[jerf]

The physical terrorism threat is negligible. The generalized cheap-attack-with-disproportionate-damage threat I can't in good conscience write off quite so readily. Biological attacks are still scarily possible, and if we start talking computer viruses it becomes scarier again. Recall Stuxnet didn't merely inconvenience people, it destroyed hardware. If someone manages to write a virus that, say, destroys a significant number of power plant turbines, we're talking about a disaster that does in fact start killing people in addition to general inconvenience. Electricity really really is one of the lifebloods of civilization, and while the phrase lifeblood is obvious not literal it's more literal than it may appear on first glance. Cut it off and real people will really be hurt and killed.

Personally I'd rate this class of threat comfortably above asteroid impact or solar flare-type disaster.

[kbolino]

Terrorist victims in 2001: 3,000

Murder victims in 2001: 15,000

Car collision fatalities in 2001: 42,000

Cancer deaths in 2001: 550,000

The only thing that's disproportionate is how we react to terrorism.

(statistics are for United States)

[jerf]

That's a canned knee-jerk response, not one that shows you read my message. That's not relevant data to the question of what future bioattacks or computer attacks are possible... and note my continued avoidance of the term "terrorism". Once an attack is launched the source isn't very relevant. Failing to secure our infrastructure because "terrorism isn't something to be afraid of" is still a stupid move because it leaves you open to not-terrorism just as much.

[kbolino]

My original response was more thoughtful, but I felt that summed up my point better.

The question is not what's possible, but what's likely and how much it will cost. If the likelihood is low and the cost is small, then you cannot justify extravagant preparation.

An attack against civilian infrastructure is terrorism no matter who does it. It may be a singular event, part of a chain of attacks, or a prelude to a full-scale military offensive. It's still terrorism, because it terrorizes the civilian population.

Irrational fear should not dictate our budget priorities. We can certainly take some precautions, and develop contingency plans. But at the end of the day, if someone is capable and determined enough, it's going to happen, regardless of how many much money and how many contractors and consultants we throw at the problem. The best we can do is take it in stride and rebuild.

[jerf]

You continue to not really be thinking about my point, insisting on framing it in a pre-canned terrorism argument. I am explicitly talking about high-cost events, and at best you can call the probability unknown, for things like a biological attack or a computer attack that perhaps even accidentally ends up taking out some very important part of the infrastructure. We already have good reasons to be concerned that a high-cost biological attack could be launched out of someone's literal garage, and it is not an irrational fear; we have plausible plans on how it could be done. Indeed I'd argue that being unconcerned about it is irrational, and being unconcerned about it because so far "terrorists", a small subset of the group of people I'm concerned about, have only managed to "fly planes into a couple of buildings". It's basically a non-sequitur argument, because a great deal of the point I'm making is that is only a small part of the total interesting threat profile.

[kbolino]

What is your point then, exactly?

Are you arguing that there are eventualities which could be disastrous, and they need not be the product of willful malice? Then of course I agree with you.

Is your point that we can and should take all possible precautions against such eventualities, regardless of cost? That's where I take disagreement. We are, after all, arguing in the context of a larger discussion here.

Our efforts at preparedness must be in proportion to the risk, which is derived from both the potential cost and our best estimate of the likelihood. Bad things happen; it's terrible, it sucks, but it's unavoidable. We can and will bankrupt ourselves trying to swat every fly. It doesn't matter that a disaster could be catastrophic if we create a catastrophe by trying to avert every disaster.

[WayneDB]

"We already have good reasons to be concerned that a high-cost biological attack could be launched out of someone's literal garage, and it is not an irrational fear."

It's easy for people to just pick up a knife at a restaurant and stab someone too. People don't spend an inordinate amount of time worrying about this though because it just doesn't happen that often.

[ThomPete]

But the problem is that it ends up being a self-fulfilled prophecy.

People without any part in the original conflict is getting affected by it and then suddenly they are part of it.

That is the root of problems here.

[einhverfr]

While I agree that terrorism is given disproportionate attention (add car-collision fatalities in September 2001 as 3300 and it becomes even more useful comparison-wise), I also think it misses the point.

The sorts of terrorism we are afraid of tends to hype fear over risk. Take anthrax for example. Anthrax has been floated as a biological weapon because it's unlikely to spread back and contaminate one's own area, but experiments with weaponized anthrax shows an abysmally low rate of contracting the disease (between 0.1% and 1%) and so it's nearly exclusively a weapon of fear. The very things that make it attractive as a biological weapon also make it ineffective (no person-person transmission for example).

Similarly when we look at nerve gas attacks and the problems and sole case in history, it's clear these are relatively ineffective terrorism-wise. VX may be more effective than Sarin given high-tech dispersal systems but it's also very sensitive to things like droplet size and it's not volatile. Sarin, OTOH, is volatile meaning you can expect it to dissolve in the air and spread that way. Despite that, Aum Shinrikyo would have been more successful using plain old high explosives than nerve gas, and only one of their two nerve gas attacks (the one under entirely ideal circumstances) resulted in any fatalities whatsoever.

Nuclear terrorism could be significant but I suspect you'd have to blow up a small nuke in a major city every ten years to have an effect similar to car crashes nationally. I am sorry but I just don't see that happening so as long as I don't worry about getting behind the wheel I don't give that a second thought either.

All the above being said, cyberwar by non-state actors is different. Traditional terrorist attacks seek to cripple a society or socially disrupt it by killing people and making them afraid. I don't know that this necessarily has to be the intermediate goal of what people call cyber-terrorism (which is why I don't call it that). Instead it can disrupt society and hold it hostage by, well, disrupting it directly.

Imagine if power blackouts and communications infrastructure was disrupted repeatedly. Imagine if we suddenly the power grid were taken down repeatedly. What would be disrupted? How well could we recover? What if telecomunications infrastructure was attacked as well?

People would die but that's not really the goal. Just as in conventional terrorism deaths are a means to an end, sufficiently successful attackers could hold a society hostage by holding the infrastructure hostage.

[webXL]

Terrorist victims in 2001: 3,000 ... Cancer deaths in 2001: 550,000

I don't think it's fair to the families of the victims, to the people of NYC, or any peaceful, healthy person who has that threat in the back of their mind when minding their own business in public, to equate a cancer death with a death caused by a crumbling skyscraper, a burning skyscraper, or jumping out of a burning, crumbling skyscraper. I know cancer can be just as ruthless and indiscriminate, but it never has struck in such a concentrated, evil manner.

The only thing that's disproportionate is how we react to terrorism.

Are you implying that we shouldn't react disproportionately?

That's not to say I agree with the current level of disproportionateness or that we shouldn't be spending billions of public dollars combatting a disease that's claiming more and more people because they are now living long enough to acquire it.

[kbolino]

Neither is any less dead than the other. The cause matters only to the living. My entire point is that fear of the threat in the back of your mind is entirely irrational. You're much more likely to die of cancer, and even then, you're not very likely to die at all.

The Stalin quote about "a single death is a tragedy, a million is a statistic" comes to mind here. I understand your point that terrorism is the result of direct, willful action by people with malicious intent, whereas cancer is just a force of nature. But you have no real control over either, so why make such a big deal of the former?

[webXL]

But you have no real control over either, so why make such a big deal of the former?

Not true. Even thought they need to be much smarter about it, people with guns, whom our tax dollars fund and who's power and number I fear and would like to limit, can reduce the likelihood of a terrorist ruining my life. Scientists can do the same for cancer, but unfortunately, we have more people who can fight terrorism that who can fight cancer.

We can elect leaders are vote in the marketplace to shift resources one way or the other, or be a better cancer or terrorism fighter if we are in those fields. Our individual control might be negligible, but not society's.

[kbolino]

You cannot effect much control over a signal that you cannot distinguish from random noise. There are so many factors that affect the likelihood of terrorism, and yet even in a bad year that likelihood is insignificant.

Our ridiculously outsized counterterrorism efforts are akin to putting a shroud around the Earth to block out cosmic background radiation. It would cost more money than we can fathom, and in the end we probably couldn't even measure the benefit. Meanwhile, the radiation you absorb from living near a nuclear plant or an old testing site is orders of magnitude greater, and yet you probably won't ever suffer a harmful effect from it.

My argument isn't that terrorism isn't real, or it isn't a threat. My argument is that it's such an insignificant threat that it fails to justify our existing efforts, nonetheless ever-more-expensive new efforts.

[knowaveragejoe]

It's equally hard to measure how much of a threat terrorism actually poses. One could easily make the argument that the reason it's perceived to be so little of a threat today is because we've gotten damn good at stopping terrorist plots. See the recently intercepted ALQ documents which describe how good the West has gotten at tracking their movements and foiling their plans.

[terangdom]

The former has a large political impact.

How many dissidents a year do you think you need to kill to suppress any opposition?

[kbolino]

Targeted acts of terrorism are different than indiscriminate attacks, and a coordinated series of attacks is different than an isolated incident. If the group of potentially affected people is very small, or the number of attacks very large, then the probabilities are drastically increased and a larger response is justified.

[einhverfr]

"Are you implying that we shouldn't react disproportionately?"

I would say that even when you factor in malicious intent we still react disproportionally, and that this is an inherent problem.

Any individual involved in any security-related field will have to work with the concept of acceptable risk at some point. The damage that terrorists can cause us is not that high compared to the way we victimize ourselves to try to prevent very modest harm.

Our reaction has become comparable to a cytokine storm in reaction to a flu virus, really. That can't be good.

Edit: As a side note, our reaction is such that it allows for what I call "grey-terrorism" vulnerabilities. If we define terrorism to only include acts which are violent or directly dangerous to human life, then leaving cardboard boxes marked "do not touch" in airport restrooms around the nation is not "terrorism." The act is not dangerous to human life. The act is not violent. The act however may be very disruptive to our airports, and it may be very good at inspiring terror.

[MartinCron]

Terrorist victims in 2001: 3,000

That's not entirely true. There were ~3000 terrorism-related deaths, but the point of terrorism is that it victimizes an entire society by creating a culture of fear and uncertainty. That's what differentiates terrorism from (conventional) murder.

[kbolino]

To "create a culture of fear and uncertainty" is certainly the aim of terrorism. However, its effectiveness is dictated by the reaction of the affected population, not by the perpetrators or their actions.

[Difwif]

Your fear about computer attacks appears to be a bit sensationalized and a typical knee jerk doomsday reaction. You parrot that "Electricity is the lifeblood of civilization" and that people will die when the power goes off but then seem to forget that blackouts already occur in highly populated areas. Are they a major annoyance? Of course! Do they cause mass death larger then asteroid impacts? Where did you get that idea? Many of our critical facilities have backup generators for a reason. If such an event did occur you'd be damn sure that any damage would be repaired ASAP.

[pyre]

I'm thinking that terrorists would have to do enough damage to warrant full replacement of a number (n = ?) of turbines at a number (m = ?) of plants to do significant, lasting damage in an area (you won't necessarily have a 'back-up turbine' lying around).