«Workshop held 9-10 January 2008 in Arlington, VA Prepared for US Strategic Command Global Innovation and Strategy Center (USSTRATCOM/GISC) Prepared ...»
Orson Scott Card may have been prophetic in his vision of a synthetic world that was so close to the real world that the boundaries could be crossed unwittingly; however, games of various sorts are catching up with that vision. In 2003 a US-based hate group called “National Alliance” released a video game, Ethnic Cleansing, in which “Kikes and Niggers” (sic) await their deaths at the hands of the Klansman. National Alliance did not have the capability to build this game from the ground up, but used the growing market in which sellers of game engines and opensource 3D software packages make it possible for novice groups to create engaging games with minimal investment. Terrorists have used the same capability to great effect. Counter-Strike, one of the earlier popular games, permits play of terrorists against counter-terrorists using weapons that behave remarkably like their real counterparts. On the other hand, with the same technology, it would be easy to build and rehearse in a target of choice – an Airbus, perhaps.
Hizbollah’s Special Forces pits the Israelis against Palestinians – the resistance always wins.
Films of Palestinian children, boys and girls, playing Jihadist games and discussing how they aspire to die for Islam are testimony to the effectiveness of gaming as a medium for inculcating ideas. Playing games is fun, it’s engaging and inspires the quest for actual jihad in the hearts of the children.
The games cited above are all fps or first person shooter games. Another class of games is the role playing game and in some of these games, the boundary between the physical and the synthetic is porous. In such games, the user is able to build his own territory, buildings and services and sell them to other players, but in real world currency. Such games are now making news as environments where terrorists can lurk.16 Nascent economies have sprung to life in these 3-D worlds, complete with currency, banks, and shopping malls. Intelligence officials who have examined these systems say they are convinced that the qualities that many computer users find so attractive about virtual worlds – including anonymity, global access, and the expanded ability to make financial transfers outside normal channels – have turned them into seedbeds for transnational threats….Because of the nature of the systems, the companies also have almost no way of monitoring the creation and use of virtual buildings and training centers, some of them protected by nearly unbreakable passwords.
The threat of financial markets within the games is mitigated by the fact that they are only a problem when they touch real world finances which we understand how to track. Crime in “Virtual personalities called a threat to U.S.”, Washington Post, February 8, 2008, http://www.detnews.com/apps/pbcs.dll/article?AID=/20080208/BIZ04/802080311/1013 Deterring VNSA in Cyberspace cyberspace may best be pursued and defeated in the geophysical domain in which the criminals live. However, the use of cyber media as a strategic communication tool is far more problematic. Synthetic worlds are engaging and in that they are persistent, physical (apparently) and interactive, they mimic the real world. Gamers, typically young adults in their twenties, spend upwards of 20 hours a week living in an alternate universe and absorbing its culture and messages. We talk of memes that transfer ideas within cultures. Role playing games may be the viral form of transferring memes.
Are There Winning Strategies?
The sense of open communication in which the Internet was developed is probably the most critical element of cyber media to preserve. The spread of interactive communication among people via blogs, websites and games is natural, human, social and creative. For the terrorist, cyber media is a two edged sword, an enabler that also erodes his hierarchical authority and dilutes his view of the world.
As cyber media expands into the Middle East, the adopters will likely resemble the inventors – individuals who value human communication and who put a premium on intellectual achievement. Their discourse is more apt to be in harmony with the core values of the US than with the radical terrorist organizations. We may find natural allies among these individuals if we hold to our core values.
The anonymity of cyber media makes it difficult to retaliate or pose an immediate threat to the terrorist; however, since the terrorist organizations retain a hybrid system in which cyber media is coupled with human social networks, it may be best to consider countering terrorists in the physical world rather than in the cyber world.
Finally, encouraging moderate voices of the Islamic community to be a welcoming presence on the Internet as an antidote to the current jihadist websites would provide the diaspora with a creative alternative as they seek to explore their cultural identities.
Deterring VNSA in Cyberspace 5 Models of Emergent Behavior of Violent Non-State Actors in Cyberspace by Robert Popp, National Security Innovations; Laura Mariano, University of Connecticut;
Krishna Pattipati, University of Connecticut; Victor Asal, State University of NY at Albany; and Katya Drozdova, National Security Innovations.
Executive Summary – Chapter 5
For violent non-state actors (VNSAs) on a mission to spread their message, or cyberterrorists who just want to create mischief, cyberspace offers limitless resources and opportunities for achieving these goals. The Internet is unparalleled in its ability to grant individuals access to a mass audience in an environment that has almost no enforceable personal conduct regulations or monitoring capabilities. According to a report compiled by Dr. Gabriel Weimann of the United States Institute of Peace, as of 2004, all active terrorist groups had established a Web presence of some kind, with the intention of exposing current and potential supporters, as well as enemies, to their ideologies (Weimann, 2004). The behavior of such groups in cyberspace has been studied extensively and can be broadly classified by the impact it has on the cyber and corporeal realms.
Figure 1 below depicts this interaction and categorizes the behavior according to its origin and impact. Cyber-psychological activities include dissemination of propaganda and disinformation, intimidation, and indoctrination via cyber-based communication channels. Cyber-cyber interactions describe efforts to negatively impact the cyber infrastructure, while attacks planned via cyber means that target the corporeal realm are illustrative of the cyber-corporeal connection.
A final category of interaction that is germane to this discussion is the corporeal-cyber connection, which represents actions originating in the corporeal realm that affect the cyber infrastructure. Table 1 below provides examples of recent actions from each of these categories.
This chapter focuses on the cyber-psychological and cyber-corporeal connections, with further discussion of the use of cyberspace by VNSAs to disseminate propaganda, recruit members, create publicity, collect and share data, network, plan, coordinate, raise funds, and wage psychological warfare (Weimann, 2004).
The wide-ranging and covert nature of VNSA activity in cyberspace makes modeling their emergent behavior a difficult task that requires a large-scale, multidisciplinary effort. The current paradigm combines technology and perspectives from the sub-disciplines of data collection, data mining and analysis, and predictive modeling; each of these contributes a piece to the puzzle. Automated data collection techniques address the issue of extracting “clean,” meaningful, and relevant information from the seemingly limitless datasets that constitute the cyberspace. The methodology must be able to locate a “needle-in-a-haystack”, since the activity is often intentionally hidden, scattered across many sites, and frequently moved or removed.
However, without the kind of content-rich datasets that data collection techniques can provide, modeling is cumbersome and time consuming, if not infeasible. An example of such a dataset is the so-called ‘Dark Web’ collection, which contains about two terabytes (2 TB) of extremist/ terrorist related content collected using a semi-automated Web-crawling approach developed by researchers at the University of Arizona’s Artificial Intelligence Lab (Univ. of Arizona, 2008).
Once a raw dataset is available, data mining and analysis techniques can be applied with the goal of extracting usable knowledge from the information. The results of these analyses often generate the datasets that inform predictive models. The field has been heavily researched, and Deterring VNSA in Cyberspace consequently there are many types of data mining and analysis techniques that are well-suited to counter-terrorism applications; indeed, numerous studies have been conducted to evaluate their effectiveness. Some of the techniques discussed in this chapter include link and social network analysis, automated classification of Web content by machine learning techniques, and a qualitative assessment of the technical sophistication, Web interactivity, and content-richness of terrorist/extremist sites on the Internet. Predictive modeling techniques identify discernible patterns of behavior that have the potential to assist analysts with situational assessment, forecasting, and deterrence strategies (Asal et al, 2008). In addition, modeling can be used to simulate the impact of counter-terrorism strategies on the performance and strength of covert VNSA networks. The modeling techniques discussed in this article include the use of hidden Markov models and dynamic Bayesian networks to detect, track, and counteract terrorist networks, and agent-based techniques for assessing terrorist network destabilization strategies.
The terrorist attacks on September 11, 2001, “spurred extraordinary efforts intended to protect America from the newly highlighted scourge of international terrorism” (Jonas and Harper, 2006). These efforts included a significant interest in the potential use of predictive modeling techniques as a means of uncovering covert terrorist networks and plots, and since then, the implementation of such techniques has been surrounded by controversy. According to the National Commission on Terrorist Attacks upon the United States, if the government had pursued leads available at the time, the attacks could have been prevented (Jonas and Harper, 2006). This raises the question: Could data mining and predictive modeling techniques have played a role in averting the tragedy? Experts agree that these techniques have their place in the counter-terrorism domain, as long as they are employed with a clear understanding of their limitations. The consensus is that meaningful results should only be expected if the models are well-informed, particularly by seed information from authoritative outside sources (Last, 2005).
Predictive modeling should be used as a “power tool for analysts and investigators - a way to conduct low-level tasks that will provide clues to assist analysts and investigators” (DeRosa, 2004).
Research on the application of modeling techniques to the study of emergent behavior of VNSAs in cyberspace is ongoing. The continued growth of clean, content-rich raw datasets like the Dark Web collection is critical for the further development of modeling techniques, as is the development of information portals that provide efficient access to the data (Univ. of Arizona, 2008). Multilingual techniques for the classification of Web content are another critical area of research, particularly for Arabic Web content. The ontology of the Arabic language poses significant challenges for classification techniques that are based on English phenomenology.
Consequently, continued development of language specific techniques are needed (Abbasi and Chen, 2005). However, it is the advancement of methodologies for the simulation of counterterrorism measures that could have the largest impact on the use of predictive models for decision support. Further development of this application can help realize one of the main goals of predictive modeling: to provide analysts with the ability to accurately predict the outcome of multiple counter-terrorism strategies before selecting a course of cyber or corporeal action.
Overall, it is evident from the current status of this field of research that when used responsibly and with a clear understanding of their limitations, data mining and predictive modeling techniques have the potential to be powerful counter-terrorism tools.
This chapter discusses seven topics as follows:
Deterring VNSA in Cyberspace Emergent Behavior of Violent Non-State Actors in Cyberspace Overview: Data Collection, Analysis, and Predictive Modeling Data Collection Data Mining and Analysis Predictive Modeling Benefits, Challenges, and Caveats Research and Development Directions
Emergent Behavior of Violent Non-State Actors in Cyberspace
For violent non-state actors (VNSAs) on a mission to spread their message, or cyberterrorists who merely want to create mischief, cyberspace offers limitless resources and opportunities for achieving these goals. The Internet is unparalleled in its ability to grant individuals access to a mass audience in an environment that has almost no enforceable personal conduct regulations or monitoring capabilities.
According to a report compiled by Dr. Gabriel Weimann of the United States Institute of Peace, as of 2004, all active terrorist groups had established a Web presence of some kind, with the intention of exposing current and potential supporters, as well as enemies, to their ideologies (Weimann, 2004). The behavior of such groups in cyberspace has been studied extensively and can be broadly classified by the impact it has on the cyber and corporeal realms. Figure 1 depicts this interaction and categorizes the behavior according its origin and impact.
Figure 1: Interaction between cyber and corporeal actions of VNSAs (Asal et al, 2008).
Deterring VNSA in Cyberspace Cyber-psychological activities include dissemination of propaganda and disinformation, intimidation, and indoctrination via cyber-based communication channels. Cyber-cyber interactions describe efforts to negatively impact the cyber infrastructure, while attacks planned via cyber means that target the corporeal realm are illustrative of the cyber-corporeal connection.