The Role of Counterterrorism Law in Shaping ad Bellum Norms for Cyber Warfare

• Author: William Banks
• Position: Board of Advisors Distinguished Professor of Law; Director, Institute for National Security and Counterterrorism
• Pages: 157-197

Role of Counterterrorism Law in Shaping ad Bellum Norms Vol. 89

157

A

The Role of Counterterrorism Law in

Shaping ad Bellum Norms for Cyber Warfare

William Banks*

I. INTRODUCTION

ssume that senior government ministers meeting to discuss economic

policies at the capital in a major industrial State are interrupted by an assis-

tant who reports that large-scale malware programs have infected the criti-

cal infrastructure of the State and its private sector. In the security sector,

large-scale routers throughout the network are failing, and classified sys-

tems have been penetrated. As the ministerial meeting suddenly shifts its

attention to the fast-spreading cyber intrusion, the malware continues to

spread, causing Internet-based systems to fail throughout the country.

Government and financial institutions continue to be besieged by a distrib-

uted denial-of-service attack from tens of thousands of computers orga-

nized into botnets, a slang term for the tool that enslaves the computers of

unknowing victims. Banks are forced to shut down, incoming payments

due from abroad cannot arrive and government ministries close up shop.

Credit card companies shut down their networks worldwide, fearing the

* Board of Advisors Distinguished Professor of Law; Director, Institute for National

Security and Counterterrorism; Professor of Public Administration and International Af-

fairs, Syracuse University. The author is grateful to Eric Je nsen and Matthew Waxman for

helpful comments on a draft version, and t o Erin Lafayette and Egon Donnarumma for

excellent research assistance.

International Law Studies 2013

158

spread of the attacks. Meanwhile, the national government closes all its

electronic borders. There was as yet no physical damage and no deaths or

injuries attributable to the cyber attacks, but the economic and social costs

are high and mounting.

As the government’s security, intelligence and law enforcement re-

sources scramble to identify the source of the attacks and implement de-

fensive measures, legal advisers face their own challenges. The first intelli-

gence reports show the sources of the attack coming from computers all

over the world, but with no clear indications of any State sponsorship or

involvement. Meanwhile, terrorist groups opposed to certain of the victim-

State government’s policies have threatened attacks, but as yet the attacks

cannot be clearly attributed. What body of law applies in responding to the

attacks? Is the nation at war? If so, who is the enemy? Has there been a

“use of force” or “armed attack” sufficient to trigger self-defense preroga-

tives under the UN Charter? Do the attacks create an “armed conflict” be-

tween the State and the unidentified enemy and, if so, do the laws of armed

conflict (LOAC) apply? What is the source of the legal authority to re-

spond defensively if the perpetrators are non-State terrorists? If the com-

puters responsible for spreading the malware can be identified, but at this

time not the State or non-State group perpetrating the attacks, what is the

nature and scope of the authority to respond?

The prospect of cyber war has evolved from science fiction and over-

the-top doomsday depictions on television, films and in novels to reality

and front-page news. The revelations that the Stuxnet attack on the com-

puters that run Iran’s nuclear enrichment program was part of a larger

“Olympic Games” campaign of cyber war begun in 2006 during the

George W. Bush administration by the United States, and perhaps Israel,

opened our eyes to the practical reality that the United States is engaged in

some kind of cyber war against Iran. The United States’ use of cyber wea p-

ons to attack a State’s infrastructure became the first known use of com-

puter code to effect physical destruction of equipment—in this case Irani-

an centrifuges—instead of disabling computers or stealing data.

1

If the

United States can so target Iran’s nuclear program, why not go after the

North Koreans? Or the Assad regime in Syria, the Chinese military, or al

1

. David E. Sanger, Obama Order Sped Up Wave of Cyberattacks Against Iran, NEW YORK

TIMES, June 1, 2012 , at A1, available at http://www.nytimes.com/2012/ 06/01/world

/middleeast/obama-ordered-wave-of-cyberattacks-against-iran.html?pagewanted=all; see

also DAVID E. SANGER, CONFRONT AND CONCEAL: OBAMA’S SECRET WARS AND SUR-

PRISING USE OF AMERICAN POWER (2012).

Role of Counterterrorism Law in Shaping ad Bellum Norms Vol. 89

159

Qaeda’s global operations? If the United States can achieve important na-

tional security and foreign policy objectives through the use of cyber

weapons, can there be any doubt that the United States is now the target of

the same kinds of weapons?

Most computer attacks temporarily disable the computer or its applica-

tions, or exploit the computer by reporting back data to a remote host.

More sophisticated intrusions, however, can cause more significant disrup-

tions or even destruction, like the Iranian centrifuges or worse. Because our

societies now entrust so much of our critical infrastructure to online sys-

tems, experts such as former Clinton and Bush administration cyber and

counterterrorism adviser Richard A. Clarke warn that cyber attackers could

derail trains, cause power blackouts, cause oil or gas pipelines to explode,

or ground aircraft.

2

Whether large or small, cyber attacks are proliferating, at least in part

because the means are becoming cheaper and easier to acquire and use.

3

Particularly when targeted at powerful adversaries like the United States,

cyber intrusions offer a model application of asymmetric warfare, where

adversaries much weaker in conventional terms exploit vulnerabilities in

the stronger foe. The asymmetric attackers are further advantaged by the

fact that they may mask their identity and location at least temporarily and

avoid immediate attribution and response to the attacks. As such, cyber

attacks share core characteristics with other terrorist attack modes. As the

means to affect cyber attacks become easier to acquire and use, terrorists

may wage cyber war against their adversaries, either directly attacking gov-

ernment systems or going after infrastructure in the private sector.

Relatively little has been written about the legal bases for countering

cyber terrorism,

4

and it has yet to be considered whether counterterrorism

law could illuminate ad bellum norms for responding to cyber attacks perpe-

trated by terrorists or where the source of an attack cannot be promptly

attributed and terrorists are suspected. The relative lack of attention given

by States and international law experts to counterterrorism law as a source

of authority to govern responses to cyber attacks is not surprising in view

2

. RICHARD A. CLARKE & ROBERT K. KNAKE, CYBER WAR: THE NEXT THREAT TO

NATIONAL SECURITY AND WHAT TO DO ABOUT IT 64–68 (2010).

3

. See id.; JOEL BRENNER, AMERICA THE VULNERABLE: INSIDE THE NEW THREAT

MATRIX OF DIGITAL ESPIONAGE, CRIME, AND WARFARE 154 (2011).

4

. Aviv Cohen, Cyberterrorism: Are We Legally Ready?, 9 JOURNAL OF INTERNATIONAL

BUSINESS AND LAW 1 (2010); Irving Lachow, Cyber Terrorism: Menace or Myth?, in CYBER-

POWER AND NATIONAL SECURITY 437, 448–49 (Franklin D. Kramer et al. eds., 2009).