Civilians in cyberwarfare: conscripts.

• Author: Brenner, Susan W.

ABSTRACT

Civilian-owned and -operated entities will almost certainly be a target in cyberwarfare because cyberattackers are likely to be more focused on undermining the viability of the targeted state than on invading its territory. Cyberattackers will probably target military computer systems, at least to some extent, but in a departure from traditional warfare, they will also target companies that operate aspects of the victim nation's infrastructure. Cyberwarfare, in other words, will penetrate the territorial borders of the attacked state and target high-value civilian businesses. Nation-states will therefore need to integrate the civilian employees of these (and perhaps other) companies into their cyberwarfare response structures if a state is to be able to respond effectively to cyberattacks. While many companies may voluntarily elect to participate in such an effort, others may decline to do so, which creates a need, in effect, to conscript companies for this purpose. This Article explores how the U.S. government can go about compelling civilian cooperation in cyberwarfare without violating constitutional guarantees and limitations on the power of the Legislature and the Executive.

TABLE OF CONTENTS I. INTRODUCTION II. CIVILIANS IN WARFARE A. Warfare B. Cyberwarfare 1. Kinetic Warfare 2. Cyberwarfare (a) Defensive Engagement (b) Offensive Engagement III. CONSCRIPTS A. Nationalization B. Conscription 1. History 2. Cyberwarfare C. A Third Option IV. CONCLUSION I. INTRODUCTION

Critical infrastructure owners ... report that their networks and control systems are under repeated cyberattack ... from ... foreign nation-states. (1)

According to one estimate, 140 nations have developed or are in the process of developing the capacity to wage cyberwarfare. (2) Other countries will follow suit. A 2009 global survey of executives working for critical infrastructure and computer security companies found that "45 percent believed their governments were either 'not very' or 'not at all' capable of preventing and deterring cyberattacks." (3)

Although cyberwarfare will probably not displace traditional, kinetic warfare, (4) it will become an increasingly important weapon in the arsenals of nation-states for several reasons. First, developing the capacity to wage cyberwar costs little compared to the cost of developing and maintaining the capacity to wage twenty-first century kinetic war. (5) The expense of cyberwarfare primarily encompasses training and paying cyberwarriors, and purchasing and maintaining the hardware and software needed to launch and counter cyberattacks, because nations will wage cyberwarfare primarily over publicly accessible networks. (6)

Second, cyberwarfare provides an appealing option for nations because of the relative conservation of human and non-human resources. While cyberattacks are likely to generate human casualties and property destruction, cyberattacks will inflict far less damage than kinetic attacks. (7) This conservation of resources erodes one of the disincentives for launching offensive war. Cyberwarfare has the added advantage of insulating cyberwarriors from physical injury: unlike their counterparts in traditional military organizations, cyberwarriors operate remotely and launch cyberattacks from within the territory of their own nation-state. The remoteness of cyberwarfare effectively eliminates the likelihood of injury or death in a physical encounter with forces from an opposing nation-state. (8) Therefore, a nation-state needs only a relatively small cadre of cyberwarriors to wage cyberwarfare, and it can assume that few, if any, of those warriors will be lost in the conflict. (9)

Third, nation-states are likely to find cyberwarfare attractive because the sponsoring nation-state may be able to disguise the source of the attacks and thereby avoid responsibility. (10) Even if Nation A suspects Nation B launched the cyberattacks that targeted its infrastructure, Nation A probably will not (and under the existing laws of war cannot lawfully) retaliate against Nation B unless and until it confirms that suspicion. (11)

For these and other reasons, nation-states will be forced to deal with the phenomenon of cyberwarfare in the years and decades to come. Cyberwarfare is a new phenomenon that differs in a number of respects from traditional warfare, (12) and these differences raise legal, policy, and practical issues that nation-states will have to resolve, both individually and collectively. (13)

This Article focuses on a subset of those issues. As Part II explains, cyberwarfare erodes, and may erase, the distinction that currently exists between combatants (soldiers) and noncombatants (civilians). (14) Under the current law of armed conflict (LOAC), civilians are non-actors: they have no legitimate role in the conduct of traditional military hostilities. (15) However, as seen in Part II.B, civilians are destined to play an active role in cyber-hostilities--not as military personnel, but as civilians. To prepare for that eventuality, the United States will need to formulate laws that authorize civilian participation in this new arena of international combat without violating constitutional restrictions on executive and legislative authority. (16) Part III (17) addresses this issue, and Part IV provides a brief conclusion.

2. CIVILIANS IN WARFARE

   The right of the noncombatant population to protection ... involves ... a corresponding duty of abstaining from ... hostilities.... (18) This Part examines the legal issues raised by civilian participation in cyberwarfare. Part II.A reviews the status of civilians under the existing laws of kinetic warfare. Although cyberwarfare relies on methods other than the use of kinetic force, this Article assumes that cyberwarfare qualifies as war under international law. (19) Part II.B reviews the need for civilian participation in cyberwarfare and the roles civilians are likely to play in virtual combat. This Part also provides an empirical context for the analysis in Part III, which analyzes how the United States can compel recalcitrant civilians to become combatants in cyberwarfare. (20)

   1. Warfare

      ... the inherent right of ... self-defence if an armed attack occurs against a [state]. (21) According to Michael S. Neiberg, war comprises three dimensions: violence, legitimacy, and legality. (22) War obviously involves violence, but warring nations need legitimacy to motivate citizens to fight for their country and convince them that killing in battle is the "right" thing to do. (23) Therefore, war differs from crime, which can also involve violence, because war "derives legitimacy from a political, societal, or religious source. Men are, in effect, given license to ignore commonlyaccepted societal conventions against killing and destroying." (24)

      This Article's analysis of civilian participation in cyberwarfare concerns "legality," the third dimension of warfare. Legality is an ancient requirement that has become increasingly sophisticated over the last millennium. (25) As one observer notes, nations fight wars according to "understood sets of rules." (26) These rules have historically been divided into two categories: jus ad bellum and jus in bello. (27) Jus ad bellum governs the legality of starting a war, and jus in bello governs the legality of conducting a war. (28) The modern jus in bello is particularly concerned with "protecting civilian populations from the injurious effects of armed conflict." (29)

      That concern did not always exist. Many trace its origins to De Jure Belli ac Pacis, Hugo Grotius's 1625 treatise on the LOAC and peace. (30) Grotius argued that war should be governed by laws because "when arms have ... been taken up there is no longer any respect for law ... it is as if ... a frenzy had openly been set loose for the committing of all crimes." (31) Grotius, and others who would later express similar sentiments, reacted to the way that wars had been waged. Until the mid-eighteenth century, armies fielded by nation-states "were composed largely of mercenaries, whose pay was intermittent and who ... had to 'live off the country.'" (32) These untrained and undisciplined soldiers brutalized civilians and razed farms and towns in the areas they passed through. (33) For example, during the Thirty Years War in the early seventeenth century, "over half the German-speaking population was wiped out," and most of Europe was left in "shambles." (34)

      Grotius's writings and the devastation left by the Thirty Years War led to a number of reforms, including the professionalization of soldiering: troops were trained; organized in a "chain of command" consisting of "regiments, and other standard units;" and regularly fed, clothed, and paid. (35) Armies added staff to handle supply and transport, and they established procedures to maintain discipline among troops. (36) As a result, customs and rules developed that governed soldiers' relationships with civilians and conduct while occupying foreign territory. (37)

      Others echoed Grotius's call for a law of armed conflict. Rousseau, for example, said that because war is a battle between nation-states, soldiers should "respect the person and property of individuals" who are not involved in combat. (38) Others called for reform during the eighteenth century, but the LOAC remained unwritten until the nineteenth century. (39)

      In the nineteenth century, humanitarian concerns prompted by newspapers' graphic accounts of battlefield violence played a role in the codification of a LOAC, as did the Union Army's commission of Francis Lieber to draft a code governing the conduct of warfare. (40) Article 15 of the Lieber Code made "military necessity" the basis for determining what actions were appropriate during military combat. (41) Under Article 15, military necessity authorized "direct destruction of life or limb of armed enemies" and others "whose destruction is incidentally unavoidable in the...