Threat of Isis' Hacking Powers Divides Officials and Security Experts

George Osborne, the British chancellor of the Exchequer, said in a speech last month that Islamic State militants were trying to develop the ability to carry out digital attacks on critical systems, like hospitals, air traffic controls and power plants.

In the United States, Clifton Triplett, the new cyber-security adviser hired by the Office of Personnel Management to help get the agency back on track after a series of hackings traced to China, said this month that he expected the Islamic State, also known as Isis, might ultimately breach the agency's systems, too.

But private security researchers who track the Islamic State's online efforts say the group's capabilities are in fact not much better than those of tech-savvy teenagers who deface websites for thrills. That view illustrates a growing perception gap between officials' fears and what security experts consider a believable threat.

Indeed, two men considered the Islamic State's most sophisticated hackers have been sidelined. One is dead; the other, in jail.

"To date, the attacks attributed or believed to be conducted by Isis have been embarrassing, but not necessarily complex or sophisticated," said Christopher Ahlberg, the chief executive and co-founder of Recorded Future, a company based in Somerville, Massachusetts, that analyses online threats.

Ahlberg cautioned that the Islamic State is trying to recruit replacements for the hackers it lost.

Indeed, the online focus of Islamic State members and sympathizers has been recruitment, not computer attacks.

A search of password-protected, online Isis forums by Recorded Future yields mild discussion of digital attacks elsewhere on the web, for instance, those launched by the activist hacker group known as the Lizard Squad. But little emerges on politically motivated hacking planning or substance.

Of the two Islamic State sympathizers believed to have the most sophisticated hacking skills, one, Ardit Ferizi, a 20-year-old citizen of Kosovo, has been imprisoned in Malaysia. He is awaiting extradition to the United States where he faces up to 35 years in prison, according to a Justice Department indictment.

The other, Junaid Hussain, a 21-year-old British-born Pakistani who is credited with breaking into the US Central Command's Twitter and YouTube accounts in January, was killed in a drone strike in Syria in August.

"Junaid Hussain and Ardit Ferizi are exactly the type of people Isis is trying to recruit," Ahlberg said.

© 2015 New York Times News Service