19
at the same time. The target is then unable to function or to receive legitimate messages ("Denial of
Service" 2001).
Such techniques may be used for cyberwarfare or terrorism. Several attacks involving forced
information have occurred, including a 1998 “e-mail bombing” attack against Sri Lankan embassies by
Tamil Guerillas and a 1999 e-mail bombing and denial of service attacks against NATO computers by those
opposed to the real bombing of Kosovo (Denning 2003). The e-mail bombings took the form of multiple e-
mails sent to clog up the mailservers and prevent legitimate e-mail from entering. Elements of the
communications infrastructure are potentially vulnerable not just to physical attack, but also to attack via
forced information. Combined, these two types of attacks would have a worse effect. A report from the
United States National Research Council states:
The committee [formed by the National Research Council to study information technology
(IT) and national security] believes that the most devastating consequences would occur if
an attack on or using IT were part of a multipronged attack with other, more physical
components. In this context compromised IT could expand terrorist opportunities to widen
the damage of the physical attack, diminish timely responses to the attack, and heighten
terror in the population by providing false information about the nature of the threat
(National Research Council 2003).
The National Research Council report further identifies state-sponsored attacks of this nature as likely to be
more damaging because of the resources (financial-backing, intelligence services) that an enemy
government or a state-sponsored group, rather than a less well-organized group, is likely to muster
(National Research Council 2003).
Shutting the sluice. Finally, actions to shut the sluice are designed to enable an Agent to prevent
such incursions of unwanted information. Firewalls, virus checkers, and the use of passwords are typical
examples. Usually such protections are considered legitimate. Indeed, individuals are called upon to
employ these technologies because the state can not effectively police the Internet to prevent cybercrime.
Organizations like the CERT Coordination Center, a unit of Carnegie Mellon University operating primarily
with US government funding, only respond to security breaches (e.g., viruses) on the Internet; they are not
Convention