Search

Throughout history, the law of warfare has evolved to protect non-combatants and limit collateral damage. The same legal and ethical constraints apply to the conduct of cyber warfare, where it is similarly desirable to limit the effects of offensive actions to specific locations and groups. However, conventional wisdom suggests that this is extremely difficult, if not impossible to accomplish in the cyber domain. In this paper, we argue to the contrary. It is possible to constrain the effects of cyber actions to specifically desired, legitimate targets while significantly limiting collateral damage and injury to non-combatants. To this end we present a generalized methodology for analysis of the targeting and effects of cyber operations with respect to principles of lawful conduct in armed conflict. This methodology includes a framework of effects categories, target attributes and control measures to direct and constrain cyber operations. It also includes a process for evaluating these effects and controls against the principles for lawful conduct in armed conflict. We illustrate the methodology in action by applying it to W32. Stuxnet, software widely considered to be a cyber weapon. Our results indicate that it is entirely possible to analyze complex cyber war problems, identify legally authorized courses of action, and focus effects on desired targets while greatly minimizing collateral damage. [ABSTRACT FROM PUBLISHER]

According to its recently published cyber strategy, the U.S. seeks to develop international consensus on how traditional law of armed conflict (LOAC) norms and understandings are modified and applied in cyberspace to help secure this global commons. Although the International Committee of the Red Cross's Interpretive Guidance on Direct Participation in Hostilities and the recent U.S. cyber strategy documents and policy statements are very different in many ways, examination of the relationships between their different aspects could be very useful in setting terms of reference framing the discussions which must occur to develop consensus on how LOAC rules and understandings regarding direct participation in hostilities could be adapted for use in cyberspace. This requires identification of their respective strengths and weaknesses, and potential areas of common ground between them. To be useful, this examination must include consideration of the significance of rules of engagement, formulations of hostile intent, and the proper inferences to be drawn from intelligence analyses as well as the legal standards by which direct participation in hostilities is determined. [ABSTRACT FROM PUBLISHER]

The class of combatant constitutes one of the most important instrumentalities of the law of war. Combatant status resolves critical and enduring legal questions such as immunity from prosecution for warlike acts, susceptibility to intentional targeting, and, in part, treatment upon capture. Since the late nineteenth century, codifications of the international law of war have included criteria for combatant status keyed to ensuring desirable battlefield conduct and, to the extent possible, humanity in war. This paper revisits the author's prior work on the topic of combatancy in cyber warfare. Building on recent public revelations concerning state capacity for offensive cyber attacks, as well as new developments in computer network attack, this paper highlights logical and normative shortcomings in current understandings of combatant status in cyberspace. In place of rote reliance on existing criteria intended for the kinetic battlefield, this paper proposes reliance on State affiliation as the sole criterion for evaluating combatant status in cyber warfare between States. An admitted interpretive gloss on current criteria, the proposed framework offers a workable and realistic reconciliation of humanitarian goals and emerging State practice in cyber warfare. [ABSTRACT FROM PUBLISHER]

Despite a greater willingness on the part of States to enter into a dialogue on the potential implications of cyber warfare, there is continued disagreement on whether new rules are required to govern this ‘new domain’ and, if so, whether such rules should be in codified form or be left to evolve through a natural progression of customary international law. Closely interlinked with these questions is the distinct issue of whether there is a need for an arms control treaty. To speak of an arms control treaty or the regulation of a particular weapon by reference to the law of armed conflict (LOAC) is to presuppose a common conception of the particular type of weapon that is under discussion. This paper therefore poses the question, ‘What is a cyber-weapon?’ before considering whether an arms control treaty is a feasible option, let alone whether such a treaty would be capable of addressing the concerns that have been raised by its proponents. This paper also considers existing LOAC rules to identify the issues that are unique to cyber-weapons and, in doing so, it is argued that further clarification is indeed merited. [ABSTRACT FROM PUBLISHER]

Cyber conflict may not be new, but it is far from old. And as with any other major, disruptive global trend, there are vexing questions on which traditional international norms still apply, whether they apply but with modifications, or whether entirely new norms must be invented. One of the most important norms has been for states to be able to remain neutral in response to international conflict, with rights and responsibilities guaranteed by the Hague Convention. Because of the nature of cyber conflict, such legal norm may be less useful than a modified norm of political neutrality. The Internet protocols themselves route cyber attacks through any number of neutral countries, cyber conflicts are usually not so destructive to obviously trigger international law, and the identity or nationality of the belligerents may not be obvious. Nations might (and probably should) accordingly come under political pressure to take reasonable steps to stop cyber attacks, regardless of whether or not it is a formal treaty obligation. This paper explores this issue and ways a nation may be less than neutral, tying this to a ten-point spectrum of state responsibility to help determine just how responsible a nation might be in a cyber conflict. To illustrate potential new norms in action, the paper then describes a notional cyber conflict which shows how the nations' rights and responsibilities are influenced by the four factors of severity, obviousness, “stoppability,” and duration. The paper concludes with a short section on the commercial neutrality during cyber-conflict, given the critical role that the private sector has played in the creation and operation of cyberspace. [ABSTRACT FROM PUBLISHER]