Cyber security without Cyber war

Journal of Conflict and Security Law

Volumn 17, Issue 2, 2012, Pages 187-209

  O'connell, Mary Ellen ^a  

^a UNIVERSITY OF NOTRE DAME   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

EID: 84865569445     PISSN: 14677954     EISSN: 14677962     Source Type: Journal    
DOI: 10.1093/jcsl/krs017     Document Type: Article

References (114)

1. Scholarly articles on the international law of cyberspace began to appear in the mid-1990s. These would, of course, have reflected developments and discussions of the previous years.
2. See, eg, A Mefford, 'Lex Informatica: Foundations of Law on the Internet' (1997/1998) 5 Ind J Global Legal Studies 211.
3. DR Johnson and D Post, 'Law and Borders-The Rise of Law in Cyberspace' (1996) 48 Stanford L Rev 1367.
4. See, eg, R Brust, 'Cyberattacks: Computer Warfare Looms as the Next Big Conflict in International Law' (1 May 2012) (accessed 20 June 2012).
5. See further R Buchan, 'Cyber Attacks: Unlawful Uses of Force or Prohibited Interventions?'.
6. N Tsagourias, 'Cyber Attacks, Self-Defence and the Problem of Attribution' in this volume.
7. See s 2.A below and accompanying notes.
8. The North Atlantic Treaty Organization was founded in 1949 for the collective self-defence of Western European states, the USA and Canada.
9. See (accessed 20 June 2012).
10. According to the NATO website: 'Cyber attacks continue to pose a real threat to NATO and cyber defence will continue to be a core capability of the Alliance.' (accessed 20 June 2012).
11. See s 2.B below and accompanying notes.
12. See, eg, M Clayton, 'The New Cyber Arms Race' Christian Science Monitor (7 March 2011), (accessed 20 June 2012).
13. See also ns 51-53 and accompanying text.
14. See n 51 and accompanying text.
15. See s 2.C and accompanying notes.
16. See, eg, M McConnell, 'To Win the Cyber-War, Look to the Cold War' Washington Post (Washington, 28 February 2010) at Bl. (The op-ed's online version has a different title: 'How to Win the Cyber War We Are Losing' (accessed 20 June 2012).)
17. For a law journal article advocating a return to Cold War thinking about cyber security and international law, see M Waxman, 'Cyber-Attacks and the Use of Force: Back to the Future of Article 2(4)' (2011) 36 Yale J Intl L 421, eg at 425-26.
18. See ns 55-59 and accompanying text.
19. SA Baker and CJ Dunlap Jr, 'What is the Role of Lawyers in Cyberwarfare?' (1 May 2012) (accessed 20 June 2012).
20. Writing in a recent online edition of the main stream international affairs journal, Foreign Policy, Baker wrote that 'State Department and National Security Council lawyers are implementing an international cyber war strategy that relies on international law "norms" to restrict cyberwar.' S Baker, 'Denial of Service, Against Cyberwar with Arcane Rules and Regulations' Foreign Policy (30 September 2011) (accessed 20 June 2012).
21. See, eg, Waxman, who takes issue with both Schmitt's attempt to devise criteria that could equate cyber attacks with the armed attack necessary to trigger UN Charter art 51 and Dinstein who is confident that the Internet can be regulated under existing weapons conventions and other rules. Waxman (n 10) fns 156-61 and accompanying text (Schmitt) and fn 64 and accompanying text (Dinstein), citing MN Schmitt, 'Computer Network Attack and the Use of Force in International Law: Thoughts on a Normative Framework' (1999) 37 Colum J Transnatl L 885.
22. Y Dinstein, 'Computer Network Attacks and Self-Defense' (2002) 76 Intl Law Studies 99.
23. The very point of Waxman's article, for example, is to return to the advocacy of some scholars during the Cold War for expanded rights to use military force by resort to novel interpretations of the plain terms of the UN Charter and rules of customary international law. See Waxman (n 10) eg at 431.
24. P Singer and N Schachtman, 'The Wrong War: The Insistence on Applying Cold War Metaphors to Cybersecurity is Misplaced and Counterproductive' Brookings Institution (15 August 2011) (accessed 20 June 2012).
25. R Singel, White House Cyber Czar: 'There is No Cyberwar' Wired Magazine (4 March 2010).
26. See the 1992 Convention on the Prohibition of the Development, Production, Stockpiling and Use of Chemical Weapons and on their Destruction (opened for signature 13 January 1993, entered into force 29 April 1997) 1974 UNTS 317 5www.opcw.org/chemical-weapons-convention4 (accessed 20 June 2012). As of time of writing, the CWC had 188 state parties and over 70% of the world's chemical weapons stockpile had been destroyed.
27. J Carr, Inside Cyberwarfare (O'Reilly 2010) 2.
28. For a helpful, general discussion of the current issues respecting cyber security, see Brookings Institution, 'The Cybersecurity Agenda: Policy Options and the Path Forward' (26 October 2011) (accessed 20 June 2012).
29. Brookings Institution, 'Deterrence in Cyberspace: Debating the Right Strategy with Ralph Langner and Dmitri Alperovitch' (20 September 2011) (accessed 20 June 2012).
30. SM Hersh, 'The Online Threat, Should We Be Worried About a Cyber War?' New Yorker (1 November 2010) 44.
31. 'The Cyber Raiders Hitting Estonia' BBC News (17 May 2007) (accessed 20 June 2012).
32. 'Estonia Fines Man for Cyber War' BBC News (25 January 2008) (accessed 20 June 2012).
33. M Landler and J Markoff, 'Digital Fears Emerge After Data Siege in Estonia' New York Times (New York, 29 May 2007) (accessed 20 June 2012).
34. J Davis, 'Hackers Take Down the Most Wired Country in Europe' Wired Magazine (21 August 2007) (accessed 20 June 2012).
35. J Benitz, 'Baltic States Urge NATO to Bolster Cyber-Defense' NATO Alliance (27 May 2011) (accessed 20 June 2012).
36. For details of the computer network attacks that occurred during the South Ossetia conflict, see S Watts, 'Combatant Status and Computer Network Attack' (2010) 50 Virginia J Intl L 391, 397-98.
37. J Swaine, 'Georgia: Russia "conducting cyber war" ' The Telegraph (London, 11 August 2008) (accessed 20 June 2012).
38. See also E Tikk and others, 'Cyber Attacks Against Georgia: Legal Lessons Identified' (Cooperative Cyber Defence Centre of Excellence 2008) 1, 4-15 at (accessed 20 June 2012).
39. See, generally, ME O'Connell, 'The Prohibition on the Use of Force' in C Henderson and N White (eds), The Handbook of Conflict and Security Law (forthcoming Edward Elgar Publishing).
40. C Gray, International Law and the Use of Force (3rd edn, OUP 2008).
41. J Markoff and DE Sanger, 'In a Computer Worm, a Possible Biblical Clue' New York Times (New York 30 September 2010).
42. WJ Broad and others, 'Israeli Test on Worm Called Crucial in Iran Nuclear Delay' New York Times (New York, 15 January 2011).
43. J Fildes, 'Stuxnet Work "Targeted high-value Iranian Assets" ', BBC News (23 September 2010) (accessed 20 June 2012).
44. J Hilder, 'Computer Virus Used to Sabotage Iran's Nuclear Plan "Built by US and Israel" ' Australian (27 January 2011).
45. 'NATO and Cyber Defence' NATO (accessed 20 June 2012).
46. N Heath, 'NATO Creates Cyber-Defence Command' ZD Net (9 April 2008) (accessed 20 June 2012).
47. 'Working with the Private Sector to Deter Cyber Attacks' NATO (10 November 2011) (accessed 20 June 2012).
48. Strategic Concept for the Defence and Security of the Members of the North Atlantic Treaty Organization (19 November 2010) (accessed 20 June 2012) para 19.
49. 'NATO Launches Cyber Defence Centre in Estonia' Space Daily (14 May 2008) (accessed 20 June 2012).
50. J Hunker, 'Cyber War and Cyber Power: Issues for NATO Doctrine' Research Division NATO Defence College, Working Paper No 62, 2010 (accessed 20 June 2012) at 8.
51. see also 'NATO Launches Cyber Defence Centre in Estonia' (n 43).
52. 'Working with the Private Sector to Deter Cyber Attacks' (n 41).
53. 'US Department of Defense, Cyber Command Fact Sheet (21 May 2010) (accessed 20 June 2012).
54. WLynn, Former Deputy Secretary of Defense, 'Announcement of the Department of Defense Cyberspace Strategy at the National Defense University' (14 July 2011) (accessed 20 June 2012).
55. Singer and Schachtman (n 16).
56. T Carney, 'The Rise of the Cybersecurity Industrial Complex' The Examiner (22 April 2011) (accessed 20 June 2012).
57. Hunton & Williams LLP, 'Senators Introduce Cybersecurity Act of 2012' Association of Corp Counsel (22 February 2012) (accessed 20 June 2012).
58. 'McCain Promises GOP Alternative to "Super Regulator" Cybersecurity Bill' The Daily Caller (20 February 2012) (accessed 20 June 2012).
59. McConnell (n 10).
60. Singer and Schachtman (n 16).
61. 'International Strategy for Cyberspace: Prosperity, Security, and Openness in a Networked World' (May 2011) (accessed 20 June 2012). (Emphasis added).
62. See Baker (n 13).
63. see also J Crawford, Manley O Hudson Award Lecture ASIL 2012 (on file with the author).
64. Numerous examples come readily to mind: the continuing operation of the prison at Guantánamo Bay, Cuba; the continuing use of military commissions; the failure to enforce the Geneva Convention prohibition on torture, the failure to enforce the Convention Against Torture's obligations and the campaign of targeted killing far from zones of armed conflict hostilities, to name a few.
65. See ME O'Connell, 'Adhering to Law and Values against Terrorism' (2012) Notre Dame J Intl & Comp Law (forthcoming).
66. Schmitt (n 14).
67. M Roscini, 'World Wide Warfare-Jus Ad Bellum and the Use of Force' (2010) 14 Max Planck UN YBk 85.
68. See also CJ Dunlap, Jr, 'Perspectives for Cyber Strategies on Law for Cyberwar' (Spring 2011) Strategic Studies Q 81, 81.
69. See generally R Buchan, 'Cyber Attacks: Unlawful uses of Force or Prohibited Interventions?' in this volume.
70. UN Charter Art 2(4): 'All Members shall refrain in their international relations from the threat or use of force against the territorial integrity or political independence of any State, or in any other manner inconsistent with the Purposes of the United Nations'. Article 39: 'the Security Council is given authority to 'determine the existence of any threat to the peace, breach of the peace, or act of aggression' and the responsibility to 'maintain or restore international peace'. It may do so by authorizing the use of force by member states'. Article 51: 'Nothing in the present Charter shall impair the inherent right of individual or collective self-defense if an armed attack occurs against a member of the United Nations, until the Security Council has taken measures necessary to maintain international peace and security. Measures taken by members in the exercise of this right of self-defense shall be immediately reported to the Security Council and shall not in any way affect the authority and responsibility of the Security Council under the present Charter to take at any time such action as it deems necessary in order to maintain or restore international peace and security.'
71. D Bowett, Self-Defence in International Law (Manchester University Press 1958) 3, 184-85.
72. I Brownlie, International Law and the Use of Force by States (OUP 1963) 428-36.
73. Military and Paramilitary Activities in and Against Nicaragua (Nicararagua v US) [1986] ICJ Rep 14, 103-4 (the Nicaragua case).
74. Oil Platforms (Iran v US) [2003] ICJ Rep 161, 191.
75. Legal Consequences of the Construction of a Wall in the Occupied Palestinian Territory (Advisory Opinion) [2004] ICJ Rep 136, 195.
76. Armed Activities on the Territory of the Congo (Congo v Uganda) [2005] ICJ Rep 168, 301.
77. See generally on the evidence standards of international law in use of force cases, ME O'Connell, 'Evidence of Terror' (2002) 7 JCSL 19.
78. Also see N Tsagourias, 'Cyber Attacks, Self-Defence and the Problem of Attribution' s 3, in this volume.
79. DE Graham, 'Cyber Threats and the Law of War' (2010) 4 J Natl Security L & Policy 87, 92.
80. citing E Jensen, 'Computer Attacks on Critical National Infrastructure: A Use of Force Invoking the Right of Self-Defense' (2002) 38 Stanford J Intl L 232-35.
81. R Lehtinen and others, Computer Security Basics (2nd ed, O'Reilly 2006) 81.
82. See n 36.
83. Nicaragua paras 187-201.
84. See Declaration on Principles of International Law Concerning Friendly Relations and Cooperation Among States in Accordance with the Charter of the United Nations, GA Res 2625 (XXV), UN Doc N8028 (1970).
85. 1928 OAS Convention on the Rights and Duties of States in the Event of Civil Strife 134 LNTS 45.
86. See Nicaragua para 203 (citing Declaration on the Inadmissibility of Intervention in the Domestic Affairs of States and the Protection of their Independence and Sovereignty, GA Res 2131 (XX), UN Doc A/EES/36/103 (9 December 1981)). The Court also referred to the principle of State sovereignty under article 2(1) of the UN Charter, noting its close connection to the principles of the prohibition on the use of force and of non-intervention.
87. Nicaragua para 212-14.
88. The definitions of the terms 'countermeasures' and 'sanctions' are not a settled matter in international law. White and Abass, for example, define countermeasures as non-forcible measures taken by States and sanctions as non-forcible measures taken by organizations. This would be a helpful distinction but for the fact that the USA, for example, labels its unilateral, non-forcible coercive measures 'sanctions'.
89. See generally, N White and A Abass, 'Countermeasures and Sanctions' in M Evans (ed), International Law (3rd edn, OUP 2010) 531.
90. In the USA the leading scholar in the area of the Internet is Lawrence Lessig of Harvard Law School. Lessig does comment on international and foreign law but his background and training are plainly in the area of US domestic law. Even Jack Goldsmith, also Harvard Law School, while being called the future of international law at the school is plainly from the domestic law arena. This is revealed by his comment that law governing military use of the Internet, is uncertain. This fact about cyber scholars is changing, however, as intellectual property scholars, such as Graham Dinwoodie, with strong backgrounds in international and domestic law relevant to cyber space regulation.
91. A number of scholars have already been cited working in the area of international law and the use of force, who have analysed military force in cyber space: see eg, Schmitt (n 14).
92. Dinstein (n 14).
93. Graham (n 77).
94. Dunlap (n 12).
95. As White and Abass point out, it is also the case that international law scholars have paid relatively little attention to countermeasures and sanctions and the rules governing their use. White and Abass (n 83) 531.
96. But see ME O'Connell, The Power and Purpose of International Law, Insights from the Theory and Practice of Enforcement (OUP 2008, paperback 2011) chs 4 and 5 and the citations therein.
97. O'Connell (n 86) 264.
98. See V Gowlland-Debbas, United Nations Sanctions and International Law (Kluwer 2001).
99. See n 18.
100. 1970 Treaty on Nuclear Non-Proliferation (opened for signature 1 July 1968, entered into force 5 March 1970) 729 UNTS 161 (accessed 20 June 2012).
101. J Markoff and AE Kramer, 'US and Russia Differ on a Treaty for Cyberspace' New York Times (New York, 27 June 2009) (accessed 20 June 2012).
102. Waxman dismisses the Russian proposal because he believes the Russians are developing cyber weapons. This is an unpersuasive reason not to pursue a convention. While the Chemical Weapons Convention was being negotiated, however, States continued to maintain chemical weapons and very likely to continue to develop them. Waxman (n 14). The Russian proposal has been part of the discussion within the United Nations about achieving security in cyberspace. This discussion dates to 1998.
103. See Developments in the field of information and telecommunications in the context of international security, G.A. Res 53/70, U.N.Doc. A/RES/53/70 (4 January 1999).
104. Markoff and Kramer (n 91).
105. 2001 Budapest Convention on Cybercrime (accessed 20 June 2012).
106. N Perlroth, 'Travelling Light in a Time of Digital Thievery' New York Times (New York, 10 February 2012) (accessed 20 June 2012).
107. M Borrett, 'Cyber Strategies Revealed' IBM Institute for Advanced Security (11 December 2011) (accessed 20 June 2012).
108. C Nott and others, 'Cyber Security: Protecting the Public Sector' IBM Institute for Advanced Security (September 2011) (accessed 20 June 2012) 1, 7.
109. L Daniel, 'Cyber Command Synchronizes Services' Efforts' US Department of Defense (9 July 2010) (accessed 20 June 2012) (emphasis added).
110. 'Much of cyberspace is owned and used by private companies. [Thus i]t is businesses that will drive the innovation required to keep pace with security challenges.' Borrett (n 96).
111. A Etzioni, 'Private Sector Neglects Cyber Security' The National Interest (29 November 2011) (accessed 20 June 2012).
112. The attitude of many in the private commercial cyber sector is captured in this opening sentence of an on-line article by two lawyers on behalf, presumably, of clients: 'Once again, many companies in the telecoms and information and communications technology (ICT) sector are facing the specter of a United Nations agency (in this case the International Telecommunications Union (ITU)) regulating critically important aspects of the internet as well as substantially expanding its jurisdiction over the telecoms and ICT industries.' Ambassador DA Gross and E Lucarelli, 'The 2012 World Conference on International Telecommunications: Another Brewing Storm Over Potential Un Regulation of the Internet' Who'sWho Legal (30 April 2012) (accessed 20 June 2012).
113. The Brookings Institution (n 16). 'Being secure is not just about keeping 'bad guys on the outside; it's about making the systems inside less vulnerable.' Reducing vulnerability of internal systems includes ensuring: (1) Each application validates its input for reasonability before processing; and (2) Each application has a way of announcing an exception-whether it is a security intrusion or simply a failing intelligent Electronic Device (IED) sending bad input. It is for the security system to decide why the abnormal event occurred.
114. Jeffrey Katz, Smart Grid Security and Architectural Thinking, available at (accessed 20 June 2012).