Slashdot Mirror
Behind the Government's Rules of Cyber War
wiredmikey writes "Deciding when malware becomes a weapon of war that warrants a response in the physical world – for example, a missile – has become a necessary part of the discussion of military doctrine. The Pentagon recently outlined (PDF) its working definition of what constitutes cyber-war and when subsequent military strikes against physical targets may be justified as result. The main issue is attribution of cyber attacks. The Department of Defense is working to develop new ways to trace the physical source of an attack and the capability to identify an attacker using behavior-based algorithms. 'If a country is going to fire a missile at someone, it better be sure it has the right target,' said one expert. A widely held misconception in the U.S. government is our offensive capabilities provide defensive advantage by identifying attacker toolkits and methods in foreign networks prior to them hitting our networks. So when do malware and cyber attacks become a weapon or act of war that warrant a real-world military response?"
Constitutionally, an "act of war" is whatever Congress agrees it to be.
Such decisions are not the Executive's to make.
'If a country is going to fire a missile at someone, it better be sure it has the right target,' said one expert.
Not true, unfortunately. How many wars have started based on false information? Off the top of my head:
* The Spanish-American War: Remember that the Maine sunk by accident
* The Vietnam War: The Gulf of Tonkin
* The Iraq War: No WMDs and no connection to Al Queda.
Constitutionally, an "act of war" is whatever Congress agrees it to be. Such decisions are not the Executive's to make.
Actually they are. An "act of war" is something different from a "declaration of war". Congress has the ability to control declaring a war and the spending on a war, however the president commands the military. In response to an act of war the president may order the US military to attack the perpetrators, this would be a lawful order. For example as soon as the president learned of pearl harbor he could immediately order US forces to attack enemy forces, he did not have to wait for the following day when congress got the paperwork in order and formally declared war.
Just to be clear here, many "hawks" claim to follow "Christian Values".
Let's consider the Old Testament values:
leviticus 24:19-24:21
19 Anyone who maims another shall suffer the same injury in return:
20 fracture for fracture, eye for eye, tooth for tooth; the injury inflicted is the injury to be suffered.
21 One who kills an animal shall make restitution for it; but one who kills a human being shall be put to death.
Now the idea here is when you are wronged, you *can't* inflect more suffering than you suffered. There is a limit.
Then Jesus came along, and said this was an *upper limit* not a lower limit. You should instead return good for evil. In other words, these Christian Hawks should consider the fact that their ideas of bombing someone because of malware doesn't even past Old Testament standards, much less those of Christianity. How does a crashed computer equate to blowing up a house or office and killing who knows how many innocents in the process?
I am getting very tired of wars and conflicts to line the pockets of various corporate interests. How about we start demanding ethical principles of our leaders rather than buying into their excuses to abuse people abroad, and increasingly, Citizens at home. What is it going to take for people to realize that our government is getting out of hand, and is not behaving in line with our moral and ethical traditions? Seriously, we hear more concern out of our Religious leaders about allowing same sex marriage than we do the killing of 10's and sometimes 100's of women and children!
There *is* something seriously wrong with the morals of this country. When are we going to realize that we are supposed to come to people's aid when they are in need, to hear them when they cry out for relief? That we are not supposed to react by blowing them up?
What happens when the missiles get hacked and detonate without launching?
Identify the source and stone the attacker to death.
Questions raise, answers kill. Raise questions to stay alive.
Yes. You attack the people who attacked you, until they don't want to attack you anymore.
-- Let us endeavor so to live that when we pass even the undertaker shall be sorry. -- M. Twain
Some ethical and moral principles apply regardless. I think as an upper limit only inflicting harm proportional to the harm done to you is a pretty reasonable ethical and moral standard regardless of your ethical/moral/religious views.
Some multiple of the harm to you might be okay as a deterrent, in the mind of some.
Almost anyone would consider someone who can forgive and forgo retribution to be someone following a high moral and ethical standard.
See? I think the post *can* apply, even if you are in no way Christian. That is because I am talking about moral and ethical standards here, not about Christianity. But it remains interesting that Christianity demands more from us, and the fact that we don't meet that standard is more of an argument that we are not a Christian Nation than any historical argument (of which there are plenty).
For instance, in the case of bin Laden, we knew for a fact that he was in Afghanistan at the time. We asked them to extradite him, all in accordance with the treaty that both the USA and Afghanistan had signed. The Taliban government refused to honor that treaty. So diplomacy had already broken down, and war was basically the only option.
In your other example, we have good relations with all of those countries, and we hope that their governments are not (very) belligerent towards us, at least not to where they would deny us our rights under extradition treaties. So we go through diplomatic channels, we get them to bust the guy and ship him to us for trial. All nice and peaceful diplomacy. Would we go to war with Canada over one criminal whom they refused to extradite? Probably not.
Now if, let's say, there was some large organized gang operating out of, say, Mexico, which routinely attacked and killed Americans, even up to American police officers, then the Mexican government better damn well be cooperating with our military and law enforcement. And if American government officials got involved in smuggling weapons to that big Mexican criminal gang, maybe for some misguided political reason, and our Justice Department knew about that smuggling and tried to stonewall and refused to deal with that problem and punish the officials who were responsible, well, that would definitely be an act of war against Mexico, as well a a violation of their oath of office by those government officials. And if high officials in our Executive branch not only let it happen, but continued to cover up for the crimes, they would deserve to be extradited to Mexico, and I hope the Mexicans would punish them to the fullest extent of the law.
I don't accept that standard.
The reason is that sometimes the amount of harm done is reduced through no desire of the attacker. Your argument says that the better your bomb shelters are, the less you are justified in attacking an enemy (since by using the bomb shelters, you reduced the casualty count on your side, and if there are fewer casualties on your side, proportional force means you are not allowed to kill as many of the enemy).
This isn't just theoretical. Israel is often the victim of this unbalanced standard. Palestinians lob missiles at Israel. The bomb shelters are too good, so Israel gets told they are using "disproportionate force" when fighting back and killing more Palestinians than are killed by the missiles.
I'd suggest a different standard: you're allowed to use whatever force on the people causing the harm to stop them from doing you harm.
The US should stop putting such stupid people in top military positions, this is extremely dangerous. Is my country going to be nuked the next time a Chinese hacker decides to use a proxy from here?
Cyberwarfare is a fearmongering buzzword so the military types can get all the permissions they need. Just because an exploit is often called an 'attack' , it has nothing to do with a physical attack. Most attacks have a much better real-life analogy:
Cyber espionage
99% of the attacks is actually analogous to some form of espionage. Most attacks aim to get information, which could hardly be classified as warfare. And even the ones that cause informational or physical damage are actually acts of sabotage, a part of espionage.
Cyber espionage has three main properties: it is anonymous, it can be done by a single person or very few people and it can be defended against perfectly.
Thus, a counterattack in case of cyber espionage is impossible as you can't ever be sure who the attacker is, and they might be just a few independent hackers messing around. The optimal course of action is to prepare the defences to resist such an attack, by securing the networks, not placing critical infrastructure on the net, forcing employees to obey security protocols and finally hiring whitehats to test the defences.
Now on the other hand, there IS such thing that can be called:
Cyber warfare
Cyber warfare is also called a denial of service attack, and is fundamentally different from cyber espionage. It's purpose is always the same simple thing: prevent a machine to be accessed from the Internet. Its dangers are that it can disrupt and cause huge losses to companies providing services through the Internet, it can block access to infrastructures that can only be controlled online, and it can prevent the public from accessing certain pieces of information.
Cyber warfare is not anonymous, done by a large number of IP addresses, and can't be defended against. While it can be done by a national "cyber army", even in this case physical retaliation is not advised. It's much easier to just not accept incoming connections from said country untilthe problem is resolved in a diplomatic way. Also, a DoS attack can be done by a group of insurgents/activists or a single botnet controller. In the first case, they should be reported to their country, asking them for action in a form of "cyber ultimatum": if they don't disconnect and investigate those users, connections from the whole country will be blocked. In the case of hacked computers, the owner of the Internet connection should be held responsible for securing it. Thus, even a cyber warfare scenario could be handled without resorting to violence.
Sadly, the Pentagon is full of these aggressive lunatics, and it's even more said that the American government does little against this nonsense.
As others have pointed out, technical attribution is unattainable right now. You'd think this would be a deterrent, but there are some legal theorists out there that suggest imputing responsibility to the country that is hosting the attackers. Think back to the U.S. invading Afghanistan because they were harboring Al Qaeda. Currently, international law permits a state to be held responsible if they have “indirect responsibility” for the actions of third parties within their borders, which means that the state had neglected its duty to prevent persons within its borders from perpetrating crimes against other states. However, if the victim state strikes back, their targets must be limited to the non-state actor attacker unless their lawful cross-border operations are opposed with force by the host state. So, there's still an attribution problem, it's just closer to the legal grey area.
Going back to the original question of when a cyberattack might warrant a kinetic counterstrike, I'm going to delve into the really boring legal terminology here. There are several different areas of law to look at. First, you have the jus ad bellum (or jus in bello, depending on what stage of the conflict you're in) requirements of military necessity, proportionality, and distinction under the law of war. Distinction just means you can, for the most part, avoid targeting noncombatants. Whether the necessity requirement is met involves determining whether a more peaceful resolution would be possible, evaluating the nature of the aggression and each party’s objectives, and estimating the likelihood that intervention would be effective. Proportionality requires the response to be limited to the amount of force that is reasonably necessary to interrupt an ongoing attack or to deter future attacks, but does not require the response to be limited to the amount or type of force initially used by the attacker. So the main things that they would be evaluating, if they're following the laws of war, would be necessity and proportionality.
Then, you have Articles 2(4), 39, and 51 of the United Nations Charter to give additional guidance (insofar as they can). Under 2(4), uses of force are prohibited. Under 39, responses to uses of force have to be approved by the UN Security Council, or they can be justified as self defense under Article 51. But Article 51 also requires the initial attack to have been an "armed attack," which probably means something more than a "use of force," which is ever so helpful since the UN Charter was written only with kinetic attacks in mind anyway. When people are talking about applying these provisions to cyberattacks, a bunch of legal scholars have come up with several different names for the same thing - look at the attack, then figure out if it's the kind of attack that would be prohibited under 2(4) (maybe considering the action itself or its effects), and then decide from there whether self defense is justified under Article 51. So basically, no, I don't have much of an answer, I just have a lot of tests to look at for case-by-case situations. Lawyers suck like that.
One of my sources for some of this information: David E. Graham, Cyber Threats and the Law of War, 4 J. NAT'L SECURITY L. & POL'Y 87
TL;DR - This question (when can cyberattacks justify kinetic attacks in response) is hard. But if a cyberattack went after a country's SCADA system, causing a failure in the electrical grid or dumping sewage into the water supply, I'd say that's probably the easiest situation where a kinetic response would be permitted under the law. Asked another way, if Stuxnet had caused a nuclear meltdown that destroyed more property and injured a lot of people, instead