The September 11, 2001, attacks on the World Trade Center and the Pentagon have shown that well-organized global terriorist groups bent on causing mass murder and destruction are no longer hypothetical. There can now be little doubt that if such terrorists could acquire weapons-usable nuclear materials across a city, they would likely attempt that as well. Under these circumstances, measures to further strengthen the protection of nuclear materials and muclear installations are urgently needed.

This report first reviews the need to strengthen protection of nuclear materials and muclear reactors against terrorists and thieves and then examines the need for better trianing of those charged with protection responsibilities to meet this challenge. Our research suggests that security practices vary significantly country to country, giving thieves and terrorists opportunities to steal nuclear material or to sabotage nuclear facilities in some countries that they do not have in others.

For decades the United States has sought international standards to ensure that nuclear facilities and materials are physically protected against theft and sabotage. On September 11, the need for such an initiative became strikingly apparent as analysts pondered the other possible targets of a terrorist attack. What would have been the loss of life if, for example, a hijacker had crashed a fuel-laden jetliner into a nuclear reactor, causing a meltdown and dispersing radioactive material?

Indeed, just days after the attacks, Mohamed ElBaradei, the head of the International Atomic Energy Agency (IAEA), made it clear that the attack had dramatic implications for the nuclear industry and for non-proliferation: “The tragic terrorist attacks on the United States were a wake-up call to us all. We cannot be complacent. We have to and will increase our efforts on all fronts—from combating illicit trafficking to ensuring the protection of nuclear materials—from nuclear installation design to withstand attacks to improving how we respond to nuclear emergencies.”

Spencer Abraham, the U.S. secretary of energy, appeared before the IAEA to urge “maintaining the highest levels of security over nuclear materials.” “We need to strengthen international commitments and cooperation on the physical protection of nuclear materials, particularly those that can readily be converted to weapons use,” he said.

If terrorists were willing to kill thousands of innocent people in suicidal attacks against buildings symbolizing America’s economic and military power, they would probably not hesitate to use truck bombs made of conventional explosives to attack nuclear reactors in order to create clouds of radioactivity like those produced by the 1986 disaster at Chernobyl. They would have little trouble acquiring anti-tank weapons that could blow up the heavy canisters in which radioactive spent fuel from nuclear reactors is transported through populated areas. It is even possible that they could acquire fissile material from one of the poorly guarded nuclear facilities around the world and find scientists willing to make nuclear weapons.

Current international agreements do not require that nuclear material and facilities in domestic use be guarded against thieves or saboteurs, including terrorists. This is a dangerous gap in the global barrier against proliferation. The IAEA has taken the first steps toward requiring measures to physically protect nuclear materials, but it is essential that this effort be pursued expeditiously and that countries take all reasonable steps to ensure that nuclear material is not part of the next terrorist attack.

The horrifying events of 11 September 2001 serve notice that civilization will confront severe challenges in the twenty-first century. As national security budgets expand in response, we should recognize that only a broad conception of security will be adequate to meet some of the threats that we may face. Biological security provides a powerful example. It must address both the challenge of biological weapons and that of infectious disease. The right approach should benefit public health even if major acts of biological terrorism never occur. Our thinking about biological security must transcend old misplaced analogies to nuclear and chemical security.

Nuclear security has been based on nonproliferation, deterrence, and defense, with intelligence woven throughout. Nonproliferation seeks to prevent the diversion of materials from civilian programs to military or terrorist weapons. Should nonproliferation fail, the United States relies on deterrence through the threat of retaliation. Defense, active or civil, has so far been less central.

Effective biological security requires a different mix. For all its challenges, nuclear nonproliferation is comparatively robust, in part because the production of weapons-usable uranium or plutonium provides a conspicuous bottleneck through which any nuclear program must pass, unless those materials are stolen. This is why preventing nuclear theft is such a high priority in the post-Cold War world. Biological agents

are easier to acquire. Most can be found in naturally occurring outbreaks. Weaponizing these agents has proved challenging for terrorist groups, but the Aum Shinrikyo's unsuccessful efforts to spray the anthrax organism throughout Tokyo in 1993 warned that attempted mass urban attacks were no longer in the realm of the fantastic.

The transfer of dangerous biological agents should be controlled where possible, and the spread of the technologies and personnel to weaponize them should be impeded. But any biological nonproliferation regime will necessarily be less robust than its nuclear counterpart, because the relevant materials, technologies, and knowledge are far more widespread.

Biological terrorism also challenges requirements for successful deterrence. Because some diseases incubate for a week or more, identifying the perpetrators of an attack may prove difficult. A terrorist group might even hope that its attack would go unrecognized; when followers of the Bhagwan Shree Rajneesh infected 750 Oregonians with salmonella in 1984, it took over a year before the infection was determined to have been intentional. Finally, as with any form of terrorism, some groups may simply be unconcerned about retaliation.

In the face of these difficulties, good intelligence is all the more important. Warning and prevention are preferable to coping with the consequences of an attack, but we must also be ready should an attack occur. This requires that greater emphasis be placed on improving public health, a kind of homeland defense that is applicable to both unintentional and intentional disease outbreaks.

Because of disease incubation times, the first responders to a biological attack may well be health-care workers at hospitals and clinics rather than specialized units. The speed and effectiveness of a response will depend on disease surveillance: the recognition by health-care workers that certain illnesses appear unusual and the rapid notification of the proper authorities. Because incubation times often exceed international travel times, both domestic and international components are required. But the domestic component of disease surveillance in most nations, including the United States, is too weak, and international networks are inadequate. Donor nations need to increase support for these efforts. And there are many other needs, such as developing and stockpiling sufficient vaccines, antibiotics, or antivirals and otherwise preparing to meet the enormous challenges that would be posed by a major outbreak. It is time to quicken the pace of these efforts, to which departments of health are as central as departments of defense.

Disease surveillance and response are not nonproliferation measures, so cannot substitute for an effective verification regime under the Biological Weapons Convention. But biological security requires the developed world, especially the United States, to see that its ongoing self-interest is closely allied with sustainable public-health improvements in the developing world. And the explosion of biotechnology, with the weapons implications that follow from it, requires the scientific community to discuss its responsibilities in earnest.

STANFORD, Calif.- For the past seven years, the United States has been negotiating a verification protocol to the Biological Weapons Convention of 1972, hoping to put teeth into the convention's ban on biological weapons production. The Bush administration recently rejected the latest draft of the protocol, viewing it as irredeemably flawed. This is a good time to ask what a new American strategy should be for security against biological threats. It is difficult to predict the likelihood or scale of biological attack. The right policy will provide benefits whether or not an attack occurs.

The first step is conceptual: we must stop thinking about biological security in the way we think about nuclear security. Few aspects of the United States strategy for nuclear security carry over cleanly to the biological case. Security against nuclear attack has relied upon nonproliferation and deterrence, with comparatively little role, so far, for defense. Security against biological-weapons threats should lean primarily on defense.

Nonproliferation, for example, is far more difficult in the biological case. Biological agents are microscopic organisms that can be grown with equipment readily available all over the world -- although the resulting weapons have proved difficult for terrorists to master. Many of the organisms can be acquired during naturally occurring outbreaks. Controls remain valuable, but they will never play the central role that they do in nuclear security. And as biotechnology explodes in the coming decades, nonproliferation will face ever greater challenges.

Deterrence may likewise be of limited use in preventing attacks with biological weapons. While the use of battlefield biological weapons may be deterred by threats, biological terrorism could remain largely immune. The incubation times of most diseases -- for example, seven to 17 days for smallpox -- may lead terrorists to hope they can cover their tracks through covert releases of biological agents. Deterrence relies on the threat of punishment. An attacker who cannot be identified cannot be threatened.

When the Aum Shinrikyo cultists sprayed an anthrax organism in Tokyo -- they did so unsuccessfully several times before their deadly 1995 nerve-gas attack -- they made no announcements and the attacks went unnoticed. When followers of the Bhagwan Shree Rajneesh infected 750 Oregonians in 1984 with salmonella, it took over a year for the attack to be distinguished from a natural outbreak.

Rather than nonproliferation and deterrence, biological security must emphasize civil defense. Civil defense in the biological realm means improving the public health system. Most important, it requires improving disease surveillance. Unusual disease outbreaks must be recognized quickly, so that a rapid response is possible. Health care workers in clinics, hospitals and private practice must know how to identify such outbreaks and be ready and able to pass their information rapidly to city, state and national authorities.

This kind of preparedness would also help to prevent unintentional outbreaks of disease. Because infected passengers can travel the world in less time than it takes for a disease to incubate, it is crucial, for the national interest as well as for humanitarian reasons, to improve disease surveillance overseas. The United States welcomes 50 million visitors every year and imports $40 billion worth of food. Disease cannot be stopped at the border. The United States must act internationally as well as nationally.

Because biological security would offer protection against both natural and nefarious transmission of disease, a sound policy would directly benefit society even if no attack ever happened. Effective biological security requires that we fit the cure to the disease.

A biological terrorist attack probably would first be detected by doctors or other health-care workers. The speed of a response would then depend on their rapid recognition and communication that certain illnesses appeared out of the ordinary. For this reason, preparing for biological terrorism has more in common with confronting the threat of emerging infectious diseases than with preparing for chemical or nuclear attacks. Defense against bioterrorism, like protection against emerging diseases, must therefore rely on improved national and international public-health surveillance. Too often, thinking about bioterrorism has mimicked thinking about chemical terrorism, a confusion that leads to an emphasis on the wrong approaches in preparing to meet the threat.

The military campaign unleashed in Chechnya in September 1999 was portrayed by the Russian leadership as a limited and carefully targeted counter-terrorist operation aimed at eliminating the threat to Russia posed by "international terrorism." In a 14 November article in the New York Times, then Prime Minister Putin sought to deflect American criticism of Russian actions and to win acquiescence, if not sympathy, by likening Russias effort in Chechnya to U.S. anti-terrorist actions. The Russian military, he insisted, had chosen "accurately targeted strikes on specifically identified terrorist bases" to avoid direct attacks on Chechen communities.

But the radical discrepancy between the initial rationale and the actual conduct of the campaign makes it clear that what we are seeing is in fact a deliberate resumption of the 1994-96 war by the Russian Government--and a unilateral abrogation of the agreements that terminated it--now pursued with even greater determination and brutality, with even less regard for civilian casualties, and with a more sophisticated military and public relations strategy.

Not only is there a massive chasm between the professed aims of the campaign and its actual conduct; there appears to be a major disconnect between the real problems of the region and the Russian Government's response. Indeed, the attempt at military subjugation and occupation of Chechnya by Russian forces is likely to exacerbate rather than solve the deeper problems of the Northern Caucasus.

This analysis focuses on three broad issues: (a) the challenge facing Moscow in Chechnya more broadly, and in particular why the opportunity for a political solution of the conflict afforded by the Khasaviurt and other peace agreements was squandered; (b) the assumptions that appear to underlie the actions of the Russian Government and why some of these assumptions appear to be questionable; and (c) the prospects for a political resolution of the conflict and for establishing longer-term peace and stability in the region.

Reprinted in Central Asia and the Caucasus, no. 4, August 2000.

Chapter in Chechnya: The International Community and Strategies for Peace and Stability, edited by Lena Jonson and Murad Esenov.

The proliferation of chemical, biological, and nuclear weapons is now the single most serious security concern for governments around the world. Peter R. Lavoy, Scott D. Sagan, and James J. Wirtz compare how military threats, strategic cultures, and organizations shape the way leaders intend to employ these armaments. They reveal the many frightening ways that emerging military powers and terrorist groups are planning the unthinkable by preparing to use chemical, biological, or nuclear weapons in future conflicts.

Distinguished specialists consider several states and organizations that have this weaponry: Iraq, Iran, India, Pakistan, North Korea, and Israel, as well as the Aum Shinrikyo cult. The contributors expose plans for using unconventional weapons, highlighting the revolutionary effects these arsenals might have on international politics and regional disputes.

The Global Diffusion of the Internet Project was initiated in 1997 to study the diffusion and absorption of the Internet to, and within, many diverse countries. This research has resulted in an ongoing series of reports and articles that have developed an analytic framework for evaluating the Internet within countries and applied it to more than 25 countries. (See http://mosaic.unomaha.edu/gdi.html for links to some of these reports and articles.)

The current report applies the analytic framework to compare and contrast the Internet experiences of Turkey and Pakistan, through mid-2000. Although historically these countries have not been closely related, there are significant parallels between the two that make them well suited for a comparative study of the absorption of the Internet. Turkey and Pakistan are among the largest non-Arab Muslim countries in the world. In contrast to most of their Arab counterparts, their governments were founded as secular, parliamentary democracies. Both countries have had stormy political histories, however, with periodic coups and authoritarian governments. Each country has firmly entrenched bureaucracies with closed and, to varying degrees, corrupt processes.

Their economies have been similarly troubled, with periods of relative hopefulness punctuated by stagnation and decline. Both countries have suffered from erratic growth rates, high inflation, and high deficits. For most of their histories, their economies were rather closed and autarkic.

In recent decades, each country has taken substantial steps to move toward a more open, market-oriented economy and made expansion of the telecommunications infrastructure a high priority. Each country has sought, less successfully than had been hoped, to attract foreign investment and integrate itself more fully with the global economy.

Each country has a number of national security concerns. Turkey and Pakistan both have histories of serious domestic terrorism and persistent conflict with a non-Muslim neighbor.

In spite of the macro-similarities, there are numerous differences between the two countries. Pakistan is considerably poorer and less developed than Turkey; it has had more coups and assassinations, deeper economic troughs, greater heterogeneity within its population, and more endemic corruption.

The information infrastructure is increasingly under attack by cyber criminals. The number, cost, and sophistication of attacks are increasing at alarming rates. Worldwide aggregate annual damage from attacks is now measured in billions of U.S. dollars. Attacks threaten the substantial and growing reliance of commerce, governments, and the public upon the information infrastructure to conduct business, carry messages, and process information. Most significant attacks are transnational by design, with victims throughout the world.

Measures thus far adopted by the private and public sectors have not provided an adequate level of security. While new methods of attack have been accurately predicted
by experts and some large attacks have been detected in early stages, efforts to prevent or deter them have been largely unsuccessful, with increasingly damaging consequences. Information necessary to combat attacks has not been timely shared. Investigations have been slow and difficult to coordinate. Some attacks are from States that lack adequate laws governing deliberate destructive conduct. Such international cooperation as occurs is voluntary and inadequate. Some significant enhancement of defensive capabilities seems essential. Cyber crime is quintessentially transnational, and will often involve jurisdictional assertions of multiple States. Agreements on jurisdiction and enforcement must be developed to avoid conflicting claims.

The need and methods for effecting international cooperation in dealing with cyber crime and terrorism were the subject of a conference sponsored by the Hoover Institution, the Consortium for Research on Information Security and Policy (CRISP) and the Center for International Security and Cooperation (CISAC) at Stanford University on December 6-7, 1999 (the "Stanford Conference"). Members of government, industry, NGOs, and academia from many nations met at Stanford to discuss the growing problem. A clear consensus emerged that greater international cooperation is required, and considerable agreement that a multilateral treaty focused on criminal abuse of cyber systems would help build the necessary cooperative framework. (A synthesis of the Stanford Conference papers and discussion will be published by the Hoover Press.) This monograph summarizes and presents the Stanford Draft International Convention to Enhance Security from Cyber Crime and Terrorism (the "Stanford Draft" or the "Draft") and commentary on the Draft. The Draft acknowledges and builds upon the draft Convention on Cyber Crime proposed by the Council of Europe (the "COE Draft").