International cyber conflict

by John Bandler

International cyber conflict is the conflict between nations ("nation-states") that involves the digital domain.

Nation states use computers, networks, and data to undermine or attack other nations.

Nations have long been at odds with each other, and had conflicts. Those conflicts can range from minor disagreement to full scale war. There is an existing body of law that has evolved surrounding these conflicts, then we see how to apply this law to cyberspace.

Terminology

I use the term "nation-state" or "country" or "nation" to talk about countries and nations.

Just consider that many international law practitioners use the term "state" to refer to a "nation-state". That confuses some of us within the  "United States" because the word "state" can imply entities like New York and New Jersey.

Terms for this area of conflict between nation-states include:

  • Cyber conflict
  • International cyber conflict
  • International cyber operations
  • Nation-state cyber operations

Now we have the "cyber" domain, computers, the internet, data, and all of the activities humans and nation-states can do with it. So we look to the evolving area of cyber conflict, and how law is applied to it.

Nation-states can do damage through cyber-space?

Yes, nation-states can do incredible damage through cyber-space.

Consider the full range of options available to nations before our world became constantly connected, with everything using a computer, and everything requiring constant connection to each other. Those options included boots on the ground, with rifles and tanks plus air power like helicopters and planes, plus destruction that could be delivered with bombs and missiles. These options allowed ranges from relatively minor death and destruction to a massive scale.

Now consider what could happen through cyberspace.

A nation-state could do something relatively minor such as steal some data, knock some systems offline, influence a few people to think something or do something. Of they could do something major, such as steal the data about almost every U.S. citizen, influence the outcome of an election to select their favorite candidate, or cause death and destruction on a massive scale.

This death and destruction on a massive scale is theoretically possible. First, realize how much of our lives and systems now rely upon "cyber". Consider systems such as:

  • Utilities, including electric grids, nuclear power, dams, water treatment
  • Finance, including banks, payments, and investments and trading
  • Navigation, transportation, and traffic
  • Health

Then, consider what would happen to these systems if they were knocked offline, for a few hours, days, weeks, or months. The impact would be massive, to include death.

Finally, realize that hostile nation-states are planning how to do it, just in case they might want to try do it someday.

Wait, there's laws about war?

Nations engage in conflict, everything up to and including war -- the targeting killing of humans and massive destruction of infrastructure. On the one hand, it might seem surprising that there are laws around this. On the other hand, reasonable people and countries often try to create rules to try reduce unnecessary conflict and death.

After twenty years in the criminal justice system, I tend to draw analogies to there, and there are criminal laws about conflict between individuals and use of force. Use of force between individuals is criminalized because we want those situations but there the defense of justification to defend oneself, meaning "self-defense" or other lawful use of force. Whatever our criminal laws may be some people don't follow them and the same can be said about the laws of conflict and warfare between nations.

Law of warfare and international conflict summarized

Law of war starts with principles of nation-state sovereignty. Sovereignty meaning, don’t mess with other countries, respect their physical borders and respect their right to manage their affairs within their borders. In my criminal law analogy, this is like saying don't touch, punch, or shoot an individual, nor invade their house. This principle of sovereignty is laid out in the United Nations (UN) Charter Article 2 (link at bottom).

The law also directs nations to resolve disputes peacefully, with force or the threat of force. The law also prohibits starting an unjust war, and indicates when a war can be started (jus ad bellum, or "right to war")

Then the law recognizes a right to self defense, and defense of other nations. This is laid out in UN Charter Article 51 and other principles. In my criminal analogy this right exists as well.

Once a war or armed conflict is in progress, there are laws for how it can be conducted (jus in bello, or "right conduct in war".) This is also part of what is known as international humanitarian law (IHL). This area of law seeks to reduce unnecessary suffering and requires consideration of targeting principles such as:

  • humanity
  • proportionality
  • distinguishing between military and civilian targets
  • necessity (to secure defeat of enemy).

Some general application of these principles includes:

  • not raping civilians (or soldiers, or anyone for that matter)
  • not killing civilians, or noncombatants
  • not targeting civilians, including schools and hospitals
  • not killing or mistreating prisoners of war (POWs).

Nation state cyber actions

As alluded to above, nation states will plan all sorts of cyber actions, and will conduct many. These may include probing information systems to infiltrating them (data breach, network intrusion) and planning and conducting further operations. These further operations could range from stealing data to knocking systems offline or causing severe damage.

They may influence individuals, and individuals can then influence how government officials act or vote for certain candidates.

Conclusion

This page is a draft and work in progress.

Cyber conflict is important and affects us, even if we think it doesn't. That's because other nation states are trying to influence what we think.

This article is (of course) not tailored to your circumstances, nor is it legal or consulting advice.

Additional reading and references

  • Rules
  • Law
  • Cyberlaw - the book (coming someday)
  • Cyberlaw
  • Cybercrime Investigations, Chapter 8 (book)
  • Army Cyber Institute at West Point, https://cyber.army.mil/
    • Thanks to select legal experts from Army West Point for me learning about this area of law
  • Lieber Institute for Law & Warfare at West Point, https://lieber.westpoint.edu/
  • UN Charter, https://www.un.org/en/about-us/un-charter
  • UN Charter Article 1 and 2, especially 2(4)   https://www.un.org/en/about-us/un-charter/chapter-1
  • UN Charter Article 51  https://www.un.org/en/about-us/un-charter/chapter-7
  • NATO Cooperative Cyber Defence Centre of Excellence (CCDCO), https://ccdcoe.org/
  • The Tallinn Manual 2.0, https://ccdcoe.org/research/tallinn-manual/
    • Wikipedia on The Tallinn Manual, https://en.wikipedia.org/wiki/Tallinn_Manual
    • Rain Ottis, Analysis of the 2007 Cyber Attacks Against Estonia from the Information Warfare Perspective, Cooperative Cyber Defence Centre of Excellence, Tallinn, Estonia, https://www.ccdcoe.org/uploads/2018/10/Ottis2008_AnalysisOf2007FromTheInformationWarfarePerspective.pdf
  • Michael Schmitt, Grey Zones in the International Law of Cyberspace, Yale Journal of International Law (October 18, 2017), https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3180687
  • Cybercrime Investigations, Chapter 8, Cyber Investigations Linked to Nation-States or Terrorists
  • Cyberlaw Book (coming someday)
  • “Mueller Report” Executive Summaries (Report on The Investigation into Russian Interference in the 2016 Presidential Election),
    • Volume I pp 1-10, https://storage.courtlistener.com/recap/gov.uscourts.dcd.205521/gov.uscourts.dcd.205521.122.1.pdf
    • Volume II pp 1-8, https://storage.courtlistener.com/recap/gov.uscourts.dcd.205521/gov.uscourts.dcd.205521.122.2.pdf
  • Building domestic individual resistance to propaganda and disinformation
    • Bandler, Building Better Consumers and Voters, https://johnbandler.com/building-better-consumers-and-voters/
    • Free Speech, the First Amendment, and social media (2), https://johnbandler.com/free-speech-first-amendment-social-media-2/

This article is hosted at https://johnbandler.com/cyber-conflict, copyright John Bandler, all rights reserved.

Originally posted 5/23/2024, updated 6/29/2024.