The latest issue of the Skeptical Inquirer (March/April 2006) features an article titled “Hoaxers, Hackers, and Policymakers: How Junk Science Persuaded the FBI to Divert Terrorism Funding to Fight Hackers” by Carolyn Meinel. The descriptive text on the first page (between the article title, subtitle, and author’s name) says “Hoaxers warned of an imminent and deadly electronic Pearl Harbor. Consequently, the FBI diverted resources and attention away from terrorism and toward fighting hackers. This may have contributed to the September 11, 2001, attacks. Use of critical inquiry and the scientific method could have avoided this misdirection."
While most of the article appears to me to be accurate and its conclusion about treating claims from self-proclaimed computer security experts with scrutiny is sound, the article itself contains unsubstantiated arguments (in particular the arguments of the title and subheading) and comes from a self-proclaimed hacking expert of questionable credibility.
Meinel’s article is in three sections–an introductory section about the title, a section about specific claims made by two hackers, and a section on “critical analysis of e-terrorism.” I find little to criticize in the latter two sections, except for its implication that Peter Neumann’s testimony before Congress was unfounded (Neumann is a highly respected expert on computer risks, the editor of the RISKS Digest, and author of the book Computer-Related Risks, 1995, The ACM Press).
Meinel begins by describing Fred J. Villella bringing hackers “Dr. Mudge” (Pieter Zatko, though Meinel never mentions his name) and “Se7en” (“Christian Valor”, who was indeed exposed as a chronic fabricator as Meinel claims in the second part of her article) to meetings of federal policymakers where they warned of “a looming electronic Pearl Harbor.” The most notable such meeting was testimony before the Senate Governmental Affairs Committee on May 19, 1998, where the above-mentioned Neumann testimony took place, and where Mudge testified that he could make the Internet unusable with less than thirty minutes of effort.
Meinel argues that this testimony “may have contributed to an entrapment scheme” by the FBI against hacker “Chameleon” (Marc Maiffret, now “Chief Hacking Officer” of eEye Digital Security) as a way to show that “hackers were actually collaborating with enemies of the U.S.” But she provides no evidence of a connection between the testimony and the action.
She falsely states that “books (Penenberg 2000; Mitnick 2005) hyped the raid [on Maiffret] to say that hackers were in league with al Qaeda.” Neither of these two books says that. Adam Penenberg, in his book Spooked: Espionage in Corporate America (with Marc Barry, 2001, Perseus Books), writes that “Hackers are always on red alert for the FBI. In fact, when Maiffret was contacted over the Internet by the alleged terrorist Khalid Ibrahim, a member of Harkat-ul-Ansar, a militant Indian separatist group on the State Department’s list of the thirty most dangerous terrorist organizations in the world, he assumed Ibrahim worked for the feds.” Kevin Mitnick, in his book The Art of Intrusion (2005, Wiley, pp. 32-34), raises the possibility that Khalid Ibrahim was part of an FBI operation, but questions it on the ground that only Maiffret received any money from him. On the other hand, he points out that Maiffret told Wired News “he had not provided any government network maps” and wonders why, despite his confession to accepting money from an terrorist-connected individual (Mitnick writes “foreign terrorist”), no charges were ever filed. Then, he writes “Perhaps the check wasn’t from Khalid after all, but from the FBI.” (As an aside, Mitnick’s book states that few know the true identity of “Chameleon,” but Penenberg’s book had already published his identity in 2000.) Perhaps Maiffret avoided prosecution by agreeing to work with the FBI, as other hackers have done (such as Justin Tanner Petersen, “Agent Steal,” whose story is partly told in Jonathan Littman’s The Watchman: The Twisted Life and Crimes of Serial Hacker Kevin Poulsen, 1997, Little, Brown).
The specific argument of the title and subheading–that the testimony of these hackers led to a diversion of funding that may have contributed to the success of the 9/11 terrorist attacks–is stated in a single paragraph in the second column of the first page of the article (p. 32). In that paragraph, Meinel states that cyberspace czar Richard Clarke’s formation of the National Infrastructure Protection Center (NIPC) diverted funding increases “earmarked against terrorism to hire FBI agents for the hacker beat.” This diversion of funds led to only $4.9 million spent by NIPC on counterterrorism, and it therefore lacked the resources to follow up on Phoenix FBI agent Ken Williams’ warning about al Qaeda members training at U.S. flight schools.
This argument assumes that NIPC, rather than the FBI’s counterterrorism unit, is the organization which should have followed up on Williams’ memo. It also overlooks the role of the FBI’s incredibly antiquated computer systems, which technophobe FBI Director Louis Freeh had refused to take steps to upgrade (with Congress withholding $60 million in funding for FBI’s IT infrastructure between 1998 and 2000 because of its failure to produce a credible upgrade plan). Not until July 2000, when Freeh appointed Bob Dies to begin work on an overhaul, did Freeh address the issue. The result was that the FBI had 42 separate database systems that could not be searched simultaneously and many agents had computers that did not work or could not display images or connect to the Internet. Many agents used home computers in order to receive email photo images of suspects from local police departments. (See the “Missing Documents” chapter of Ronald Kessler’s The Bureau: The Secret History of the FBI, 2002, St. Martin’s Press. Similar observations are made in the “9/11” chapter of James Bovard’s The Bush Betrayal, 2004, Palgrave Macmillan. Bovard cites (p. 27) a Los Angeles Times story that reports the FBI diverting $60 million in funds earmarked for IT upgrades in the year 2000 to be used for staffing and international offices. The fact that the dollar figure is the same in Bovard and Kessler may indicate that Bovard is misdescribing the same $60 million Kessler mentions.) By contrast, NIPC’s entire budget (PDF) was under $20 million per year through 2000, and Bush requested a budget of $20.4 million for NIPC in 2001. (This is not to say that NIPC was effectively using what funds it had–it wasn’t. But Meinel’s complaint that only $4.9 million of NIPC’s budget was spent on counterterrorism should be put in context–that was a quarter or more of its annual budget.)
These IT failings and the other failures reported in the 9/11 Commission Report and elsewhere strike me as more plausible reasons for the U.S. government’s failure to avert the 9/11 attacks than trying to pin it on the hackers who testified before Congress in 1998 about the dangers of cyber attacks. Ironically, in October 2001 an article arguing that the Code Red worm demonstrates that there really are significant risks of Internet-based attacks on U.S. infrastructure (“They would be far worse than not being able to make bids on eBay–potentially affecting product manufacturing and deliveries, bank transactions, telephony and more. Should it occur five years from now, the results could be a lot more severe.”) appeared in Scientific American. The author of this article, “Code Red for the Web,” was Carolyn Meinel.
It’s more surprising to me that Skeptical Inquirer published an article by Carolyn Meinel at all. Meinel’s author description printed in SI states:
...