It is no surprise, then, that many legal experts, diplomats and military commanders around the world are now debating how to extend the law of war to cyberspace. The emergence of electronic and cyberwar-fighting capabilities is the most important military development in decades, but it is not yet clear how existing treaties and conventions might apply in this new domain of conflict.
Uncertainty about the legal and ethical limits of state behavior in cyberspace could have disastrous consequences.
“We don’t know when or if a cyberattack rises to the level of an ‘armed attack,’ ” says Daniel Ryan, who teaches cyber law and the law of war at the U.S. military’s National Defense University.
“A direct attack on a civilian infrastructure that caused damage, even loss of life of civilians, would, I think, be a war crime,” Ryan says.
The civilian computer infrastructure would include the networks that control an air traffic control system or a water supply, for example. But distinguishing civilian and military cybertargets is not necessarily so simple.
“Since we can’t predict what the unintended consequences of the use of cyber might be, that would say, you can’t attack at all in cyberspace,” Ryan says. “That can’t possibly be the right answer.”
To Ryan, the “right answer” is that commanders should have to consider those effects of a cyberattack they are able to consider, but not those consequences that can’t be anticipated.
“It is a near certainty that the United States will scrupulously obey whatever is written down, and it is almost as certain that no one else will,” says Stewart Baker, a former NSA general counsel and an assistant secretary of homeland security under President George W. Bush.
The amount of anonymity in cyberspace means that a devastating attack might leave no “signature” or trace of its origin.
“Since we know that that’s going to happen all the time,” Baker says, “and no one is going to get caught, to say that [a cyberattack] is a violation of the law of war, is simply to make the law of war irrelevant.”