Cyber Attacks as "Force" under UN Charter Article 2(4)
I a 2010 article in Foreign Affairs, Deputy Secretary of Defense William Lynn revealed that in 2008 the Department of Defense suffered “the most significant breach of U.S. military computers ever” when a flash drive inserted into a US military laptop surreptitiously introduced malicious software into US Central Command’s classified and unclassified computer systems.1 Lynn explains that the US government is developing defensive systems to protect military and civilian electronic infrastructure from intrusions and, potentially worse, disruptions and destruction, and it is developing its own cyber-strategy “to defend the United States in the digital age.”2 To what extent is existing international law, including the UN Charter, adequate to regulate cyber attacks and related offensive and defensive activities today and in the future? By “cyber attacks” I mean efforts to alter, disrupt, degrade or destroy computer systems or networks or the information or programs on them.3 This article examines one slice of that legal puzzle: the UN Charter’s prohibitions of the threat or use of “force” contained in Article 2(4).4 Other writings in this volume deal with questions such as Article 51’s self-defense provisions and questions of State responsibility, and there are other international legal prohibitions and regulations that are relevant as well. But Article 2(4) is a good place to start
Why States Need an International Law for Information Operations
Just as states have spent the last several years wrestling with the appropriate legal response to terror, they must now undertake a similar effort to deal with the burgeoning use of information operations (IO). IO involves the use of information technology, such as computer network attacks or psychological operations, to influence, disrupt, corrupt, usurp or defend information systems and the infrastructure they support. More than thirty states have developed IO capacities. But IO is also undoubtedly attractive to non-state actors like Al Qaeda, since the technology is mostly inexpensive, easy-to-use, and capable of deployment from virtually anywhere. This Article assesses the ways in which international law, specifically the rules regulating the use of force and the law of war, currently applies to IO. Conventional wisdom suggests existing rules can cover IO by analogy. The conventional wisdom is only half-right. This Article explains why the existing rules govern IO, but challenges the unstated assumption that they do so appropriately. Translating existing rules into the IO context produces extensive uncertainty, risking unintentional escalations of conflict where forces have differing interpretations of what is permissible. Alternatively, such uncertainty may discourage the use of IO even if it might produce less harm than traditional means of warfare. Beyond uncertainty, the existing legal framework is insufficient and overly complex. Existing rules have little to say about the non-state actors that will be at the center of future conflicts. And where the laws of war do not apply, even by analogy, an overwhelmingly complex set of other international and foreign law rules purport to govern IO. To remedy such deficiencies, this Article proposes a new legal framework, an international law for information operations (ILIO). By adopting an ILIO, states could alleviate the uncertainty and complexity of the status quo, reduce transaction costs for states fighting global terror, and lessen the collateral costs of armed conflict itself. This Article concludes with a review of some of the regulatory design questions facing an ILIO, but does not offer any specific rules. Rather, its ultimate aim is to convince states and scholars about the need for an ILIO in the first place.
Revisiting a Strategic Assessment of the Internet
The political process is moving onto the Internet. Both within the United States and internationally, individuals, interest groups, and even nations are using the Internet to find each other, discuss the issues, and further their political goals. The Internet has also played an important role in recent conflicts. As a result, overseas segments of the Internet can be a useful tool for U. S. Department of Defense, both for gathering and for disseminating information. By monitoring public message traffic and alternative news sources from around the world, early warning of impending significant developments could be developed, in advance of more traditional means of indications and warning. Commentary placed on the Internet by observers on the scene of low-intensity conflicts overseas could be useful to U. S. policy making. During larger scale conflicts, when other conventional channels are disrupted, the Internet can be the only available means of communication into and out of the affected areas. Internet messages originating within regions under authoritarian control could provide other useful intelligence. Public messages conveying information about the intent of overseas groups prone to disrupting U. S. military operations can provide important counterintelligence. The Internet could also be used offensively as an additional medium in psychological operations campaigns and to help achieve unconventional warfare objectives. Used creatively as an integral asset, the Internet can facilitate many U. S. Department of Defense operations and activities.