This is really two posts in one: some reflections on where I was on 9/11, and some of the follow-on effects.
Eight years ago this morning, I was sitting in a conference room at the National Security Agency with a number of colleagues from university programs in infosec education. We were awaiting a speaker to address us on the topic of counter-terrorism. The speaker was late, and then someone came into the room and told us the schedule had changed – and turned on the TV to CNN’s live coverage of the burning World Trade Center tower, hit by flight 11 a few minutes earlier. We watched as flight 175 crashed into the second tower. Our hosts seemed unable to determine what we should do next, until the order came to evacuate the buildings – all nonessential personnel were told to evacuate.
As we were exiting the building, Flight 77 crashed into the Pentagon.
The ensuing traffic jam was a nightmare. I sat in my rental car with Peter Freeman, then the dean at Georgia Tech, for nearly 2 hours as traffic crawled out of the parking lot and towards our hotel in Linthicum. Our group reassembled in the restaurant, watching TV, trying to get a cell phone signal to call our homes, and discussing what was happening.
My personal experience with this was confounded by having my father in a hospital in Alexandria, having suffered a stroke on 9/8. Unbeknown to me, he was moved to another facility that afternoon as part of a regional disaster plan, to make room for more potential victims if there were other attacks. It took me a day to find him, and several more days to complete arrangements for his care after I went home. I then drove all the way back to Indiana in a rental car, as air travel was still not operational.
It also changed my own personal plans in several major ways. When I returned to Purdue, I found the completed forms for my planned sabbatical, awaiting only my signature ….to go be the first CTO at the NSA. General Mike Hayden (then DIRNSA) and I had discussed a project to examine how to modernize some of the computing internally, and to get a sense of what would be good to build into the university curriculum to train for a new era of computer threats around the world. As a result of 9/11, Gen. Hayden recommended that I cancel my plans, as the environment would not be the same (obviously), and would not likely be something I would enjoy or benefit from.
I basically lost my sabbatical. It was too late to cancel with the university, and I was unable to make alternate arrangements, so I resolved to stay at home and catch up on reading and writing. Within the next few months both of the most senior staff at CERIAS had left for better arrangements (for them) and I ended up working more than my regular position simply to keep the center going. It was not pleasant, and although I was able to hire outstanding replacements, it was not immediate.
It was the second of three of my sabbaticals that have all been occupied with external events such that I did not really get a sabbatical. And each time, Purdue has charged me for the time and I have ended up more drained than refreshed. Ah well, that is minor compared to the world events here.
9/11 changed the attention that we were beginning to get on cyber security, too. Our meeting that morning of educators and researchers was enabled by interest generated by Richard Clarke and Mike Hayden (among others). Soon thereafter, everyone was focused on issues related to further (non-cyber) attacks, and momentum was lost on the efforts we had spent years to build. That is not to suggest that such a focus was incorrect, but one wonders what our cyber security would be like now without the 9/11 incident? (Dick Clarke kept some focus on our community, and I visited him several times in the following two years before he left government. He always understood the role of cyber security, but the policy environment was all focused elsewhere.)
The Scholarship for Service program started up around that time, and the public concern and a desire to “do something” led many people to enroll in the program. We had a large number of students in our program over the next few years (although it tapered off to only one remaining student this year). Most of our former students are still working in the government, some in senior positions. That clearly was one ray of sunshine in the gloom.
It is only now that some focus has really returned on Cyber from the Congress and the White House. Even so, it is primarily directed towards “cyber war” and “cyber terrorism” as boogeymen, rather than the more general problems of crime, fraud and abuse. We continue to be drained by cyber crime, with some estimates of the damage as high as $100 billion per year. That is a heavy burden to continue to bear.
I was asked to give a talk at Tufts University yesterday, and to look at the 9/11 incident as part of my talk on security. I came up with some some numbers, and an interesting quote.
It is generally understood that the Al Qaeda goal of the 9/11 attack was to try to foment unrest among Muslims around the world, to rise up against the West and re-establish the Caliphate. They completely misunderstood the overall world reaction to the attack. Although there was celebration in a few places (such as by the Palestinians), there was near universal outrage, and great solidarity of purpose. The invasion of Afghanistan to overthrow the Taliban and get the leadership of Al Qaeda had widespread support.
Then, for reasons that still do not make sense to many of us, before we (as an international community) finished the task at hand, President Bush & company initiated the invasion of Iraq – despite no threat from Iraq, and no connection with Al Qaeda. Rather than editorialize on that, let me simply list some numbers:
- Number of casualties from the 9/11 attacks: 2974 (and 19 hijackers)
- Number of US casualties from all domestic terrorism from 1900 to 2000: about 250
- People killed by Timothy McVey 4/19/95 in Oklahoma City: 168 (about 2/3 of total)
- Deaths of US military personnel since 2001 in Afghanistan and Iraq: 5130
- Estimated number of civilian deaths in Iraq and Afghanistan from military operations: 1,339,771
- Estimated direct cost of the military actions in Iraq and Afghanistan: $908 billion and growing.
- Estimates of indirect, eventual costs to the US: $1-$2 trillion more.
- Refugees from Iraq as a result of hostilities: 4.7 million. Another 1 million from Afghanistan.
Yet, we have a paradoxical response to losses that happen regularly, over time. Consider:
- 443,600 people will die this year as a direct result of smoking.
- Approximately 20,000 people die a year because they do not wear their seatbelts.
And yet we have people fighting to be allowed to smoke and go without seat belts.
I wonder how each of the 2974 victims of the 9/11 attacks would react to hear that, as a response to each and every one of their deaths, the US and its allies spent $675 BILLION apiece to kill 450 people in the Middle East and cause another 1916 to be refugees from their homeland. Oh, and for each of those victims, 2.2 coalition military personnel died, and as many as another 1000 suffer permanent injuries.
And the architects of the 9/11 attack are still free and plotting more mayhem.
I have no grand, sweeping conclusion from all of this. Terrorism is clearly a bad thing. So is untimely death. I fear the greater tragedy, however, is losing sight of how we, as civilized society, treat the lessons of the 9/11 tragedy and its aftermath. Osama bin Laden was quoted as saying:
“All that we have to do is send two mujaheddin to the furthest point east with a flag on which is written the words al-Qaeda, and the Americans will panic and send a general and an army there, and engage in military operations which cost them blood and money and political capital, and then we’ll just do it again. … so brothers, we’re pursuing this strategy of bleeding the United States to exhaustion and bankruptcy.”
As a country, we tend to react violently when attacked overtly – we remember the Maine, we remember the Alamo, we remember Pearl Harbor, and we certainly remember 9/11. We grieve for those who lost their lives suddenly. We condemn the evil deeds that caused their untimely deaths. We seek some justice and retribution, usually in the form of war.
Let us pause to mourn the fallen, but focus on a better future for all, because we seem to be doing what the terrorists want. And that does not bode well for a peaceful future. I have lived through one 9/11 catastrophe. I do not wish to see another.