Terrorists nearing ability to launch big cyberattacks against U.S.

The biggest threat to U.S. computer networks is terrorist organizations that will purchase software code from cybercriminals to penetrate sensitive systems, a possibility that could be just a few years away, information security and former intelligence officials said on Friday.

Although enemy states often are blamed for cyberattacks against the United States, it is not common because political and financial repercussions dissuade most countries from launching a widespread effort, James Woolsey, a former CIA director, said during a panel discussion at the International Spy Museum. The talk was part of the launch of a new gallery on cyber threats.

"We don't have the [degree] of strife [with] those that have these capabilities -- such as China and Russia," that would cause them to attack the United States, Woolsey said. "The ultimate problem we face is the possibility that we will have an enemy whose objective is total destruction."

Power plants are a prime target, he said, with the goal being to take down the electric grid. "Would anyone want to do that?" Woolsy asked. "Yes. We saw their faces on 9/11."

Al Qaeda and other Islamic terrorist organizations are honest about what motivates them, he said. "They believe God wants to destroy the U.S.," Woolsey added. "That's a different kind of enemy."

While most nation states have the capability to launch a widespread cyberattack, but choose not to, terrorist organizations have not yet developed the necessary computer programming skills to do significant damage, according to Mike McConnell, former director of National Intelligence. "When terrorist groups have the sophistication, they'll use it," he said.

That could happen within the next few years as cybercriminals peddle through the black market the software programs needed to launch a debilitating cyberattack, said James Lewis, director of the technology and public policy program at the Center for Strategic and International Studies. "When does stuff get good enough for al Qaeda to go buy it? That will happen in the next few years," he said.

McConnell also noted the possibility that enemy nation states will use a terrorist organization as a proxy, providing the technology but denying involvement.

Among the most effective strategies to combat cybercrime and terrorism is international engagement to support global criminal investigation and legal action against those tied to cyberwarfare activities, Lewis said. "We agreed to not sell nuclear weapons to terrorists and that's worked out pretty well," he said. "Now we need agreement among nations to not supply terrorists with these capabilities and to support better cybercrime laws" to pursue those that support attacks.