08 Oct Cyberwar in the LA Times
Today’s LA Times has an op-ed I wrote arguing that states need to tailor the law of war and the prohibition on the use of force to cyberspace. This is a shorter version of a piece I posted on SSRN a few months ago (more details here). I’m still working on a longer, law-review length treatment now so comments would be welcome.
Meanwhile, evidence continues to mount, suggesting that cyberwar and information operations are moving back to the front burner for states and their militaries. President Bush acknowledged as much during the recent round of accusations that the Chinese People’s Liberation Army had hacked into an unclassified DOD computer network. As I mention in the op-ed, moreover, the United States’ capacity to use cyberattacks to destroy infrastructure is now a matter of public record. Moreover, last week accusations emerged that Israel had hacked Syria’s air defenses in order to launch a targeted bombing run against targets in Syrian territory. Ten years ago, cyberwar was the stuff of theory. Today, it sure looks to be part of the new reality.
I think the author of the article quoted below pulls out what is probably the key problem.
Under current law, you have to know who and where. But in cyber operations, the one thing you almost never know, at least quickly enough to do anything about it that matters, is who and where.
That’s where you should focus. There and on the implications for civil liberties and privacy implicated in a change of approach. How do we get the balance right?
See Harvard Journal of Law &Technology, Volume 20, Number 2 Spring 2007
GETTING IT RIGHT: PROTECTING AMERICAN CRITICAL
INFRASTRUCTURE IN CYBERSPACE
Sean M. Condron (Judge Advocate, U.S. Army. Presently assigned as an Associate Professor, International
and Operational Law Department, The Judge Advocate General’s Legal Center and School, Charlottesville, Virginia.)
“The views expressed in this article are those of the author and do not reflect the views of the Department of Defense or the Department of the Army.”
“Attribution and characterization are especially important in the context of cyber warfare. A state must attribute an attack for two reasons. First, attribution helps to ensure that a state does not target an innocent person or place. Second, a state must attribute an attack because the laws governing a permissible response vary depending on whether the attacker is a state actor or a non-state actor. A state actor includes state employees, such as members of the military, as well as
independent contractors, such as hackers hired to launch a cyber attack. A non-state actor is someone acting individually or a member of a terrorist organization. If the attacker is a state actor, the response must comply with the United Nations Charter and customary international law. On the other hand, if the attacker is a non-state actor, domestic criminal law will likely govern the response.
In addition, international law requires a state to characterize an attack to avoid using force against an entity that inadvertently launched a cyber attack.
A state may be able to use force against a hostile attack under its own laws, but international law prohibits the use of force against an inadvertent attack.
When a state defends itself using an active defense measure, additional international law implications arise. The principles of necessity and proportionality forbid “retaliatory or punitive actions. . . . [I]n
particular, the means employed for the defence have to be strictly necessary for repelling the attack.” Yet the principle of proportionality does not limit “a state, victim of an armed attack . . . to expelling the
foreign troops from its territory in exercising its right to self-defence, but [also allows pursuit] across the border into their territory.”
The current jus ad bellum paradigm does not offer adequate safeguards from cyber attacks.The problem with cyber warfare is that technology makes it nearly impossible to attribute the attack to a specific
source or to characterize the intent behind it. Moreover, a cyber attacker can launch her assault with the push of a key, completing the attack almost instantaneously. A legal system that requires a determination of the attacker’s identity and intent does not account for
these features of the digital age. The current international paradigm therefore ties a state’s hands, making it difficult to effectively respond without risking a violation of international law.
To address the unique nature of cyber warfare, international law should provide a safe harbor for states who initiate a good-faith response to an attack, thus acting in cyber self-defense, without first attributing and characterizing the attack. …
A preferable governing principle would be: when the
attack targets the state’s critical infrastructure, the state should be able to exercise active defense measures or launch a cyber attack in response without incurring liability. In order to avoid an exception
that swallows the rule, states should be required to maintain a publicly available list of critical infrastructure, which a state may protect with
active defense measures and, if the identified critical infrastructure were subjected to a cyber attack, a state could respond in cyberspace without first attributing or characterizing the attack. In these circumstances,
such an exception would not fundamentally alter the jus
ad bellum framework, but would instead allow the state to exercise its inherent right of self-defense.”
“The anonymity of cyber attackers is not only a practical problem. It also raises civil liberties concerns. While cyber attacks by a foreign nation launched from abroad are unlikely to implicate constitutional liberties, the same cannot be said for cyber attacks originating on
United States soil. The possibility of employing active defense measures against United States citizens may infringe certain civil liberties normally enjoyed by Americans. Although a cyber attack on critical
infrastructure may threaten national security, the United States should take into account the civil liberties of the individual American citizen when determining the proper response. The law must therefore adjust
traditional understandings of the right to privacy, the right to protection against an unreasonable search, and the right to due process, given the practical necessity of responding to cyber attacks before determining the attacker’s identity and intent.”