Crossing the Line: Law of War and Cyber Engagement-Applying the Existing Body of Law to this National Security Threat

• Author: Sandra Hodgkinson
• Position: This presentation was part of a panel discussion during the ABA Spring of the International Section on April 26, 2017 in Washington, DC. Ms. Hodgkinson is a member of the ABA Cyber Task Force, retired Captain from the U.S. Navy JAGC Corps reserves, and former member of the U.S. Government's Senior Executive Service with positions at DoD, State ...
• Pages: 613-628

Crossing the Line: The Law of War and Cyber

Engagement – Applying the Existing Body of

Law to this New National Security Threat

S

ANDRA

L. H

ODGKINSON

1

I. Introduction

Over the past decade, there has been a growing awareness of the threat

caused by the increasing reliance on cyberspace and the risk to national

security it brings. Cyber “attacks” against the U.S. government can be

launched by a variety of actors with different motivations for intelligence

collection, data or intellectual property theft, espionage, or ultimately to

threaten our national security by offensively crippling a military asset or

critical U.S. infrastructure.

2

Notwithstanding, a large majority of cyber

incidents are often aimed at data theft for personal gain, rather than

launched by would-be enemy nations as an instrument of warfare. Whatever

the motivation, the damage from a cyber-attack can be serious, and can put

our national interests at risk.

When we talk about “crossing the line,”—we are discussing at what point

the law of armed conflict is triggered in a cyber “attack” which would justify

a lawful military response. This is a very narrow subset of current cyber

events, and it requires its own set of laws and policies. The last ten years has

seen a significant shaping of the law in this area and even a growing

consensus between the U.S. and the international community as to when a

cyber-event has crossed the threshold into becoming an “armed attack.”

3

This short article will, at a very high level, discuss the threshold jus ad bellum

question that other panelists are also addressing. In addition, this article will

focus on what the practical effect of a cyber “armed attack” means and how

some of the law of armed conflict principles may apply. Volumes can be

written about these topics, but the goal here, in this panel, is to lay them out

for discussion.

1. This presentation was part of a panel discussion during the ABA Spring of the

International Section on April 26, 2017 in Washington, DC. Ms. Hodgkinson is a member of

the ABA Cyber Task Force, retired Captain from the U.S. Navy JAGC Corps reserves, and

former member of the U.S. Government’s Senior Executive Service with positions at DoD,

State Department and the National Security Council. She currently works as a Senior Vice

President in the defense industry at Leonardo DRS.

2. Cyberattack, T

ECHNOPEDIA

, https://www.techopedia.com/definition/24748/cyberattack

(last visited June 17, 2018).

3. CYBERSECURITY LEGISLATION 2017, NCSL (Dec. 29, 2017), http://www.ncsl.org/

research/telecommunications-and-information-technology/cybersecurity-legislation-2017.aspx.

THE INTERNATIONAL LAWYER

A TRIANNUAL PUBLICATION OF THE ABA/SECTION OF INTERNATIONAL LAW

PUBLISHED IN COOPERATION WITH

SMU DEDMAN SCHOOL OF LAW

614 THE INTERNATIONAL LAWYER [VOL. 51, NO. 3

What does it mean to be in an “armed conflict” in a cyber-context?

Clearly, cyber bombs are not dropping from the sky, but there is a

significant threat to national security that arises from a cyber-war. And for

those individuals who engage in a cyber-attack, what is their status? Are

they lawful “combatants” entitled to prisoner of war status upon capture, and

possessing the greatest right of all in wartime—the right to kill? Or,

alternatively, are they more akin to the unprivileged belligerents we have

seen through the more recent asymmetrical conflicts with Al Qaeda and

other terrorist organizations? Are individual “hacktivists” capable of

launching a cyber-attack? How do the unique challenges of attribution in

cyber space affect the ability of nations to adequately deter, and respond to,

cyber threats? And how do the time-tested principles of necessity and

proportionality apply to cyber-attacks which have crossed the line? As in

wars of the past, does state sovereignty afford nations the right to be

“neutral” in these cyber conflicts, even if a cyber-event passes through their

networks? And once the line has been crossed, how does that impact the

applicability of other cyber-crime laws, espionage laws, and sabotage laws?

These are all questions that this panel discussion and supporting paper are

designed to address.

This presentation will first provide a quick summary of key developments

in the law governing cyber-attacks. Then, it will address the practical

implications of being in a cyber-war and discuss the status of individuals

involved in this war. Third, it will address the principles of necessity and

proportionality. Fourth, the article will discuss the role of state sovereignty

and neutrality. Finally, the article will address the applicability of other laws.

In its conclusion, the article will raise concerns about areas where the law of

armed conflict remains unclear and imperfect in addressing this new threat

emanating from the cyber world.

II. Growing Consensus That Cyber Attacks May be Acts of War

In July 2011, the U.S. Department of Defense (“DoD”) launched its first

official cyber strategy, and listed cyber space as an “operational domain,” like

sea, air, space and land.

4

President Obama, consistent with his National

Security Strategy, signed a classified presidential directive related to cyber

operations, PPD-20 the following year, which recognized the growth in

cyber incidents and threats against the U.S. government.

5

PPD-20

promoted a whole-of-government approach, establishing principles and

processes for cyber operations to enable more effective planning,

development, and use of our capabilities.

6

PPD-20 aimed to take the least

action necessary to mitigate threats and emphasized network defense and law

4. U.S. D

EP

’

TOF

D

EF

., D

EP

’

TOF

D

EF

. S

TRATEGY FOR

O

PERATING IN

C

YBERSPACE

(2011).

5. P

RESIDENTIAL

P

OLICY

D

IRECTIVE

20, PPD-20, U.S. C

YBER

O

PERATIONS

P

OLICY

(Oct.

2012).

6. Id.

THE INTERNATIONAL LAWYER

A TRIANNUAL PUBLICATION OF THE ABA/SECTION OF INTERNATIONAL LAW

PUBLISHED IN COOPERATION WITH

SMU DEDMAN SCHOOL OF LAW