[Editor’s Note: Mad Scientist Laboratory is pleased to publish today’s post by returning guest blogger Zachary Kallenborn, continuing his New Age of Terror series. The democratization of unmanned air, ground, sea, and subsea systems and the proliferation of cyber-physical systems (e.g., automated plants) provide lesser states, non-state actors, and super-empowered individuals with new capabilities to conduct long-range precision fires and generate global non-kinetic effects resulting in mass casualty events. The potential weaponization of these otherwise benign capabilities pose new vulnerabilities to those who fail to remain vigilant and imagine the unthinkable — beware!]
A loud buzz pierced the quiet night air. A group of drones descended on a chemical plant near New York City. The drones disperse throughout the installation in search of storage tanks. A few minutes later, the buzz of the drone propellers was drowned out by loud explosions. A surge of fire leapt to the sky. A plume of gas followed, floating towards the nearby city. The gas killed thousands and thousands more were hospitalized with severe injuries.
The rapid proliferation of unmanned systems and cyber-physical systems offer terrorists new, easier means of carrying out mass casualty attacks. Drones allow terrorists to reduce their operational risk and acquire relatively low cost platforms. Cyber attacks require few resources and could cause significant harm, though a lack of expertise limits terrorist ability to inflict harm. Terrorists may prefer these methods to difficult-to-acquire and risky chemical, biological, radiological, and nuclear (CBRN) weapons.
Drones
Drones offer terrorists low cost methods of delivering harm with lower risk to attacker lives. Drone attacks can be launched from afar, in a hidden position, close to an escape route. Simple unmanned systems can be acquired easily: Amazon.com offers seemingly hundreds of drones for as low as $25. Of course, low cost drones also mean lower payloads that limit the harm caused, often significantly. Improvements to drone autonomy will allow terrorists to deploy more drones at once, including in true drone swarms.1 Terrorists can mount drone attacks across air, land, and sea.
Aerial drones allow attackers to evade ground-based defenses and could be highly effective in striking airports, chemical facilities, and other critical infrastructure. Houthi rebels in Yemen have repeatedly launched drone strikes on Saudi oil pipelines and refineries.2 Recent drone attacks eliminated half of Saudi 
oil production capacity.3 Attacks on chemical facilities are likely to be particularly effective. A chemical release would not require large amounts of explosives and could cause massive harm, as in the Bhopal gas accident that killed thousands. Current Department of Homeland Security Chemical Facility Anti-Terrorism Standards do not require any meaningful defenses against aerial attack.4 Alternatively, even small drones can cause major damage to airplane wings or engines, potentially risking bringing a plane down.5 In December 2018, that risk alone was enough to ground hundreds of flights at Gatwick airport south of London when drones were spotted close to the runway.
Self-driving cars also provide a means of mass casualty attack. Waymo, Uber, and several other companies seek to launch a self-driving taxi service, open to the public. Terrorists could request multiple taxis, load them with explosives or remotely operated weapons, and send them out to multiple targets. Alternatively, terrorists could launch multi-stage attacks on the same target: a first strike causes first responders to mass and subsequent attacks hit the responders. In fact, ISIS has reportedly considered this option.6
For a few hundred dollars, anyone can rent a semi-autonomous surface vessel that can carry up to 35lbs.7 No license or registration is necessary.8 Although a surface attack limits terrorists to maritime targets, 
potential still exists for significant harm. Terrorists can strike popular tourist sites like the Statue of Liberty or San Francisco’s Fisherman’s Wharf. U.S. military vessels are ideal targets too, such as the USS Cole bombing in October 2000.9 But drones are not the only new method of attack.
Cyber-physical systems
Like drones, cyber attacks are low cost and reduce operational risks. Cyber attacks can be launched from secure locations, even on the other side of the world. Terrorists also gain high levels of autonomy that will inhibit law enforcement responses.10 Although cyberterrorism requires significant technical know-how, terrorists require few resources other than a computer to carry out an attack.
Cyber attacks could target chemical facilities, airplanes, and other critical infrastructure targets. In 2000, Vitek Boden infiltrated computers controlling the sewage system of M
aroochy Shire, Australia, and released hundreds of thousands of gallons of raw sewage into the surrounding area.11 Boden could have caused even more harm if he wished.12 Although Boden’s attack primarily harmed the environment, other attacks could threaten human life. Cyber attacks could disable safety systems at chemical facilities, risking an accidental toxic gas release or explosions. A cyber assault on a Saudi petrochemical facility in August 2017 reportedly had that exact goal.13
However, cyber expertise and specific target knowledge is likely to be a significant inhibitor. Although attacks on critical infrastructure may require specialist knowledge of the control system and administrative operations, protective measures are not always implemented, leaving targets vulnerable.14 Boden was successful in large part because he worked closely with the sewage system’s control systems. Although terrorists have defaced websites and conducted denial of service attacks, known terrorist organizations do not currently possess the capabilities to mount a major destructive cyber attack.15 The availability of the necessary human capital is a strong factor in whether terrorists pursue cyber attacks.16 Nonetheless, the risk is likely to grow as terrorists develop greater cyber capabilities, increased connectivity creates new opportunities for attack, and the black market for cybercrime tools grows.17
The Future Operational Environment
If terrorists have new avenues of mass casualty attack, U.S. forces must devote more resources to force protection and emergency response. U.S. forces may be called upon to aid local, state, and federal emergency responders in the event of a mass casualty attack. Likewise, U.S. troops may face risks themselves: cyber and drone attacks could certainly target U.S. military installations. Even attacks that do not kill can cause significant harm: disrupting airport operations as in the 2018 Gatwick drone incident may delay troop resupply, troop deployment, or close air support to Soldiers in the field. The U.S. military and the broader national security community must rethink its approach to mass casualty terrorism to respond to these threats. Terrorist groups have typically required CBRN weapons to cause mass harm. But if you can kill thousands in a drone attack, why bother with risky, difficult-to-acquire CBRN weapons?
For more information on this threat trend, see Non-State Actors and Their Uses of Emerging Technology, presented by Dr. Gary Ackerman, National Consortium for the Study of Terrorism and Responses to Terrorism, University of Maryland, at the Mad Scientist Robotics, Artificial Intelligence & Autonomy Conference at the Georgia Tech Research Institute, Atlanta, Georgia, 7-8 March 2017…
… as well as the following related Mad Scientist Laboratory posts:
– Zachary Kallenborn‘s previous post, A New Age of Terror: The Future of CBRN Terrorism.
– Marie Murphy‘s post, Trouble in Paradise: The Technological Upheaval of Modern Political and Economic Systems
– The Democratization of Dual Use Technology
– The Future of the Cyber Domain
– Emergent Threat Posed by Super-Empowered Individuals…
… and crank up Love and Terror by The Cinematics!
Zachary Kallenborn is a freelance researcher and analyst, specializing in Chemical, Biological, Radiological, and Nuclear (CBRN) weapons, CBRN terrorism, drone swarms, and emerging technologies writ large. His research has appeared in the Nonproliferation Review, Studies in Conflict and Terrorism, Defense One, the Modern War Institute at West Point, and other outlets. His most recent study, Swarming Destruction: Drone Swarms and CBRN Weapons, examines the threats and opportunities of drone swarms for the full scope of CBRN weapons.
Disclaimer: The views expressed in this blog post do not necessarily reflect those of the Department of Defense, Department of the Army, Army Futures Command (AFC), or Training and Doctrine Command (TRADOC).
1 Amy Hocraffer and Chang S. Nam, “A Meta-analysis of Human–System Interfaces in Unmanned Aerial Vehicle (UAV) Swarm Management,” Applied Ergonomics, Vol. 58 (2017), pp. 66–80, http://www.researchgate.net/profile/Chang_Nam5/publication/303782432_A_meta-analysis_of_human-system_interfaces_in_unmanned_aerial_vehicle_UAV_swarm_management/links/5767f71f08ae1658e2f8b435.pdf
2 Natasha Turak, “Oil Prices Jump as Saudi Energy Minister Reports Drone ‘Terrorism’ Against Pipeline Infrastructure,” CNBC, May 14, 2019, https://www.cnbc.com/2019/05/14/oil-jumps-as-saudi-energy-minister-reports-drone-terrorism-against-pipeline.html
3 John Defterios and Victoria Cavaliere, “Coordinated Strikes Knock Out Half of Saudi Oil Capacity, More Than 5 Million Barrels a Day,” CNN, September 15, 2019, https://www.cnn.com/2019/09/14/business/saudi-oil-output-impacted-drone-attack/index.html
4 Department of Homeland Security, “Risk-Based Performance Standards Guidance: Chemical Facility Anti-Terrorism Standards,” May 2009, 15, 85.
5 Peter Dockrill, “Here’s What it Looks Like When a Drone Smashes into a Plane Wing at 238 MPH,” ScienceAlert, October 22, 2018, https://www.sciencealert.com/this-is-what-it-looks-like-drone-smashes-into-plane-s-wing-238-mph-mid-air-collision-aircraft-impact
6 Lia Eustachewich, “Terrorist Wannabes Plotted Self-Driving Car Bomb Attack: Authorities,” New York Post, September 4, 2018, https://nypost.com/2018/09/04/terrorist-wannabes-plotted-self-driving-car-bomb-attack-authorities/
7 AllTerra, “AllTerra Rental Rates,” May 3, 2019, https://allterracentral.com/pub/media/wysiwyg/AllTerra_Rental_Rates-5.3.19.pdf
8 Phone conversation with USV retailer.
9 CNN Library, “USS Cole Bombing Fast Facts,” CNN, March 27, 2019, https://www.cnn.com/2013/09/18/world/meast/uss-cole-bombing-fast-facts/index.html
10 Steve S. Sin, Laura A. Blackerby, Elvis Asiamah, and Rhyner Washburn, “Determining Extremist Organisations’ Likelihood of Conducting Cyber Attacks,” 2016 8th International Conference on Cyber Conflict, May 31 to June 3, 2016, http://ieeexplore.ieee.org/xpl/articleDetails.jsp?reload=true&arnumber=7529428&tag=1
11 Marshall Abrams and Joe Weiss, “Malicious Control System Cyber Security Attack Case Study – Maroochy Water Services, Australia,” MITRE, July 23, 2008, https://www.mitre.org/sites/default/files/pdf/08_1145.pdf
12 Nabil Sayfayn and Stuart Madnick, “Cybersafety Analysis of the Maroochy Shire Sewage Spill (Preliminary Draft),” Cybersecurity Interdisciplinary Systems Laboratory, May 2017, http://web.mit.edu/smadnick/www/wp/2017-09.pdf
13 Nicole Perlroth and Clifford Krauss, “A Cyberattack in Saudi Arabia had a Deadly Goal. Experts Fear Another Try,” New York Times, March 15, 2018, https://www.nytimes.com/2018/03/15/technology/saudi-arabia-hacks-cyberattacks.html
14 Noguchi Mutsuo and Ueda Hirofumi, “An Analysis of the Actual Status of Recent Cyberattacks on Critical Infrastructure,” NEC Technical Journal, Vol. 12, No. 2, January 2018, https://www.nec.com/en/global/techrep/journal/g17/n02/pdf/170204.pdf
15 Tamara Evan, Eireann Leverett, Simon Ruffle, Andrew Coburn, James Bourdeau, Rohan Gunaratna, and Daniel Ralph, “Cyber Terrorism: Assessment of the Threat to Insurance,” Cambridge Centre for Risk Studies – Cyber Terrorism Insurance Futures 2017, November 2017, https://www.jbs.cam.ac.uk/fileadmin/user_upload/research/centres/risk/downloads/pool-re-cyber-terrorism.pdf
16 Steve S. Sin, et al, “Determining Extremist Organisations’ Likelihood of Conducting Cyber Attacks.”
17 Lillian Ablon, Martin C. Libicki, and Andrea A. Golay, “Markets for Cybercrime Tools and Stolen Data: Hacker’s Bazaar,” RAND, 2014, https://www.rand.org/content/dam/rand/pubs/research_reports/RR600/RR610/RAND_RR610.pdf
