Building the ethical cyber commander and the law of armed conflict.

• Author: Prescott, Jody M.

1. INTRODUCTION II. WILL CYBER CONFLICT BECOME CYBER WAR? III. ACCELERATING REAL-TIME DECISION MAKING A. Innovative Staffing Techniques B. Human Computer Interfaces C. Autonomous Decision-Making Processes D. Are Ethical and Legally-Compliant ADPs Feasible?. IV. CURRENT CYBER EDUCATION EFFORTS IN ETHICS AND LOAC V. RETHINKING ETHICAL EDUCATION AND TRAINING A. Ordinary Soldiers--The Case Study B. Ordinary Soldiers--The P2P Lesson Plan VI. CONCLUSION I. INTRODUCTION

   The importance of ensuring that military action conforms to the overarching political, social, and legal norms held by most democracies' means that instruction in military ethics and the law of armed conflict (LOAC) is standard fare in military educational and training institutions throughout the world. (2) What are considered "military ethics" appear to vary significantly depending upon the country and the armed service in which they are taught, and in large part appear to focus on the teaching of specific virtues, such as integrity and loyalty, rather than the broad philosophical enquiry found commonly in ethics classes in civilian institutions. (3) There are variations, of course. Military ethics as taught in the Netherlands appear to be consistent with the "Dutch approach" of reducing the amount of force used in operations and emphasizing cooperation, and are therefore geared towards a more critical ethical perspective. (4) Military ethics as taught in Israel favor embedding the ethical lessons in professional development projects linked to officers' sense of professional identity. (5) Given the complementary nature of just war theory and LOAC, (6) it is not surprising that many military academies include some instruction on ethical models on the use of force, but this is far from universal. (7) To further complicate the ethical picture, despite the universal acceptance of the 1949 Geneva Conventions (8) and the large number of countries that have ratified Additional Protocol I, (9) understandings of LOAC can differ in their interpretation and application. (10) This potentially impacts the ways in which young military students process their ethical education and training.

   Conceivably, any instructional failure to strongly link military ethics and LOAC together might not have a discemable negative impact upon the ethical and legal conduct of military operations in the geophysical world. The reinforcing effects of civilian control over militaries, military traditions, discipline and regulations, and the continuing influence of ingrained social, religious and moral values will likely provide a sufficient framework within which most soldiers and officers can function ethically and legally in their regular military operations. (11) However, because of the technological and virtual basis of the human-created domain of cyberspace, future cyber operations are potentially very different from their geophysical world analogs. (12) The potential differences are great enough that different approaches may need to be taken by militaries in educating and training personnel eventually destined to become cyber commanders. For these new methods of cyber conflict training and education to be effective in developing ethical cyber commanders, military ethics and LOAC must be integrated. This need for integration is addressed in a lesson plan titled Ordinary Soldiers, which was developed by historians, educators, and lawyers under the guidance of the US Holocaust Memorial Museum and the West Point Center for Holocaust and Genocide Studies. This lesson plan not only provides a model for teaching military ethics and LOAC in a complementary manner, its format replicates aspects of how undergraduates interact with their peers in an environment influenced by information technology--an environment which parallels the operational cyber environment of the future in many ways.

   This article will first review the current nature of conflict in cyberspace, and then assess current trends in the development of cyber means and methods to form a picture of potential operational characteristics of cyber conflict, including the need for accelerated, but still LOAC-compliant, decision-making by cyber commanders. Next, this article will examine possible ways in which decision-making could be accelerated and surged as necessary, including the use of Autonomous Decision-Making Processes (ADPs) to control and exercise certain uses of force in cyberspace, and the ethical and legal concerns that might flow from the use of these techniques. Mindful of these possible staffing and technological solutions, this article will then address current academic efforts in the areas of cyber operations with respect to military ethics and LOAC, and identify both positive and negative aspects of these efforts. Finally, this article will describe the Ordinary Soldiers lesson plan's peer-to-peer (P2P) format as used with U.S. Army cadets at the University of Vermont and Norwich University, as well as its potential to be developed further through the incorporation of social media in its delivery, and propose it as a basis for effectively combining the teaching of military ethics and LOAC for tomorrow's cyber commanders.

2. WILL CYBER CONFLICT BECOME CYBER WAR?

   Whether war, commonly understood as armed conflict that results in human casualties and damage and destruction of property and environments, will actually occur as a result of military operations in cyberspace remains an unsettled issue. (13) Although the instances of cyber operations with effects in the geophysical world typically associated with kinetic military actions are at the moment apparently few, (14) the feasibility of causing actual physical harm has been convincingly demonstrated in testing (15) and in the cases of Stuxnet (16) and Shamoon (17) in the field as well. Importantly, these few instances differ markedly from the popular picture of cyber armed conflict often painted by national security officials and others. Rather than occurring at the speed of light and resembling an "|electronic Pearl Harbor," (18) they have instead largely played out quietly and stealthily. (19)

   This might change in the foreseeable future, however. A number of NATO nations have publically stated that they possess some "offensive" cyber capacity, (20) and U.S. research and development programs suggest a trend towards the industrialization of cyber conflict. (21) This makes it more likely that cyber offensive capabilities will at some point be weaponized in a manner that will make their use more practicable and predictable than the somewhat boutique practice of cyber mischief, which is the norm today. (22) This degree of utility would also suggest that the decision making associated with the use of these capabilities would need to occur more quickly, and would need to be pushed down to lower levels of weapons release authority to take action. (23)

   As nations move toward securing the means to conduct cyber conflict (24) that begins to approach our common understandings of war, a consensus appears to be emerging among international organizations concerned with the implementation of LOAC, and in academia, that LOAC at least applies to those actions in cyberspace that either result in, or are intended to result in, injury to humans and damage to geophysical things. (25) In particular, the recently published TALLINN Manual marks an important milestone in the understanding of the practical application of LOAC to cyber operations. Accordingly, future cyber strike capabilities which produce effects that ripple into the geophysical world, whether used offensively or in self-defense, would require commanders to be responsible under LOAC for their actions and those of their subordinates. Below the level of this use of force, cyber operations that result only in direct effects within cyberspace itself would not be considered uses of force regulated by LOAC, even though their indirect effects might have far-reaching and negative impacts upon the nation targeted. (26) As perhaps best illustrated publicly by the various U.S. cyber strategies and statements of U.S. officials, however, it appears that nations might view this second level of cyber actions in a somewhat amorphous manner. (27) This "grey zone" between the use of kinetic-like force at the upper end, and mere cyber annoyance at the lower, might be further stratified by classified "red-lines" past which nations will not tolerate interference in their national digital infrastructure, and might respond with the use of kinetic-like or even actual kinetic force to unfriendly intrusions. (28)

   From a legal perspective, then, a cyber commander might view operations in cyberspace as similar to a game of three-dimensional chess, with different rules at different levels, and the possibility that the effects of play on one level might ripple onto another. At the lowest level, cyber annoyance, domestic law is likely applicable, but it is difficult to conceive of international law concerned with the use of force, armed or otherwise, being applicable. At the highest level, LOAC would operate as lex specialis regarding the use of armed force and largely displace other sources of international law, (29) and the rules of engagement (ROE) would be consistent with it. In the grey zone, however, jus ad bellum and the ordinary international law regarding the use of non-armed force would apply, as well as other bodies of international law and perhaps even domestic laws to a degree. Cyber ROE at this level would, of course, need to be consistent with controlling law and might even reflect certain ethical concerns under just war theory, but because they would likely be influenced by pragmatic national policies which themselves could be classified, they might be less transparent and therefore less commonly understood than those ROE which implement LOAC in the geophysical world. Making sense of this aspect of operational complexity...