The Real Online Terrorist Threat

THE UNITED STATES is gradually losing the online war against terrorists. Rather than aggressively pursuing its enemies, the U.S. government has adopted a largely defensive strategy, the centerpiece of which is an electronic Maginot Line that supposedly protects critical infrastructure (for example, the computer systems run by agencies such as the Department of Defense and the Federal Aviation Administration) against online attacks. In the meantime, terrorists and their sympathizers, unhindered by bureaucratic inertia and unchallenged by Western governments, have reorganized their operations to take advantage of the Internet's more prosaic properties. The U.S. government is mishandling the growing threat because it misunderstands terrorists. For more than a decade, a host of pundits and supposed experts have traded in doom-and-gloom predictions that cyberterrorists would wreak havoc on the Internet-or, worse, use computer networks to do damage in the offline world (for instance, by hijacking systems that control the water and power utilities of major met ropolitan areas). Such warnings were bolstered by the occasional acts of terrorist groups such as the Pakistani-based Lashkar-e-Taiba, which has staged dramatic but ineffectual cyberattacks, such as its hacking into the Indian army's Web site in 2000. Although such incidents had only