Could Isis’s ‘cyber caliphate’ unleash a deadly attack on key targets?

Britain’s new spy chief has warned that we are in a ‘technology arms race’ with terrorists recruiting an army of hackers to their cause
Illustration: Pete Gamlen
Illustration: Pete Gamlen

When a chubby Birmingham teenager went on trial in 2012 for hacking Tony Blair’s personal address book, and taking down an anti-terror hotline, defence lawyers described him as “shy and unassuming” and dismissed the online exploits as a childish prank.

“They weren’t terrorists in any way, shape or form,” his barrister argued in court. Less than two years later, Junaid Hussain was in Syria, apparently on his way to join Isis, one of its most dangerous new recruits.

The group transfixed the world with its ultraviolent ideology, as it swept through Syria and Iraq in a frenzy of bloodshed and destruction. But its leaders’ enthusiasm for medieval barbarity is matched by an equally fervent embrace of modern technology. They know that a hacker like Hussain, behind his laptop, is as intimidating to some of their distant enemies as the gunmen terrorising people on the ground.

“Isis has been recruiting hackers for some time now. Some are virtual collaborators from a distance, but others have been recruited to emigrate to Syria,” said JM Berger, co-author of Isis: The State of Terror. “Activity targeting the west is just part of their portfolio. They’re also responsible for maintaining internet access in Isis territories, for instance, and for instructing members on security.”

The group’s skill at manipulating social media, for recruitment and projection of power, has been acknowledged even by enemies and rivals, who have poured resources into trying to dismantle, defuse – or in the case of other jihadi groups, emulate – its online success.

Perhaps its most dramatic publicity coup came in January, when the Twitter and YouTube accounts of the US Central Military Command (Centcom) were hacked by a group calling itself the “CyberCaliphate”. Intelligence experts suspect Hussain was the mastermind.

An attack on the Twitter and YouTube accounts of Centcom was embarrassing for the Pentagon.
Pinterest
An attack on the Twitter and YouTube accounts of Centcom was embarrassing for the Pentagon. Photograph: Jason Reed/Reuters

The hackers scrawled “I love you Isis” across the page and sent out tweets including pictures showing US personnel in a command outpost and military documents, suggesting Isis sympathisers had somehow infiltrated military servers and installations.

In fact, although the attack was deeply embarrassing, it was more like the digital equivalent of graffiti in an entrance hall than a theft of sensitive files from the Pentagon. The information shared was widely available and non-official, and Central Command said that no classified information was divulged or operational networks affected, and it viewed the hack as “purely an act of vandalism”.

That reflects a wider online strategy apparently focused more on publicity than damage so far, but internet security experts and analysts who have studied the rise of Isis warn that its enemies should not be complacent about its capacities or intent.

“They have not yet been extremely visible carrying out more sophisticated activities such as high-level cybercrime or more destructive attacks, but I suspect this is just a matter of time,” Berger said. “This is a very low-cost way to publicise their cause and harass their enemies.”

None of the risks posed by Isis is unique to the group. They are part of a fast-growing vulnerability as we rush headlong to put our lives and our businesses online, and our security and justice systems struggle to keep up. There have always been connections between criminal and terrorist networks and the online world is no different.

But the dangers posed by Isis may be more acute because of its embrace of modern technology, mastery of the difficult art of online propaganda and its appeal to young, computer-literate foreigners, including known hackers.

What rival organisations can only dream of attempting in a distant future, Raqqa’s rulers may be able to pursue now. Skilled recruits like Hussain can reach into our increasingly interconnected western cities and potentially bring them to a standstill, just as effectively as sympathisers armed with knives and guns have done over the last year.

“We have seen many politically motivated hackings in recent years, emanating from terrorist and militant groups, or on their behalf … and, so far, the damage they have done has mainly caused inconveniences rather than serious damage,” said Professor Gabriella Blum, author of The Future of Violence: Robots and Germs, Hackers and Drones. “Why haven’t we seen more or worse? Is it a matter of lack of capability, a lack of motivation, or just constricted imagination? Probably a combination of the three. But at least the first factor – capability and access to materials and knowhow – is growing rapidly. This is bound to affect the incidence and magnitude of attacks that will utilise new technologies.”

Hacking attacks on our basic infrastructure may seem the stuff of sci-fi nightmare, interconnected cities held hostage to a malign genius. But it is already reality, security expert Marc Goodman argues in his book Future Crimes, where he details a string of such attacks. A Brazilian power station shuttered by mafia hackers after their demands for protection money were not met, a Polish tram derailed by a bored teenager, and in Australia the sluice gates of a sewage station opened to pour waste over fields and parks – all masterminded by people behind screens.

Attackers often share their success or what they have learned from failure, raising future vulnerability to other hackers, regardless of their affiliation. “One well-known hacker database, Shodan, provides tips on how to exploit everything from power plants to wind turbines,” Goodman writes. “It is searchable by country, company or device, providing detailed how-tos and greatly lowering the technical bar and knowledge for any rogue individual to hack our critical infrastructures.”

Vulnerability only gets worse as the world goes further online, with an “internet of things” designed for convenience that could also be used for intelligence gathering and attacks. Smartphones and TVs can already be turned into microphones that listen in on their owners. Facebook even promotes digital eavesdropping as a useful feature, for subscribers who want friends to automatically know what music they are listening to, or what programmes they are watching.

Illustration: Pete Gamlen
Pinterest
Illustration: Pete Gamlen

More dangerous everyday items have become hackable too, including cars. “Security researchers have proven it is entirely possible for criminals 1,500 miles away to seize control of your car when you are driving 65mph down the highway,” Goodman writes. “What they do with your hacked vehicle is limited only by their imaginations.”

Britain’s new spy chief warned last month that the country was now in a “technology arms race” with enemies “often unconstrained by consideration of ethics and law … terrorists, malicious actors in cyberspace and criminals”. “[The technology] allows them to see what we are doing and to put our people and agents at risk,” Alex Younger told an audience in London, adding that traditional human espionage was becoming increasingly intertwined with “technical operations”.

For now, a key deterrent to planning a spectacular hacking attack coordinated out of Raqqa may be a simple question of resources, as Isis deals with heavy military pressure on the ground, according to Hassan Hassan, analyst and author of Isis: Inside the Army of Terror. His book details the group’s technical agility at exploiting everything from the Zello app, which turns phones into walkie-talkies, to drones, to the hackers they tempted to Syria.

“Isis targets this kind of people [hackers], tries to recruit them … but maybe it is not their priority at the moment,” he said. “They did the attack on Centcom, and when they were in full control of their territory in Iraq and Syria, they were using drones and other things, but now they are focused on military operations.”

Isis is now battling to hold territory under assault from a motley coalition including the US, Iran and conventional Iraqi forces.

An online offensive may also be distracting members of the “cyber caliphate”. Western governments, the companies whose social media platforms they use and even some fellow hackers, from the Anonymous collective, have declared war on their internet presence. After months of rampaging through cyberspace as they swept through Iraq and Syria, the members are now lamenting the “devastating” impact of these efforts to shut down their propaganda machine, Berger says.

Even without the distractions of a game of online cat and mouse, Isis hackers would likely find attacking a specific physical target more challenging than the propaganda hits that have been their focus so far, security experts say, because they require more time and skills.

Perhaps the most famous and dramatic cyber-attack the world has seen so far was the stuxnet worm, a virus that went unnoticed for years, and baffled experts even after it was found. Eventually it became clear that it was a meticulously designed program with just one aim, knocking out the centrifuges at Iran’s nuclear enrichment plant.

It took a large team months, perhaps years, of work to develop both the sophisticated coding and the social engineering needed to get the virus into a system not connected to the internet. Once in place, it took years to have full effect.

Stuxnet is an extreme example, because it targeted what was probably one of the most heavily guarded systems in the world. But almost all institutions now have some form of digital security, and its creation underlines the patience usually needed to go after a physical target.

In 2010 the Stuxnet computer virus was discovered to have knocked out centrifuges at Iran’s Bushehr nuclear enrichment plant.
Pinterest
In 2010 the Stuxnet computer virus was discovered to have knocked out centrifuges at Iran’s Bushehr nuclear enrichment plant. Photograph: ATTA KENARE/Getty

“If you are talking about defacing a website probably one person could do that,” said David Emm, principal security researcher at the Kaspersky lab. “If you want to get more serious and talk about infiltrating an organisation you probably need some more people to do the research – who works there, what are their email addresses, what are their interests. It’s typically going to mean exploiting a human weakness, framing an email to them that is going to make them click [on something containing malware], so there is more legwork, if only because of the intelligence.”

Once inside any system, the hacking itself would also be much more challenging. Most commercial attacks involve effectively sneaking into a system to gather sensitive information unnoticed, while an attempt to sabotage infrastructure would be far more likely to set off digital alarms.

“If on the other hand you don’t just want to blend in and gather information, you want to subvert a physical process, you have much more work to do to mask your presence,” Emm said.

The relative ease of hacking for cash rather than for sabotage might tempt Isis hackers to focus on that instead, especially as the group is reportedly struggling with the expensive business of trying to run a state.

Last year its coffers were flush with cash from oil wells, looting and hostage ransoms, but the oil price has crashed, the rapid expansion that made looting so profitable has slowed, and the captives are mostly dead or gone now.

There is a template for using online robbery to fund real-world attacks. Mobile phone fraud helped pay for the 2004 Madrid train bombings, Goodman says, and the terrorist group that attacked Mumbai in 2008 got $2m from a hacking gang in the Philippines, routed through intermediaries in the Gulf. The money can be extremely hard to trace, once it has been skimmed from bank accounts, phones or other online transactions. Even for supporters based outside Isis territory, the risks are fairly low; the chance of ending up in court is only around 0.01%, Goodman says.

The 2008 terror attack on the Taj Mahal hotel in Mumbai was in part funded by a hacking gang in the Philippines.
Pinterest
The 2008 terror attack on the Taj Mahal hotel in Mumbai was in part funded by a hacking gang in the Philippines. Photograph: INDRANIL MUKHERJEE/Getty

Still, Isis has drawn in elite hackers, a group that often thrives on a challenge. The risk they might venture beyond propaganda or cyber-theft to substantive attacks on cities and infrastructure may be small, but it is certainly real. Far too little is being done to analyse and prepare for the threat, by governments or the companies that run our power and our water, our transport, our banks.

“The quality of protection is always measured in outcomes: the fact that so far, we haven’t suffered major harms is reassuring,” Blum said. “If, however, you believe that the frequency and ease with which these attacks are conducted is a trend that is likely to grow worse in the future … there isn’t enough protection.”