Easier Said than Done: Legal Reviews of Cyber Weapons

Abstract

IntroductionOn June 1, 2012, author and New York Times reporter David Sanger created a sensation within the cyber-law community. Just over a year previously, Vanity Fair, among other media outlets, reported that a malware package of unprecedented complexity had effectively targeted the Iranian nuclear research program.1 The malware, which came to be known as Stuxnet, was also discovered on many computer systems outside Iran, but it did not appear to do any damage to these other systems. Just as the discussions spurred by the discovery of Stuxnet had begun to die down, the New York Times published an interview with Mr. Sanger to discuss his newest book, in which he alleged that the Stuxnet malware had been part of a U.S. planned and led covert operation. The assertion that a nation state had used a cyber attack in support of its national objectives reinvigorated the attention of cyber-law commentators, both in and out of government.What makes Stuxnet interesting as a point of discussion is that the basic functioning of the software is easy to understand and easy to categorize. A piece of software was deliberately inserted into the target systems, and physical damage was the result. However, resulting physical damage is not characteristic of most operations, and the legal analysis of Stuxnet is of limited utility when examining a broad range of activities.2 A distinct lack of physical effects is much more characteristic of operations, and the absence of physical effects has continued to complicate the legal analysis of in the context of military operations.The terms cyber attack or cyber imply the employment of weapons. But the uncertainty in the term cyber leads to equal uncertainty in identifying weapons, and great confusion about when the use of a cyber weapon is a cyber attack that creates a state of cyber warfare. There have been some excellent attempts to define cyber weapon with specificity and to use that discussion to gain a better understanding of war.3 These discussions are intellectually stimulating, but the purpose of this paper is to highlight the difficulty in transforming these broad topics of academic discussion into practical legal advice for those few practitioners advising commanders on the impact of law on operations. Military attorneys must translate academic and deeply theoretical discussions into concrete legal advice. That experience informs this article, which offers examples of how the practicalities of war may collide with the academic discourse, in the hope of informing and shaping the debate. The actual examples of capabilities and operations offered here highlight the practical issues involved in cyberspace operations, where attorneys are called upon to analyze operations under the existing legal regime regarding weapons, and the means and methods of war. Ultimately, this article concludes that treating all techniques as weapons is impractical. Rather, an assessment focusing on how a capability will be used in context, especially of the primary purpose of the capability, is more effective and consonant with international law. This approach will more clearly delineate attacks, and permit a separate discussion of the great majority of events - those that fall below the level of attack.What this paper does not do is discuss the difference between state-sponsored operations, including warfare and espionage, and crimes. Distinguishing between state uses of cyberspace, and the operations of criminal groups by examining the technical details of incidents is usually not possible. ultimately, this can only be determined by learning and assessing the motivation of the responsible party, and issues of agency and attribution may make this a near-impossible task. Agency is a particularly thorny problem. The keyboard operator may think he is merely part of a criminal enterprise stealing intellectual property or assisting in an extortion scheme, but the entity paying the bills could as easily be a government pursuing a national security agenda. …