Information and communication technology (ICT) can be used to facilitate the commission of terrorist-related offences (a form of cyber-enabled terrorism) or can be the target of terrorists (a form of cyber-dependent terrorism). Specifically, ICT can be used to promote, support, facilitate, and/or engage in acts of terrorism. Particularly, the Internet can be used for terrorist purposes such as the spreading of "propaganda (including recruitment, radicalization and incitement to terrorism); [terrorist] financing; [terrorist] training; planning [of terrorist attacks] (including through secret communication and open-source information); execution [of terrorist attacks]; and cyberattacks" (UNODC, 2012, p. 3). The term cyberterrorism has been applied by some to describe the use of the Internet for terrorist purposes (Jarvis, Macdonald, and Nouri, 2014).
Just as there is no consensus on a definition of cybercrime (see Cybercrime Module 1 on Introduction to Cybercrime), there is no universally accepted definition of terrorism (see Module 1 of the Teaching Module Series on Counter-Terrorism) nor of cyberterrorism. Conceptions of cyberterrorism have ranged from "more expansive conceptions…[including] any form of online terrorist activity…[and] narrower understandings of this concept" (Jarvis, Macdonald, and Nouri, 2014, p. 69). The narrow understanding of cyberterrorism has been described as "pure cyberterrorism" by some (e.g., Conway, 2002; Gordon, 2003; Neumann, 2009; Jarvis and Macdonald, 2014; Jarvis, Macdonald, and Nouri, 2014). This narrow definition considers cyberterrorism as a cyber-dependent crime perpetrated for political objectives to provoke fear, intimidate and/or coerce a target government or population, and cause or threaten to cause harm (e.g., sabotage) (Denning, 2001; Jarvis, Macdonald, and Nouri, 2014; Jarvis and Macdonald, 2015.). Examples of this narrow conception of cyberterrorism include "attacks that lead to death or bodily injury, explosions, plane crashes, water contamination, or severe economic loss.... Serious attacks against critical infrastructures could be acts of cyberterrorism, depending on their impact. Attacks that disrupt nonessential services or that are mainly a costly nuisance would not" (Denning, 2001 cited in Jarvis, Macdonald, and Nouri, 2014, p. 69; for information about critical infrastructure, see Cybercrime Module 5 on Cybercrime Investigation). It is important to note that this limitation of cyberterrorism to cybercrimes committed against critical infrastructure (or pure cyberterrorism) is not widely held (for more information about the concepts of 'cyberterrorism' and 'use of the Internet for terrorist purposes' see the UNODC Counter-Terrorism Legal Training Curriculum Module "Counter-terrorism in the International Law Context" (forthcoming in 2019)).
Some cyberterrorism laws have been criticized for being overly broad and being used by governments to prosecute activists and dissidents (Yousafzai, 2017; Maras, 2016; A/70/371, para 14; A/63/337, para 53; UN OHCHR, 2018, " Mandates of the Special Rapporteur"; on the broader point of overbroad extremism/terrorism legislation, see A/HRC/33/29, paras. 21 and 22, and A/71/373, para. 23). In view of that, more expansive conceptions of cyberterrorism in law lead to disproportionate limitations of human rights ( A/70/371, para 14).
While certain countries have national cyberterrorism laws (e.g., India, Section 66-F, Information Technology Act of 2000; Pakistan, Section 10, Prevention of Electronic Crimes Act of 2016; and Kenya, Section 33, Computer Misuse and Cybercrimes Act of 2018), cyberterrorism is not explicitly prohibited under international law (NATO CCD COE, 2012, p. 156). Even though there is no universally accepted definition of cyberterrorism and international law does not explicitly criminalize cyberterrorism, "most …[laws] contain offence-creating provisions directly targeting malicious acts aimed at destroying or interfering with the functioning of" critical infrastructure (UNSC CTED and UNOCT, 2018, p. 70). Specifically, acts of terrorism against critical infrastructure sectors, such as the transportation (e.g., aviation and maritime), nuclear, and government sectors, are prohibited under certain provisions of the following United Nations international conventions and protocols (UNSC CTED and UNOCT, 2018, pp. 70-73) (for further information about these counter-terrorism legal instruments, see Module 3 of the Teaching Module Series on Counter-Terrorism):
Countries that are parties to these conventions and protocols are obliged to harmonize their domestic legal frameworks with the provisions of these instruments, whereas those "that are not parties to some of the… conventions and protocols are encouraged to ratify or accede them" pursuant to United Nations Security Council Resolution 1373 (2001) (UNSC CTED and UNOCT, 2018, p. 70). Countries are further required to comply with UNSC Chapter VII binding resolutions in the fight against terrorism. UNSC Resolution 2370 (2017) "urges Member States to act cooperatively to prevent terrorists from acquiring weapons, including through information and communications technologies, while respecting human rights and fundamental freedoms and in compliance with obligations under international law, and stresses the importance of cooperation with civil society and the private sector in this endeavour, including through establishing public private partnerships."
Ultimately, what is considered cyberterrorism depends on the country that is labelling the act (Maras, 2014). Nonetheless, the mislabeling of acts as cyberterrorism can have detrimental consequences, resulting in disproportionate sentences for those prosecuted for this cybercrime. In this vein, all counterterrorism laws "must be limited to the countering of offences within the scope of, and as defined in, the international conventions and protocols relating to terrorism, or the countering of associated conduct called for within resolutions of the Security Council, when combined with the intention and purpose elements identified in Security Council resolution 1566 (2001)" ( E/CN.4/2006/98, para. 39). Conversely, "[c]rimes not having the quality of terrorism (…), regardless of how serious, should not be the subject of counter-terrorist legislation" ( E/CN.4/2006/98, para. 47).
Next: Cyberwarfare
Back to top
