Computer attacks on critical national infrastructure: A use of force invoking the right of self-defense

Stanford Journal of International Law

Volumn 38, Issue 2, 2002, Pages 207-240

  Jensen, Eric Talbot ^a  

^a U S ARMY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

EID: 26044472171     PISSN: 07315082     EISSN: None     Source Type: Journal    
DOI: None     Document Type: Review

References (290)

1. QIAO LIANG & WANG XIANGSUI, UNRESTRICTED WARFARE 75 (FBIS trans. 1999),
2. quoted in ARNAUD DE BORCHGRAVE ET AL., CENTER FOR STRATEGIC & INTERNATIONAL STUDIES, CYBER THREATS AND INFORMATION SECURITY MEETING THE 21ST CENTURY CHALLENGE 8 (2000), available at http://www.csis.org/homeland/reports/cyberthreatsandinfosec.pdf.
3. See generally DOROTHY E. DENNING, INFORMATION WARFARE AND SECURITY (2000) (describing the common computer hacker tools employed in information warfare and possible defense strategies). A detailed description of these techniques is beyond the scope of this Article. However, a brief introduction to some standard hacker tools is valuable as a baseline for the discussion that follows. A Trojan horse is a "program that, when activated, performs some undesirable action not anticipated by the person running it. It could delete files, reformat a disk, or leak sensitive data back to its author."
4. Id. at 259. A logic bomb, or time bomb, is a Trojan horse that is "triggered by some event."
5. Id. at 259. A virus is a fragment of code that attaches itself to other computer instructions, including software application code . . . performs some function and then turns control over to its host . . . . The resident copy watches for uninfected hosts [and] inserts a copy of itself in the host. The virus may then execute a "payload," which can do anything from displaying an amusing or political message to wiping out files on the hard drive.
6. Id. at 269-70. A worm is a program that propagates from one computer to another over a computer network by breaking into the computers in much the way that a hacker would break into them. Unlike viruses, they do not get any help from unwitting users. They must find a computer they can penetrate, carry out an attack, and transfer a replica of their code to the target host for execution. In effect, a worm completely automates the steps taken by a computer intruder who hops from one system to the next.
7. Id. at 280. Denial of service attacks deny legitimate users access to information sources by destroying data or disrupting operations. Id. at 231. Code breaking entails "acquiring access to the plaintext of encrypted data by some means other than the normal decryption process used by the intended recipient(s) of the data. Code breaking is achieved either by obtaining the decryption key through a special key recovery service or by finding the key through cryptanalysis."
8. Id. at 408;
9. see also George K. Walker, Information Warfare and Neutrality, 33 VAND. J. TRANSNAT'L L. 1079, 1100-01 (2000) (defining common hacker tools).
10. THE JOINT CHIEFS OF STAFF, JOINT PUB. No. 3-13, JOINT DOCTRINE FOR INFORMATION OPERATIONS 1-9 (Oct. 9, 1998), available at http://www.dtic.mil/doctrine/jel/new_pubs/jp3_13.pdf (defining computer network attack as "operations to disrupt, deny, degrade, or destroy information resident in computers and computer networks, or the computers and networks themselves. Also called CNA").
11. As used in this Article, computer network defense will mean measures, active or passive (discussed infra), which prevent or safeguard the computer or network from the actions of computer network attack. Together, CNA and CND constitute CNO, or computer network operations. In the Pentagon's 1999 Unified Command Plan, CND was assigned to U.S. Space Command. The next year, Space Command was also given responsibility for CNA; and in April of 2001, Joint Task Force CND was changed to become Joint Task Force CNO. Michael C. Sirak, Threat to the Nets, A.F. MAG, Oct. 2001, at 24.
12. U.N. CHARTER, reprinted in 3 BEVANS 1153.
13. Source: Custom, 1 Hackworth DIGEST § 3, at 15-17.
14. For the purposes of this Article, a "hacker" is someone who conducts a computer hack, or "gain[s] access to or break[s] into electronic systems, particularly computers and telecommunications systems" and "includes 'crackers,' who break access codes and computer locks, and 'phreakers,' who crack and exploit phone systems." DENNING, supra note 2, at 44.
15. Dan Verton, Think tank warns that Microsoft hack could pose national security risk, COMPUTERWORLD (Dec. 27, 2000), available at http://www.computerworld.com/cwi/story/0,1199,NAV47-81_STO55656,00.html.
16. BORCHGRAVE ET AL., supra note 1, at iv.
17. Verton, supra note 8.
18. Source code is defined as the "[w]ritten instructions for a program in a form readable by humans. Must be translated or 'compiled' into object code in order to be executed by a computer." MARK A. LEMLEY ET AL., SOFTWARE AND INTERNET LAW 1098 (2000).
19. Microsoft strongly disagreed with CSIS's report. Verton, supra note 8. A Microsoft spokesman further stated: [A]fter tracking the intruders and investigating their activities, there is no evidence and no basis to believe that they had any access at all to Windows or Office source code. That is, we have no reason to believe that the intruders were able to see Windows or Office source code, much less modify it. Microsoft's current and future products remain intact and secure, and customers can use them with confidence.
20. Verton, Supra note Id.
21. BORCHGRAVE ET AL., supra note 1, at iv.
22. John Schwanz & Ariana Eunjung Cha, Respite Follows Hacker Attacks; Vandals Pursued by Law and Peers, WASH. POST, Feb. 11, 2000, at El (cataloging a number of large U.S. companies that have been the object of recent hacking).
23. BORCHGRAVE ET AL., supra note 1, at iv.
24. Id. at 7.
25. Id. at i-ii.
26. Id. at 9;
27. see also Jim Wolf, Hacking of Pentagon Computers Persists, WASH. POST, Aug. 9, 2000, at 23 (reporting that of those 22,144 attacks, "all but 1, 000 of [1999's] reported attacks were attributed to recreational hackers"). "According to Interpol, 30,000 hacker web sites currently exist on the Internet. In the ten years between 1989 and 1999, there were only 34,000 reported global hacking incidents in aggregate, but between January and October 2000 alone, 50,000 incidents were reported . . . . So far this year, the number of attacks is up roughly 10 percent, with over 14,000 electronic attacks detected in the first seven months of the year alone."
28. BORCHGRAVE ET AL., supra note 1, at 9;
29. see also Elinor Mills Abreu, Israel, US Leading Sources of Cyber Attacks, JERUSALEM POST, Jan. 29, 2002, at 11 (Economics Section), where the author states: "The study found attacks that appeared to originate in the US - nearly 30% of the total - were nearly triple the second-ranked country. But only about 3.5 attacks were made per 10,000 US Internet users, compared with 26 attacks per 10,000 Internet users in Israel." The author also states that this rate for Israel of hacks per ten-thousand Internet users is the highest for any country, followed by Hong Kong, Thailand, South Korea, France, Turkey, Malaysia, Poland, Taiwan, and Denmark.
30. Elinor Mills Abreu, Israel, US Leading Sources of Cyber Attacks, JERUSALEM POST, 2002, at 11 Id.
31. David A. Fulgham & Robert Wall, Global Hawk, J-STARS Head for Afghanistan, AVIATION WK. & SPACE TECH., Nov. 5, 2001, at 26. Economic damage from these attacks totaled an estimated $17 billion in 2000.
32. Marilyn Geewax, 'Red Worm' Shows Dangers of Cyber-Terrorism. Web Attacks Could Wreak Havoc, PALM BEACH POST, Aug. 13, 2001, at A1. Further, a recent Defense Science Board report found that ninety-nine percent of the National Security Agency "red team" attacks on DOD computer networks went undetected despite the use of known hacking tools. See
33. Sirak, supra note 4, at 26.
34. BORCHGRAVE ET AL., supra note 1, at 9.
35. st Century: International Terrorism Must Force the U.S. to Adopt "Carnivore" and New Electronic Surveillance Standards, 27 BROOK. J. INT'LL. 245, 255-56 (2001) (putting the estimate of Pentagon attacks at 2.5 million).
36. BORCHGRAVE ET AL., supra note 1, at 10.
37. Richard Clarke, Keynote Address: Threats to U.S. National Security: Proposed Partnership Initiatives Toward Preventing Cyber Terrorist Attacks, 12 DEPAUL BUS. L.J. 33, 35 (1999).
38. Id. at 36. I can tell you that there are tonight nations around the world who are developing or have developed offensive information warfare tools and techniques and have offensive information warfare organizations. I can tell you that those nations are doing reconnaissance today on America's computer networks looking for our weaknesses, and our vulnerabilities. It is not science fiction.
39. Id.
40. Id. at 37. In February of 1998, when Saddam Hussein was defying the UN and the UN Special Commission on Iraq, the President decided to send wings of aircraft to the Persian Gulf. That was on a Friday. On Saturday, we discovered that, at over 20 of our Air Force bases, someone had taken control of the logistic systems. They had downloaded all the password files. They had put sniffers [programs designed to seek and find certain information] on the lines. They had achieved systems administrator status on the computers. We thought it was Saddam Hussein about to crash the U.S. Air Force logistics support necessary for that deployment to the Gulf. Four days later, and nine federal courts later, we discovered it was two 14 years [sic] old children in San Francisco.
41. Id.
42. Id. at 38;
43. see also Todd A. Morth, Note, Considering Our Position: Viewing Information Warfare as a Use of Force Prohibited by Article 2(4) of the U.N. Charter, 30 CASE W. RES. J. INT'L L. 567, 568 (1998) (comparing information warfare capabilities to those of nuclear, chemical, and biological attacks in destructive capability but contrasting them by the ease with which they can be attained).
44. BORCHGRAVE ET AL., supra note 1, at ii;
45. see also Dan Verton, Defense Agency, Veridian to Pinpoint Foreign Hackers, INFOWORLD (Aug. 29, 2001), available at http://www.infoworld.com/articles/hn/xml/01/08/29/010829hndefense.xml (discussing Veridian's upcoming contract with the DOD to study computer intrusions and hacks by China against DOD computers).
46. Darcy Noricks, Cyber Attacks on U.S. Security, WASH. TIMES, Apr. 20, 2000, at A19;
47. see also Verton, supra note 27 (referring to recent DIA and CIA estimates that at least twenty countries are developing information warfare strategies specifically targeting the United States).
48. David Hoffman, Russian Touts Computer Virus as Weapon, WASH. POST, May 9, 2000, at 21.
49. Bill Gertz, U.S. Set to Take Warfare On-Line, WASH. TIMES, Jan. 6, 2000, at A3.
50. Clarke, supra note 23, at 40;
51. see also Frank Tiboni, Virtually Vulnerable: Civilian Board Warns Pentagon of Gaps in Computer Security, DEFENSE NEWS, June 25-July 1, 2001, at B1.
52. Bradley Graham, U.S. Studies New Threat: Cyber Attack; Hackers, Simulation Expose Vulnerability, WASH. POST, May 24, 1998, at Al (discussing operation Eligible Receiver, where a group of government employees successfully hacked into numerous government computer networks).
53. Michael N. Schmitt, Computer Network Attack and the Use of Force in International Law: Thoughts on a Normative Framework, 37 COLUM. J. TRANSNAT'L L. 885, 892 (1999) [hereinafter Schmitt, Normative Framework].
54. Jeffrey K. Souder, Information Operations in Homeland Computer-Network Defense, J. ELECTRONIC DEF. (Oct. 1, 2001), at http://www.jedonline.com/jedonline/default.asp?journalid=4&func= articles&page=0110j12&year=2001&month=10&doct=features. Souder continues, "[t]his fact alone implies that planning for computer attack and defense must be quite different than that of physical attack and defense," and concludes that "[w]ithin the cyberspace, distance is nearly irrelevant, speed is almost instantaneous, and forces are able to 'arrive' with little or no warning, strike, and maintain the attack for as long as necessary to attain the objective without experiencing fatigue or injury."
55. Jeffrey K. Souder, Information Operations in Homeland Computer-Network Defense, J. ELECTRONIC DEF., 2001, at http://www.jedonline.com/jedonline/default.asp?journalid=4&func= articles&page=0110j12&year=2001&month=10&doct=features Id.
56. The problem of identifying the perpetrator of the attack is also known as "attribution" and will be discussed below.
57. The problem of determining the attacker's intent is also known as "characterization" and will be discussed below.
58. BORCHGRAVE ET AL., supra note 1, at 7.
59. The May 2000 "Love Bug" worm is a good example of this. See id. at 12-13.
60. Id. at 19-20.
61. Id., Executive Summary, at i;
62. see also Angolan Cyber-Guerilla's Raid UNITA, AFRICA ANALYSIS, Nov. 30, 2001, at 3, available at http://www.africaanalysis.com (discussing a cyber attack against UNITA by the opposition party).
63. Matthew Fordahl, Computer Czar Issues Warning, AP ONLINE, Feb. 19, 2002 (Financial News Section), LEXIS, Nexis Library, CURNWS File.
64. Taking action in anticipation of a use of force is commonly referred to as "anticipatory self-defense" and will be discussed below.
65. GEOFFREY BEST, HUMANITY IN WARFARE 17-18 (1980).
66. Id. at 18.
67. THE LAWS OF ARMED CONFLICTS 788 (Dietrich Schindler & Jiri Toman eds., 3d ed. 1988).
68. Pacific Settlement of International Disputes (Hague I) July 29, 1899,
69. reprinted in 1 BEVANS 230. As rewritten and repromulgated on Oct. 18, 1907, Article 1 introduced language of international dispute settlement that became the basis for similar agreements over the next century: "With a view to obviating, as far as possible, recourse to force in the relations between States, the Signatory Powers agree to use their best efforts to insure the pacific settlement of international differences."
70. Id. at 234. Articles 9-57 of the agreement went on to outline a voluntary system of mediation and arbitration designed to resolve disputes before nations felt it necessary to resort to the use of force.
71. Id. at 236-43.
72. LEAGUE OF NATIONS COVENANT, reprinted in WOODROW WILSON'S CASE FOR THE LEAGUE OF NATIONS, at app. f (Hamilton Foley ed., 1969) (describing the intent, structure, and battle for the League of Nations). The preamble of the Covenant of the League of Nations states the intent of the framers: "In order to promote international cooperation and to achieve international peace and security by the acceptance of obligations not to resort to war . . ." LEAGUE OF NATIONS COVENANT pmbl. Though no language of the Covenant made a resort to war illegal per se, it required nations to submit "any dispute likely to lead to a rupture" to arbitration or to the League Council.
73. Woodrow wilson's case for the league of nations Id. arts. 12, 15. Further, Article 16 states: Should any Member of the League resort to war in disregard of its covenants under Articles 12, 13, or 15, it shall ipso facto be deemed to have committed an act of war against all other Members of the League, which hereby undertake immediately to subject it to the severance of all trade or financial relations, the prohibition of all intercourse between their nationals and the nationals of the covenant-breaking State, and the prevention of all financial, commercial, or personal intercourse between the nationals of the covenant-breaking State and the nationals of any other State, whether a Member of the League or not. It shall be the duty of the Council in such case to recommend to the several Governments concerned what effective military, naval, or air force the Members of the League shall severally contribute to the armed forces to be used to protect the covenants of the League.
74. Woodrow wilson's case for the league of nations Id. art. 16.
75. Kellogg-Briand Pact (1928), reprinted in 2 BEVANS 732. Articles I and II of the Treaty state: Article I. The High Contracting Parties solemnly declare in the names of their respective peoples that they condemn recourse to war for the solution of international controversies, and renounce it as an instrument of national policy in their relations with one another. Article II. The High Contracting Parties agree that the settlement or solution of all disputes or conflicts of whatever nature or of whatever origin they may be, which may arise among them, shall never be sought except by pacific means.
76. Id. at 734.
77. BARRY E. CARTER & PHILLIP R. TRIMBLE, INTERNATIONAL LAW 35 (2d ed. 1995).
78. U.N. CHARTER, reprinted in 3 BEVANS 1153.
79. U.N. CHARTER pmbl. The preamble states: We the peoples of the United Nations determined to save succeeding generations from the scourge of war, which twice in our lifetime has brought untold sorrow to mankind . . . and for these ends to practice tolerance and live together in peace with one another as good neighbors, and to unite our strength to maintain international peace and security, and to ensure, by the acceptance of principles and the institution of methods, that armed force shall not be used, save in the common interest . . . have resolved to combine our efforts to accomplish these aims. 3 Bevans Id.
80. 3 Bevans Id. art 1. Article 1 states: The Purposes of the United Nations are: 1. To maintain international peace and security, and to that end: to take effective collective measures for the prevention and removal of threats to the peace, and for the suppression of acts of aggression or other breaches of the peace, and to bring about by peaceful means, and in conformity with the principles of justice and international law, adjustment or settlement of international disputes or situations which might lead to a breach of the peace . . . .
81. 3 Bevans Id.
82. 3 Bevans Id. art. 2, para. 4.
83. The composition and functions of the Security Council are covered in Chapter V of the U.N. Charter, comprising Articles 23-32. Id. arts 23-32. The Security Council has primary responsibility for international peace and security (Article 24) as described in Chapters VI, VII, VIII, and XII, comprising Articles 33-54 and 75-85. Id. arts 33-54, 75-85.
84. 3 Bevans Id. art. 51.
85. Article 2(7) allows for a nation to use or threaten force in "matters which are essentially within the domestic jurisdiction of any state" without U.N. intervention. 3 Bevans Id, art. 2, para. 7. Nothing continued in the present Charter shall authorize the United Nations to intervene in matters which are essentially within the domestic jurisdiction of any state or shall require the Members to submit such matters to settlement under the present Charter; but this principle shall not prejudice the application of enforcement measures under Chapter VII. U.N. CHARTER art. 2, para. 7. Some have made that claim on behalf of Serbia concerning NATO's intervening in Kosovo.
86. See, e.g., John C. Yoo, Point/Counterpoint: Kosovo, War Powers, and the Multilateral Future, 148 U. PA. L. REV. 1673, 1725 (2000). However, it is important to note that this limitation on the international community's ability to intervene in domestic issues is balanced by the Security Council's right, under Chapter VII, to determine that such actions may constitute a threat to or breach of the peace affecting international peace and security.
87. WALTER GARY SHARP, SR., CYBERSPACE AND THE USE OF FORCE 7, 28 (1999).
88. U.S. DEP'T OF STATE, CHARTER OF THE UNITED NATIONS: REPORT TO THE PRESIDENT ON THE RESULTS OF THE SAN FRANCISCO CONFERENCE BY THE CHAIRMAN OF THE UNITED STATES DELEGATION, THE SECRETARY OF STATE 88 (1945) (describing Chapter VII as "the teeth of the United Nations") [hereinafter REPORT TO THE PRESIDENT]. The Report continues, While the novel quality of the enforcement measures envisaged in that Chapter may attract undue public attention at the expense of other vital functions of the Organization, the fact remains that upon the confidence which member states repose in the efficacy of the measures designed to halt aggression - a confidence which may have to meet the test of successive crises - the survival of the entire Organization and of world peace itself must ultimately depend.
89. "Aggression" and its usefulness as a definitional limitation on a nation's use of force have been the topic of much debate by scholars. Compare GA. Res. 3314, U.N. GAOR, 29th Sess., Supp. No. 31, U.N. Doc. A/RES/ 3314 (1974) (where the U.N. General Assembly passed a resolution without a vote containing the definition of aggression in 1974), with United Nations Press Release, U.N. Doc. L/2967 (2000), http://www.un.org/News/Press/docs/2000/20001201.12967.doc.html (stating that the definition of aggression was a contested issue in the formulation of the International Criminal Court).
90. U.N. CHARTER art. 39. Article 41 states: The Security Council may decide what measures not involving the use of armed force are to be employed to give effect to its decisions, and it may call upon the Members of the United Nations to apply such measures. These may include complete or partial interruption of economic relations and of rail, sea, air, postal, telegraphic, radio, and other means of communication, and the severance of diplomatic relations.
91. Id. art. 41. Article 42 states: Should the Security Council consider that measures provided for in Article 41 would be inadequate or have proved to be inadequate, it may take such action by air, sea, or land forces as may be necessary to maintain or restore international peace and security. Such action may include demonstrations, blockade, and other operations by air, sea, or land forces of Members of the United Nations.
92. Id. art. 42.
93. S.C. Res. 678, U.N. SCOR, 45th Sess., 2963d mtg., U.N. Doc. S/RES/0678 (1990), available at http://www.fas.org/news/un/iraq/sres/sres0678.htm (providing the text of the United Nations Security Council Resolution authorizing the use of all necessary means to expel Iraq).
94. Article 51 was originally framed with the primary intent of incorporating regional systems from Chapter VIII into the international security system, not as a means of one nation using force to preempt or respond to an attack from another nation. See REPORT TO THE PRESIDENT, supra note 58, at 107.
95. U.N. CHARTER art. 51. Article 51 continues: Measures taken by Members in the exercise of this right of self-defense shall be immediately reported to the Security Council and shall not in any way affect the authority and responsibility of the Security Council under the present Charter to take at any time such action as it deems necessary in order to maintain or restore international peace and security.
96. Id. art. 51.
97. LELAND M. GOODRICH & EDVARD HAMBRO, CHARTER OF THE UNITED NATIONS: COMMENTARY AND DOCUMENTS 299 (2d ed. 1949).
98. NORMAN BENTWICH & ANDREW MARTIN, A COMMENTARY ON THE CHARTER OF THE UNITED NATIONS 106 (1950) (providing the German aggression against Luxembourg and Belgium in August 1914, the Japanese aggression in Manchuria in 1931-32, and the German aggression against Poland in September 1939 as examples of the misuse of the doctrine of self-defense).
99. NORMAN BENTWICH & ANDREW MARTIN, A COMMENTARY ON THE CHARTER OF THE UNITED NATIONS 106 (1950) Id.
100. Richard J. Grunawalt, The JCS Standing Rules of Engagement: A Judge Advocate's Primer, 42 A.F. L. REV. 245, 251 (1997).
101. Richard J. Grunawalt, The JCS Standing Rules of Engagement: A Judge Advocate's Primer, 42 A.F. L. REV. 245, 251 (1997) Id.
102. See Military and Paramilitary Activities (Nicar. v. U.S.), 1986 I.C.J. 94 (June 27) (Merits).
103. The quintessential statement of the right of anticipatory self-defense was espoused in 1842 by the U.S. Secretary of State, Daniel Webster, in The Caroline incident. In a letter to Henry Fox, the British Minister in Washington, D.C., Webster argued that an action by the British was not justified by anticipatory self-defense: The statement of Secretary of State Daniel Webster on The Caroline incident in 1842 has been widely accepted and was quoted approvingly by the Nuremberg Tribunal. Webster said, with reference to the invasion of U.S. territory across the Niagara River by British forces to prevent aid to Canadian revolutionaries from The Caroline, which was loaded with arms and about to depart, that such invasion was in principle illegal, but he added "while it is admitted that exceptions growing out of the great law of self-defense do exist, those exceptions should be confined to cases in which the necessity of that self-defense is instant, overwhelming, and leaving no choice of means and no moment for deliberation, and must be limited by that necessity and kept clearly within it. Self-Defense, 5 Whiteman DIGEST § 25, at 981-82 (citations omitted);
104. see also SHARP, supra note 57, at 43 (discussing anticipatory self-defense under the U.N. Charter).
105. But see Timothy Kearley, Raising the Caroline, 17 WIS. INT'L L.J. 325 (1999) for the assertion that Webster's original meaning and the original understanding of the doctrine of anticipatory self-defense applied only to actions outside a state's own territory. It is only since the Charter that this doctrine has been used to justify acts within a state's own territory.
106. Timothy Kearley, Raising the Caroline, 17 WIS. INT'L L.J. 325 (1999) Id.
107. Whiteman, Self-Defense, supra note 70.
108. MYRES S. MCDOUGAL & FLORENTINO P. FELICIANO, THE INTERNATIONAL LAW OF WAR: TRANSNATIONAL COERCION AND WORLD PUBLIC ORDER 235 (1994);
109. THE CHARTER OF THE UNITED NATIONS: A COMMENTARY 678 (Bruno Simma ed., 1995) [hereinafter Simma].
110. See, e.g., MCDOUGAL & FELICIANO, supra note 72, at 235;
111. D.W. BOWETT, SELF-DEFENCE IN INTERNATIONAL LAW 184-93 (1958);
112. TIMOTHY L.H. MCCORMACK, SELF-DEFENSE IN INTERNATIONAL LAW 139-44 (1996).
113. YORAM DINSTEIN, WAR, AGREESION AND SELF-DEFENCE 182-91 (2d ed. 1994) (arguing that a standard of "interceptive" self-defense is legitimate under Article 51 of the U.N. Charter. Interceptive self-defense refers to actions taken after the other side has committed itself to an armed attack.).
114. MCDOUGAL & FELICIANO, supra note 72, at 232-34;
115. Simma, supra note 72, at 675-76;
116. LOUIS HENKEN, How NATIONS BEHAVE 141-45 (2d ed. 1979);
117. Permissible and Impermissible Uses of Force, 12 Whiteman DIGEST § 1, at 48.
118. The Permanent Court of International Justice, formed in 1921 at The Hague, was succeeded by the ICJ in 1946.
119. See also CARTER & TRIMBLE, supra note 49, at 296-97.
120. Article 38(1), STAT. OF THE INT'L CT. OF J., June 26, 1945, 59 Stat. 1031 (entered into force Oct. 24, 1945).
121. Military and Paramilitary Activities (Nicar. v. U.S.), 1986 I.C.J. 94 (June 27) (Merits).
122. Id. at 101 (Merits).
123. Id. at 119 (Merits).
124. Id. at 103 (Merits).
125. Id. But see id. at 347 (Schwebel, dissenting).
126. STANIMIR A. ALEXANDROV, SELF-DEFENSE AGAINST THE USE OF FORCE IN INTERNATIONAL LAW 149-65 (1996).
127. Id. at 161.
128. OFFICE OF THE GENERAL COUNSEL, DEP'T OF DEFENSE, AN ASSESSMENT OF LEGAL ISSUES IN INFORMATION OPERATIONS 15 (2d ed. 1999) [hereinafter DOD OGC].
129. MCCORMACK, supra note 73, at 229.
130. Military and Paramilitary Activities (Nicar. v. U.S.), 1986 I.C.J. 94, 127 (June 27) (Merits). The Court does not describe or further explain what these proportional countermeasures might include. It merely states that such measures would be permissible in response to a use of force short of armed attack.
131. 1986 I.C.J. 94, 127 Id.
132. Gabcikovo-Nagymaros Project (Hung. v. Slovk.), 1997 I.C.J. 7, 55-56 (Sep. 25) (Merits).
133. (Hung. v. Slovk.), 1997 I.C.J. 7, 55-56 Id.;
134. see also John Lawrence Hargrove, The "Nicaragua " Judgment and the Future of the Law of Force and Self-Defense, 81 AM. J. INT'LL. 135, 138 (1987) (arguing that, though it did not specifically say so, the Court in that case strongly suggested that a victim of an illegal act involving the use of force could legally respond with forceful countermeasures);
135. D.G Stephens, The Impact of the 1982 Law of the Sea Convention on the Conduct of Peacetime Naval/Military Operations, 29 CAL. W. INT'L L.J. 283, 303-04 (1999) (stating that the right to use force as a countermeasure was implicit in the ICJ's opinion in the Nicaragua case).
136. Compare Oscar Schachter, United Nations Law, 88 AM. J. INT'L L. 1, 15 (1994), where the author states: The term "countermeasures" has come to be used for self-help action in place of the older terms "reprisal" and "retorsion." But it is still relevant to distinguish between countermeasures that would be illegal if not for the prior illegal act of the state against which they are directed (i.e., reprisals) and countermeasures that a state could legally take against any state irrespective of that state's conduct (retorsion). Both may be regarded as sanctions against violations. Reprisals are generally permitted if they do not involve use of force contrary to the Charter and if they are directed to obtaining redress for the wrong committed.
137. Compare Oscar Schachter, United Nations Law, 88 AM. J. INT'L L. 1, 15 (1994) Id.
138. Military and Paramilitary Activities (Nicar. v. U.S.), 1986 I.C.J. 94, 96-97 (June 27) (Merits) (discussing the Court's decision to apply customary international law rather than multilateral treaties such as the U.N. Charter, based on objections by the United States).
139. Id. at 94 (Merits).
140. Michael Reisman, No Man's Land: International Legal Regulations of Coercive Responses to Protracted and Low Level Conflict, 11 HOUS. J. INT'L L. 317, 319 (1989). Both the Charter and customary conceptions of international law with regard to use of the military instrument rested on a set of inherited assumptions about how military conflict is conducted: conflict is territorial, between organized communities; conducted by certain types of specialists in violence or "regular forces" who are clearly identified; they concentrate their efforts against each other in a war zone; the conflict itself is preceded by formal notification; suspended by some formal arrangement, and terminated in an explicit and often ceremonialized fashion.
141. Michael Reisman, No Man's Land: International Legal Regulations of Coercive Responses to Protracted and Low Level Conflict, 11 HOUS. J. INT'L L. 317, 319 (1989) Id.
142. quoted in Richard W. Aldrich, How Do You Know You Are at War in the Information Age?, 22 HOUS. J. INT'L L. 223, 234 (2000) (arguing that the underlying assumptions that were the basis for the rules on the use of force may not be sufficient to fit the technological warfare possible today).
143. Schmitt, Normative Framework, supra note 33, at 912.
144. State practice is one of the ways customary international law is established. For example, in the statute of the Permanent Court of International Justice, the court is allowed to look at the practice of states. See Source: Custom, 1 Whiteman DIGEST § 6, at 75. It is not possible for the Court to apply a custom; instead, it can observe the general practice of States, and if it finds that such practice is due to a conception that the law requires it, it may declare that a rule of law exists and proceed to apply it. The elements necessary are the concordant and recurring action of numerous States in the domain of international relations, the conception in each case that such action was enjoined by law, and the failure of other States to challenge that conception at the time.
145. Source: Custom, 1 Whiteman DIGEST § 6, at 75 Id.
146. Statements of scholars can also provide a basis for international law, particularly when the specific area of law is not developed enough to evidence much state practice and few, if any, international agreements exist in the area. See International Law: General Nature, 1 Hackworth DIGEST § 1, at 1. When doubt arises as to the existence or nonexistence of a rule of international law, or as to the application of a rule to a given situation, resort is usually had to such sources as pertinent treaties, pronouncements of foreign offices, statements by writers, and decisions of international tribunals and those of prize courts and other domestic courts purporting to be expressive of the law of nations.
147. SHARP, supra note 57, at 91.
148. Id. at 92.
149. Id. at 226 (quoting CHAIRMAN, THE JOINT CHIEFS OF STAFF INSTRUCTION 3121.01, STANDING RULES OF ENGAGEMENT FOR U.S. FORCES, encl. A, paras. 5e, 5f (Oct. 1, 1994, amended Dec. 22, 1994) (discussing the U.S. military's definitions of hostile intent and hostile act)). These 1994 rules were replaced on Jan. 15, 2000 by CHAIRMAN, JOINT CHIEFS OF STAFF INSTRUCTION 3121.01A, STANDING RULES OF ENGAGEMENT FOR U.S. FORCES (2000) [hereinafter INSTRUCTION 3121.01A].
150. SHARP, supra note 57, at 95.
151. Id. at 101.
152. Id.
153. (quoting Simma, supra note 72, at 113) (listing "cross frontier expulsion of populations, the diversion of a river by an up-stream state, the release of large quantities of water down a valley, and the spreading of fire across a frontier" as examples of nonmilitary physical force that would amount to a use of force).
154. Id. at 133.
155. Id. at 126.
156. Id. at 127-28.
157. Id. at 148
158. (quoting THE JOINT CHIEFS OF STAFF, JOINT PUB. No. 1-02, DICTIONARY OF MILITARY AND ASSOCIATED TERMS 174 (1998) [hereinafter JOINT PUB. 1-02] (defining espionage as "[t]he act of obtaining, delivering, transmitting, communicating, or receiving information about the national defense of a state with an intent, or reason to believe, that the information may be used to the injury of that state or to the advantage of any foreign nation")).
159. SHARP, supra note 57, at 129.
160. Id. at 131 (referring to Exec. Order No. 13,010, 61 Fed. Reg. 37,347 (1996),
161. reprinted as amended in 42 U.S.C. § 5195 (2000) [hereinafter Exec. Order 13,010] (defining which systems are sensitive and vital)).
162. Id. at 129.
163. Id. at 132.
164. For example, though a CNA that causes a single train crash within a victim state would constitute an unlawful use of force, only a series of incidents or one major incident such as causing the nation's stock exchange to crash would rise to the level of an armed attack.
165. Id. at 117.
166. Michael N. Schmitt is a retired U.S. Air Force Lieutenant Colonel and currently a professor of international law at the George C. Marshall European Center for Strategic Studies in Garmisch-Partenkirchen, Germany. He has written several important articles on this issue, including Schmitt, Bellum Americanum, infra note 115,
167. Schmitt, Normative Framework, supra note 33,
168. and Michael N. Schmitt, The Principle of Discrimination in 21st Century Warfare, 2 YALE HUM. RTS. & DEV. L.J. 143 (1999).
169. Schmitt, Normative Framework, supra note 33, at 908.
170. Schmitt, Normative Framework, supra note 33, at 908 Id.
171. Id. at 886.
172. Id. at 911;
173. see also DOD OGC, supra note 85, at 14 (stating that the consequences of a CNA are likely more important than the methods used);
174. Michael N. Schmitt, Bellum Americanum: The U.S. View of Twenty-First Century War and Its Possible Implications for the Law of Armed Conflict, 19 MICH. J. INT'L L. 1051, 1071-72 (1998) [hereinafter Schmitt, Bellum Americanum] (discussing the difference in consequence between a devastating economic embargo which would not be considered a use of force or armed attack and a minor border incursion that may be considered a use of force and possibly an armed attack).
175. Schmitt, Normative Framework, supra note 33, at 934.
176. Id. at 935. Schmitt's analysis proceeds as follows: 2) If it is not armed force, is the CNA nevertheless a use of force as contemplated in the U.N. Charter? It is if the nature of its consequences track those consequence commonalities which characterize armed force. 3) If the CNA is a use of force (armed or otherwise), is that force applied consistent with Chapter VII, the principle of self-defense, or operational code norms permitting its use in the attendant circumstances? a) If so, the operation is likely to be judged legitimate. b) If not and the operation constitutes a use of armed force, the CNA will violate Article 2(4), as well as the customary international law prohibition on the use of force. c) If not and the operation constitutes a use of force, but not armed force, the CNA will violate Article 2(4). 4) If the CNA does not rise to the level of the use of force, is there another prohibition in international law that would preclude its use? The most likely candidate, albeit not the only one, would be the prohibition on intervening in the affairs of other States. Id. Schmitt uses the term "operational code" to refer to actions that do not fall within the prescribed limitations of the Charter, but that are accepted nonetheless.
177. Id. at 902-03.
178. Id. at 932-33.
179. "Note that it is not the CNA that is actually being defended against, but instead the overall armed attack, complete with its information operation component." Id. at 933.
180. DOD OGC, supra note 85.
181. Id. at 16.
182. Exec. Order No. 13,010, supra note 107.
183. supra note 107 Id.
184. supra note 107 Id.
185. Exec. Order No. 13,231, 66 Fed. Reg. 53,063 (Oct. 18, 2001), available at http://www.nara.gov/fedreg/eo2001b.html.
186. 2001, http://www.nara.gov/fedreg/eo2001b.html Id.
187. Id. at 53,064.
188. Id. at 53,069. As mentioned previously, President Bush has also appointed Richard Clarke,
189. see supra notes 23-26 and accompanying text (quoting Clarke on computer security), as his special advisor on cyberspace security.
190. Scott Lindlaw, Officials Named for Anti-Terrorism Fight, THE ADVOCATE (Baton Rouge, La.), Oct. 1, 2001, at 11-A. The White House Office of Cyberspace Security has made the creation of "an analysis center that would help government target the most vulnerable points in the nation's critical infrastructure" one of its top priorities.
191. Bara Vaida, Cybersecurity Chief Pushes Early-Warning System, NAT'L JOURNAL'S TECH DAILY, Nov. 26, 2001, available at http://www.govexec.com/dailyfed/1101/112601td2.htm. Mr. Clarke has identified ten goals on which the Office of Cyberspace Security is currently working: (1) He and his team in late spring or early summer will release a national cybersecurity strategy worked out with the private sector, "not a table-top book" but one "in Internet time, living in cyberspace, " that will be updated as needed. (2) The FY 2003 budget proposes 8% of IT funds be used for security, although Clarke admitted "we cannot cure many problems in computer networks in one year." (3) Clarke will continue to encourage Internet leaders such as Microsoft's Bill Gates, Oracle's Larry Ellison and Cisco System's John Chambers to focus on security, as those individuals have promised. (4) His team will work with Tier One ISPs to improve Internet security. (5) Scholarships for IT security will be funded in exchange for commitments to work for the federal govt. (6) The govt. and the private sector will work to develop a cyberintelligence warning network "to share information in real time." (7) The possibility of a separate network such as GovNet will continue to be examined, an effort Clarke said was being researched now by 167 companies. (8) A national infrastructure modeling center would be developed to predict and cope with future attacks. (9) Homes and small businesses would be encouraged to increase cybersecurity. (10) The Commerce Dept.'s critical infrastructure efforts would work hand-in-hand with the FBI's National Infrastructure Protection Center (NIPC). Terrorists May Have Penetrated Internet System Already,
192. Clarke Warns, WASH. INTERNET DAILY, Feb. 14, 2002, LEXIS, Nexis Library, CURNWS File.
193. See Alan Goldstein, Ashcroft Warns About Cyberattacks; Attorney General Calls For More Protection of Critical Infrastructure, DALLAS MORNING NEWS, Feb. 13, 2002, at 1D (Business Section) ("U.S. Attorney General John Ashcroft warned Tuesday that potential terrorist invasions of computer networks could be just as dangerous as attacks on physical places, saying that more needs to be done to protect the nation's so-called critical infrastructure.").
194. But see Winkler Says Gov't Ignored Cyberattack Wake-up Calls, COMM. DAILY, Mar. 1, 2002, LEXIS, Nexis Library, CURNWS File (quoting Ira Winkler, chief security strategist for Hewlett-Packard, who condemns the government's inaction and lack of real response to warnings over the past five years saying, "[t]here have been no lessons learned or applied by government . . . any of the practical lessons learned would have prevented a lot of these problems").
195. Simma, supra note 72, at 112 (arguing that Articles 2(4) and 51 were not intended to proscribe political or economic coercion);
196. see also SHARP, supra note 57, at 99-109.
197. DOD OGC, supra note 85, at 23.
198. Id. Though a detailed interpretation on the current state of the law, the DOD OGC paper makes no attempt to put forward any theory on how to handle this difficult area, or even put potential offenders on notice that the United States views certain acts as violations of its sovereignty and potential uses of force.
199. The USA Patriot Act of 2001, passed in response to the September 11, 2001 terrorist acts, expands domestic legal options in the area of CND, but does not go far enough, particularly to protect critical national infrastructure. USA Patriot Act of 2001, Pub. L. No. 107-56, 115 Stat. 1394 (2001). Pertinent provisions of the Act include: § 202, which adds felony violations of the Computer Fraud and Abuse Act to the list of offenses that support a voice wiretap; § 203b, which encourages sharing of information between all federal agencies; § 210, which expands the coverage of a subpoena for electronic evidence; § 211, which brings internet services within the ECPA trap and trace rules; § 214, which modifies the FISA pen register, trap and trace requirements to replace "agent of a foreign power" with a showing that the register or trap and trace is relevant to an investigation to protect against international terrorism; § 216, which expands generally pen register, trap and trace authority; § 217, which allows victims of computer attacks to authorize system monitoring; § 218, which makes obtaining foreign intelligence "a significant purpose" rather than "the purpose" of the search for obtaining a warrant; § 219, which authorizes single-jurisdiction search warrants in any district where terrorist acts may have occurred; § 220 which allows nationwide search warrants for email; § 377 which provides extraterritorial jurisdiction for certain computer data theft cases; and § 1016, which creates the National Infrastructure Simulation and Analysis Center (NISAC) and authorizes $20 million for the Defense Threat Reduction Agency.
200. Id.
201. This Article will consider only responses that amount to a use of force and can be accomplished in a relatively quick amount of time. It will not discuss other potential responses such as diplomatic measures or sanctions, extradition of the perpetrator, and other proposed and current remedies. As discussed above, in the case of critical national infrastructure protection, these remedies take too long and will not provide sufficient protection for critical systems.
202. Grunawalt, supra note 67, at 251.
203. Mark R. Shulman, Discrimination in the Laws of Information Warfare, 37 COLUM. J. TRANSNAT'L L. 939, 955-56 (1999). Shulman states: In [information warfare, the attacker] would be a combatant and subject to proportional response. In fact, if the target of her attack did not have the means [sic] respond with his own [information warfare] measures, he could reasonably bomb the building in which she is believed to be sitting - again a proportional response but one that returns kinetic destruction for that created by electronic means.
204. Id.
205. "CND is the mission to defend computer systems and networks from unauthorized activity and other activity, which degrade mission performance and adversely impact survivability (e.g., disruption, denial, degradation, destruction, or exploitation)." CHAIRMAN, THE JOINT CHIEFS OF STAFF INSTRUCTION 6510.01C, INFORMATION ASSURANCE AND COMPUTER NETWORK DEFENSE, encl. A, para. 1(a) (May 1, 2001). This mission is to be accomplished by "employing communications, law enforcement, counterintelligence, and Intelligence Community capabilities in response to specific or potential threats" (emphasis added).
206. Chairman, The Joint Chiefs of Staff Instruction 6510.01C, Information Assurance and Computer Network Defense Id. The inclusion of defense against "potential threats" is another clear statement of the United States' commitment to apply anticipatory self-defense in the area of CNO.
207. Encryption is the process of producing a scrambled ciphertext that can only be unscrambled by someone who has the secret key or decryption. DENNING, supra note 2, at 286.
208. "A firewall is a network monitor or collection of monitors placed between an organization's internal network and the Internet or between two local area networks . . . . A firewall is essentially a guarded gateway between two networks." Id. at 353.
209. Automated detection is the process of programming computers to "scan computer records or on-line computer activity for patterns that indicate or suggest the presence of unauthorized activity." Id. at 361.
210. Advertising Tighter Measures 'Essential,' INFOTECH WEEKLY, Nov. 5, 2001, § 2, at 27.
211. ForeScout Technologies Ships ActiveScout Product, Unique Perimeter Defense System Accurately Blocks Network Attacks in Real Time; ActiveScout Automatically Stops Attacks Before They Reach the Firewall, INTERNET WIRE, Feb. 4, 2002, LEXIS, News Library, CURNWS File.
212. DOD OGC, supra note 85, at 18.
213. Aldrich, supra note 92, 258-60 (stating that the Department of Justice is opposed to an active computer network defense system because of potential difficulties inherent in controlling such a response and because it believes such a system would violate the Computer Fraud and Abuse Act; and, urging national security exemptions to these laws to facilitate an adequate defense against information warfare).
214. Sirak, supra note 4, at 28;
215. see also William Arkin & Robert Windrem, The U.S. China Information War: Major Headaches, MSNBC, at http://www.msnbc.com/news/607031.asp#BODY (Aug. 20, 2001).
216. DENNING, supra note 2, at 392.
217. William B. Scott, Newark Security Still the 'Wild West,' AVIATION WK. & SPACE TECH., Feb. 26, 2001, at 62 (quoting a high-level Pentagon official as saying the government has an "immediate kill" tactic already in place to protect national "crown jewels" against network intrusions).
218. DENNING, supra note 2, at 393.
219. Prem Kumar, Tactics to Combat Cyber-Attacks, Bus. LINE, Jan. 9, 2002, LEXIS, Nexis Library, CURNWS File, where the author states: With the rapid rise in the attacks on military computers, the guardians of the Pentagon information system want to look beyond the passive set-up of firewalls, sensors and computer experts. According to the journal Defense News, there is a proposal to deploy Active Network Defense, which "will track down hackers with techniques that trace the origin of the attack."
220. Prem Kumar, Tactics to Combat Cyber-Attacks, Bus. LINE 2002 Id.
221. Walker, supra note 2, at 1103.
222. Michael J. Robbat, Note, Resolving the Legal Issues Concerning the Use of Information Warfare in the International Forum: The Reach of the Existing Legal Framework, and the Creation of a New Paradigm, 6 B.U. J. SCI. & TECH. L. 10, paras. 63-67 (2000) (proposing an international convention with the intent to proclaim CNA and other forms of information warfare as an "armed use of force" and provide for universal cooperation and extradition).
223. BORCHGRAVE ET AL., supra note 1, at 3. Understanding the distinctions between attacks and motives, and improving our nation's ability to provide fast and accurate assessments of the nature of both the attacks and their perpetrators, are a core part of the problem at hand. [B]oth the likely criminal entities and the damage they seek to inflict become more difficult to identify, quantify, and warn against. It is increasingly complicated to distinguish between a national security threat, criminal activity, and malicious but low-level disruption.
224. BORCHGRAVE ET AL., supra note 1, at 3 Id.
225. James P. Terry, USMC (ret.), Responding to Attacks on Critical Computer Infrastructure: What Targets? What Rules of Engagement?, 46 NAVAL. L. REV. 170, 177 (1999) (arguing that any time lapse should not preclude a military response). The Article notes that: [I]t would be unreasonable to preclude the victim of techno-violence from redress, based upon a doctrinaire determination that the threat of further destructive intrusions into a critical system is no longer imminent, when the perpetrator's own actions have precluded immediate identification.
226. James P. Terry, Responding to Attacks on Critical Computer Infrastructure: What Targets? What Rules of Engagement?, 46 NAVAL. L. REV. 170, 177 (1999) Id.
227. Souder, supra note 34. "[I]t is possible to predict that, in many cases, attribution for the attack will not be possible."
228. Souder, supra note 34 Id.
229. BORCHGRAVE ET AL., supra note 1, at 46 (arguing that a passive response "undermines efforts geared at identifying attackers and adopting deterrent measures toward future hostile acts").
230. Declaration on Principles of International Law Concerning Friendly Relations and Cooperation Among States in Accordance with the Charter of the United Nations, G.A. Res. 2625, U.N. GAOR, 25th Sess., Supp. No. 28, at 122, U.N. Doc. A/RES/2625 (1970).
231. Military and Paramilitary Activities (Nicar. v. U.S.), 1986 I.C.J. 94 (June 27) (Merits).
232. Aldrich, supra note 92, at 235-36.
233. DOD OGC, supra note 85, at 2 (noting that exceptions to this include war crimes, genocide, crimes against humanity, and crimes against peace);
234. see also Ann Roosevelt, Computer Crime Against the Army Doesn't Pay, DEF. WK., Dec. 3, 2001, available at www.kingpublishing.com (password required) (copy on file with the author) (stating that between March 1, 2000 and October
235. During armed conflict, the law of war prohibits targeting attacks on civilians unless specific criteria are met. As stated in the preamble to the 1868 Declaration of St. Petersburg, "the only legitimate object which States should endeavour to accomplish during war is to weaken the military forces of the enemy." THE LAWS OF ARMED CONFLICTS, supra note 45, at 102. Therefore, civilian populations, as well as civilian objects, are not to be the object of attack unless they somehow lose their protected status.
236. See Protocol Additional to the Geneva Conventions of 12 August 1949, and Relating to the Protection of Victims of International Armed Conflicts, Dec. 12, 1977, 16 I.L.M. 1391, 1442 (1977) [hereinafter Protocol Additional]. The United States recognizes portions of the Protocol Additional as customary international law.
237. Michael J. Matheson, The United Slates Position on the Relation of Customary Law to the 1977 Protocols Additional to the 1949 Geneva Conventions, 2 AM. U. J. INT'LL. & POL'Y 419, 421 (1987). The general rule regarding distinction during an armed conflict is found in Article 48, which states: "In order to ensure respect for and protection of the civilian population and civilian objects, the Parties to the conflict shall at all times distinguish between the civilian population and combatants and between civilian objects and military objectives and accordingly shall direct their operations only against military objectives."
238. Protocol Additional, supra, art. 48. The United States accepts Article 48 as customary international law
239. . Matheson, supra, at 426. Several articles that follow this provision expand on these terms and how this protection is to be applied. Article 51 pronounces rules intended to protect civilians from the dangers arising from military operations. Not only does it preclude making civilians the "object of attack" unless they take a "direct part" in hostilities, but it also precludes attacks that are unable to discriminate or be directed at a particular military object. The Protocol specifically identifies "an attack which may be expected to cause incidental loss of civilian life, injury to civilians, damage to civilian objects, or a combination thereof, which would be excessive in relation to the concrete and direct military advantage anticipated."
240. Protocol Additional, supra, art. 51. The United States accepts much of Article 51 as customary international law.
241. Matheson, supra, at 426.
242. Oliver August, Cyberforce Threatens Taiwan, LONDON TIMES, Mar. 8, 2000, available at http://ebird.dtic.mil/Mar2000/e20000308cyberforce.htm (discussing anticipated attacks on Taiwan from China during the upcoming elections);
243. John J. Stanton, Rules of Cyber War Baffle U.S. Government Agencies, NAT'L DEF., Feb. 2000, at 29 (discussing the cyber attack on Taiwan causing a nationwide blackout and subsequent crash of bank teller machines thought to have been caused by Chinese state-sponsored computer hacks);
244. Warren P. Strobel et al., A Glimpse of Cyberwarfare, U.S. NEWS & WORLD REPORT, Mar. 13, 2000, at 32;
245. see also Jim Bronskill, Crippling Cyberattack in 10 years: CSIS: Russia, China, India, Cuba Actively Advancing Cyberwar Capability, OTTAWA CITIZEN, July 18, 2001, at A3 (putting the time frame for a cyber attack at within ten years);
246. cf. Robert Wall & David A. Fulghum, Secrecy Shrouds Computer War Threat, AVIATION WK. & SPACE TECH., Feb. 26, 2001, at 56 (quoting an Air Force general who states, "[b]eginning in 2005, the probability of a cyber attack using state-sponsored capability gets very high"). The most noted potentially state-sponsored attack that the government has divulged originates from Russia and has been termed Moonlight Maze. The attack started in 1998 and has been traced to seven Russian internet addresses. James Adams, writing in the May/June 2001 issue of Foreign Affairs, states "[d]espite all the investigative effort, the United States still does not know who is behind the attacks, what additional information has been taken and why, to what extent the public and private sectors have been penetrated, and what else has been left behind that could still damage the vulnerable networks."
247. James Adams, Virtual Defense, FOREIGN AFFAIRS, May/June 2001, at 100.
248. BORCHGRAVE ET AL., supra note 1, at 20;
249. SHARP, supra note 57, at 22. It is also important to note that President Clinton determined that all such intrusions, even into critical national infrastructure, should initially be considered a law enforcement issue.
250. Presidential Decision Directive 63, Critical Infrastructure Protection, at Annex A (May 22, 1998), available at http://www.fas.org/irp/offdocs/pdd/pdd-63.htm.
251. On the other hand, once the origin of the attack becomes known, much more severe measures could be appropriate. See DOD OGC, supra note 85, at 15 (arguing that though the response must be proportional, it need not use the same means as the attacker). [T]here is no requirement that an act of self-defense use the same means as the provocation, that the object of the attack be either a similar type target or the means used in the offending attacks, or that the action taken be contemporaneous with the provocation, particularly if the attacker is responding to a continuing course of conduct.
252. supra note 85, at 15 Id. Scholarly writings reflect this same attitude on the subject.
253. See Shulman, supra note 137, at 956 (suggesting that if the victim of a CNA did not have the capability to respond with CNA or CND, it could legally proportionally respond with kinetic destruction of the computer system).
254. Schmitt, Normative Frammork, supra note 33, at 892.
255. Sirak, supra note 4, at 24.
256. See, e.g., Shulman, supra note 137, at 955-56 (arguing that during armed conflict, even a protected person conducting a lethal CNA would lose her status and become the legitimate target of a response). Shulman states: The person launching a computer virus to attack an American military communications system, for example, might be sitting in the basement of a publicly traded telephone company wearing a nun's habit. Instead of a military uniform, she would be wearing the symbol of clergy - a protected group [under the law of war], and she would be sitting in a privately owned building also doubly protected by being private and vital to the well-being of society. Even assuming she is indeed a nun and not an impostor, she would nonetheless also be a combatant subject to a proportional response, such as the destruction of her own computer or the local area network.
257. Id.
258. Schmitt, Bellum Americanum, supra note 115, at 1073-74.
259. INSTRUCTION 3121.01A, supra note 98.
260. Uri Fisher, Information Age State Security: New Threats to Old Boundaries, J. HOMELAND SECURITY, Nov. 2001, at http://www.homelandsecurity.org/journal/Anicles/fisher.htm (stating that cyber attacks represent a greater attack on a nation's geographic territorial sovereignty than even nuclear weapons with their long distance capability).
261. As mentioned previously, it is only after the passive defenses have been penetrated that the active defenses or "hack-back" would occur. Thus, there would be time prior to the penetration of the passive defenses to take intermediate steps.
262. See Souder, supra note 34.
263. 1?3 It is insufficient in such a case to simply turn off the computer or sever the connection with the attacker. Not only does this allow the attacker to control the situation by forcing a continuing interruption in the ability of a nation to use its own computer systems, but it also provides no deterrent against the continuing invasion of the system. Further, as in the case of an air traffic control computer system, shutting the system down may itself create the conditions for lethal consequences. For self-defense to have any real meaning, it must not only deflect the lethal attacks of the aggressor, but must also allow for degradation of the aggressor's ability to continue to commit those lethal acts. See Sirak, supra note 4, at 28;
264. Souder, supra note 34.
265. SHARP, supra note 57, at 153
266. (quoting JOINT PUB. 1-02, supra note 105, at 398). Joint Pub. 1-02 defines rules of engagement (ROE) as [directives issued by competent military authority to delineate the circumstances and limitations under which its own naval, ground, and air forces will initiate and/or continue combat engagement with other forces encountered. They are the means by which the National Command Authority (NCA) and operational commanders regulate the use of armed force in the context of applicable political and military policy and domestic and international law.
267. supra note 105, at 398 Id.
268. SHARP, supra note 57, at 149. Hostile intent is defined as "[t]he threat of imminent use of force against the United States, U.S. forces, and in certain circumstances, U.S. nationals, their property, U.S. commercial assets, and/or other designated non-US forces, foreign nationals and their property."
269. SHARP, supra note 57, at 149 Id. Hostile act is defined as "[a]n attack or other use of force against the United States, U.S. forces, and, in certain circumstances, U.S. nationals, their property, U.S. commercial assets, and/or other designated non-US forces, foreign nationals and their property."
270. SHARP, supra note 57, at 149 Id.
271. SHARP, supra note 57, at 149 Id. The definitions of hostile act and hostile intent are significant because service members and their commanders have not only the authority, but also the obligation to respond to them. "A unit commander has the authority and obligation to use all necessary means available and take all appropriate actions to defend the unit, including elements and personnel, or other U.S. forces in the vicinity, against a hostile act or demonstrated hostile intent."
272. SHARP, supra note 57, at 149 Id.
273. This could be accomplished through a combination of warning banners on critical national infrastructure websites, policy statements, and inclusion in government publications.
274. Whiteman, Self-Defense, supra note 70, at 982;
275. see also Schmitt, Normative Framework, supra note 33, at 931 (discussing the fact that the window of opportunity to respond in self-defense is different under different methods of attack). "Hence, the appropriate question relates more to the correct timing of the preemptive strike than to the imminence of the attack that animates it."
276. Schmitt, Normative Framework, supra note 33, at 931 Id.
277. On April 14, 1986, in response to recent bombings in Europe involving U.S. soldiers, the United States conducted a bombing strike on various terrorist and military targets in Libya. President Reagan justified these actions as within the U.S.'s right of self-defense under Article 51 of the U.N. Charter. Stuart G Baker, Note, Comparing the 1993 U.S. Airstrike on Iraq to the 1986 Bombing of Libya: The New Interpretation of Article 51, 24 GA. J. INT'L & COMP. L. 99, 106 (1994). In preparation for this strike, France denied the U.S. request to fly over its airspace in furtherance of its military operation and Spain stated after the fact that it would have denied permission had it been asked.
278. Id. at 106 n.36. Though France and Spain may have acted out of a belief that this was not justifiable self-defense, the interaction highlights the question of the use of neutral territory in the exercise of self-defense. Even if transiting a nation's airspace might be a violation of that nation's territorial sovereignty, the DOD OGC has concluded that "use of a nation's communications networks as a conduit for an electronic attack would not be a violation of its sovereignty in the same way that would be a flight through its airspace by a military aircraft."
279. DOD OGC, supra note 85, at 21. For an excellent discussion of neutrality in information warfare,
280. see Walker, supra note 2 .
281. Shulman, supra note 137, at 948.
282. THE LAWS OF ARMED CONFLICTS, supra note 45, at 941.
283. Id. at 943. Article 8. A neutral Power is not called upon to forbid or restrict the use on behalf of the belligerents of telegraph or telephone cables or of wireless telegraphy apparatus belonging to it or to companies or private individuals. Article 9. Every measure of restriction or prohibition taken by a neutral power in regard to the matters referred to in Article 7 and 8 must be impartially applied by it to both belligerents. A neutral Power must see to the same obligation being observed by companies or private individuals owning telegraph or telephone cables or wireless telegraphy apparatus.
284. Id.
285. Id. at 943.
286. DOD OGC, supra note 85, at 6.
287. In the case of Moonlight Maze, the Russian government has been contacted and has made no efforts to stop the computer intrusions. Adams, supra note 162, at 98,100. According to James Adams, "[L]ast year, Washington issued a demarche to the Russian government and provided Russian officials with the telephone numbers from which the attacks appeared to be originating. Moscow said the numbers were in-operative and denied any prior knowledge of the attacks."
288. Id. at 100.
289. Robbat, supra note 152, at para. 11.
290. DOD OGC, supra note 85, at 21.