Unpunished insults - the looming cyber Barbary wars.

• Author: Martemucci, Matteo G.
• Position: Frederick K. Cox International Law Center Symposium: International Regulation of Emerging Military Technologies

This article argues that while current cyber literature focuses on cyber crime and cyber war, policy makers do not treat the most damaging cyber activity--large-scale economic espionage--in a manner commensurate with its importance. The threat from nation-states like China is real, and it requires a coherent strategy of response. The article analyzes the historic role of the U.S. government and the military in the protection of commerce from piracy and privateering at the turn of the last century. This provides useful context for the necessary debate over the role of the government and military in the defense of the modern cyberspace-enabled economy. This article further argues that there is a role for the US Government, and possibly the Department of Defense, in safeguarding US commerce in cyberspace just as it does in the physical domain. Policy leaders need to thoughtfully debate and define this role.

CONTENTS I. INTRODUCTION II. HISTORICAL PRECEDENT: THREATS TO COMMERCE IN 1801--A NEW NATION'S ANSWER III. THE NECESSARY DEBATE: CAN AND SHOULD THE MILITARY DEFEND COMMERCIAL CYBERSPACE? IV. RECOMMENDATIONS V. CONCLUSION Weakness provokes insult and injury, while a condition to punish it often prevents it ... I think it is in our interest to punish the first insult: because an insult unpunished is the parent of many others. (2)

If we wish our commerce to be free and uninsulted, we must let these nations see that we have an energy which at present they disbelieve. (3)

--Thomas Jefferson

1. INTRODUCTION

   The current debate over threats, vulnerabilities, and responsibilities in cyberspace is incomplete. While the current cyber literature and academic debate focuses on cybercrime and cyberwar, policy makers do not treat the most damaging cyber activity--large-scale economic espionage--in a manner commensurate with its importance. The greatest single threat to the American national existence we enjoy today is the systematic, long-term economic espionage by nation-states, like China, that contribute to the shifting of the balance of economic power away from the U.S. This threat is real, it is happening now, and it is growing fast. Economic espionage requires a coherent strategy of response.

   The U.S. military has historically served to maintain the security of the global commons to allow for the continuation and expansion of trade to the nation's benefit. Along with the other instruments of national power, military capability serves as a powerful deterrent for illegal action by other states. In cyberspace, however, there is currently no equivalent motivation for states to act appropriately, resulting in significant negative impact on the U.S. economy. Thus, in addition to preventing cyber attacks on critical infrastructure, there is a role for the U.S. Government, and possibly for the Department of Defense (DoD), in safeguarding U.S. commerce on the high seas of cyberspace, just as it does in physical domains of the global commons. Unfortunately, policy leaders have yet to thoughtfully debate and define this role, but their participation is vital in addressing the serious threat of economic espionage.

   In recent years, cyber-based threats of all kinds have grabbed the consciousness of the public, pundits, and political leaders. Cyber attacks on Estonia in 2007 and on Georgia in 2008 form the outline of many discussions about cyber war. (4) The Stuxnet virus that destroyed nearly one thousand uranium-enriching centrifuges in Iran in 2010 by an as-yet unconfirmed entity has further shaded the picture. (5) Recent large-scale theft of credit card and personal information from Target, JPMorgan, and others add color to the public consciousness. (6) Yet, despite the details, the threat picture remains unclear. Many are afraid, but no one is exactly sure what to fear. The author's research suggests that, in the realm of cyberspace, we are worrying about the wrong things. Current cyber literature and academic debate focus on cybercrime, politically motivated hacking, and cyber war, but they largely ignore the most important cyber threat today: large-scale economic espionage conducted by nation-states and their proxies.

   In May 2014, in the most significant case of direct attribution against a nation-state to date, the U.S. Department of Justice (DoJ) issued an indictment against five Chinese hackers, explicitly linking them to a unit of the Chinese Peoples' Liberation Army. (7) "This is a case alleging economic espionage by members of the Chinese military and represents the first ever charges against a state actor for this type of hacking," U.S. Attorney General Eric Holder said. "The range of trade secrets and other sensitive business information stolen in this case is significant and demands an aggressive response." (8) This indictment is a good first step, but it falls short of a credible response that may actually change China's behavior because the DOJ's indictment is not a credible deterrent. With no possibility of extradition, and no further cost imposed on the Chinese economy by the U.S. Government in response, the indictment alone prevents nothing, though it sits as an interesting piece of political theater.

2. ...