The 21st century is experiencing the beginning of a new rebalancing of the world. Globalization, terrorism, weapons proliferation, the emerging East, and the rise of technology have resulted in shifting centers of power, the prominence of asymmetric threats, and quickly evolving warfare. In response, the United States military has undertaken a similar rebalancing to effectively meet these challenges. As the threat of conventional, World War II-style war continues to diminish, the emergence of a new battlefield, cyberspace, has taken a position equal to that of land, sea, air, and space. Arguably, cyberspace has become the fundamental stratum upon which modern warfighting capabilities are based — a state-of-the-art fighter plane is not very effective if its on-board systems and targeting network have been compromised. Beyond the empowering relationship between technology and weapons hardware, cyberspace potentially threatens the nation’s vital functions. Enemies may disable critical infrastructure, undermine logistical support, steal intelligence and communique, glean strategies, conduct industrial espionage, or wreak havoc on the civilian sector. But cyberspace is a double edged sword; just as cyberspace is a vulnerability to the United States, so is it too with all other advanced nations. Thus, it is not surprising that the United States military has created the U.S. Cyber Command to develop tactics and personnel capable of defending, attacking, and dominating the new cyberspace domain. However, the characteristics of cyberspace pose unique difficulties. In cyberspace, the best defense is a good offense. Typically, the ability to proactively defend against unauthorized access is short-lived as an adept enemy hacker can eventually find a weakness. Further, given the numerous preexisting vulnerabilities, defenses are most often reactive. Thus, agility and specialization are essential to be effective in cyberspace, both to attack and defend.In this realm, cybersecurity firms, defense contractors (collectively “PCSFs”) and state-sponsored hacker groups (“SSHGs”) have several advantages over traditional government actors, such as high specialization, quick innovation, higher pay, greater autonomy, and less accountability that make them particularly attractive for cyberwarfare. The combination of cyberwarfare and PCSFs/SSHGs is an exceptional blend of two systems almost completely unregulated by international or domestic law throughout the world. Under current domestic and international law, PCSFs/SSHGs operate in what is essentially a legal vacuum and with minimal restrictions. This Article addresses the legal classification of PCSFs/SSHGs if engaging in cyber-attacks. Part I examines the peculiarities of cyberwarfare vis-a-vis traditional war, and then discusses some recruiting advantages PCSFs/SSHGs have over the U.S. government in cyberspace. Part II outlines the distinction between cyber-crimes, cyber-espionage, and cyber-attacks. Part III discusses international and domestic law as it relates to mercenaries and the role of private defense companies in modern conflicts. Part IV analyzes whether PCSFs/SSHGs should be classified as mercenaries, ultimately arguing that PCSFs/SSHGs should be categorized as mercenaries as the law currently stands, and briefly concludes with prescribes a change to domestic law that will be able to adequately accommodate the role of private cyberwarriors. Although this Article will primarily focus on the United States’ particular position and U.S. PCSFs, many of the lessons apply globally SSHGs.
Read full abstract