With "Cyber" Attacks, Effects Matter More Than Means
I enjoyed reading Stuxnet Poses Interesting International Cyber Law Issues by Rick Aldrich in IAnewsletter Vol 14 No 2 (pdf). I've known the author since my days in the USAF and he's very clued-in as a CS grad from USAFA and a lawyer who worked for AFOSI. I'd like to share a few excerpts. Please try to avoid fixation on Stuxnet if that topic bothers you. Stuxnet is not the core of Alrich's argument.Article 51 of the United Nations (UN) charter states in pertinent part, “Nothing in the present Charter shall impair the inherent right of individual or collective self-defense if an armed attack occurs against a Member of the United Nations.” [8]
So can a cyber attack, such as that evidenced by Stuxnet, constitute an “armed attack?”
Clearly at the time Article 51 was written, in August of 1945, such an attack was never envisioned. Traditionally the term “armed attack” has connoted a kinetic attack – missiles, bombs, bullets and the like – but it has never been definitively defined.
Incidents like the cyber attacks against Estonia in 2007 and against Georgia in 2008 have prompted renewed interest in defining if or when a cyber attack can also constitute an “armed attack.”
International legal scholars are increasingly moving away from the means of attack and instead looking to the effects.
The test would be whether the effects of the attack are similar to those of a kinetic attack.
Cyber attacks that result in physical damage, such as the destroyed centrifuges in the case of Stuxnet, may be pulled under the rubric of an armed attack, though this approach does not rule out attacks resulting in non-physical effects if the harm is substantial.
This is fascinating, because it makes "cyber" less relevant and requires judgement regarding the consequences of an event. Clearly physical harm takes precedence here, but the underlined portion shows that even digital events without physical harm could still be considered attacks, in the eyes of legal experts.
The article raises other interesting points, such as options for Iran, but I wanted to emphasize the points I listed above.
Tweet
Comments
In modern times the most powerful weapon is news. It is not the banking, banking is a very strong, but artificial dependency, at least in Estonia.
There are legends that perhaps the most powerful cyber attack was in 1982 from CIA to soviet union, that created the worlds most powerful non-nuclear explosion, gas lines controllers were modified. I do not know if they are true.
Another interesting case is Latvia. Somebody copied all of the income tax information and published information on some politicians. The real question was not about what was published, but what other politicians had to do so that they would not to be published.
Juhani
defenders, on the other hand, still need to know about methods. countermeasures are so called because they counter the measures of others. effects (or potential effects) should obviously inform their decisions about what to prioritize, though.
What if someone frames Iran for taking down a NYC water grid for an hour, can US then legally nuke them?
These are extreme examples and surely there are flaws, but I wanted to make a point: traditional (kinetic + NBC) warfare has had a long history and we've arrived at a point where global wars are no longer fought, partially, because we have a good set of rules for these kinds of activities based on centuries of refinement.
Cyberwar should not be governed by the same rules, just because there is "war" in it. If anything, I would rather see it governed by WTO than UN.
But I'm still not comfortable at all lumping cyber attacks (or any digital mischief) with kinetic attacks.
I'm actually a little more interested in what the intelligence/espionage community would say on such topics, since I think it fits more into their models of behavior than militaristic activity.
I'm sure the problem of attribution will come up at some point. It's pretty clear when a kinetic attack happens who is behind it and it's very clear when it happens (ok, some unofficially-sponsored groups are exceptions).
-LonerVamp
An enemy EW vessel at sea, that's otherwise unarmed in the kinetic sense is causing serious disruption to my vessel's radar and communication systems, and therefore its combat capability.
Is the enemy EW vessel considered to be a combatant? If not, what if hostile aircraft are also on an inbound track to my vessel's position?
http://www.au.af.mil/au/ssq/2011/spring/dunlap.pdf