Why Cyber Attacks Could Be War Crimes

By Patrick Lin

Cyber-attacks are the new normal, but, when they come from abroad, they can raise panic about an invisible cyberwar. If international conflicts are unavoidable, isn’t a cyberwar better than a physical war with bombs and bullets?

Sure, cyberwar is better than a kinetic or physical war in many ways, but it could also make war worse. Unless it’s very carefully designed, a cyber-attack could be a war crime.

Imagine that you’re a political leader and you want to take out an enemy base. We suspect it’s a propaganda machine and financing terrorist activities. How would you do it?

Well, you could go the old fashioned way, call in some airstrikes or send troops to blow up the building, but this would be an open declaration of war, worsening tensions. It would also be a political disaster if your troops or even drones were captured.

Now, there is another way: you could launch a cyber-attack against the facility. This is more invisible and therefore less risky. It’d take too long to directly hack into the facility’s secure network, but you’ve already created an email virus that can knock out the town’s energy grid, which would take out the base.

Let’s say you plan to disguise the malware as an official United Nations email to help ensure it’ll be opened by the local leaders. Once opened, the malware will autonomously spread on its own across the town’s networks until it finds the energy grid and is able to disable its controls and overload its transformers.

Without power, the enemy headquarters has effectively been taken out, without a single boot on the ground or bullet fired. So, in this scenario, should you launch that cyberattack?

Before you do, your legal advisor might tell you: “Not so fast.”

By taking out an energy grid, you’re not only blacking out the enemy base, but also all local civilians. You will also infect innocent computers with malware, you used them to reach the energy grid, and this seems to break a bedrock rule in the Laws of Armed Conflict: the principle of distinction, which requires that we never target non-combatants and spare them from the effects of an attack as much as possible.

Collateral damage is allowed, of course, but within limits. If a few nearby civilians are accidentally killed while some important target is blown up, that’s tragic, but not illegal in war, if the military advantage gained outweighs the deadly side effect. This is the rule of proportionality, which means that collateral damage must not be disproportionate or unreasonable.

Bombing an entire town to kill a lone sniper, for instance, would likely be disproportionate. Causing a blackout for an entire town or city? That could be excessive, too. Remember, electricity doesn’t just turn on the lights, it also keeps medicine and food refrigerated and runs air conditioning and heating units, without which hundreds of people, or more, could die in the summer or winter. Blowing up transformers could also start wildfires that affect or kill local residents.

Let’s say no town is nearby and no innocent civilians are affected in this scenario. There’s still a prior question of whether that enemy building is a legal target in the first place. If it’s only a propaganda machine and a bank for terrorists, yes, it certainly plays a crucial role in enabling militants. But being crucial doesn’t make something a legal target. The Laws of Armed Conflict prohibit the targeting of media and financiers, allowing only people and objects directly participating in hostilities as targets.

Even if we can resolve all of these things, no collateral damage, no affected civilians and a confirmed legal target, there’s also a rule against perfidy or treacherous deceit. Dressing up as a humanitarian worker or in a UN uniform to gain access and attack an enemy is an example of illegal perfidy. In your cyber-attack, pretending that your email is coming from UN offices might break that rule, you’re disguising it with what’s supposed to be a neutral or protected status in war.

And, even if we can somehow resolve this issue, unleashing an autonomous cyber-weapon could be a problem. In ongoing debates about killer robots, a key argument is that autonomous robots are illegal if we can’t retain meaningful human control. Their autonomy may create a responsibility gap, where it’s hard to pin liability on a person if things go wrong. After all, we can’t punish artificial intelligence (AI) for its decisions and actions.

Responsibility aside, without meaningful human control, we could see “flash escalations”, as military AI interacts with other AI systems at digital speed and causes unpredictable, cascading effects too fast for us to stop. This is something like the “flash crashes” that still plague stock markets or “flash spikes” from competing price-bots that can drive the sale price of a textbook to $23 million.

There are many other legal and ethical issues too and it seems weird that war is governed by so many rules. But the Laws of Armed Conflict exist to protect us all, so that war doesn’t become a free-for-all in which terrible, inhumane weapons are used, like biological weapons or chemical gas; innocent civilians pay for the sins of their politicians; and fighting is so cruel that lasting peace is impossible.

Deliberately breaking those rules means risking the charge of a war crime. It also sets a dangerous precedent that our enemies may follow, putting us all at risk. It undermines the rule of law and erodes the values such laws are meant to safeguard.

Now, it could be that those laws and norms need to evolve with technological realities. This isn’t meant to argue that cyber-weapons should never be used. Again, something seems right about firing digital bullets instead of real ones. But, while we wait for the law to align with changing realities, some victims may turn to self-help measures, such as “hacking back” or counter cyberattacks, that could exacerbate international tensions.

Many other questions are now emerging. Recently, a Facebook glitch accidentally revealed personal information about its content moderators, potentially exposing them to retaliation from the terrorist groups they thwart. Under the old rules of war, it’d certainly feel wrong that these civilian office workers could be legitimate targets.

But if cyberspace is just another battlefield domain, then those content moderators could arguably be “combatants directly participating in hostilities” and therefore liable to attack. Anyone else who participates in cyber operations against an adversary should be aware of this risk before they sign up, if the argument, which is untested in law, works.

Given the risks and uncertainty, this is a conversation we need to have right now, not after the cyber genie is out of the bottle and has ripped through the laws of war. By that time, it may be too late.

WeForum

Patrick Lin is Director, Ethics and Emerging Sciences Group, at California Polytechnic State University (Cal Poly)

You Might Also Read:

Which Countries Are Ready For Cyberwar?:

Cyberwar: A Guide:

 

« Spy Satellites Just Became Much Smaller
IT Jobs Are Bound For Extinction »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Titania

Titania

Titania provide network security and compliance software. Find your Network Security gaps before hackers do with our security & compliance tools.

Norton Rose Fulbright

Norton Rose Fulbright

Norton Rose Fulbright is a global business law firm. Practice areas include Data protection, Privacy and Cybersecurity.

Applied Risk

Applied Risk

Applied Risk is an established leader in Industrial Control Systems security, focused on critical infrastructure security and combating security breaches that pose a significant threat.

Saudi Federation for Cyber Security and Programming (SAFCSP)

Saudi Federation for Cyber Security and Programming (SAFCSP)

SAFCSP is a national institution under the umbrella of the Saudi Arabian Olympic Committee, which seeks to build national and professional capabilities in the fields of cyber security and programming.

Science Applications International Corporation (SAIC)

Science Applications International Corporation (SAIC)

SAIC is a premier technology integrator in the technical, engineering, intelligence, and enterprise information technology markets. Services and solutions include Cybersecurity.

Phosphorus Cybersecurity

Phosphorus Cybersecurity

Phosphorus has fully automated remediation of the two biggest IoT vulnerabilities, out of date firmware and default credentials.

CUJO AI

CUJO AI

CUJO AI is the global leader in the development and application of artificial intelligence to improve the security, control and privacy of connected devices in homes and businesses.

BeyondTrust

BeyondTrust

BeyondTrust is a leader in Privileged Access Management, offering a seamless approach to preventing data breaches related to stolen credentials, misused privileges, and compromised remote access.

Privacera

Privacera

Privacera enables consistent data governance, security, and compliance across all your data services - on-premises and in the cloud - so you can maximize the value of your data.

DeFY Security

DeFY Security

DeFY Security is a Cyber Security solutions provider with more than 20 years of experience securing financial institutions, healthcare, manufacturing and retail.

Northdoor

Northdoor

Northdoor provides a comprehensive set of services around information security and works with leading global technology vendors to deploy and manage cyber security solutions.

CV-Library

CV-Library

Start your job search with 216,931 live UK vacancies on award-winning CV-Library. Register your CV and find local jobs near you today!

Sekoia.io

Sekoia.io

Sekoia.io is a European cybersecurity company whose mission is to develop the best protection capabilities against cyber-attacks.

Royal United Services Institute (RUSI)

Royal United Services Institute (RUSI)

The Royal United Services Institute is an independent think tank engaged in cutting edge defence and security research. Areas of research include cyber security and resilience.

Barquin Solutions

Barquin Solutions

Barquin Solutions is a full-service information technology consulting firm focused on supporting U.S. federal government agencies and their partners.

Redport Information Assurance

Redport Information Assurance

Redport Information Assurance is an information assurance and cyber security solutions provider offering integrated business solutions for all levels of government.