Both Schneier and Dick agree that the definition of cyberterrorism includes two clear subcategories of cyberterrorist threats.

• The physical infrastructure threat: compromising critical systems to severely affect critical physical infrastructure, such as power grids, water and sewer systems, dams, hospital equipment, pipelines, communications, global positioning satellites, air traffic systems or any other networked system, which would result in death and/or destruction.

• The critical data threat: compromising critical computer systems to steal or irreversibly damage vital data, such as the Social Security database, a large financial institution’s records or secret military documents, which would result in death, destruction and/or catastrophic economic turmoil.

SEDUCED BY THE WEB

To answer those questions, we have to go back and look at how infrastructure adapted to the introduction of computers. In the 1970s, computers made it possible to network command and control functions of systems like the power grid or dams or communications switches. Remote control was considered a boon to routine maintenance; it created new efficiencies. Ironically, it was also deemed a good defense against terrorism; the government feared onsite attacks. The notion that someone could manipulate a computer to affect infrastructure was considered a bit of science fiction.

In the 1980s and early ’90s, SCADA systems matured and came to dominate critical physical infrastructure. With SCADA, power companies could remotely control functions like load dispatching (balancing transformers so that no one power station gets overloaded). Networked SCADA looked like the future of utility maintenance and control.

The Nuclear Regulatory Commission (NRC) was the exception. After a short evaluation, the NRC decided to forbid remote control at nuclear plants. Then in the late ’90s, critical utilities were, like everyone, barraged by consultants promising unprecedented cost savings through the Internet.

Kempe at the MWRA recalls meetings during the Web’s headiest days, when he and his staff discussed the merits of opening up his systems to the Internet. "It was so tempting," he recalled. "It looked so wonderful?the cost savings, the efficiencies." In the end, the MWRA resisted temptation.

Not everyone did. Many utilities, particularly smaller outfits, and, for arbitrary reasons, power companies, embraced the Web. The ones who dove in either didn’t recognize or didn’t care at the time that they were also embracing the security weaknesses inherent in the public network.