial assets from individuals that are often restored to individuals by the financial institutions who hold power

Does the Emergence of the Cybercrime Community Qualify as a Social Movement?

• Key Components to Tilly’s definition: Displays of numbers

• Numbers not in terms of members but of effect on societal institutions: estimated 2014 loss to cybercrime globally is $400 billion USD (CSIS, 2014)

Does the Emergence of the Cybercrime Community Qualify as a Social Movement?

• Key Components to Tilly’s definition: Displays of unity and commitment

• Organized underground marketplaces, guarantor services, cooperative reputational mechanisms (Holt, 2013)

Core Elements to Hara and Huang (2011)

• Five key functional dimensions of ICT in online social movements:

– ICT as a resource

– ICT as a framing function

– ICT supporting collective identity

– ICT role in mobilization of the movement members

– ICT as a virtual space provider for activities

Epoch 1: The Rise of the Hacking Social Movement

• ICT as a resource

• ICT is in a very unique position here – the members of the social movement control the development and shape of ICT platforms themselves including development of – Communications platforms– Representational platforms– Network platforms– Financial transaction platforms

Epoch 1: The Rise of the Hacking Social Movement

• ICT as frame alignment

• Frame bridging (Snow et al, 1988) link

“unmobilized sentiment pools…who share common grievances and attributional orientations, but who lack the organization base for expressing their discontents and for acting in pursuit of their interests.”

Epoch 1: The Rise of the Hacking Social Movement

• ICT as assisting collective identity

• Collective identity has been an issue for this social movement/community since the beginning…

• Internal versus external identity

Epoch 1: The Rise of the Hacking Social Movement

• ICT role in mobilizing its members

• Lack of propinquity

• Ability to globally coordinate and mobilize quickly

• Ability to globally target

• Ability to engage in normative behaviors – circumvent Internet restrictions in some countries

Epoch 1: The Rise of the Hacking Social Movement

• ICT as virtual space provider for movement activities

• Important to note hacking social movement creates it virtual spaces for activities

• ICT is their true “home”

• Ability to create true virtual worlds to interact in

Whittier (2004) and the Concept of Social Movement Spinoff

• Social movements may spin off from each other. Spinoffs may be similar or dissimilar from the original movement

• The idea here that there are many spinoffs from hacking social movement – many minor ones

• Major spinoff from hacking movement is the cybercrime social movement – dissimilarities may be the cause of the spinoff

Epoch 2: The Rise of the Cybercrime Social Movement

• ICT as a resource

• ICT is a focal point for access to financial and other valuable assets

– Propinquity not required to perform basic function of social movement – theft of assets

– Access to coding resources – people and code

Epoch 2: The Rise of the Cybercrime Social Movement

• ICT as frame alignment

• Primary attractant is prospect of acquiring large sums of money

• Attracting both law-abiding citizens and traditional criminals

Epoch 2: The Rise of the Cybercrime Social Movement

• ICT as assisting collective identity

• Similar issue to hacking movement

• External collective identity – brand image, promotion of products and services

• Obey collective identity norms

Epoch 2: The Rise of the Cybercrime Social Movement

• ICT role in mobilizing its members

• ICT facilitates reputation control for buyers and sellers, allows mobilization for social control of norm violators

• Mobilize against potential threats thru intel gathering and information sharing

Epoch 2: The Rise of the Cybercrime Social Movement

• ICT role as virtual space provider for movement activities

• One of the most important functions – provides a marketplace for members to conduct their business

• Not just any space will do – Dark Web

Epoch 2: The Future of the Cybercrime Social Movement

• Afroz et al (2013) suggest the community is sustainable if:– Easy/cheap community

monitoring– Moderate increases in new

membership– Do not witness reduced

connectivity as network size increases

– Limited privileged access– Enforce bans or fines on

offending members

Epoch 3: The Rise of the Cyberterror Social Movement

• Cyberterrorism

• “is generally understood to mean unlawful attacks and threats of attack against computers, networks, and the information stored therein when done to intimidate or coerce a government or its people in furtherance of political or social objectives. Further, to qualify as cyberterrorism, an attack should result in violence against persons or property, or at least cause enough harm to generate fear. Attacks that lead to death or bodily injury, explosions, plane crashes, water contamination, or severe economic loss would be examples. Serious attacks against critical infrastructures could be acts of cyber terrorism, depending on their impact. Attacks that disrupt nonessential services or that are mainly a costly nuisance would not.” Denning, 2000.

Epoch 3: The Rise of the Cyberterror Social Movement

• ICT as a resource

• Command and communications

• Source of fundraising and transfer – direct and thru cybercrime

• As case for cybercrime social movement, provides key access to targets

Epoch 3: The Rise of the Cyberterror Social Movement• ICT as frame alignment

• Functioned for years as frame alignment in recruitment role (Bowman-Grieve, 2013; Cohen-Almagor, 2013)

• Some researchers say typical text and image communications lowers level of trust (Hegghammer, 2014)

• Individuals with specific technical skills may build trust more easily - meritocracy

Epoch 3: The Rise of the Cyberterror Social Movement• ICT as frame alignment

• Frame alignment accelerant – Civilian Cyber Warrior (Kilger, 2010)

• Internet facilitating first time likely in history an individual can effectively attack a nation state

• Definition of effectively is key here…

Epoch 3: The Rise of the Cyberterror Social Movement• ICT role in collective identity

• Ability to publicize logos and other images of collective identity to encourage solidarity

• Provide membership and identification with the cyberterror group as motivations for enlistment

• Enhance solidarity and motivation via rich media

Epoch 3: The Rise of the Cyberterror Social Movement• ICT role in mobilizing its

members

• Ability to mobilize members quickly in reaction to world events

• Global mobilization against a target anywhere in the world is possible

• Ability to organize large scale, multi-target attacks

Epoch 3: The Rise of the Cyberterror Social Movement• ICT role as virtual space

provider for movement activities

• Again as in cybercrime movement, most all of the activity occurs in cyberspace

• Key targets are reached and attacked online

Assemble the Parts: Conclusions About the Nature and Likelihood of the Emergence of a Cyberterror Community and Social Movement

• Applying the criteria of Hara and Huang suggests that it would qualify as a social movement

• There is more than sufficient “fuel” in terms of targets

• There is likely an accelerant in terms of frame alignment as suggested by the criteria from Kilger (2010)

• Prior social movement spinoffs have endured (cybercrime community)

Conclusions About the Nature and Likelihood of the Emergence of a Cyberterror Community and Social Movement

• Given the evidence we have seen along with the analysis from this paper, conclude that is likely to very likely that a cyberterror community and accompanying social movement will emerge

• This community will retain some of the characteristics of the original hacking community such as meritocracy and exhibit some new characteristics such as the civilian cyber warrior element

If it only were this easy to set a watch for epoch 3…