38. In a letter to Secretary of Homeland Security Tom Ridge dated March 19, 2004, Senator Joseph Lieberman criticized the Bush administration for failing to move beyond the vague generalities outlined in the National Strategy to Secure Cyberspace and implement concrete plans to protect information systems from cyberattacks. Meanwhile, Internet-industry officials believe that the government's neglect of cybersecurity has led to rapid turnover in the position of director of the National Cyber Security Division, part of the Department of Homeland Security. "Top U.S. Cyber-Security Official Resigns," The Washington Post, October 2, 2004.
39. China, Russia, North Korea, Iran, Libya, Syria, India, Cuba, Japan, Germany, France, and the United Kingdom all are reportedly developing their information-warfare capabilities. The Pentagon's 2003 assessment of China's military potential noted "an unusual emphasis on a host of new information warfare forces," including "a corps of 'network warriors.'" "Cyberwarfare," CRS, RL30735, June 19, 2001. Also "Annual Report on the Military Power of the People's Republic of China," Department of Defense, July 28, 2003.
40. Zero Day worms, viruses, and other electronic "exploits" have already attacked military and civilian computer systems in the United States. Vulnerability to such attacks persists. "Blindsided," Government Executive, May 1, 2004. Also "Computer Attack and Cyber Terrorism: Vulnerabilities and Policy Issues for Congress." Also CRS, October 17, 2003.
41. The increased reliance on computers to monitor and control telecommunications, power distribution, water supply, and public-health and emergency services, combined with the adoption of standardized technologies (such as Microsoft's Windows) and the widespread availability of technical information, has put these control systems at greater risk of attack. "Critical Infrastructure Protection: Challenges in Securing Control Systems," GAO-04-140T, October 1, 2003.
42. A recent Justice Department report suggests that there are few safeguards against the propagation of Muslim extremism in federal prisons. Fundamentalist Islamic inmates are converting fellow prisoners to radicalism, and at times urging them to overthrow the U.S. government. "A Review of the Federal Bureau of Prisons' Selection of Muslim Religious Services Providers," Department of Justice, Office of the Inspector General, April 2004.
43. The Maritime Transportation Security Act of 2002 identified vulnerabilities in the nation's ports and waterways, the routes by which an illicit nuclear weapon might arrive. The Coast Guard has worked with facilities and vessels to implement security plans, but the task may be too big to complete in time. "Maritime Security: Substantial Work Remains to Translate New Planning Requirements Into Effective Port Security," GAO-04-838, June 30, 2004. Also Graham Allison, Nuclear Terrorism: The Ultimate Preventable Catastrophe, Times Books, 2004.
44. Today most containers are secured by a passive seal that indicates when there has been tampering but does not prevent access to the contents. Such seals are easily circumvented. Standardizing seals and containers and installing electronic systems to monitor a container's status would greatly increase security throughout the transport chain. Maarten van de Voort et al., "'Seacurity': Improving the Security of the Global Sea-Container Shipping System," RAND, MR-1695-JRC, 2003.
45. Not that our southern border is particularly secure: currently no strategy exists for comprehensively monitoring all 1,933 miles of the U.S.-Mexico border around the clock. Technology is used erratically, and most of the seismic, magnetic, and thermal sensors deployed along the border are more than twenty-five years old and require constant maintenance. Integrated surveillance systems, which use both ground sensors and cameras linked to a central command center, have recently been installed, but they cover only a portion of the border. The Tethered Aerostat Radar System is a set of six high-altitude balloons anchored over the border that identify low-flying aircraft. When TARS is inoperable because of bad weather, P-3 airplanes flown by the Office of Air and Marine Operations provide live radar and video feeds of activity along the border. The Border Patrol has also deployed unmanned aerial vehicles that use night-vision equipment. "Transforming the Southern Border," House Select Committee on Homeland Security, September 2004.
46. A nuclear attack on the United States is, along with the threat of a biological attack, the most frightening possibility to contemplate. Although developing and using even a crude nuclear weapon would be extremely difficult for terrorists, it is far from impossible, and the United States remains poorly prepared to defend against a nuclear attack. Matthew Bunn and Anthony Wier, Securing the Bomb: An Agenda for Action, Nuclear Threat Initiative and the Project on Managing the Atom, Harvard University, May 2004. Also Graham Allison, op. cit.
47. A recent study conducted by the New York Academy of Medicine found that two fifths of Americans would fail to follow civil-defense orders properly in the event of a biological attack. Roz D. Lasker, "Redefining Readiness: Terrorism Planning Through the Eyes of the Public," New York Academy of Medicine, September 14, 2004.
48. The EPA and the DHS have done separate threat analyses showing that between two (the DHS's estimate) and 123 (the EPA's estimate) of the nation's chemical plants pose a risk to the lives of more than a million people. Current federal requirements to reduce risks at chemical facilities are based on the Emergency Planning and Community Right-to-Know Act of 1986 and the Clean Air Act of 1990. But neither law explicitly addresses chemical release due to criminal or terrorist acts. Proposals now pending before Congress would require vulnerability assessments, reduce the amount of information available to the public about security at chemical facilities, and increase funding for security at those facilities. "Chemical Plant Security," CRS, RL31530, January 20, 2004. Also "Chemical Plants Still Have Few Terror Controls," Wall Street Journal, August 20, 2004.
49. Author's note: This scenario is intentionally very bad but not worst-case. (A nuclear or biological attack would be the worst case.) The purpose of this article is to suggest that there are still opportunities to avoid such disasters without sacrificing our liberties, if we act now. Finally, for those who may say that this has given the terrorists recipes and road maps for how to attack us, here's a bit of bad news: the terrorists already know in much greater detail how best to attack us again.