The Law of Cyber-Attack

Abstract

Iran’s nuclear program grinds to a halt, the subject of a sophisticated computer attack that sent centrifuges spinning wildly out of control. A “distributed denial of service” attack takes the entire population of Burma offline immediately before the country’s first national election in twenty years. China’s military mounts an attack on a Falun Gong Web site based in Alabama. What law regulates these “cyber-attacks”? Does the law of war apply? If not, what other bodies of law might help address the problem? This Article examines these questions and, in the process, offers new insights into how existing law may be applied—and adapted and amended—to meet the distinctive challenge posed by cyber-attacks. It does so in two principal ways. First, the Article clarifies what cyber-attacks are and how they relate to existing bodies of law, including the law of war, recent international efforts to directly regulate cyber-attacks, international bodies of law that may be used to indirectly regulate cyber-attacks, and domestic criminal law. Second, the Article shows how existing law is deficient and what needs to be done to improve it. Although existing bodies of law do offer some tools for responding to cyber-attacks, these tools are far from complete or adequate. The law of war, for example, provides a useful legal framework for only the very small slice of cyber-attacks that amount to an armed attack or that take place in the context of an ongoing armed conflict. Other existing legal frameworks—both domestic and international—offer equally fragmentary assistance in addressing cyberattacks through law. Examining existing law leads to a clear conclusion: A new, comprehensive legal framework is needed to address cyber-attacks. That framework includes a more robust system of domestic enforcement, but a truly effective solution to this global challenge will require global cooperation. This Article thus outlines the key elements of a cyber-treaty that would provide a more comprehensive solution to the emerging threat of cyber-attacks.