Security Forces

Technology May Help Prevent Another 9/11 -- If We Can Implement It Properly
March 20, 2002 |
The increasing reliance on computer networks has made cyber-security a particular concern for the private and public sectors alike.

The attacks of September 11 were stunning not only for their brutality, but also for their simplicity. It is estimated that the entire operation cost al-Qaeda just $300,000, and the expertise involved -- from piloting skills to document forgery -- was relatively unsophisticated. Yet the terrorists were able to cause an estimated $200 billion worth of damage to the United States economy, in addition to cutting short thousands of innocent lives. Those jaw-dropping figures do not include the additional havoc wreaked by the subsequent anthrax attacks, which relied on little more than paper envelopes and an organism first cultivated in the 1860s.

Preventing a recurrence of those horrific events will not be a similarly low-tech, low-cost affair. One of the developed world's greatest assets in the campaign against terrorism is its technological edge, and security experts are scrambling to mobilize their hardware and know-how. Biometric smart cards, pathogen scanners, Internet packet monitors -- the arsenal of futuristic tools at the developed world's disposal is wondrous.

The post-attack chaos in New York City also highlighted the need to re-evaluate backup systems, which can help minimize the economic fallout from future terrorist incidents. The NYSE was shuttered for four consecutive weekdays -- its longest hiatus ever -- in part because it lacked an adequate computerized alternative for the physical trading floor. According to the research firm Cahners In-Stat/MDR, September 11 was also the "biggest catastrophe" ever to befall the US telecommunications infrastructure, as critical services were inoperative for days. Verizon will need to spend up to $1.9 billion to restore service to pre-attack levels, an investment that may hamper its ability to roll out broadband as quickly as consumers or government may want.

Fortunately, the tragedy has spurred many companies to seek and share "best practices" regarding emergency strategies. Morgan Stanley, for example, reviewed the blueprint of its New York building and found that the front and back offices shared the same communications grid, a dangerous design that could paralyze the investment bank should another calamity occur. Several other companies have begun issuing two-way radios to senior executives, to act as backups in case a mobile-phone network is destroyed. Ken Alibek, president of Hadron Advanced Biosystems, an anti-bioterrorism consultancy, has been advising clients to stock their corporate headquarters with the medicines necessary to combat weapons such as anthrax and botulism.

The increasing reliance on computer networks has made cyber-security a particular concern for the private and public sectors alike. Even before September 11, breaches of electronic security were a growing problem; in 2001, the CERT Coordination Center at Carnegie Mellon University recorded over 52,000 "cyber incidents", more than double the previous year's total. And it has been nearly two years since researchers at the University of Notre Dame in Indiana warned that the Internet relied on too few key "nodes", making it especially susceptible to organized attacks.

"When we talk about weapons of mass destruction, we have to understand that attacks on our cyber-systems could have a tremendous impact on government," says Tom Ridge, director of the United States' newly created Office of Homeland Security. He notes that vulnerable computer networks control vital infrastructure components such as energy plants, airport towers and financial markets. Indeed, in late January the Federal Bureau of Investigation (FBI) warned that al-Qaeda members had used the Web to gather intelligence on Supervisory Control and Data Acquisition (SCADA) systems, which are used to manage water supplies remotely.

Protecting those electronic systems has thus become a top priority for governments. In February, the US House of Representatives overwhelmingly approved a bill that allocates $880 million over five years to cyber-security research. And last year, the EU ratified a draft treaty that mandates international cooperation in the pursuit of computer criminals across borders; jurisdictional issues had previously complicated investigations, as malicious hackers could hide in nations less likely to extradite or cooperate.

It would be an egregious error to consider technology solely a defensive liability, of course. There have been suggestions that the more aggressive use of digital databases by immigration officials could have prevented the September 11 hijackings; Mohammed Atta, the suspected ringleader, was able to enter the US despite being on a terrorist watch list. Had Mr Atta been compelled to carry a "smart" visa, containing a thumbprint scan or iris pattern, law-enforcement officials would likely have been alerted to his arrival. After the attacks, Oakland International Airport in California became the first American airport to announce the use of facial-recognition cameras, which compare travelers' visages to a database of terrorist photos.

Advanced sensors also hold the promise of providing early warnings in the event of bioterrorism. "The best way to defend is to detect," says Arthur Caplan, director of the Center for Bioethics at the University of Pennsylvania. "There has to be an ability to screen for [toxins] that have been released into the open air." Though pathogen sensors are a relatively untested technology, they are already being deployed in locations thought to be prime terrorist targets. At this year's Super Bowl in New Orleans, the air around the stadium was constantly monitored for signs of chemical agents such as sarin, a lethal and easily concocted nerve gas.

If these monitors are to develop quickly enough, however, governments will need to prove themselves more willing to tap private-sector expertise. Mr Ridge, for one, has been frustrated with the array of airport screening devices, most of which have been developed under the creaky aegis of federal agencies. "Congress is pushing us to adopt one specific [screening] technology, not because it's leading edge, but because it's the only edge," he says. "The private sector hasn't had a chance because there hasn't been a market for technological solutions for security... We need to give the private sector an opportunity to develop the technologies that will help us." Already, aviation officials are joining with data-mining companies to test predictive software that analyzes whether passengers have used their credit cards in a suspicious manner prior to boarding -- say, by purchasing flight lessons or buying tickets for non-family members seated in other parts of the plane.

The trick to implementing such systems is to do so unobtrusively. Overbearing security will adversely affect trade and travel, and thus hand the terrorists another victory. Scanning every letter for traces of anthrax would slow postal delivery to a snail’s pace. Even a facial-recognition camera with 99.99% accuracy -- a technological impossibility -- would cause an avalanche of false alarms. "The population of non-terrorists is so much larger than the number of terrorists. The test is useless," says Bruce Schneier, chief technology officer for Counterpane Internet Security, who notes that the scanner would still generate nearly 10,000 false alarms for every miscreant it ensnared. "It’s a system that has enormous costs -- money to install, manpower to run, inconvenience to the millions of people incorrectly identified [and] successful lawsuits by some of those people."

Supporters of the technologies insist that there are ways to mitigate these effects, such as adopting Israel’s successful trusted-traveler program, in which frequent, law-abiding flyers are issued smart cards that allow them to bypass rigorous security checks. (Virgin Atlantic and British Airways are testing trusted-traveler programs at London’s Heathrow Airport, which use iris scans to verify identities.) But there are fewer stock answers when it comes to addressing the concerns of civil libertarians. They fear that technological gadgets will erode privacy, which the United Nations defines as a fundamental human right. Activists are particularly galled by some of the provisions of the PATRIOT Act, a US bill that has broadened the government’s powers to monitor Internet communications and tap mobile phones. The vogue for surveillance cameras has also caused a stir; George Radwanski, privacy commissioner of Canada, issued a report in October 2001 concluding that "the level and quality of privacy in our country risks being struck a crippling, irreparable blow if we allow ourselves to become subjected to constant, unrelenting surveillance."

Some government officials dismiss such concerns as inappropriate for these troubled times. "The most important principle in law enforcement is to treat everyone with dignity, everyone with respect," says James Kallstrom, ex-head of the FBI’s New York bureau. "But I don’t think that our constitution should be a death sentence, either." Kumi Naidoo, secretary-general of Civicus, an NGO dedicated to improving civil society, counters that abuses are possible even during crises. He suggests that NGOs be mindful of an ancient Latin admonition, Quis custodiet ipsos custodes? (Who watches the watchmen?), and actively monitor the privacy implications of anti-terrorist technologies.

Tempering the privacy-eroding effects of technology may be an imperative, but there is little doubt that such electronic safeguards are essential. "There are no more innocent bystanders in the world of the asymmetric threat," cautions Ralph Shrader, chairman and chief executive officer of Booz Allen Hamilton. "None of us can opt-out -- not as individuals, not as organizations, not as nations. In the old days, you could hide under a rock. Today, there is no place to hide." Given the ubiquity of terror, and the threat it poses to political and economic liberty, no one can afford to ignore the protective powers of bits and bytes.

Join the Conversation

Please log in below through Disqus, Twitter or Facebook to participate in the conversation. Your email address, which is required for a Disqus account, will not be publicly displayed. If you sign in with Twitter or Facebook, you have the option of publishing your comments in those streams as well.

Related Programs