Next March will see governments in Canada, Australia, New Zealand, the UK and the US, along with many global companies, conduct a massive global cyber-war game called Cyber Storm II. This follows a similar war-game called Cyber Storm I that was conducted in February 2006.

A US Homeland Security (HS) report released in September 2006 about the first war-game shows a heightened interest on the part of police and military agencies, as well as corporate head offices, in the activities of on-line bloggers, independent media and public demonstrators.

The report, issued September 16, 2006, says the purpose of Cyber Storm I, the largest cyber-related test run by HS, was to simulate a large coordinated cyber-attack by extortionists demanding a significant ransom, in order to learn what was required of governments and corporations at all levels to prevent such a thing and to mitigate its effects. But the details of the simulation betray a much different concern.

A significant lesson learned by HS in the cyber-war game was apparently the role of bloggers and independent media outlets jamming up the works with “misinformation.” As the Associated Press reported in 2006, “Participants [in the cyber-war game] confirmed parts of the worldwide simulation challenged government officials and industry executives to respond to deliberate misinformation campaigns and activist calls by Internet bloggers, online diarists whose ‘Web logs’ include political rantings and musings about current events.” But it was more than just parts of the game that was concerned about activists; it was all of the game.

Citizen activism seems to have formed a particular focus for HS, and it shows in their organization and simulation of the game, and in their analyzing of the results afterward. “More damage could have occurred as a result of erroneous and panicked public responses to incorrect media coverage,” the report notes, “than by actual attacks by the adversary.” It goes on to add that the response team “was significantly challenged by the adversary’s robust media campaign that accompanied the cyber attacks, and may warrant re-examination for possible adjustments.”

According to a June 2006 HS document, the imagined scenario involved a multi-faceted attack coordinated by a fictitious organization called Worldwide Anti-Globalization Alliance (WAGA), working with other groups called Freedom Not Bombs, The Peoples Pact, and The Black Hood Society. During the attack, WAGA would be holding “ongoing protests surrounding WTO [World Trade Organization—a real entity] and DEUI [an unknown entity] meetings, and would be conducting a “virtual sit-in.” After issuing a call for an attack, related groups and individuals, including a disgruntled airline employee, Augie Jones, a cyber saboteur, some hackers, the Internet Techno Front, and some Berlin-based mysterious individuals called The Tricky Trio, would pull off stunts like altering the national No Fly Lists, defacing national newspaper web pages, tripping electricity transmission lines, issuing false Amber Alerts, posting personal SIN numbers online, and knocking out the heat to government buildings.

Among the more mysterious episodes would be “Tricare Botnet discovery” (Tricare is the US military health system), and a software update that crashes the FAA Control System.

WAGA is described as an “anti-capitalist” organization that targets transnational companies and seeks to “maintain cultural diversity [and] target language standardization [and] currency standardization (the Euro-dollar),” the document helpfully indicates, and is “anti-imperialist” and “targets the US for pushing English around the globe.”

The Peoples Pact is described as “an anti-nuclear group” while Freedom Not Bombs is described as “anti-NATO” interested in “non-violent disruptions.” The document is not without humour. In describing WAGA, it says the group also targets “the national reliance on cyber services [which are] a product of Globalization. (The irony of its attacker.)”

The simulated scenario included “complementary physical demonstrations and disturbances targeting the energy, transportation, and IT/telecommunications sectors.” Among the imagined problems, in addition to the FAA Control System crash presumably grounding all aircraft, are commuter rail systems going down, subway systems grinding to a halt, the Red Cross messaging system screwing up, PayPal accounts all registering zero, massive power outages, Internet connectivity crashes, cascading Internet router failures, and threats to oil and gas pipeline operations.

The simulated attack also imagined, curiously enough, targets within government intended to “undermine public confidence in the government(s).” This would in part be accomplished through “social engineering” on the part of WAGA, the report says. The issue of public confidence arises in several other places in the September follow-up report as well. “The planning and response process,” this report notes, is crucial “as it plays a vital role in shaping public and consumer response and confidence.” An example is provided: “As the Transportation Sector observed, publicly-released information on a private sector entity could undermine consumer confidence and have potentially large-scale negative impacts on their business viability.” And again, later, the report notes that press releases to the media would not be sufficient in this regard, so that “tangible demonstration of response activity is equally vital in providing the public with the reassurance needed to maintain general public confidence.”

The role of public confidence in their governments in the case of a massive failure in national and global infrastructure seems to have played a key role in Cyber Storm. A crucial aspect of the Cyber Storm war game, in addition to vague public “demonstrations and disturbances” was also the “adversary’s” “exacerbation of public and market responses by encouraging and injecting believable but misleading information in the media.”

When one thinks back to the fall of 2003, during the lead-up to the US launch of a war of aggression on Iraq, one is reminded of much “believable but misleading information in the media” spread by the White House. And when one recalls the immediate aftermath of Hurricane Katrina, one is reminded of why public confidence in the role of government during significant events is ebbing. The Homeland Security report on Cyber Storm notes that the combination of the public demonstrations, cyber-attacks, and critical media commentary it envisions would affect everything the State governments do, including, it specifically pointed out, “welfare and licensing.” The scenario of the cyber-war game also envisioned public demonstrations and disturbances specifically at energy installations. It included a “significant challenge” for governmental authorities in combating “misinformation” spread through the media. And it concentrated very specifically on the role of public confidence in government in testing whether the participating nations, which included Canada, the UK, Australia and New Zealand, were prepared for such a large failure.

Had the scenario not been a game, but was in fact reality, what would it have looked like to us? Large public demonstrations would be picketing gasoline stations and oil refineries. Welfare offices and licensing bureaus would suddenly be closed. Online and independent media would be reporting on collapses in the supply of food and gas as the transportation sector shut down. Large parts of the population would express serious doubt online and in independent media about what their governments were doing or were able to do about it all. And then, in the midst of the calamity, the White House would issue a press release announcing that all the troubles originate with a small group of Berlin-based mysterious saboteurs strictly interested in self-enrichment through a conniving extortion scheme.

It’s no wonder they’re worried. No doubt pre-written and ready-to-print editorials for papers like the National Post blaming a small band of criminals or terrorists are one of the crucial “adjustments” the report calls for in combating public perceptions when the national infrastructure inevitably goes kaput as a result of, for example, a skyrocketing surge in gasoline prices brought on by peak oil or an attack on Iran, and governmental failure at all levels to plan for it.