Invasion of The Internet Snatchers

As the recent incidents involving Iran reminded us, terrorism is never far away. Suppose a terrorist attack caused the Internet to stop working: Businesses would come to a screeching halt, Americans' activities would be disrupted, but to whom could they seek relief ? The Internet service provider? The mayor? The governor? Congress? Right now, no one is entirely responsible.

Last week, a member of the board of the Internet Corporation for the Assignment of Names and Numbers, Susan Crawford, who is also founder of OneWebDay and a professor of law at the Cardozo Law School, analyzed various forms of Internet security failures during a lecture at the Hudson Institute in Washington, D.C.

Ms. Crawford discussed risks that could lead to long-term disruption of the Internet. The Internet is vulnerable to software attacks against which no individual business or governmental entity can defend. Sinister individuals develop "robot networks," or "botnets," that can infect tens of thousands of personal computers around the world. Rather like the zombies in the science fiction classic "Invasion of the Bodysnatchers," computers controlled by a botnet become unwitting agents of a remote cyber-criminal. These botnets are a coordinated army of computers for nefarious purposes such as denying service to an entire network.

Other potential problems, less likely to cause widespread Internet failure, include breaches in the physical security of the communications networks and systematic failure of the systems to record, to store, and to look up Internet addresses. Even in the aftermath of the terror attacks of September 11, 2001, or natural disasters such as hurricanes or earthquakes, physical communications networks are rapidly restored — if interrupted at all — in part because of the redundancy of those networks. AT&T, Verizon, Sprint, Comcast, and similar businesses own most of these communications networks, and they have substantial incentives to protect them and restore service when interrupted.

Similarly, the intelligence of the Internet embodied in files that contain Internet addresses and routing information is redundantly stored around the world. Verisign and other companies under contract to ICANN manage this information and have every incentive to protect them from attacks. Malicious individuals constantly attack the recording and storage of this information, thus far without significant success.

Physical attacks on networks can be defended by physical barriers enforced by national laws. But software attacks on the Internet can be defeated only by more clever software. American businesses spend billions of dollars on software to protect their internal networks and computers from spam, viruses, and other harmful attacks. But large-scale coordinated attacks from botnets are difficult for many businesses to defend against.

To date, most efforts to disrupt or interfere with Internet service appear to have come from hackers or organized criminals, many outside America. It is only a matter of time before the Internet becomes the target of choice for terrorists. As Professor Crawford notes, today no organization is responsible for defending against such attacks, nor does any institution have the wherewithal for such a defense. Our own government has many efforts to enhance cyber-security, but these efforts, even if they ultimately prove technologically effective, will likely have little influence overseas.

Many international institutions, including the United Nations, would like to assume responsibility for defending the Internet from attack. These organizations, and the UN in particular, have little technical or legal capability to defend the Internet but have enormous political ambitions to gain control over it. Ms. Crawford recommends a less formal structure outside of the UN, such as ICANN, to at least begin addressing these issues.

The direct costs of lost business and lost consumer services from an Internet outage of any duration and any geographic scope are enormous; the indirect cost of shaken confidence in the reliability of the Internet would be even greater. Despite an absence of foolproof technology to stop harmful interference with the Internet, of laws to criminalize such efforts, and of meaningful enforcement mechanisms for those laws, the Internet survives and thrives without a history of major outages. But benign outcomes are not always accurate predictors of the future.

A former FCC commissioner, Mr. Furchtgott-Roth is president of Furchtgott-Roth Economic Enterprises. He is organizing the seminar series at the Hudson Institute. He can be reached at hfr@furchtgott-roth.com.