Hacking into international humanitarian law: the principles of distinction and neutrality in the age of cyber warfare.

• Author: Kelsey, Jeffrey T.G.

Cyber warfare is an emerging form of warfare not explicitly addressed by existing international law. While most agree that legal restrictions should apply to cyber warfare, the international community has yet to reach consensus on how international humanitarian law ("IHL") applies to this new form of conflict. After providing an overview of the global Internet structure and outlining several cyber warfare scenarios, this Note argues that violations of the traditional principles of distinction and neutrality are more likely to occur in cyber warfare than in conventional warfare. States have strong incentives to engage in prohibited cyber attacks, despite the risk of war crimes accusations. This Note argues that belligerents will violate the principle of distinction more frequently in cyber warfare than in conventional warfare. Many cyber attacks will unavoidably violate neutrality law, making these violations more likely in cyber conflicts than in conventional wars. Rather than condemn all uses of cyber weapons, this Note argues that IHL should evolve to encourage the use of cyber warfare in some situations and provide states better guidance in the conduct of these attacks.

TABLE OF CONTENTS INTRODUCTION I. THE MODERN INTERNET AND THE OPPORTUNITIES FOR CYBER WARFARE A. The Modern Internet B. Cyber Warfare Scenarios 1. Using a Cyber Attack to Shut Down an Air Defense Station 2. Infiltration of the Enemy's Centralized Defense Network 3. Cyber Attack on Power Plants 4. Cyber Attack on a Media Station II. WHILE THE LEGALITY OF POTENTIAL CYBER ATTACKS WILL OFTEN BE CLEAR, THE NONLETHAL POTENTIAL OF CYBER WARFARE MAY LEAD TO MORE FREQUENT VIOLATIONS OF THE PRINCIPLE OF DISTINCTION THAN IN CONVENTIONAL WARFARE A. The Meaning of Distinction in International Humanitarian Law B. The Legality of Potential Cyber Attacks Under the Principle of Distinction Will Be Clear for Many Operations C. The Nonlethal Potential of Cyber Warfare May Lead to More Attacks on Traditionally Protected Objects and Individuals than Occurs in Conventional Warfare III. THE PRINCIPLE OF NEUTRALITY REGULATES CYBER WARFARE, BUT MANY INTERNET-BASED ATTACKS WILL UNAVOIDABLY VIOLATE NEUTRALITY DUE TO THE STRUCTURE OF THE INTERNET A. General Overview of Relevant Neutrality Law B. Cyber Warfare Operations Conducted via the Internet Violate Neutrality Law C. Belligerents Have Incentives to Engage in Attacks That Violate Neutrality Law and Will Choose to Engage in Prohibited Conduct IV. IHL SHOULD EVOLVE THROUGH CUSTOM AND STATE PRACTICE TO ENCOURAGE THE USE OF CYBER WEAPONS IN SOME SITUATIONS AND TO PROVIDE STATES BETTER GUIDANCE IN THE CONDUCT OF THESE ATTACKS A. The Current Definitions of Distinction and Neutrality Are Too Narrow and Should Evolve to Accommodate Cyber Weapons and, in Some Cases, Encourage Their Use over Conventional Methods of Warfare 1. Expanding the Principle of Distinction 2. Evolving Neutrality to Focus on Intent B. The Evolution of New Norms--Treaties Are Not the Answer CONCLUSION INTRODUCTION

In May 2007, the Estonian government faced the reality of cyber warfare. An anonymous cyber attack targeted both civilian and government systems. (1) Hitting the websites of banks, ministries, newspapers, and broadcasters, the assault left Estonia without the means to tell the world it was under attack. (2) The strike was both indiscriminate and surprisingly focused: "'Particular "ports" of particular mission-critical computers in, for example, the telephone exchanges were targeted. Packet "bombs" of hundreds of megabytes in size would be sent first to one address, then another.'" (3) This attack was more than just an inconvenience to the Estonian population: the emergency number, used to call for ambulances and the fire service, was unavailable for more than an hour. (4) No state or terrorist group claimed responsibility after the attack, but analysts believed the complexity of the attack required the cooperation of a state and/or several large telecom firms. (5) Given the history of the Baltic State, some naturally suspected Russian involvement. (6)

The attack on Estonia illustrates the need to confront the seriousness of cyber warfare. As leaders begin to address the problem of defending against such attacks, they must not ignore the legal questions. For example, does a cyber attack constitute an "armed attack" under the United Nations Charter? (7) If analysts eventually link Russia to the attack, would the attack justify Estonia in invoking its right of self-defense under the Charter? (8) Or, should the international community view the attack as a mere criminal act for the criminal justice system to address? The recent news of individuals tied to the Chinese military hacking into the U.S. Defense Department's computer system raised very similar legal questions. (9) These issues will take time to address, and yet such jus ad bellum (10) issues barely scratch the surface of the legal conundrum. (11)

International and military lawyers must also consider how the jus in bello, or international humanitarian law ("IHL"), (12) applies to cyber warfare. For example, how would international humanitarian law apply to these attacks if a state of war existed between Estonia and Russia or the United States and China at the time of the attacks? Should the Geneva and Hague treaties apply to this form of warfare? While a general consensus exists that legal restrictions should apply to the use of cyber weapons in war, no apparent provision of international law explicitly bans or addresses their use. (13)

Military planners have been aware of the potential threat and opportunity of cyber warfare for at least a decade. (14) Unfortunately, the international community has yet to reach consensus on the application of IHL to this new form of conflict. Some have argued the existing framework of IHL is ill suited to cope with cyber warfare's new paradigm and have called for a new international convention to regulate its use. (15) At least one legal scholar has proposed an international convention. (16) Others, including the U.S. government, have opposed efforts to create a new treaty (17) and have argued that the current IHL framework can be applied to cyber warfare by analogy. (18) Some arguments against a new treaty are quite practical; George K. Walker argues:

Given ... technology's fluidity and exponential growth, the relative lack (thus far) of practice in [cyber warfare] situations, and the relatively small number (again thus far) of claims and counterclaims in the worldwide electronic arena, any international agreements on [cyber warfare] would likely be obsolete in terms of hardware and practice before their ink would be dry. (19) Perhaps in acknowledgement of the legal uncertainty, President George W. Bush has issued National Security Directive 16, which ordered the development of guidelines to regulate the use of cyber weapons in war. (20) The Directive also instituted strict rules of engagement requiring "top-level" approval for any attack. (21)

This Note takes the position that IHL applies to cyber warfare by analogy but contends that IHL must evolve to accommodate and, in some cases, even encourage cyber warfare over conventional methods. This Note argues that states have strong incentives to engage in cyber attacks that violate the traditional notions of distinction and neutrality. (22) As such, violations of these legal principles are likely to be more common in cyber warfare than in conventional warfare. Part I provides an overview of the world Internet structure and highlights the interconnected nature of civilian and military telecommunications systems. This Part also outlines several cyber warfare scenarios that IHL should address. Part II shows how the principle of distinction (23) applies to the use of cyber weapons and maintains that cyber warfare creates additional incentives for belligerents to violate this principle more frequently than they do when engaged in conventional warfare. Part III describes how similar incentives exist for belligerents to violate the principle of neutrality (24) more often in the context of cyber warfare. Part IV argues that IHL should evolve to encourage the use of cyber weapons in some situations and provide states with better guidance for conducting these attacks in compliance with IHL.

1. THE MODERN INTERNET AND THE OPPORTUNITIES FOR CYBER WARFARE

   This Part provides a general background on the modern structure of the Internet while highlighting the substantial overlap between civilian and military cyber activities. Section I.A provides a general overview of the modern structure of the Internet. Section I.B outlines several cyber warfare scenarios that have tangible, physical effects.

   1. The Modern Internet

      Computers control much of our civilian and military infrastructure, including communications, power systems, sewage regulation, and healthcare. (25) In the United States, the military uses over two million computers and has in excess of ten thousand local area networks. (26) Further, the Internet provides nearly universal interconnectivity of computer networks without distinction between civilian and military uses. (27) According to one count, "[a]pproximately '[ninety-five percent] of the telecommunications of the [Department of Defense] travel through the Public Switched Network,' and a significant amount of both the operation and maintenance of military-owned network segments is currently handled by civilians on a contracted-out basis." (28)

      These statistics are unsurprising given that the Internet began as a military program to ensure redundant communication channels in case of attack. (29) The unitary term "Internet" implies a single network; in fact, the Internet's physical structure is made up of many different linked networks, which are known collectively as the "Internet backbone." (30) The Internet backbone has the capacity to carry data across the countries, continents, and oceans...