Kellan Schmelz GOVT 391--Floyd March 19, 2011

Cyber-Attacks: Explaining Hamas Reluctance I. Introduction In late 2011, a Saudi hacker operating out of Mexico named 0x-Omar launched several cyberattacks against Israeli websites, including the Tel Aviv stock exchange and an Israeli airline, causing a small amount of disruption and hysteria (Al-Saadi). Hamas, an Islamist Palestinian resistance group which currently governs the Gaza strip, praised the attacks. We urge Arab youth to develop their methods in electronic warfare, said a spokesman (Enoch). Though Hamas has applauded cyber-attacks against Israeli institutions, Hamas remains unwilling to stage an attack of their own. Hamas seems content to stick to a style of cyber-terrorism restrained to communication and coordination. This paper argues this reluctance stems from cyber-attacks strategic incongruity with Hamas tactical preference for operations that kill, and that the relevant technology may never or will need a significant amount of time before Hamas will consider including it in their arsenal. II. Definitions This paper seeks to build upon and add to the existing literature on the use of terrorist activities on the internet; to that end, the research here will use a definition the existing literature on cyber-terrorism has found relevant.www.terror.net, a 2004 study on the online presence of terrorist groups, refers to a definition that systematically isolated the common elements of 109 different definitions of terrorism, building a definition from the emerging commonalities, which follows: an act of violence; symbolic or chance victims (innocent people); performance by an organization; methodicalness or seriality in the operation; advance planning; criminal character; absence of moral restraints; political demands; attempt to win attention; use of fear (terror); and unpredictability or unexpectedness (Tsfati and Weimann, 319-320)

This study seeks to use a definition that recognizes the diversity of cyber-terrorism and is prevalent among existing literature on the topic FBI Director Robert Muellers definition in his speech at the March 2010 RSA Cyber Security Conference in San Francisco, best meets these terms. Mueller defines cyber-terrorism as including a range of terrorist activities involving use of the internet, including specifically cyber attacks designed to cripple websites and other online institutions (Mueller), recruiting efforts (Mueller), and organization of terrorist violence (Mueller). The first element of the three strains of cyberterrorism referred to could be described as cyberattacks, another term this paper will use heavily. This paper will draw upon the most all-encompassing one, provided below. deliberate actions perhaps over an extended period of time to alter, disrupt, deceive, degrade, or destroy adversary computer systems or networks or the information and/or programs resident in or transiting these systems or networks. (Owens, Dam and Lin, 80) Finally, though this paper seeks to discuss Hamas, the term must be specified given the groups diversity of operations: in addition to a military wing, the group also has a political and a social welfare wing (Rosaler, 26). It should be assumed that when this paper refers to Hamas, it refers to the military wing unless indicated otherwise. III. Literature Review The existing literature on Hamas' online activities discusses Hamas' lack of engagement in cyberattacks, usually in the context of two major conclusions about Hamas' online activities. The first describes Hamas reluctance, while the second conclusion holds that most of Hamas online activities are devoted to communication and coordination. Jose Nazario and Nate Anderson both entertain the first conclusion in studies of Israeli-Hamas fighting in Gaza in 2009. Both Nazario and Anderson conclude that while cyber-attacks were launched against both Hamas and Israel, both attacks appeared to originate from outside either sides operations.

Nazario even concludes that the bulk of attacks launched against Israel actually originated from outside terminals associated with Hamas in the Gaza Strip. Deborah Denning notes in A View of Cyberterrorism Five Years Later that in 2003, discussion emerged on websites such as Qassam.net about the possibility of Hamas coordinating cyber-attacks against Israel, but notes that no attacks appear to have emerged (5-12). Later, in Cyberterrorism: The Logic Bomb versus the Truck Bomb, Denning discusses the online activities of a variety of terrorist organizations; she discusses Hamas' communication efforts on qassam.net are discussed (Cyberspace Violence), but excludes them from her discussion of groups that engage in attacks on critical infrastructure (How real a threat?). Finally, the website Hackmageddon.com has maintained since early 2011 a list of Cyber-attacks and incidents of Cyberwar. Hamas does not appear on any of their list of attacks for 2011 or 2012. This is not to say that Hamas abstains from cyberterrorism, however; the literature suggests that Hamas engages in just about every facet of cyberterrorism outlined by Muller but cyber-attacks. Tomer Mozes and Gabriel Weimann write about Hamas' use of the internet as a tool to advertise the goals and activities of the group in The E-Marketing Strategy of Hamas; to them, Hamas' efforts to promote its military goals and view of the Israel-Palestine conflict mirror the strategies employed by multinational corporations to promote a product. Jonathan Dahoah argues Hamas uses the internet to write their own version of history (Halevi, 5), and Denning outlines Hamas' efforts to use chatrooms and websites like qassam.net to recruit new members of the group and coordinate bombings and other attacks in the aforementioned Logic Bomb versus the Truck Bomb (Exploiting Cyberspace). Bruce Hoffmann elaborates on the role of the internet as a coordinator of terrorist activity for Hamas in a passage from Inside Terrorism (82-87). Though Hamas has refrained from employing cyber-attacks, the internet has provided no shortage of opportunities for Hamas to engage in cyberterrorism. The existing body of literature fails to ask why Hamas has been content to sit on the sidelines of

cyber-attacks. This paper seeks to fill this gap in the discussion. V. Capabilities If 0x-Omar could, acting on his own, down Israeli websites through cyber-attacks, surely an organized group like Hamas is capable of achieving similar results. Almost no scholars doubt Hamas ability to launch small-scale cyber-attacks such as Distributed Denial of Service (DDOS) attacks or hacking of moderately secure websitesand inflict a certain amount of disruption and economic damage on Israeli society in the process (Rosenberg), and some describe such attacks as inevitable (Rosenberg). Hamas ability to do much more than these simple operations remains doubtful, though. The capabilities necessary for a group to engage in a critically damaging cyber-attack, the kind that inflicts devastating or long-term economic damage or corruption of government or military electronic infrastructures of a developed nation, are out of Hamas reach. These include a large team of experienced hackers (Knake) ; a large, long-term financial investment (Rollins and Wilson, 16-18); and a secure facility(Knake) and a system for testing cyber operations (Rollins and Wilson, 25). Currently, only a handful of nation-state actors possess these capabilities, and even then on a limited basis (Krekel, Bekos, and Adams), with even groups like al-Qaeda having failed to reach such levels (Harknett, Callaghan and Kaufman). Hamas ability to do what al-Qaeda could not and China can barely do (Krekel, Bekos, and Adams) must be doubted. Some of Hamas' supporters acknowledge that Hamas' ability to use cyber-attacks effectively is limited. Abdullah al Aalwit, a Shi'ite cleric with ties to Hamas, discounted cyber-attacks as a legitimate form of Jihad on account of capabilities, writing that Hamas' limited electronic warfare would invite retaliation from more advanced enemies who exceed [Hamas] in... [technology] (Atayaf). Until Hamas' capabilities to launch a cyber-attack match those of Israel, al Aalwit argues, they must refrain from engaging in cyber-attacks (Atayaf)a blow to the idea that Hamas stands to inflict critical damage on Israel through the internet.

VI. Tactics A common thread among Hamas array of tactics is the use of deadly forceHamas prefers it exclusively. Their inability to use cyber-attacks to kill explains their reluctance to include the tactic in their arsenal of terror. Hamas is unlikely to explore cyber-attacks until the ability to kill people through online attacks becomes a real possibility and certain conditions related to the tactic's difficulty and financial burden are met. Hamas array of activities is completely congruent with their preference for operations that kill. The chief activities of the group are rocket and mortar attacks against public Israeli spaces, both deployed with the intention of killing (Chosak and Sawyer). Until 2006, Hamas used suicide bombings (), a manifestation of Hamas' obsession with murderous tactics. This makes sense in light of Hamas longterm military strategy of essentially frightening Israel into a cease-fire (or hudna), which the group intends to use for a military buildup for the liberation of all of historic Palestine--killing Israeli citizens is key to pressuring Israel into a ceasefire and essential to the final act of liberation (Erlanger)--. This murderous brand of tactical tunnel vision is also affirmed by Hamas 1988 Charter, which is explicit both in its call for the liberation of Palestine and its demand that this goal be achieved through the killing of Jewish residents of Israel. Article 13 of the Charter rejects initiatives, conferences, and international proposals, as a waste of time, in favor of killing, and other, more controversial parts of the Charter make claims such as that Palestine's liberation will not come until Muslims will fight the Jews [and kill them]!. Though the relevance of the charter to modern times has been debated, Hamas' current leaders have endorsed the above elements. Ismail Haniyeh, the prime minister and de facto leader of Hamas, recently affirmed idea that Hamas' military wing is, first and foremost, in the business of killing Israelis when confronted with rumors that Hamas was planning on transitioning to non-violent resistance in the

face of the Arab Spring (Baconi). Hamas' current online presence is congruent with their killing ways. The bulk of Hamas' online activity falls under the aegis of coordinating real-life activities or communication. Both aims contribute to the killing of more people, as congruent with Hamas' tactical preferences. Coordinating real-life attacks and training terror online clearly plays into this. E-marketing does as well: it results in the recruiting of more soldiers for the struggle against Israel (Mozes and Weimann, 5). Jonathan Dahoah argues it influences policymakers associated with the Israel-Palestine conflict both inside Israel and supranational organizations like the United Nations, making it easier for Hamas to conduct their operations. It encourages supporters to buy weaponry and ammunition for Hamasonline (Levit 154). Everything Hamas currently does on the internet directly leads to the killing of Israelis in some sense. Cyber-attacks lack this congruency. Killing through cyber-attacks is off the table at the present moment. All feasible methods of using cyber-terror for the purposes of killing, whether hacking nuclear plants, weapons facilities or other methods, involve a level of technological sophistication currently out of the reach of non-state actors and much more sophisticated terror groups. At the most, cyber-attacks represent an opportunity to inflict economic damage on Israeli society and institutions and perhaps disrupt the flow of daily life in Israel. Even if Hamas could do this on the largest of scales, not a single person dies. Hamas recognizes the benefits of such damage to Israeli societyhence their praise of 0x-omar and othersbut know it doesnt fit into their modus operandi. While this does not make Hamas intrinsically opposed to cyberterror, technology and Hamas own capabilities leave the tactic out of reach for now. Moreover, the possibility of such attacks becoming something Hamas is capable of doing appear likely to remain out of reach for quite some time. Knake argues that the costs and other barriers to developing such attacks are declining, but not slowly enough

to make them available to even state actors like China for a number of years. Others have argued that investments from developed countries in cyber-defense (Rollins and Wilson, 19) and tactics such as air gapping (disconnecting electronic systems like the electric grid from networks connected to the Internet) (Amaroso, 64) pose a block to such attacks are unlikely to overcome with presently existing technology. These conclusions by themselves should represent a sigh of relief for those battling Hamasfor the time being, they will have one less front to fight the battle against Hamas on. The challenge for technology developers, businesses and government institutions of continuing to structure the development of technology and construction of online networks in a way that coordinating cyber-attacks that kill remains an impossibility is ongoing, and must be if Hamas is to be kept off of the front of cyber-attacks.

VI. Conclusion Until destruction of Israeli people and society becomes a viable consequence of using cyberterror, Hamas appears unlikely to engage in it. Those threatened by Hamas can take cold comfort in the fact that while this does not mean Hamas is intrinsically opposed to the use of cyber-attacks, the condition that would catapult the group into this realm of terrorthe ability to easily and cheaply use a cyber-attack to killis a long way off. Word Count: 2,123

Works Cited Al-Saadi, Yazan. "Saudi 0xOmar: Hackers of the World Unite Against Israel." Al Akhbar English. 16 Jan. 2012. Web. 20 Mar. 2012. <http://english.al-akhbar.com/content/saudi-0xomar-hackers-worldunite-against-israel>. Amoroso, Edward G. "Separation." Cyber Attacks: Protecting National Infrastructure. Burlington, MA: Butterworth-Heinemann, 2011. 51-70. Print. Anderson, Nate. "Israel/Hamas Battle Goes Web 2.0." Web - That Big Internet Thing Blog. Ars Technica, 2009. Web. 25 Mar. 2012. <http://arstechnica.com/web/news/2009/01/israelhamas-battle-goesweb-2-0.ars>. Atayaf, Mohamed. "Scholars Speak out in Favor of "electronic Jihad" against the Enemy." Alarabiya.net English. 29 Jan. 2012. Web. 28 Mar. 2012. <http://english.alarabiya.net/articles/2012/01/29/191307.html>. Baconi, Tareq. "Hamas Is Making a Tactical Appeal to the Grassroots." The Guardian. Guardian News and Media, 08 Mar. 2012. Web. 23 Mar. 2012. <http://www.guardian.co.uk/commentisfree/2012/mar/08/hamas-tactical-appeal-grassroots>. "The Charter of the Hamas." The Jerusalem Fund. Palestine Center -- Selected Documents Regarding Palestine, 2 Mar. 2012. Web. 28 Mar. 2012. <http://www.thejerusalemfund.org/www.thejerusalemfund.org/carryover/documents/charter.html> . Chosak, Jamie, and Julie Sawyer. "Hamas's Tactics: Lessons from Recent Attacks." Washington Institute for Near East Policy. 19 Oct. 2005. Web. 8 Mar. 2012. <http://www.washingtoninstitute.org/templateC05.php?CID=2382>.

Denning, Deborah. ""Activism, Hacktivism, and Cyberterrorism: The Internet as a Tool for Influencing Foreign Policy"" Ed. John Arquilla and David F. Ronfeldt. Networks and Netwars: The Future of Terror, Crime, and Militancy. Santa Monica, CA: Rand, 2001. Print. Enoch, Nick. "Hamas Hails Hack Attack against Websites of Israel's Stock Exchange, El Al Airline and Three Banks." Mail Online. 16 Jan. 2012. Web. 28 Mar. 2012. <http://www.dailymail.co.uk/news/article-2087386/Saudi-hackers-attack-websites-Israels-stockexchange-El-Al-airline.html>. Erlanger, Steven. "In Gaza, Hamass Insults to Jews Complicate Peace." New York Times Online. 1 Apr. 2008. Web. 2 Mar. 2012. <http://www.nytimes.com/2008/04/01/world/middleeast/01hamas.html? pagewanted=print>. Halevi, Jonathon D. "The Israeli-Palestinian Conflict Reflected Through the Internet." Terrorism and the Internet Threats, Target Groups, Deradicalisation Strategies. Ed. Hans-Liudger Dienel. Amsterdam: IOS, 2010. Print. Harknett, Richard J., John P. Callaghan, and Rudi Kauffman. "Leaving Deterrence Behind: War-Fighting and National Cybersecurity." Journal of Homeland Security and Emergency Management 7.1 (2010). Print. Hoffman, Bruce. Inside Terrorism. New York: Columbia UP, 2006. Print. "Israel Hit by Cyber-attacks on Stock Exchange, Airline and Banks." The Guardian. Guardian News and Media, 16 Jan. 2012. Web. 25 Feb. 2012. <http://www.guardian.co.uk/world/2012/jan/16/israelcyber-attacks-banks-airline>. Khoury-Machool, Makram. "Cyber Resistance: Palestinian Youth and Emerging Internet Culture." Ed. Asef Bayat and Linda Herrera. Being Young and Muslim: New Cultural Politics in the Global

South and North. New York: Oxford UP, 2010. Oxford Scholarship Online. Web. 24 Feb. 2012. <http://www.oxfordscholarship.com/view/10.1093/acprof:oso/9780195369212.001.0001/acprof9780195369212-chapter-7>. Knake, Robert K. "Cyberterrorism Hype v. Fact." Council on Foreign Relations. 16 Feb. 2010. Web. 25 Mar. 2012. <http://www.cfr.org/terrorism-and-technology/cyberterrorism-hype-v-fact/p21434>. Krekel, Bryan, George Bekos, and Patton Adams. Occupying the Information High Ground: Chinese Capabilities for Computer Network Operations and Cyber Espionage. Rep. US-China Economic Security Review Division. Occupying the Information High Ground: Chinese Capabilities for Computer Network Operations and Cyber Espionage. The Washington Post. Web. 12 Mar. 2012. <http://www.washingtonpost.com/r/2010-2019/WashingtonPost/2012/03/08/NationalSecurity/Graphics/USCC_Report_Chinese_Capabilities_for_Computer_Network_Operations_and _Cyber_%20Espionage.pdf>. Levitt, Matthew. "Foreign Funding of Hamas." Hamas: Politics, Charity, and Terrorism in the Service of Jihad. New Haven, CT: Yale UP, 2006. 143-70. Print. Mozes, Tomer, and Gabriel Weimann. "The E-Marketing Strategy of Hamas." Studies in Conflict & Terrorism 33.3 (2010): 211-25. Print. Mueller, Robert. "Tackling the Cyber Threat." Speech. RSA Cyber Security Conference. San Francisco, California. 4 Mar. 2010. RSA Cyber Security Conference. Federal Bureau of Investigation, 4 Mar. 2010. Web. 12 Mar. 2012. <http://www.fbi.gov/news/speeches/tackling-the-cyber-threat>. Nazario, Jose. "The Effects of War: Gaza and Israel." Web log post. DDoS and Security Reports: The Arbor Networks Security Blog. Arbor SERT: Security Engineering and Response Team, 5 Jan. 2009. Web. 20 Feb. 2012. <http://ddos.arbornetworks.com/2009/01/the-effects-of-war-gaza-and-

israel/>. Owens, William A., Kenneth W. Dam, and Herbert Lin, eds. "Technological and Operational Considerations in Cyberattack and Cyberexploitation." Technology, Policy, Law, and Ethics regarding U.S. Acquisition and Use of Cyberattack Capabilities. Washington, DC: National Academies, 2009. 79-83. Print. Rollins, John, and Clay Wilson. Terrorist Capabilities for Cyberattack: Overview and Policy Issues. Issue brief. Congressional Research Service. Foundation of American Scientists. Web. 2 Mar. 2012. <http://www.fas.org/sgp/crs/terror/RL33123.pdf>. Rosaler, Maxine. Hamas: Palestinian Terrorists. New York: Rosen Pub. Group, 2003. Print. Rosenberg, David. "Big Hack Attack on Israel Inevitable, Say Experts." Jerusalem Post Online. 9 Jan. 2012. Web. 28 Mar. 2012. <http://www.jpost.com/NationalNews/Article.aspx?id=252807>. "Why the Stuxnet Worm Is like Nothing Seen before." The New Scientist 208.2780 (2010): 4. Print.