The United States promises to follow international norms when conducting offensive cyberwar operations, reports Defense One. Speaking at the Navy League’s Sea Air Space conference last week, Adm. Michael Rogers, commander of U.S. Cyber Command and director of the National Security Agency, noted that cyber weapons are just the next evolutionary step in warfare and that, as a consequence, the rules of war should apply in cyberspace.
“Remember, anything we do in the cyber arena … must follow the law of conflict. Our response must be proportional, must be in line with the broader set of norms that we’ve created over time. I don’t expect cyber to be any different,” emphasized Rogers.
He also attempted to put cyber weapons (e.g, worms, viruses, remote manual control, key loggers etc.) into historical context:
I’m sure there were huge reactions to the development of mass firepower in the 1800s as a new kind of warfighting implement. Cyber represents change, a different technical application to attempt to achieve some of the exact same effects, just do it in a different way. Like those other effects, I think, over time, we’ll have a broad discussion in terms of our sense of awareness, both in terms of capabilities as well as limitations.
However, is it really that easy to apply international rules of war to cyberspace given the obvious difference between an analog and cyber a weapon? Back in 2011, I was part of a joint Russia-U.S. research team,which attempted to address this question by rendering the Geneva and Hague conventions in cyberspace.
We assessed that traditional weapons are characterized by:
- the use of force (including kinetic, electromagnetic field and nuclear), biological contaminants, or chemical hazards
- the immediate target is physical
- assets are usually specially designed for armed conflict
- access for the most advanced is very restricted
- the most basic are inexpensive while the most advanced are very expensive
In comparison, cyber weapons are characterized by:
- the use of logic
- the target is information or control assets
- often have civilian applications
- the threshold for access is low and getting lower
- can be relatively cheap
We also noted:
Relative to traditional weapons, their attributes can seem relatively extreme, as they can (a) be delivered on the order of a second from around the world, (b) have viral-like behavior in spreading, (c) have artificial intelligence that enables them to learn and adapt, (d) be produced relatively cheaply, and (e) be easily copied and transferred. While these attributes may be extreme from a weapons standpoint, they are also the same attributes of the ICT and networks that we use everyday in our personal lives and businesses. However, when combined with an aim toward destruction, they have a very different demeanor.
One of our principal recommendations was the following: “Russia, the U.S. and other interested parties, should conduct a joint analysis of the attributes of cyber weapons in order to determine if there are attributes analogous to weapons previously banned by the Geneva Protocol.”
We further stated:
An innovative approach that significantly satisfies (…) is one that would (a) avoid compromising military intelligence regarding specific capabilities, and that would (b) operate within the existing Convention principles, and that would (c) operate with discussion on attributes that are well established in the public domain.
The “Tallinn Manual on the International Applicable to Cyberwarfare” comes very close to the vision we had, but skips an in-depth analysis of weapon attributes and instead elaborates:
For the purpose of this Manual, cyber weapons are cyber means of warfare that are by design,use, or intended use capable of causing either (i)injury to, or death, of persons; or (ii) damage,to, or destruction of objects, that is, causing the consequences required for qualification of a cyber operation as an attack. (…)
A weapon is generally understood as that aspect of the system used to cause damage or destruction to objects or injury or death to persons. Cyber means of warfare therefore include any cyber device, materiel, instrument, mechanism, equipment, or software used, designed, or intended to be used to conduct a cyber attack.
Of course, some may argue that it is self-evident that cyber weapons can cause physical harm and consequently have one of the key attributes of analog weapons. However, this reductionist assessment does not fully do justice to the special nature of these new weapons and, for example, fails to cover the gray area between cyber espionage and cyber war (e.g., If cyber weapons are an integral part of cyber espionage operations, could such an activity be rather classified as cyber war?).
Consequently, conducting an analysis on the attributes of cyber weapons may be very helpful in reducing the ambiguity when discussing cyber-related security issues, and could help policymakers formulate prudential responses to this growing national security risk.