Following tragic terrorist attacks committed by ISIS agents in Paris last week, the online hacker group Anonymous declared in a video that it would launch a cyber-attack on ISIS.

The masked Anonymous speaker in the video warns ISIS, in French, to be prepared for a massive retaliation.

The "hacktivist" group has been tangling with ISIS since it attacked the Charlie Hebdo magazine's office in Paris last January, taking over email and social media accounts, or crashing public Islamic State websites by overwhelming them with traffic.

Anonymous members are already boasting that they have taken down ISIS-related websites and several thousand messaging or social media accounts.

Herbert Lin, senior research scholar for cyber policy and security at Stanford's Center for International Security and Cooperation and a research fellow at the Hoover Institution, says that Anonymous' activities against ISIS provide a useful nuisance to the terror group, but aren't quite legal under U.S. laws.

What types of attacks will Anonymous likely launch?

They don't have the capability to do the kind of things that a nation-state could do. The NSA, for instance, has the ability to place implants into hardware. Anonymous is more likely to engage in hacking that is less sophisticated. For example, ISIS almost certainly doesn't have a bank account that is coupled to the international banking system; they operate outside that particular channel. But they have lots of money, some of which may be stored in a personal- or business-like bank account. If so, that means that it can be hacked the same way that your bank account can be hacked, by cracking the username and password.

Similarly, Anonymous has been successful in the past at getting into ISIS members' email and messaging accounts, or taking down their Twitter feeds, which can disrupt their ability to coordinate terrorism-related activities; we can expect more in the future.

What kind of damage can Anonymous do to ISIS, and how effective will it be?

This approach clearly isn't the silver bullet that takes down ISIS, but attacking messaging abilities or bank accounts are useful harassing activities. Repairing these systems and accounts wastes ISIS's time and annoys them – the same way it does to you when your personal accounts are hacked. Having to untangle these messes can disrupt their overall operations, which is a perfectly good thing to do.

Do governments frown upon private citizens taking this type of action?

I think that the official line of the U.S. government on this is that it violates U.S. law for Anonymous to take on ISIS. It's vigilante justice in cyberspace, which is illegal under the Computer Fraud and Abuse Act. On the other hand, while the U.S. government might not be favorably disposed to it, I think it is unlikely that any prosecutor would actually indict an American for harassing ISIS in this way. And maybe the Anonymous hacker will uncover some information that is really useful to the U.S. government and be inclined to pass it along.

Former U.S. Secretary of Defense William J. Perry said he was concerned that the Islamic State in Iraq and Syria (ISIS) could buy, steal or build a nuclear weapon capable of killing a hundred thousand or more people in a single strike.

And, he said, stopping the flow of oil money to ISIS should be the main, short-term objective of the United States and its allies in the fight against the terrorist organization.

“They have demonstrated their objective is just killing as many Americans as they can, or Europeans as the case may be…and there is no better way of doing that than with nuclear weapons,” Perry said.

Image

“If they can buy or steal a nuclear bomb, or if they could buy or steal fissile material, they could probably make a bomb – a crude improvised bomb,” he said.

Even a crude nuclear weapon could have an explosive power equivalent to around fifteen thousand tons of TNT – similar to the bomb that destroyed the Japanese city of Hiroshima near the end of World War II.

Perry said there was evidence that Al Qaeda had actively tried to get nuclear weapons, and he said it was likely that ISIS was also pursuing its own nuclear strategy.

“The big difference between ISIS and Al Qaeda in that respect is that ISIS has access to huge amounts of resources through the oil that they now control,” Perry said.

“I believe that our primary objective in dealing with ISIS should be to stop that flow of money, stop the trading they’re doing in oil which is giving them the resources.”

U.S. warplanes reportedly destroyed 116 trucks in Eastern Syria on Monday that American officials said were being used to smuggle crude oil.

U.S. fighter jets dropped leaflets before the attack, warning the drivers to abandon their vehicles, according to a report in The New York Times.

The Russian Air Force also claimed its planes had struck around 500 oil tankers that were carrying oil from Syria to Iraq for processing.

Perry said that combating ISIS over the long run was a “hugely difficult problem” for Western powers.

“To really stop ISIS completely it would be a long and brutal and ugly fighting on the ground, which I don’t believe we’re going to want to do again,” he said.

“What we can do however, a more limited objective is stopping the resources they’re getting, stopping their access to this oil money. And that limits quite a bit what they can do…That can be done I think in more of a targeted and effective way, and without having to put armies on the ground to do it.”

The deadly terrorist attacks in Paris last Friday that killed 129 people and wounded around 350 more signaled a significant change in strategy for the Islamic State in Iraq and Syria (ISIS), the radical jihadist organization that has claimed responsibility.

“It underscores that this threat is real and that ISIS is not going to be content to consolidate its power in Iraq and Syria,” said Joe Felter, a former Colonel in the U.S. Army Special Forces and senior research scholar Stanford’s Center for International Security and Cooperation (CISAC).

“They have demonstrated their ability to project power into foreign countries and conduct what I would call an “asymmetric strategic bombing capacity” in the form of these home-grown Western citizens who are willing to strap on suicide vests and blow up targets in support of ISIS directed objectives.

“They’re able to launch attacks with centralized planning and decentralized execution in a way that makes anticipating and interdicting them very difficult.”

French President François Hollande said that the attacks were “planned in Syria, organized in Belgium, perpetrated on our soil with French complicity.”

CISAC senior fellow Martha Crenshaw said the Paris attacks represented “a shift in strategy” for ISIS with the group “taking a more Al Qaeda-like stance and striking Western countries.”

However, she emphasized that the carefully planned nature of the coordinated strikes, where multiple teams carried out simultaneous attacks in three locations across downtown Paris, indicated that this new strategy had been secretly underway for some time.

“These attacks were planned a long time ago,” said Crenshaw, whose Mapping Militants Project includes more information on groups like ISIS.

“You shouldn’t think they’re reacting to very recent circumstances…It’s not like we bombed them one day and the next day they planned these attacks.”

Apocalyptic visions

ISIS has long advocated a plan of provoking the West into a larger confrontation that would lead to an apocalyptic victory for Islam, according to Abbas Milani, director of Iranian studies at Stanford and an affiliate at the Center for Democracy Development and the Rule of Law.

“There’s a lot of method to this madness,” Milani said.

“If you read their literature, they have always talked about creating this sort of mayhem.”

ISIS’s propaganda magazine Dabiq, which is available online in Arabic and English, is named after a village in Syria with important symbolism for jihadists.

“They claim that the prophet has predicted that if you can get the West to come and fight the Muslims at Dabiq, then Islam will conquer the world,” Milani said.

Unlike France’s earlier battles against extremists in Algeria, it cannot rely on a proxy state to take the fight to the terrorists, according to Crenshaw.

“When terrorism in France has its origins in Algeria, France could rely on the Algerian state to crack down on these groups,” she said.

“Now you’ve got a situation where the planners are in a country where you don’t have a reliable state to go in and get them for you and wrap up their networks.”

With French warplanes already bombing targets in the Syrian city of Raqqa, Felter warned against the limits of air power in the fight against ISIS.

“There’s a risk that as we ramp up the bombing campaign and increase civilian casualties, this does play into the narrative of these extremists,” he said.

“It’s a very difficult targeting process. ISIS has occupied urban areas full of non-combatants and civilians…It’s the ultimate human shield.”

Felter acknowledged that increasing the number of US ground forces sent to interdict ISIS in Iraq and Syria may ultimately be necessary, but also that this increased presence, if not managed carefully, could backfire.

“At some level, they want to bring Western military forces to occupy these lands, because that will help turn popular opinion against the West and aid in their propaganda and recruitment,” he said.

The fight against ISIS is not limited to the territories it claims in the Middle East. It must be a global effort and include increased international cooperation and information sharing across intelligence, law enforcement and other agencies around the world, Felter said.

ISIS wants to drive a wedge between Europeans and the growing Muslim communities in their countries, so recruiting French citizens to participate in the Paris attacks served a dual purpose, Milani said.

“Using French citizens helps them with logistics, but it also helps them in terms of their strategy in that it makes it difficult for Muslims to live in a non-caliphate context,” he said.

Failed states problem

In the wake of the attacks, European nations are working to create legislation that would toughen criminal penalties for citizens who travel abroad to fight with designated terrorist organizations such as ISIS, or strip them of their citizenship, according to CISAC affiliate Anja Dalgaard-Nielsen, a former executive director of the Danish Security and Intelligence Service.

Individuals who are seen as inciting people to travel to Syria and Iraq to join the jihad could also face tougher sanctions, she said.

The emergence of ISIS and its nihilistic theology is a symptom of broader underlying problems in the Middle East, which is grappling with failed and failing states across North Africa and in Syria, Iraq, Afghanistan and Pakistan, according to Milani.

“ISIS is the most militant and brutal manifestation of something deeper that’s going wrong,” he said.

“I honestly have never seen the Middle East as perilously close to complete chaos as it is now… [and] I don’t think we’ve seen the worst of it yet.”

Resources & links

Get more background on the Islamic State and its leaders from Martha Crenshaw’s Mapping Militants Project

Is There a Sunni Solution to ISIS? – The Atlantic | By Lisa Blaydes & Martha Crenshaw

Airstrikes Can Only Do So Much to Combat ISIS – New York Times | By Joe Felter

The Super Smart Way to Dismantle ISIS – The National Interest | By Eli Berman, Joe Felter & Jacob Shapiro

The Rise of ISIS and the Changing Landscape of the Middle East – Commonwealth Club of California | Abbas Milani

U.S. national security faces rising challenges from insider threats and organizational rigidity, a Stanford professor says.

Amy Zegart, co-director of the Center for International Security and Cooperation at Stanford and a senior fellow at the Hoover Institution, wrote in a new study that in the past five years, seemingly trustworthy U.S. military and intelligence insiders have been responsible for a number of national security incidents, including the WikiLeaks publications and the 2009 attack at Fort Hood in Texas that killed 13 and injured more than 30.

She defines "insider threats" as people who use their authorized access to do harm to the security of the United States. They could range from mentally ill people to "coldly calculating officials" who betray critical national security secrets.

In her research, which relies upon declassified investigations by the U.S. military, FBI and Congress, Zegart analyzes the Fort Hood attack and one facet of the insider threat universe – Islamist terrorists.

In this case, a self-radicalized Army psychiatrist named Nidal Hasan walked into a Fort Hood facility in 2009 and fired 200 rounds, killing 13 people and wounding dozens of others. The shooting spree remains the worst terrorist attack on American soil since 9/11 and the worst mass murder at a military site in American history, she added.

Insights and lessons learned

Zegart's study of insider and surprise attacks as well as academic research into the theory of organizations led her to some key insights about why the Army failed to prevent Hasan's attack when clues were clear:

Image

In the Fort Hood case, she said, bureaucratic procedures kept red flags about Hasan in different places, making them harder to detect.

• Career incentives and organizational cultures often backfire. As Zegart wrote, several researchers found that "misaligned incentives and cultures" played major roles in undermining safety before the Challenger space shuttle disaster.

Zegart's earlier research on 9/11 found the same dynamic played a role in the FBI's manhunt for two 9/11 hijackers just 19 days before their attack. Because the FBI's culture prized convicting criminals after the fact rather than preventing disasters beforehand, the search for two would-be terrorists received the lowest priority and was handled by one of the least experienced agents in the New York office.

• Organizations matter more than most people think. Robust structures, processes and cultures that were effective in earlier periods for other tasks proved maladaptive after 9/11.

In the case of the Fort Hood attack, the evidence suggests that government investigations, which focused on individual errors and political correctness (disciplining or investigating a Muslim American in the military) identified only some of the root causes, missing key organizational failures.

Hasan slipped through the cracks not only because people made mistakes or were prone to political correctness, but also because defense organizations "worked in their usual ways," according to Zegart.

Adapting to a new threat

In terms of organizational weaknesses, Hasan's Fort Hood attack signaled a new challenge for the U.S. military: rethinking what "force protection" truly means, Zegart said. Before 9/11, force protection reflected a physical protection or hardening of potential targets from an outside attack. Now, force protection has evolved to mean that the threats could come from within the Defense Department and from Americans, she added.

"For half a century, the department's structure, systems, policies and culture had been oriented to think about protecting forces from the outside, not the inside," Zegart wrote.

In the case of Hasan, the Defense Department failed in three different ways to identify him as a threat: through the disciplinary system, the performance evaluation system and the counter-terrorism investigatory system run jointly with the FBI through Joint Terrorism Task Forces.

"Organizational factors played a significant role in explaining why the Pentagon could not stop Nidal Hasan in time. Despite 9/11 and a rising number of homegrown Jihadi terrorist attacks, the Defense Department struggled to adapt to insider terrorist threats," Zegart wrote.

Difficult to change

Another problem was that the Pentagon faced substantial manpower shortages in the medical corps – especially among psychiatrists. So the Defense Department responded to incentives and promoted Hasan, despite his increasingly poor performance and erratic behavior.

In addition, Zegart found the Defense Department official who investigated Hasan prior to the attack saw nothing amiss because he was the wrong person for the job – he was trained to ferret out waste, fraud and abuse, not counterterrorism, which is why he did not know how to look for signs of radicalization or counterintelligence risk.

"In sum, the Pentagon's force protection, discipline, promotion and counter-terrorism investigatory systems all missed this insider threat because they were designed for other purposes in earlier times, and deep-seated organizational incentives and cultures made it difficult for officials to change what they normally did," she wrote.

Zegart acknowledges the difficulties of learning lessons from tragedies like 9/11, the NASA space shuttle accidents and the 2009 Fort Hood shooting.

"People and organizations often remember what they should forget and forget what they should remember," she said, adding that policymakers tend to attribute failure to people and policies. While seemingly hidden at times, the organizational roots of disaster are much more important than many think, she added.

It’s a technique that’s been used to calculate the odds of everything from the likelihood of a nuclear meltdown to the chances of getting sick from eating bad seafood.

Today, a CISAC scholar told the U.S. Senate Judiciary Committee that he hoped probabilistic risk analysis could help move the ball forward in the debate over encryption that’s pitted law enforcement and national security agencies against some of Silicon Valley’s most influential technology companies.

“Neither side can prove its case, and we see a clash of theological absolutes,” said Herb Lin, senior research scholar for cybersecurity at the Center for International Security and Cooperation and research fellow at the Hoover Institution, in his testimony before a full hearing of the committee.

The contentious debate over encryption has developed in the wake of the National Security Agency spying scandal, with tech titans Apple and Google recently announcing plans to implement stringent new cryptography protocols to protect customer data.

“When the Snowden documents revealed that NSA was hacking [the tech companies], there was a real sense of betrayal,” Lin said.

“You now hear tech companies talking about the U.S. government in the same way they talk about China. They feel like they have to protect themselves against the U.S. government in the same way they have to protect themselves against China. That’s a terrifying thought. In that kind of environment, there’s no trust.”

Law enforcement and national security agencies want tech companies to integrate a mechanism for the government to gain “exceptional access” to encrypted data into their new encryption technology. But, industry and privacy advocates have resisted, arguing that creating a so-called “backdoor” would make their software more vulnerable to attacks from hackers.

FBI director James B. Comey, who also testified before the committee, warned that the latest generation of encryption technology was putting American lives at risk. He said that the Islamic State in Iraq and Syria (ISIS) was actively recruiting homegrown terrorists via Twitter then using end-to-end encrypted mobile messaging apps to secretly send orders for them to carry out attacks within the United States.

FBI Director James B. Comey (right) testifies before the U.S. Senate Judiciary Committee about the national security risks of end-to-end encryption, with Deputy Attorney General Sally Quillian Yates (left) at his side, as CISAC senior research scholar Herb Lin looks on from the gallery.

“Our job is to look in a haystack the size of this country for needles that are increasingly invisible to us because of end-to-end encryption,” Comey said.

Deputy Attorney General Sally Quillian Yates, who testified at Comey’s side, said law enforcement could not get access to that kind of encrypted communications, even with a valid court order.

“Critical information becomes in effect ‘warrant proof’,” she said.

“Because of this, we are creating safe zones where dangerous terrorists and criminals can operate and avoid detection.”

It is a polarizing debate.

Image

“I’d like to find a way to move the ball forward rather than seeing both sides being stuck in the trenches shouting at each other.”

Lin’s proposal, which he presented to the Senate Judiciary Committee on Wednesday, recommended that both sides focus on estimating how long it would take a hacker to break into an encrypted device equipped for “exceptional access.”

“If it takes a thousand years for a bad guy to figure out how to hack…that’s probably secure enough,” Lin testified.

“If it takes him 30 seconds, using that mechanism is a dumb idea. So somewhere between 30 seconds and a thousand years, the mechanism changes from being unworkable to being secure enough.”

Not all computer security experts believe such a calculation would be possible.

“It’s challenging to come up with a defensible methodology for estimating the risk that a backdoor system will be compromised,” said Jonathan Mayer, a Stanford PhD candidate in Computer Science and former CISAC cybersecurity fellow who garnered national headlines for his research demonstrating that the NSA could use phone metadata to reconstruct detailed personal information.

“Not only are the risks of compromise unknown – they’re unknowable.”

However, Lin said the mathematical methodology known as probabilistic risk analysis, which has widely been used to predict the likelihood of catastrophic failure in complex systems from nuclear power plants to the space shuttle, might be able to shed some useful light on the risks.

And, he said, the only way to find out if it could successfully be used to calculate the risks of encryption software getting hacked would be to conduct more research.

Veterans of the so-called “Crypto Wars” of the ‘70s and ‘90s (when the U.S. government tried to limit public access to encryption technology), like Stanford professor emeritus of electrical engineering and CISAC affiliated faculty member Martin Hellman, said proposals like Lin’s could help advance the public debate and bring both sides closer together.

“Getting the two opposing sides to talk — and listen — is really important,” Hellman said.

“That's what happened 20 years ago when Congress asked the National Academies to look at an almost identical problem. It got those different groups talking and working out compromises.”

The International Studies Association is proud to announce that Martha Crenshaw, Senior Fellow at the Center for International Security and Cooperation (CISAC) and the Freeman Spogli Institute for International Studies and Professor of Political Science (by courtesy) at Stanford University has been named the 2016 recipient of the International Security Studies Section (ISSS) Distinguished Scholar Award.

Professor Crenshaw is renowned for her work on political terrorism, as one of the first scholars to have approached terrorism as a serious subject of academic inquiry.  Her steady stream of high quality publications – including two books, five edited volumes, and numerous articles – have garnered global respect and attention.  Her work has been funded by such prestigious organizations as the Ford Foundation, Pew, Guggenheim, the National Science Foundation, and the Minerva Initiative.  Dr. Crenshaw has testified before Congress, weighed in on important national policy debates and served on boards and committees in multiple fields.  She was a member of the Committee on Evaluating the Effectiveness of the Global Nuclear Detection Architecture of the National Academies of Science and serves on the editorial boards of International Security, Political Psychology, Security Studies, Dynamics of Asymmetric Conflict, and Terrorism and Political Violence.  She previously served as the President and Councilor of the International Society of Political Psychology (ISPP) and a member of the executive board of Women in International Security.

Dr. Crenshaw taught for many years at Wesleyan, where she was awarded for her teaching excellence.  Many junior scholars have benefited enormously from her generous mentoring and advice, while her career has served as a model to many more scholars in the field.  Through her research, policy work, service, teaching, and mentoring, Professor Crenshaw has indelibly shaped the International Security field.  We hope that you will join us in celebrating her accomplishments at the ISSS panel and reception that will be held in her honor at the annual meeting of the International Studies Association in March 2016, in Atlanta.

In related news, Crenshaw was also elected on July 16, 2015 to the prestigious British Academy – the U.K.’s national academy for the humanities and Social Sciences – as one of 20 new Corresponding Fellows from overseas universities.

Note: This story is used by permission from the International Studies Association