sinks 0407

36
AU/ACSC/Sinks/AY08 AIR COMMAND AND STAFF COLLEGE AIR UNIVERSITY Cyber Warfare and International Law by Michael A. Sinks, Major, USAF A Research Report Submitted to the Faculty In Partial Fulfillment of the Graduation Requirements Advisor: Maj Lance E. Mathews Maxwell Air Force Base, Alabama April 2008

Upload: naqeeb-ahmed-kazia

Post on 08-Mar-2015

50 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: Sinks 0407

AUACSCSinksAY08

AIR COMMAND AND STAFF COLLEGE

AIR UNIVERSITY

Cyber Warfare and International Law

by

Michael A Sinks Major USAF

A Research Report Submitted to the Faculty

In Partial Fulfillment of the Graduation Requirements

Advisor Maj Lance E Mathews

Maxwell Air Force Base Alabama

April 2008

walterscl
Text Box
Distribution A Approved for Public Release distribution unlimited 13

AUACSCSinksAY08

Disclaimer

The views expressed in this academic research paper are those of the author(s) and do not

reflect the official policy or position of the US government or the Department of Defense In

accordance with Air Force Instruction 51-303 it is not copyrighted but is the property of the

United States government

ii

AUACSCSinksAY08

Abstract

In land sea and air battles military combatants can see the enemy coming whether itrsquos

the whites of their eyes or a blip on a screen International boundaries easily define when an

aggressor threatens the sovereignty of a nation giving the victim nation the right of jurisdiction

and there are specific international laws that address military operations in space In addition

the international community has defined when an adversaryrsquos use of force threatens a nationrsquos

territorial integrity and political independence

However the global nature of cyberspace and the speed of which victims can experience

cyber attacks force nations to deal with the legal challenges associated with over-the-horizon

military operations Jurisdiction over a cyber attack compounds the legal issues surrounding an

aggressive act that can have a wide-range of effects In addition nations face a very difficult

task in attributing an aggressive act to a particular actor and responding to asymmetric

techniques in cyberspace presents nations with an even more challenging and complicated issue

particularly in the legal regime

Cyberspace relies heavily on the other physical domains to operate and international laws

exist that govern the physical domains or air land sea and space The far-reaching nature of

cyberspace generates jurisdiction challenges that arenrsquot associated with the other domains but

the jurisdiction principles can apply to cyber warfare While scholars argue about the definition

of the Use of Force cyber warfare can have strategic and operational impacts that fall neatly

within existing definitions Finally international committees and oversight organizations have

generated legal precedents that apply to cyber warfare operations Therefore while cyberspace

is its own domain and there are unique demands placed on nations by cyber warfare existing

international laws and definitions are applicable to cyber warfare

iii

AUACSCSinksAY08

Table of Contents

DISCLAIMER II

ABSTRACT III

TABLE OF CONTENTS IV

INTRODUCTION 1

WHAT IS CYBER WARFARE 3 Defining Cyberspace 3 What Cyberspace is Not 4 Defining Cyber Warfare 5

TERRITORIAL SOVEREIGNTY 6 Airspace 7 Space 10 Land 12 Sea 13

APPLYING INTERNATIONAL LAW TO CYBER WARFARE 15 Jurisdiction 15 Use of Force 18 International Laws 22

CONCLUSION 23

END NOTES 27

BIBLIOGRAPHY 29

iv

AUACSCSinksAY08

Introduction We need to be able to think in terms of target effects I picture myself around that same targeting table where you have the fighter pilot the bomber pilot the special operations people and the information warrior As you go down the target list each one takes a turn raising his or her hand saying ldquoI can take that targetrdquo1

~ General (Retired) John P Jumper

The worldrsquos growing reliance on information technology to improve efficiency has

opened a threat to all who become reliant on cyberspace to conduct operationshellipa threat that has

many sources of predators ranging from pranksters to white-collar criminals to terrorists Yet

cyberspace has limited international laws to govern a worldwide domain that is ever expanding

as third world nations begin to invest in information technology and enter the cyberspace realm

to enhance business and military operations As nations begin to rely more on cyberspace as an

effective means of conducting business and military operations the more these operations will

become susceptible to outside aggressive influences whether itrsquos from economic invasions or

disruption of military operations

In addition the threat of military operations in the cyberspace domain is real The

Russian military has incorporated cyber warfare into their doctrine in order to gain information

advantage by affecting an adversaryrsquos information system decision-making processes command

and control and even the populace2 China is pursuing a battalion-sized force of computer

experts trained ldquoto carry out computer network attacks as a means of seeking asymmetrical

advantages over an adversaryrdquo3 The threat doesnrsquot reside just within state actors non-state

actors are incorporating cyber warfare operations into their realm of capabilities Hezbollah has

outlined a strategy to cripple the Israeli government by disrupting normal economic and societal

operations by targeting official websites crashing financial sites knocking out the internet

servers and targeting e-commerce sites4

In land sea and air battles military combatants can see the enemy coming whether itrsquos

1

AUACSCSinksAY08

the whites of their eyes or a blip on a screen International boundaries easily define when an

aggressor threatens the sovereignty of a nation giving the victim nation the right of jurisdiction

and there are specific international laws that address military operations in space In addition

the international community has defined when an adversaryrsquos use of force threatens a nationrsquos

territorial integrity and political independence

However the global nature of cyberspace and the speed of which victims can experience

cyber attacks force nations to deal with the legal challenges associated with over-the-horizon

military operations as commanders can experience battlefield affects with little or no warning

Moreover cyber attacks are much more difficult to define Jurisdiction over a cyber attack that

occurs 7000 miles away that crosses multiple physical domains and spans several international

borders compounds the legal issues surrounding an aggressive act that can have a wide-range of

effects Add the fact that determining the perpetrator proves to be less than speedy as most

cyber warriors can use the Internet ldquoanonymously or as a shell game to hide identitiesrdquo5 nations

face a very difficult task in attributing an aggressive act to a particular actor Responding to

asymmetric techniques tactics and procedures by state and non-state actors have proven to be

difficult for conventional forces Introducing asymmetric tactics in cyberspace presents nations

an even more challenging and complicated issue particularly in the legal regime

Therefore this paper will analyze the need for international guidance for conducting warfare

operations in the cyberspace domain This paper will define cyberspace and cyber warfare in an

effort to set the stage for illustrating the global nature of cyberspace and its reliance on the other

physical domains to conduct military operations The paper will define the international law as it

relates to territorial boundaries and outline the jurisdiction principles that allow a nation to act

against an adversary This paper outlines the definition of the Use of Force and how it

2

AUACSCSinksAY08

corresponds to the cyberspace domain and cyber warfare and with the final discussion centered

on the international laws that already exist which help shape international law for cyberspace

What is Cyber Warfare Very few of the new manifestations in war can be ascribed to new inventions or new departures in ideas6

~Carl Von Clausewitz

Defining Cyberspace William Gibson coined the term ldquocyberspacerdquo in his 1984 novel Neuromancer in order to

describe ldquoa shared virtual environment whose inhabitants objects and spaces comprise data that

is visualized heard and touchedrdquo7 However the most common of definitions today refer to the

Internet or the World Wide Web and usually consists of an information-sharing environment

between computers8 However the military has defined cyberspace to advocate a worldwide

spectrum of more than just information sharing among computers

In the National Military Strategy for Cyberspace Operations cyberspace is defined as a

domain characterized by the use of electronics and the electromagnetic spectrum to store

modify and exchange data via networked systems and associated physical infrastructure9 Joint

doctrine has adopted a computer-centric definition where cyberspace is ldquothe notional

environment in which digitized information is communicated over networksrdquo10 The National

Military Strategy and joint doctrine definitions advocate a worldwide information environment

that isnrsquot limited to the Internet or to just computers Matter of fact the expanded definitions

suggest that cyberspace consists of all networks to include highly sensitive military

governmental and commercial networks that may or may not use commercial means to store

modify and exchange data These systems include exchange networks like tactical digital

information links (TADIL) links between command and control platforms and air ground and

sea weapon systems In addition because the definition includes the electromagnetic spectrum

3

AUACSCSinksAY08

cyberspace includes ldquocapabilities that are currently considered electronic warfarerdquo11 which Great

Britain exploited in World War II when they introduced radar technology in World War II and is

still applicable with communication and navigational jamming capabilities used in todayrsquos

conflicts

While cyberspace is a unique domain that military commanders must protect in order to

conduct operations more effectively and offers commanders another dimension in which to

exploit weaknesses in an adversaryrsquos ability to project power cyberspace doesnrsquot exist on its

own According to Lt Col Fahrenkreg in the published Air University article title Cyberspace

Define ldquocyberspace exists across the other domains of air land sea and spacerdquo12 There are

clear delineations between the sea land and air Commanders know where the land ends and the

sea begins While there are some discussions as to where airspace ends and space begins the

capabilities and roles associated with each domain are clear Therefore to depict cyberspace as

an autonomous domain is unrealistic as the physical infrastructure of cyberspace and the means

of sharing information within the cyberspace domain resides in one or more of the four linear

domains

What Cyberspace is Not The most confused notion about cyberspace is that information operations and

cyberspace are one in the same Joint Publication 3-13 Information Operations describes the

information environment as a collection of leaders decision makers and systems that process

collect disseminate or act on information consisting of three dimensions the physical

informational and cognitive dimensions13 The goal of information operations is to influence the

cognitive dimension by affecting the decision-making process known affectionately by the Air

Force as the OODA Loop (Observe Orient Decide and Act)14 By disrupting and corrupting

4

AUACSCSinksAY08

information processes military commanders can influence or usurp adversarial human and

automated decision making in the physical and informational dimensions

As stated by Lt Col Fahrenkreg the confusion between cyberspace and information

operations comes from the misunderstanding of cyberspace as an operation rather than a

domain15 Information operation is a capability available to the combatant commander to

generate an effect in one of the five domains It just so happens that cyberspace tends to be the

primary means of delivering the Information Operation capability

Cyberspace connects the physical dimensions with the cognitive process and is a means

to create effects to include disrupting degrading denying the enemy the use of strategic and

operational assets to include command and controls systems power plants telecommunications

and other like targets to affect a statersquos operational and strategic centers of gravity Cyberspace

isnrsquot information or the data residing on a computer but is the means in which users transfer

store or modify information Cyberspace isnrsquot the data sent to a precision guided munition but

the means in which the originator passes the information Cyberspace is the digital super

highway of the electromagnetic spectrum with the ones zeros and electrons as the passengers

Defining Cyber Warfare According to the Institute for Advanced Study of Information Warfare (ASIW) cyber

warfare has become a form of information warfare which ASIW defines as ldquothe offensive and

defensive use of information and information systems to deny exploit corrupt or destroy and

adversaryrsquos information information-based processes information systems and computer-based

networks while protecting onersquos own Such actions are designed to achieve advantages over

military adversariesrdquo16 While this definition doesnrsquot specifically address the electromagnetic

spectrum the definition focuses on information-sharing systems which is where crux of the

cyberspace domain revolves around

5

AUACSCSinksAY08

Joint doctrine defines cyber warfare as those areas of operations that affect the

electromagnetic spectrum to include Computer Network Operations and Electronic Warfare

which are two of the five core operational capabilities of Information Operations Electronic

warfare operations operates across ldquoradio visible micro directed energy and all other

frequenciesrdquo and overlaps with network warfare operations which include ldquoradio nets satellite

links tactical digital information links (TADIL) telemetry digital track files

telecommunications and wireless communication network and systemsrdquo all of which operate

within the electromagnetic spectrum17

Cyber warfare consists of defensive and offensive operations Defensive operations

arenrsquot limited to severing connections or blocking attempts of an adversary trying to corrupt data

modify transmissions or destroy information systems Defensive operations include the

elimination of the adversaryrsquos capability of conducting operations which may involve crossing

sovereign borders in order to complete the task However defensive network operations come in

more than just one form The movies portray computer experts hovering over computers trying

to affect each otherrsquos operations However cyber warfare includes the use of traditional kinetic

effect to disrupt computer network operations of the enemy as a fighter-bomber delivering a

500-pound bomb to destroy a vital mode in a computer network may serve the same purpose as a

computer-centric network attack While this isnrsquot as sexy as a network attack that spans the

globe to degrade the enemyrsquos ability operation within the cyberspace domain the effects are the

same

Territorial Sovereignty In total war it is quite impossible to draw any precise line between military and non-military problems18

~Sir Winston Churchill

6

AUACSCSinksAY08

Cyberspace is certainly a domain that requires unique attention in order for commanders

to effectively and efficiently prosecute combat operations Cyberspace spans the globe using

the physical infrastructure residing within the other linear domains As users pass information

from one site to another data crosses boundaries by means of the cyberspace domain Data

leaves the Iraq area of operation via satellite to a receiving site in Germany Operators route the

information to the United States either through another satellite or by ground to sea-based cables

bound for computer nodes within the United States before arriving in South Carolina where

automated network tools redirect the information to the receiverrsquos location

An adversary attempting to modify corrupt or destroy this information traveling within

the cyberspace domain would at one time or another would cross sovereign borders through air

land sea or space The adversaryrsquos physical presence may not apply as they could conduct

operations from the comforts of their home however a nation could detect the adversaryrsquos

digital presence and could feel the impact of their actions from within their sovereign borders

Therefore as these adversaries span the globe using the cyberspace domain that relies on the

other linear domains to exist does international law apply when boundaries are crossed The

following sections will address the international laws of each physical domain and evaluate how

their principles apply to the cyberspace domain

Airspace Airspace as defined by Doctor Boleslaw A Boczek the internationally renowned expert

on international law ldquois the air pillow above the subjacent territoryrdquo to include ldquoairspace above

international waters and the territorial seardquo The airspace is under complete and exclusive

sovereignty of the subject state19 With that states have jurisdiction over their airspace and

require identification of foreign aircraft along with their intentions According to Dr Boczek

book International Law A Dictionary ldquoentry of national spacehellipmay take place only with the

7

AUACSCSinksAY08

authorization of the territorial staterdquo20 and currently only applies to aircraft Entry into the

airspace would require ldquoall aircraft to identify themselves file flight plans and report their

positionrdquo According to the 1944 Chicago Convention on International Civil Aviation nations

can enter into agreements that allow scheduled international civil air services which usually

include reciprocal agreements covering routes volume and other matters relating to air traffic

However these agreements only apply to civil aviation where state aircraft which include

aircraft belonging to the military customs public services and heads of states must follow more

restrictive procedures upon entering the airspace of a foreign nation21

There are several incidents where states have evoked their right for defending their

national security like the shooting down of a US military reconnaissance aircraft over Soviet

airspace by the Soviet Union in 196022 or the shooting down by Soviet fighter planes of a South

Korean airliner in 198323 The Soviet Union isnrsquot the only nation to protect its airspace as the

United States was responsible for shooting down an Iranian airliner thought to be an attacking

military plane over the Persian Gulf in 198824 These examples illustrate a nationrsquos sovereign

resolve to protect itself when a suspected adversary violated their airspace

Applying international law of airspace to cyberspace doesnrsquot seem too practical Civilian

signals entering a nationrsquos airspace would require nations to enter into agreements to allow

scheduled services and the persons receiving information through airspace would have to be

non-state sponsored Nationrsquos could regulate some cyberspace networks entering airspace like

radio communications that primarily use land-based infrastructure to function However the

very nature of computer networks and the ever-increasing global reach of communication

capabilities severely restrict a nationrsquos ability to monitor the millions of transmissions made on a

daily basis and these signals certainly wouldnrsquot be on any scheduled basis Therefore even if

8

AUACSCSinksAY08

nations made agreements concerning the cyberspace domain nations would have a difficult time

enforcing their terms of agreements unless the terms are very open-ended If they were so open-

ended then the agreement may not be necessary and based on my research nations realize the

futility of establishing these agreements as this author couldnrsquot find any reference to any

agreements that nations have entered into referencing the cyberspace domain

While the international law for civilian aircraft in airspace may not relate well or isnrsquot

feasible to enforce in the cyberspace domain does a nation have that same right to protect itself

from a suspected attack from cyberspace where the attackerrsquos signal enters airspace Does a

nation have the right to ldquoshoot downrdquo a cyberspace attack as it enters their domain through

airspace The whole idea behind restricting airspace from foreign military aircraft is because of

the strategic impact military aircraft can have on a nation As demonstrated in World War II

military aircraft carrying weapons of mass destruction can decimate cities and destroy a nation

with minimal effort The effects generated by military aircraft are quite destructive and garner

specific attention While an aircraft in of itself is relatively harmless the actions taken by the

crew can lead to devastating results

The same is true for cyber attacks The information passing through airspace in the

cyberspace domain is the vehicle however the crew conducting the operation is potentially

creating the same strategic results The cyber attack may not destroy cities but it certainly can

be destructive to a nationrsquos well-being by crippling power sources economic industries water

supply etc all at the blink of an eye while the victim takes several days to determine the

perpetrator Therefore while the international law for airspace may not be specifically relevant

the underlying principles are applicable as cyber attacks can have the same potential strategic

impact as an attack from a military aircraft

9

AUACSCSinksAY08

Space Outer space as defined by Doctor Boczek ldquois the space beyond the air surrounding the

earthrdquo As of 2005 international law doesnrsquot define a demarcation between airspace and outer

space but ldquostates agree that state sovereignty doesnrsquot extend without any limitsrdquo25 Proposals of

where airspace ends and when outer space begins are base on various scientific and technological

criteria (gravitational pull capabilities of air breathing aircraft etc26) Others scientists argue

that defining a boundary between airspace and outer space isnrsquot necessary as it would hinder the

progress of space technology and the legal status would depend on the nature of the activity

While no boundary exists airspace is finite and activity in outer space follows four

fundamentals principles First over flights of foreign satellites over a nation is permissible as

airspace doesnrsquot extend forever Second space ldquointernational law applies to outer space and

celestial bodiesrdquo Third according to the Outer Space Treaty of 1967 states canrsquot claim celestial

bodies or outer space which are not subject to national appropriation therefore are free for use

by all states Finally states must use outer space exclusively for peaceful purposes with specific

bans on weapons of mass destruction However states can use space for other military purposes

like intelligence surveillance and reconnaissance activities 27

Are these international laws and principles applicable to cyberspace Satellites are

certainly an integral part of the space domain Operators control satellites by using the

cyberspace domain and information passes between satellites and ground stations One can

argue that space is a sub-set of the cyberspace domain with satellites serving as computers in

space Global positioning system devices in vehicles interact with satellites all through an

elaborate network as part of the electromagnetic spectrum known as cyberspace Therefore

cyberspace is in space with millions of people using cyberspace everyday

10

AUACSCSinksAY08

The military uses space assets for intelligence surveillance and reconnaissance

knowledge management and command and control Agencies like the National Reconnaissance

Office and National Geospatial-Intelligence Agency obtain high-altitude imagery using a variety

of capabilities to include heat signature resonation Satellites can detect missile launches which

provide vital military information to senior leaders tasked with the security of their nation The

military networks to include decision briefs tasks and emails in Iraq and the Predator feeds in

Afghanistan travel through military and commercial satellites with all the information flowing

through the cyberspace domain With the heavy reliance of cyberspace to operate space assets

and the demands of information flowing through space by businesses it should come as no

surprise that space is a vital component for day-to-day operations of the military

Since cyberspace is an inherent component for space operations it is logical to assume

international law for outer space is applicable to cyberspace as long as an aggressor doesnt

violate the four premises and as long as weapons of mass destruction arenrsquot ldquostationed in outer

spacerdquo 28 Therefore a state would consider a cyber attack against a satellite as other than for

peaceful purposes and according to the fourth premise international law would apply

However what about a cyber attack using satellites as a means of conducting operations

Under todayrsquos current operations international elites havenrsquot considered a cyber attack passing

through space as a violation of international law When a senior leader in Qatar approves a

target set that is executed by a pilot in Nevada by an aircraft in Afghanistan all this information

is transmitted by cyberspace through space The result is that an aircraft renders an air or ground

target inoperable The effect is the same for cyberspace The information flows through space

by way of the cyberspace domain and the result is that an operator has rendered a target

11

AUACSCSinksAY08

inoperable As with airspace the information isnrsquot the cause of the damage but what an operator

does with the information is what constitutes the cyber attack

Land Cyber attacks using resources over land is relatively straightforward International

boundaries are defined as ldquoimaginary lines which separate territorial sovereigntyrdquo 29 which are

mutually agreed upon via international treaties Crossing an international border without

permission from the state is a violation of international law While an illegal immigrant crossing

a border to seek an opportunity to provide for his family is a violation of national law the United

Nation considers a nation-sponsored invasion of another nation that threatens the security and

stability of a nation as a breach in international law and an act of war

However international law doesnrsquot consider all border crossings as an act of war For

example when Nicaraguan troops and arms allegedly crossed the borders of El Salvador the

United Nations determined that incursions didnrsquot threaten El Salvadorrsquos territorial integrity and

stated that neither ldquothese incursions nor the alleged supply of arms may be relied upon as

justifying the exercise of the right of collective self-defenserdquo30 The victim state can repelled the

aggressive act but the United Nations Council wouldnrsquot condone any further military action

taken against the adversary opting for diplomatic or economic solution instead

Does international law apply when an adversary crosses international borders using

cyberspace as the means for conducting warfare operations When an adversarial state crosses a

statersquos boundaries using roads or bridges that connect the two nations the road is the resource

spanning the two nations If the adversary doesnrsquot do anything then returns to their sovereign

borders the aggressor hasnrsquot violated international law However when the adversary uses

weapon systems to affect serious damage the adversary has broken international law and a

12

AUACSCSinksAY08

nation may invoke their right for self-defense and may conduct full-scale operations to neutralize

the threat

A parallel notion is when an adversary uses a copper or fiber optic connection that spans

between two nations The adversary uses the land-based LAN connection as a means for

conducting cyber warfare operations The adversary may cross the borders using cyberspace yet

do nothing The affected state may push the adversary back to its borders but no further actions

are deemed appropriate However once the adversary uses the information transmitted over

cyberspace to cause severe operational or strategic damage the affected state now has the right

of self-defense Cyberspace is the means like the road or bridge for which the adversary

delivered the weapon The affected nation will consider the execution of the adversaryrsquos

information packet or weapon system as an act of aggression and the effect caused by the

weapon is what breeches international law

The difference between these two scenarios is that the adversary using the

electromagnetic spectrum hasnrsquot physically invaded a nationrsquos sovereign borders However

their digital presence crossed sovereign borders and as latter discussed in the paper adversaries

committing an act aggression against a state are now under the jurisdiction of the affected state

Sea ldquoThe territorial sea is a belt of sea adjacent to the (statersquos) coasthellipto include the airspace

aboverdquo as well as the seabed and subsoil31 The territorial sea is subject to the right of innocent

passage by foreign shops giving states the right to transport goods and passengers between ports

All of which is subject to the full sovereignty of the state which according to the United Nations

Convention on the Law of the Sea in 1982 and agreed upon by the majority of its membership in

1982 extends 12 miles from the coast32 The jurisdiction includes crimes where the

consequences extend to the coastal state and disturbs the peace of the country33 A cyber attack

13

AUACSCSinksAY08

conducted within the territorial sea of a nation would be no different from a cyber attack

conducted from within the nationrsquos land borders therefore cyber attacks against a state or even

another state conducted within the territorial seas are subject to current international laws Cyber

attacks originating outside the statersquos sovereign borders but results in affecting a statersquos

resources in their territorial seas would fall under the land and airspace breeches of territorial

sovereignty and would be subject to international law

The high seas on the other hand arenrsquot subject to the sovereignty of any one state The

high seas extend beyond the territorial sea and include the airspace the seabed and the subsoil34

and all states have the right to exercise freedoms on the high seas35 As similarly defined in

space ldquothe high seas shall be reserved for peaceful purposesrdquo as stated by Article 88 of the Law

of the Seas Cooperative36 which is defined as refraining from any threat or use of force (outside

of wartime conflicts)

The very nature of a cyber attack in the high seas lends itself to be a violation of

international law as nations are restricted to conducting peaceful operations in the high seas

The question is whom has jurisdiction of crimes committed in the high seas By applying the

Protective Security Principle of Jurisdiction where an actor threatens a statersquo security and

introducing the United Nationrsquos definition on the Illegal Use of Force extends to the high seas

and for that matter space giving states the right for self-defense as defined by the United Nations

as ldquoan armed attackrdquo The sheer name of cyber attack doesnrsquot immediately lend itself to an

ldquoarmedrdquo cyber attack However the effects generated from a cyber attack can be equivalent to a

traditional conventional attack and the international law would permit a state to take appropriate

countermeasures while notifying the United Nations Security Council37

14

AUACSCSinksAY08

Applying International Law to Cyber Warfare Today we live in an Information Age where communication through cyberspace has forever changed and flattened out worldhellipOur adversaries seek to operate from behind technical legal and international screens as they execute their costly attacks38

~General James E Cartwright Commander United States Strategic Command

Jurisdiction

Understanding the territorial sovereignty principles of a nation is important in applying

cyberspace and cyber warfare to existing international laws While some of these principles and

international laws may not be relevant for the cyberspace domain due to the far-reaching

capability of cyber warfare the jurisdiction of a nation further defines its ability to respond to

aggressive acts by nations in the cyberspace domain There are three jurisdictional principles

that provide nations the right to pursue aggressors that threaten a nationrsquos independence the

Territorial Principle Nationality Principle and the Protective Security Principle

For actions originating within the state the jurisdiction clearly falls within the territorial

principle where a ldquostate has jurisdiction over all crimes committed in its territoryhellipto include

airspace international waters and territorial seasrdquo39 The territorial jurisdiction is subject to

exceptions when dealing with persons from foreign states as in the most popular example of

immunity given to foreign diplomats In this case ldquostates may exercise jurisdiction over its

citizenhellipeven if they are physically outside the statesrsquo territoryrdquo as Doctor Boczek defines as the

Nationality Principle Nations usually agree upon on these concessions states prior to the offense

being committed40

Doctor Boczek defines the Protective Security Principle as a ldquojurisdictional principle

whereby a state my assume jurisdiction over and punish foreign nationals for certain conduct

outside its territory which is directed against its security territorial integrity and political

independencerdquo41 Some states would argue that criticism of a state or government is applicable

15

AUACSCSinksAY08

in applying this principle of jurisdiction However this is too broad of an interpretation and

should be confined to acts that are more tangible in nature like falsification of a statesrsquo official

documents conspiracy to violate immigration of custom laws and illicit drug trafficking42

Would a cyber attack that is deemed to challenge a nationrsquos banking community or bring

down a power source be a direct attack against its security and political independence The

international community easily sees the attack of a power source with kinetic weapons as a

violation of a territorial boundary and a breech of international law The United States viewed

the attack on the Trade Towers as an act of war launching the Global War on Terrorism Would

the United States have viewed the same devastation as if the attack occurred through cyberspace

Would the attack have been less of an act of war if the aggressor remotely controlled domestic

airliners from a foreign country Probably not What happens if the cyber attack caused a fire in

the lower floors of the buildings preventing people from escaping While less dramatic than an

airbus flying into the middle of the towers and maybe more difficult to demonize the crime the

result is the samemdashinnocent people suffering as a result of an adversary trying to threaten a

nationrsquos security

What happens if the suspected cyber attack has violated a nationrsquos territorial boundary in

order to attack a neighboring country or an ally Going from point A to point B in cyberspace is

rarely a direct connection As with the global nature of cyberspace itrsquos conceivable that

adversaries cross several nationsrsquo boundaries to conduct cyber attack operations The question

generated is who has jurisdiction

If the actor committing the crime had used an airplane each nation could claim

jurisdiction as the adversary violated their territorial boundaries and violated international law

More often than not the first state would have acted immediately upon the aggressive act and

16

AUACSCSinksAY08

would have prevented aggressors from completing their task by either forcing the aircraft to land

or turnaround or an even more escalated response of firing upon the aircraft In the air land or

sea the ability for a nationrsquos military forces to respond in a timely manner gives way to the

deterrence factor of not crossing a statersquos boundaries without receiving permission for fear of

reprisal A clear example of this was when Turkey denied the United States the ability deploy

the 4th Infantry Division from its borders at the beginning of Operation Iraqi Freedom Violating

Turkeyrsquos borders without permission would have brought about great repercussions that would

have made Operation Iraqi Freedom even more difficult and could have resulted in an escalation

of the war outside the Iraqi borders43 Another example is when Spain and France denied the

Unites States the use of their airspace when F-111s based in the United Kingdom conducted air

operations in Libya in an effort to eliminate Muammar Khadafy44

However the speeds at which these breeches in territorial boundaries occur make it

difficult for a nation to claim jurisdiction especially when nothing occurred within their

territorial sovereignty The cyber attacks didnrsquot result in any damage to nation as the information

packets passed through their sovereign borders According to territorial boundary description

described by Doctor Boczek the international community doesnrsquot consider the crossing the

border in of itself an act of warmdashserious damage is a driving factor in determining conflict

escalation In addition according to the territorial jurisdiction principle the cyber attack didnrsquot

threaten a nationrsquos security territorial integrity and political independence If the cyber attack or

information originated from within a sovereign territory by a third party then the two nations

would have to work together to resolve the issue and mutual jurisdiction would probably apply

However if the cyber attack didnrsquot physically manifest itself from within their sovereign

territory or the adversary didnrsquot use the nation as a staging area to launch a further attack the

17

AUACSCSinksAY08

international law and the jurisdiction principles would dictate the affected nation would have

jurisdiction

Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security

territorial integrity and political independence Cyberspace utilizes the other domains as a means

of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence

Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of

territorial sovereignty the Protective Security Principle does provide nations the ability to

enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos

sovereignty when it conducts cyber warfare operations However some elites donrsquot consider

cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense

International law specifically article 2 of the United Nations Charters states that a

members shall refrain in their international relations from the threat or use of force against the

territorial integrity or political independence of any state or in any other manner inconsistent

with the purposes of the United Nations which is intended to prohibit all types of force except

those carried out under the aegis of the United Nations or as provided for by the Security

Council45 The only exception to the United Nations Charters as it relates to the Use of Force is

the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed

attack46

International elites have discussed the term ldquouse of forcerdquo in the past because of the

development of chemical and biological weapons and had to move from a kinetic impact based

definition to a results-oriented approach47 Chemical and biological weapons lacked the

characteristic of an explosion or physical force yet these weapons certainly are capable of

destroying life and property Doctor Leigh Armistead a former information warfare instructor at

18

AUACSCSinksAY08

the Joint Forces Staff College cautions that the use of computer network attacks by the military

ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary

that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great

Russia introduced a proposal to the United Nations that banned the use of information

operations Even though the United Nations didnrsquot adopt the law the concern of international

community is fully aware of the impact cyber attacks can have on a nation

The concern over cyber warfare capabilities is that it can generate both non-kinetic and

kinetic effects There has always been the traditional kinetic solution for cyber warfare where a

precision guidance munition destroys a critical information system node Most people assume

computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos

computer system from the safety of onersquos own command and control center but the physical

destruction of a computer system or network by kinetic means also qualifies as cyber warfare

However cyber warfare has also evolved to the point where aggressors can achieve a kinetic

effect without the use of a traditional kinetic weapon A cyber attack on an information system

can shut down a particular node of a power plant causing the system to become inoperative

Even if there wasnrsquot an explosion the attack serves the same purpose

The question raised is do cyber attacks constitute an armed attack Scholars do agree that

some cyber attacks fit comfortably within the United Nations Charter For example a strategic

level cyber attack causing widespread damage and significant casualties would trigger the statersquos

right of self-defense In addition a cyber attack that precluded a conventional attack or a series

of cyber attacks causing significant damage would give a state the right of self-defense49 Few

would dispute that a country has the right under international law to respond with military force

19

AUACSCSinksAY08

if a state destroyed or significantly damaged another nationrsquos economic system for example the

New York or London stock exchanges

However some confusion and state-defined interpretation comes into play when the

frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard

Law School argues that cyber attacks require an expansion of the definition on the ldquouse of

forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot

be prohibited by international law50 International scholars recommend ldquoclearer rules of what

kinds of information warfare actions constitute an armed attackrdquo which drives permissible

responses of self-defense51 For example a state-sponsored cyber attack causes damage to a

victimrsquos factory or power plant however the nation claims the incident is an isolated instance

and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under

the United Nations Charter and the United Nations would consider any response retaliation

which would violate international law52

Another example involves a nation conducting a series of small attacks causing minimal

damage and then ceases Even though the aggressor used force to conduct cyber warfare

operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under

the United Nations Charter This type of attack is analogues to a small band of troops crossing a

border without causing significant damage53 According to the United Nations Charter the

national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders

and respond to the use of force Repelling the small band of troops and reestablishing their

sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration

of war and allies would have to respect the United Nations decision and couldnrsquot intervene The

same is true for the cyber attack A state can employ defensive measure to isolate and defeat the

20

AUACSCSinksAY08

incursion over the electromagnetic spectrum However the United Nations would see further

offensive operations or invasive operations as retaliation Therefore a nation must take the

incident whether it is signs of conventional forces on the ground or traces of cyber warfare

incursions in the electromagnetic spectrum to the United Nations to seek restitution

In both of these situations the international law becomes the target for change not

whether cyber warfare is in violation of international law If the law were to change the

international community would then consider the above situations acts of war even if an

adversary used conventional forces As written today the result of an operation remains the

driving factor in determining if an adversary has violated international law The means by which

an adversary conducts military operations may affect how nations react to the situation but

whether an adversary conducts the operation by means of the air land sea space or cyberspace

doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian

Triggs a public international lawyer and member of the Attorney General International Legal

Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over

offences abroad having an intended and substantial effect within a state may be justifiedrdquo54

Therefore the international community must evaluate the effect of a criminal act rather than the

means in which the act was committed

Others claim that because the Internet takes advantages of legal norms where non-state

actors can ignore Western notions of law55 more international laws are needed for cyberspace

However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using

other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the

Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked

aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts

21

AUACSCSinksAY08

against a staterdquo in the cyberspace domain The anonymity of the Internet and their total

disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and

national laws already exist in most countries that prohibit the use of the Internet for terrorist

activities therefore additional international laws wouldnrsquot prevent or deter terrorist from

committing such acts of aggression

International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed

Conflict includes the Martens Clause which extends established custom and humanitarian

principles to new technologies and addresses the ever-changing nature of warfare The

international community designed The Martens Clause ldquoto prevent future unnecessary andor

disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges

crimes by invoking the laws of humanity and public conscience hence their effects and not its

methods

The basic legal premise behind Law of Armed Conflict is that attacks must be limited to

military objectives and collateral damage must be proportionate to military advantages and

forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary

suffering but military commanders and planners need to be aware of the results a particular

action will invoke Russian leadership believes a computer network attack against their

homeland can be a means for executing a variety of escalating responses to include nuclear

attack58 Therefore it is imperative military commanders understand the impact any weapon

system can have on an adversary not just cyber attacks

Not all scholars agree that international law is insufficient to govern cyber warfare

Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace

and the Use of Force states that computer network attacks constitute an unlawful use of force in

22

AUACSCSinksAY08

cyberspace under traditional international law Sharp declared that an armed attack may occur

ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a

way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive

definition of cyber attacks may never be drafted59 The Congressional Research Service also

concluded that ldquothere is little likelihood that the international community will soon generate a

coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations

on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos

conclusion is that the effects of cyber warfare operations are the same as if an adversary

conducted conventional warfare operations where the effect of the attacks are the driving factors

in determining whether an adversary used force or not

The United States Government agrees with Sharprsquos conclusion The offensive

Information Operation strategy for the United States government as described by Doctor

Armistead ties the tools used to conduct military operations back to the desired effect which is

in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning

effects-based operations and operational art focus the Joint Force Commanderrsquos course of action

towards meeting objectives outlined in guidance provided by the National Command Authority

and senior military leadership62 Whether the tools are dropped pamphlets invasive network

attacks or bombs on targets the goal is to produce a desired effect to achieve the overall

objectives and cyber warfare can produce effects that challenge the national security of a nation

Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63

~General T Michael Moseley USAF

23

AUACSCSinksAY08

The cyberspace domain has been around for quite sometime but as technology continues

to advance businesses as well as governmental organizations are becoming more reliant on the

cyberspace domain With that reliance the protection of this critical domain becomes even more

important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the

electromagnetic spectrum by denying and disrupting information demands Scholars claim that

protection needs to include addressing existing international laws expanding them to incorporate

the ever-advancing capabilities emerging in the cyberspace domain

However territorial sovereignty of a nation and the principles of jurisdiction specifically

the Protective Security Principle give nations the right to exercise jurisdiction when an

aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64

While cyberspace is a domain requiring specific attention it relies on assets in the other domains

of land space sea and air in order to operate and international laws for the linear domains do

exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace

but during cyber warfare operations the principles behind the restrictions of foreign military

entering airspace do apply The strategic nature of cyber warfare operations correspond to the

same strategic impact that airpower can inflict upon a nation threatening their independence

While maybe not as dramatic as kinetic effects the results can be just as devastating

Space is relatively straightforward Since a nation canrsquot claim space and over flights of

foreign satellites over a nation is permissible nations must use space for peaceful purposes

Kinetic attacks against space assets are a violation of international law therefore nations would

consider cyber warfare operations against space assets as other than peaceful purposes and a

violation of international law Cyber attacks traversing space assets relate to current military

operations where the military uses space assets to conduct kinetic operations Since international

24

AUACSCSinksAY08

elites havenrsquot considered these kinetic operations as a breach of international law military

commanders can conduct cyber warfare operations through space without fear of violating

international laws for outer space

Crossing international borders without a nationrsquos permission and threatening their

sovereignty is a violation of international law While nations canrsquot consider all border crossings

as an act of war those acts of aggression that threaten the territorial integrity would elicit a

defensive response by the victim nation Whether incursions involve combat vehicles over a

highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are

threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not

have set foot in the nation but according the Protective Security Principle the victim nation has

jurisdiction

Conducting cyber warfare operations from the territorial sea is no different from

conducting operations from within a nationrsquos land or sea borders However the high seas are

very similar in nature to space in that they are reserved for peaceful purposes Therefore

conducting any means of warfare from within the high seas is a violation of international law

and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-

defense

According to Barkham ldquoinformation warfare attacks are in essence territorial

penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then

subject to the jurisdiction of the victim nation who then has the right for self-defense However

due to the global nature of cyberspace aggressors can cross multiple borders and determining

who has jurisdiction demands cooperation among nations The origin and any deliberate staging

locations of the cyber attack will drive who has jurisdiction The crossing of third party borders

25

AUACSCSinksAY08

by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the

aggressors threaten a nationrsquos independence or territorial integrity

Scholars consider cyber warfare operations that involve strategic and operational impacts

as being a means of using force and fall within the legal regime of existing international law

However scholars argue that because cyber warfare includes kinetic and non-kinetic results the

Use of Force definition needs expanding Yet they conclude that an exhaustive definition of

cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare

operations against existing case studies where the effects are evaluated as opposed to the means

even if the operations originated from outside the nationrsquos territorial jurisdiction There is some

authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to

have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade

non-state actors from conducting cyber warfare operations given their willingness to ignore

Western notions of war and their ability to conduct operations anonymously in cyberspace

International laws are in place to that address the ever-changing nature of warfare The

Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a

framework for addressing all warfare to include cyber warfare operations The international

community will need to measure the effects of an operation rather the means Whether its boots

on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a

nationrsquos response

26

AUACSCSinksAY08

End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)

27

AUACSCSinksAY08

44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

28

AUACSCSinksAY08

Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005

Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department

American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)

Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983

Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988

Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)

Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)

IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)

Joint Publication 3-13 Information Operations 13 February 2006

Joint Publication 5-0 Joint Operations Planning 26 December 2006

Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies

Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc

Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College

Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)

Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press

29

AUACSCSinksAY08

Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI

Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)

Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press

Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company

Detter Delupis I The law of war (2000) New York NY Cambridge University Press

Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)

Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College

Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor

Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)

Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)

Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf

Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)

Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College

Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College

Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)

Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA

30

AUACSCSinksAY08

Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)

Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)

Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College

Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology

Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College

Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)

OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center

OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College

OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications

Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991

Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College

Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center

Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)

31

AUACSCSinksAY08

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press

Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA

Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University

Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor

Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661

Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office

Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis

United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC

United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center

Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College

Wesley David C The Military Commander and the Law 2006

32

Page 2: Sinks 0407

AUACSCSinksAY08

Disclaimer

The views expressed in this academic research paper are those of the author(s) and do not

reflect the official policy or position of the US government or the Department of Defense In

accordance with Air Force Instruction 51-303 it is not copyrighted but is the property of the

United States government

ii

AUACSCSinksAY08

Abstract

In land sea and air battles military combatants can see the enemy coming whether itrsquos

the whites of their eyes or a blip on a screen International boundaries easily define when an

aggressor threatens the sovereignty of a nation giving the victim nation the right of jurisdiction

and there are specific international laws that address military operations in space In addition

the international community has defined when an adversaryrsquos use of force threatens a nationrsquos

territorial integrity and political independence

However the global nature of cyberspace and the speed of which victims can experience

cyber attacks force nations to deal with the legal challenges associated with over-the-horizon

military operations Jurisdiction over a cyber attack compounds the legal issues surrounding an

aggressive act that can have a wide-range of effects In addition nations face a very difficult

task in attributing an aggressive act to a particular actor and responding to asymmetric

techniques in cyberspace presents nations with an even more challenging and complicated issue

particularly in the legal regime

Cyberspace relies heavily on the other physical domains to operate and international laws

exist that govern the physical domains or air land sea and space The far-reaching nature of

cyberspace generates jurisdiction challenges that arenrsquot associated with the other domains but

the jurisdiction principles can apply to cyber warfare While scholars argue about the definition

of the Use of Force cyber warfare can have strategic and operational impacts that fall neatly

within existing definitions Finally international committees and oversight organizations have

generated legal precedents that apply to cyber warfare operations Therefore while cyberspace

is its own domain and there are unique demands placed on nations by cyber warfare existing

international laws and definitions are applicable to cyber warfare

iii

AUACSCSinksAY08

Table of Contents

DISCLAIMER II

ABSTRACT III

TABLE OF CONTENTS IV

INTRODUCTION 1

WHAT IS CYBER WARFARE 3 Defining Cyberspace 3 What Cyberspace is Not 4 Defining Cyber Warfare 5

TERRITORIAL SOVEREIGNTY 6 Airspace 7 Space 10 Land 12 Sea 13

APPLYING INTERNATIONAL LAW TO CYBER WARFARE 15 Jurisdiction 15 Use of Force 18 International Laws 22

CONCLUSION 23

END NOTES 27

BIBLIOGRAPHY 29

iv

AUACSCSinksAY08

Introduction We need to be able to think in terms of target effects I picture myself around that same targeting table where you have the fighter pilot the bomber pilot the special operations people and the information warrior As you go down the target list each one takes a turn raising his or her hand saying ldquoI can take that targetrdquo1

~ General (Retired) John P Jumper

The worldrsquos growing reliance on information technology to improve efficiency has

opened a threat to all who become reliant on cyberspace to conduct operationshellipa threat that has

many sources of predators ranging from pranksters to white-collar criminals to terrorists Yet

cyberspace has limited international laws to govern a worldwide domain that is ever expanding

as third world nations begin to invest in information technology and enter the cyberspace realm

to enhance business and military operations As nations begin to rely more on cyberspace as an

effective means of conducting business and military operations the more these operations will

become susceptible to outside aggressive influences whether itrsquos from economic invasions or

disruption of military operations

In addition the threat of military operations in the cyberspace domain is real The

Russian military has incorporated cyber warfare into their doctrine in order to gain information

advantage by affecting an adversaryrsquos information system decision-making processes command

and control and even the populace2 China is pursuing a battalion-sized force of computer

experts trained ldquoto carry out computer network attacks as a means of seeking asymmetrical

advantages over an adversaryrdquo3 The threat doesnrsquot reside just within state actors non-state

actors are incorporating cyber warfare operations into their realm of capabilities Hezbollah has

outlined a strategy to cripple the Israeli government by disrupting normal economic and societal

operations by targeting official websites crashing financial sites knocking out the internet

servers and targeting e-commerce sites4

In land sea and air battles military combatants can see the enemy coming whether itrsquos

1

AUACSCSinksAY08

the whites of their eyes or a blip on a screen International boundaries easily define when an

aggressor threatens the sovereignty of a nation giving the victim nation the right of jurisdiction

and there are specific international laws that address military operations in space In addition

the international community has defined when an adversaryrsquos use of force threatens a nationrsquos

territorial integrity and political independence

However the global nature of cyberspace and the speed of which victims can experience

cyber attacks force nations to deal with the legal challenges associated with over-the-horizon

military operations as commanders can experience battlefield affects with little or no warning

Moreover cyber attacks are much more difficult to define Jurisdiction over a cyber attack that

occurs 7000 miles away that crosses multiple physical domains and spans several international

borders compounds the legal issues surrounding an aggressive act that can have a wide-range of

effects Add the fact that determining the perpetrator proves to be less than speedy as most

cyber warriors can use the Internet ldquoanonymously or as a shell game to hide identitiesrdquo5 nations

face a very difficult task in attributing an aggressive act to a particular actor Responding to

asymmetric techniques tactics and procedures by state and non-state actors have proven to be

difficult for conventional forces Introducing asymmetric tactics in cyberspace presents nations

an even more challenging and complicated issue particularly in the legal regime

Therefore this paper will analyze the need for international guidance for conducting warfare

operations in the cyberspace domain This paper will define cyberspace and cyber warfare in an

effort to set the stage for illustrating the global nature of cyberspace and its reliance on the other

physical domains to conduct military operations The paper will define the international law as it

relates to territorial boundaries and outline the jurisdiction principles that allow a nation to act

against an adversary This paper outlines the definition of the Use of Force and how it

2

AUACSCSinksAY08

corresponds to the cyberspace domain and cyber warfare and with the final discussion centered

on the international laws that already exist which help shape international law for cyberspace

What is Cyber Warfare Very few of the new manifestations in war can be ascribed to new inventions or new departures in ideas6

~Carl Von Clausewitz

Defining Cyberspace William Gibson coined the term ldquocyberspacerdquo in his 1984 novel Neuromancer in order to

describe ldquoa shared virtual environment whose inhabitants objects and spaces comprise data that

is visualized heard and touchedrdquo7 However the most common of definitions today refer to the

Internet or the World Wide Web and usually consists of an information-sharing environment

between computers8 However the military has defined cyberspace to advocate a worldwide

spectrum of more than just information sharing among computers

In the National Military Strategy for Cyberspace Operations cyberspace is defined as a

domain characterized by the use of electronics and the electromagnetic spectrum to store

modify and exchange data via networked systems and associated physical infrastructure9 Joint

doctrine has adopted a computer-centric definition where cyberspace is ldquothe notional

environment in which digitized information is communicated over networksrdquo10 The National

Military Strategy and joint doctrine definitions advocate a worldwide information environment

that isnrsquot limited to the Internet or to just computers Matter of fact the expanded definitions

suggest that cyberspace consists of all networks to include highly sensitive military

governmental and commercial networks that may or may not use commercial means to store

modify and exchange data These systems include exchange networks like tactical digital

information links (TADIL) links between command and control platforms and air ground and

sea weapon systems In addition because the definition includes the electromagnetic spectrum

3

AUACSCSinksAY08

cyberspace includes ldquocapabilities that are currently considered electronic warfarerdquo11 which Great

Britain exploited in World War II when they introduced radar technology in World War II and is

still applicable with communication and navigational jamming capabilities used in todayrsquos

conflicts

While cyberspace is a unique domain that military commanders must protect in order to

conduct operations more effectively and offers commanders another dimension in which to

exploit weaknesses in an adversaryrsquos ability to project power cyberspace doesnrsquot exist on its

own According to Lt Col Fahrenkreg in the published Air University article title Cyberspace

Define ldquocyberspace exists across the other domains of air land sea and spacerdquo12 There are

clear delineations between the sea land and air Commanders know where the land ends and the

sea begins While there are some discussions as to where airspace ends and space begins the

capabilities and roles associated with each domain are clear Therefore to depict cyberspace as

an autonomous domain is unrealistic as the physical infrastructure of cyberspace and the means

of sharing information within the cyberspace domain resides in one or more of the four linear

domains

What Cyberspace is Not The most confused notion about cyberspace is that information operations and

cyberspace are one in the same Joint Publication 3-13 Information Operations describes the

information environment as a collection of leaders decision makers and systems that process

collect disseminate or act on information consisting of three dimensions the physical

informational and cognitive dimensions13 The goal of information operations is to influence the

cognitive dimension by affecting the decision-making process known affectionately by the Air

Force as the OODA Loop (Observe Orient Decide and Act)14 By disrupting and corrupting

4

AUACSCSinksAY08

information processes military commanders can influence or usurp adversarial human and

automated decision making in the physical and informational dimensions

As stated by Lt Col Fahrenkreg the confusion between cyberspace and information

operations comes from the misunderstanding of cyberspace as an operation rather than a

domain15 Information operation is a capability available to the combatant commander to

generate an effect in one of the five domains It just so happens that cyberspace tends to be the

primary means of delivering the Information Operation capability

Cyberspace connects the physical dimensions with the cognitive process and is a means

to create effects to include disrupting degrading denying the enemy the use of strategic and

operational assets to include command and controls systems power plants telecommunications

and other like targets to affect a statersquos operational and strategic centers of gravity Cyberspace

isnrsquot information or the data residing on a computer but is the means in which users transfer

store or modify information Cyberspace isnrsquot the data sent to a precision guided munition but

the means in which the originator passes the information Cyberspace is the digital super

highway of the electromagnetic spectrum with the ones zeros and electrons as the passengers

Defining Cyber Warfare According to the Institute for Advanced Study of Information Warfare (ASIW) cyber

warfare has become a form of information warfare which ASIW defines as ldquothe offensive and

defensive use of information and information systems to deny exploit corrupt or destroy and

adversaryrsquos information information-based processes information systems and computer-based

networks while protecting onersquos own Such actions are designed to achieve advantages over

military adversariesrdquo16 While this definition doesnrsquot specifically address the electromagnetic

spectrum the definition focuses on information-sharing systems which is where crux of the

cyberspace domain revolves around

5

AUACSCSinksAY08

Joint doctrine defines cyber warfare as those areas of operations that affect the

electromagnetic spectrum to include Computer Network Operations and Electronic Warfare

which are two of the five core operational capabilities of Information Operations Electronic

warfare operations operates across ldquoradio visible micro directed energy and all other

frequenciesrdquo and overlaps with network warfare operations which include ldquoradio nets satellite

links tactical digital information links (TADIL) telemetry digital track files

telecommunications and wireless communication network and systemsrdquo all of which operate

within the electromagnetic spectrum17

Cyber warfare consists of defensive and offensive operations Defensive operations

arenrsquot limited to severing connections or blocking attempts of an adversary trying to corrupt data

modify transmissions or destroy information systems Defensive operations include the

elimination of the adversaryrsquos capability of conducting operations which may involve crossing

sovereign borders in order to complete the task However defensive network operations come in

more than just one form The movies portray computer experts hovering over computers trying

to affect each otherrsquos operations However cyber warfare includes the use of traditional kinetic

effect to disrupt computer network operations of the enemy as a fighter-bomber delivering a

500-pound bomb to destroy a vital mode in a computer network may serve the same purpose as a

computer-centric network attack While this isnrsquot as sexy as a network attack that spans the

globe to degrade the enemyrsquos ability operation within the cyberspace domain the effects are the

same

Territorial Sovereignty In total war it is quite impossible to draw any precise line between military and non-military problems18

~Sir Winston Churchill

6

AUACSCSinksAY08

Cyberspace is certainly a domain that requires unique attention in order for commanders

to effectively and efficiently prosecute combat operations Cyberspace spans the globe using

the physical infrastructure residing within the other linear domains As users pass information

from one site to another data crosses boundaries by means of the cyberspace domain Data

leaves the Iraq area of operation via satellite to a receiving site in Germany Operators route the

information to the United States either through another satellite or by ground to sea-based cables

bound for computer nodes within the United States before arriving in South Carolina where

automated network tools redirect the information to the receiverrsquos location

An adversary attempting to modify corrupt or destroy this information traveling within

the cyberspace domain would at one time or another would cross sovereign borders through air

land sea or space The adversaryrsquos physical presence may not apply as they could conduct

operations from the comforts of their home however a nation could detect the adversaryrsquos

digital presence and could feel the impact of their actions from within their sovereign borders

Therefore as these adversaries span the globe using the cyberspace domain that relies on the

other linear domains to exist does international law apply when boundaries are crossed The

following sections will address the international laws of each physical domain and evaluate how

their principles apply to the cyberspace domain

Airspace Airspace as defined by Doctor Boleslaw A Boczek the internationally renowned expert

on international law ldquois the air pillow above the subjacent territoryrdquo to include ldquoairspace above

international waters and the territorial seardquo The airspace is under complete and exclusive

sovereignty of the subject state19 With that states have jurisdiction over their airspace and

require identification of foreign aircraft along with their intentions According to Dr Boczek

book International Law A Dictionary ldquoentry of national spacehellipmay take place only with the

7

AUACSCSinksAY08

authorization of the territorial staterdquo20 and currently only applies to aircraft Entry into the

airspace would require ldquoall aircraft to identify themselves file flight plans and report their

positionrdquo According to the 1944 Chicago Convention on International Civil Aviation nations

can enter into agreements that allow scheduled international civil air services which usually

include reciprocal agreements covering routes volume and other matters relating to air traffic

However these agreements only apply to civil aviation where state aircraft which include

aircraft belonging to the military customs public services and heads of states must follow more

restrictive procedures upon entering the airspace of a foreign nation21

There are several incidents where states have evoked their right for defending their

national security like the shooting down of a US military reconnaissance aircraft over Soviet

airspace by the Soviet Union in 196022 or the shooting down by Soviet fighter planes of a South

Korean airliner in 198323 The Soviet Union isnrsquot the only nation to protect its airspace as the

United States was responsible for shooting down an Iranian airliner thought to be an attacking

military plane over the Persian Gulf in 198824 These examples illustrate a nationrsquos sovereign

resolve to protect itself when a suspected adversary violated their airspace

Applying international law of airspace to cyberspace doesnrsquot seem too practical Civilian

signals entering a nationrsquos airspace would require nations to enter into agreements to allow

scheduled services and the persons receiving information through airspace would have to be

non-state sponsored Nationrsquos could regulate some cyberspace networks entering airspace like

radio communications that primarily use land-based infrastructure to function However the

very nature of computer networks and the ever-increasing global reach of communication

capabilities severely restrict a nationrsquos ability to monitor the millions of transmissions made on a

daily basis and these signals certainly wouldnrsquot be on any scheduled basis Therefore even if

8

AUACSCSinksAY08

nations made agreements concerning the cyberspace domain nations would have a difficult time

enforcing their terms of agreements unless the terms are very open-ended If they were so open-

ended then the agreement may not be necessary and based on my research nations realize the

futility of establishing these agreements as this author couldnrsquot find any reference to any

agreements that nations have entered into referencing the cyberspace domain

While the international law for civilian aircraft in airspace may not relate well or isnrsquot

feasible to enforce in the cyberspace domain does a nation have that same right to protect itself

from a suspected attack from cyberspace where the attackerrsquos signal enters airspace Does a

nation have the right to ldquoshoot downrdquo a cyberspace attack as it enters their domain through

airspace The whole idea behind restricting airspace from foreign military aircraft is because of

the strategic impact military aircraft can have on a nation As demonstrated in World War II

military aircraft carrying weapons of mass destruction can decimate cities and destroy a nation

with minimal effort The effects generated by military aircraft are quite destructive and garner

specific attention While an aircraft in of itself is relatively harmless the actions taken by the

crew can lead to devastating results

The same is true for cyber attacks The information passing through airspace in the

cyberspace domain is the vehicle however the crew conducting the operation is potentially

creating the same strategic results The cyber attack may not destroy cities but it certainly can

be destructive to a nationrsquos well-being by crippling power sources economic industries water

supply etc all at the blink of an eye while the victim takes several days to determine the

perpetrator Therefore while the international law for airspace may not be specifically relevant

the underlying principles are applicable as cyber attacks can have the same potential strategic

impact as an attack from a military aircraft

9

AUACSCSinksAY08

Space Outer space as defined by Doctor Boczek ldquois the space beyond the air surrounding the

earthrdquo As of 2005 international law doesnrsquot define a demarcation between airspace and outer

space but ldquostates agree that state sovereignty doesnrsquot extend without any limitsrdquo25 Proposals of

where airspace ends and when outer space begins are base on various scientific and technological

criteria (gravitational pull capabilities of air breathing aircraft etc26) Others scientists argue

that defining a boundary between airspace and outer space isnrsquot necessary as it would hinder the

progress of space technology and the legal status would depend on the nature of the activity

While no boundary exists airspace is finite and activity in outer space follows four

fundamentals principles First over flights of foreign satellites over a nation is permissible as

airspace doesnrsquot extend forever Second space ldquointernational law applies to outer space and

celestial bodiesrdquo Third according to the Outer Space Treaty of 1967 states canrsquot claim celestial

bodies or outer space which are not subject to national appropriation therefore are free for use

by all states Finally states must use outer space exclusively for peaceful purposes with specific

bans on weapons of mass destruction However states can use space for other military purposes

like intelligence surveillance and reconnaissance activities 27

Are these international laws and principles applicable to cyberspace Satellites are

certainly an integral part of the space domain Operators control satellites by using the

cyberspace domain and information passes between satellites and ground stations One can

argue that space is a sub-set of the cyberspace domain with satellites serving as computers in

space Global positioning system devices in vehicles interact with satellites all through an

elaborate network as part of the electromagnetic spectrum known as cyberspace Therefore

cyberspace is in space with millions of people using cyberspace everyday

10

AUACSCSinksAY08

The military uses space assets for intelligence surveillance and reconnaissance

knowledge management and command and control Agencies like the National Reconnaissance

Office and National Geospatial-Intelligence Agency obtain high-altitude imagery using a variety

of capabilities to include heat signature resonation Satellites can detect missile launches which

provide vital military information to senior leaders tasked with the security of their nation The

military networks to include decision briefs tasks and emails in Iraq and the Predator feeds in

Afghanistan travel through military and commercial satellites with all the information flowing

through the cyberspace domain With the heavy reliance of cyberspace to operate space assets

and the demands of information flowing through space by businesses it should come as no

surprise that space is a vital component for day-to-day operations of the military

Since cyberspace is an inherent component for space operations it is logical to assume

international law for outer space is applicable to cyberspace as long as an aggressor doesnt

violate the four premises and as long as weapons of mass destruction arenrsquot ldquostationed in outer

spacerdquo 28 Therefore a state would consider a cyber attack against a satellite as other than for

peaceful purposes and according to the fourth premise international law would apply

However what about a cyber attack using satellites as a means of conducting operations

Under todayrsquos current operations international elites havenrsquot considered a cyber attack passing

through space as a violation of international law When a senior leader in Qatar approves a

target set that is executed by a pilot in Nevada by an aircraft in Afghanistan all this information

is transmitted by cyberspace through space The result is that an aircraft renders an air or ground

target inoperable The effect is the same for cyberspace The information flows through space

by way of the cyberspace domain and the result is that an operator has rendered a target

11

AUACSCSinksAY08

inoperable As with airspace the information isnrsquot the cause of the damage but what an operator

does with the information is what constitutes the cyber attack

Land Cyber attacks using resources over land is relatively straightforward International

boundaries are defined as ldquoimaginary lines which separate territorial sovereigntyrdquo 29 which are

mutually agreed upon via international treaties Crossing an international border without

permission from the state is a violation of international law While an illegal immigrant crossing

a border to seek an opportunity to provide for his family is a violation of national law the United

Nation considers a nation-sponsored invasion of another nation that threatens the security and

stability of a nation as a breach in international law and an act of war

However international law doesnrsquot consider all border crossings as an act of war For

example when Nicaraguan troops and arms allegedly crossed the borders of El Salvador the

United Nations determined that incursions didnrsquot threaten El Salvadorrsquos territorial integrity and

stated that neither ldquothese incursions nor the alleged supply of arms may be relied upon as

justifying the exercise of the right of collective self-defenserdquo30 The victim state can repelled the

aggressive act but the United Nations Council wouldnrsquot condone any further military action

taken against the adversary opting for diplomatic or economic solution instead

Does international law apply when an adversary crosses international borders using

cyberspace as the means for conducting warfare operations When an adversarial state crosses a

statersquos boundaries using roads or bridges that connect the two nations the road is the resource

spanning the two nations If the adversary doesnrsquot do anything then returns to their sovereign

borders the aggressor hasnrsquot violated international law However when the adversary uses

weapon systems to affect serious damage the adversary has broken international law and a

12

AUACSCSinksAY08

nation may invoke their right for self-defense and may conduct full-scale operations to neutralize

the threat

A parallel notion is when an adversary uses a copper or fiber optic connection that spans

between two nations The adversary uses the land-based LAN connection as a means for

conducting cyber warfare operations The adversary may cross the borders using cyberspace yet

do nothing The affected state may push the adversary back to its borders but no further actions

are deemed appropriate However once the adversary uses the information transmitted over

cyberspace to cause severe operational or strategic damage the affected state now has the right

of self-defense Cyberspace is the means like the road or bridge for which the adversary

delivered the weapon The affected nation will consider the execution of the adversaryrsquos

information packet or weapon system as an act of aggression and the effect caused by the

weapon is what breeches international law

The difference between these two scenarios is that the adversary using the

electromagnetic spectrum hasnrsquot physically invaded a nationrsquos sovereign borders However

their digital presence crossed sovereign borders and as latter discussed in the paper adversaries

committing an act aggression against a state are now under the jurisdiction of the affected state

Sea ldquoThe territorial sea is a belt of sea adjacent to the (statersquos) coasthellipto include the airspace

aboverdquo as well as the seabed and subsoil31 The territorial sea is subject to the right of innocent

passage by foreign shops giving states the right to transport goods and passengers between ports

All of which is subject to the full sovereignty of the state which according to the United Nations

Convention on the Law of the Sea in 1982 and agreed upon by the majority of its membership in

1982 extends 12 miles from the coast32 The jurisdiction includes crimes where the

consequences extend to the coastal state and disturbs the peace of the country33 A cyber attack

13

AUACSCSinksAY08

conducted within the territorial sea of a nation would be no different from a cyber attack

conducted from within the nationrsquos land borders therefore cyber attacks against a state or even

another state conducted within the territorial seas are subject to current international laws Cyber

attacks originating outside the statersquos sovereign borders but results in affecting a statersquos

resources in their territorial seas would fall under the land and airspace breeches of territorial

sovereignty and would be subject to international law

The high seas on the other hand arenrsquot subject to the sovereignty of any one state The

high seas extend beyond the territorial sea and include the airspace the seabed and the subsoil34

and all states have the right to exercise freedoms on the high seas35 As similarly defined in

space ldquothe high seas shall be reserved for peaceful purposesrdquo as stated by Article 88 of the Law

of the Seas Cooperative36 which is defined as refraining from any threat or use of force (outside

of wartime conflicts)

The very nature of a cyber attack in the high seas lends itself to be a violation of

international law as nations are restricted to conducting peaceful operations in the high seas

The question is whom has jurisdiction of crimes committed in the high seas By applying the

Protective Security Principle of Jurisdiction where an actor threatens a statersquo security and

introducing the United Nationrsquos definition on the Illegal Use of Force extends to the high seas

and for that matter space giving states the right for self-defense as defined by the United Nations

as ldquoan armed attackrdquo The sheer name of cyber attack doesnrsquot immediately lend itself to an

ldquoarmedrdquo cyber attack However the effects generated from a cyber attack can be equivalent to a

traditional conventional attack and the international law would permit a state to take appropriate

countermeasures while notifying the United Nations Security Council37

14

AUACSCSinksAY08

Applying International Law to Cyber Warfare Today we live in an Information Age where communication through cyberspace has forever changed and flattened out worldhellipOur adversaries seek to operate from behind technical legal and international screens as they execute their costly attacks38

~General James E Cartwright Commander United States Strategic Command

Jurisdiction

Understanding the territorial sovereignty principles of a nation is important in applying

cyberspace and cyber warfare to existing international laws While some of these principles and

international laws may not be relevant for the cyberspace domain due to the far-reaching

capability of cyber warfare the jurisdiction of a nation further defines its ability to respond to

aggressive acts by nations in the cyberspace domain There are three jurisdictional principles

that provide nations the right to pursue aggressors that threaten a nationrsquos independence the

Territorial Principle Nationality Principle and the Protective Security Principle

For actions originating within the state the jurisdiction clearly falls within the territorial

principle where a ldquostate has jurisdiction over all crimes committed in its territoryhellipto include

airspace international waters and territorial seasrdquo39 The territorial jurisdiction is subject to

exceptions when dealing with persons from foreign states as in the most popular example of

immunity given to foreign diplomats In this case ldquostates may exercise jurisdiction over its

citizenhellipeven if they are physically outside the statesrsquo territoryrdquo as Doctor Boczek defines as the

Nationality Principle Nations usually agree upon on these concessions states prior to the offense

being committed40

Doctor Boczek defines the Protective Security Principle as a ldquojurisdictional principle

whereby a state my assume jurisdiction over and punish foreign nationals for certain conduct

outside its territory which is directed against its security territorial integrity and political

independencerdquo41 Some states would argue that criticism of a state or government is applicable

15

AUACSCSinksAY08

in applying this principle of jurisdiction However this is too broad of an interpretation and

should be confined to acts that are more tangible in nature like falsification of a statesrsquo official

documents conspiracy to violate immigration of custom laws and illicit drug trafficking42

Would a cyber attack that is deemed to challenge a nationrsquos banking community or bring

down a power source be a direct attack against its security and political independence The

international community easily sees the attack of a power source with kinetic weapons as a

violation of a territorial boundary and a breech of international law The United States viewed

the attack on the Trade Towers as an act of war launching the Global War on Terrorism Would

the United States have viewed the same devastation as if the attack occurred through cyberspace

Would the attack have been less of an act of war if the aggressor remotely controlled domestic

airliners from a foreign country Probably not What happens if the cyber attack caused a fire in

the lower floors of the buildings preventing people from escaping While less dramatic than an

airbus flying into the middle of the towers and maybe more difficult to demonize the crime the

result is the samemdashinnocent people suffering as a result of an adversary trying to threaten a

nationrsquos security

What happens if the suspected cyber attack has violated a nationrsquos territorial boundary in

order to attack a neighboring country or an ally Going from point A to point B in cyberspace is

rarely a direct connection As with the global nature of cyberspace itrsquos conceivable that

adversaries cross several nationsrsquo boundaries to conduct cyber attack operations The question

generated is who has jurisdiction

If the actor committing the crime had used an airplane each nation could claim

jurisdiction as the adversary violated their territorial boundaries and violated international law

More often than not the first state would have acted immediately upon the aggressive act and

16

AUACSCSinksAY08

would have prevented aggressors from completing their task by either forcing the aircraft to land

or turnaround or an even more escalated response of firing upon the aircraft In the air land or

sea the ability for a nationrsquos military forces to respond in a timely manner gives way to the

deterrence factor of not crossing a statersquos boundaries without receiving permission for fear of

reprisal A clear example of this was when Turkey denied the United States the ability deploy

the 4th Infantry Division from its borders at the beginning of Operation Iraqi Freedom Violating

Turkeyrsquos borders without permission would have brought about great repercussions that would

have made Operation Iraqi Freedom even more difficult and could have resulted in an escalation

of the war outside the Iraqi borders43 Another example is when Spain and France denied the

Unites States the use of their airspace when F-111s based in the United Kingdom conducted air

operations in Libya in an effort to eliminate Muammar Khadafy44

However the speeds at which these breeches in territorial boundaries occur make it

difficult for a nation to claim jurisdiction especially when nothing occurred within their

territorial sovereignty The cyber attacks didnrsquot result in any damage to nation as the information

packets passed through their sovereign borders According to territorial boundary description

described by Doctor Boczek the international community doesnrsquot consider the crossing the

border in of itself an act of warmdashserious damage is a driving factor in determining conflict

escalation In addition according to the territorial jurisdiction principle the cyber attack didnrsquot

threaten a nationrsquos security territorial integrity and political independence If the cyber attack or

information originated from within a sovereign territory by a third party then the two nations

would have to work together to resolve the issue and mutual jurisdiction would probably apply

However if the cyber attack didnrsquot physically manifest itself from within their sovereign

territory or the adversary didnrsquot use the nation as a staging area to launch a further attack the

17

AUACSCSinksAY08

international law and the jurisdiction principles would dictate the affected nation would have

jurisdiction

Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security

territorial integrity and political independence Cyberspace utilizes the other domains as a means

of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence

Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of

territorial sovereignty the Protective Security Principle does provide nations the ability to

enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos

sovereignty when it conducts cyber warfare operations However some elites donrsquot consider

cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense

International law specifically article 2 of the United Nations Charters states that a

members shall refrain in their international relations from the threat or use of force against the

territorial integrity or political independence of any state or in any other manner inconsistent

with the purposes of the United Nations which is intended to prohibit all types of force except

those carried out under the aegis of the United Nations or as provided for by the Security

Council45 The only exception to the United Nations Charters as it relates to the Use of Force is

the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed

attack46

International elites have discussed the term ldquouse of forcerdquo in the past because of the

development of chemical and biological weapons and had to move from a kinetic impact based

definition to a results-oriented approach47 Chemical and biological weapons lacked the

characteristic of an explosion or physical force yet these weapons certainly are capable of

destroying life and property Doctor Leigh Armistead a former information warfare instructor at

18

AUACSCSinksAY08

the Joint Forces Staff College cautions that the use of computer network attacks by the military

ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary

that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great

Russia introduced a proposal to the United Nations that banned the use of information

operations Even though the United Nations didnrsquot adopt the law the concern of international

community is fully aware of the impact cyber attacks can have on a nation

The concern over cyber warfare capabilities is that it can generate both non-kinetic and

kinetic effects There has always been the traditional kinetic solution for cyber warfare where a

precision guidance munition destroys a critical information system node Most people assume

computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos

computer system from the safety of onersquos own command and control center but the physical

destruction of a computer system or network by kinetic means also qualifies as cyber warfare

However cyber warfare has also evolved to the point where aggressors can achieve a kinetic

effect without the use of a traditional kinetic weapon A cyber attack on an information system

can shut down a particular node of a power plant causing the system to become inoperative

Even if there wasnrsquot an explosion the attack serves the same purpose

The question raised is do cyber attacks constitute an armed attack Scholars do agree that

some cyber attacks fit comfortably within the United Nations Charter For example a strategic

level cyber attack causing widespread damage and significant casualties would trigger the statersquos

right of self-defense In addition a cyber attack that precluded a conventional attack or a series

of cyber attacks causing significant damage would give a state the right of self-defense49 Few

would dispute that a country has the right under international law to respond with military force

19

AUACSCSinksAY08

if a state destroyed or significantly damaged another nationrsquos economic system for example the

New York or London stock exchanges

However some confusion and state-defined interpretation comes into play when the

frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard

Law School argues that cyber attacks require an expansion of the definition on the ldquouse of

forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot

be prohibited by international law50 International scholars recommend ldquoclearer rules of what

kinds of information warfare actions constitute an armed attackrdquo which drives permissible

responses of self-defense51 For example a state-sponsored cyber attack causes damage to a

victimrsquos factory or power plant however the nation claims the incident is an isolated instance

and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under

the United Nations Charter and the United Nations would consider any response retaliation

which would violate international law52

Another example involves a nation conducting a series of small attacks causing minimal

damage and then ceases Even though the aggressor used force to conduct cyber warfare

operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under

the United Nations Charter This type of attack is analogues to a small band of troops crossing a

border without causing significant damage53 According to the United Nations Charter the

national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders

and respond to the use of force Repelling the small band of troops and reestablishing their

sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration

of war and allies would have to respect the United Nations decision and couldnrsquot intervene The

same is true for the cyber attack A state can employ defensive measure to isolate and defeat the

20

AUACSCSinksAY08

incursion over the electromagnetic spectrum However the United Nations would see further

offensive operations or invasive operations as retaliation Therefore a nation must take the

incident whether it is signs of conventional forces on the ground or traces of cyber warfare

incursions in the electromagnetic spectrum to the United Nations to seek restitution

In both of these situations the international law becomes the target for change not

whether cyber warfare is in violation of international law If the law were to change the

international community would then consider the above situations acts of war even if an

adversary used conventional forces As written today the result of an operation remains the

driving factor in determining if an adversary has violated international law The means by which

an adversary conducts military operations may affect how nations react to the situation but

whether an adversary conducts the operation by means of the air land sea space or cyberspace

doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian

Triggs a public international lawyer and member of the Attorney General International Legal

Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over

offences abroad having an intended and substantial effect within a state may be justifiedrdquo54

Therefore the international community must evaluate the effect of a criminal act rather than the

means in which the act was committed

Others claim that because the Internet takes advantages of legal norms where non-state

actors can ignore Western notions of law55 more international laws are needed for cyberspace

However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using

other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the

Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked

aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts

21

AUACSCSinksAY08

against a staterdquo in the cyberspace domain The anonymity of the Internet and their total

disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and

national laws already exist in most countries that prohibit the use of the Internet for terrorist

activities therefore additional international laws wouldnrsquot prevent or deter terrorist from

committing such acts of aggression

International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed

Conflict includes the Martens Clause which extends established custom and humanitarian

principles to new technologies and addresses the ever-changing nature of warfare The

international community designed The Martens Clause ldquoto prevent future unnecessary andor

disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges

crimes by invoking the laws of humanity and public conscience hence their effects and not its

methods

The basic legal premise behind Law of Armed Conflict is that attacks must be limited to

military objectives and collateral damage must be proportionate to military advantages and

forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary

suffering but military commanders and planners need to be aware of the results a particular

action will invoke Russian leadership believes a computer network attack against their

homeland can be a means for executing a variety of escalating responses to include nuclear

attack58 Therefore it is imperative military commanders understand the impact any weapon

system can have on an adversary not just cyber attacks

Not all scholars agree that international law is insufficient to govern cyber warfare

Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace

and the Use of Force states that computer network attacks constitute an unlawful use of force in

22

AUACSCSinksAY08

cyberspace under traditional international law Sharp declared that an armed attack may occur

ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a

way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive

definition of cyber attacks may never be drafted59 The Congressional Research Service also

concluded that ldquothere is little likelihood that the international community will soon generate a

coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations

on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos

conclusion is that the effects of cyber warfare operations are the same as if an adversary

conducted conventional warfare operations where the effect of the attacks are the driving factors

in determining whether an adversary used force or not

The United States Government agrees with Sharprsquos conclusion The offensive

Information Operation strategy for the United States government as described by Doctor

Armistead ties the tools used to conduct military operations back to the desired effect which is

in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning

effects-based operations and operational art focus the Joint Force Commanderrsquos course of action

towards meeting objectives outlined in guidance provided by the National Command Authority

and senior military leadership62 Whether the tools are dropped pamphlets invasive network

attacks or bombs on targets the goal is to produce a desired effect to achieve the overall

objectives and cyber warfare can produce effects that challenge the national security of a nation

Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63

~General T Michael Moseley USAF

23

AUACSCSinksAY08

The cyberspace domain has been around for quite sometime but as technology continues

to advance businesses as well as governmental organizations are becoming more reliant on the

cyberspace domain With that reliance the protection of this critical domain becomes even more

important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the

electromagnetic spectrum by denying and disrupting information demands Scholars claim that

protection needs to include addressing existing international laws expanding them to incorporate

the ever-advancing capabilities emerging in the cyberspace domain

However territorial sovereignty of a nation and the principles of jurisdiction specifically

the Protective Security Principle give nations the right to exercise jurisdiction when an

aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64

While cyberspace is a domain requiring specific attention it relies on assets in the other domains

of land space sea and air in order to operate and international laws for the linear domains do

exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace

but during cyber warfare operations the principles behind the restrictions of foreign military

entering airspace do apply The strategic nature of cyber warfare operations correspond to the

same strategic impact that airpower can inflict upon a nation threatening their independence

While maybe not as dramatic as kinetic effects the results can be just as devastating

Space is relatively straightforward Since a nation canrsquot claim space and over flights of

foreign satellites over a nation is permissible nations must use space for peaceful purposes

Kinetic attacks against space assets are a violation of international law therefore nations would

consider cyber warfare operations against space assets as other than peaceful purposes and a

violation of international law Cyber attacks traversing space assets relate to current military

operations where the military uses space assets to conduct kinetic operations Since international

24

AUACSCSinksAY08

elites havenrsquot considered these kinetic operations as a breach of international law military

commanders can conduct cyber warfare operations through space without fear of violating

international laws for outer space

Crossing international borders without a nationrsquos permission and threatening their

sovereignty is a violation of international law While nations canrsquot consider all border crossings

as an act of war those acts of aggression that threaten the territorial integrity would elicit a

defensive response by the victim nation Whether incursions involve combat vehicles over a

highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are

threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not

have set foot in the nation but according the Protective Security Principle the victim nation has

jurisdiction

Conducting cyber warfare operations from the territorial sea is no different from

conducting operations from within a nationrsquos land or sea borders However the high seas are

very similar in nature to space in that they are reserved for peaceful purposes Therefore

conducting any means of warfare from within the high seas is a violation of international law

and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-

defense

According to Barkham ldquoinformation warfare attacks are in essence territorial

penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then

subject to the jurisdiction of the victim nation who then has the right for self-defense However

due to the global nature of cyberspace aggressors can cross multiple borders and determining

who has jurisdiction demands cooperation among nations The origin and any deliberate staging

locations of the cyber attack will drive who has jurisdiction The crossing of third party borders

25

AUACSCSinksAY08

by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the

aggressors threaten a nationrsquos independence or territorial integrity

Scholars consider cyber warfare operations that involve strategic and operational impacts

as being a means of using force and fall within the legal regime of existing international law

However scholars argue that because cyber warfare includes kinetic and non-kinetic results the

Use of Force definition needs expanding Yet they conclude that an exhaustive definition of

cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare

operations against existing case studies where the effects are evaluated as opposed to the means

even if the operations originated from outside the nationrsquos territorial jurisdiction There is some

authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to

have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade

non-state actors from conducting cyber warfare operations given their willingness to ignore

Western notions of war and their ability to conduct operations anonymously in cyberspace

International laws are in place to that address the ever-changing nature of warfare The

Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a

framework for addressing all warfare to include cyber warfare operations The international

community will need to measure the effects of an operation rather the means Whether its boots

on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a

nationrsquos response

26

AUACSCSinksAY08

End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)

27

AUACSCSinksAY08

44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

28

AUACSCSinksAY08

Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005

Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department

American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)

Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983

Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988

Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)

Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)

IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)

Joint Publication 3-13 Information Operations 13 February 2006

Joint Publication 5-0 Joint Operations Planning 26 December 2006

Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies

Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc

Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College

Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)

Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press

29

AUACSCSinksAY08

Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI

Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)

Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press

Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company

Detter Delupis I The law of war (2000) New York NY Cambridge University Press

Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)

Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College

Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor

Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)

Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)

Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf

Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)

Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College

Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College

Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)

Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA

30

AUACSCSinksAY08

Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)

Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)

Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College

Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology

Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College

Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)

OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center

OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College

OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications

Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991

Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College

Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center

Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)

31

AUACSCSinksAY08

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press

Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA

Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University

Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor

Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661

Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office

Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis

United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC

United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center

Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College

Wesley David C The Military Commander and the Law 2006

32

Page 3: Sinks 0407

AUACSCSinksAY08

Abstract

In land sea and air battles military combatants can see the enemy coming whether itrsquos

the whites of their eyes or a blip on a screen International boundaries easily define when an

aggressor threatens the sovereignty of a nation giving the victim nation the right of jurisdiction

and there are specific international laws that address military operations in space In addition

the international community has defined when an adversaryrsquos use of force threatens a nationrsquos

territorial integrity and political independence

However the global nature of cyberspace and the speed of which victims can experience

cyber attacks force nations to deal with the legal challenges associated with over-the-horizon

military operations Jurisdiction over a cyber attack compounds the legal issues surrounding an

aggressive act that can have a wide-range of effects In addition nations face a very difficult

task in attributing an aggressive act to a particular actor and responding to asymmetric

techniques in cyberspace presents nations with an even more challenging and complicated issue

particularly in the legal regime

Cyberspace relies heavily on the other physical domains to operate and international laws

exist that govern the physical domains or air land sea and space The far-reaching nature of

cyberspace generates jurisdiction challenges that arenrsquot associated with the other domains but

the jurisdiction principles can apply to cyber warfare While scholars argue about the definition

of the Use of Force cyber warfare can have strategic and operational impacts that fall neatly

within existing definitions Finally international committees and oversight organizations have

generated legal precedents that apply to cyber warfare operations Therefore while cyberspace

is its own domain and there are unique demands placed on nations by cyber warfare existing

international laws and definitions are applicable to cyber warfare

iii

AUACSCSinksAY08

Table of Contents

DISCLAIMER II

ABSTRACT III

TABLE OF CONTENTS IV

INTRODUCTION 1

WHAT IS CYBER WARFARE 3 Defining Cyberspace 3 What Cyberspace is Not 4 Defining Cyber Warfare 5

TERRITORIAL SOVEREIGNTY 6 Airspace 7 Space 10 Land 12 Sea 13

APPLYING INTERNATIONAL LAW TO CYBER WARFARE 15 Jurisdiction 15 Use of Force 18 International Laws 22

CONCLUSION 23

END NOTES 27

BIBLIOGRAPHY 29

iv

AUACSCSinksAY08

Introduction We need to be able to think in terms of target effects I picture myself around that same targeting table where you have the fighter pilot the bomber pilot the special operations people and the information warrior As you go down the target list each one takes a turn raising his or her hand saying ldquoI can take that targetrdquo1

~ General (Retired) John P Jumper

The worldrsquos growing reliance on information technology to improve efficiency has

opened a threat to all who become reliant on cyberspace to conduct operationshellipa threat that has

many sources of predators ranging from pranksters to white-collar criminals to terrorists Yet

cyberspace has limited international laws to govern a worldwide domain that is ever expanding

as third world nations begin to invest in information technology and enter the cyberspace realm

to enhance business and military operations As nations begin to rely more on cyberspace as an

effective means of conducting business and military operations the more these operations will

become susceptible to outside aggressive influences whether itrsquos from economic invasions or

disruption of military operations

In addition the threat of military operations in the cyberspace domain is real The

Russian military has incorporated cyber warfare into their doctrine in order to gain information

advantage by affecting an adversaryrsquos information system decision-making processes command

and control and even the populace2 China is pursuing a battalion-sized force of computer

experts trained ldquoto carry out computer network attacks as a means of seeking asymmetrical

advantages over an adversaryrdquo3 The threat doesnrsquot reside just within state actors non-state

actors are incorporating cyber warfare operations into their realm of capabilities Hezbollah has

outlined a strategy to cripple the Israeli government by disrupting normal economic and societal

operations by targeting official websites crashing financial sites knocking out the internet

servers and targeting e-commerce sites4

In land sea and air battles military combatants can see the enemy coming whether itrsquos

1

AUACSCSinksAY08

the whites of their eyes or a blip on a screen International boundaries easily define when an

aggressor threatens the sovereignty of a nation giving the victim nation the right of jurisdiction

and there are specific international laws that address military operations in space In addition

the international community has defined when an adversaryrsquos use of force threatens a nationrsquos

territorial integrity and political independence

However the global nature of cyberspace and the speed of which victims can experience

cyber attacks force nations to deal with the legal challenges associated with over-the-horizon

military operations as commanders can experience battlefield affects with little or no warning

Moreover cyber attacks are much more difficult to define Jurisdiction over a cyber attack that

occurs 7000 miles away that crosses multiple physical domains and spans several international

borders compounds the legal issues surrounding an aggressive act that can have a wide-range of

effects Add the fact that determining the perpetrator proves to be less than speedy as most

cyber warriors can use the Internet ldquoanonymously or as a shell game to hide identitiesrdquo5 nations

face a very difficult task in attributing an aggressive act to a particular actor Responding to

asymmetric techniques tactics and procedures by state and non-state actors have proven to be

difficult for conventional forces Introducing asymmetric tactics in cyberspace presents nations

an even more challenging and complicated issue particularly in the legal regime

Therefore this paper will analyze the need for international guidance for conducting warfare

operations in the cyberspace domain This paper will define cyberspace and cyber warfare in an

effort to set the stage for illustrating the global nature of cyberspace and its reliance on the other

physical domains to conduct military operations The paper will define the international law as it

relates to territorial boundaries and outline the jurisdiction principles that allow a nation to act

against an adversary This paper outlines the definition of the Use of Force and how it

2

AUACSCSinksAY08

corresponds to the cyberspace domain and cyber warfare and with the final discussion centered

on the international laws that already exist which help shape international law for cyberspace

What is Cyber Warfare Very few of the new manifestations in war can be ascribed to new inventions or new departures in ideas6

~Carl Von Clausewitz

Defining Cyberspace William Gibson coined the term ldquocyberspacerdquo in his 1984 novel Neuromancer in order to

describe ldquoa shared virtual environment whose inhabitants objects and spaces comprise data that

is visualized heard and touchedrdquo7 However the most common of definitions today refer to the

Internet or the World Wide Web and usually consists of an information-sharing environment

between computers8 However the military has defined cyberspace to advocate a worldwide

spectrum of more than just information sharing among computers

In the National Military Strategy for Cyberspace Operations cyberspace is defined as a

domain characterized by the use of electronics and the electromagnetic spectrum to store

modify and exchange data via networked systems and associated physical infrastructure9 Joint

doctrine has adopted a computer-centric definition where cyberspace is ldquothe notional

environment in which digitized information is communicated over networksrdquo10 The National

Military Strategy and joint doctrine definitions advocate a worldwide information environment

that isnrsquot limited to the Internet or to just computers Matter of fact the expanded definitions

suggest that cyberspace consists of all networks to include highly sensitive military

governmental and commercial networks that may or may not use commercial means to store

modify and exchange data These systems include exchange networks like tactical digital

information links (TADIL) links between command and control platforms and air ground and

sea weapon systems In addition because the definition includes the electromagnetic spectrum

3

AUACSCSinksAY08

cyberspace includes ldquocapabilities that are currently considered electronic warfarerdquo11 which Great

Britain exploited in World War II when they introduced radar technology in World War II and is

still applicable with communication and navigational jamming capabilities used in todayrsquos

conflicts

While cyberspace is a unique domain that military commanders must protect in order to

conduct operations more effectively and offers commanders another dimension in which to

exploit weaknesses in an adversaryrsquos ability to project power cyberspace doesnrsquot exist on its

own According to Lt Col Fahrenkreg in the published Air University article title Cyberspace

Define ldquocyberspace exists across the other domains of air land sea and spacerdquo12 There are

clear delineations between the sea land and air Commanders know where the land ends and the

sea begins While there are some discussions as to where airspace ends and space begins the

capabilities and roles associated with each domain are clear Therefore to depict cyberspace as

an autonomous domain is unrealistic as the physical infrastructure of cyberspace and the means

of sharing information within the cyberspace domain resides in one or more of the four linear

domains

What Cyberspace is Not The most confused notion about cyberspace is that information operations and

cyberspace are one in the same Joint Publication 3-13 Information Operations describes the

information environment as a collection of leaders decision makers and systems that process

collect disseminate or act on information consisting of three dimensions the physical

informational and cognitive dimensions13 The goal of information operations is to influence the

cognitive dimension by affecting the decision-making process known affectionately by the Air

Force as the OODA Loop (Observe Orient Decide and Act)14 By disrupting and corrupting

4

AUACSCSinksAY08

information processes military commanders can influence or usurp adversarial human and

automated decision making in the physical and informational dimensions

As stated by Lt Col Fahrenkreg the confusion between cyberspace and information

operations comes from the misunderstanding of cyberspace as an operation rather than a

domain15 Information operation is a capability available to the combatant commander to

generate an effect in one of the five domains It just so happens that cyberspace tends to be the

primary means of delivering the Information Operation capability

Cyberspace connects the physical dimensions with the cognitive process and is a means

to create effects to include disrupting degrading denying the enemy the use of strategic and

operational assets to include command and controls systems power plants telecommunications

and other like targets to affect a statersquos operational and strategic centers of gravity Cyberspace

isnrsquot information or the data residing on a computer but is the means in which users transfer

store or modify information Cyberspace isnrsquot the data sent to a precision guided munition but

the means in which the originator passes the information Cyberspace is the digital super

highway of the electromagnetic spectrum with the ones zeros and electrons as the passengers

Defining Cyber Warfare According to the Institute for Advanced Study of Information Warfare (ASIW) cyber

warfare has become a form of information warfare which ASIW defines as ldquothe offensive and

defensive use of information and information systems to deny exploit corrupt or destroy and

adversaryrsquos information information-based processes information systems and computer-based

networks while protecting onersquos own Such actions are designed to achieve advantages over

military adversariesrdquo16 While this definition doesnrsquot specifically address the electromagnetic

spectrum the definition focuses on information-sharing systems which is where crux of the

cyberspace domain revolves around

5

AUACSCSinksAY08

Joint doctrine defines cyber warfare as those areas of operations that affect the

electromagnetic spectrum to include Computer Network Operations and Electronic Warfare

which are two of the five core operational capabilities of Information Operations Electronic

warfare operations operates across ldquoradio visible micro directed energy and all other

frequenciesrdquo and overlaps with network warfare operations which include ldquoradio nets satellite

links tactical digital information links (TADIL) telemetry digital track files

telecommunications and wireless communication network and systemsrdquo all of which operate

within the electromagnetic spectrum17

Cyber warfare consists of defensive and offensive operations Defensive operations

arenrsquot limited to severing connections or blocking attempts of an adversary trying to corrupt data

modify transmissions or destroy information systems Defensive operations include the

elimination of the adversaryrsquos capability of conducting operations which may involve crossing

sovereign borders in order to complete the task However defensive network operations come in

more than just one form The movies portray computer experts hovering over computers trying

to affect each otherrsquos operations However cyber warfare includes the use of traditional kinetic

effect to disrupt computer network operations of the enemy as a fighter-bomber delivering a

500-pound bomb to destroy a vital mode in a computer network may serve the same purpose as a

computer-centric network attack While this isnrsquot as sexy as a network attack that spans the

globe to degrade the enemyrsquos ability operation within the cyberspace domain the effects are the

same

Territorial Sovereignty In total war it is quite impossible to draw any precise line between military and non-military problems18

~Sir Winston Churchill

6

AUACSCSinksAY08

Cyberspace is certainly a domain that requires unique attention in order for commanders

to effectively and efficiently prosecute combat operations Cyberspace spans the globe using

the physical infrastructure residing within the other linear domains As users pass information

from one site to another data crosses boundaries by means of the cyberspace domain Data

leaves the Iraq area of operation via satellite to a receiving site in Germany Operators route the

information to the United States either through another satellite or by ground to sea-based cables

bound for computer nodes within the United States before arriving in South Carolina where

automated network tools redirect the information to the receiverrsquos location

An adversary attempting to modify corrupt or destroy this information traveling within

the cyberspace domain would at one time or another would cross sovereign borders through air

land sea or space The adversaryrsquos physical presence may not apply as they could conduct

operations from the comforts of their home however a nation could detect the adversaryrsquos

digital presence and could feel the impact of their actions from within their sovereign borders

Therefore as these adversaries span the globe using the cyberspace domain that relies on the

other linear domains to exist does international law apply when boundaries are crossed The

following sections will address the international laws of each physical domain and evaluate how

their principles apply to the cyberspace domain

Airspace Airspace as defined by Doctor Boleslaw A Boczek the internationally renowned expert

on international law ldquois the air pillow above the subjacent territoryrdquo to include ldquoairspace above

international waters and the territorial seardquo The airspace is under complete and exclusive

sovereignty of the subject state19 With that states have jurisdiction over their airspace and

require identification of foreign aircraft along with their intentions According to Dr Boczek

book International Law A Dictionary ldquoentry of national spacehellipmay take place only with the

7

AUACSCSinksAY08

authorization of the territorial staterdquo20 and currently only applies to aircraft Entry into the

airspace would require ldquoall aircraft to identify themselves file flight plans and report their

positionrdquo According to the 1944 Chicago Convention on International Civil Aviation nations

can enter into agreements that allow scheduled international civil air services which usually

include reciprocal agreements covering routes volume and other matters relating to air traffic

However these agreements only apply to civil aviation where state aircraft which include

aircraft belonging to the military customs public services and heads of states must follow more

restrictive procedures upon entering the airspace of a foreign nation21

There are several incidents where states have evoked their right for defending their

national security like the shooting down of a US military reconnaissance aircraft over Soviet

airspace by the Soviet Union in 196022 or the shooting down by Soviet fighter planes of a South

Korean airliner in 198323 The Soviet Union isnrsquot the only nation to protect its airspace as the

United States was responsible for shooting down an Iranian airliner thought to be an attacking

military plane over the Persian Gulf in 198824 These examples illustrate a nationrsquos sovereign

resolve to protect itself when a suspected adversary violated their airspace

Applying international law of airspace to cyberspace doesnrsquot seem too practical Civilian

signals entering a nationrsquos airspace would require nations to enter into agreements to allow

scheduled services and the persons receiving information through airspace would have to be

non-state sponsored Nationrsquos could regulate some cyberspace networks entering airspace like

radio communications that primarily use land-based infrastructure to function However the

very nature of computer networks and the ever-increasing global reach of communication

capabilities severely restrict a nationrsquos ability to monitor the millions of transmissions made on a

daily basis and these signals certainly wouldnrsquot be on any scheduled basis Therefore even if

8

AUACSCSinksAY08

nations made agreements concerning the cyberspace domain nations would have a difficult time

enforcing their terms of agreements unless the terms are very open-ended If they were so open-

ended then the agreement may not be necessary and based on my research nations realize the

futility of establishing these agreements as this author couldnrsquot find any reference to any

agreements that nations have entered into referencing the cyberspace domain

While the international law for civilian aircraft in airspace may not relate well or isnrsquot

feasible to enforce in the cyberspace domain does a nation have that same right to protect itself

from a suspected attack from cyberspace where the attackerrsquos signal enters airspace Does a

nation have the right to ldquoshoot downrdquo a cyberspace attack as it enters their domain through

airspace The whole idea behind restricting airspace from foreign military aircraft is because of

the strategic impact military aircraft can have on a nation As demonstrated in World War II

military aircraft carrying weapons of mass destruction can decimate cities and destroy a nation

with minimal effort The effects generated by military aircraft are quite destructive and garner

specific attention While an aircraft in of itself is relatively harmless the actions taken by the

crew can lead to devastating results

The same is true for cyber attacks The information passing through airspace in the

cyberspace domain is the vehicle however the crew conducting the operation is potentially

creating the same strategic results The cyber attack may not destroy cities but it certainly can

be destructive to a nationrsquos well-being by crippling power sources economic industries water

supply etc all at the blink of an eye while the victim takes several days to determine the

perpetrator Therefore while the international law for airspace may not be specifically relevant

the underlying principles are applicable as cyber attacks can have the same potential strategic

impact as an attack from a military aircraft

9

AUACSCSinksAY08

Space Outer space as defined by Doctor Boczek ldquois the space beyond the air surrounding the

earthrdquo As of 2005 international law doesnrsquot define a demarcation between airspace and outer

space but ldquostates agree that state sovereignty doesnrsquot extend without any limitsrdquo25 Proposals of

where airspace ends and when outer space begins are base on various scientific and technological

criteria (gravitational pull capabilities of air breathing aircraft etc26) Others scientists argue

that defining a boundary between airspace and outer space isnrsquot necessary as it would hinder the

progress of space technology and the legal status would depend on the nature of the activity

While no boundary exists airspace is finite and activity in outer space follows four

fundamentals principles First over flights of foreign satellites over a nation is permissible as

airspace doesnrsquot extend forever Second space ldquointernational law applies to outer space and

celestial bodiesrdquo Third according to the Outer Space Treaty of 1967 states canrsquot claim celestial

bodies or outer space which are not subject to national appropriation therefore are free for use

by all states Finally states must use outer space exclusively for peaceful purposes with specific

bans on weapons of mass destruction However states can use space for other military purposes

like intelligence surveillance and reconnaissance activities 27

Are these international laws and principles applicable to cyberspace Satellites are

certainly an integral part of the space domain Operators control satellites by using the

cyberspace domain and information passes between satellites and ground stations One can

argue that space is a sub-set of the cyberspace domain with satellites serving as computers in

space Global positioning system devices in vehicles interact with satellites all through an

elaborate network as part of the electromagnetic spectrum known as cyberspace Therefore

cyberspace is in space with millions of people using cyberspace everyday

10

AUACSCSinksAY08

The military uses space assets for intelligence surveillance and reconnaissance

knowledge management and command and control Agencies like the National Reconnaissance

Office and National Geospatial-Intelligence Agency obtain high-altitude imagery using a variety

of capabilities to include heat signature resonation Satellites can detect missile launches which

provide vital military information to senior leaders tasked with the security of their nation The

military networks to include decision briefs tasks and emails in Iraq and the Predator feeds in

Afghanistan travel through military and commercial satellites with all the information flowing

through the cyberspace domain With the heavy reliance of cyberspace to operate space assets

and the demands of information flowing through space by businesses it should come as no

surprise that space is a vital component for day-to-day operations of the military

Since cyberspace is an inherent component for space operations it is logical to assume

international law for outer space is applicable to cyberspace as long as an aggressor doesnt

violate the four premises and as long as weapons of mass destruction arenrsquot ldquostationed in outer

spacerdquo 28 Therefore a state would consider a cyber attack against a satellite as other than for

peaceful purposes and according to the fourth premise international law would apply

However what about a cyber attack using satellites as a means of conducting operations

Under todayrsquos current operations international elites havenrsquot considered a cyber attack passing

through space as a violation of international law When a senior leader in Qatar approves a

target set that is executed by a pilot in Nevada by an aircraft in Afghanistan all this information

is transmitted by cyberspace through space The result is that an aircraft renders an air or ground

target inoperable The effect is the same for cyberspace The information flows through space

by way of the cyberspace domain and the result is that an operator has rendered a target

11

AUACSCSinksAY08

inoperable As with airspace the information isnrsquot the cause of the damage but what an operator

does with the information is what constitutes the cyber attack

Land Cyber attacks using resources over land is relatively straightforward International

boundaries are defined as ldquoimaginary lines which separate territorial sovereigntyrdquo 29 which are

mutually agreed upon via international treaties Crossing an international border without

permission from the state is a violation of international law While an illegal immigrant crossing

a border to seek an opportunity to provide for his family is a violation of national law the United

Nation considers a nation-sponsored invasion of another nation that threatens the security and

stability of a nation as a breach in international law and an act of war

However international law doesnrsquot consider all border crossings as an act of war For

example when Nicaraguan troops and arms allegedly crossed the borders of El Salvador the

United Nations determined that incursions didnrsquot threaten El Salvadorrsquos territorial integrity and

stated that neither ldquothese incursions nor the alleged supply of arms may be relied upon as

justifying the exercise of the right of collective self-defenserdquo30 The victim state can repelled the

aggressive act but the United Nations Council wouldnrsquot condone any further military action

taken against the adversary opting for diplomatic or economic solution instead

Does international law apply when an adversary crosses international borders using

cyberspace as the means for conducting warfare operations When an adversarial state crosses a

statersquos boundaries using roads or bridges that connect the two nations the road is the resource

spanning the two nations If the adversary doesnrsquot do anything then returns to their sovereign

borders the aggressor hasnrsquot violated international law However when the adversary uses

weapon systems to affect serious damage the adversary has broken international law and a

12

AUACSCSinksAY08

nation may invoke their right for self-defense and may conduct full-scale operations to neutralize

the threat

A parallel notion is when an adversary uses a copper or fiber optic connection that spans

between two nations The adversary uses the land-based LAN connection as a means for

conducting cyber warfare operations The adversary may cross the borders using cyberspace yet

do nothing The affected state may push the adversary back to its borders but no further actions

are deemed appropriate However once the adversary uses the information transmitted over

cyberspace to cause severe operational or strategic damage the affected state now has the right

of self-defense Cyberspace is the means like the road or bridge for which the adversary

delivered the weapon The affected nation will consider the execution of the adversaryrsquos

information packet or weapon system as an act of aggression and the effect caused by the

weapon is what breeches international law

The difference between these two scenarios is that the adversary using the

electromagnetic spectrum hasnrsquot physically invaded a nationrsquos sovereign borders However

their digital presence crossed sovereign borders and as latter discussed in the paper adversaries

committing an act aggression against a state are now under the jurisdiction of the affected state

Sea ldquoThe territorial sea is a belt of sea adjacent to the (statersquos) coasthellipto include the airspace

aboverdquo as well as the seabed and subsoil31 The territorial sea is subject to the right of innocent

passage by foreign shops giving states the right to transport goods and passengers between ports

All of which is subject to the full sovereignty of the state which according to the United Nations

Convention on the Law of the Sea in 1982 and agreed upon by the majority of its membership in

1982 extends 12 miles from the coast32 The jurisdiction includes crimes where the

consequences extend to the coastal state and disturbs the peace of the country33 A cyber attack

13

AUACSCSinksAY08

conducted within the territorial sea of a nation would be no different from a cyber attack

conducted from within the nationrsquos land borders therefore cyber attacks against a state or even

another state conducted within the territorial seas are subject to current international laws Cyber

attacks originating outside the statersquos sovereign borders but results in affecting a statersquos

resources in their territorial seas would fall under the land and airspace breeches of territorial

sovereignty and would be subject to international law

The high seas on the other hand arenrsquot subject to the sovereignty of any one state The

high seas extend beyond the territorial sea and include the airspace the seabed and the subsoil34

and all states have the right to exercise freedoms on the high seas35 As similarly defined in

space ldquothe high seas shall be reserved for peaceful purposesrdquo as stated by Article 88 of the Law

of the Seas Cooperative36 which is defined as refraining from any threat or use of force (outside

of wartime conflicts)

The very nature of a cyber attack in the high seas lends itself to be a violation of

international law as nations are restricted to conducting peaceful operations in the high seas

The question is whom has jurisdiction of crimes committed in the high seas By applying the

Protective Security Principle of Jurisdiction where an actor threatens a statersquo security and

introducing the United Nationrsquos definition on the Illegal Use of Force extends to the high seas

and for that matter space giving states the right for self-defense as defined by the United Nations

as ldquoan armed attackrdquo The sheer name of cyber attack doesnrsquot immediately lend itself to an

ldquoarmedrdquo cyber attack However the effects generated from a cyber attack can be equivalent to a

traditional conventional attack and the international law would permit a state to take appropriate

countermeasures while notifying the United Nations Security Council37

14

AUACSCSinksAY08

Applying International Law to Cyber Warfare Today we live in an Information Age where communication through cyberspace has forever changed and flattened out worldhellipOur adversaries seek to operate from behind technical legal and international screens as they execute their costly attacks38

~General James E Cartwright Commander United States Strategic Command

Jurisdiction

Understanding the territorial sovereignty principles of a nation is important in applying

cyberspace and cyber warfare to existing international laws While some of these principles and

international laws may not be relevant for the cyberspace domain due to the far-reaching

capability of cyber warfare the jurisdiction of a nation further defines its ability to respond to

aggressive acts by nations in the cyberspace domain There are three jurisdictional principles

that provide nations the right to pursue aggressors that threaten a nationrsquos independence the

Territorial Principle Nationality Principle and the Protective Security Principle

For actions originating within the state the jurisdiction clearly falls within the territorial

principle where a ldquostate has jurisdiction over all crimes committed in its territoryhellipto include

airspace international waters and territorial seasrdquo39 The territorial jurisdiction is subject to

exceptions when dealing with persons from foreign states as in the most popular example of

immunity given to foreign diplomats In this case ldquostates may exercise jurisdiction over its

citizenhellipeven if they are physically outside the statesrsquo territoryrdquo as Doctor Boczek defines as the

Nationality Principle Nations usually agree upon on these concessions states prior to the offense

being committed40

Doctor Boczek defines the Protective Security Principle as a ldquojurisdictional principle

whereby a state my assume jurisdiction over and punish foreign nationals for certain conduct

outside its territory which is directed against its security territorial integrity and political

independencerdquo41 Some states would argue that criticism of a state or government is applicable

15

AUACSCSinksAY08

in applying this principle of jurisdiction However this is too broad of an interpretation and

should be confined to acts that are more tangible in nature like falsification of a statesrsquo official

documents conspiracy to violate immigration of custom laws and illicit drug trafficking42

Would a cyber attack that is deemed to challenge a nationrsquos banking community or bring

down a power source be a direct attack against its security and political independence The

international community easily sees the attack of a power source with kinetic weapons as a

violation of a territorial boundary and a breech of international law The United States viewed

the attack on the Trade Towers as an act of war launching the Global War on Terrorism Would

the United States have viewed the same devastation as if the attack occurred through cyberspace

Would the attack have been less of an act of war if the aggressor remotely controlled domestic

airliners from a foreign country Probably not What happens if the cyber attack caused a fire in

the lower floors of the buildings preventing people from escaping While less dramatic than an

airbus flying into the middle of the towers and maybe more difficult to demonize the crime the

result is the samemdashinnocent people suffering as a result of an adversary trying to threaten a

nationrsquos security

What happens if the suspected cyber attack has violated a nationrsquos territorial boundary in

order to attack a neighboring country or an ally Going from point A to point B in cyberspace is

rarely a direct connection As with the global nature of cyberspace itrsquos conceivable that

adversaries cross several nationsrsquo boundaries to conduct cyber attack operations The question

generated is who has jurisdiction

If the actor committing the crime had used an airplane each nation could claim

jurisdiction as the adversary violated their territorial boundaries and violated international law

More often than not the first state would have acted immediately upon the aggressive act and

16

AUACSCSinksAY08

would have prevented aggressors from completing their task by either forcing the aircraft to land

or turnaround or an even more escalated response of firing upon the aircraft In the air land or

sea the ability for a nationrsquos military forces to respond in a timely manner gives way to the

deterrence factor of not crossing a statersquos boundaries without receiving permission for fear of

reprisal A clear example of this was when Turkey denied the United States the ability deploy

the 4th Infantry Division from its borders at the beginning of Operation Iraqi Freedom Violating

Turkeyrsquos borders without permission would have brought about great repercussions that would

have made Operation Iraqi Freedom even more difficult and could have resulted in an escalation

of the war outside the Iraqi borders43 Another example is when Spain and France denied the

Unites States the use of their airspace when F-111s based in the United Kingdom conducted air

operations in Libya in an effort to eliminate Muammar Khadafy44

However the speeds at which these breeches in territorial boundaries occur make it

difficult for a nation to claim jurisdiction especially when nothing occurred within their

territorial sovereignty The cyber attacks didnrsquot result in any damage to nation as the information

packets passed through their sovereign borders According to territorial boundary description

described by Doctor Boczek the international community doesnrsquot consider the crossing the

border in of itself an act of warmdashserious damage is a driving factor in determining conflict

escalation In addition according to the territorial jurisdiction principle the cyber attack didnrsquot

threaten a nationrsquos security territorial integrity and political independence If the cyber attack or

information originated from within a sovereign territory by a third party then the two nations

would have to work together to resolve the issue and mutual jurisdiction would probably apply

However if the cyber attack didnrsquot physically manifest itself from within their sovereign

territory or the adversary didnrsquot use the nation as a staging area to launch a further attack the

17

AUACSCSinksAY08

international law and the jurisdiction principles would dictate the affected nation would have

jurisdiction

Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security

territorial integrity and political independence Cyberspace utilizes the other domains as a means

of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence

Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of

territorial sovereignty the Protective Security Principle does provide nations the ability to

enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos

sovereignty when it conducts cyber warfare operations However some elites donrsquot consider

cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense

International law specifically article 2 of the United Nations Charters states that a

members shall refrain in their international relations from the threat or use of force against the

territorial integrity or political independence of any state or in any other manner inconsistent

with the purposes of the United Nations which is intended to prohibit all types of force except

those carried out under the aegis of the United Nations or as provided for by the Security

Council45 The only exception to the United Nations Charters as it relates to the Use of Force is

the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed

attack46

International elites have discussed the term ldquouse of forcerdquo in the past because of the

development of chemical and biological weapons and had to move from a kinetic impact based

definition to a results-oriented approach47 Chemical and biological weapons lacked the

characteristic of an explosion or physical force yet these weapons certainly are capable of

destroying life and property Doctor Leigh Armistead a former information warfare instructor at

18

AUACSCSinksAY08

the Joint Forces Staff College cautions that the use of computer network attacks by the military

ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary

that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great

Russia introduced a proposal to the United Nations that banned the use of information

operations Even though the United Nations didnrsquot adopt the law the concern of international

community is fully aware of the impact cyber attacks can have on a nation

The concern over cyber warfare capabilities is that it can generate both non-kinetic and

kinetic effects There has always been the traditional kinetic solution for cyber warfare where a

precision guidance munition destroys a critical information system node Most people assume

computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos

computer system from the safety of onersquos own command and control center but the physical

destruction of a computer system or network by kinetic means also qualifies as cyber warfare

However cyber warfare has also evolved to the point where aggressors can achieve a kinetic

effect without the use of a traditional kinetic weapon A cyber attack on an information system

can shut down a particular node of a power plant causing the system to become inoperative

Even if there wasnrsquot an explosion the attack serves the same purpose

The question raised is do cyber attacks constitute an armed attack Scholars do agree that

some cyber attacks fit comfortably within the United Nations Charter For example a strategic

level cyber attack causing widespread damage and significant casualties would trigger the statersquos

right of self-defense In addition a cyber attack that precluded a conventional attack or a series

of cyber attacks causing significant damage would give a state the right of self-defense49 Few

would dispute that a country has the right under international law to respond with military force

19

AUACSCSinksAY08

if a state destroyed or significantly damaged another nationrsquos economic system for example the

New York or London stock exchanges

However some confusion and state-defined interpretation comes into play when the

frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard

Law School argues that cyber attacks require an expansion of the definition on the ldquouse of

forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot

be prohibited by international law50 International scholars recommend ldquoclearer rules of what

kinds of information warfare actions constitute an armed attackrdquo which drives permissible

responses of self-defense51 For example a state-sponsored cyber attack causes damage to a

victimrsquos factory or power plant however the nation claims the incident is an isolated instance

and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under

the United Nations Charter and the United Nations would consider any response retaliation

which would violate international law52

Another example involves a nation conducting a series of small attacks causing minimal

damage and then ceases Even though the aggressor used force to conduct cyber warfare

operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under

the United Nations Charter This type of attack is analogues to a small band of troops crossing a

border without causing significant damage53 According to the United Nations Charter the

national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders

and respond to the use of force Repelling the small band of troops and reestablishing their

sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration

of war and allies would have to respect the United Nations decision and couldnrsquot intervene The

same is true for the cyber attack A state can employ defensive measure to isolate and defeat the

20

AUACSCSinksAY08

incursion over the electromagnetic spectrum However the United Nations would see further

offensive operations or invasive operations as retaliation Therefore a nation must take the

incident whether it is signs of conventional forces on the ground or traces of cyber warfare

incursions in the electromagnetic spectrum to the United Nations to seek restitution

In both of these situations the international law becomes the target for change not

whether cyber warfare is in violation of international law If the law were to change the

international community would then consider the above situations acts of war even if an

adversary used conventional forces As written today the result of an operation remains the

driving factor in determining if an adversary has violated international law The means by which

an adversary conducts military operations may affect how nations react to the situation but

whether an adversary conducts the operation by means of the air land sea space or cyberspace

doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian

Triggs a public international lawyer and member of the Attorney General International Legal

Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over

offences abroad having an intended and substantial effect within a state may be justifiedrdquo54

Therefore the international community must evaluate the effect of a criminal act rather than the

means in which the act was committed

Others claim that because the Internet takes advantages of legal norms where non-state

actors can ignore Western notions of law55 more international laws are needed for cyberspace

However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using

other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the

Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked

aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts

21

AUACSCSinksAY08

against a staterdquo in the cyberspace domain The anonymity of the Internet and their total

disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and

national laws already exist in most countries that prohibit the use of the Internet for terrorist

activities therefore additional international laws wouldnrsquot prevent or deter terrorist from

committing such acts of aggression

International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed

Conflict includes the Martens Clause which extends established custom and humanitarian

principles to new technologies and addresses the ever-changing nature of warfare The

international community designed The Martens Clause ldquoto prevent future unnecessary andor

disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges

crimes by invoking the laws of humanity and public conscience hence their effects and not its

methods

The basic legal premise behind Law of Armed Conflict is that attacks must be limited to

military objectives and collateral damage must be proportionate to military advantages and

forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary

suffering but military commanders and planners need to be aware of the results a particular

action will invoke Russian leadership believes a computer network attack against their

homeland can be a means for executing a variety of escalating responses to include nuclear

attack58 Therefore it is imperative military commanders understand the impact any weapon

system can have on an adversary not just cyber attacks

Not all scholars agree that international law is insufficient to govern cyber warfare

Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace

and the Use of Force states that computer network attacks constitute an unlawful use of force in

22

AUACSCSinksAY08

cyberspace under traditional international law Sharp declared that an armed attack may occur

ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a

way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive

definition of cyber attacks may never be drafted59 The Congressional Research Service also

concluded that ldquothere is little likelihood that the international community will soon generate a

coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations

on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos

conclusion is that the effects of cyber warfare operations are the same as if an adversary

conducted conventional warfare operations where the effect of the attacks are the driving factors

in determining whether an adversary used force or not

The United States Government agrees with Sharprsquos conclusion The offensive

Information Operation strategy for the United States government as described by Doctor

Armistead ties the tools used to conduct military operations back to the desired effect which is

in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning

effects-based operations and operational art focus the Joint Force Commanderrsquos course of action

towards meeting objectives outlined in guidance provided by the National Command Authority

and senior military leadership62 Whether the tools are dropped pamphlets invasive network

attacks or bombs on targets the goal is to produce a desired effect to achieve the overall

objectives and cyber warfare can produce effects that challenge the national security of a nation

Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63

~General T Michael Moseley USAF

23

AUACSCSinksAY08

The cyberspace domain has been around for quite sometime but as technology continues

to advance businesses as well as governmental organizations are becoming more reliant on the

cyberspace domain With that reliance the protection of this critical domain becomes even more

important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the

electromagnetic spectrum by denying and disrupting information demands Scholars claim that

protection needs to include addressing existing international laws expanding them to incorporate

the ever-advancing capabilities emerging in the cyberspace domain

However territorial sovereignty of a nation and the principles of jurisdiction specifically

the Protective Security Principle give nations the right to exercise jurisdiction when an

aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64

While cyberspace is a domain requiring specific attention it relies on assets in the other domains

of land space sea and air in order to operate and international laws for the linear domains do

exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace

but during cyber warfare operations the principles behind the restrictions of foreign military

entering airspace do apply The strategic nature of cyber warfare operations correspond to the

same strategic impact that airpower can inflict upon a nation threatening their independence

While maybe not as dramatic as kinetic effects the results can be just as devastating

Space is relatively straightforward Since a nation canrsquot claim space and over flights of

foreign satellites over a nation is permissible nations must use space for peaceful purposes

Kinetic attacks against space assets are a violation of international law therefore nations would

consider cyber warfare operations against space assets as other than peaceful purposes and a

violation of international law Cyber attacks traversing space assets relate to current military

operations where the military uses space assets to conduct kinetic operations Since international

24

AUACSCSinksAY08

elites havenrsquot considered these kinetic operations as a breach of international law military

commanders can conduct cyber warfare operations through space without fear of violating

international laws for outer space

Crossing international borders without a nationrsquos permission and threatening their

sovereignty is a violation of international law While nations canrsquot consider all border crossings

as an act of war those acts of aggression that threaten the territorial integrity would elicit a

defensive response by the victim nation Whether incursions involve combat vehicles over a

highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are

threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not

have set foot in the nation but according the Protective Security Principle the victim nation has

jurisdiction

Conducting cyber warfare operations from the territorial sea is no different from

conducting operations from within a nationrsquos land or sea borders However the high seas are

very similar in nature to space in that they are reserved for peaceful purposes Therefore

conducting any means of warfare from within the high seas is a violation of international law

and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-

defense

According to Barkham ldquoinformation warfare attacks are in essence territorial

penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then

subject to the jurisdiction of the victim nation who then has the right for self-defense However

due to the global nature of cyberspace aggressors can cross multiple borders and determining

who has jurisdiction demands cooperation among nations The origin and any deliberate staging

locations of the cyber attack will drive who has jurisdiction The crossing of third party borders

25

AUACSCSinksAY08

by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the

aggressors threaten a nationrsquos independence or territorial integrity

Scholars consider cyber warfare operations that involve strategic and operational impacts

as being a means of using force and fall within the legal regime of existing international law

However scholars argue that because cyber warfare includes kinetic and non-kinetic results the

Use of Force definition needs expanding Yet they conclude that an exhaustive definition of

cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare

operations against existing case studies where the effects are evaluated as opposed to the means

even if the operations originated from outside the nationrsquos territorial jurisdiction There is some

authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to

have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade

non-state actors from conducting cyber warfare operations given their willingness to ignore

Western notions of war and their ability to conduct operations anonymously in cyberspace

International laws are in place to that address the ever-changing nature of warfare The

Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a

framework for addressing all warfare to include cyber warfare operations The international

community will need to measure the effects of an operation rather the means Whether its boots

on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a

nationrsquos response

26

AUACSCSinksAY08

End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)

27

AUACSCSinksAY08

44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

28

AUACSCSinksAY08

Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005

Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department

American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)

Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983

Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988

Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)

Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)

IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)

Joint Publication 3-13 Information Operations 13 February 2006

Joint Publication 5-0 Joint Operations Planning 26 December 2006

Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies

Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc

Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College

Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)

Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press

29

AUACSCSinksAY08

Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI

Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)

Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press

Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company

Detter Delupis I The law of war (2000) New York NY Cambridge University Press

Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)

Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College

Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor

Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)

Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)

Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf

Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)

Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College

Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College

Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)

Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA

30

AUACSCSinksAY08

Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)

Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)

Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College

Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology

Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College

Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)

OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center

OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College

OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications

Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991

Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College

Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center

Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)

31

AUACSCSinksAY08

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press

Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA

Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University

Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor

Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661

Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office

Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis

United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC

United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center

Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College

Wesley David C The Military Commander and the Law 2006

32

Page 4: Sinks 0407

AUACSCSinksAY08

Table of Contents

DISCLAIMER II

ABSTRACT III

TABLE OF CONTENTS IV

INTRODUCTION 1

WHAT IS CYBER WARFARE 3 Defining Cyberspace 3 What Cyberspace is Not 4 Defining Cyber Warfare 5

TERRITORIAL SOVEREIGNTY 6 Airspace 7 Space 10 Land 12 Sea 13

APPLYING INTERNATIONAL LAW TO CYBER WARFARE 15 Jurisdiction 15 Use of Force 18 International Laws 22

CONCLUSION 23

END NOTES 27

BIBLIOGRAPHY 29

iv

AUACSCSinksAY08

Introduction We need to be able to think in terms of target effects I picture myself around that same targeting table where you have the fighter pilot the bomber pilot the special operations people and the information warrior As you go down the target list each one takes a turn raising his or her hand saying ldquoI can take that targetrdquo1

~ General (Retired) John P Jumper

The worldrsquos growing reliance on information technology to improve efficiency has

opened a threat to all who become reliant on cyberspace to conduct operationshellipa threat that has

many sources of predators ranging from pranksters to white-collar criminals to terrorists Yet

cyberspace has limited international laws to govern a worldwide domain that is ever expanding

as third world nations begin to invest in information technology and enter the cyberspace realm

to enhance business and military operations As nations begin to rely more on cyberspace as an

effective means of conducting business and military operations the more these operations will

become susceptible to outside aggressive influences whether itrsquos from economic invasions or

disruption of military operations

In addition the threat of military operations in the cyberspace domain is real The

Russian military has incorporated cyber warfare into their doctrine in order to gain information

advantage by affecting an adversaryrsquos information system decision-making processes command

and control and even the populace2 China is pursuing a battalion-sized force of computer

experts trained ldquoto carry out computer network attacks as a means of seeking asymmetrical

advantages over an adversaryrdquo3 The threat doesnrsquot reside just within state actors non-state

actors are incorporating cyber warfare operations into their realm of capabilities Hezbollah has

outlined a strategy to cripple the Israeli government by disrupting normal economic and societal

operations by targeting official websites crashing financial sites knocking out the internet

servers and targeting e-commerce sites4

In land sea and air battles military combatants can see the enemy coming whether itrsquos

1

AUACSCSinksAY08

the whites of their eyes or a blip on a screen International boundaries easily define when an

aggressor threatens the sovereignty of a nation giving the victim nation the right of jurisdiction

and there are specific international laws that address military operations in space In addition

the international community has defined when an adversaryrsquos use of force threatens a nationrsquos

territorial integrity and political independence

However the global nature of cyberspace and the speed of which victims can experience

cyber attacks force nations to deal with the legal challenges associated with over-the-horizon

military operations as commanders can experience battlefield affects with little or no warning

Moreover cyber attacks are much more difficult to define Jurisdiction over a cyber attack that

occurs 7000 miles away that crosses multiple physical domains and spans several international

borders compounds the legal issues surrounding an aggressive act that can have a wide-range of

effects Add the fact that determining the perpetrator proves to be less than speedy as most

cyber warriors can use the Internet ldquoanonymously or as a shell game to hide identitiesrdquo5 nations

face a very difficult task in attributing an aggressive act to a particular actor Responding to

asymmetric techniques tactics and procedures by state and non-state actors have proven to be

difficult for conventional forces Introducing asymmetric tactics in cyberspace presents nations

an even more challenging and complicated issue particularly in the legal regime

Therefore this paper will analyze the need for international guidance for conducting warfare

operations in the cyberspace domain This paper will define cyberspace and cyber warfare in an

effort to set the stage for illustrating the global nature of cyberspace and its reliance on the other

physical domains to conduct military operations The paper will define the international law as it

relates to territorial boundaries and outline the jurisdiction principles that allow a nation to act

against an adversary This paper outlines the definition of the Use of Force and how it

2

AUACSCSinksAY08

corresponds to the cyberspace domain and cyber warfare and with the final discussion centered

on the international laws that already exist which help shape international law for cyberspace

What is Cyber Warfare Very few of the new manifestations in war can be ascribed to new inventions or new departures in ideas6

~Carl Von Clausewitz

Defining Cyberspace William Gibson coined the term ldquocyberspacerdquo in his 1984 novel Neuromancer in order to

describe ldquoa shared virtual environment whose inhabitants objects and spaces comprise data that

is visualized heard and touchedrdquo7 However the most common of definitions today refer to the

Internet or the World Wide Web and usually consists of an information-sharing environment

between computers8 However the military has defined cyberspace to advocate a worldwide

spectrum of more than just information sharing among computers

In the National Military Strategy for Cyberspace Operations cyberspace is defined as a

domain characterized by the use of electronics and the electromagnetic spectrum to store

modify and exchange data via networked systems and associated physical infrastructure9 Joint

doctrine has adopted a computer-centric definition where cyberspace is ldquothe notional

environment in which digitized information is communicated over networksrdquo10 The National

Military Strategy and joint doctrine definitions advocate a worldwide information environment

that isnrsquot limited to the Internet or to just computers Matter of fact the expanded definitions

suggest that cyberspace consists of all networks to include highly sensitive military

governmental and commercial networks that may or may not use commercial means to store

modify and exchange data These systems include exchange networks like tactical digital

information links (TADIL) links between command and control platforms and air ground and

sea weapon systems In addition because the definition includes the electromagnetic spectrum

3

AUACSCSinksAY08

cyberspace includes ldquocapabilities that are currently considered electronic warfarerdquo11 which Great

Britain exploited in World War II when they introduced radar technology in World War II and is

still applicable with communication and navigational jamming capabilities used in todayrsquos

conflicts

While cyberspace is a unique domain that military commanders must protect in order to

conduct operations more effectively and offers commanders another dimension in which to

exploit weaknesses in an adversaryrsquos ability to project power cyberspace doesnrsquot exist on its

own According to Lt Col Fahrenkreg in the published Air University article title Cyberspace

Define ldquocyberspace exists across the other domains of air land sea and spacerdquo12 There are

clear delineations between the sea land and air Commanders know where the land ends and the

sea begins While there are some discussions as to where airspace ends and space begins the

capabilities and roles associated with each domain are clear Therefore to depict cyberspace as

an autonomous domain is unrealistic as the physical infrastructure of cyberspace and the means

of sharing information within the cyberspace domain resides in one or more of the four linear

domains

What Cyberspace is Not The most confused notion about cyberspace is that information operations and

cyberspace are one in the same Joint Publication 3-13 Information Operations describes the

information environment as a collection of leaders decision makers and systems that process

collect disseminate or act on information consisting of three dimensions the physical

informational and cognitive dimensions13 The goal of information operations is to influence the

cognitive dimension by affecting the decision-making process known affectionately by the Air

Force as the OODA Loop (Observe Orient Decide and Act)14 By disrupting and corrupting

4

AUACSCSinksAY08

information processes military commanders can influence or usurp adversarial human and

automated decision making in the physical and informational dimensions

As stated by Lt Col Fahrenkreg the confusion between cyberspace and information

operations comes from the misunderstanding of cyberspace as an operation rather than a

domain15 Information operation is a capability available to the combatant commander to

generate an effect in one of the five domains It just so happens that cyberspace tends to be the

primary means of delivering the Information Operation capability

Cyberspace connects the physical dimensions with the cognitive process and is a means

to create effects to include disrupting degrading denying the enemy the use of strategic and

operational assets to include command and controls systems power plants telecommunications

and other like targets to affect a statersquos operational and strategic centers of gravity Cyberspace

isnrsquot information or the data residing on a computer but is the means in which users transfer

store or modify information Cyberspace isnrsquot the data sent to a precision guided munition but

the means in which the originator passes the information Cyberspace is the digital super

highway of the electromagnetic spectrum with the ones zeros and electrons as the passengers

Defining Cyber Warfare According to the Institute for Advanced Study of Information Warfare (ASIW) cyber

warfare has become a form of information warfare which ASIW defines as ldquothe offensive and

defensive use of information and information systems to deny exploit corrupt or destroy and

adversaryrsquos information information-based processes information systems and computer-based

networks while protecting onersquos own Such actions are designed to achieve advantages over

military adversariesrdquo16 While this definition doesnrsquot specifically address the electromagnetic

spectrum the definition focuses on information-sharing systems which is where crux of the

cyberspace domain revolves around

5

AUACSCSinksAY08

Joint doctrine defines cyber warfare as those areas of operations that affect the

electromagnetic spectrum to include Computer Network Operations and Electronic Warfare

which are two of the five core operational capabilities of Information Operations Electronic

warfare operations operates across ldquoradio visible micro directed energy and all other

frequenciesrdquo and overlaps with network warfare operations which include ldquoradio nets satellite

links tactical digital information links (TADIL) telemetry digital track files

telecommunications and wireless communication network and systemsrdquo all of which operate

within the electromagnetic spectrum17

Cyber warfare consists of defensive and offensive operations Defensive operations

arenrsquot limited to severing connections or blocking attempts of an adversary trying to corrupt data

modify transmissions or destroy information systems Defensive operations include the

elimination of the adversaryrsquos capability of conducting operations which may involve crossing

sovereign borders in order to complete the task However defensive network operations come in

more than just one form The movies portray computer experts hovering over computers trying

to affect each otherrsquos operations However cyber warfare includes the use of traditional kinetic

effect to disrupt computer network operations of the enemy as a fighter-bomber delivering a

500-pound bomb to destroy a vital mode in a computer network may serve the same purpose as a

computer-centric network attack While this isnrsquot as sexy as a network attack that spans the

globe to degrade the enemyrsquos ability operation within the cyberspace domain the effects are the

same

Territorial Sovereignty In total war it is quite impossible to draw any precise line between military and non-military problems18

~Sir Winston Churchill

6

AUACSCSinksAY08

Cyberspace is certainly a domain that requires unique attention in order for commanders

to effectively and efficiently prosecute combat operations Cyberspace spans the globe using

the physical infrastructure residing within the other linear domains As users pass information

from one site to another data crosses boundaries by means of the cyberspace domain Data

leaves the Iraq area of operation via satellite to a receiving site in Germany Operators route the

information to the United States either through another satellite or by ground to sea-based cables

bound for computer nodes within the United States before arriving in South Carolina where

automated network tools redirect the information to the receiverrsquos location

An adversary attempting to modify corrupt or destroy this information traveling within

the cyberspace domain would at one time or another would cross sovereign borders through air

land sea or space The adversaryrsquos physical presence may not apply as they could conduct

operations from the comforts of their home however a nation could detect the adversaryrsquos

digital presence and could feel the impact of their actions from within their sovereign borders

Therefore as these adversaries span the globe using the cyberspace domain that relies on the

other linear domains to exist does international law apply when boundaries are crossed The

following sections will address the international laws of each physical domain and evaluate how

their principles apply to the cyberspace domain

Airspace Airspace as defined by Doctor Boleslaw A Boczek the internationally renowned expert

on international law ldquois the air pillow above the subjacent territoryrdquo to include ldquoairspace above

international waters and the territorial seardquo The airspace is under complete and exclusive

sovereignty of the subject state19 With that states have jurisdiction over their airspace and

require identification of foreign aircraft along with their intentions According to Dr Boczek

book International Law A Dictionary ldquoentry of national spacehellipmay take place only with the

7

AUACSCSinksAY08

authorization of the territorial staterdquo20 and currently only applies to aircraft Entry into the

airspace would require ldquoall aircraft to identify themselves file flight plans and report their

positionrdquo According to the 1944 Chicago Convention on International Civil Aviation nations

can enter into agreements that allow scheduled international civil air services which usually

include reciprocal agreements covering routes volume and other matters relating to air traffic

However these agreements only apply to civil aviation where state aircraft which include

aircraft belonging to the military customs public services and heads of states must follow more

restrictive procedures upon entering the airspace of a foreign nation21

There are several incidents where states have evoked their right for defending their

national security like the shooting down of a US military reconnaissance aircraft over Soviet

airspace by the Soviet Union in 196022 or the shooting down by Soviet fighter planes of a South

Korean airliner in 198323 The Soviet Union isnrsquot the only nation to protect its airspace as the

United States was responsible for shooting down an Iranian airliner thought to be an attacking

military plane over the Persian Gulf in 198824 These examples illustrate a nationrsquos sovereign

resolve to protect itself when a suspected adversary violated their airspace

Applying international law of airspace to cyberspace doesnrsquot seem too practical Civilian

signals entering a nationrsquos airspace would require nations to enter into agreements to allow

scheduled services and the persons receiving information through airspace would have to be

non-state sponsored Nationrsquos could regulate some cyberspace networks entering airspace like

radio communications that primarily use land-based infrastructure to function However the

very nature of computer networks and the ever-increasing global reach of communication

capabilities severely restrict a nationrsquos ability to monitor the millions of transmissions made on a

daily basis and these signals certainly wouldnrsquot be on any scheduled basis Therefore even if

8

AUACSCSinksAY08

nations made agreements concerning the cyberspace domain nations would have a difficult time

enforcing their terms of agreements unless the terms are very open-ended If they were so open-

ended then the agreement may not be necessary and based on my research nations realize the

futility of establishing these agreements as this author couldnrsquot find any reference to any

agreements that nations have entered into referencing the cyberspace domain

While the international law for civilian aircraft in airspace may not relate well or isnrsquot

feasible to enforce in the cyberspace domain does a nation have that same right to protect itself

from a suspected attack from cyberspace where the attackerrsquos signal enters airspace Does a

nation have the right to ldquoshoot downrdquo a cyberspace attack as it enters their domain through

airspace The whole idea behind restricting airspace from foreign military aircraft is because of

the strategic impact military aircraft can have on a nation As demonstrated in World War II

military aircraft carrying weapons of mass destruction can decimate cities and destroy a nation

with minimal effort The effects generated by military aircraft are quite destructive and garner

specific attention While an aircraft in of itself is relatively harmless the actions taken by the

crew can lead to devastating results

The same is true for cyber attacks The information passing through airspace in the

cyberspace domain is the vehicle however the crew conducting the operation is potentially

creating the same strategic results The cyber attack may not destroy cities but it certainly can

be destructive to a nationrsquos well-being by crippling power sources economic industries water

supply etc all at the blink of an eye while the victim takes several days to determine the

perpetrator Therefore while the international law for airspace may not be specifically relevant

the underlying principles are applicable as cyber attacks can have the same potential strategic

impact as an attack from a military aircraft

9

AUACSCSinksAY08

Space Outer space as defined by Doctor Boczek ldquois the space beyond the air surrounding the

earthrdquo As of 2005 international law doesnrsquot define a demarcation between airspace and outer

space but ldquostates agree that state sovereignty doesnrsquot extend without any limitsrdquo25 Proposals of

where airspace ends and when outer space begins are base on various scientific and technological

criteria (gravitational pull capabilities of air breathing aircraft etc26) Others scientists argue

that defining a boundary between airspace and outer space isnrsquot necessary as it would hinder the

progress of space technology and the legal status would depend on the nature of the activity

While no boundary exists airspace is finite and activity in outer space follows four

fundamentals principles First over flights of foreign satellites over a nation is permissible as

airspace doesnrsquot extend forever Second space ldquointernational law applies to outer space and

celestial bodiesrdquo Third according to the Outer Space Treaty of 1967 states canrsquot claim celestial

bodies or outer space which are not subject to national appropriation therefore are free for use

by all states Finally states must use outer space exclusively for peaceful purposes with specific

bans on weapons of mass destruction However states can use space for other military purposes

like intelligence surveillance and reconnaissance activities 27

Are these international laws and principles applicable to cyberspace Satellites are

certainly an integral part of the space domain Operators control satellites by using the

cyberspace domain and information passes between satellites and ground stations One can

argue that space is a sub-set of the cyberspace domain with satellites serving as computers in

space Global positioning system devices in vehicles interact with satellites all through an

elaborate network as part of the electromagnetic spectrum known as cyberspace Therefore

cyberspace is in space with millions of people using cyberspace everyday

10

AUACSCSinksAY08

The military uses space assets for intelligence surveillance and reconnaissance

knowledge management and command and control Agencies like the National Reconnaissance

Office and National Geospatial-Intelligence Agency obtain high-altitude imagery using a variety

of capabilities to include heat signature resonation Satellites can detect missile launches which

provide vital military information to senior leaders tasked with the security of their nation The

military networks to include decision briefs tasks and emails in Iraq and the Predator feeds in

Afghanistan travel through military and commercial satellites with all the information flowing

through the cyberspace domain With the heavy reliance of cyberspace to operate space assets

and the demands of information flowing through space by businesses it should come as no

surprise that space is a vital component for day-to-day operations of the military

Since cyberspace is an inherent component for space operations it is logical to assume

international law for outer space is applicable to cyberspace as long as an aggressor doesnt

violate the four premises and as long as weapons of mass destruction arenrsquot ldquostationed in outer

spacerdquo 28 Therefore a state would consider a cyber attack against a satellite as other than for

peaceful purposes and according to the fourth premise international law would apply

However what about a cyber attack using satellites as a means of conducting operations

Under todayrsquos current operations international elites havenrsquot considered a cyber attack passing

through space as a violation of international law When a senior leader in Qatar approves a

target set that is executed by a pilot in Nevada by an aircraft in Afghanistan all this information

is transmitted by cyberspace through space The result is that an aircraft renders an air or ground

target inoperable The effect is the same for cyberspace The information flows through space

by way of the cyberspace domain and the result is that an operator has rendered a target

11

AUACSCSinksAY08

inoperable As with airspace the information isnrsquot the cause of the damage but what an operator

does with the information is what constitutes the cyber attack

Land Cyber attacks using resources over land is relatively straightforward International

boundaries are defined as ldquoimaginary lines which separate territorial sovereigntyrdquo 29 which are

mutually agreed upon via international treaties Crossing an international border without

permission from the state is a violation of international law While an illegal immigrant crossing

a border to seek an opportunity to provide for his family is a violation of national law the United

Nation considers a nation-sponsored invasion of another nation that threatens the security and

stability of a nation as a breach in international law and an act of war

However international law doesnrsquot consider all border crossings as an act of war For

example when Nicaraguan troops and arms allegedly crossed the borders of El Salvador the

United Nations determined that incursions didnrsquot threaten El Salvadorrsquos territorial integrity and

stated that neither ldquothese incursions nor the alleged supply of arms may be relied upon as

justifying the exercise of the right of collective self-defenserdquo30 The victim state can repelled the

aggressive act but the United Nations Council wouldnrsquot condone any further military action

taken against the adversary opting for diplomatic or economic solution instead

Does international law apply when an adversary crosses international borders using

cyberspace as the means for conducting warfare operations When an adversarial state crosses a

statersquos boundaries using roads or bridges that connect the two nations the road is the resource

spanning the two nations If the adversary doesnrsquot do anything then returns to their sovereign

borders the aggressor hasnrsquot violated international law However when the adversary uses

weapon systems to affect serious damage the adversary has broken international law and a

12

AUACSCSinksAY08

nation may invoke their right for self-defense and may conduct full-scale operations to neutralize

the threat

A parallel notion is when an adversary uses a copper or fiber optic connection that spans

between two nations The adversary uses the land-based LAN connection as a means for

conducting cyber warfare operations The adversary may cross the borders using cyberspace yet

do nothing The affected state may push the adversary back to its borders but no further actions

are deemed appropriate However once the adversary uses the information transmitted over

cyberspace to cause severe operational or strategic damage the affected state now has the right

of self-defense Cyberspace is the means like the road or bridge for which the adversary

delivered the weapon The affected nation will consider the execution of the adversaryrsquos

information packet or weapon system as an act of aggression and the effect caused by the

weapon is what breeches international law

The difference between these two scenarios is that the adversary using the

electromagnetic spectrum hasnrsquot physically invaded a nationrsquos sovereign borders However

their digital presence crossed sovereign borders and as latter discussed in the paper adversaries

committing an act aggression against a state are now under the jurisdiction of the affected state

Sea ldquoThe territorial sea is a belt of sea adjacent to the (statersquos) coasthellipto include the airspace

aboverdquo as well as the seabed and subsoil31 The territorial sea is subject to the right of innocent

passage by foreign shops giving states the right to transport goods and passengers between ports

All of which is subject to the full sovereignty of the state which according to the United Nations

Convention on the Law of the Sea in 1982 and agreed upon by the majority of its membership in

1982 extends 12 miles from the coast32 The jurisdiction includes crimes where the

consequences extend to the coastal state and disturbs the peace of the country33 A cyber attack

13

AUACSCSinksAY08

conducted within the territorial sea of a nation would be no different from a cyber attack

conducted from within the nationrsquos land borders therefore cyber attacks against a state or even

another state conducted within the territorial seas are subject to current international laws Cyber

attacks originating outside the statersquos sovereign borders but results in affecting a statersquos

resources in their territorial seas would fall under the land and airspace breeches of territorial

sovereignty and would be subject to international law

The high seas on the other hand arenrsquot subject to the sovereignty of any one state The

high seas extend beyond the territorial sea and include the airspace the seabed and the subsoil34

and all states have the right to exercise freedoms on the high seas35 As similarly defined in

space ldquothe high seas shall be reserved for peaceful purposesrdquo as stated by Article 88 of the Law

of the Seas Cooperative36 which is defined as refraining from any threat or use of force (outside

of wartime conflicts)

The very nature of a cyber attack in the high seas lends itself to be a violation of

international law as nations are restricted to conducting peaceful operations in the high seas

The question is whom has jurisdiction of crimes committed in the high seas By applying the

Protective Security Principle of Jurisdiction where an actor threatens a statersquo security and

introducing the United Nationrsquos definition on the Illegal Use of Force extends to the high seas

and for that matter space giving states the right for self-defense as defined by the United Nations

as ldquoan armed attackrdquo The sheer name of cyber attack doesnrsquot immediately lend itself to an

ldquoarmedrdquo cyber attack However the effects generated from a cyber attack can be equivalent to a

traditional conventional attack and the international law would permit a state to take appropriate

countermeasures while notifying the United Nations Security Council37

14

AUACSCSinksAY08

Applying International Law to Cyber Warfare Today we live in an Information Age where communication through cyberspace has forever changed and flattened out worldhellipOur adversaries seek to operate from behind technical legal and international screens as they execute their costly attacks38

~General James E Cartwright Commander United States Strategic Command

Jurisdiction

Understanding the territorial sovereignty principles of a nation is important in applying

cyberspace and cyber warfare to existing international laws While some of these principles and

international laws may not be relevant for the cyberspace domain due to the far-reaching

capability of cyber warfare the jurisdiction of a nation further defines its ability to respond to

aggressive acts by nations in the cyberspace domain There are three jurisdictional principles

that provide nations the right to pursue aggressors that threaten a nationrsquos independence the

Territorial Principle Nationality Principle and the Protective Security Principle

For actions originating within the state the jurisdiction clearly falls within the territorial

principle where a ldquostate has jurisdiction over all crimes committed in its territoryhellipto include

airspace international waters and territorial seasrdquo39 The territorial jurisdiction is subject to

exceptions when dealing with persons from foreign states as in the most popular example of

immunity given to foreign diplomats In this case ldquostates may exercise jurisdiction over its

citizenhellipeven if they are physically outside the statesrsquo territoryrdquo as Doctor Boczek defines as the

Nationality Principle Nations usually agree upon on these concessions states prior to the offense

being committed40

Doctor Boczek defines the Protective Security Principle as a ldquojurisdictional principle

whereby a state my assume jurisdiction over and punish foreign nationals for certain conduct

outside its territory which is directed against its security territorial integrity and political

independencerdquo41 Some states would argue that criticism of a state or government is applicable

15

AUACSCSinksAY08

in applying this principle of jurisdiction However this is too broad of an interpretation and

should be confined to acts that are more tangible in nature like falsification of a statesrsquo official

documents conspiracy to violate immigration of custom laws and illicit drug trafficking42

Would a cyber attack that is deemed to challenge a nationrsquos banking community or bring

down a power source be a direct attack against its security and political independence The

international community easily sees the attack of a power source with kinetic weapons as a

violation of a territorial boundary and a breech of international law The United States viewed

the attack on the Trade Towers as an act of war launching the Global War on Terrorism Would

the United States have viewed the same devastation as if the attack occurred through cyberspace

Would the attack have been less of an act of war if the aggressor remotely controlled domestic

airliners from a foreign country Probably not What happens if the cyber attack caused a fire in

the lower floors of the buildings preventing people from escaping While less dramatic than an

airbus flying into the middle of the towers and maybe more difficult to demonize the crime the

result is the samemdashinnocent people suffering as a result of an adversary trying to threaten a

nationrsquos security

What happens if the suspected cyber attack has violated a nationrsquos territorial boundary in

order to attack a neighboring country or an ally Going from point A to point B in cyberspace is

rarely a direct connection As with the global nature of cyberspace itrsquos conceivable that

adversaries cross several nationsrsquo boundaries to conduct cyber attack operations The question

generated is who has jurisdiction

If the actor committing the crime had used an airplane each nation could claim

jurisdiction as the adversary violated their territorial boundaries and violated international law

More often than not the first state would have acted immediately upon the aggressive act and

16

AUACSCSinksAY08

would have prevented aggressors from completing their task by either forcing the aircraft to land

or turnaround or an even more escalated response of firing upon the aircraft In the air land or

sea the ability for a nationrsquos military forces to respond in a timely manner gives way to the

deterrence factor of not crossing a statersquos boundaries without receiving permission for fear of

reprisal A clear example of this was when Turkey denied the United States the ability deploy

the 4th Infantry Division from its borders at the beginning of Operation Iraqi Freedom Violating

Turkeyrsquos borders without permission would have brought about great repercussions that would

have made Operation Iraqi Freedom even more difficult and could have resulted in an escalation

of the war outside the Iraqi borders43 Another example is when Spain and France denied the

Unites States the use of their airspace when F-111s based in the United Kingdom conducted air

operations in Libya in an effort to eliminate Muammar Khadafy44

However the speeds at which these breeches in territorial boundaries occur make it

difficult for a nation to claim jurisdiction especially when nothing occurred within their

territorial sovereignty The cyber attacks didnrsquot result in any damage to nation as the information

packets passed through their sovereign borders According to territorial boundary description

described by Doctor Boczek the international community doesnrsquot consider the crossing the

border in of itself an act of warmdashserious damage is a driving factor in determining conflict

escalation In addition according to the territorial jurisdiction principle the cyber attack didnrsquot

threaten a nationrsquos security territorial integrity and political independence If the cyber attack or

information originated from within a sovereign territory by a third party then the two nations

would have to work together to resolve the issue and mutual jurisdiction would probably apply

However if the cyber attack didnrsquot physically manifest itself from within their sovereign

territory or the adversary didnrsquot use the nation as a staging area to launch a further attack the

17

AUACSCSinksAY08

international law and the jurisdiction principles would dictate the affected nation would have

jurisdiction

Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security

territorial integrity and political independence Cyberspace utilizes the other domains as a means

of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence

Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of

territorial sovereignty the Protective Security Principle does provide nations the ability to

enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos

sovereignty when it conducts cyber warfare operations However some elites donrsquot consider

cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense

International law specifically article 2 of the United Nations Charters states that a

members shall refrain in their international relations from the threat or use of force against the

territorial integrity or political independence of any state or in any other manner inconsistent

with the purposes of the United Nations which is intended to prohibit all types of force except

those carried out under the aegis of the United Nations or as provided for by the Security

Council45 The only exception to the United Nations Charters as it relates to the Use of Force is

the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed

attack46

International elites have discussed the term ldquouse of forcerdquo in the past because of the

development of chemical and biological weapons and had to move from a kinetic impact based

definition to a results-oriented approach47 Chemical and biological weapons lacked the

characteristic of an explosion or physical force yet these weapons certainly are capable of

destroying life and property Doctor Leigh Armistead a former information warfare instructor at

18

AUACSCSinksAY08

the Joint Forces Staff College cautions that the use of computer network attacks by the military

ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary

that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great

Russia introduced a proposal to the United Nations that banned the use of information

operations Even though the United Nations didnrsquot adopt the law the concern of international

community is fully aware of the impact cyber attacks can have on a nation

The concern over cyber warfare capabilities is that it can generate both non-kinetic and

kinetic effects There has always been the traditional kinetic solution for cyber warfare where a

precision guidance munition destroys a critical information system node Most people assume

computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos

computer system from the safety of onersquos own command and control center but the physical

destruction of a computer system or network by kinetic means also qualifies as cyber warfare

However cyber warfare has also evolved to the point where aggressors can achieve a kinetic

effect without the use of a traditional kinetic weapon A cyber attack on an information system

can shut down a particular node of a power plant causing the system to become inoperative

Even if there wasnrsquot an explosion the attack serves the same purpose

The question raised is do cyber attacks constitute an armed attack Scholars do agree that

some cyber attacks fit comfortably within the United Nations Charter For example a strategic

level cyber attack causing widespread damage and significant casualties would trigger the statersquos

right of self-defense In addition a cyber attack that precluded a conventional attack or a series

of cyber attacks causing significant damage would give a state the right of self-defense49 Few

would dispute that a country has the right under international law to respond with military force

19

AUACSCSinksAY08

if a state destroyed or significantly damaged another nationrsquos economic system for example the

New York or London stock exchanges

However some confusion and state-defined interpretation comes into play when the

frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard

Law School argues that cyber attacks require an expansion of the definition on the ldquouse of

forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot

be prohibited by international law50 International scholars recommend ldquoclearer rules of what

kinds of information warfare actions constitute an armed attackrdquo which drives permissible

responses of self-defense51 For example a state-sponsored cyber attack causes damage to a

victimrsquos factory or power plant however the nation claims the incident is an isolated instance

and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under

the United Nations Charter and the United Nations would consider any response retaliation

which would violate international law52

Another example involves a nation conducting a series of small attacks causing minimal

damage and then ceases Even though the aggressor used force to conduct cyber warfare

operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under

the United Nations Charter This type of attack is analogues to a small band of troops crossing a

border without causing significant damage53 According to the United Nations Charter the

national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders

and respond to the use of force Repelling the small band of troops and reestablishing their

sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration

of war and allies would have to respect the United Nations decision and couldnrsquot intervene The

same is true for the cyber attack A state can employ defensive measure to isolate and defeat the

20

AUACSCSinksAY08

incursion over the electromagnetic spectrum However the United Nations would see further

offensive operations or invasive operations as retaliation Therefore a nation must take the

incident whether it is signs of conventional forces on the ground or traces of cyber warfare

incursions in the electromagnetic spectrum to the United Nations to seek restitution

In both of these situations the international law becomes the target for change not

whether cyber warfare is in violation of international law If the law were to change the

international community would then consider the above situations acts of war even if an

adversary used conventional forces As written today the result of an operation remains the

driving factor in determining if an adversary has violated international law The means by which

an adversary conducts military operations may affect how nations react to the situation but

whether an adversary conducts the operation by means of the air land sea space or cyberspace

doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian

Triggs a public international lawyer and member of the Attorney General International Legal

Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over

offences abroad having an intended and substantial effect within a state may be justifiedrdquo54

Therefore the international community must evaluate the effect of a criminal act rather than the

means in which the act was committed

Others claim that because the Internet takes advantages of legal norms where non-state

actors can ignore Western notions of law55 more international laws are needed for cyberspace

However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using

other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the

Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked

aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts

21

AUACSCSinksAY08

against a staterdquo in the cyberspace domain The anonymity of the Internet and their total

disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and

national laws already exist in most countries that prohibit the use of the Internet for terrorist

activities therefore additional international laws wouldnrsquot prevent or deter terrorist from

committing such acts of aggression

International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed

Conflict includes the Martens Clause which extends established custom and humanitarian

principles to new technologies and addresses the ever-changing nature of warfare The

international community designed The Martens Clause ldquoto prevent future unnecessary andor

disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges

crimes by invoking the laws of humanity and public conscience hence their effects and not its

methods

The basic legal premise behind Law of Armed Conflict is that attacks must be limited to

military objectives and collateral damage must be proportionate to military advantages and

forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary

suffering but military commanders and planners need to be aware of the results a particular

action will invoke Russian leadership believes a computer network attack against their

homeland can be a means for executing a variety of escalating responses to include nuclear

attack58 Therefore it is imperative military commanders understand the impact any weapon

system can have on an adversary not just cyber attacks

Not all scholars agree that international law is insufficient to govern cyber warfare

Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace

and the Use of Force states that computer network attacks constitute an unlawful use of force in

22

AUACSCSinksAY08

cyberspace under traditional international law Sharp declared that an armed attack may occur

ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a

way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive

definition of cyber attacks may never be drafted59 The Congressional Research Service also

concluded that ldquothere is little likelihood that the international community will soon generate a

coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations

on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos

conclusion is that the effects of cyber warfare operations are the same as if an adversary

conducted conventional warfare operations where the effect of the attacks are the driving factors

in determining whether an adversary used force or not

The United States Government agrees with Sharprsquos conclusion The offensive

Information Operation strategy for the United States government as described by Doctor

Armistead ties the tools used to conduct military operations back to the desired effect which is

in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning

effects-based operations and operational art focus the Joint Force Commanderrsquos course of action

towards meeting objectives outlined in guidance provided by the National Command Authority

and senior military leadership62 Whether the tools are dropped pamphlets invasive network

attacks or bombs on targets the goal is to produce a desired effect to achieve the overall

objectives and cyber warfare can produce effects that challenge the national security of a nation

Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63

~General T Michael Moseley USAF

23

AUACSCSinksAY08

The cyberspace domain has been around for quite sometime but as technology continues

to advance businesses as well as governmental organizations are becoming more reliant on the

cyberspace domain With that reliance the protection of this critical domain becomes even more

important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the

electromagnetic spectrum by denying and disrupting information demands Scholars claim that

protection needs to include addressing existing international laws expanding them to incorporate

the ever-advancing capabilities emerging in the cyberspace domain

However territorial sovereignty of a nation and the principles of jurisdiction specifically

the Protective Security Principle give nations the right to exercise jurisdiction when an

aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64

While cyberspace is a domain requiring specific attention it relies on assets in the other domains

of land space sea and air in order to operate and international laws for the linear domains do

exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace

but during cyber warfare operations the principles behind the restrictions of foreign military

entering airspace do apply The strategic nature of cyber warfare operations correspond to the

same strategic impact that airpower can inflict upon a nation threatening their independence

While maybe not as dramatic as kinetic effects the results can be just as devastating

Space is relatively straightforward Since a nation canrsquot claim space and over flights of

foreign satellites over a nation is permissible nations must use space for peaceful purposes

Kinetic attacks against space assets are a violation of international law therefore nations would

consider cyber warfare operations against space assets as other than peaceful purposes and a

violation of international law Cyber attacks traversing space assets relate to current military

operations where the military uses space assets to conduct kinetic operations Since international

24

AUACSCSinksAY08

elites havenrsquot considered these kinetic operations as a breach of international law military

commanders can conduct cyber warfare operations through space without fear of violating

international laws for outer space

Crossing international borders without a nationrsquos permission and threatening their

sovereignty is a violation of international law While nations canrsquot consider all border crossings

as an act of war those acts of aggression that threaten the territorial integrity would elicit a

defensive response by the victim nation Whether incursions involve combat vehicles over a

highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are

threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not

have set foot in the nation but according the Protective Security Principle the victim nation has

jurisdiction

Conducting cyber warfare operations from the territorial sea is no different from

conducting operations from within a nationrsquos land or sea borders However the high seas are

very similar in nature to space in that they are reserved for peaceful purposes Therefore

conducting any means of warfare from within the high seas is a violation of international law

and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-

defense

According to Barkham ldquoinformation warfare attacks are in essence territorial

penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then

subject to the jurisdiction of the victim nation who then has the right for self-defense However

due to the global nature of cyberspace aggressors can cross multiple borders and determining

who has jurisdiction demands cooperation among nations The origin and any deliberate staging

locations of the cyber attack will drive who has jurisdiction The crossing of third party borders

25

AUACSCSinksAY08

by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the

aggressors threaten a nationrsquos independence or territorial integrity

Scholars consider cyber warfare operations that involve strategic and operational impacts

as being a means of using force and fall within the legal regime of existing international law

However scholars argue that because cyber warfare includes kinetic and non-kinetic results the

Use of Force definition needs expanding Yet they conclude that an exhaustive definition of

cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare

operations against existing case studies where the effects are evaluated as opposed to the means

even if the operations originated from outside the nationrsquos territorial jurisdiction There is some

authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to

have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade

non-state actors from conducting cyber warfare operations given their willingness to ignore

Western notions of war and their ability to conduct operations anonymously in cyberspace

International laws are in place to that address the ever-changing nature of warfare The

Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a

framework for addressing all warfare to include cyber warfare operations The international

community will need to measure the effects of an operation rather the means Whether its boots

on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a

nationrsquos response

26

AUACSCSinksAY08

End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)

27

AUACSCSinksAY08

44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

28

AUACSCSinksAY08

Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005

Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department

American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)

Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983

Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988

Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)

Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)

IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)

Joint Publication 3-13 Information Operations 13 February 2006

Joint Publication 5-0 Joint Operations Planning 26 December 2006

Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies

Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc

Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College

Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)

Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press

29

AUACSCSinksAY08

Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI

Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)

Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press

Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company

Detter Delupis I The law of war (2000) New York NY Cambridge University Press

Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)

Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College

Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor

Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)

Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)

Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf

Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)

Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College

Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College

Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)

Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA

30

AUACSCSinksAY08

Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)

Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)

Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College

Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology

Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College

Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)

OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center

OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College

OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications

Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991

Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College

Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center

Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)

31

AUACSCSinksAY08

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press

Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA

Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University

Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor

Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661

Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office

Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis

United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC

United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center

Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College

Wesley David C The Military Commander and the Law 2006

32

Page 5: Sinks 0407

AUACSCSinksAY08

Introduction We need to be able to think in terms of target effects I picture myself around that same targeting table where you have the fighter pilot the bomber pilot the special operations people and the information warrior As you go down the target list each one takes a turn raising his or her hand saying ldquoI can take that targetrdquo1

~ General (Retired) John P Jumper

The worldrsquos growing reliance on information technology to improve efficiency has

opened a threat to all who become reliant on cyberspace to conduct operationshellipa threat that has

many sources of predators ranging from pranksters to white-collar criminals to terrorists Yet

cyberspace has limited international laws to govern a worldwide domain that is ever expanding

as third world nations begin to invest in information technology and enter the cyberspace realm

to enhance business and military operations As nations begin to rely more on cyberspace as an

effective means of conducting business and military operations the more these operations will

become susceptible to outside aggressive influences whether itrsquos from economic invasions or

disruption of military operations

In addition the threat of military operations in the cyberspace domain is real The

Russian military has incorporated cyber warfare into their doctrine in order to gain information

advantage by affecting an adversaryrsquos information system decision-making processes command

and control and even the populace2 China is pursuing a battalion-sized force of computer

experts trained ldquoto carry out computer network attacks as a means of seeking asymmetrical

advantages over an adversaryrdquo3 The threat doesnrsquot reside just within state actors non-state

actors are incorporating cyber warfare operations into their realm of capabilities Hezbollah has

outlined a strategy to cripple the Israeli government by disrupting normal economic and societal

operations by targeting official websites crashing financial sites knocking out the internet

servers and targeting e-commerce sites4

In land sea and air battles military combatants can see the enemy coming whether itrsquos

1

AUACSCSinksAY08

the whites of their eyes or a blip on a screen International boundaries easily define when an

aggressor threatens the sovereignty of a nation giving the victim nation the right of jurisdiction

and there are specific international laws that address military operations in space In addition

the international community has defined when an adversaryrsquos use of force threatens a nationrsquos

territorial integrity and political independence

However the global nature of cyberspace and the speed of which victims can experience

cyber attacks force nations to deal with the legal challenges associated with over-the-horizon

military operations as commanders can experience battlefield affects with little or no warning

Moreover cyber attacks are much more difficult to define Jurisdiction over a cyber attack that

occurs 7000 miles away that crosses multiple physical domains and spans several international

borders compounds the legal issues surrounding an aggressive act that can have a wide-range of

effects Add the fact that determining the perpetrator proves to be less than speedy as most

cyber warriors can use the Internet ldquoanonymously or as a shell game to hide identitiesrdquo5 nations

face a very difficult task in attributing an aggressive act to a particular actor Responding to

asymmetric techniques tactics and procedures by state and non-state actors have proven to be

difficult for conventional forces Introducing asymmetric tactics in cyberspace presents nations

an even more challenging and complicated issue particularly in the legal regime

Therefore this paper will analyze the need for international guidance for conducting warfare

operations in the cyberspace domain This paper will define cyberspace and cyber warfare in an

effort to set the stage for illustrating the global nature of cyberspace and its reliance on the other

physical domains to conduct military operations The paper will define the international law as it

relates to territorial boundaries and outline the jurisdiction principles that allow a nation to act

against an adversary This paper outlines the definition of the Use of Force and how it

2

AUACSCSinksAY08

corresponds to the cyberspace domain and cyber warfare and with the final discussion centered

on the international laws that already exist which help shape international law for cyberspace

What is Cyber Warfare Very few of the new manifestations in war can be ascribed to new inventions or new departures in ideas6

~Carl Von Clausewitz

Defining Cyberspace William Gibson coined the term ldquocyberspacerdquo in his 1984 novel Neuromancer in order to

describe ldquoa shared virtual environment whose inhabitants objects and spaces comprise data that

is visualized heard and touchedrdquo7 However the most common of definitions today refer to the

Internet or the World Wide Web and usually consists of an information-sharing environment

between computers8 However the military has defined cyberspace to advocate a worldwide

spectrum of more than just information sharing among computers

In the National Military Strategy for Cyberspace Operations cyberspace is defined as a

domain characterized by the use of electronics and the electromagnetic spectrum to store

modify and exchange data via networked systems and associated physical infrastructure9 Joint

doctrine has adopted a computer-centric definition where cyberspace is ldquothe notional

environment in which digitized information is communicated over networksrdquo10 The National

Military Strategy and joint doctrine definitions advocate a worldwide information environment

that isnrsquot limited to the Internet or to just computers Matter of fact the expanded definitions

suggest that cyberspace consists of all networks to include highly sensitive military

governmental and commercial networks that may or may not use commercial means to store

modify and exchange data These systems include exchange networks like tactical digital

information links (TADIL) links between command and control platforms and air ground and

sea weapon systems In addition because the definition includes the electromagnetic spectrum

3

AUACSCSinksAY08

cyberspace includes ldquocapabilities that are currently considered electronic warfarerdquo11 which Great

Britain exploited in World War II when they introduced radar technology in World War II and is

still applicable with communication and navigational jamming capabilities used in todayrsquos

conflicts

While cyberspace is a unique domain that military commanders must protect in order to

conduct operations more effectively and offers commanders another dimension in which to

exploit weaknesses in an adversaryrsquos ability to project power cyberspace doesnrsquot exist on its

own According to Lt Col Fahrenkreg in the published Air University article title Cyberspace

Define ldquocyberspace exists across the other domains of air land sea and spacerdquo12 There are

clear delineations between the sea land and air Commanders know where the land ends and the

sea begins While there are some discussions as to where airspace ends and space begins the

capabilities and roles associated with each domain are clear Therefore to depict cyberspace as

an autonomous domain is unrealistic as the physical infrastructure of cyberspace and the means

of sharing information within the cyberspace domain resides in one or more of the four linear

domains

What Cyberspace is Not The most confused notion about cyberspace is that information operations and

cyberspace are one in the same Joint Publication 3-13 Information Operations describes the

information environment as a collection of leaders decision makers and systems that process

collect disseminate or act on information consisting of three dimensions the physical

informational and cognitive dimensions13 The goal of information operations is to influence the

cognitive dimension by affecting the decision-making process known affectionately by the Air

Force as the OODA Loop (Observe Orient Decide and Act)14 By disrupting and corrupting

4

AUACSCSinksAY08

information processes military commanders can influence or usurp adversarial human and

automated decision making in the physical and informational dimensions

As stated by Lt Col Fahrenkreg the confusion between cyberspace and information

operations comes from the misunderstanding of cyberspace as an operation rather than a

domain15 Information operation is a capability available to the combatant commander to

generate an effect in one of the five domains It just so happens that cyberspace tends to be the

primary means of delivering the Information Operation capability

Cyberspace connects the physical dimensions with the cognitive process and is a means

to create effects to include disrupting degrading denying the enemy the use of strategic and

operational assets to include command and controls systems power plants telecommunications

and other like targets to affect a statersquos operational and strategic centers of gravity Cyberspace

isnrsquot information or the data residing on a computer but is the means in which users transfer

store or modify information Cyberspace isnrsquot the data sent to a precision guided munition but

the means in which the originator passes the information Cyberspace is the digital super

highway of the electromagnetic spectrum with the ones zeros and electrons as the passengers

Defining Cyber Warfare According to the Institute for Advanced Study of Information Warfare (ASIW) cyber

warfare has become a form of information warfare which ASIW defines as ldquothe offensive and

defensive use of information and information systems to deny exploit corrupt or destroy and

adversaryrsquos information information-based processes information systems and computer-based

networks while protecting onersquos own Such actions are designed to achieve advantages over

military adversariesrdquo16 While this definition doesnrsquot specifically address the electromagnetic

spectrum the definition focuses on information-sharing systems which is where crux of the

cyberspace domain revolves around

5

AUACSCSinksAY08

Joint doctrine defines cyber warfare as those areas of operations that affect the

electromagnetic spectrum to include Computer Network Operations and Electronic Warfare

which are two of the five core operational capabilities of Information Operations Electronic

warfare operations operates across ldquoradio visible micro directed energy and all other

frequenciesrdquo and overlaps with network warfare operations which include ldquoradio nets satellite

links tactical digital information links (TADIL) telemetry digital track files

telecommunications and wireless communication network and systemsrdquo all of which operate

within the electromagnetic spectrum17

Cyber warfare consists of defensive and offensive operations Defensive operations

arenrsquot limited to severing connections or blocking attempts of an adversary trying to corrupt data

modify transmissions or destroy information systems Defensive operations include the

elimination of the adversaryrsquos capability of conducting operations which may involve crossing

sovereign borders in order to complete the task However defensive network operations come in

more than just one form The movies portray computer experts hovering over computers trying

to affect each otherrsquos operations However cyber warfare includes the use of traditional kinetic

effect to disrupt computer network operations of the enemy as a fighter-bomber delivering a

500-pound bomb to destroy a vital mode in a computer network may serve the same purpose as a

computer-centric network attack While this isnrsquot as sexy as a network attack that spans the

globe to degrade the enemyrsquos ability operation within the cyberspace domain the effects are the

same

Territorial Sovereignty In total war it is quite impossible to draw any precise line between military and non-military problems18

~Sir Winston Churchill

6

AUACSCSinksAY08

Cyberspace is certainly a domain that requires unique attention in order for commanders

to effectively and efficiently prosecute combat operations Cyberspace spans the globe using

the physical infrastructure residing within the other linear domains As users pass information

from one site to another data crosses boundaries by means of the cyberspace domain Data

leaves the Iraq area of operation via satellite to a receiving site in Germany Operators route the

information to the United States either through another satellite or by ground to sea-based cables

bound for computer nodes within the United States before arriving in South Carolina where

automated network tools redirect the information to the receiverrsquos location

An adversary attempting to modify corrupt or destroy this information traveling within

the cyberspace domain would at one time or another would cross sovereign borders through air

land sea or space The adversaryrsquos physical presence may not apply as they could conduct

operations from the comforts of their home however a nation could detect the adversaryrsquos

digital presence and could feel the impact of their actions from within their sovereign borders

Therefore as these adversaries span the globe using the cyberspace domain that relies on the

other linear domains to exist does international law apply when boundaries are crossed The

following sections will address the international laws of each physical domain and evaluate how

their principles apply to the cyberspace domain

Airspace Airspace as defined by Doctor Boleslaw A Boczek the internationally renowned expert

on international law ldquois the air pillow above the subjacent territoryrdquo to include ldquoairspace above

international waters and the territorial seardquo The airspace is under complete and exclusive

sovereignty of the subject state19 With that states have jurisdiction over their airspace and

require identification of foreign aircraft along with their intentions According to Dr Boczek

book International Law A Dictionary ldquoentry of national spacehellipmay take place only with the

7

AUACSCSinksAY08

authorization of the territorial staterdquo20 and currently only applies to aircraft Entry into the

airspace would require ldquoall aircraft to identify themselves file flight plans and report their

positionrdquo According to the 1944 Chicago Convention on International Civil Aviation nations

can enter into agreements that allow scheduled international civil air services which usually

include reciprocal agreements covering routes volume and other matters relating to air traffic

However these agreements only apply to civil aviation where state aircraft which include

aircraft belonging to the military customs public services and heads of states must follow more

restrictive procedures upon entering the airspace of a foreign nation21

There are several incidents where states have evoked their right for defending their

national security like the shooting down of a US military reconnaissance aircraft over Soviet

airspace by the Soviet Union in 196022 or the shooting down by Soviet fighter planes of a South

Korean airliner in 198323 The Soviet Union isnrsquot the only nation to protect its airspace as the

United States was responsible for shooting down an Iranian airliner thought to be an attacking

military plane over the Persian Gulf in 198824 These examples illustrate a nationrsquos sovereign

resolve to protect itself when a suspected adversary violated their airspace

Applying international law of airspace to cyberspace doesnrsquot seem too practical Civilian

signals entering a nationrsquos airspace would require nations to enter into agreements to allow

scheduled services and the persons receiving information through airspace would have to be

non-state sponsored Nationrsquos could regulate some cyberspace networks entering airspace like

radio communications that primarily use land-based infrastructure to function However the

very nature of computer networks and the ever-increasing global reach of communication

capabilities severely restrict a nationrsquos ability to monitor the millions of transmissions made on a

daily basis and these signals certainly wouldnrsquot be on any scheduled basis Therefore even if

8

AUACSCSinksAY08

nations made agreements concerning the cyberspace domain nations would have a difficult time

enforcing their terms of agreements unless the terms are very open-ended If they were so open-

ended then the agreement may not be necessary and based on my research nations realize the

futility of establishing these agreements as this author couldnrsquot find any reference to any

agreements that nations have entered into referencing the cyberspace domain

While the international law for civilian aircraft in airspace may not relate well or isnrsquot

feasible to enforce in the cyberspace domain does a nation have that same right to protect itself

from a suspected attack from cyberspace where the attackerrsquos signal enters airspace Does a

nation have the right to ldquoshoot downrdquo a cyberspace attack as it enters their domain through

airspace The whole idea behind restricting airspace from foreign military aircraft is because of

the strategic impact military aircraft can have on a nation As demonstrated in World War II

military aircraft carrying weapons of mass destruction can decimate cities and destroy a nation

with minimal effort The effects generated by military aircraft are quite destructive and garner

specific attention While an aircraft in of itself is relatively harmless the actions taken by the

crew can lead to devastating results

The same is true for cyber attacks The information passing through airspace in the

cyberspace domain is the vehicle however the crew conducting the operation is potentially

creating the same strategic results The cyber attack may not destroy cities but it certainly can

be destructive to a nationrsquos well-being by crippling power sources economic industries water

supply etc all at the blink of an eye while the victim takes several days to determine the

perpetrator Therefore while the international law for airspace may not be specifically relevant

the underlying principles are applicable as cyber attacks can have the same potential strategic

impact as an attack from a military aircraft

9

AUACSCSinksAY08

Space Outer space as defined by Doctor Boczek ldquois the space beyond the air surrounding the

earthrdquo As of 2005 international law doesnrsquot define a demarcation between airspace and outer

space but ldquostates agree that state sovereignty doesnrsquot extend without any limitsrdquo25 Proposals of

where airspace ends and when outer space begins are base on various scientific and technological

criteria (gravitational pull capabilities of air breathing aircraft etc26) Others scientists argue

that defining a boundary between airspace and outer space isnrsquot necessary as it would hinder the

progress of space technology and the legal status would depend on the nature of the activity

While no boundary exists airspace is finite and activity in outer space follows four

fundamentals principles First over flights of foreign satellites over a nation is permissible as

airspace doesnrsquot extend forever Second space ldquointernational law applies to outer space and

celestial bodiesrdquo Third according to the Outer Space Treaty of 1967 states canrsquot claim celestial

bodies or outer space which are not subject to national appropriation therefore are free for use

by all states Finally states must use outer space exclusively for peaceful purposes with specific

bans on weapons of mass destruction However states can use space for other military purposes

like intelligence surveillance and reconnaissance activities 27

Are these international laws and principles applicable to cyberspace Satellites are

certainly an integral part of the space domain Operators control satellites by using the

cyberspace domain and information passes between satellites and ground stations One can

argue that space is a sub-set of the cyberspace domain with satellites serving as computers in

space Global positioning system devices in vehicles interact with satellites all through an

elaborate network as part of the electromagnetic spectrum known as cyberspace Therefore

cyberspace is in space with millions of people using cyberspace everyday

10

AUACSCSinksAY08

The military uses space assets for intelligence surveillance and reconnaissance

knowledge management and command and control Agencies like the National Reconnaissance

Office and National Geospatial-Intelligence Agency obtain high-altitude imagery using a variety

of capabilities to include heat signature resonation Satellites can detect missile launches which

provide vital military information to senior leaders tasked with the security of their nation The

military networks to include decision briefs tasks and emails in Iraq and the Predator feeds in

Afghanistan travel through military and commercial satellites with all the information flowing

through the cyberspace domain With the heavy reliance of cyberspace to operate space assets

and the demands of information flowing through space by businesses it should come as no

surprise that space is a vital component for day-to-day operations of the military

Since cyberspace is an inherent component for space operations it is logical to assume

international law for outer space is applicable to cyberspace as long as an aggressor doesnt

violate the four premises and as long as weapons of mass destruction arenrsquot ldquostationed in outer

spacerdquo 28 Therefore a state would consider a cyber attack against a satellite as other than for

peaceful purposes and according to the fourth premise international law would apply

However what about a cyber attack using satellites as a means of conducting operations

Under todayrsquos current operations international elites havenrsquot considered a cyber attack passing

through space as a violation of international law When a senior leader in Qatar approves a

target set that is executed by a pilot in Nevada by an aircraft in Afghanistan all this information

is transmitted by cyberspace through space The result is that an aircraft renders an air or ground

target inoperable The effect is the same for cyberspace The information flows through space

by way of the cyberspace domain and the result is that an operator has rendered a target

11

AUACSCSinksAY08

inoperable As with airspace the information isnrsquot the cause of the damage but what an operator

does with the information is what constitutes the cyber attack

Land Cyber attacks using resources over land is relatively straightforward International

boundaries are defined as ldquoimaginary lines which separate territorial sovereigntyrdquo 29 which are

mutually agreed upon via international treaties Crossing an international border without

permission from the state is a violation of international law While an illegal immigrant crossing

a border to seek an opportunity to provide for his family is a violation of national law the United

Nation considers a nation-sponsored invasion of another nation that threatens the security and

stability of a nation as a breach in international law and an act of war

However international law doesnrsquot consider all border crossings as an act of war For

example when Nicaraguan troops and arms allegedly crossed the borders of El Salvador the

United Nations determined that incursions didnrsquot threaten El Salvadorrsquos territorial integrity and

stated that neither ldquothese incursions nor the alleged supply of arms may be relied upon as

justifying the exercise of the right of collective self-defenserdquo30 The victim state can repelled the

aggressive act but the United Nations Council wouldnrsquot condone any further military action

taken against the adversary opting for diplomatic or economic solution instead

Does international law apply when an adversary crosses international borders using

cyberspace as the means for conducting warfare operations When an adversarial state crosses a

statersquos boundaries using roads or bridges that connect the two nations the road is the resource

spanning the two nations If the adversary doesnrsquot do anything then returns to their sovereign

borders the aggressor hasnrsquot violated international law However when the adversary uses

weapon systems to affect serious damage the adversary has broken international law and a

12

AUACSCSinksAY08

nation may invoke their right for self-defense and may conduct full-scale operations to neutralize

the threat

A parallel notion is when an adversary uses a copper or fiber optic connection that spans

between two nations The adversary uses the land-based LAN connection as a means for

conducting cyber warfare operations The adversary may cross the borders using cyberspace yet

do nothing The affected state may push the adversary back to its borders but no further actions

are deemed appropriate However once the adversary uses the information transmitted over

cyberspace to cause severe operational or strategic damage the affected state now has the right

of self-defense Cyberspace is the means like the road or bridge for which the adversary

delivered the weapon The affected nation will consider the execution of the adversaryrsquos

information packet or weapon system as an act of aggression and the effect caused by the

weapon is what breeches international law

The difference between these two scenarios is that the adversary using the

electromagnetic spectrum hasnrsquot physically invaded a nationrsquos sovereign borders However

their digital presence crossed sovereign borders and as latter discussed in the paper adversaries

committing an act aggression against a state are now under the jurisdiction of the affected state

Sea ldquoThe territorial sea is a belt of sea adjacent to the (statersquos) coasthellipto include the airspace

aboverdquo as well as the seabed and subsoil31 The territorial sea is subject to the right of innocent

passage by foreign shops giving states the right to transport goods and passengers between ports

All of which is subject to the full sovereignty of the state which according to the United Nations

Convention on the Law of the Sea in 1982 and agreed upon by the majority of its membership in

1982 extends 12 miles from the coast32 The jurisdiction includes crimes where the

consequences extend to the coastal state and disturbs the peace of the country33 A cyber attack

13

AUACSCSinksAY08

conducted within the territorial sea of a nation would be no different from a cyber attack

conducted from within the nationrsquos land borders therefore cyber attacks against a state or even

another state conducted within the territorial seas are subject to current international laws Cyber

attacks originating outside the statersquos sovereign borders but results in affecting a statersquos

resources in their territorial seas would fall under the land and airspace breeches of territorial

sovereignty and would be subject to international law

The high seas on the other hand arenrsquot subject to the sovereignty of any one state The

high seas extend beyond the territorial sea and include the airspace the seabed and the subsoil34

and all states have the right to exercise freedoms on the high seas35 As similarly defined in

space ldquothe high seas shall be reserved for peaceful purposesrdquo as stated by Article 88 of the Law

of the Seas Cooperative36 which is defined as refraining from any threat or use of force (outside

of wartime conflicts)

The very nature of a cyber attack in the high seas lends itself to be a violation of

international law as nations are restricted to conducting peaceful operations in the high seas

The question is whom has jurisdiction of crimes committed in the high seas By applying the

Protective Security Principle of Jurisdiction where an actor threatens a statersquo security and

introducing the United Nationrsquos definition on the Illegal Use of Force extends to the high seas

and for that matter space giving states the right for self-defense as defined by the United Nations

as ldquoan armed attackrdquo The sheer name of cyber attack doesnrsquot immediately lend itself to an

ldquoarmedrdquo cyber attack However the effects generated from a cyber attack can be equivalent to a

traditional conventional attack and the international law would permit a state to take appropriate

countermeasures while notifying the United Nations Security Council37

14

AUACSCSinksAY08

Applying International Law to Cyber Warfare Today we live in an Information Age where communication through cyberspace has forever changed and flattened out worldhellipOur adversaries seek to operate from behind technical legal and international screens as they execute their costly attacks38

~General James E Cartwright Commander United States Strategic Command

Jurisdiction

Understanding the territorial sovereignty principles of a nation is important in applying

cyberspace and cyber warfare to existing international laws While some of these principles and

international laws may not be relevant for the cyberspace domain due to the far-reaching

capability of cyber warfare the jurisdiction of a nation further defines its ability to respond to

aggressive acts by nations in the cyberspace domain There are three jurisdictional principles

that provide nations the right to pursue aggressors that threaten a nationrsquos independence the

Territorial Principle Nationality Principle and the Protective Security Principle

For actions originating within the state the jurisdiction clearly falls within the territorial

principle where a ldquostate has jurisdiction over all crimes committed in its territoryhellipto include

airspace international waters and territorial seasrdquo39 The territorial jurisdiction is subject to

exceptions when dealing with persons from foreign states as in the most popular example of

immunity given to foreign diplomats In this case ldquostates may exercise jurisdiction over its

citizenhellipeven if they are physically outside the statesrsquo territoryrdquo as Doctor Boczek defines as the

Nationality Principle Nations usually agree upon on these concessions states prior to the offense

being committed40

Doctor Boczek defines the Protective Security Principle as a ldquojurisdictional principle

whereby a state my assume jurisdiction over and punish foreign nationals for certain conduct

outside its territory which is directed against its security territorial integrity and political

independencerdquo41 Some states would argue that criticism of a state or government is applicable

15

AUACSCSinksAY08

in applying this principle of jurisdiction However this is too broad of an interpretation and

should be confined to acts that are more tangible in nature like falsification of a statesrsquo official

documents conspiracy to violate immigration of custom laws and illicit drug trafficking42

Would a cyber attack that is deemed to challenge a nationrsquos banking community or bring

down a power source be a direct attack against its security and political independence The

international community easily sees the attack of a power source with kinetic weapons as a

violation of a territorial boundary and a breech of international law The United States viewed

the attack on the Trade Towers as an act of war launching the Global War on Terrorism Would

the United States have viewed the same devastation as if the attack occurred through cyberspace

Would the attack have been less of an act of war if the aggressor remotely controlled domestic

airliners from a foreign country Probably not What happens if the cyber attack caused a fire in

the lower floors of the buildings preventing people from escaping While less dramatic than an

airbus flying into the middle of the towers and maybe more difficult to demonize the crime the

result is the samemdashinnocent people suffering as a result of an adversary trying to threaten a

nationrsquos security

What happens if the suspected cyber attack has violated a nationrsquos territorial boundary in

order to attack a neighboring country or an ally Going from point A to point B in cyberspace is

rarely a direct connection As with the global nature of cyberspace itrsquos conceivable that

adversaries cross several nationsrsquo boundaries to conduct cyber attack operations The question

generated is who has jurisdiction

If the actor committing the crime had used an airplane each nation could claim

jurisdiction as the adversary violated their territorial boundaries and violated international law

More often than not the first state would have acted immediately upon the aggressive act and

16

AUACSCSinksAY08

would have prevented aggressors from completing their task by either forcing the aircraft to land

or turnaround or an even more escalated response of firing upon the aircraft In the air land or

sea the ability for a nationrsquos military forces to respond in a timely manner gives way to the

deterrence factor of not crossing a statersquos boundaries without receiving permission for fear of

reprisal A clear example of this was when Turkey denied the United States the ability deploy

the 4th Infantry Division from its borders at the beginning of Operation Iraqi Freedom Violating

Turkeyrsquos borders without permission would have brought about great repercussions that would

have made Operation Iraqi Freedom even more difficult and could have resulted in an escalation

of the war outside the Iraqi borders43 Another example is when Spain and France denied the

Unites States the use of their airspace when F-111s based in the United Kingdom conducted air

operations in Libya in an effort to eliminate Muammar Khadafy44

However the speeds at which these breeches in territorial boundaries occur make it

difficult for a nation to claim jurisdiction especially when nothing occurred within their

territorial sovereignty The cyber attacks didnrsquot result in any damage to nation as the information

packets passed through their sovereign borders According to territorial boundary description

described by Doctor Boczek the international community doesnrsquot consider the crossing the

border in of itself an act of warmdashserious damage is a driving factor in determining conflict

escalation In addition according to the territorial jurisdiction principle the cyber attack didnrsquot

threaten a nationrsquos security territorial integrity and political independence If the cyber attack or

information originated from within a sovereign territory by a third party then the two nations

would have to work together to resolve the issue and mutual jurisdiction would probably apply

However if the cyber attack didnrsquot physically manifest itself from within their sovereign

territory or the adversary didnrsquot use the nation as a staging area to launch a further attack the

17

AUACSCSinksAY08

international law and the jurisdiction principles would dictate the affected nation would have

jurisdiction

Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security

territorial integrity and political independence Cyberspace utilizes the other domains as a means

of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence

Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of

territorial sovereignty the Protective Security Principle does provide nations the ability to

enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos

sovereignty when it conducts cyber warfare operations However some elites donrsquot consider

cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense

International law specifically article 2 of the United Nations Charters states that a

members shall refrain in their international relations from the threat or use of force against the

territorial integrity or political independence of any state or in any other manner inconsistent

with the purposes of the United Nations which is intended to prohibit all types of force except

those carried out under the aegis of the United Nations or as provided for by the Security

Council45 The only exception to the United Nations Charters as it relates to the Use of Force is

the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed

attack46

International elites have discussed the term ldquouse of forcerdquo in the past because of the

development of chemical and biological weapons and had to move from a kinetic impact based

definition to a results-oriented approach47 Chemical and biological weapons lacked the

characteristic of an explosion or physical force yet these weapons certainly are capable of

destroying life and property Doctor Leigh Armistead a former information warfare instructor at

18

AUACSCSinksAY08

the Joint Forces Staff College cautions that the use of computer network attacks by the military

ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary

that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great

Russia introduced a proposal to the United Nations that banned the use of information

operations Even though the United Nations didnrsquot adopt the law the concern of international

community is fully aware of the impact cyber attacks can have on a nation

The concern over cyber warfare capabilities is that it can generate both non-kinetic and

kinetic effects There has always been the traditional kinetic solution for cyber warfare where a

precision guidance munition destroys a critical information system node Most people assume

computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos

computer system from the safety of onersquos own command and control center but the physical

destruction of a computer system or network by kinetic means also qualifies as cyber warfare

However cyber warfare has also evolved to the point where aggressors can achieve a kinetic

effect without the use of a traditional kinetic weapon A cyber attack on an information system

can shut down a particular node of a power plant causing the system to become inoperative

Even if there wasnrsquot an explosion the attack serves the same purpose

The question raised is do cyber attacks constitute an armed attack Scholars do agree that

some cyber attacks fit comfortably within the United Nations Charter For example a strategic

level cyber attack causing widespread damage and significant casualties would trigger the statersquos

right of self-defense In addition a cyber attack that precluded a conventional attack or a series

of cyber attacks causing significant damage would give a state the right of self-defense49 Few

would dispute that a country has the right under international law to respond with military force

19

AUACSCSinksAY08

if a state destroyed or significantly damaged another nationrsquos economic system for example the

New York or London stock exchanges

However some confusion and state-defined interpretation comes into play when the

frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard

Law School argues that cyber attacks require an expansion of the definition on the ldquouse of

forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot

be prohibited by international law50 International scholars recommend ldquoclearer rules of what

kinds of information warfare actions constitute an armed attackrdquo which drives permissible

responses of self-defense51 For example a state-sponsored cyber attack causes damage to a

victimrsquos factory or power plant however the nation claims the incident is an isolated instance

and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under

the United Nations Charter and the United Nations would consider any response retaliation

which would violate international law52

Another example involves a nation conducting a series of small attacks causing minimal

damage and then ceases Even though the aggressor used force to conduct cyber warfare

operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under

the United Nations Charter This type of attack is analogues to a small band of troops crossing a

border without causing significant damage53 According to the United Nations Charter the

national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders

and respond to the use of force Repelling the small band of troops and reestablishing their

sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration

of war and allies would have to respect the United Nations decision and couldnrsquot intervene The

same is true for the cyber attack A state can employ defensive measure to isolate and defeat the

20

AUACSCSinksAY08

incursion over the electromagnetic spectrum However the United Nations would see further

offensive operations or invasive operations as retaliation Therefore a nation must take the

incident whether it is signs of conventional forces on the ground or traces of cyber warfare

incursions in the electromagnetic spectrum to the United Nations to seek restitution

In both of these situations the international law becomes the target for change not

whether cyber warfare is in violation of international law If the law were to change the

international community would then consider the above situations acts of war even if an

adversary used conventional forces As written today the result of an operation remains the

driving factor in determining if an adversary has violated international law The means by which

an adversary conducts military operations may affect how nations react to the situation but

whether an adversary conducts the operation by means of the air land sea space or cyberspace

doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian

Triggs a public international lawyer and member of the Attorney General International Legal

Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over

offences abroad having an intended and substantial effect within a state may be justifiedrdquo54

Therefore the international community must evaluate the effect of a criminal act rather than the

means in which the act was committed

Others claim that because the Internet takes advantages of legal norms where non-state

actors can ignore Western notions of law55 more international laws are needed for cyberspace

However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using

other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the

Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked

aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts

21

AUACSCSinksAY08

against a staterdquo in the cyberspace domain The anonymity of the Internet and their total

disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and

national laws already exist in most countries that prohibit the use of the Internet for terrorist

activities therefore additional international laws wouldnrsquot prevent or deter terrorist from

committing such acts of aggression

International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed

Conflict includes the Martens Clause which extends established custom and humanitarian

principles to new technologies and addresses the ever-changing nature of warfare The

international community designed The Martens Clause ldquoto prevent future unnecessary andor

disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges

crimes by invoking the laws of humanity and public conscience hence their effects and not its

methods

The basic legal premise behind Law of Armed Conflict is that attacks must be limited to

military objectives and collateral damage must be proportionate to military advantages and

forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary

suffering but military commanders and planners need to be aware of the results a particular

action will invoke Russian leadership believes a computer network attack against their

homeland can be a means for executing a variety of escalating responses to include nuclear

attack58 Therefore it is imperative military commanders understand the impact any weapon

system can have on an adversary not just cyber attacks

Not all scholars agree that international law is insufficient to govern cyber warfare

Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace

and the Use of Force states that computer network attacks constitute an unlawful use of force in

22

AUACSCSinksAY08

cyberspace under traditional international law Sharp declared that an armed attack may occur

ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a

way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive

definition of cyber attacks may never be drafted59 The Congressional Research Service also

concluded that ldquothere is little likelihood that the international community will soon generate a

coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations

on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos

conclusion is that the effects of cyber warfare operations are the same as if an adversary

conducted conventional warfare operations where the effect of the attacks are the driving factors

in determining whether an adversary used force or not

The United States Government agrees with Sharprsquos conclusion The offensive

Information Operation strategy for the United States government as described by Doctor

Armistead ties the tools used to conduct military operations back to the desired effect which is

in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning

effects-based operations and operational art focus the Joint Force Commanderrsquos course of action

towards meeting objectives outlined in guidance provided by the National Command Authority

and senior military leadership62 Whether the tools are dropped pamphlets invasive network

attacks or bombs on targets the goal is to produce a desired effect to achieve the overall

objectives and cyber warfare can produce effects that challenge the national security of a nation

Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63

~General T Michael Moseley USAF

23

AUACSCSinksAY08

The cyberspace domain has been around for quite sometime but as technology continues

to advance businesses as well as governmental organizations are becoming more reliant on the

cyberspace domain With that reliance the protection of this critical domain becomes even more

important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the

electromagnetic spectrum by denying and disrupting information demands Scholars claim that

protection needs to include addressing existing international laws expanding them to incorporate

the ever-advancing capabilities emerging in the cyberspace domain

However territorial sovereignty of a nation and the principles of jurisdiction specifically

the Protective Security Principle give nations the right to exercise jurisdiction when an

aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64

While cyberspace is a domain requiring specific attention it relies on assets in the other domains

of land space sea and air in order to operate and international laws for the linear domains do

exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace

but during cyber warfare operations the principles behind the restrictions of foreign military

entering airspace do apply The strategic nature of cyber warfare operations correspond to the

same strategic impact that airpower can inflict upon a nation threatening their independence

While maybe not as dramatic as kinetic effects the results can be just as devastating

Space is relatively straightforward Since a nation canrsquot claim space and over flights of

foreign satellites over a nation is permissible nations must use space for peaceful purposes

Kinetic attacks against space assets are a violation of international law therefore nations would

consider cyber warfare operations against space assets as other than peaceful purposes and a

violation of international law Cyber attacks traversing space assets relate to current military

operations where the military uses space assets to conduct kinetic operations Since international

24

AUACSCSinksAY08

elites havenrsquot considered these kinetic operations as a breach of international law military

commanders can conduct cyber warfare operations through space without fear of violating

international laws for outer space

Crossing international borders without a nationrsquos permission and threatening their

sovereignty is a violation of international law While nations canrsquot consider all border crossings

as an act of war those acts of aggression that threaten the territorial integrity would elicit a

defensive response by the victim nation Whether incursions involve combat vehicles over a

highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are

threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not

have set foot in the nation but according the Protective Security Principle the victim nation has

jurisdiction

Conducting cyber warfare operations from the territorial sea is no different from

conducting operations from within a nationrsquos land or sea borders However the high seas are

very similar in nature to space in that they are reserved for peaceful purposes Therefore

conducting any means of warfare from within the high seas is a violation of international law

and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-

defense

According to Barkham ldquoinformation warfare attacks are in essence territorial

penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then

subject to the jurisdiction of the victim nation who then has the right for self-defense However

due to the global nature of cyberspace aggressors can cross multiple borders and determining

who has jurisdiction demands cooperation among nations The origin and any deliberate staging

locations of the cyber attack will drive who has jurisdiction The crossing of third party borders

25

AUACSCSinksAY08

by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the

aggressors threaten a nationrsquos independence or territorial integrity

Scholars consider cyber warfare operations that involve strategic and operational impacts

as being a means of using force and fall within the legal regime of existing international law

However scholars argue that because cyber warfare includes kinetic and non-kinetic results the

Use of Force definition needs expanding Yet they conclude that an exhaustive definition of

cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare

operations against existing case studies where the effects are evaluated as opposed to the means

even if the operations originated from outside the nationrsquos territorial jurisdiction There is some

authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to

have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade

non-state actors from conducting cyber warfare operations given their willingness to ignore

Western notions of war and their ability to conduct operations anonymously in cyberspace

International laws are in place to that address the ever-changing nature of warfare The

Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a

framework for addressing all warfare to include cyber warfare operations The international

community will need to measure the effects of an operation rather the means Whether its boots

on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a

nationrsquos response

26

AUACSCSinksAY08

End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)

27

AUACSCSinksAY08

44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

28

AUACSCSinksAY08

Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005

Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department

American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)

Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983

Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988

Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)

Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)

IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)

Joint Publication 3-13 Information Operations 13 February 2006

Joint Publication 5-0 Joint Operations Planning 26 December 2006

Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies

Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc

Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College

Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)

Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press

29

AUACSCSinksAY08

Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI

Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)

Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press

Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company

Detter Delupis I The law of war (2000) New York NY Cambridge University Press

Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)

Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College

Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor

Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)

Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)

Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf

Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)

Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College

Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College

Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)

Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA

30

AUACSCSinksAY08

Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)

Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)

Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College

Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology

Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College

Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)

OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center

OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College

OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications

Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991

Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College

Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center

Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)

31

AUACSCSinksAY08

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press

Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA

Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University

Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor

Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661

Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office

Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis

United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC

United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center

Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College

Wesley David C The Military Commander and the Law 2006

32

Page 6: Sinks 0407

AUACSCSinksAY08

the whites of their eyes or a blip on a screen International boundaries easily define when an

aggressor threatens the sovereignty of a nation giving the victim nation the right of jurisdiction

and there are specific international laws that address military operations in space In addition

the international community has defined when an adversaryrsquos use of force threatens a nationrsquos

territorial integrity and political independence

However the global nature of cyberspace and the speed of which victims can experience

cyber attacks force nations to deal with the legal challenges associated with over-the-horizon

military operations as commanders can experience battlefield affects with little or no warning

Moreover cyber attacks are much more difficult to define Jurisdiction over a cyber attack that

occurs 7000 miles away that crosses multiple physical domains and spans several international

borders compounds the legal issues surrounding an aggressive act that can have a wide-range of

effects Add the fact that determining the perpetrator proves to be less than speedy as most

cyber warriors can use the Internet ldquoanonymously or as a shell game to hide identitiesrdquo5 nations

face a very difficult task in attributing an aggressive act to a particular actor Responding to

asymmetric techniques tactics and procedures by state and non-state actors have proven to be

difficult for conventional forces Introducing asymmetric tactics in cyberspace presents nations

an even more challenging and complicated issue particularly in the legal regime

Therefore this paper will analyze the need for international guidance for conducting warfare

operations in the cyberspace domain This paper will define cyberspace and cyber warfare in an

effort to set the stage for illustrating the global nature of cyberspace and its reliance on the other

physical domains to conduct military operations The paper will define the international law as it

relates to territorial boundaries and outline the jurisdiction principles that allow a nation to act

against an adversary This paper outlines the definition of the Use of Force and how it

2

AUACSCSinksAY08

corresponds to the cyberspace domain and cyber warfare and with the final discussion centered

on the international laws that already exist which help shape international law for cyberspace

What is Cyber Warfare Very few of the new manifestations in war can be ascribed to new inventions or new departures in ideas6

~Carl Von Clausewitz

Defining Cyberspace William Gibson coined the term ldquocyberspacerdquo in his 1984 novel Neuromancer in order to

describe ldquoa shared virtual environment whose inhabitants objects and spaces comprise data that

is visualized heard and touchedrdquo7 However the most common of definitions today refer to the

Internet or the World Wide Web and usually consists of an information-sharing environment

between computers8 However the military has defined cyberspace to advocate a worldwide

spectrum of more than just information sharing among computers

In the National Military Strategy for Cyberspace Operations cyberspace is defined as a

domain characterized by the use of electronics and the electromagnetic spectrum to store

modify and exchange data via networked systems and associated physical infrastructure9 Joint

doctrine has adopted a computer-centric definition where cyberspace is ldquothe notional

environment in which digitized information is communicated over networksrdquo10 The National

Military Strategy and joint doctrine definitions advocate a worldwide information environment

that isnrsquot limited to the Internet or to just computers Matter of fact the expanded definitions

suggest that cyberspace consists of all networks to include highly sensitive military

governmental and commercial networks that may or may not use commercial means to store

modify and exchange data These systems include exchange networks like tactical digital

information links (TADIL) links between command and control platforms and air ground and

sea weapon systems In addition because the definition includes the electromagnetic spectrum

3

AUACSCSinksAY08

cyberspace includes ldquocapabilities that are currently considered electronic warfarerdquo11 which Great

Britain exploited in World War II when they introduced radar technology in World War II and is

still applicable with communication and navigational jamming capabilities used in todayrsquos

conflicts

While cyberspace is a unique domain that military commanders must protect in order to

conduct operations more effectively and offers commanders another dimension in which to

exploit weaknesses in an adversaryrsquos ability to project power cyberspace doesnrsquot exist on its

own According to Lt Col Fahrenkreg in the published Air University article title Cyberspace

Define ldquocyberspace exists across the other domains of air land sea and spacerdquo12 There are

clear delineations between the sea land and air Commanders know where the land ends and the

sea begins While there are some discussions as to where airspace ends and space begins the

capabilities and roles associated with each domain are clear Therefore to depict cyberspace as

an autonomous domain is unrealistic as the physical infrastructure of cyberspace and the means

of sharing information within the cyberspace domain resides in one or more of the four linear

domains

What Cyberspace is Not The most confused notion about cyberspace is that information operations and

cyberspace are one in the same Joint Publication 3-13 Information Operations describes the

information environment as a collection of leaders decision makers and systems that process

collect disseminate or act on information consisting of three dimensions the physical

informational and cognitive dimensions13 The goal of information operations is to influence the

cognitive dimension by affecting the decision-making process known affectionately by the Air

Force as the OODA Loop (Observe Orient Decide and Act)14 By disrupting and corrupting

4

AUACSCSinksAY08

information processes military commanders can influence or usurp adversarial human and

automated decision making in the physical and informational dimensions

As stated by Lt Col Fahrenkreg the confusion between cyberspace and information

operations comes from the misunderstanding of cyberspace as an operation rather than a

domain15 Information operation is a capability available to the combatant commander to

generate an effect in one of the five domains It just so happens that cyberspace tends to be the

primary means of delivering the Information Operation capability

Cyberspace connects the physical dimensions with the cognitive process and is a means

to create effects to include disrupting degrading denying the enemy the use of strategic and

operational assets to include command and controls systems power plants telecommunications

and other like targets to affect a statersquos operational and strategic centers of gravity Cyberspace

isnrsquot information or the data residing on a computer but is the means in which users transfer

store or modify information Cyberspace isnrsquot the data sent to a precision guided munition but

the means in which the originator passes the information Cyberspace is the digital super

highway of the electromagnetic spectrum with the ones zeros and electrons as the passengers

Defining Cyber Warfare According to the Institute for Advanced Study of Information Warfare (ASIW) cyber

warfare has become a form of information warfare which ASIW defines as ldquothe offensive and

defensive use of information and information systems to deny exploit corrupt or destroy and

adversaryrsquos information information-based processes information systems and computer-based

networks while protecting onersquos own Such actions are designed to achieve advantages over

military adversariesrdquo16 While this definition doesnrsquot specifically address the electromagnetic

spectrum the definition focuses on information-sharing systems which is where crux of the

cyberspace domain revolves around

5

AUACSCSinksAY08

Joint doctrine defines cyber warfare as those areas of operations that affect the

electromagnetic spectrum to include Computer Network Operations and Electronic Warfare

which are two of the five core operational capabilities of Information Operations Electronic

warfare operations operates across ldquoradio visible micro directed energy and all other

frequenciesrdquo and overlaps with network warfare operations which include ldquoradio nets satellite

links tactical digital information links (TADIL) telemetry digital track files

telecommunications and wireless communication network and systemsrdquo all of which operate

within the electromagnetic spectrum17

Cyber warfare consists of defensive and offensive operations Defensive operations

arenrsquot limited to severing connections or blocking attempts of an adversary trying to corrupt data

modify transmissions or destroy information systems Defensive operations include the

elimination of the adversaryrsquos capability of conducting operations which may involve crossing

sovereign borders in order to complete the task However defensive network operations come in

more than just one form The movies portray computer experts hovering over computers trying

to affect each otherrsquos operations However cyber warfare includes the use of traditional kinetic

effect to disrupt computer network operations of the enemy as a fighter-bomber delivering a

500-pound bomb to destroy a vital mode in a computer network may serve the same purpose as a

computer-centric network attack While this isnrsquot as sexy as a network attack that spans the

globe to degrade the enemyrsquos ability operation within the cyberspace domain the effects are the

same

Territorial Sovereignty In total war it is quite impossible to draw any precise line between military and non-military problems18

~Sir Winston Churchill

6

AUACSCSinksAY08

Cyberspace is certainly a domain that requires unique attention in order for commanders

to effectively and efficiently prosecute combat operations Cyberspace spans the globe using

the physical infrastructure residing within the other linear domains As users pass information

from one site to another data crosses boundaries by means of the cyberspace domain Data

leaves the Iraq area of operation via satellite to a receiving site in Germany Operators route the

information to the United States either through another satellite or by ground to sea-based cables

bound for computer nodes within the United States before arriving in South Carolina where

automated network tools redirect the information to the receiverrsquos location

An adversary attempting to modify corrupt or destroy this information traveling within

the cyberspace domain would at one time or another would cross sovereign borders through air

land sea or space The adversaryrsquos physical presence may not apply as they could conduct

operations from the comforts of their home however a nation could detect the adversaryrsquos

digital presence and could feel the impact of their actions from within their sovereign borders

Therefore as these adversaries span the globe using the cyberspace domain that relies on the

other linear domains to exist does international law apply when boundaries are crossed The

following sections will address the international laws of each physical domain and evaluate how

their principles apply to the cyberspace domain

Airspace Airspace as defined by Doctor Boleslaw A Boczek the internationally renowned expert

on international law ldquois the air pillow above the subjacent territoryrdquo to include ldquoairspace above

international waters and the territorial seardquo The airspace is under complete and exclusive

sovereignty of the subject state19 With that states have jurisdiction over their airspace and

require identification of foreign aircraft along with their intentions According to Dr Boczek

book International Law A Dictionary ldquoentry of national spacehellipmay take place only with the

7

AUACSCSinksAY08

authorization of the territorial staterdquo20 and currently only applies to aircraft Entry into the

airspace would require ldquoall aircraft to identify themselves file flight plans and report their

positionrdquo According to the 1944 Chicago Convention on International Civil Aviation nations

can enter into agreements that allow scheduled international civil air services which usually

include reciprocal agreements covering routes volume and other matters relating to air traffic

However these agreements only apply to civil aviation where state aircraft which include

aircraft belonging to the military customs public services and heads of states must follow more

restrictive procedures upon entering the airspace of a foreign nation21

There are several incidents where states have evoked their right for defending their

national security like the shooting down of a US military reconnaissance aircraft over Soviet

airspace by the Soviet Union in 196022 or the shooting down by Soviet fighter planes of a South

Korean airliner in 198323 The Soviet Union isnrsquot the only nation to protect its airspace as the

United States was responsible for shooting down an Iranian airliner thought to be an attacking

military plane over the Persian Gulf in 198824 These examples illustrate a nationrsquos sovereign

resolve to protect itself when a suspected adversary violated their airspace

Applying international law of airspace to cyberspace doesnrsquot seem too practical Civilian

signals entering a nationrsquos airspace would require nations to enter into agreements to allow

scheduled services and the persons receiving information through airspace would have to be

non-state sponsored Nationrsquos could regulate some cyberspace networks entering airspace like

radio communications that primarily use land-based infrastructure to function However the

very nature of computer networks and the ever-increasing global reach of communication

capabilities severely restrict a nationrsquos ability to monitor the millions of transmissions made on a

daily basis and these signals certainly wouldnrsquot be on any scheduled basis Therefore even if

8

AUACSCSinksAY08

nations made agreements concerning the cyberspace domain nations would have a difficult time

enforcing their terms of agreements unless the terms are very open-ended If they were so open-

ended then the agreement may not be necessary and based on my research nations realize the

futility of establishing these agreements as this author couldnrsquot find any reference to any

agreements that nations have entered into referencing the cyberspace domain

While the international law for civilian aircraft in airspace may not relate well or isnrsquot

feasible to enforce in the cyberspace domain does a nation have that same right to protect itself

from a suspected attack from cyberspace where the attackerrsquos signal enters airspace Does a

nation have the right to ldquoshoot downrdquo a cyberspace attack as it enters their domain through

airspace The whole idea behind restricting airspace from foreign military aircraft is because of

the strategic impact military aircraft can have on a nation As demonstrated in World War II

military aircraft carrying weapons of mass destruction can decimate cities and destroy a nation

with minimal effort The effects generated by military aircraft are quite destructive and garner

specific attention While an aircraft in of itself is relatively harmless the actions taken by the

crew can lead to devastating results

The same is true for cyber attacks The information passing through airspace in the

cyberspace domain is the vehicle however the crew conducting the operation is potentially

creating the same strategic results The cyber attack may not destroy cities but it certainly can

be destructive to a nationrsquos well-being by crippling power sources economic industries water

supply etc all at the blink of an eye while the victim takes several days to determine the

perpetrator Therefore while the international law for airspace may not be specifically relevant

the underlying principles are applicable as cyber attacks can have the same potential strategic

impact as an attack from a military aircraft

9

AUACSCSinksAY08

Space Outer space as defined by Doctor Boczek ldquois the space beyond the air surrounding the

earthrdquo As of 2005 international law doesnrsquot define a demarcation between airspace and outer

space but ldquostates agree that state sovereignty doesnrsquot extend without any limitsrdquo25 Proposals of

where airspace ends and when outer space begins are base on various scientific and technological

criteria (gravitational pull capabilities of air breathing aircraft etc26) Others scientists argue

that defining a boundary between airspace and outer space isnrsquot necessary as it would hinder the

progress of space technology and the legal status would depend on the nature of the activity

While no boundary exists airspace is finite and activity in outer space follows four

fundamentals principles First over flights of foreign satellites over a nation is permissible as

airspace doesnrsquot extend forever Second space ldquointernational law applies to outer space and

celestial bodiesrdquo Third according to the Outer Space Treaty of 1967 states canrsquot claim celestial

bodies or outer space which are not subject to national appropriation therefore are free for use

by all states Finally states must use outer space exclusively for peaceful purposes with specific

bans on weapons of mass destruction However states can use space for other military purposes

like intelligence surveillance and reconnaissance activities 27

Are these international laws and principles applicable to cyberspace Satellites are

certainly an integral part of the space domain Operators control satellites by using the

cyberspace domain and information passes between satellites and ground stations One can

argue that space is a sub-set of the cyberspace domain with satellites serving as computers in

space Global positioning system devices in vehicles interact with satellites all through an

elaborate network as part of the electromagnetic spectrum known as cyberspace Therefore

cyberspace is in space with millions of people using cyberspace everyday

10

AUACSCSinksAY08

The military uses space assets for intelligence surveillance and reconnaissance

knowledge management and command and control Agencies like the National Reconnaissance

Office and National Geospatial-Intelligence Agency obtain high-altitude imagery using a variety

of capabilities to include heat signature resonation Satellites can detect missile launches which

provide vital military information to senior leaders tasked with the security of their nation The

military networks to include decision briefs tasks and emails in Iraq and the Predator feeds in

Afghanistan travel through military and commercial satellites with all the information flowing

through the cyberspace domain With the heavy reliance of cyberspace to operate space assets

and the demands of information flowing through space by businesses it should come as no

surprise that space is a vital component for day-to-day operations of the military

Since cyberspace is an inherent component for space operations it is logical to assume

international law for outer space is applicable to cyberspace as long as an aggressor doesnt

violate the four premises and as long as weapons of mass destruction arenrsquot ldquostationed in outer

spacerdquo 28 Therefore a state would consider a cyber attack against a satellite as other than for

peaceful purposes and according to the fourth premise international law would apply

However what about a cyber attack using satellites as a means of conducting operations

Under todayrsquos current operations international elites havenrsquot considered a cyber attack passing

through space as a violation of international law When a senior leader in Qatar approves a

target set that is executed by a pilot in Nevada by an aircraft in Afghanistan all this information

is transmitted by cyberspace through space The result is that an aircraft renders an air or ground

target inoperable The effect is the same for cyberspace The information flows through space

by way of the cyberspace domain and the result is that an operator has rendered a target

11

AUACSCSinksAY08

inoperable As with airspace the information isnrsquot the cause of the damage but what an operator

does with the information is what constitutes the cyber attack

Land Cyber attacks using resources over land is relatively straightforward International

boundaries are defined as ldquoimaginary lines which separate territorial sovereigntyrdquo 29 which are

mutually agreed upon via international treaties Crossing an international border without

permission from the state is a violation of international law While an illegal immigrant crossing

a border to seek an opportunity to provide for his family is a violation of national law the United

Nation considers a nation-sponsored invasion of another nation that threatens the security and

stability of a nation as a breach in international law and an act of war

However international law doesnrsquot consider all border crossings as an act of war For

example when Nicaraguan troops and arms allegedly crossed the borders of El Salvador the

United Nations determined that incursions didnrsquot threaten El Salvadorrsquos territorial integrity and

stated that neither ldquothese incursions nor the alleged supply of arms may be relied upon as

justifying the exercise of the right of collective self-defenserdquo30 The victim state can repelled the

aggressive act but the United Nations Council wouldnrsquot condone any further military action

taken against the adversary opting for diplomatic or economic solution instead

Does international law apply when an adversary crosses international borders using

cyberspace as the means for conducting warfare operations When an adversarial state crosses a

statersquos boundaries using roads or bridges that connect the two nations the road is the resource

spanning the two nations If the adversary doesnrsquot do anything then returns to their sovereign

borders the aggressor hasnrsquot violated international law However when the adversary uses

weapon systems to affect serious damage the adversary has broken international law and a

12

AUACSCSinksAY08

nation may invoke their right for self-defense and may conduct full-scale operations to neutralize

the threat

A parallel notion is when an adversary uses a copper or fiber optic connection that spans

between two nations The adversary uses the land-based LAN connection as a means for

conducting cyber warfare operations The adversary may cross the borders using cyberspace yet

do nothing The affected state may push the adversary back to its borders but no further actions

are deemed appropriate However once the adversary uses the information transmitted over

cyberspace to cause severe operational or strategic damage the affected state now has the right

of self-defense Cyberspace is the means like the road or bridge for which the adversary

delivered the weapon The affected nation will consider the execution of the adversaryrsquos

information packet or weapon system as an act of aggression and the effect caused by the

weapon is what breeches international law

The difference between these two scenarios is that the adversary using the

electromagnetic spectrum hasnrsquot physically invaded a nationrsquos sovereign borders However

their digital presence crossed sovereign borders and as latter discussed in the paper adversaries

committing an act aggression against a state are now under the jurisdiction of the affected state

Sea ldquoThe territorial sea is a belt of sea adjacent to the (statersquos) coasthellipto include the airspace

aboverdquo as well as the seabed and subsoil31 The territorial sea is subject to the right of innocent

passage by foreign shops giving states the right to transport goods and passengers between ports

All of which is subject to the full sovereignty of the state which according to the United Nations

Convention on the Law of the Sea in 1982 and agreed upon by the majority of its membership in

1982 extends 12 miles from the coast32 The jurisdiction includes crimes where the

consequences extend to the coastal state and disturbs the peace of the country33 A cyber attack

13

AUACSCSinksAY08

conducted within the territorial sea of a nation would be no different from a cyber attack

conducted from within the nationrsquos land borders therefore cyber attacks against a state or even

another state conducted within the territorial seas are subject to current international laws Cyber

attacks originating outside the statersquos sovereign borders but results in affecting a statersquos

resources in their territorial seas would fall under the land and airspace breeches of territorial

sovereignty and would be subject to international law

The high seas on the other hand arenrsquot subject to the sovereignty of any one state The

high seas extend beyond the territorial sea and include the airspace the seabed and the subsoil34

and all states have the right to exercise freedoms on the high seas35 As similarly defined in

space ldquothe high seas shall be reserved for peaceful purposesrdquo as stated by Article 88 of the Law

of the Seas Cooperative36 which is defined as refraining from any threat or use of force (outside

of wartime conflicts)

The very nature of a cyber attack in the high seas lends itself to be a violation of

international law as nations are restricted to conducting peaceful operations in the high seas

The question is whom has jurisdiction of crimes committed in the high seas By applying the

Protective Security Principle of Jurisdiction where an actor threatens a statersquo security and

introducing the United Nationrsquos definition on the Illegal Use of Force extends to the high seas

and for that matter space giving states the right for self-defense as defined by the United Nations

as ldquoan armed attackrdquo The sheer name of cyber attack doesnrsquot immediately lend itself to an

ldquoarmedrdquo cyber attack However the effects generated from a cyber attack can be equivalent to a

traditional conventional attack and the international law would permit a state to take appropriate

countermeasures while notifying the United Nations Security Council37

14

AUACSCSinksAY08

Applying International Law to Cyber Warfare Today we live in an Information Age where communication through cyberspace has forever changed and flattened out worldhellipOur adversaries seek to operate from behind technical legal and international screens as they execute their costly attacks38

~General James E Cartwright Commander United States Strategic Command

Jurisdiction

Understanding the territorial sovereignty principles of a nation is important in applying

cyberspace and cyber warfare to existing international laws While some of these principles and

international laws may not be relevant for the cyberspace domain due to the far-reaching

capability of cyber warfare the jurisdiction of a nation further defines its ability to respond to

aggressive acts by nations in the cyberspace domain There are three jurisdictional principles

that provide nations the right to pursue aggressors that threaten a nationrsquos independence the

Territorial Principle Nationality Principle and the Protective Security Principle

For actions originating within the state the jurisdiction clearly falls within the territorial

principle where a ldquostate has jurisdiction over all crimes committed in its territoryhellipto include

airspace international waters and territorial seasrdquo39 The territorial jurisdiction is subject to

exceptions when dealing with persons from foreign states as in the most popular example of

immunity given to foreign diplomats In this case ldquostates may exercise jurisdiction over its

citizenhellipeven if they are physically outside the statesrsquo territoryrdquo as Doctor Boczek defines as the

Nationality Principle Nations usually agree upon on these concessions states prior to the offense

being committed40

Doctor Boczek defines the Protective Security Principle as a ldquojurisdictional principle

whereby a state my assume jurisdiction over and punish foreign nationals for certain conduct

outside its territory which is directed against its security territorial integrity and political

independencerdquo41 Some states would argue that criticism of a state or government is applicable

15

AUACSCSinksAY08

in applying this principle of jurisdiction However this is too broad of an interpretation and

should be confined to acts that are more tangible in nature like falsification of a statesrsquo official

documents conspiracy to violate immigration of custom laws and illicit drug trafficking42

Would a cyber attack that is deemed to challenge a nationrsquos banking community or bring

down a power source be a direct attack against its security and political independence The

international community easily sees the attack of a power source with kinetic weapons as a

violation of a territorial boundary and a breech of international law The United States viewed

the attack on the Trade Towers as an act of war launching the Global War on Terrorism Would

the United States have viewed the same devastation as if the attack occurred through cyberspace

Would the attack have been less of an act of war if the aggressor remotely controlled domestic

airliners from a foreign country Probably not What happens if the cyber attack caused a fire in

the lower floors of the buildings preventing people from escaping While less dramatic than an

airbus flying into the middle of the towers and maybe more difficult to demonize the crime the

result is the samemdashinnocent people suffering as a result of an adversary trying to threaten a

nationrsquos security

What happens if the suspected cyber attack has violated a nationrsquos territorial boundary in

order to attack a neighboring country or an ally Going from point A to point B in cyberspace is

rarely a direct connection As with the global nature of cyberspace itrsquos conceivable that

adversaries cross several nationsrsquo boundaries to conduct cyber attack operations The question

generated is who has jurisdiction

If the actor committing the crime had used an airplane each nation could claim

jurisdiction as the adversary violated their territorial boundaries and violated international law

More often than not the first state would have acted immediately upon the aggressive act and

16

AUACSCSinksAY08

would have prevented aggressors from completing their task by either forcing the aircraft to land

or turnaround or an even more escalated response of firing upon the aircraft In the air land or

sea the ability for a nationrsquos military forces to respond in a timely manner gives way to the

deterrence factor of not crossing a statersquos boundaries without receiving permission for fear of

reprisal A clear example of this was when Turkey denied the United States the ability deploy

the 4th Infantry Division from its borders at the beginning of Operation Iraqi Freedom Violating

Turkeyrsquos borders without permission would have brought about great repercussions that would

have made Operation Iraqi Freedom even more difficult and could have resulted in an escalation

of the war outside the Iraqi borders43 Another example is when Spain and France denied the

Unites States the use of their airspace when F-111s based in the United Kingdom conducted air

operations in Libya in an effort to eliminate Muammar Khadafy44

However the speeds at which these breeches in territorial boundaries occur make it

difficult for a nation to claim jurisdiction especially when nothing occurred within their

territorial sovereignty The cyber attacks didnrsquot result in any damage to nation as the information

packets passed through their sovereign borders According to territorial boundary description

described by Doctor Boczek the international community doesnrsquot consider the crossing the

border in of itself an act of warmdashserious damage is a driving factor in determining conflict

escalation In addition according to the territorial jurisdiction principle the cyber attack didnrsquot

threaten a nationrsquos security territorial integrity and political independence If the cyber attack or

information originated from within a sovereign territory by a third party then the two nations

would have to work together to resolve the issue and mutual jurisdiction would probably apply

However if the cyber attack didnrsquot physically manifest itself from within their sovereign

territory or the adversary didnrsquot use the nation as a staging area to launch a further attack the

17

AUACSCSinksAY08

international law and the jurisdiction principles would dictate the affected nation would have

jurisdiction

Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security

territorial integrity and political independence Cyberspace utilizes the other domains as a means

of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence

Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of

territorial sovereignty the Protective Security Principle does provide nations the ability to

enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos

sovereignty when it conducts cyber warfare operations However some elites donrsquot consider

cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense

International law specifically article 2 of the United Nations Charters states that a

members shall refrain in their international relations from the threat or use of force against the

territorial integrity or political independence of any state or in any other manner inconsistent

with the purposes of the United Nations which is intended to prohibit all types of force except

those carried out under the aegis of the United Nations or as provided for by the Security

Council45 The only exception to the United Nations Charters as it relates to the Use of Force is

the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed

attack46

International elites have discussed the term ldquouse of forcerdquo in the past because of the

development of chemical and biological weapons and had to move from a kinetic impact based

definition to a results-oriented approach47 Chemical and biological weapons lacked the

characteristic of an explosion or physical force yet these weapons certainly are capable of

destroying life and property Doctor Leigh Armistead a former information warfare instructor at

18

AUACSCSinksAY08

the Joint Forces Staff College cautions that the use of computer network attacks by the military

ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary

that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great

Russia introduced a proposal to the United Nations that banned the use of information

operations Even though the United Nations didnrsquot adopt the law the concern of international

community is fully aware of the impact cyber attacks can have on a nation

The concern over cyber warfare capabilities is that it can generate both non-kinetic and

kinetic effects There has always been the traditional kinetic solution for cyber warfare where a

precision guidance munition destroys a critical information system node Most people assume

computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos

computer system from the safety of onersquos own command and control center but the physical

destruction of a computer system or network by kinetic means also qualifies as cyber warfare

However cyber warfare has also evolved to the point where aggressors can achieve a kinetic

effect without the use of a traditional kinetic weapon A cyber attack on an information system

can shut down a particular node of a power plant causing the system to become inoperative

Even if there wasnrsquot an explosion the attack serves the same purpose

The question raised is do cyber attacks constitute an armed attack Scholars do agree that

some cyber attacks fit comfortably within the United Nations Charter For example a strategic

level cyber attack causing widespread damage and significant casualties would trigger the statersquos

right of self-defense In addition a cyber attack that precluded a conventional attack or a series

of cyber attacks causing significant damage would give a state the right of self-defense49 Few

would dispute that a country has the right under international law to respond with military force

19

AUACSCSinksAY08

if a state destroyed or significantly damaged another nationrsquos economic system for example the

New York or London stock exchanges

However some confusion and state-defined interpretation comes into play when the

frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard

Law School argues that cyber attacks require an expansion of the definition on the ldquouse of

forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot

be prohibited by international law50 International scholars recommend ldquoclearer rules of what

kinds of information warfare actions constitute an armed attackrdquo which drives permissible

responses of self-defense51 For example a state-sponsored cyber attack causes damage to a

victimrsquos factory or power plant however the nation claims the incident is an isolated instance

and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under

the United Nations Charter and the United Nations would consider any response retaliation

which would violate international law52

Another example involves a nation conducting a series of small attacks causing minimal

damage and then ceases Even though the aggressor used force to conduct cyber warfare

operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under

the United Nations Charter This type of attack is analogues to a small band of troops crossing a

border without causing significant damage53 According to the United Nations Charter the

national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders

and respond to the use of force Repelling the small band of troops and reestablishing their

sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration

of war and allies would have to respect the United Nations decision and couldnrsquot intervene The

same is true for the cyber attack A state can employ defensive measure to isolate and defeat the

20

AUACSCSinksAY08

incursion over the electromagnetic spectrum However the United Nations would see further

offensive operations or invasive operations as retaliation Therefore a nation must take the

incident whether it is signs of conventional forces on the ground or traces of cyber warfare

incursions in the electromagnetic spectrum to the United Nations to seek restitution

In both of these situations the international law becomes the target for change not

whether cyber warfare is in violation of international law If the law were to change the

international community would then consider the above situations acts of war even if an

adversary used conventional forces As written today the result of an operation remains the

driving factor in determining if an adversary has violated international law The means by which

an adversary conducts military operations may affect how nations react to the situation but

whether an adversary conducts the operation by means of the air land sea space or cyberspace

doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian

Triggs a public international lawyer and member of the Attorney General International Legal

Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over

offences abroad having an intended and substantial effect within a state may be justifiedrdquo54

Therefore the international community must evaluate the effect of a criminal act rather than the

means in which the act was committed

Others claim that because the Internet takes advantages of legal norms where non-state

actors can ignore Western notions of law55 more international laws are needed for cyberspace

However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using

other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the

Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked

aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts

21

AUACSCSinksAY08

against a staterdquo in the cyberspace domain The anonymity of the Internet and their total

disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and

national laws already exist in most countries that prohibit the use of the Internet for terrorist

activities therefore additional international laws wouldnrsquot prevent or deter terrorist from

committing such acts of aggression

International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed

Conflict includes the Martens Clause which extends established custom and humanitarian

principles to new technologies and addresses the ever-changing nature of warfare The

international community designed The Martens Clause ldquoto prevent future unnecessary andor

disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges

crimes by invoking the laws of humanity and public conscience hence their effects and not its

methods

The basic legal premise behind Law of Armed Conflict is that attacks must be limited to

military objectives and collateral damage must be proportionate to military advantages and

forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary

suffering but military commanders and planners need to be aware of the results a particular

action will invoke Russian leadership believes a computer network attack against their

homeland can be a means for executing a variety of escalating responses to include nuclear

attack58 Therefore it is imperative military commanders understand the impact any weapon

system can have on an adversary not just cyber attacks

Not all scholars agree that international law is insufficient to govern cyber warfare

Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace

and the Use of Force states that computer network attacks constitute an unlawful use of force in

22

AUACSCSinksAY08

cyberspace under traditional international law Sharp declared that an armed attack may occur

ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a

way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive

definition of cyber attacks may never be drafted59 The Congressional Research Service also

concluded that ldquothere is little likelihood that the international community will soon generate a

coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations

on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos

conclusion is that the effects of cyber warfare operations are the same as if an adversary

conducted conventional warfare operations where the effect of the attacks are the driving factors

in determining whether an adversary used force or not

The United States Government agrees with Sharprsquos conclusion The offensive

Information Operation strategy for the United States government as described by Doctor

Armistead ties the tools used to conduct military operations back to the desired effect which is

in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning

effects-based operations and operational art focus the Joint Force Commanderrsquos course of action

towards meeting objectives outlined in guidance provided by the National Command Authority

and senior military leadership62 Whether the tools are dropped pamphlets invasive network

attacks or bombs on targets the goal is to produce a desired effect to achieve the overall

objectives and cyber warfare can produce effects that challenge the national security of a nation

Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63

~General T Michael Moseley USAF

23

AUACSCSinksAY08

The cyberspace domain has been around for quite sometime but as technology continues

to advance businesses as well as governmental organizations are becoming more reliant on the

cyberspace domain With that reliance the protection of this critical domain becomes even more

important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the

electromagnetic spectrum by denying and disrupting information demands Scholars claim that

protection needs to include addressing existing international laws expanding them to incorporate

the ever-advancing capabilities emerging in the cyberspace domain

However territorial sovereignty of a nation and the principles of jurisdiction specifically

the Protective Security Principle give nations the right to exercise jurisdiction when an

aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64

While cyberspace is a domain requiring specific attention it relies on assets in the other domains

of land space sea and air in order to operate and international laws for the linear domains do

exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace

but during cyber warfare operations the principles behind the restrictions of foreign military

entering airspace do apply The strategic nature of cyber warfare operations correspond to the

same strategic impact that airpower can inflict upon a nation threatening their independence

While maybe not as dramatic as kinetic effects the results can be just as devastating

Space is relatively straightforward Since a nation canrsquot claim space and over flights of

foreign satellites over a nation is permissible nations must use space for peaceful purposes

Kinetic attacks against space assets are a violation of international law therefore nations would

consider cyber warfare operations against space assets as other than peaceful purposes and a

violation of international law Cyber attacks traversing space assets relate to current military

operations where the military uses space assets to conduct kinetic operations Since international

24

AUACSCSinksAY08

elites havenrsquot considered these kinetic operations as a breach of international law military

commanders can conduct cyber warfare operations through space without fear of violating

international laws for outer space

Crossing international borders without a nationrsquos permission and threatening their

sovereignty is a violation of international law While nations canrsquot consider all border crossings

as an act of war those acts of aggression that threaten the territorial integrity would elicit a

defensive response by the victim nation Whether incursions involve combat vehicles over a

highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are

threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not

have set foot in the nation but according the Protective Security Principle the victim nation has

jurisdiction

Conducting cyber warfare operations from the territorial sea is no different from

conducting operations from within a nationrsquos land or sea borders However the high seas are

very similar in nature to space in that they are reserved for peaceful purposes Therefore

conducting any means of warfare from within the high seas is a violation of international law

and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-

defense

According to Barkham ldquoinformation warfare attacks are in essence territorial

penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then

subject to the jurisdiction of the victim nation who then has the right for self-defense However

due to the global nature of cyberspace aggressors can cross multiple borders and determining

who has jurisdiction demands cooperation among nations The origin and any deliberate staging

locations of the cyber attack will drive who has jurisdiction The crossing of third party borders

25

AUACSCSinksAY08

by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the

aggressors threaten a nationrsquos independence or territorial integrity

Scholars consider cyber warfare operations that involve strategic and operational impacts

as being a means of using force and fall within the legal regime of existing international law

However scholars argue that because cyber warfare includes kinetic and non-kinetic results the

Use of Force definition needs expanding Yet they conclude that an exhaustive definition of

cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare

operations against existing case studies where the effects are evaluated as opposed to the means

even if the operations originated from outside the nationrsquos territorial jurisdiction There is some

authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to

have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade

non-state actors from conducting cyber warfare operations given their willingness to ignore

Western notions of war and their ability to conduct operations anonymously in cyberspace

International laws are in place to that address the ever-changing nature of warfare The

Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a

framework for addressing all warfare to include cyber warfare operations The international

community will need to measure the effects of an operation rather the means Whether its boots

on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a

nationrsquos response

26

AUACSCSinksAY08

End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)

27

AUACSCSinksAY08

44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

28

AUACSCSinksAY08

Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005

Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department

American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)

Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983

Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988

Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)

Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)

IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)

Joint Publication 3-13 Information Operations 13 February 2006

Joint Publication 5-0 Joint Operations Planning 26 December 2006

Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies

Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc

Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College

Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)

Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press

29

AUACSCSinksAY08

Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI

Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)

Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press

Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company

Detter Delupis I The law of war (2000) New York NY Cambridge University Press

Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)

Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College

Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor

Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)

Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)

Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf

Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)

Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College

Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College

Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)

Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA

30

AUACSCSinksAY08

Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)

Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)

Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College

Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology

Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College

Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)

OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center

OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College

OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications

Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991

Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College

Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center

Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)

31

AUACSCSinksAY08

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press

Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA

Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University

Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor

Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661

Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office

Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis

United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC

United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center

Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College

Wesley David C The Military Commander and the Law 2006

32

Page 7: Sinks 0407

AUACSCSinksAY08

corresponds to the cyberspace domain and cyber warfare and with the final discussion centered

on the international laws that already exist which help shape international law for cyberspace

What is Cyber Warfare Very few of the new manifestations in war can be ascribed to new inventions or new departures in ideas6

~Carl Von Clausewitz

Defining Cyberspace William Gibson coined the term ldquocyberspacerdquo in his 1984 novel Neuromancer in order to

describe ldquoa shared virtual environment whose inhabitants objects and spaces comprise data that

is visualized heard and touchedrdquo7 However the most common of definitions today refer to the

Internet or the World Wide Web and usually consists of an information-sharing environment

between computers8 However the military has defined cyberspace to advocate a worldwide

spectrum of more than just information sharing among computers

In the National Military Strategy for Cyberspace Operations cyberspace is defined as a

domain characterized by the use of electronics and the electromagnetic spectrum to store

modify and exchange data via networked systems and associated physical infrastructure9 Joint

doctrine has adopted a computer-centric definition where cyberspace is ldquothe notional

environment in which digitized information is communicated over networksrdquo10 The National

Military Strategy and joint doctrine definitions advocate a worldwide information environment

that isnrsquot limited to the Internet or to just computers Matter of fact the expanded definitions

suggest that cyberspace consists of all networks to include highly sensitive military

governmental and commercial networks that may or may not use commercial means to store

modify and exchange data These systems include exchange networks like tactical digital

information links (TADIL) links between command and control platforms and air ground and

sea weapon systems In addition because the definition includes the electromagnetic spectrum

3

AUACSCSinksAY08

cyberspace includes ldquocapabilities that are currently considered electronic warfarerdquo11 which Great

Britain exploited in World War II when they introduced radar technology in World War II and is

still applicable with communication and navigational jamming capabilities used in todayrsquos

conflicts

While cyberspace is a unique domain that military commanders must protect in order to

conduct operations more effectively and offers commanders another dimension in which to

exploit weaknesses in an adversaryrsquos ability to project power cyberspace doesnrsquot exist on its

own According to Lt Col Fahrenkreg in the published Air University article title Cyberspace

Define ldquocyberspace exists across the other domains of air land sea and spacerdquo12 There are

clear delineations between the sea land and air Commanders know where the land ends and the

sea begins While there are some discussions as to where airspace ends and space begins the

capabilities and roles associated with each domain are clear Therefore to depict cyberspace as

an autonomous domain is unrealistic as the physical infrastructure of cyberspace and the means

of sharing information within the cyberspace domain resides in one or more of the four linear

domains

What Cyberspace is Not The most confused notion about cyberspace is that information operations and

cyberspace are one in the same Joint Publication 3-13 Information Operations describes the

information environment as a collection of leaders decision makers and systems that process

collect disseminate or act on information consisting of three dimensions the physical

informational and cognitive dimensions13 The goal of information operations is to influence the

cognitive dimension by affecting the decision-making process known affectionately by the Air

Force as the OODA Loop (Observe Orient Decide and Act)14 By disrupting and corrupting

4

AUACSCSinksAY08

information processes military commanders can influence or usurp adversarial human and

automated decision making in the physical and informational dimensions

As stated by Lt Col Fahrenkreg the confusion between cyberspace and information

operations comes from the misunderstanding of cyberspace as an operation rather than a

domain15 Information operation is a capability available to the combatant commander to

generate an effect in one of the five domains It just so happens that cyberspace tends to be the

primary means of delivering the Information Operation capability

Cyberspace connects the physical dimensions with the cognitive process and is a means

to create effects to include disrupting degrading denying the enemy the use of strategic and

operational assets to include command and controls systems power plants telecommunications

and other like targets to affect a statersquos operational and strategic centers of gravity Cyberspace

isnrsquot information or the data residing on a computer but is the means in which users transfer

store or modify information Cyberspace isnrsquot the data sent to a precision guided munition but

the means in which the originator passes the information Cyberspace is the digital super

highway of the electromagnetic spectrum with the ones zeros and electrons as the passengers

Defining Cyber Warfare According to the Institute for Advanced Study of Information Warfare (ASIW) cyber

warfare has become a form of information warfare which ASIW defines as ldquothe offensive and

defensive use of information and information systems to deny exploit corrupt or destroy and

adversaryrsquos information information-based processes information systems and computer-based

networks while protecting onersquos own Such actions are designed to achieve advantages over

military adversariesrdquo16 While this definition doesnrsquot specifically address the electromagnetic

spectrum the definition focuses on information-sharing systems which is where crux of the

cyberspace domain revolves around

5

AUACSCSinksAY08

Joint doctrine defines cyber warfare as those areas of operations that affect the

electromagnetic spectrum to include Computer Network Operations and Electronic Warfare

which are two of the five core operational capabilities of Information Operations Electronic

warfare operations operates across ldquoradio visible micro directed energy and all other

frequenciesrdquo and overlaps with network warfare operations which include ldquoradio nets satellite

links tactical digital information links (TADIL) telemetry digital track files

telecommunications and wireless communication network and systemsrdquo all of which operate

within the electromagnetic spectrum17

Cyber warfare consists of defensive and offensive operations Defensive operations

arenrsquot limited to severing connections or blocking attempts of an adversary trying to corrupt data

modify transmissions or destroy information systems Defensive operations include the

elimination of the adversaryrsquos capability of conducting operations which may involve crossing

sovereign borders in order to complete the task However defensive network operations come in

more than just one form The movies portray computer experts hovering over computers trying

to affect each otherrsquos operations However cyber warfare includes the use of traditional kinetic

effect to disrupt computer network operations of the enemy as a fighter-bomber delivering a

500-pound bomb to destroy a vital mode in a computer network may serve the same purpose as a

computer-centric network attack While this isnrsquot as sexy as a network attack that spans the

globe to degrade the enemyrsquos ability operation within the cyberspace domain the effects are the

same

Territorial Sovereignty In total war it is quite impossible to draw any precise line between military and non-military problems18

~Sir Winston Churchill

6

AUACSCSinksAY08

Cyberspace is certainly a domain that requires unique attention in order for commanders

to effectively and efficiently prosecute combat operations Cyberspace spans the globe using

the physical infrastructure residing within the other linear domains As users pass information

from one site to another data crosses boundaries by means of the cyberspace domain Data

leaves the Iraq area of operation via satellite to a receiving site in Germany Operators route the

information to the United States either through another satellite or by ground to sea-based cables

bound for computer nodes within the United States before arriving in South Carolina where

automated network tools redirect the information to the receiverrsquos location

An adversary attempting to modify corrupt or destroy this information traveling within

the cyberspace domain would at one time or another would cross sovereign borders through air

land sea or space The adversaryrsquos physical presence may not apply as they could conduct

operations from the comforts of their home however a nation could detect the adversaryrsquos

digital presence and could feel the impact of their actions from within their sovereign borders

Therefore as these adversaries span the globe using the cyberspace domain that relies on the

other linear domains to exist does international law apply when boundaries are crossed The

following sections will address the international laws of each physical domain and evaluate how

their principles apply to the cyberspace domain

Airspace Airspace as defined by Doctor Boleslaw A Boczek the internationally renowned expert

on international law ldquois the air pillow above the subjacent territoryrdquo to include ldquoairspace above

international waters and the territorial seardquo The airspace is under complete and exclusive

sovereignty of the subject state19 With that states have jurisdiction over their airspace and

require identification of foreign aircraft along with their intentions According to Dr Boczek

book International Law A Dictionary ldquoentry of national spacehellipmay take place only with the

7

AUACSCSinksAY08

authorization of the territorial staterdquo20 and currently only applies to aircraft Entry into the

airspace would require ldquoall aircraft to identify themselves file flight plans and report their

positionrdquo According to the 1944 Chicago Convention on International Civil Aviation nations

can enter into agreements that allow scheduled international civil air services which usually

include reciprocal agreements covering routes volume and other matters relating to air traffic

However these agreements only apply to civil aviation where state aircraft which include

aircraft belonging to the military customs public services and heads of states must follow more

restrictive procedures upon entering the airspace of a foreign nation21

There are several incidents where states have evoked their right for defending their

national security like the shooting down of a US military reconnaissance aircraft over Soviet

airspace by the Soviet Union in 196022 or the shooting down by Soviet fighter planes of a South

Korean airliner in 198323 The Soviet Union isnrsquot the only nation to protect its airspace as the

United States was responsible for shooting down an Iranian airliner thought to be an attacking

military plane over the Persian Gulf in 198824 These examples illustrate a nationrsquos sovereign

resolve to protect itself when a suspected adversary violated their airspace

Applying international law of airspace to cyberspace doesnrsquot seem too practical Civilian

signals entering a nationrsquos airspace would require nations to enter into agreements to allow

scheduled services and the persons receiving information through airspace would have to be

non-state sponsored Nationrsquos could regulate some cyberspace networks entering airspace like

radio communications that primarily use land-based infrastructure to function However the

very nature of computer networks and the ever-increasing global reach of communication

capabilities severely restrict a nationrsquos ability to monitor the millions of transmissions made on a

daily basis and these signals certainly wouldnrsquot be on any scheduled basis Therefore even if

8

AUACSCSinksAY08

nations made agreements concerning the cyberspace domain nations would have a difficult time

enforcing their terms of agreements unless the terms are very open-ended If they were so open-

ended then the agreement may not be necessary and based on my research nations realize the

futility of establishing these agreements as this author couldnrsquot find any reference to any

agreements that nations have entered into referencing the cyberspace domain

While the international law for civilian aircraft in airspace may not relate well or isnrsquot

feasible to enforce in the cyberspace domain does a nation have that same right to protect itself

from a suspected attack from cyberspace where the attackerrsquos signal enters airspace Does a

nation have the right to ldquoshoot downrdquo a cyberspace attack as it enters their domain through

airspace The whole idea behind restricting airspace from foreign military aircraft is because of

the strategic impact military aircraft can have on a nation As demonstrated in World War II

military aircraft carrying weapons of mass destruction can decimate cities and destroy a nation

with minimal effort The effects generated by military aircraft are quite destructive and garner

specific attention While an aircraft in of itself is relatively harmless the actions taken by the

crew can lead to devastating results

The same is true for cyber attacks The information passing through airspace in the

cyberspace domain is the vehicle however the crew conducting the operation is potentially

creating the same strategic results The cyber attack may not destroy cities but it certainly can

be destructive to a nationrsquos well-being by crippling power sources economic industries water

supply etc all at the blink of an eye while the victim takes several days to determine the

perpetrator Therefore while the international law for airspace may not be specifically relevant

the underlying principles are applicable as cyber attacks can have the same potential strategic

impact as an attack from a military aircraft

9

AUACSCSinksAY08

Space Outer space as defined by Doctor Boczek ldquois the space beyond the air surrounding the

earthrdquo As of 2005 international law doesnrsquot define a demarcation between airspace and outer

space but ldquostates agree that state sovereignty doesnrsquot extend without any limitsrdquo25 Proposals of

where airspace ends and when outer space begins are base on various scientific and technological

criteria (gravitational pull capabilities of air breathing aircraft etc26) Others scientists argue

that defining a boundary between airspace and outer space isnrsquot necessary as it would hinder the

progress of space technology and the legal status would depend on the nature of the activity

While no boundary exists airspace is finite and activity in outer space follows four

fundamentals principles First over flights of foreign satellites over a nation is permissible as

airspace doesnrsquot extend forever Second space ldquointernational law applies to outer space and

celestial bodiesrdquo Third according to the Outer Space Treaty of 1967 states canrsquot claim celestial

bodies or outer space which are not subject to national appropriation therefore are free for use

by all states Finally states must use outer space exclusively for peaceful purposes with specific

bans on weapons of mass destruction However states can use space for other military purposes

like intelligence surveillance and reconnaissance activities 27

Are these international laws and principles applicable to cyberspace Satellites are

certainly an integral part of the space domain Operators control satellites by using the

cyberspace domain and information passes between satellites and ground stations One can

argue that space is a sub-set of the cyberspace domain with satellites serving as computers in

space Global positioning system devices in vehicles interact with satellites all through an

elaborate network as part of the electromagnetic spectrum known as cyberspace Therefore

cyberspace is in space with millions of people using cyberspace everyday

10

AUACSCSinksAY08

The military uses space assets for intelligence surveillance and reconnaissance

knowledge management and command and control Agencies like the National Reconnaissance

Office and National Geospatial-Intelligence Agency obtain high-altitude imagery using a variety

of capabilities to include heat signature resonation Satellites can detect missile launches which

provide vital military information to senior leaders tasked with the security of their nation The

military networks to include decision briefs tasks and emails in Iraq and the Predator feeds in

Afghanistan travel through military and commercial satellites with all the information flowing

through the cyberspace domain With the heavy reliance of cyberspace to operate space assets

and the demands of information flowing through space by businesses it should come as no

surprise that space is a vital component for day-to-day operations of the military

Since cyberspace is an inherent component for space operations it is logical to assume

international law for outer space is applicable to cyberspace as long as an aggressor doesnt

violate the four premises and as long as weapons of mass destruction arenrsquot ldquostationed in outer

spacerdquo 28 Therefore a state would consider a cyber attack against a satellite as other than for

peaceful purposes and according to the fourth premise international law would apply

However what about a cyber attack using satellites as a means of conducting operations

Under todayrsquos current operations international elites havenrsquot considered a cyber attack passing

through space as a violation of international law When a senior leader in Qatar approves a

target set that is executed by a pilot in Nevada by an aircraft in Afghanistan all this information

is transmitted by cyberspace through space The result is that an aircraft renders an air or ground

target inoperable The effect is the same for cyberspace The information flows through space

by way of the cyberspace domain and the result is that an operator has rendered a target

11

AUACSCSinksAY08

inoperable As with airspace the information isnrsquot the cause of the damage but what an operator

does with the information is what constitutes the cyber attack

Land Cyber attacks using resources over land is relatively straightforward International

boundaries are defined as ldquoimaginary lines which separate territorial sovereigntyrdquo 29 which are

mutually agreed upon via international treaties Crossing an international border without

permission from the state is a violation of international law While an illegal immigrant crossing

a border to seek an opportunity to provide for his family is a violation of national law the United

Nation considers a nation-sponsored invasion of another nation that threatens the security and

stability of a nation as a breach in international law and an act of war

However international law doesnrsquot consider all border crossings as an act of war For

example when Nicaraguan troops and arms allegedly crossed the borders of El Salvador the

United Nations determined that incursions didnrsquot threaten El Salvadorrsquos territorial integrity and

stated that neither ldquothese incursions nor the alleged supply of arms may be relied upon as

justifying the exercise of the right of collective self-defenserdquo30 The victim state can repelled the

aggressive act but the United Nations Council wouldnrsquot condone any further military action

taken against the adversary opting for diplomatic or economic solution instead

Does international law apply when an adversary crosses international borders using

cyberspace as the means for conducting warfare operations When an adversarial state crosses a

statersquos boundaries using roads or bridges that connect the two nations the road is the resource

spanning the two nations If the adversary doesnrsquot do anything then returns to their sovereign

borders the aggressor hasnrsquot violated international law However when the adversary uses

weapon systems to affect serious damage the adversary has broken international law and a

12

AUACSCSinksAY08

nation may invoke their right for self-defense and may conduct full-scale operations to neutralize

the threat

A parallel notion is when an adversary uses a copper or fiber optic connection that spans

between two nations The adversary uses the land-based LAN connection as a means for

conducting cyber warfare operations The adversary may cross the borders using cyberspace yet

do nothing The affected state may push the adversary back to its borders but no further actions

are deemed appropriate However once the adversary uses the information transmitted over

cyberspace to cause severe operational or strategic damage the affected state now has the right

of self-defense Cyberspace is the means like the road or bridge for which the adversary

delivered the weapon The affected nation will consider the execution of the adversaryrsquos

information packet or weapon system as an act of aggression and the effect caused by the

weapon is what breeches international law

The difference between these two scenarios is that the adversary using the

electromagnetic spectrum hasnrsquot physically invaded a nationrsquos sovereign borders However

their digital presence crossed sovereign borders and as latter discussed in the paper adversaries

committing an act aggression against a state are now under the jurisdiction of the affected state

Sea ldquoThe territorial sea is a belt of sea adjacent to the (statersquos) coasthellipto include the airspace

aboverdquo as well as the seabed and subsoil31 The territorial sea is subject to the right of innocent

passage by foreign shops giving states the right to transport goods and passengers between ports

All of which is subject to the full sovereignty of the state which according to the United Nations

Convention on the Law of the Sea in 1982 and agreed upon by the majority of its membership in

1982 extends 12 miles from the coast32 The jurisdiction includes crimes where the

consequences extend to the coastal state and disturbs the peace of the country33 A cyber attack

13

AUACSCSinksAY08

conducted within the territorial sea of a nation would be no different from a cyber attack

conducted from within the nationrsquos land borders therefore cyber attacks against a state or even

another state conducted within the territorial seas are subject to current international laws Cyber

attacks originating outside the statersquos sovereign borders but results in affecting a statersquos

resources in their territorial seas would fall under the land and airspace breeches of territorial

sovereignty and would be subject to international law

The high seas on the other hand arenrsquot subject to the sovereignty of any one state The

high seas extend beyond the territorial sea and include the airspace the seabed and the subsoil34

and all states have the right to exercise freedoms on the high seas35 As similarly defined in

space ldquothe high seas shall be reserved for peaceful purposesrdquo as stated by Article 88 of the Law

of the Seas Cooperative36 which is defined as refraining from any threat or use of force (outside

of wartime conflicts)

The very nature of a cyber attack in the high seas lends itself to be a violation of

international law as nations are restricted to conducting peaceful operations in the high seas

The question is whom has jurisdiction of crimes committed in the high seas By applying the

Protective Security Principle of Jurisdiction where an actor threatens a statersquo security and

introducing the United Nationrsquos definition on the Illegal Use of Force extends to the high seas

and for that matter space giving states the right for self-defense as defined by the United Nations

as ldquoan armed attackrdquo The sheer name of cyber attack doesnrsquot immediately lend itself to an

ldquoarmedrdquo cyber attack However the effects generated from a cyber attack can be equivalent to a

traditional conventional attack and the international law would permit a state to take appropriate

countermeasures while notifying the United Nations Security Council37

14

AUACSCSinksAY08

Applying International Law to Cyber Warfare Today we live in an Information Age where communication through cyberspace has forever changed and flattened out worldhellipOur adversaries seek to operate from behind technical legal and international screens as they execute their costly attacks38

~General James E Cartwright Commander United States Strategic Command

Jurisdiction

Understanding the territorial sovereignty principles of a nation is important in applying

cyberspace and cyber warfare to existing international laws While some of these principles and

international laws may not be relevant for the cyberspace domain due to the far-reaching

capability of cyber warfare the jurisdiction of a nation further defines its ability to respond to

aggressive acts by nations in the cyberspace domain There are three jurisdictional principles

that provide nations the right to pursue aggressors that threaten a nationrsquos independence the

Territorial Principle Nationality Principle and the Protective Security Principle

For actions originating within the state the jurisdiction clearly falls within the territorial

principle where a ldquostate has jurisdiction over all crimes committed in its territoryhellipto include

airspace international waters and territorial seasrdquo39 The territorial jurisdiction is subject to

exceptions when dealing with persons from foreign states as in the most popular example of

immunity given to foreign diplomats In this case ldquostates may exercise jurisdiction over its

citizenhellipeven if they are physically outside the statesrsquo territoryrdquo as Doctor Boczek defines as the

Nationality Principle Nations usually agree upon on these concessions states prior to the offense

being committed40

Doctor Boczek defines the Protective Security Principle as a ldquojurisdictional principle

whereby a state my assume jurisdiction over and punish foreign nationals for certain conduct

outside its territory which is directed against its security territorial integrity and political

independencerdquo41 Some states would argue that criticism of a state or government is applicable

15

AUACSCSinksAY08

in applying this principle of jurisdiction However this is too broad of an interpretation and

should be confined to acts that are more tangible in nature like falsification of a statesrsquo official

documents conspiracy to violate immigration of custom laws and illicit drug trafficking42

Would a cyber attack that is deemed to challenge a nationrsquos banking community or bring

down a power source be a direct attack against its security and political independence The

international community easily sees the attack of a power source with kinetic weapons as a

violation of a territorial boundary and a breech of international law The United States viewed

the attack on the Trade Towers as an act of war launching the Global War on Terrorism Would

the United States have viewed the same devastation as if the attack occurred through cyberspace

Would the attack have been less of an act of war if the aggressor remotely controlled domestic

airliners from a foreign country Probably not What happens if the cyber attack caused a fire in

the lower floors of the buildings preventing people from escaping While less dramatic than an

airbus flying into the middle of the towers and maybe more difficult to demonize the crime the

result is the samemdashinnocent people suffering as a result of an adversary trying to threaten a

nationrsquos security

What happens if the suspected cyber attack has violated a nationrsquos territorial boundary in

order to attack a neighboring country or an ally Going from point A to point B in cyberspace is

rarely a direct connection As with the global nature of cyberspace itrsquos conceivable that

adversaries cross several nationsrsquo boundaries to conduct cyber attack operations The question

generated is who has jurisdiction

If the actor committing the crime had used an airplane each nation could claim

jurisdiction as the adversary violated their territorial boundaries and violated international law

More often than not the first state would have acted immediately upon the aggressive act and

16

AUACSCSinksAY08

would have prevented aggressors from completing their task by either forcing the aircraft to land

or turnaround or an even more escalated response of firing upon the aircraft In the air land or

sea the ability for a nationrsquos military forces to respond in a timely manner gives way to the

deterrence factor of not crossing a statersquos boundaries without receiving permission for fear of

reprisal A clear example of this was when Turkey denied the United States the ability deploy

the 4th Infantry Division from its borders at the beginning of Operation Iraqi Freedom Violating

Turkeyrsquos borders without permission would have brought about great repercussions that would

have made Operation Iraqi Freedom even more difficult and could have resulted in an escalation

of the war outside the Iraqi borders43 Another example is when Spain and France denied the

Unites States the use of their airspace when F-111s based in the United Kingdom conducted air

operations in Libya in an effort to eliminate Muammar Khadafy44

However the speeds at which these breeches in territorial boundaries occur make it

difficult for a nation to claim jurisdiction especially when nothing occurred within their

territorial sovereignty The cyber attacks didnrsquot result in any damage to nation as the information

packets passed through their sovereign borders According to territorial boundary description

described by Doctor Boczek the international community doesnrsquot consider the crossing the

border in of itself an act of warmdashserious damage is a driving factor in determining conflict

escalation In addition according to the territorial jurisdiction principle the cyber attack didnrsquot

threaten a nationrsquos security territorial integrity and political independence If the cyber attack or

information originated from within a sovereign territory by a third party then the two nations

would have to work together to resolve the issue and mutual jurisdiction would probably apply

However if the cyber attack didnrsquot physically manifest itself from within their sovereign

territory or the adversary didnrsquot use the nation as a staging area to launch a further attack the

17

AUACSCSinksAY08

international law and the jurisdiction principles would dictate the affected nation would have

jurisdiction

Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security

territorial integrity and political independence Cyberspace utilizes the other domains as a means

of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence

Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of

territorial sovereignty the Protective Security Principle does provide nations the ability to

enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos

sovereignty when it conducts cyber warfare operations However some elites donrsquot consider

cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense

International law specifically article 2 of the United Nations Charters states that a

members shall refrain in their international relations from the threat or use of force against the

territorial integrity or political independence of any state or in any other manner inconsistent

with the purposes of the United Nations which is intended to prohibit all types of force except

those carried out under the aegis of the United Nations or as provided for by the Security

Council45 The only exception to the United Nations Charters as it relates to the Use of Force is

the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed

attack46

International elites have discussed the term ldquouse of forcerdquo in the past because of the

development of chemical and biological weapons and had to move from a kinetic impact based

definition to a results-oriented approach47 Chemical and biological weapons lacked the

characteristic of an explosion or physical force yet these weapons certainly are capable of

destroying life and property Doctor Leigh Armistead a former information warfare instructor at

18

AUACSCSinksAY08

the Joint Forces Staff College cautions that the use of computer network attacks by the military

ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary

that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great

Russia introduced a proposal to the United Nations that banned the use of information

operations Even though the United Nations didnrsquot adopt the law the concern of international

community is fully aware of the impact cyber attacks can have on a nation

The concern over cyber warfare capabilities is that it can generate both non-kinetic and

kinetic effects There has always been the traditional kinetic solution for cyber warfare where a

precision guidance munition destroys a critical information system node Most people assume

computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos

computer system from the safety of onersquos own command and control center but the physical

destruction of a computer system or network by kinetic means also qualifies as cyber warfare

However cyber warfare has also evolved to the point where aggressors can achieve a kinetic

effect without the use of a traditional kinetic weapon A cyber attack on an information system

can shut down a particular node of a power plant causing the system to become inoperative

Even if there wasnrsquot an explosion the attack serves the same purpose

The question raised is do cyber attacks constitute an armed attack Scholars do agree that

some cyber attacks fit comfortably within the United Nations Charter For example a strategic

level cyber attack causing widespread damage and significant casualties would trigger the statersquos

right of self-defense In addition a cyber attack that precluded a conventional attack or a series

of cyber attacks causing significant damage would give a state the right of self-defense49 Few

would dispute that a country has the right under international law to respond with military force

19

AUACSCSinksAY08

if a state destroyed or significantly damaged another nationrsquos economic system for example the

New York or London stock exchanges

However some confusion and state-defined interpretation comes into play when the

frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard

Law School argues that cyber attacks require an expansion of the definition on the ldquouse of

forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot

be prohibited by international law50 International scholars recommend ldquoclearer rules of what

kinds of information warfare actions constitute an armed attackrdquo which drives permissible

responses of self-defense51 For example a state-sponsored cyber attack causes damage to a

victimrsquos factory or power plant however the nation claims the incident is an isolated instance

and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under

the United Nations Charter and the United Nations would consider any response retaliation

which would violate international law52

Another example involves a nation conducting a series of small attacks causing minimal

damage and then ceases Even though the aggressor used force to conduct cyber warfare

operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under

the United Nations Charter This type of attack is analogues to a small band of troops crossing a

border without causing significant damage53 According to the United Nations Charter the

national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders

and respond to the use of force Repelling the small band of troops and reestablishing their

sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration

of war and allies would have to respect the United Nations decision and couldnrsquot intervene The

same is true for the cyber attack A state can employ defensive measure to isolate and defeat the

20

AUACSCSinksAY08

incursion over the electromagnetic spectrum However the United Nations would see further

offensive operations or invasive operations as retaliation Therefore a nation must take the

incident whether it is signs of conventional forces on the ground or traces of cyber warfare

incursions in the electromagnetic spectrum to the United Nations to seek restitution

In both of these situations the international law becomes the target for change not

whether cyber warfare is in violation of international law If the law were to change the

international community would then consider the above situations acts of war even if an

adversary used conventional forces As written today the result of an operation remains the

driving factor in determining if an adversary has violated international law The means by which

an adversary conducts military operations may affect how nations react to the situation but

whether an adversary conducts the operation by means of the air land sea space or cyberspace

doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian

Triggs a public international lawyer and member of the Attorney General International Legal

Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over

offences abroad having an intended and substantial effect within a state may be justifiedrdquo54

Therefore the international community must evaluate the effect of a criminal act rather than the

means in which the act was committed

Others claim that because the Internet takes advantages of legal norms where non-state

actors can ignore Western notions of law55 more international laws are needed for cyberspace

However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using

other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the

Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked

aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts

21

AUACSCSinksAY08

against a staterdquo in the cyberspace domain The anonymity of the Internet and their total

disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and

national laws already exist in most countries that prohibit the use of the Internet for terrorist

activities therefore additional international laws wouldnrsquot prevent or deter terrorist from

committing such acts of aggression

International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed

Conflict includes the Martens Clause which extends established custom and humanitarian

principles to new technologies and addresses the ever-changing nature of warfare The

international community designed The Martens Clause ldquoto prevent future unnecessary andor

disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges

crimes by invoking the laws of humanity and public conscience hence their effects and not its

methods

The basic legal premise behind Law of Armed Conflict is that attacks must be limited to

military objectives and collateral damage must be proportionate to military advantages and

forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary

suffering but military commanders and planners need to be aware of the results a particular

action will invoke Russian leadership believes a computer network attack against their

homeland can be a means for executing a variety of escalating responses to include nuclear

attack58 Therefore it is imperative military commanders understand the impact any weapon

system can have on an adversary not just cyber attacks

Not all scholars agree that international law is insufficient to govern cyber warfare

Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace

and the Use of Force states that computer network attacks constitute an unlawful use of force in

22

AUACSCSinksAY08

cyberspace under traditional international law Sharp declared that an armed attack may occur

ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a

way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive

definition of cyber attacks may never be drafted59 The Congressional Research Service also

concluded that ldquothere is little likelihood that the international community will soon generate a

coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations

on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos

conclusion is that the effects of cyber warfare operations are the same as if an adversary

conducted conventional warfare operations where the effect of the attacks are the driving factors

in determining whether an adversary used force or not

The United States Government agrees with Sharprsquos conclusion The offensive

Information Operation strategy for the United States government as described by Doctor

Armistead ties the tools used to conduct military operations back to the desired effect which is

in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning

effects-based operations and operational art focus the Joint Force Commanderrsquos course of action

towards meeting objectives outlined in guidance provided by the National Command Authority

and senior military leadership62 Whether the tools are dropped pamphlets invasive network

attacks or bombs on targets the goal is to produce a desired effect to achieve the overall

objectives and cyber warfare can produce effects that challenge the national security of a nation

Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63

~General T Michael Moseley USAF

23

AUACSCSinksAY08

The cyberspace domain has been around for quite sometime but as technology continues

to advance businesses as well as governmental organizations are becoming more reliant on the

cyberspace domain With that reliance the protection of this critical domain becomes even more

important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the

electromagnetic spectrum by denying and disrupting information demands Scholars claim that

protection needs to include addressing existing international laws expanding them to incorporate

the ever-advancing capabilities emerging in the cyberspace domain

However territorial sovereignty of a nation and the principles of jurisdiction specifically

the Protective Security Principle give nations the right to exercise jurisdiction when an

aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64

While cyberspace is a domain requiring specific attention it relies on assets in the other domains

of land space sea and air in order to operate and international laws for the linear domains do

exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace

but during cyber warfare operations the principles behind the restrictions of foreign military

entering airspace do apply The strategic nature of cyber warfare operations correspond to the

same strategic impact that airpower can inflict upon a nation threatening their independence

While maybe not as dramatic as kinetic effects the results can be just as devastating

Space is relatively straightforward Since a nation canrsquot claim space and over flights of

foreign satellites over a nation is permissible nations must use space for peaceful purposes

Kinetic attacks against space assets are a violation of international law therefore nations would

consider cyber warfare operations against space assets as other than peaceful purposes and a

violation of international law Cyber attacks traversing space assets relate to current military

operations where the military uses space assets to conduct kinetic operations Since international

24

AUACSCSinksAY08

elites havenrsquot considered these kinetic operations as a breach of international law military

commanders can conduct cyber warfare operations through space without fear of violating

international laws for outer space

Crossing international borders without a nationrsquos permission and threatening their

sovereignty is a violation of international law While nations canrsquot consider all border crossings

as an act of war those acts of aggression that threaten the territorial integrity would elicit a

defensive response by the victim nation Whether incursions involve combat vehicles over a

highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are

threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not

have set foot in the nation but according the Protective Security Principle the victim nation has

jurisdiction

Conducting cyber warfare operations from the territorial sea is no different from

conducting operations from within a nationrsquos land or sea borders However the high seas are

very similar in nature to space in that they are reserved for peaceful purposes Therefore

conducting any means of warfare from within the high seas is a violation of international law

and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-

defense

According to Barkham ldquoinformation warfare attacks are in essence territorial

penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then

subject to the jurisdiction of the victim nation who then has the right for self-defense However

due to the global nature of cyberspace aggressors can cross multiple borders and determining

who has jurisdiction demands cooperation among nations The origin and any deliberate staging

locations of the cyber attack will drive who has jurisdiction The crossing of third party borders

25

AUACSCSinksAY08

by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the

aggressors threaten a nationrsquos independence or territorial integrity

Scholars consider cyber warfare operations that involve strategic and operational impacts

as being a means of using force and fall within the legal regime of existing international law

However scholars argue that because cyber warfare includes kinetic and non-kinetic results the

Use of Force definition needs expanding Yet they conclude that an exhaustive definition of

cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare

operations against existing case studies where the effects are evaluated as opposed to the means

even if the operations originated from outside the nationrsquos territorial jurisdiction There is some

authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to

have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade

non-state actors from conducting cyber warfare operations given their willingness to ignore

Western notions of war and their ability to conduct operations anonymously in cyberspace

International laws are in place to that address the ever-changing nature of warfare The

Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a

framework for addressing all warfare to include cyber warfare operations The international

community will need to measure the effects of an operation rather the means Whether its boots

on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a

nationrsquos response

26

AUACSCSinksAY08

End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)

27

AUACSCSinksAY08

44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

28

AUACSCSinksAY08

Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005

Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department

American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)

Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983

Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988

Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)

Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)

IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)

Joint Publication 3-13 Information Operations 13 February 2006

Joint Publication 5-0 Joint Operations Planning 26 December 2006

Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies

Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc

Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College

Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)

Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press

29

AUACSCSinksAY08

Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI

Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)

Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press

Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company

Detter Delupis I The law of war (2000) New York NY Cambridge University Press

Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)

Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College

Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor

Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)

Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)

Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf

Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)

Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College

Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College

Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)

Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA

30

AUACSCSinksAY08

Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)

Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)

Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College

Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology

Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College

Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)

OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center

OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College

OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications

Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991

Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College

Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center

Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)

31

AUACSCSinksAY08

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press

Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA

Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University

Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor

Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661

Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office

Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis

United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC

United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center

Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College

Wesley David C The Military Commander and the Law 2006

32

Page 8: Sinks 0407

AUACSCSinksAY08

cyberspace includes ldquocapabilities that are currently considered electronic warfarerdquo11 which Great

Britain exploited in World War II when they introduced radar technology in World War II and is

still applicable with communication and navigational jamming capabilities used in todayrsquos

conflicts

While cyberspace is a unique domain that military commanders must protect in order to

conduct operations more effectively and offers commanders another dimension in which to

exploit weaknesses in an adversaryrsquos ability to project power cyberspace doesnrsquot exist on its

own According to Lt Col Fahrenkreg in the published Air University article title Cyberspace

Define ldquocyberspace exists across the other domains of air land sea and spacerdquo12 There are

clear delineations between the sea land and air Commanders know where the land ends and the

sea begins While there are some discussions as to where airspace ends and space begins the

capabilities and roles associated with each domain are clear Therefore to depict cyberspace as

an autonomous domain is unrealistic as the physical infrastructure of cyberspace and the means

of sharing information within the cyberspace domain resides in one or more of the four linear

domains

What Cyberspace is Not The most confused notion about cyberspace is that information operations and

cyberspace are one in the same Joint Publication 3-13 Information Operations describes the

information environment as a collection of leaders decision makers and systems that process

collect disseminate or act on information consisting of three dimensions the physical

informational and cognitive dimensions13 The goal of information operations is to influence the

cognitive dimension by affecting the decision-making process known affectionately by the Air

Force as the OODA Loop (Observe Orient Decide and Act)14 By disrupting and corrupting

4

AUACSCSinksAY08

information processes military commanders can influence or usurp adversarial human and

automated decision making in the physical and informational dimensions

As stated by Lt Col Fahrenkreg the confusion between cyberspace and information

operations comes from the misunderstanding of cyberspace as an operation rather than a

domain15 Information operation is a capability available to the combatant commander to

generate an effect in one of the five domains It just so happens that cyberspace tends to be the

primary means of delivering the Information Operation capability

Cyberspace connects the physical dimensions with the cognitive process and is a means

to create effects to include disrupting degrading denying the enemy the use of strategic and

operational assets to include command and controls systems power plants telecommunications

and other like targets to affect a statersquos operational and strategic centers of gravity Cyberspace

isnrsquot information or the data residing on a computer but is the means in which users transfer

store or modify information Cyberspace isnrsquot the data sent to a precision guided munition but

the means in which the originator passes the information Cyberspace is the digital super

highway of the electromagnetic spectrum with the ones zeros and electrons as the passengers

Defining Cyber Warfare According to the Institute for Advanced Study of Information Warfare (ASIW) cyber

warfare has become a form of information warfare which ASIW defines as ldquothe offensive and

defensive use of information and information systems to deny exploit corrupt or destroy and

adversaryrsquos information information-based processes information systems and computer-based

networks while protecting onersquos own Such actions are designed to achieve advantages over

military adversariesrdquo16 While this definition doesnrsquot specifically address the electromagnetic

spectrum the definition focuses on information-sharing systems which is where crux of the

cyberspace domain revolves around

5

AUACSCSinksAY08

Joint doctrine defines cyber warfare as those areas of operations that affect the

electromagnetic spectrum to include Computer Network Operations and Electronic Warfare

which are two of the five core operational capabilities of Information Operations Electronic

warfare operations operates across ldquoradio visible micro directed energy and all other

frequenciesrdquo and overlaps with network warfare operations which include ldquoradio nets satellite

links tactical digital information links (TADIL) telemetry digital track files

telecommunications and wireless communication network and systemsrdquo all of which operate

within the electromagnetic spectrum17

Cyber warfare consists of defensive and offensive operations Defensive operations

arenrsquot limited to severing connections or blocking attempts of an adversary trying to corrupt data

modify transmissions or destroy information systems Defensive operations include the

elimination of the adversaryrsquos capability of conducting operations which may involve crossing

sovereign borders in order to complete the task However defensive network operations come in

more than just one form The movies portray computer experts hovering over computers trying

to affect each otherrsquos operations However cyber warfare includes the use of traditional kinetic

effect to disrupt computer network operations of the enemy as a fighter-bomber delivering a

500-pound bomb to destroy a vital mode in a computer network may serve the same purpose as a

computer-centric network attack While this isnrsquot as sexy as a network attack that spans the

globe to degrade the enemyrsquos ability operation within the cyberspace domain the effects are the

same

Territorial Sovereignty In total war it is quite impossible to draw any precise line between military and non-military problems18

~Sir Winston Churchill

6

AUACSCSinksAY08

Cyberspace is certainly a domain that requires unique attention in order for commanders

to effectively and efficiently prosecute combat operations Cyberspace spans the globe using

the physical infrastructure residing within the other linear domains As users pass information

from one site to another data crosses boundaries by means of the cyberspace domain Data

leaves the Iraq area of operation via satellite to a receiving site in Germany Operators route the

information to the United States either through another satellite or by ground to sea-based cables

bound for computer nodes within the United States before arriving in South Carolina where

automated network tools redirect the information to the receiverrsquos location

An adversary attempting to modify corrupt or destroy this information traveling within

the cyberspace domain would at one time or another would cross sovereign borders through air

land sea or space The adversaryrsquos physical presence may not apply as they could conduct

operations from the comforts of their home however a nation could detect the adversaryrsquos

digital presence and could feel the impact of their actions from within their sovereign borders

Therefore as these adversaries span the globe using the cyberspace domain that relies on the

other linear domains to exist does international law apply when boundaries are crossed The

following sections will address the international laws of each physical domain and evaluate how

their principles apply to the cyberspace domain

Airspace Airspace as defined by Doctor Boleslaw A Boczek the internationally renowned expert

on international law ldquois the air pillow above the subjacent territoryrdquo to include ldquoairspace above

international waters and the territorial seardquo The airspace is under complete and exclusive

sovereignty of the subject state19 With that states have jurisdiction over their airspace and

require identification of foreign aircraft along with their intentions According to Dr Boczek

book International Law A Dictionary ldquoentry of national spacehellipmay take place only with the

7

AUACSCSinksAY08

authorization of the territorial staterdquo20 and currently only applies to aircraft Entry into the

airspace would require ldquoall aircraft to identify themselves file flight plans and report their

positionrdquo According to the 1944 Chicago Convention on International Civil Aviation nations

can enter into agreements that allow scheduled international civil air services which usually

include reciprocal agreements covering routes volume and other matters relating to air traffic

However these agreements only apply to civil aviation where state aircraft which include

aircraft belonging to the military customs public services and heads of states must follow more

restrictive procedures upon entering the airspace of a foreign nation21

There are several incidents where states have evoked their right for defending their

national security like the shooting down of a US military reconnaissance aircraft over Soviet

airspace by the Soviet Union in 196022 or the shooting down by Soviet fighter planes of a South

Korean airliner in 198323 The Soviet Union isnrsquot the only nation to protect its airspace as the

United States was responsible for shooting down an Iranian airliner thought to be an attacking

military plane over the Persian Gulf in 198824 These examples illustrate a nationrsquos sovereign

resolve to protect itself when a suspected adversary violated their airspace

Applying international law of airspace to cyberspace doesnrsquot seem too practical Civilian

signals entering a nationrsquos airspace would require nations to enter into agreements to allow

scheduled services and the persons receiving information through airspace would have to be

non-state sponsored Nationrsquos could regulate some cyberspace networks entering airspace like

radio communications that primarily use land-based infrastructure to function However the

very nature of computer networks and the ever-increasing global reach of communication

capabilities severely restrict a nationrsquos ability to monitor the millions of transmissions made on a

daily basis and these signals certainly wouldnrsquot be on any scheduled basis Therefore even if

8

AUACSCSinksAY08

nations made agreements concerning the cyberspace domain nations would have a difficult time

enforcing their terms of agreements unless the terms are very open-ended If they were so open-

ended then the agreement may not be necessary and based on my research nations realize the

futility of establishing these agreements as this author couldnrsquot find any reference to any

agreements that nations have entered into referencing the cyberspace domain

While the international law for civilian aircraft in airspace may not relate well or isnrsquot

feasible to enforce in the cyberspace domain does a nation have that same right to protect itself

from a suspected attack from cyberspace where the attackerrsquos signal enters airspace Does a

nation have the right to ldquoshoot downrdquo a cyberspace attack as it enters their domain through

airspace The whole idea behind restricting airspace from foreign military aircraft is because of

the strategic impact military aircraft can have on a nation As demonstrated in World War II

military aircraft carrying weapons of mass destruction can decimate cities and destroy a nation

with minimal effort The effects generated by military aircraft are quite destructive and garner

specific attention While an aircraft in of itself is relatively harmless the actions taken by the

crew can lead to devastating results

The same is true for cyber attacks The information passing through airspace in the

cyberspace domain is the vehicle however the crew conducting the operation is potentially

creating the same strategic results The cyber attack may not destroy cities but it certainly can

be destructive to a nationrsquos well-being by crippling power sources economic industries water

supply etc all at the blink of an eye while the victim takes several days to determine the

perpetrator Therefore while the international law for airspace may not be specifically relevant

the underlying principles are applicable as cyber attacks can have the same potential strategic

impact as an attack from a military aircraft

9

AUACSCSinksAY08

Space Outer space as defined by Doctor Boczek ldquois the space beyond the air surrounding the

earthrdquo As of 2005 international law doesnrsquot define a demarcation between airspace and outer

space but ldquostates agree that state sovereignty doesnrsquot extend without any limitsrdquo25 Proposals of

where airspace ends and when outer space begins are base on various scientific and technological

criteria (gravitational pull capabilities of air breathing aircraft etc26) Others scientists argue

that defining a boundary between airspace and outer space isnrsquot necessary as it would hinder the

progress of space technology and the legal status would depend on the nature of the activity

While no boundary exists airspace is finite and activity in outer space follows four

fundamentals principles First over flights of foreign satellites over a nation is permissible as

airspace doesnrsquot extend forever Second space ldquointernational law applies to outer space and

celestial bodiesrdquo Third according to the Outer Space Treaty of 1967 states canrsquot claim celestial

bodies or outer space which are not subject to national appropriation therefore are free for use

by all states Finally states must use outer space exclusively for peaceful purposes with specific

bans on weapons of mass destruction However states can use space for other military purposes

like intelligence surveillance and reconnaissance activities 27

Are these international laws and principles applicable to cyberspace Satellites are

certainly an integral part of the space domain Operators control satellites by using the

cyberspace domain and information passes between satellites and ground stations One can

argue that space is a sub-set of the cyberspace domain with satellites serving as computers in

space Global positioning system devices in vehicles interact with satellites all through an

elaborate network as part of the electromagnetic spectrum known as cyberspace Therefore

cyberspace is in space with millions of people using cyberspace everyday

10

AUACSCSinksAY08

The military uses space assets for intelligence surveillance and reconnaissance

knowledge management and command and control Agencies like the National Reconnaissance

Office and National Geospatial-Intelligence Agency obtain high-altitude imagery using a variety

of capabilities to include heat signature resonation Satellites can detect missile launches which

provide vital military information to senior leaders tasked with the security of their nation The

military networks to include decision briefs tasks and emails in Iraq and the Predator feeds in

Afghanistan travel through military and commercial satellites with all the information flowing

through the cyberspace domain With the heavy reliance of cyberspace to operate space assets

and the demands of information flowing through space by businesses it should come as no

surprise that space is a vital component for day-to-day operations of the military

Since cyberspace is an inherent component for space operations it is logical to assume

international law for outer space is applicable to cyberspace as long as an aggressor doesnt

violate the four premises and as long as weapons of mass destruction arenrsquot ldquostationed in outer

spacerdquo 28 Therefore a state would consider a cyber attack against a satellite as other than for

peaceful purposes and according to the fourth premise international law would apply

However what about a cyber attack using satellites as a means of conducting operations

Under todayrsquos current operations international elites havenrsquot considered a cyber attack passing

through space as a violation of international law When a senior leader in Qatar approves a

target set that is executed by a pilot in Nevada by an aircraft in Afghanistan all this information

is transmitted by cyberspace through space The result is that an aircraft renders an air or ground

target inoperable The effect is the same for cyberspace The information flows through space

by way of the cyberspace domain and the result is that an operator has rendered a target

11

AUACSCSinksAY08

inoperable As with airspace the information isnrsquot the cause of the damage but what an operator

does with the information is what constitutes the cyber attack

Land Cyber attacks using resources over land is relatively straightforward International

boundaries are defined as ldquoimaginary lines which separate territorial sovereigntyrdquo 29 which are

mutually agreed upon via international treaties Crossing an international border without

permission from the state is a violation of international law While an illegal immigrant crossing

a border to seek an opportunity to provide for his family is a violation of national law the United

Nation considers a nation-sponsored invasion of another nation that threatens the security and

stability of a nation as a breach in international law and an act of war

However international law doesnrsquot consider all border crossings as an act of war For

example when Nicaraguan troops and arms allegedly crossed the borders of El Salvador the

United Nations determined that incursions didnrsquot threaten El Salvadorrsquos territorial integrity and

stated that neither ldquothese incursions nor the alleged supply of arms may be relied upon as

justifying the exercise of the right of collective self-defenserdquo30 The victim state can repelled the

aggressive act but the United Nations Council wouldnrsquot condone any further military action

taken against the adversary opting for diplomatic or economic solution instead

Does international law apply when an adversary crosses international borders using

cyberspace as the means for conducting warfare operations When an adversarial state crosses a

statersquos boundaries using roads or bridges that connect the two nations the road is the resource

spanning the two nations If the adversary doesnrsquot do anything then returns to their sovereign

borders the aggressor hasnrsquot violated international law However when the adversary uses

weapon systems to affect serious damage the adversary has broken international law and a

12

AUACSCSinksAY08

nation may invoke their right for self-defense and may conduct full-scale operations to neutralize

the threat

A parallel notion is when an adversary uses a copper or fiber optic connection that spans

between two nations The adversary uses the land-based LAN connection as a means for

conducting cyber warfare operations The adversary may cross the borders using cyberspace yet

do nothing The affected state may push the adversary back to its borders but no further actions

are deemed appropriate However once the adversary uses the information transmitted over

cyberspace to cause severe operational or strategic damage the affected state now has the right

of self-defense Cyberspace is the means like the road or bridge for which the adversary

delivered the weapon The affected nation will consider the execution of the adversaryrsquos

information packet or weapon system as an act of aggression and the effect caused by the

weapon is what breeches international law

The difference between these two scenarios is that the adversary using the

electromagnetic spectrum hasnrsquot physically invaded a nationrsquos sovereign borders However

their digital presence crossed sovereign borders and as latter discussed in the paper adversaries

committing an act aggression against a state are now under the jurisdiction of the affected state

Sea ldquoThe territorial sea is a belt of sea adjacent to the (statersquos) coasthellipto include the airspace

aboverdquo as well as the seabed and subsoil31 The territorial sea is subject to the right of innocent

passage by foreign shops giving states the right to transport goods and passengers between ports

All of which is subject to the full sovereignty of the state which according to the United Nations

Convention on the Law of the Sea in 1982 and agreed upon by the majority of its membership in

1982 extends 12 miles from the coast32 The jurisdiction includes crimes where the

consequences extend to the coastal state and disturbs the peace of the country33 A cyber attack

13

AUACSCSinksAY08

conducted within the territorial sea of a nation would be no different from a cyber attack

conducted from within the nationrsquos land borders therefore cyber attacks against a state or even

another state conducted within the territorial seas are subject to current international laws Cyber

attacks originating outside the statersquos sovereign borders but results in affecting a statersquos

resources in their territorial seas would fall under the land and airspace breeches of territorial

sovereignty and would be subject to international law

The high seas on the other hand arenrsquot subject to the sovereignty of any one state The

high seas extend beyond the territorial sea and include the airspace the seabed and the subsoil34

and all states have the right to exercise freedoms on the high seas35 As similarly defined in

space ldquothe high seas shall be reserved for peaceful purposesrdquo as stated by Article 88 of the Law

of the Seas Cooperative36 which is defined as refraining from any threat or use of force (outside

of wartime conflicts)

The very nature of a cyber attack in the high seas lends itself to be a violation of

international law as nations are restricted to conducting peaceful operations in the high seas

The question is whom has jurisdiction of crimes committed in the high seas By applying the

Protective Security Principle of Jurisdiction where an actor threatens a statersquo security and

introducing the United Nationrsquos definition on the Illegal Use of Force extends to the high seas

and for that matter space giving states the right for self-defense as defined by the United Nations

as ldquoan armed attackrdquo The sheer name of cyber attack doesnrsquot immediately lend itself to an

ldquoarmedrdquo cyber attack However the effects generated from a cyber attack can be equivalent to a

traditional conventional attack and the international law would permit a state to take appropriate

countermeasures while notifying the United Nations Security Council37

14

AUACSCSinksAY08

Applying International Law to Cyber Warfare Today we live in an Information Age where communication through cyberspace has forever changed and flattened out worldhellipOur adversaries seek to operate from behind technical legal and international screens as they execute their costly attacks38

~General James E Cartwright Commander United States Strategic Command

Jurisdiction

Understanding the territorial sovereignty principles of a nation is important in applying

cyberspace and cyber warfare to existing international laws While some of these principles and

international laws may not be relevant for the cyberspace domain due to the far-reaching

capability of cyber warfare the jurisdiction of a nation further defines its ability to respond to

aggressive acts by nations in the cyberspace domain There are three jurisdictional principles

that provide nations the right to pursue aggressors that threaten a nationrsquos independence the

Territorial Principle Nationality Principle and the Protective Security Principle

For actions originating within the state the jurisdiction clearly falls within the territorial

principle where a ldquostate has jurisdiction over all crimes committed in its territoryhellipto include

airspace international waters and territorial seasrdquo39 The territorial jurisdiction is subject to

exceptions when dealing with persons from foreign states as in the most popular example of

immunity given to foreign diplomats In this case ldquostates may exercise jurisdiction over its

citizenhellipeven if they are physically outside the statesrsquo territoryrdquo as Doctor Boczek defines as the

Nationality Principle Nations usually agree upon on these concessions states prior to the offense

being committed40

Doctor Boczek defines the Protective Security Principle as a ldquojurisdictional principle

whereby a state my assume jurisdiction over and punish foreign nationals for certain conduct

outside its territory which is directed against its security territorial integrity and political

independencerdquo41 Some states would argue that criticism of a state or government is applicable

15

AUACSCSinksAY08

in applying this principle of jurisdiction However this is too broad of an interpretation and

should be confined to acts that are more tangible in nature like falsification of a statesrsquo official

documents conspiracy to violate immigration of custom laws and illicit drug trafficking42

Would a cyber attack that is deemed to challenge a nationrsquos banking community or bring

down a power source be a direct attack against its security and political independence The

international community easily sees the attack of a power source with kinetic weapons as a

violation of a territorial boundary and a breech of international law The United States viewed

the attack on the Trade Towers as an act of war launching the Global War on Terrorism Would

the United States have viewed the same devastation as if the attack occurred through cyberspace

Would the attack have been less of an act of war if the aggressor remotely controlled domestic

airliners from a foreign country Probably not What happens if the cyber attack caused a fire in

the lower floors of the buildings preventing people from escaping While less dramatic than an

airbus flying into the middle of the towers and maybe more difficult to demonize the crime the

result is the samemdashinnocent people suffering as a result of an adversary trying to threaten a

nationrsquos security

What happens if the suspected cyber attack has violated a nationrsquos territorial boundary in

order to attack a neighboring country or an ally Going from point A to point B in cyberspace is

rarely a direct connection As with the global nature of cyberspace itrsquos conceivable that

adversaries cross several nationsrsquo boundaries to conduct cyber attack operations The question

generated is who has jurisdiction

If the actor committing the crime had used an airplane each nation could claim

jurisdiction as the adversary violated their territorial boundaries and violated international law

More often than not the first state would have acted immediately upon the aggressive act and

16

AUACSCSinksAY08

would have prevented aggressors from completing their task by either forcing the aircraft to land

or turnaround or an even more escalated response of firing upon the aircraft In the air land or

sea the ability for a nationrsquos military forces to respond in a timely manner gives way to the

deterrence factor of not crossing a statersquos boundaries without receiving permission for fear of

reprisal A clear example of this was when Turkey denied the United States the ability deploy

the 4th Infantry Division from its borders at the beginning of Operation Iraqi Freedom Violating

Turkeyrsquos borders without permission would have brought about great repercussions that would

have made Operation Iraqi Freedom even more difficult and could have resulted in an escalation

of the war outside the Iraqi borders43 Another example is when Spain and France denied the

Unites States the use of their airspace when F-111s based in the United Kingdom conducted air

operations in Libya in an effort to eliminate Muammar Khadafy44

However the speeds at which these breeches in territorial boundaries occur make it

difficult for a nation to claim jurisdiction especially when nothing occurred within their

territorial sovereignty The cyber attacks didnrsquot result in any damage to nation as the information

packets passed through their sovereign borders According to territorial boundary description

described by Doctor Boczek the international community doesnrsquot consider the crossing the

border in of itself an act of warmdashserious damage is a driving factor in determining conflict

escalation In addition according to the territorial jurisdiction principle the cyber attack didnrsquot

threaten a nationrsquos security territorial integrity and political independence If the cyber attack or

information originated from within a sovereign territory by a third party then the two nations

would have to work together to resolve the issue and mutual jurisdiction would probably apply

However if the cyber attack didnrsquot physically manifest itself from within their sovereign

territory or the adversary didnrsquot use the nation as a staging area to launch a further attack the

17

AUACSCSinksAY08

international law and the jurisdiction principles would dictate the affected nation would have

jurisdiction

Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security

territorial integrity and political independence Cyberspace utilizes the other domains as a means

of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence

Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of

territorial sovereignty the Protective Security Principle does provide nations the ability to

enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos

sovereignty when it conducts cyber warfare operations However some elites donrsquot consider

cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense

International law specifically article 2 of the United Nations Charters states that a

members shall refrain in their international relations from the threat or use of force against the

territorial integrity or political independence of any state or in any other manner inconsistent

with the purposes of the United Nations which is intended to prohibit all types of force except

those carried out under the aegis of the United Nations or as provided for by the Security

Council45 The only exception to the United Nations Charters as it relates to the Use of Force is

the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed

attack46

International elites have discussed the term ldquouse of forcerdquo in the past because of the

development of chemical and biological weapons and had to move from a kinetic impact based

definition to a results-oriented approach47 Chemical and biological weapons lacked the

characteristic of an explosion or physical force yet these weapons certainly are capable of

destroying life and property Doctor Leigh Armistead a former information warfare instructor at

18

AUACSCSinksAY08

the Joint Forces Staff College cautions that the use of computer network attacks by the military

ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary

that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great

Russia introduced a proposal to the United Nations that banned the use of information

operations Even though the United Nations didnrsquot adopt the law the concern of international

community is fully aware of the impact cyber attacks can have on a nation

The concern over cyber warfare capabilities is that it can generate both non-kinetic and

kinetic effects There has always been the traditional kinetic solution for cyber warfare where a

precision guidance munition destroys a critical information system node Most people assume

computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos

computer system from the safety of onersquos own command and control center but the physical

destruction of a computer system or network by kinetic means also qualifies as cyber warfare

However cyber warfare has also evolved to the point where aggressors can achieve a kinetic

effect without the use of a traditional kinetic weapon A cyber attack on an information system

can shut down a particular node of a power plant causing the system to become inoperative

Even if there wasnrsquot an explosion the attack serves the same purpose

The question raised is do cyber attacks constitute an armed attack Scholars do agree that

some cyber attacks fit comfortably within the United Nations Charter For example a strategic

level cyber attack causing widespread damage and significant casualties would trigger the statersquos

right of self-defense In addition a cyber attack that precluded a conventional attack or a series

of cyber attacks causing significant damage would give a state the right of self-defense49 Few

would dispute that a country has the right under international law to respond with military force

19

AUACSCSinksAY08

if a state destroyed or significantly damaged another nationrsquos economic system for example the

New York or London stock exchanges

However some confusion and state-defined interpretation comes into play when the

frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard

Law School argues that cyber attacks require an expansion of the definition on the ldquouse of

forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot

be prohibited by international law50 International scholars recommend ldquoclearer rules of what

kinds of information warfare actions constitute an armed attackrdquo which drives permissible

responses of self-defense51 For example a state-sponsored cyber attack causes damage to a

victimrsquos factory or power plant however the nation claims the incident is an isolated instance

and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under

the United Nations Charter and the United Nations would consider any response retaliation

which would violate international law52

Another example involves a nation conducting a series of small attacks causing minimal

damage and then ceases Even though the aggressor used force to conduct cyber warfare

operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under

the United Nations Charter This type of attack is analogues to a small band of troops crossing a

border without causing significant damage53 According to the United Nations Charter the

national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders

and respond to the use of force Repelling the small band of troops and reestablishing their

sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration

of war and allies would have to respect the United Nations decision and couldnrsquot intervene The

same is true for the cyber attack A state can employ defensive measure to isolate and defeat the

20

AUACSCSinksAY08

incursion over the electromagnetic spectrum However the United Nations would see further

offensive operations or invasive operations as retaliation Therefore a nation must take the

incident whether it is signs of conventional forces on the ground or traces of cyber warfare

incursions in the electromagnetic spectrum to the United Nations to seek restitution

In both of these situations the international law becomes the target for change not

whether cyber warfare is in violation of international law If the law were to change the

international community would then consider the above situations acts of war even if an

adversary used conventional forces As written today the result of an operation remains the

driving factor in determining if an adversary has violated international law The means by which

an adversary conducts military operations may affect how nations react to the situation but

whether an adversary conducts the operation by means of the air land sea space or cyberspace

doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian

Triggs a public international lawyer and member of the Attorney General International Legal

Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over

offences abroad having an intended and substantial effect within a state may be justifiedrdquo54

Therefore the international community must evaluate the effect of a criminal act rather than the

means in which the act was committed

Others claim that because the Internet takes advantages of legal norms where non-state

actors can ignore Western notions of law55 more international laws are needed for cyberspace

However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using

other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the

Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked

aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts

21

AUACSCSinksAY08

against a staterdquo in the cyberspace domain The anonymity of the Internet and their total

disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and

national laws already exist in most countries that prohibit the use of the Internet for terrorist

activities therefore additional international laws wouldnrsquot prevent or deter terrorist from

committing such acts of aggression

International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed

Conflict includes the Martens Clause which extends established custom and humanitarian

principles to new technologies and addresses the ever-changing nature of warfare The

international community designed The Martens Clause ldquoto prevent future unnecessary andor

disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges

crimes by invoking the laws of humanity and public conscience hence their effects and not its

methods

The basic legal premise behind Law of Armed Conflict is that attacks must be limited to

military objectives and collateral damage must be proportionate to military advantages and

forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary

suffering but military commanders and planners need to be aware of the results a particular

action will invoke Russian leadership believes a computer network attack against their

homeland can be a means for executing a variety of escalating responses to include nuclear

attack58 Therefore it is imperative military commanders understand the impact any weapon

system can have on an adversary not just cyber attacks

Not all scholars agree that international law is insufficient to govern cyber warfare

Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace

and the Use of Force states that computer network attacks constitute an unlawful use of force in

22

AUACSCSinksAY08

cyberspace under traditional international law Sharp declared that an armed attack may occur

ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a

way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive

definition of cyber attacks may never be drafted59 The Congressional Research Service also

concluded that ldquothere is little likelihood that the international community will soon generate a

coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations

on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos

conclusion is that the effects of cyber warfare operations are the same as if an adversary

conducted conventional warfare operations where the effect of the attacks are the driving factors

in determining whether an adversary used force or not

The United States Government agrees with Sharprsquos conclusion The offensive

Information Operation strategy for the United States government as described by Doctor

Armistead ties the tools used to conduct military operations back to the desired effect which is

in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning

effects-based operations and operational art focus the Joint Force Commanderrsquos course of action

towards meeting objectives outlined in guidance provided by the National Command Authority

and senior military leadership62 Whether the tools are dropped pamphlets invasive network

attacks or bombs on targets the goal is to produce a desired effect to achieve the overall

objectives and cyber warfare can produce effects that challenge the national security of a nation

Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63

~General T Michael Moseley USAF

23

AUACSCSinksAY08

The cyberspace domain has been around for quite sometime but as technology continues

to advance businesses as well as governmental organizations are becoming more reliant on the

cyberspace domain With that reliance the protection of this critical domain becomes even more

important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the

electromagnetic spectrum by denying and disrupting information demands Scholars claim that

protection needs to include addressing existing international laws expanding them to incorporate

the ever-advancing capabilities emerging in the cyberspace domain

However territorial sovereignty of a nation and the principles of jurisdiction specifically

the Protective Security Principle give nations the right to exercise jurisdiction when an

aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64

While cyberspace is a domain requiring specific attention it relies on assets in the other domains

of land space sea and air in order to operate and international laws for the linear domains do

exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace

but during cyber warfare operations the principles behind the restrictions of foreign military

entering airspace do apply The strategic nature of cyber warfare operations correspond to the

same strategic impact that airpower can inflict upon a nation threatening their independence

While maybe not as dramatic as kinetic effects the results can be just as devastating

Space is relatively straightforward Since a nation canrsquot claim space and over flights of

foreign satellites over a nation is permissible nations must use space for peaceful purposes

Kinetic attacks against space assets are a violation of international law therefore nations would

consider cyber warfare operations against space assets as other than peaceful purposes and a

violation of international law Cyber attacks traversing space assets relate to current military

operations where the military uses space assets to conduct kinetic operations Since international

24

AUACSCSinksAY08

elites havenrsquot considered these kinetic operations as a breach of international law military

commanders can conduct cyber warfare operations through space without fear of violating

international laws for outer space

Crossing international borders without a nationrsquos permission and threatening their

sovereignty is a violation of international law While nations canrsquot consider all border crossings

as an act of war those acts of aggression that threaten the territorial integrity would elicit a

defensive response by the victim nation Whether incursions involve combat vehicles over a

highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are

threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not

have set foot in the nation but according the Protective Security Principle the victim nation has

jurisdiction

Conducting cyber warfare operations from the territorial sea is no different from

conducting operations from within a nationrsquos land or sea borders However the high seas are

very similar in nature to space in that they are reserved for peaceful purposes Therefore

conducting any means of warfare from within the high seas is a violation of international law

and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-

defense

According to Barkham ldquoinformation warfare attacks are in essence territorial

penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then

subject to the jurisdiction of the victim nation who then has the right for self-defense However

due to the global nature of cyberspace aggressors can cross multiple borders and determining

who has jurisdiction demands cooperation among nations The origin and any deliberate staging

locations of the cyber attack will drive who has jurisdiction The crossing of third party borders

25

AUACSCSinksAY08

by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the

aggressors threaten a nationrsquos independence or territorial integrity

Scholars consider cyber warfare operations that involve strategic and operational impacts

as being a means of using force and fall within the legal regime of existing international law

However scholars argue that because cyber warfare includes kinetic and non-kinetic results the

Use of Force definition needs expanding Yet they conclude that an exhaustive definition of

cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare

operations against existing case studies where the effects are evaluated as opposed to the means

even if the operations originated from outside the nationrsquos territorial jurisdiction There is some

authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to

have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade

non-state actors from conducting cyber warfare operations given their willingness to ignore

Western notions of war and their ability to conduct operations anonymously in cyberspace

International laws are in place to that address the ever-changing nature of warfare The

Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a

framework for addressing all warfare to include cyber warfare operations The international

community will need to measure the effects of an operation rather the means Whether its boots

on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a

nationrsquos response

26

AUACSCSinksAY08

End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)

27

AUACSCSinksAY08

44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

28

AUACSCSinksAY08

Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005

Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department

American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)

Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983

Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988

Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)

Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)

IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)

Joint Publication 3-13 Information Operations 13 February 2006

Joint Publication 5-0 Joint Operations Planning 26 December 2006

Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies

Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc

Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College

Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)

Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press

29

AUACSCSinksAY08

Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI

Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)

Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press

Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company

Detter Delupis I The law of war (2000) New York NY Cambridge University Press

Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)

Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College

Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor

Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)

Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)

Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf

Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)

Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College

Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College

Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)

Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA

30

AUACSCSinksAY08

Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)

Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)

Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College

Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology

Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College

Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)

OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center

OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College

OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications

Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991

Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College

Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center

Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)

31

AUACSCSinksAY08

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press

Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA

Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University

Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor

Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661

Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office

Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis

United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC

United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center

Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College

Wesley David C The Military Commander and the Law 2006

32

Page 9: Sinks 0407

AUACSCSinksAY08

information processes military commanders can influence or usurp adversarial human and

automated decision making in the physical and informational dimensions

As stated by Lt Col Fahrenkreg the confusion between cyberspace and information

operations comes from the misunderstanding of cyberspace as an operation rather than a

domain15 Information operation is a capability available to the combatant commander to

generate an effect in one of the five domains It just so happens that cyberspace tends to be the

primary means of delivering the Information Operation capability

Cyberspace connects the physical dimensions with the cognitive process and is a means

to create effects to include disrupting degrading denying the enemy the use of strategic and

operational assets to include command and controls systems power plants telecommunications

and other like targets to affect a statersquos operational and strategic centers of gravity Cyberspace

isnrsquot information or the data residing on a computer but is the means in which users transfer

store or modify information Cyberspace isnrsquot the data sent to a precision guided munition but

the means in which the originator passes the information Cyberspace is the digital super

highway of the electromagnetic spectrum with the ones zeros and electrons as the passengers

Defining Cyber Warfare According to the Institute for Advanced Study of Information Warfare (ASIW) cyber

warfare has become a form of information warfare which ASIW defines as ldquothe offensive and

defensive use of information and information systems to deny exploit corrupt or destroy and

adversaryrsquos information information-based processes information systems and computer-based

networks while protecting onersquos own Such actions are designed to achieve advantages over

military adversariesrdquo16 While this definition doesnrsquot specifically address the electromagnetic

spectrum the definition focuses on information-sharing systems which is where crux of the

cyberspace domain revolves around

5

AUACSCSinksAY08

Joint doctrine defines cyber warfare as those areas of operations that affect the

electromagnetic spectrum to include Computer Network Operations and Electronic Warfare

which are two of the five core operational capabilities of Information Operations Electronic

warfare operations operates across ldquoradio visible micro directed energy and all other

frequenciesrdquo and overlaps with network warfare operations which include ldquoradio nets satellite

links tactical digital information links (TADIL) telemetry digital track files

telecommunications and wireless communication network and systemsrdquo all of which operate

within the electromagnetic spectrum17

Cyber warfare consists of defensive and offensive operations Defensive operations

arenrsquot limited to severing connections or blocking attempts of an adversary trying to corrupt data

modify transmissions or destroy information systems Defensive operations include the

elimination of the adversaryrsquos capability of conducting operations which may involve crossing

sovereign borders in order to complete the task However defensive network operations come in

more than just one form The movies portray computer experts hovering over computers trying

to affect each otherrsquos operations However cyber warfare includes the use of traditional kinetic

effect to disrupt computer network operations of the enemy as a fighter-bomber delivering a

500-pound bomb to destroy a vital mode in a computer network may serve the same purpose as a

computer-centric network attack While this isnrsquot as sexy as a network attack that spans the

globe to degrade the enemyrsquos ability operation within the cyberspace domain the effects are the

same

Territorial Sovereignty In total war it is quite impossible to draw any precise line between military and non-military problems18

~Sir Winston Churchill

6

AUACSCSinksAY08

Cyberspace is certainly a domain that requires unique attention in order for commanders

to effectively and efficiently prosecute combat operations Cyberspace spans the globe using

the physical infrastructure residing within the other linear domains As users pass information

from one site to another data crosses boundaries by means of the cyberspace domain Data

leaves the Iraq area of operation via satellite to a receiving site in Germany Operators route the

information to the United States either through another satellite or by ground to sea-based cables

bound for computer nodes within the United States before arriving in South Carolina where

automated network tools redirect the information to the receiverrsquos location

An adversary attempting to modify corrupt or destroy this information traveling within

the cyberspace domain would at one time or another would cross sovereign borders through air

land sea or space The adversaryrsquos physical presence may not apply as they could conduct

operations from the comforts of their home however a nation could detect the adversaryrsquos

digital presence and could feel the impact of their actions from within their sovereign borders

Therefore as these adversaries span the globe using the cyberspace domain that relies on the

other linear domains to exist does international law apply when boundaries are crossed The

following sections will address the international laws of each physical domain and evaluate how

their principles apply to the cyberspace domain

Airspace Airspace as defined by Doctor Boleslaw A Boczek the internationally renowned expert

on international law ldquois the air pillow above the subjacent territoryrdquo to include ldquoairspace above

international waters and the territorial seardquo The airspace is under complete and exclusive

sovereignty of the subject state19 With that states have jurisdiction over their airspace and

require identification of foreign aircraft along with their intentions According to Dr Boczek

book International Law A Dictionary ldquoentry of national spacehellipmay take place only with the

7

AUACSCSinksAY08

authorization of the territorial staterdquo20 and currently only applies to aircraft Entry into the

airspace would require ldquoall aircraft to identify themselves file flight plans and report their

positionrdquo According to the 1944 Chicago Convention on International Civil Aviation nations

can enter into agreements that allow scheduled international civil air services which usually

include reciprocal agreements covering routes volume and other matters relating to air traffic

However these agreements only apply to civil aviation where state aircraft which include

aircraft belonging to the military customs public services and heads of states must follow more

restrictive procedures upon entering the airspace of a foreign nation21

There are several incidents where states have evoked their right for defending their

national security like the shooting down of a US military reconnaissance aircraft over Soviet

airspace by the Soviet Union in 196022 or the shooting down by Soviet fighter planes of a South

Korean airliner in 198323 The Soviet Union isnrsquot the only nation to protect its airspace as the

United States was responsible for shooting down an Iranian airliner thought to be an attacking

military plane over the Persian Gulf in 198824 These examples illustrate a nationrsquos sovereign

resolve to protect itself when a suspected adversary violated their airspace

Applying international law of airspace to cyberspace doesnrsquot seem too practical Civilian

signals entering a nationrsquos airspace would require nations to enter into agreements to allow

scheduled services and the persons receiving information through airspace would have to be

non-state sponsored Nationrsquos could regulate some cyberspace networks entering airspace like

radio communications that primarily use land-based infrastructure to function However the

very nature of computer networks and the ever-increasing global reach of communication

capabilities severely restrict a nationrsquos ability to monitor the millions of transmissions made on a

daily basis and these signals certainly wouldnrsquot be on any scheduled basis Therefore even if

8

AUACSCSinksAY08

nations made agreements concerning the cyberspace domain nations would have a difficult time

enforcing their terms of agreements unless the terms are very open-ended If they were so open-

ended then the agreement may not be necessary and based on my research nations realize the

futility of establishing these agreements as this author couldnrsquot find any reference to any

agreements that nations have entered into referencing the cyberspace domain

While the international law for civilian aircraft in airspace may not relate well or isnrsquot

feasible to enforce in the cyberspace domain does a nation have that same right to protect itself

from a suspected attack from cyberspace where the attackerrsquos signal enters airspace Does a

nation have the right to ldquoshoot downrdquo a cyberspace attack as it enters their domain through

airspace The whole idea behind restricting airspace from foreign military aircraft is because of

the strategic impact military aircraft can have on a nation As demonstrated in World War II

military aircraft carrying weapons of mass destruction can decimate cities and destroy a nation

with minimal effort The effects generated by military aircraft are quite destructive and garner

specific attention While an aircraft in of itself is relatively harmless the actions taken by the

crew can lead to devastating results

The same is true for cyber attacks The information passing through airspace in the

cyberspace domain is the vehicle however the crew conducting the operation is potentially

creating the same strategic results The cyber attack may not destroy cities but it certainly can

be destructive to a nationrsquos well-being by crippling power sources economic industries water

supply etc all at the blink of an eye while the victim takes several days to determine the

perpetrator Therefore while the international law for airspace may not be specifically relevant

the underlying principles are applicable as cyber attacks can have the same potential strategic

impact as an attack from a military aircraft

9

AUACSCSinksAY08

Space Outer space as defined by Doctor Boczek ldquois the space beyond the air surrounding the

earthrdquo As of 2005 international law doesnrsquot define a demarcation between airspace and outer

space but ldquostates agree that state sovereignty doesnrsquot extend without any limitsrdquo25 Proposals of

where airspace ends and when outer space begins are base on various scientific and technological

criteria (gravitational pull capabilities of air breathing aircraft etc26) Others scientists argue

that defining a boundary between airspace and outer space isnrsquot necessary as it would hinder the

progress of space technology and the legal status would depend on the nature of the activity

While no boundary exists airspace is finite and activity in outer space follows four

fundamentals principles First over flights of foreign satellites over a nation is permissible as

airspace doesnrsquot extend forever Second space ldquointernational law applies to outer space and

celestial bodiesrdquo Third according to the Outer Space Treaty of 1967 states canrsquot claim celestial

bodies or outer space which are not subject to national appropriation therefore are free for use

by all states Finally states must use outer space exclusively for peaceful purposes with specific

bans on weapons of mass destruction However states can use space for other military purposes

like intelligence surveillance and reconnaissance activities 27

Are these international laws and principles applicable to cyberspace Satellites are

certainly an integral part of the space domain Operators control satellites by using the

cyberspace domain and information passes between satellites and ground stations One can

argue that space is a sub-set of the cyberspace domain with satellites serving as computers in

space Global positioning system devices in vehicles interact with satellites all through an

elaborate network as part of the electromagnetic spectrum known as cyberspace Therefore

cyberspace is in space with millions of people using cyberspace everyday

10

AUACSCSinksAY08

The military uses space assets for intelligence surveillance and reconnaissance

knowledge management and command and control Agencies like the National Reconnaissance

Office and National Geospatial-Intelligence Agency obtain high-altitude imagery using a variety

of capabilities to include heat signature resonation Satellites can detect missile launches which

provide vital military information to senior leaders tasked with the security of their nation The

military networks to include decision briefs tasks and emails in Iraq and the Predator feeds in

Afghanistan travel through military and commercial satellites with all the information flowing

through the cyberspace domain With the heavy reliance of cyberspace to operate space assets

and the demands of information flowing through space by businesses it should come as no

surprise that space is a vital component for day-to-day operations of the military

Since cyberspace is an inherent component for space operations it is logical to assume

international law for outer space is applicable to cyberspace as long as an aggressor doesnt

violate the four premises and as long as weapons of mass destruction arenrsquot ldquostationed in outer

spacerdquo 28 Therefore a state would consider a cyber attack against a satellite as other than for

peaceful purposes and according to the fourth premise international law would apply

However what about a cyber attack using satellites as a means of conducting operations

Under todayrsquos current operations international elites havenrsquot considered a cyber attack passing

through space as a violation of international law When a senior leader in Qatar approves a

target set that is executed by a pilot in Nevada by an aircraft in Afghanistan all this information

is transmitted by cyberspace through space The result is that an aircraft renders an air or ground

target inoperable The effect is the same for cyberspace The information flows through space

by way of the cyberspace domain and the result is that an operator has rendered a target

11

AUACSCSinksAY08

inoperable As with airspace the information isnrsquot the cause of the damage but what an operator

does with the information is what constitutes the cyber attack

Land Cyber attacks using resources over land is relatively straightforward International

boundaries are defined as ldquoimaginary lines which separate territorial sovereigntyrdquo 29 which are

mutually agreed upon via international treaties Crossing an international border without

permission from the state is a violation of international law While an illegal immigrant crossing

a border to seek an opportunity to provide for his family is a violation of national law the United

Nation considers a nation-sponsored invasion of another nation that threatens the security and

stability of a nation as a breach in international law and an act of war

However international law doesnrsquot consider all border crossings as an act of war For

example when Nicaraguan troops and arms allegedly crossed the borders of El Salvador the

United Nations determined that incursions didnrsquot threaten El Salvadorrsquos territorial integrity and

stated that neither ldquothese incursions nor the alleged supply of arms may be relied upon as

justifying the exercise of the right of collective self-defenserdquo30 The victim state can repelled the

aggressive act but the United Nations Council wouldnrsquot condone any further military action

taken against the adversary opting for diplomatic or economic solution instead

Does international law apply when an adversary crosses international borders using

cyberspace as the means for conducting warfare operations When an adversarial state crosses a

statersquos boundaries using roads or bridges that connect the two nations the road is the resource

spanning the two nations If the adversary doesnrsquot do anything then returns to their sovereign

borders the aggressor hasnrsquot violated international law However when the adversary uses

weapon systems to affect serious damage the adversary has broken international law and a

12

AUACSCSinksAY08

nation may invoke their right for self-defense and may conduct full-scale operations to neutralize

the threat

A parallel notion is when an adversary uses a copper or fiber optic connection that spans

between two nations The adversary uses the land-based LAN connection as a means for

conducting cyber warfare operations The adversary may cross the borders using cyberspace yet

do nothing The affected state may push the adversary back to its borders but no further actions

are deemed appropriate However once the adversary uses the information transmitted over

cyberspace to cause severe operational or strategic damage the affected state now has the right

of self-defense Cyberspace is the means like the road or bridge for which the adversary

delivered the weapon The affected nation will consider the execution of the adversaryrsquos

information packet or weapon system as an act of aggression and the effect caused by the

weapon is what breeches international law

The difference between these two scenarios is that the adversary using the

electromagnetic spectrum hasnrsquot physically invaded a nationrsquos sovereign borders However

their digital presence crossed sovereign borders and as latter discussed in the paper adversaries

committing an act aggression against a state are now under the jurisdiction of the affected state

Sea ldquoThe territorial sea is a belt of sea adjacent to the (statersquos) coasthellipto include the airspace

aboverdquo as well as the seabed and subsoil31 The territorial sea is subject to the right of innocent

passage by foreign shops giving states the right to transport goods and passengers between ports

All of which is subject to the full sovereignty of the state which according to the United Nations

Convention on the Law of the Sea in 1982 and agreed upon by the majority of its membership in

1982 extends 12 miles from the coast32 The jurisdiction includes crimes where the

consequences extend to the coastal state and disturbs the peace of the country33 A cyber attack

13

AUACSCSinksAY08

conducted within the territorial sea of a nation would be no different from a cyber attack

conducted from within the nationrsquos land borders therefore cyber attacks against a state or even

another state conducted within the territorial seas are subject to current international laws Cyber

attacks originating outside the statersquos sovereign borders but results in affecting a statersquos

resources in their territorial seas would fall under the land and airspace breeches of territorial

sovereignty and would be subject to international law

The high seas on the other hand arenrsquot subject to the sovereignty of any one state The

high seas extend beyond the territorial sea and include the airspace the seabed and the subsoil34

and all states have the right to exercise freedoms on the high seas35 As similarly defined in

space ldquothe high seas shall be reserved for peaceful purposesrdquo as stated by Article 88 of the Law

of the Seas Cooperative36 which is defined as refraining from any threat or use of force (outside

of wartime conflicts)

The very nature of a cyber attack in the high seas lends itself to be a violation of

international law as nations are restricted to conducting peaceful operations in the high seas

The question is whom has jurisdiction of crimes committed in the high seas By applying the

Protective Security Principle of Jurisdiction where an actor threatens a statersquo security and

introducing the United Nationrsquos definition on the Illegal Use of Force extends to the high seas

and for that matter space giving states the right for self-defense as defined by the United Nations

as ldquoan armed attackrdquo The sheer name of cyber attack doesnrsquot immediately lend itself to an

ldquoarmedrdquo cyber attack However the effects generated from a cyber attack can be equivalent to a

traditional conventional attack and the international law would permit a state to take appropriate

countermeasures while notifying the United Nations Security Council37

14

AUACSCSinksAY08

Applying International Law to Cyber Warfare Today we live in an Information Age where communication through cyberspace has forever changed and flattened out worldhellipOur adversaries seek to operate from behind technical legal and international screens as they execute their costly attacks38

~General James E Cartwright Commander United States Strategic Command

Jurisdiction

Understanding the territorial sovereignty principles of a nation is important in applying

cyberspace and cyber warfare to existing international laws While some of these principles and

international laws may not be relevant for the cyberspace domain due to the far-reaching

capability of cyber warfare the jurisdiction of a nation further defines its ability to respond to

aggressive acts by nations in the cyberspace domain There are three jurisdictional principles

that provide nations the right to pursue aggressors that threaten a nationrsquos independence the

Territorial Principle Nationality Principle and the Protective Security Principle

For actions originating within the state the jurisdiction clearly falls within the territorial

principle where a ldquostate has jurisdiction over all crimes committed in its territoryhellipto include

airspace international waters and territorial seasrdquo39 The territorial jurisdiction is subject to

exceptions when dealing with persons from foreign states as in the most popular example of

immunity given to foreign diplomats In this case ldquostates may exercise jurisdiction over its

citizenhellipeven if they are physically outside the statesrsquo territoryrdquo as Doctor Boczek defines as the

Nationality Principle Nations usually agree upon on these concessions states prior to the offense

being committed40

Doctor Boczek defines the Protective Security Principle as a ldquojurisdictional principle

whereby a state my assume jurisdiction over and punish foreign nationals for certain conduct

outside its territory which is directed against its security territorial integrity and political

independencerdquo41 Some states would argue that criticism of a state or government is applicable

15

AUACSCSinksAY08

in applying this principle of jurisdiction However this is too broad of an interpretation and

should be confined to acts that are more tangible in nature like falsification of a statesrsquo official

documents conspiracy to violate immigration of custom laws and illicit drug trafficking42

Would a cyber attack that is deemed to challenge a nationrsquos banking community or bring

down a power source be a direct attack against its security and political independence The

international community easily sees the attack of a power source with kinetic weapons as a

violation of a territorial boundary and a breech of international law The United States viewed

the attack on the Trade Towers as an act of war launching the Global War on Terrorism Would

the United States have viewed the same devastation as if the attack occurred through cyberspace

Would the attack have been less of an act of war if the aggressor remotely controlled domestic

airliners from a foreign country Probably not What happens if the cyber attack caused a fire in

the lower floors of the buildings preventing people from escaping While less dramatic than an

airbus flying into the middle of the towers and maybe more difficult to demonize the crime the

result is the samemdashinnocent people suffering as a result of an adversary trying to threaten a

nationrsquos security

What happens if the suspected cyber attack has violated a nationrsquos territorial boundary in

order to attack a neighboring country or an ally Going from point A to point B in cyberspace is

rarely a direct connection As with the global nature of cyberspace itrsquos conceivable that

adversaries cross several nationsrsquo boundaries to conduct cyber attack operations The question

generated is who has jurisdiction

If the actor committing the crime had used an airplane each nation could claim

jurisdiction as the adversary violated their territorial boundaries and violated international law

More often than not the first state would have acted immediately upon the aggressive act and

16

AUACSCSinksAY08

would have prevented aggressors from completing their task by either forcing the aircraft to land

or turnaround or an even more escalated response of firing upon the aircraft In the air land or

sea the ability for a nationrsquos military forces to respond in a timely manner gives way to the

deterrence factor of not crossing a statersquos boundaries without receiving permission for fear of

reprisal A clear example of this was when Turkey denied the United States the ability deploy

the 4th Infantry Division from its borders at the beginning of Operation Iraqi Freedom Violating

Turkeyrsquos borders without permission would have brought about great repercussions that would

have made Operation Iraqi Freedom even more difficult and could have resulted in an escalation

of the war outside the Iraqi borders43 Another example is when Spain and France denied the

Unites States the use of their airspace when F-111s based in the United Kingdom conducted air

operations in Libya in an effort to eliminate Muammar Khadafy44

However the speeds at which these breeches in territorial boundaries occur make it

difficult for a nation to claim jurisdiction especially when nothing occurred within their

territorial sovereignty The cyber attacks didnrsquot result in any damage to nation as the information

packets passed through their sovereign borders According to territorial boundary description

described by Doctor Boczek the international community doesnrsquot consider the crossing the

border in of itself an act of warmdashserious damage is a driving factor in determining conflict

escalation In addition according to the territorial jurisdiction principle the cyber attack didnrsquot

threaten a nationrsquos security territorial integrity and political independence If the cyber attack or

information originated from within a sovereign territory by a third party then the two nations

would have to work together to resolve the issue and mutual jurisdiction would probably apply

However if the cyber attack didnrsquot physically manifest itself from within their sovereign

territory or the adversary didnrsquot use the nation as a staging area to launch a further attack the

17

AUACSCSinksAY08

international law and the jurisdiction principles would dictate the affected nation would have

jurisdiction

Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security

territorial integrity and political independence Cyberspace utilizes the other domains as a means

of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence

Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of

territorial sovereignty the Protective Security Principle does provide nations the ability to

enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos

sovereignty when it conducts cyber warfare operations However some elites donrsquot consider

cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense

International law specifically article 2 of the United Nations Charters states that a

members shall refrain in their international relations from the threat or use of force against the

territorial integrity or political independence of any state or in any other manner inconsistent

with the purposes of the United Nations which is intended to prohibit all types of force except

those carried out under the aegis of the United Nations or as provided for by the Security

Council45 The only exception to the United Nations Charters as it relates to the Use of Force is

the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed

attack46

International elites have discussed the term ldquouse of forcerdquo in the past because of the

development of chemical and biological weapons and had to move from a kinetic impact based

definition to a results-oriented approach47 Chemical and biological weapons lacked the

characteristic of an explosion or physical force yet these weapons certainly are capable of

destroying life and property Doctor Leigh Armistead a former information warfare instructor at

18

AUACSCSinksAY08

the Joint Forces Staff College cautions that the use of computer network attacks by the military

ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary

that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great

Russia introduced a proposal to the United Nations that banned the use of information

operations Even though the United Nations didnrsquot adopt the law the concern of international

community is fully aware of the impact cyber attacks can have on a nation

The concern over cyber warfare capabilities is that it can generate both non-kinetic and

kinetic effects There has always been the traditional kinetic solution for cyber warfare where a

precision guidance munition destroys a critical information system node Most people assume

computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos

computer system from the safety of onersquos own command and control center but the physical

destruction of a computer system or network by kinetic means also qualifies as cyber warfare

However cyber warfare has also evolved to the point where aggressors can achieve a kinetic

effect without the use of a traditional kinetic weapon A cyber attack on an information system

can shut down a particular node of a power plant causing the system to become inoperative

Even if there wasnrsquot an explosion the attack serves the same purpose

The question raised is do cyber attacks constitute an armed attack Scholars do agree that

some cyber attacks fit comfortably within the United Nations Charter For example a strategic

level cyber attack causing widespread damage and significant casualties would trigger the statersquos

right of self-defense In addition a cyber attack that precluded a conventional attack or a series

of cyber attacks causing significant damage would give a state the right of self-defense49 Few

would dispute that a country has the right under international law to respond with military force

19

AUACSCSinksAY08

if a state destroyed or significantly damaged another nationrsquos economic system for example the

New York or London stock exchanges

However some confusion and state-defined interpretation comes into play when the

frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard

Law School argues that cyber attacks require an expansion of the definition on the ldquouse of

forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot

be prohibited by international law50 International scholars recommend ldquoclearer rules of what

kinds of information warfare actions constitute an armed attackrdquo which drives permissible

responses of self-defense51 For example a state-sponsored cyber attack causes damage to a

victimrsquos factory or power plant however the nation claims the incident is an isolated instance

and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under

the United Nations Charter and the United Nations would consider any response retaliation

which would violate international law52

Another example involves a nation conducting a series of small attacks causing minimal

damage and then ceases Even though the aggressor used force to conduct cyber warfare

operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under

the United Nations Charter This type of attack is analogues to a small band of troops crossing a

border without causing significant damage53 According to the United Nations Charter the

national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders

and respond to the use of force Repelling the small band of troops and reestablishing their

sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration

of war and allies would have to respect the United Nations decision and couldnrsquot intervene The

same is true for the cyber attack A state can employ defensive measure to isolate and defeat the

20

AUACSCSinksAY08

incursion over the electromagnetic spectrum However the United Nations would see further

offensive operations or invasive operations as retaliation Therefore a nation must take the

incident whether it is signs of conventional forces on the ground or traces of cyber warfare

incursions in the electromagnetic spectrum to the United Nations to seek restitution

In both of these situations the international law becomes the target for change not

whether cyber warfare is in violation of international law If the law were to change the

international community would then consider the above situations acts of war even if an

adversary used conventional forces As written today the result of an operation remains the

driving factor in determining if an adversary has violated international law The means by which

an adversary conducts military operations may affect how nations react to the situation but

whether an adversary conducts the operation by means of the air land sea space or cyberspace

doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian

Triggs a public international lawyer and member of the Attorney General International Legal

Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over

offences abroad having an intended and substantial effect within a state may be justifiedrdquo54

Therefore the international community must evaluate the effect of a criminal act rather than the

means in which the act was committed

Others claim that because the Internet takes advantages of legal norms where non-state

actors can ignore Western notions of law55 more international laws are needed for cyberspace

However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using

other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the

Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked

aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts

21

AUACSCSinksAY08

against a staterdquo in the cyberspace domain The anonymity of the Internet and their total

disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and

national laws already exist in most countries that prohibit the use of the Internet for terrorist

activities therefore additional international laws wouldnrsquot prevent or deter terrorist from

committing such acts of aggression

International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed

Conflict includes the Martens Clause which extends established custom and humanitarian

principles to new technologies and addresses the ever-changing nature of warfare The

international community designed The Martens Clause ldquoto prevent future unnecessary andor

disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges

crimes by invoking the laws of humanity and public conscience hence their effects and not its

methods

The basic legal premise behind Law of Armed Conflict is that attacks must be limited to

military objectives and collateral damage must be proportionate to military advantages and

forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary

suffering but military commanders and planners need to be aware of the results a particular

action will invoke Russian leadership believes a computer network attack against their

homeland can be a means for executing a variety of escalating responses to include nuclear

attack58 Therefore it is imperative military commanders understand the impact any weapon

system can have on an adversary not just cyber attacks

Not all scholars agree that international law is insufficient to govern cyber warfare

Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace

and the Use of Force states that computer network attacks constitute an unlawful use of force in

22

AUACSCSinksAY08

cyberspace under traditional international law Sharp declared that an armed attack may occur

ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a

way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive

definition of cyber attacks may never be drafted59 The Congressional Research Service also

concluded that ldquothere is little likelihood that the international community will soon generate a

coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations

on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos

conclusion is that the effects of cyber warfare operations are the same as if an adversary

conducted conventional warfare operations where the effect of the attacks are the driving factors

in determining whether an adversary used force or not

The United States Government agrees with Sharprsquos conclusion The offensive

Information Operation strategy for the United States government as described by Doctor

Armistead ties the tools used to conduct military operations back to the desired effect which is

in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning

effects-based operations and operational art focus the Joint Force Commanderrsquos course of action

towards meeting objectives outlined in guidance provided by the National Command Authority

and senior military leadership62 Whether the tools are dropped pamphlets invasive network

attacks or bombs on targets the goal is to produce a desired effect to achieve the overall

objectives and cyber warfare can produce effects that challenge the national security of a nation

Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63

~General T Michael Moseley USAF

23

AUACSCSinksAY08

The cyberspace domain has been around for quite sometime but as technology continues

to advance businesses as well as governmental organizations are becoming more reliant on the

cyberspace domain With that reliance the protection of this critical domain becomes even more

important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the

electromagnetic spectrum by denying and disrupting information demands Scholars claim that

protection needs to include addressing existing international laws expanding them to incorporate

the ever-advancing capabilities emerging in the cyberspace domain

However territorial sovereignty of a nation and the principles of jurisdiction specifically

the Protective Security Principle give nations the right to exercise jurisdiction when an

aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64

While cyberspace is a domain requiring specific attention it relies on assets in the other domains

of land space sea and air in order to operate and international laws for the linear domains do

exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace

but during cyber warfare operations the principles behind the restrictions of foreign military

entering airspace do apply The strategic nature of cyber warfare operations correspond to the

same strategic impact that airpower can inflict upon a nation threatening their independence

While maybe not as dramatic as kinetic effects the results can be just as devastating

Space is relatively straightforward Since a nation canrsquot claim space and over flights of

foreign satellites over a nation is permissible nations must use space for peaceful purposes

Kinetic attacks against space assets are a violation of international law therefore nations would

consider cyber warfare operations against space assets as other than peaceful purposes and a

violation of international law Cyber attacks traversing space assets relate to current military

operations where the military uses space assets to conduct kinetic operations Since international

24

AUACSCSinksAY08

elites havenrsquot considered these kinetic operations as a breach of international law military

commanders can conduct cyber warfare operations through space without fear of violating

international laws for outer space

Crossing international borders without a nationrsquos permission and threatening their

sovereignty is a violation of international law While nations canrsquot consider all border crossings

as an act of war those acts of aggression that threaten the territorial integrity would elicit a

defensive response by the victim nation Whether incursions involve combat vehicles over a

highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are

threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not

have set foot in the nation but according the Protective Security Principle the victim nation has

jurisdiction

Conducting cyber warfare operations from the territorial sea is no different from

conducting operations from within a nationrsquos land or sea borders However the high seas are

very similar in nature to space in that they are reserved for peaceful purposes Therefore

conducting any means of warfare from within the high seas is a violation of international law

and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-

defense

According to Barkham ldquoinformation warfare attacks are in essence territorial

penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then

subject to the jurisdiction of the victim nation who then has the right for self-defense However

due to the global nature of cyberspace aggressors can cross multiple borders and determining

who has jurisdiction demands cooperation among nations The origin and any deliberate staging

locations of the cyber attack will drive who has jurisdiction The crossing of third party borders

25

AUACSCSinksAY08

by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the

aggressors threaten a nationrsquos independence or territorial integrity

Scholars consider cyber warfare operations that involve strategic and operational impacts

as being a means of using force and fall within the legal regime of existing international law

However scholars argue that because cyber warfare includes kinetic and non-kinetic results the

Use of Force definition needs expanding Yet they conclude that an exhaustive definition of

cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare

operations against existing case studies where the effects are evaluated as opposed to the means

even if the operations originated from outside the nationrsquos territorial jurisdiction There is some

authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to

have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade

non-state actors from conducting cyber warfare operations given their willingness to ignore

Western notions of war and their ability to conduct operations anonymously in cyberspace

International laws are in place to that address the ever-changing nature of warfare The

Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a

framework for addressing all warfare to include cyber warfare operations The international

community will need to measure the effects of an operation rather the means Whether its boots

on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a

nationrsquos response

26

AUACSCSinksAY08

End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)

27

AUACSCSinksAY08

44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

28

AUACSCSinksAY08

Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005

Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department

American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)

Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983

Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988

Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)

Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)

IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)

Joint Publication 3-13 Information Operations 13 February 2006

Joint Publication 5-0 Joint Operations Planning 26 December 2006

Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies

Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc

Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College

Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)

Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press

29

AUACSCSinksAY08

Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI

Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)

Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press

Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company

Detter Delupis I The law of war (2000) New York NY Cambridge University Press

Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)

Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College

Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor

Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)

Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)

Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf

Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)

Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College

Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College

Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)

Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA

30

AUACSCSinksAY08

Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)

Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)

Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College

Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology

Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College

Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)

OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center

OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College

OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications

Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991

Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College

Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center

Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)

31

AUACSCSinksAY08

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press

Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA

Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University

Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor

Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661

Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office

Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis

United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC

United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center

Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College

Wesley David C The Military Commander and the Law 2006

32

Page 10: Sinks 0407

AUACSCSinksAY08

Joint doctrine defines cyber warfare as those areas of operations that affect the

electromagnetic spectrum to include Computer Network Operations and Electronic Warfare

which are two of the five core operational capabilities of Information Operations Electronic

warfare operations operates across ldquoradio visible micro directed energy and all other

frequenciesrdquo and overlaps with network warfare operations which include ldquoradio nets satellite

links tactical digital information links (TADIL) telemetry digital track files

telecommunications and wireless communication network and systemsrdquo all of which operate

within the electromagnetic spectrum17

Cyber warfare consists of defensive and offensive operations Defensive operations

arenrsquot limited to severing connections or blocking attempts of an adversary trying to corrupt data

modify transmissions or destroy information systems Defensive operations include the

elimination of the adversaryrsquos capability of conducting operations which may involve crossing

sovereign borders in order to complete the task However defensive network operations come in

more than just one form The movies portray computer experts hovering over computers trying

to affect each otherrsquos operations However cyber warfare includes the use of traditional kinetic

effect to disrupt computer network operations of the enemy as a fighter-bomber delivering a

500-pound bomb to destroy a vital mode in a computer network may serve the same purpose as a

computer-centric network attack While this isnrsquot as sexy as a network attack that spans the

globe to degrade the enemyrsquos ability operation within the cyberspace domain the effects are the

same

Territorial Sovereignty In total war it is quite impossible to draw any precise line between military and non-military problems18

~Sir Winston Churchill

6

AUACSCSinksAY08

Cyberspace is certainly a domain that requires unique attention in order for commanders

to effectively and efficiently prosecute combat operations Cyberspace spans the globe using

the physical infrastructure residing within the other linear domains As users pass information

from one site to another data crosses boundaries by means of the cyberspace domain Data

leaves the Iraq area of operation via satellite to a receiving site in Germany Operators route the

information to the United States either through another satellite or by ground to sea-based cables

bound for computer nodes within the United States before arriving in South Carolina where

automated network tools redirect the information to the receiverrsquos location

An adversary attempting to modify corrupt or destroy this information traveling within

the cyberspace domain would at one time or another would cross sovereign borders through air

land sea or space The adversaryrsquos physical presence may not apply as they could conduct

operations from the comforts of their home however a nation could detect the adversaryrsquos

digital presence and could feel the impact of their actions from within their sovereign borders

Therefore as these adversaries span the globe using the cyberspace domain that relies on the

other linear domains to exist does international law apply when boundaries are crossed The

following sections will address the international laws of each physical domain and evaluate how

their principles apply to the cyberspace domain

Airspace Airspace as defined by Doctor Boleslaw A Boczek the internationally renowned expert

on international law ldquois the air pillow above the subjacent territoryrdquo to include ldquoairspace above

international waters and the territorial seardquo The airspace is under complete and exclusive

sovereignty of the subject state19 With that states have jurisdiction over their airspace and

require identification of foreign aircraft along with their intentions According to Dr Boczek

book International Law A Dictionary ldquoentry of national spacehellipmay take place only with the

7

AUACSCSinksAY08

authorization of the territorial staterdquo20 and currently only applies to aircraft Entry into the

airspace would require ldquoall aircraft to identify themselves file flight plans and report their

positionrdquo According to the 1944 Chicago Convention on International Civil Aviation nations

can enter into agreements that allow scheduled international civil air services which usually

include reciprocal agreements covering routes volume and other matters relating to air traffic

However these agreements only apply to civil aviation where state aircraft which include

aircraft belonging to the military customs public services and heads of states must follow more

restrictive procedures upon entering the airspace of a foreign nation21

There are several incidents where states have evoked their right for defending their

national security like the shooting down of a US military reconnaissance aircraft over Soviet

airspace by the Soviet Union in 196022 or the shooting down by Soviet fighter planes of a South

Korean airliner in 198323 The Soviet Union isnrsquot the only nation to protect its airspace as the

United States was responsible for shooting down an Iranian airliner thought to be an attacking

military plane over the Persian Gulf in 198824 These examples illustrate a nationrsquos sovereign

resolve to protect itself when a suspected adversary violated their airspace

Applying international law of airspace to cyberspace doesnrsquot seem too practical Civilian

signals entering a nationrsquos airspace would require nations to enter into agreements to allow

scheduled services and the persons receiving information through airspace would have to be

non-state sponsored Nationrsquos could regulate some cyberspace networks entering airspace like

radio communications that primarily use land-based infrastructure to function However the

very nature of computer networks and the ever-increasing global reach of communication

capabilities severely restrict a nationrsquos ability to monitor the millions of transmissions made on a

daily basis and these signals certainly wouldnrsquot be on any scheduled basis Therefore even if

8

AUACSCSinksAY08

nations made agreements concerning the cyberspace domain nations would have a difficult time

enforcing their terms of agreements unless the terms are very open-ended If they were so open-

ended then the agreement may not be necessary and based on my research nations realize the

futility of establishing these agreements as this author couldnrsquot find any reference to any

agreements that nations have entered into referencing the cyberspace domain

While the international law for civilian aircraft in airspace may not relate well or isnrsquot

feasible to enforce in the cyberspace domain does a nation have that same right to protect itself

from a suspected attack from cyberspace where the attackerrsquos signal enters airspace Does a

nation have the right to ldquoshoot downrdquo a cyberspace attack as it enters their domain through

airspace The whole idea behind restricting airspace from foreign military aircraft is because of

the strategic impact military aircraft can have on a nation As demonstrated in World War II

military aircraft carrying weapons of mass destruction can decimate cities and destroy a nation

with minimal effort The effects generated by military aircraft are quite destructive and garner

specific attention While an aircraft in of itself is relatively harmless the actions taken by the

crew can lead to devastating results

The same is true for cyber attacks The information passing through airspace in the

cyberspace domain is the vehicle however the crew conducting the operation is potentially

creating the same strategic results The cyber attack may not destroy cities but it certainly can

be destructive to a nationrsquos well-being by crippling power sources economic industries water

supply etc all at the blink of an eye while the victim takes several days to determine the

perpetrator Therefore while the international law for airspace may not be specifically relevant

the underlying principles are applicable as cyber attacks can have the same potential strategic

impact as an attack from a military aircraft

9

AUACSCSinksAY08

Space Outer space as defined by Doctor Boczek ldquois the space beyond the air surrounding the

earthrdquo As of 2005 international law doesnrsquot define a demarcation between airspace and outer

space but ldquostates agree that state sovereignty doesnrsquot extend without any limitsrdquo25 Proposals of

where airspace ends and when outer space begins are base on various scientific and technological

criteria (gravitational pull capabilities of air breathing aircraft etc26) Others scientists argue

that defining a boundary between airspace and outer space isnrsquot necessary as it would hinder the

progress of space technology and the legal status would depend on the nature of the activity

While no boundary exists airspace is finite and activity in outer space follows four

fundamentals principles First over flights of foreign satellites over a nation is permissible as

airspace doesnrsquot extend forever Second space ldquointernational law applies to outer space and

celestial bodiesrdquo Third according to the Outer Space Treaty of 1967 states canrsquot claim celestial

bodies or outer space which are not subject to national appropriation therefore are free for use

by all states Finally states must use outer space exclusively for peaceful purposes with specific

bans on weapons of mass destruction However states can use space for other military purposes

like intelligence surveillance and reconnaissance activities 27

Are these international laws and principles applicable to cyberspace Satellites are

certainly an integral part of the space domain Operators control satellites by using the

cyberspace domain and information passes between satellites and ground stations One can

argue that space is a sub-set of the cyberspace domain with satellites serving as computers in

space Global positioning system devices in vehicles interact with satellites all through an

elaborate network as part of the electromagnetic spectrum known as cyberspace Therefore

cyberspace is in space with millions of people using cyberspace everyday

10

AUACSCSinksAY08

The military uses space assets for intelligence surveillance and reconnaissance

knowledge management and command and control Agencies like the National Reconnaissance

Office and National Geospatial-Intelligence Agency obtain high-altitude imagery using a variety

of capabilities to include heat signature resonation Satellites can detect missile launches which

provide vital military information to senior leaders tasked with the security of their nation The

military networks to include decision briefs tasks and emails in Iraq and the Predator feeds in

Afghanistan travel through military and commercial satellites with all the information flowing

through the cyberspace domain With the heavy reliance of cyberspace to operate space assets

and the demands of information flowing through space by businesses it should come as no

surprise that space is a vital component for day-to-day operations of the military

Since cyberspace is an inherent component for space operations it is logical to assume

international law for outer space is applicable to cyberspace as long as an aggressor doesnt

violate the four premises and as long as weapons of mass destruction arenrsquot ldquostationed in outer

spacerdquo 28 Therefore a state would consider a cyber attack against a satellite as other than for

peaceful purposes and according to the fourth premise international law would apply

However what about a cyber attack using satellites as a means of conducting operations

Under todayrsquos current operations international elites havenrsquot considered a cyber attack passing

through space as a violation of international law When a senior leader in Qatar approves a

target set that is executed by a pilot in Nevada by an aircraft in Afghanistan all this information

is transmitted by cyberspace through space The result is that an aircraft renders an air or ground

target inoperable The effect is the same for cyberspace The information flows through space

by way of the cyberspace domain and the result is that an operator has rendered a target

11

AUACSCSinksAY08

inoperable As with airspace the information isnrsquot the cause of the damage but what an operator

does with the information is what constitutes the cyber attack

Land Cyber attacks using resources over land is relatively straightforward International

boundaries are defined as ldquoimaginary lines which separate territorial sovereigntyrdquo 29 which are

mutually agreed upon via international treaties Crossing an international border without

permission from the state is a violation of international law While an illegal immigrant crossing

a border to seek an opportunity to provide for his family is a violation of national law the United

Nation considers a nation-sponsored invasion of another nation that threatens the security and

stability of a nation as a breach in international law and an act of war

However international law doesnrsquot consider all border crossings as an act of war For

example when Nicaraguan troops and arms allegedly crossed the borders of El Salvador the

United Nations determined that incursions didnrsquot threaten El Salvadorrsquos territorial integrity and

stated that neither ldquothese incursions nor the alleged supply of arms may be relied upon as

justifying the exercise of the right of collective self-defenserdquo30 The victim state can repelled the

aggressive act but the United Nations Council wouldnrsquot condone any further military action

taken against the adversary opting for diplomatic or economic solution instead

Does international law apply when an adversary crosses international borders using

cyberspace as the means for conducting warfare operations When an adversarial state crosses a

statersquos boundaries using roads or bridges that connect the two nations the road is the resource

spanning the two nations If the adversary doesnrsquot do anything then returns to their sovereign

borders the aggressor hasnrsquot violated international law However when the adversary uses

weapon systems to affect serious damage the adversary has broken international law and a

12

AUACSCSinksAY08

nation may invoke their right for self-defense and may conduct full-scale operations to neutralize

the threat

A parallel notion is when an adversary uses a copper or fiber optic connection that spans

between two nations The adversary uses the land-based LAN connection as a means for

conducting cyber warfare operations The adversary may cross the borders using cyberspace yet

do nothing The affected state may push the adversary back to its borders but no further actions

are deemed appropriate However once the adversary uses the information transmitted over

cyberspace to cause severe operational or strategic damage the affected state now has the right

of self-defense Cyberspace is the means like the road or bridge for which the adversary

delivered the weapon The affected nation will consider the execution of the adversaryrsquos

information packet or weapon system as an act of aggression and the effect caused by the

weapon is what breeches international law

The difference between these two scenarios is that the adversary using the

electromagnetic spectrum hasnrsquot physically invaded a nationrsquos sovereign borders However

their digital presence crossed sovereign borders and as latter discussed in the paper adversaries

committing an act aggression against a state are now under the jurisdiction of the affected state

Sea ldquoThe territorial sea is a belt of sea adjacent to the (statersquos) coasthellipto include the airspace

aboverdquo as well as the seabed and subsoil31 The territorial sea is subject to the right of innocent

passage by foreign shops giving states the right to transport goods and passengers between ports

All of which is subject to the full sovereignty of the state which according to the United Nations

Convention on the Law of the Sea in 1982 and agreed upon by the majority of its membership in

1982 extends 12 miles from the coast32 The jurisdiction includes crimes where the

consequences extend to the coastal state and disturbs the peace of the country33 A cyber attack

13

AUACSCSinksAY08

conducted within the territorial sea of a nation would be no different from a cyber attack

conducted from within the nationrsquos land borders therefore cyber attacks against a state or even

another state conducted within the territorial seas are subject to current international laws Cyber

attacks originating outside the statersquos sovereign borders but results in affecting a statersquos

resources in their territorial seas would fall under the land and airspace breeches of territorial

sovereignty and would be subject to international law

The high seas on the other hand arenrsquot subject to the sovereignty of any one state The

high seas extend beyond the territorial sea and include the airspace the seabed and the subsoil34

and all states have the right to exercise freedoms on the high seas35 As similarly defined in

space ldquothe high seas shall be reserved for peaceful purposesrdquo as stated by Article 88 of the Law

of the Seas Cooperative36 which is defined as refraining from any threat or use of force (outside

of wartime conflicts)

The very nature of a cyber attack in the high seas lends itself to be a violation of

international law as nations are restricted to conducting peaceful operations in the high seas

The question is whom has jurisdiction of crimes committed in the high seas By applying the

Protective Security Principle of Jurisdiction where an actor threatens a statersquo security and

introducing the United Nationrsquos definition on the Illegal Use of Force extends to the high seas

and for that matter space giving states the right for self-defense as defined by the United Nations

as ldquoan armed attackrdquo The sheer name of cyber attack doesnrsquot immediately lend itself to an

ldquoarmedrdquo cyber attack However the effects generated from a cyber attack can be equivalent to a

traditional conventional attack and the international law would permit a state to take appropriate

countermeasures while notifying the United Nations Security Council37

14

AUACSCSinksAY08

Applying International Law to Cyber Warfare Today we live in an Information Age where communication through cyberspace has forever changed and flattened out worldhellipOur adversaries seek to operate from behind technical legal and international screens as they execute their costly attacks38

~General James E Cartwright Commander United States Strategic Command

Jurisdiction

Understanding the territorial sovereignty principles of a nation is important in applying

cyberspace and cyber warfare to existing international laws While some of these principles and

international laws may not be relevant for the cyberspace domain due to the far-reaching

capability of cyber warfare the jurisdiction of a nation further defines its ability to respond to

aggressive acts by nations in the cyberspace domain There are three jurisdictional principles

that provide nations the right to pursue aggressors that threaten a nationrsquos independence the

Territorial Principle Nationality Principle and the Protective Security Principle

For actions originating within the state the jurisdiction clearly falls within the territorial

principle where a ldquostate has jurisdiction over all crimes committed in its territoryhellipto include

airspace international waters and territorial seasrdquo39 The territorial jurisdiction is subject to

exceptions when dealing with persons from foreign states as in the most popular example of

immunity given to foreign diplomats In this case ldquostates may exercise jurisdiction over its

citizenhellipeven if they are physically outside the statesrsquo territoryrdquo as Doctor Boczek defines as the

Nationality Principle Nations usually agree upon on these concessions states prior to the offense

being committed40

Doctor Boczek defines the Protective Security Principle as a ldquojurisdictional principle

whereby a state my assume jurisdiction over and punish foreign nationals for certain conduct

outside its territory which is directed against its security territorial integrity and political

independencerdquo41 Some states would argue that criticism of a state or government is applicable

15

AUACSCSinksAY08

in applying this principle of jurisdiction However this is too broad of an interpretation and

should be confined to acts that are more tangible in nature like falsification of a statesrsquo official

documents conspiracy to violate immigration of custom laws and illicit drug trafficking42

Would a cyber attack that is deemed to challenge a nationrsquos banking community or bring

down a power source be a direct attack against its security and political independence The

international community easily sees the attack of a power source with kinetic weapons as a

violation of a territorial boundary and a breech of international law The United States viewed

the attack on the Trade Towers as an act of war launching the Global War on Terrorism Would

the United States have viewed the same devastation as if the attack occurred through cyberspace

Would the attack have been less of an act of war if the aggressor remotely controlled domestic

airliners from a foreign country Probably not What happens if the cyber attack caused a fire in

the lower floors of the buildings preventing people from escaping While less dramatic than an

airbus flying into the middle of the towers and maybe more difficult to demonize the crime the

result is the samemdashinnocent people suffering as a result of an adversary trying to threaten a

nationrsquos security

What happens if the suspected cyber attack has violated a nationrsquos territorial boundary in

order to attack a neighboring country or an ally Going from point A to point B in cyberspace is

rarely a direct connection As with the global nature of cyberspace itrsquos conceivable that

adversaries cross several nationsrsquo boundaries to conduct cyber attack operations The question

generated is who has jurisdiction

If the actor committing the crime had used an airplane each nation could claim

jurisdiction as the adversary violated their territorial boundaries and violated international law

More often than not the first state would have acted immediately upon the aggressive act and

16

AUACSCSinksAY08

would have prevented aggressors from completing their task by either forcing the aircraft to land

or turnaround or an even more escalated response of firing upon the aircraft In the air land or

sea the ability for a nationrsquos military forces to respond in a timely manner gives way to the

deterrence factor of not crossing a statersquos boundaries without receiving permission for fear of

reprisal A clear example of this was when Turkey denied the United States the ability deploy

the 4th Infantry Division from its borders at the beginning of Operation Iraqi Freedom Violating

Turkeyrsquos borders without permission would have brought about great repercussions that would

have made Operation Iraqi Freedom even more difficult and could have resulted in an escalation

of the war outside the Iraqi borders43 Another example is when Spain and France denied the

Unites States the use of their airspace when F-111s based in the United Kingdom conducted air

operations in Libya in an effort to eliminate Muammar Khadafy44

However the speeds at which these breeches in territorial boundaries occur make it

difficult for a nation to claim jurisdiction especially when nothing occurred within their

territorial sovereignty The cyber attacks didnrsquot result in any damage to nation as the information

packets passed through their sovereign borders According to territorial boundary description

described by Doctor Boczek the international community doesnrsquot consider the crossing the

border in of itself an act of warmdashserious damage is a driving factor in determining conflict

escalation In addition according to the territorial jurisdiction principle the cyber attack didnrsquot

threaten a nationrsquos security territorial integrity and political independence If the cyber attack or

information originated from within a sovereign territory by a third party then the two nations

would have to work together to resolve the issue and mutual jurisdiction would probably apply

However if the cyber attack didnrsquot physically manifest itself from within their sovereign

territory or the adversary didnrsquot use the nation as a staging area to launch a further attack the

17

AUACSCSinksAY08

international law and the jurisdiction principles would dictate the affected nation would have

jurisdiction

Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security

territorial integrity and political independence Cyberspace utilizes the other domains as a means

of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence

Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of

territorial sovereignty the Protective Security Principle does provide nations the ability to

enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos

sovereignty when it conducts cyber warfare operations However some elites donrsquot consider

cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense

International law specifically article 2 of the United Nations Charters states that a

members shall refrain in their international relations from the threat or use of force against the

territorial integrity or political independence of any state or in any other manner inconsistent

with the purposes of the United Nations which is intended to prohibit all types of force except

those carried out under the aegis of the United Nations or as provided for by the Security

Council45 The only exception to the United Nations Charters as it relates to the Use of Force is

the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed

attack46

International elites have discussed the term ldquouse of forcerdquo in the past because of the

development of chemical and biological weapons and had to move from a kinetic impact based

definition to a results-oriented approach47 Chemical and biological weapons lacked the

characteristic of an explosion or physical force yet these weapons certainly are capable of

destroying life and property Doctor Leigh Armistead a former information warfare instructor at

18

AUACSCSinksAY08

the Joint Forces Staff College cautions that the use of computer network attacks by the military

ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary

that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great

Russia introduced a proposal to the United Nations that banned the use of information

operations Even though the United Nations didnrsquot adopt the law the concern of international

community is fully aware of the impact cyber attacks can have on a nation

The concern over cyber warfare capabilities is that it can generate both non-kinetic and

kinetic effects There has always been the traditional kinetic solution for cyber warfare where a

precision guidance munition destroys a critical information system node Most people assume

computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos

computer system from the safety of onersquos own command and control center but the physical

destruction of a computer system or network by kinetic means also qualifies as cyber warfare

However cyber warfare has also evolved to the point where aggressors can achieve a kinetic

effect without the use of a traditional kinetic weapon A cyber attack on an information system

can shut down a particular node of a power plant causing the system to become inoperative

Even if there wasnrsquot an explosion the attack serves the same purpose

The question raised is do cyber attacks constitute an armed attack Scholars do agree that

some cyber attacks fit comfortably within the United Nations Charter For example a strategic

level cyber attack causing widespread damage and significant casualties would trigger the statersquos

right of self-defense In addition a cyber attack that precluded a conventional attack or a series

of cyber attacks causing significant damage would give a state the right of self-defense49 Few

would dispute that a country has the right under international law to respond with military force

19

AUACSCSinksAY08

if a state destroyed or significantly damaged another nationrsquos economic system for example the

New York or London stock exchanges

However some confusion and state-defined interpretation comes into play when the

frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard

Law School argues that cyber attacks require an expansion of the definition on the ldquouse of

forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot

be prohibited by international law50 International scholars recommend ldquoclearer rules of what

kinds of information warfare actions constitute an armed attackrdquo which drives permissible

responses of self-defense51 For example a state-sponsored cyber attack causes damage to a

victimrsquos factory or power plant however the nation claims the incident is an isolated instance

and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under

the United Nations Charter and the United Nations would consider any response retaliation

which would violate international law52

Another example involves a nation conducting a series of small attacks causing minimal

damage and then ceases Even though the aggressor used force to conduct cyber warfare

operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under

the United Nations Charter This type of attack is analogues to a small band of troops crossing a

border without causing significant damage53 According to the United Nations Charter the

national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders

and respond to the use of force Repelling the small band of troops and reestablishing their

sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration

of war and allies would have to respect the United Nations decision and couldnrsquot intervene The

same is true for the cyber attack A state can employ defensive measure to isolate and defeat the

20

AUACSCSinksAY08

incursion over the electromagnetic spectrum However the United Nations would see further

offensive operations or invasive operations as retaliation Therefore a nation must take the

incident whether it is signs of conventional forces on the ground or traces of cyber warfare

incursions in the electromagnetic spectrum to the United Nations to seek restitution

In both of these situations the international law becomes the target for change not

whether cyber warfare is in violation of international law If the law were to change the

international community would then consider the above situations acts of war even if an

adversary used conventional forces As written today the result of an operation remains the

driving factor in determining if an adversary has violated international law The means by which

an adversary conducts military operations may affect how nations react to the situation but

whether an adversary conducts the operation by means of the air land sea space or cyberspace

doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian

Triggs a public international lawyer and member of the Attorney General International Legal

Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over

offences abroad having an intended and substantial effect within a state may be justifiedrdquo54

Therefore the international community must evaluate the effect of a criminal act rather than the

means in which the act was committed

Others claim that because the Internet takes advantages of legal norms where non-state

actors can ignore Western notions of law55 more international laws are needed for cyberspace

However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using

other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the

Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked

aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts

21

AUACSCSinksAY08

against a staterdquo in the cyberspace domain The anonymity of the Internet and their total

disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and

national laws already exist in most countries that prohibit the use of the Internet for terrorist

activities therefore additional international laws wouldnrsquot prevent or deter terrorist from

committing such acts of aggression

International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed

Conflict includes the Martens Clause which extends established custom and humanitarian

principles to new technologies and addresses the ever-changing nature of warfare The

international community designed The Martens Clause ldquoto prevent future unnecessary andor

disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges

crimes by invoking the laws of humanity and public conscience hence their effects and not its

methods

The basic legal premise behind Law of Armed Conflict is that attacks must be limited to

military objectives and collateral damage must be proportionate to military advantages and

forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary

suffering but military commanders and planners need to be aware of the results a particular

action will invoke Russian leadership believes a computer network attack against their

homeland can be a means for executing a variety of escalating responses to include nuclear

attack58 Therefore it is imperative military commanders understand the impact any weapon

system can have on an adversary not just cyber attacks

Not all scholars agree that international law is insufficient to govern cyber warfare

Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace

and the Use of Force states that computer network attacks constitute an unlawful use of force in

22

AUACSCSinksAY08

cyberspace under traditional international law Sharp declared that an armed attack may occur

ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a

way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive

definition of cyber attacks may never be drafted59 The Congressional Research Service also

concluded that ldquothere is little likelihood that the international community will soon generate a

coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations

on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos

conclusion is that the effects of cyber warfare operations are the same as if an adversary

conducted conventional warfare operations where the effect of the attacks are the driving factors

in determining whether an adversary used force or not

The United States Government agrees with Sharprsquos conclusion The offensive

Information Operation strategy for the United States government as described by Doctor

Armistead ties the tools used to conduct military operations back to the desired effect which is

in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning

effects-based operations and operational art focus the Joint Force Commanderrsquos course of action

towards meeting objectives outlined in guidance provided by the National Command Authority

and senior military leadership62 Whether the tools are dropped pamphlets invasive network

attacks or bombs on targets the goal is to produce a desired effect to achieve the overall

objectives and cyber warfare can produce effects that challenge the national security of a nation

Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63

~General T Michael Moseley USAF

23

AUACSCSinksAY08

The cyberspace domain has been around for quite sometime but as technology continues

to advance businesses as well as governmental organizations are becoming more reliant on the

cyberspace domain With that reliance the protection of this critical domain becomes even more

important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the

electromagnetic spectrum by denying and disrupting information demands Scholars claim that

protection needs to include addressing existing international laws expanding them to incorporate

the ever-advancing capabilities emerging in the cyberspace domain

However territorial sovereignty of a nation and the principles of jurisdiction specifically

the Protective Security Principle give nations the right to exercise jurisdiction when an

aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64

While cyberspace is a domain requiring specific attention it relies on assets in the other domains

of land space sea and air in order to operate and international laws for the linear domains do

exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace

but during cyber warfare operations the principles behind the restrictions of foreign military

entering airspace do apply The strategic nature of cyber warfare operations correspond to the

same strategic impact that airpower can inflict upon a nation threatening their independence

While maybe not as dramatic as kinetic effects the results can be just as devastating

Space is relatively straightforward Since a nation canrsquot claim space and over flights of

foreign satellites over a nation is permissible nations must use space for peaceful purposes

Kinetic attacks against space assets are a violation of international law therefore nations would

consider cyber warfare operations against space assets as other than peaceful purposes and a

violation of international law Cyber attacks traversing space assets relate to current military

operations where the military uses space assets to conduct kinetic operations Since international

24

AUACSCSinksAY08

elites havenrsquot considered these kinetic operations as a breach of international law military

commanders can conduct cyber warfare operations through space without fear of violating

international laws for outer space

Crossing international borders without a nationrsquos permission and threatening their

sovereignty is a violation of international law While nations canrsquot consider all border crossings

as an act of war those acts of aggression that threaten the territorial integrity would elicit a

defensive response by the victim nation Whether incursions involve combat vehicles over a

highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are

threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not

have set foot in the nation but according the Protective Security Principle the victim nation has

jurisdiction

Conducting cyber warfare operations from the territorial sea is no different from

conducting operations from within a nationrsquos land or sea borders However the high seas are

very similar in nature to space in that they are reserved for peaceful purposes Therefore

conducting any means of warfare from within the high seas is a violation of international law

and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-

defense

According to Barkham ldquoinformation warfare attacks are in essence territorial

penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then

subject to the jurisdiction of the victim nation who then has the right for self-defense However

due to the global nature of cyberspace aggressors can cross multiple borders and determining

who has jurisdiction demands cooperation among nations The origin and any deliberate staging

locations of the cyber attack will drive who has jurisdiction The crossing of third party borders

25

AUACSCSinksAY08

by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the

aggressors threaten a nationrsquos independence or territorial integrity

Scholars consider cyber warfare operations that involve strategic and operational impacts

as being a means of using force and fall within the legal regime of existing international law

However scholars argue that because cyber warfare includes kinetic and non-kinetic results the

Use of Force definition needs expanding Yet they conclude that an exhaustive definition of

cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare

operations against existing case studies where the effects are evaluated as opposed to the means

even if the operations originated from outside the nationrsquos territorial jurisdiction There is some

authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to

have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade

non-state actors from conducting cyber warfare operations given their willingness to ignore

Western notions of war and their ability to conduct operations anonymously in cyberspace

International laws are in place to that address the ever-changing nature of warfare The

Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a

framework for addressing all warfare to include cyber warfare operations The international

community will need to measure the effects of an operation rather the means Whether its boots

on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a

nationrsquos response

26

AUACSCSinksAY08

End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)

27

AUACSCSinksAY08

44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

28

AUACSCSinksAY08

Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005

Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department

American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)

Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983

Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988

Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)

Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)

IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)

Joint Publication 3-13 Information Operations 13 February 2006

Joint Publication 5-0 Joint Operations Planning 26 December 2006

Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies

Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc

Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College

Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)

Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press

29

AUACSCSinksAY08

Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI

Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)

Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press

Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company

Detter Delupis I The law of war (2000) New York NY Cambridge University Press

Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)

Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College

Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor

Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)

Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)

Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf

Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)

Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College

Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College

Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)

Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA

30

AUACSCSinksAY08

Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)

Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)

Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College

Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology

Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College

Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)

OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center

OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College

OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications

Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991

Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College

Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center

Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)

31

AUACSCSinksAY08

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press

Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA

Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University

Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor

Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661

Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office

Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis

United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC

United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center

Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College

Wesley David C The Military Commander and the Law 2006

32

Page 11: Sinks 0407

AUACSCSinksAY08

Cyberspace is certainly a domain that requires unique attention in order for commanders

to effectively and efficiently prosecute combat operations Cyberspace spans the globe using

the physical infrastructure residing within the other linear domains As users pass information

from one site to another data crosses boundaries by means of the cyberspace domain Data

leaves the Iraq area of operation via satellite to a receiving site in Germany Operators route the

information to the United States either through another satellite or by ground to sea-based cables

bound for computer nodes within the United States before arriving in South Carolina where

automated network tools redirect the information to the receiverrsquos location

An adversary attempting to modify corrupt or destroy this information traveling within

the cyberspace domain would at one time or another would cross sovereign borders through air

land sea or space The adversaryrsquos physical presence may not apply as they could conduct

operations from the comforts of their home however a nation could detect the adversaryrsquos

digital presence and could feel the impact of their actions from within their sovereign borders

Therefore as these adversaries span the globe using the cyberspace domain that relies on the

other linear domains to exist does international law apply when boundaries are crossed The

following sections will address the international laws of each physical domain and evaluate how

their principles apply to the cyberspace domain

Airspace Airspace as defined by Doctor Boleslaw A Boczek the internationally renowned expert

on international law ldquois the air pillow above the subjacent territoryrdquo to include ldquoairspace above

international waters and the territorial seardquo The airspace is under complete and exclusive

sovereignty of the subject state19 With that states have jurisdiction over their airspace and

require identification of foreign aircraft along with their intentions According to Dr Boczek

book International Law A Dictionary ldquoentry of national spacehellipmay take place only with the

7

AUACSCSinksAY08

authorization of the territorial staterdquo20 and currently only applies to aircraft Entry into the

airspace would require ldquoall aircraft to identify themselves file flight plans and report their

positionrdquo According to the 1944 Chicago Convention on International Civil Aviation nations

can enter into agreements that allow scheduled international civil air services which usually

include reciprocal agreements covering routes volume and other matters relating to air traffic

However these agreements only apply to civil aviation where state aircraft which include

aircraft belonging to the military customs public services and heads of states must follow more

restrictive procedures upon entering the airspace of a foreign nation21

There are several incidents where states have evoked their right for defending their

national security like the shooting down of a US military reconnaissance aircraft over Soviet

airspace by the Soviet Union in 196022 or the shooting down by Soviet fighter planes of a South

Korean airliner in 198323 The Soviet Union isnrsquot the only nation to protect its airspace as the

United States was responsible for shooting down an Iranian airliner thought to be an attacking

military plane over the Persian Gulf in 198824 These examples illustrate a nationrsquos sovereign

resolve to protect itself when a suspected adversary violated their airspace

Applying international law of airspace to cyberspace doesnrsquot seem too practical Civilian

signals entering a nationrsquos airspace would require nations to enter into agreements to allow

scheduled services and the persons receiving information through airspace would have to be

non-state sponsored Nationrsquos could regulate some cyberspace networks entering airspace like

radio communications that primarily use land-based infrastructure to function However the

very nature of computer networks and the ever-increasing global reach of communication

capabilities severely restrict a nationrsquos ability to monitor the millions of transmissions made on a

daily basis and these signals certainly wouldnrsquot be on any scheduled basis Therefore even if

8

AUACSCSinksAY08

nations made agreements concerning the cyberspace domain nations would have a difficult time

enforcing their terms of agreements unless the terms are very open-ended If they were so open-

ended then the agreement may not be necessary and based on my research nations realize the

futility of establishing these agreements as this author couldnrsquot find any reference to any

agreements that nations have entered into referencing the cyberspace domain

While the international law for civilian aircraft in airspace may not relate well or isnrsquot

feasible to enforce in the cyberspace domain does a nation have that same right to protect itself

from a suspected attack from cyberspace where the attackerrsquos signal enters airspace Does a

nation have the right to ldquoshoot downrdquo a cyberspace attack as it enters their domain through

airspace The whole idea behind restricting airspace from foreign military aircraft is because of

the strategic impact military aircraft can have on a nation As demonstrated in World War II

military aircraft carrying weapons of mass destruction can decimate cities and destroy a nation

with minimal effort The effects generated by military aircraft are quite destructive and garner

specific attention While an aircraft in of itself is relatively harmless the actions taken by the

crew can lead to devastating results

The same is true for cyber attacks The information passing through airspace in the

cyberspace domain is the vehicle however the crew conducting the operation is potentially

creating the same strategic results The cyber attack may not destroy cities but it certainly can

be destructive to a nationrsquos well-being by crippling power sources economic industries water

supply etc all at the blink of an eye while the victim takes several days to determine the

perpetrator Therefore while the international law for airspace may not be specifically relevant

the underlying principles are applicable as cyber attacks can have the same potential strategic

impact as an attack from a military aircraft

9

AUACSCSinksAY08

Space Outer space as defined by Doctor Boczek ldquois the space beyond the air surrounding the

earthrdquo As of 2005 international law doesnrsquot define a demarcation between airspace and outer

space but ldquostates agree that state sovereignty doesnrsquot extend without any limitsrdquo25 Proposals of

where airspace ends and when outer space begins are base on various scientific and technological

criteria (gravitational pull capabilities of air breathing aircraft etc26) Others scientists argue

that defining a boundary between airspace and outer space isnrsquot necessary as it would hinder the

progress of space technology and the legal status would depend on the nature of the activity

While no boundary exists airspace is finite and activity in outer space follows four

fundamentals principles First over flights of foreign satellites over a nation is permissible as

airspace doesnrsquot extend forever Second space ldquointernational law applies to outer space and

celestial bodiesrdquo Third according to the Outer Space Treaty of 1967 states canrsquot claim celestial

bodies or outer space which are not subject to national appropriation therefore are free for use

by all states Finally states must use outer space exclusively for peaceful purposes with specific

bans on weapons of mass destruction However states can use space for other military purposes

like intelligence surveillance and reconnaissance activities 27

Are these international laws and principles applicable to cyberspace Satellites are

certainly an integral part of the space domain Operators control satellites by using the

cyberspace domain and information passes between satellites and ground stations One can

argue that space is a sub-set of the cyberspace domain with satellites serving as computers in

space Global positioning system devices in vehicles interact with satellites all through an

elaborate network as part of the electromagnetic spectrum known as cyberspace Therefore

cyberspace is in space with millions of people using cyberspace everyday

10

AUACSCSinksAY08

The military uses space assets for intelligence surveillance and reconnaissance

knowledge management and command and control Agencies like the National Reconnaissance

Office and National Geospatial-Intelligence Agency obtain high-altitude imagery using a variety

of capabilities to include heat signature resonation Satellites can detect missile launches which

provide vital military information to senior leaders tasked with the security of their nation The

military networks to include decision briefs tasks and emails in Iraq and the Predator feeds in

Afghanistan travel through military and commercial satellites with all the information flowing

through the cyberspace domain With the heavy reliance of cyberspace to operate space assets

and the demands of information flowing through space by businesses it should come as no

surprise that space is a vital component for day-to-day operations of the military

Since cyberspace is an inherent component for space operations it is logical to assume

international law for outer space is applicable to cyberspace as long as an aggressor doesnt

violate the four premises and as long as weapons of mass destruction arenrsquot ldquostationed in outer

spacerdquo 28 Therefore a state would consider a cyber attack against a satellite as other than for

peaceful purposes and according to the fourth premise international law would apply

However what about a cyber attack using satellites as a means of conducting operations

Under todayrsquos current operations international elites havenrsquot considered a cyber attack passing

through space as a violation of international law When a senior leader in Qatar approves a

target set that is executed by a pilot in Nevada by an aircraft in Afghanistan all this information

is transmitted by cyberspace through space The result is that an aircraft renders an air or ground

target inoperable The effect is the same for cyberspace The information flows through space

by way of the cyberspace domain and the result is that an operator has rendered a target

11

AUACSCSinksAY08

inoperable As with airspace the information isnrsquot the cause of the damage but what an operator

does with the information is what constitutes the cyber attack

Land Cyber attacks using resources over land is relatively straightforward International

boundaries are defined as ldquoimaginary lines which separate territorial sovereigntyrdquo 29 which are

mutually agreed upon via international treaties Crossing an international border without

permission from the state is a violation of international law While an illegal immigrant crossing

a border to seek an opportunity to provide for his family is a violation of national law the United

Nation considers a nation-sponsored invasion of another nation that threatens the security and

stability of a nation as a breach in international law and an act of war

However international law doesnrsquot consider all border crossings as an act of war For

example when Nicaraguan troops and arms allegedly crossed the borders of El Salvador the

United Nations determined that incursions didnrsquot threaten El Salvadorrsquos territorial integrity and

stated that neither ldquothese incursions nor the alleged supply of arms may be relied upon as

justifying the exercise of the right of collective self-defenserdquo30 The victim state can repelled the

aggressive act but the United Nations Council wouldnrsquot condone any further military action

taken against the adversary opting for diplomatic or economic solution instead

Does international law apply when an adversary crosses international borders using

cyberspace as the means for conducting warfare operations When an adversarial state crosses a

statersquos boundaries using roads or bridges that connect the two nations the road is the resource

spanning the two nations If the adversary doesnrsquot do anything then returns to their sovereign

borders the aggressor hasnrsquot violated international law However when the adversary uses

weapon systems to affect serious damage the adversary has broken international law and a

12

AUACSCSinksAY08

nation may invoke their right for self-defense and may conduct full-scale operations to neutralize

the threat

A parallel notion is when an adversary uses a copper or fiber optic connection that spans

between two nations The adversary uses the land-based LAN connection as a means for

conducting cyber warfare operations The adversary may cross the borders using cyberspace yet

do nothing The affected state may push the adversary back to its borders but no further actions

are deemed appropriate However once the adversary uses the information transmitted over

cyberspace to cause severe operational or strategic damage the affected state now has the right

of self-defense Cyberspace is the means like the road or bridge for which the adversary

delivered the weapon The affected nation will consider the execution of the adversaryrsquos

information packet or weapon system as an act of aggression and the effect caused by the

weapon is what breeches international law

The difference between these two scenarios is that the adversary using the

electromagnetic spectrum hasnrsquot physically invaded a nationrsquos sovereign borders However

their digital presence crossed sovereign borders and as latter discussed in the paper adversaries

committing an act aggression against a state are now under the jurisdiction of the affected state

Sea ldquoThe territorial sea is a belt of sea adjacent to the (statersquos) coasthellipto include the airspace

aboverdquo as well as the seabed and subsoil31 The territorial sea is subject to the right of innocent

passage by foreign shops giving states the right to transport goods and passengers between ports

All of which is subject to the full sovereignty of the state which according to the United Nations

Convention on the Law of the Sea in 1982 and agreed upon by the majority of its membership in

1982 extends 12 miles from the coast32 The jurisdiction includes crimes where the

consequences extend to the coastal state and disturbs the peace of the country33 A cyber attack

13

AUACSCSinksAY08

conducted within the territorial sea of a nation would be no different from a cyber attack

conducted from within the nationrsquos land borders therefore cyber attacks against a state or even

another state conducted within the territorial seas are subject to current international laws Cyber

attacks originating outside the statersquos sovereign borders but results in affecting a statersquos

resources in their territorial seas would fall under the land and airspace breeches of territorial

sovereignty and would be subject to international law

The high seas on the other hand arenrsquot subject to the sovereignty of any one state The

high seas extend beyond the territorial sea and include the airspace the seabed and the subsoil34

and all states have the right to exercise freedoms on the high seas35 As similarly defined in

space ldquothe high seas shall be reserved for peaceful purposesrdquo as stated by Article 88 of the Law

of the Seas Cooperative36 which is defined as refraining from any threat or use of force (outside

of wartime conflicts)

The very nature of a cyber attack in the high seas lends itself to be a violation of

international law as nations are restricted to conducting peaceful operations in the high seas

The question is whom has jurisdiction of crimes committed in the high seas By applying the

Protective Security Principle of Jurisdiction where an actor threatens a statersquo security and

introducing the United Nationrsquos definition on the Illegal Use of Force extends to the high seas

and for that matter space giving states the right for self-defense as defined by the United Nations

as ldquoan armed attackrdquo The sheer name of cyber attack doesnrsquot immediately lend itself to an

ldquoarmedrdquo cyber attack However the effects generated from a cyber attack can be equivalent to a

traditional conventional attack and the international law would permit a state to take appropriate

countermeasures while notifying the United Nations Security Council37

14

AUACSCSinksAY08

Applying International Law to Cyber Warfare Today we live in an Information Age where communication through cyberspace has forever changed and flattened out worldhellipOur adversaries seek to operate from behind technical legal and international screens as they execute their costly attacks38

~General James E Cartwright Commander United States Strategic Command

Jurisdiction

Understanding the territorial sovereignty principles of a nation is important in applying

cyberspace and cyber warfare to existing international laws While some of these principles and

international laws may not be relevant for the cyberspace domain due to the far-reaching

capability of cyber warfare the jurisdiction of a nation further defines its ability to respond to

aggressive acts by nations in the cyberspace domain There are three jurisdictional principles

that provide nations the right to pursue aggressors that threaten a nationrsquos independence the

Territorial Principle Nationality Principle and the Protective Security Principle

For actions originating within the state the jurisdiction clearly falls within the territorial

principle where a ldquostate has jurisdiction over all crimes committed in its territoryhellipto include

airspace international waters and territorial seasrdquo39 The territorial jurisdiction is subject to

exceptions when dealing with persons from foreign states as in the most popular example of

immunity given to foreign diplomats In this case ldquostates may exercise jurisdiction over its

citizenhellipeven if they are physically outside the statesrsquo territoryrdquo as Doctor Boczek defines as the

Nationality Principle Nations usually agree upon on these concessions states prior to the offense

being committed40

Doctor Boczek defines the Protective Security Principle as a ldquojurisdictional principle

whereby a state my assume jurisdiction over and punish foreign nationals for certain conduct

outside its territory which is directed against its security territorial integrity and political

independencerdquo41 Some states would argue that criticism of a state or government is applicable

15

AUACSCSinksAY08

in applying this principle of jurisdiction However this is too broad of an interpretation and

should be confined to acts that are more tangible in nature like falsification of a statesrsquo official

documents conspiracy to violate immigration of custom laws and illicit drug trafficking42

Would a cyber attack that is deemed to challenge a nationrsquos banking community or bring

down a power source be a direct attack against its security and political independence The

international community easily sees the attack of a power source with kinetic weapons as a

violation of a territorial boundary and a breech of international law The United States viewed

the attack on the Trade Towers as an act of war launching the Global War on Terrorism Would

the United States have viewed the same devastation as if the attack occurred through cyberspace

Would the attack have been less of an act of war if the aggressor remotely controlled domestic

airliners from a foreign country Probably not What happens if the cyber attack caused a fire in

the lower floors of the buildings preventing people from escaping While less dramatic than an

airbus flying into the middle of the towers and maybe more difficult to demonize the crime the

result is the samemdashinnocent people suffering as a result of an adversary trying to threaten a

nationrsquos security

What happens if the suspected cyber attack has violated a nationrsquos territorial boundary in

order to attack a neighboring country or an ally Going from point A to point B in cyberspace is

rarely a direct connection As with the global nature of cyberspace itrsquos conceivable that

adversaries cross several nationsrsquo boundaries to conduct cyber attack operations The question

generated is who has jurisdiction

If the actor committing the crime had used an airplane each nation could claim

jurisdiction as the adversary violated their territorial boundaries and violated international law

More often than not the first state would have acted immediately upon the aggressive act and

16

AUACSCSinksAY08

would have prevented aggressors from completing their task by either forcing the aircraft to land

or turnaround or an even more escalated response of firing upon the aircraft In the air land or

sea the ability for a nationrsquos military forces to respond in a timely manner gives way to the

deterrence factor of not crossing a statersquos boundaries without receiving permission for fear of

reprisal A clear example of this was when Turkey denied the United States the ability deploy

the 4th Infantry Division from its borders at the beginning of Operation Iraqi Freedom Violating

Turkeyrsquos borders without permission would have brought about great repercussions that would

have made Operation Iraqi Freedom even more difficult and could have resulted in an escalation

of the war outside the Iraqi borders43 Another example is when Spain and France denied the

Unites States the use of their airspace when F-111s based in the United Kingdom conducted air

operations in Libya in an effort to eliminate Muammar Khadafy44

However the speeds at which these breeches in territorial boundaries occur make it

difficult for a nation to claim jurisdiction especially when nothing occurred within their

territorial sovereignty The cyber attacks didnrsquot result in any damage to nation as the information

packets passed through their sovereign borders According to territorial boundary description

described by Doctor Boczek the international community doesnrsquot consider the crossing the

border in of itself an act of warmdashserious damage is a driving factor in determining conflict

escalation In addition according to the territorial jurisdiction principle the cyber attack didnrsquot

threaten a nationrsquos security territorial integrity and political independence If the cyber attack or

information originated from within a sovereign territory by a third party then the two nations

would have to work together to resolve the issue and mutual jurisdiction would probably apply

However if the cyber attack didnrsquot physically manifest itself from within their sovereign

territory or the adversary didnrsquot use the nation as a staging area to launch a further attack the

17

AUACSCSinksAY08

international law and the jurisdiction principles would dictate the affected nation would have

jurisdiction

Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security

territorial integrity and political independence Cyberspace utilizes the other domains as a means

of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence

Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of

territorial sovereignty the Protective Security Principle does provide nations the ability to

enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos

sovereignty when it conducts cyber warfare operations However some elites donrsquot consider

cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense

International law specifically article 2 of the United Nations Charters states that a

members shall refrain in their international relations from the threat or use of force against the

territorial integrity or political independence of any state or in any other manner inconsistent

with the purposes of the United Nations which is intended to prohibit all types of force except

those carried out under the aegis of the United Nations or as provided for by the Security

Council45 The only exception to the United Nations Charters as it relates to the Use of Force is

the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed

attack46

International elites have discussed the term ldquouse of forcerdquo in the past because of the

development of chemical and biological weapons and had to move from a kinetic impact based

definition to a results-oriented approach47 Chemical and biological weapons lacked the

characteristic of an explosion or physical force yet these weapons certainly are capable of

destroying life and property Doctor Leigh Armistead a former information warfare instructor at

18

AUACSCSinksAY08

the Joint Forces Staff College cautions that the use of computer network attacks by the military

ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary

that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great

Russia introduced a proposal to the United Nations that banned the use of information

operations Even though the United Nations didnrsquot adopt the law the concern of international

community is fully aware of the impact cyber attacks can have on a nation

The concern over cyber warfare capabilities is that it can generate both non-kinetic and

kinetic effects There has always been the traditional kinetic solution for cyber warfare where a

precision guidance munition destroys a critical information system node Most people assume

computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos

computer system from the safety of onersquos own command and control center but the physical

destruction of a computer system or network by kinetic means also qualifies as cyber warfare

However cyber warfare has also evolved to the point where aggressors can achieve a kinetic

effect without the use of a traditional kinetic weapon A cyber attack on an information system

can shut down a particular node of a power plant causing the system to become inoperative

Even if there wasnrsquot an explosion the attack serves the same purpose

The question raised is do cyber attacks constitute an armed attack Scholars do agree that

some cyber attacks fit comfortably within the United Nations Charter For example a strategic

level cyber attack causing widespread damage and significant casualties would trigger the statersquos

right of self-defense In addition a cyber attack that precluded a conventional attack or a series

of cyber attacks causing significant damage would give a state the right of self-defense49 Few

would dispute that a country has the right under international law to respond with military force

19

AUACSCSinksAY08

if a state destroyed or significantly damaged another nationrsquos economic system for example the

New York or London stock exchanges

However some confusion and state-defined interpretation comes into play when the

frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard

Law School argues that cyber attacks require an expansion of the definition on the ldquouse of

forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot

be prohibited by international law50 International scholars recommend ldquoclearer rules of what

kinds of information warfare actions constitute an armed attackrdquo which drives permissible

responses of self-defense51 For example a state-sponsored cyber attack causes damage to a

victimrsquos factory or power plant however the nation claims the incident is an isolated instance

and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under

the United Nations Charter and the United Nations would consider any response retaliation

which would violate international law52

Another example involves a nation conducting a series of small attacks causing minimal

damage and then ceases Even though the aggressor used force to conduct cyber warfare

operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under

the United Nations Charter This type of attack is analogues to a small band of troops crossing a

border without causing significant damage53 According to the United Nations Charter the

national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders

and respond to the use of force Repelling the small band of troops and reestablishing their

sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration

of war and allies would have to respect the United Nations decision and couldnrsquot intervene The

same is true for the cyber attack A state can employ defensive measure to isolate and defeat the

20

AUACSCSinksAY08

incursion over the electromagnetic spectrum However the United Nations would see further

offensive operations or invasive operations as retaliation Therefore a nation must take the

incident whether it is signs of conventional forces on the ground or traces of cyber warfare

incursions in the electromagnetic spectrum to the United Nations to seek restitution

In both of these situations the international law becomes the target for change not

whether cyber warfare is in violation of international law If the law were to change the

international community would then consider the above situations acts of war even if an

adversary used conventional forces As written today the result of an operation remains the

driving factor in determining if an adversary has violated international law The means by which

an adversary conducts military operations may affect how nations react to the situation but

whether an adversary conducts the operation by means of the air land sea space or cyberspace

doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian

Triggs a public international lawyer and member of the Attorney General International Legal

Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over

offences abroad having an intended and substantial effect within a state may be justifiedrdquo54

Therefore the international community must evaluate the effect of a criminal act rather than the

means in which the act was committed

Others claim that because the Internet takes advantages of legal norms where non-state

actors can ignore Western notions of law55 more international laws are needed for cyberspace

However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using

other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the

Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked

aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts

21

AUACSCSinksAY08

against a staterdquo in the cyberspace domain The anonymity of the Internet and their total

disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and

national laws already exist in most countries that prohibit the use of the Internet for terrorist

activities therefore additional international laws wouldnrsquot prevent or deter terrorist from

committing such acts of aggression

International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed

Conflict includes the Martens Clause which extends established custom and humanitarian

principles to new technologies and addresses the ever-changing nature of warfare The

international community designed The Martens Clause ldquoto prevent future unnecessary andor

disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges

crimes by invoking the laws of humanity and public conscience hence their effects and not its

methods

The basic legal premise behind Law of Armed Conflict is that attacks must be limited to

military objectives and collateral damage must be proportionate to military advantages and

forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary

suffering but military commanders and planners need to be aware of the results a particular

action will invoke Russian leadership believes a computer network attack against their

homeland can be a means for executing a variety of escalating responses to include nuclear

attack58 Therefore it is imperative military commanders understand the impact any weapon

system can have on an adversary not just cyber attacks

Not all scholars agree that international law is insufficient to govern cyber warfare

Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace

and the Use of Force states that computer network attacks constitute an unlawful use of force in

22

AUACSCSinksAY08

cyberspace under traditional international law Sharp declared that an armed attack may occur

ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a

way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive

definition of cyber attacks may never be drafted59 The Congressional Research Service also

concluded that ldquothere is little likelihood that the international community will soon generate a

coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations

on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos

conclusion is that the effects of cyber warfare operations are the same as if an adversary

conducted conventional warfare operations where the effect of the attacks are the driving factors

in determining whether an adversary used force or not

The United States Government agrees with Sharprsquos conclusion The offensive

Information Operation strategy for the United States government as described by Doctor

Armistead ties the tools used to conduct military operations back to the desired effect which is

in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning

effects-based operations and operational art focus the Joint Force Commanderrsquos course of action

towards meeting objectives outlined in guidance provided by the National Command Authority

and senior military leadership62 Whether the tools are dropped pamphlets invasive network

attacks or bombs on targets the goal is to produce a desired effect to achieve the overall

objectives and cyber warfare can produce effects that challenge the national security of a nation

Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63

~General T Michael Moseley USAF

23

AUACSCSinksAY08

The cyberspace domain has been around for quite sometime but as technology continues

to advance businesses as well as governmental organizations are becoming more reliant on the

cyberspace domain With that reliance the protection of this critical domain becomes even more

important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the

electromagnetic spectrum by denying and disrupting information demands Scholars claim that

protection needs to include addressing existing international laws expanding them to incorporate

the ever-advancing capabilities emerging in the cyberspace domain

However territorial sovereignty of a nation and the principles of jurisdiction specifically

the Protective Security Principle give nations the right to exercise jurisdiction when an

aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64

While cyberspace is a domain requiring specific attention it relies on assets in the other domains

of land space sea and air in order to operate and international laws for the linear domains do

exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace

but during cyber warfare operations the principles behind the restrictions of foreign military

entering airspace do apply The strategic nature of cyber warfare operations correspond to the

same strategic impact that airpower can inflict upon a nation threatening their independence

While maybe not as dramatic as kinetic effects the results can be just as devastating

Space is relatively straightforward Since a nation canrsquot claim space and over flights of

foreign satellites over a nation is permissible nations must use space for peaceful purposes

Kinetic attacks against space assets are a violation of international law therefore nations would

consider cyber warfare operations against space assets as other than peaceful purposes and a

violation of international law Cyber attacks traversing space assets relate to current military

operations where the military uses space assets to conduct kinetic operations Since international

24

AUACSCSinksAY08

elites havenrsquot considered these kinetic operations as a breach of international law military

commanders can conduct cyber warfare operations through space without fear of violating

international laws for outer space

Crossing international borders without a nationrsquos permission and threatening their

sovereignty is a violation of international law While nations canrsquot consider all border crossings

as an act of war those acts of aggression that threaten the territorial integrity would elicit a

defensive response by the victim nation Whether incursions involve combat vehicles over a

highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are

threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not

have set foot in the nation but according the Protective Security Principle the victim nation has

jurisdiction

Conducting cyber warfare operations from the territorial sea is no different from

conducting operations from within a nationrsquos land or sea borders However the high seas are

very similar in nature to space in that they are reserved for peaceful purposes Therefore

conducting any means of warfare from within the high seas is a violation of international law

and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-

defense

According to Barkham ldquoinformation warfare attacks are in essence territorial

penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then

subject to the jurisdiction of the victim nation who then has the right for self-defense However

due to the global nature of cyberspace aggressors can cross multiple borders and determining

who has jurisdiction demands cooperation among nations The origin and any deliberate staging

locations of the cyber attack will drive who has jurisdiction The crossing of third party borders

25

AUACSCSinksAY08

by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the

aggressors threaten a nationrsquos independence or territorial integrity

Scholars consider cyber warfare operations that involve strategic and operational impacts

as being a means of using force and fall within the legal regime of existing international law

However scholars argue that because cyber warfare includes kinetic and non-kinetic results the

Use of Force definition needs expanding Yet they conclude that an exhaustive definition of

cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare

operations against existing case studies where the effects are evaluated as opposed to the means

even if the operations originated from outside the nationrsquos territorial jurisdiction There is some

authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to

have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade

non-state actors from conducting cyber warfare operations given their willingness to ignore

Western notions of war and their ability to conduct operations anonymously in cyberspace

International laws are in place to that address the ever-changing nature of warfare The

Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a

framework for addressing all warfare to include cyber warfare operations The international

community will need to measure the effects of an operation rather the means Whether its boots

on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a

nationrsquos response

26

AUACSCSinksAY08

End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)

27

AUACSCSinksAY08

44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

28

AUACSCSinksAY08

Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005

Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department

American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)

Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983

Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988

Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)

Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)

IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)

Joint Publication 3-13 Information Operations 13 February 2006

Joint Publication 5-0 Joint Operations Planning 26 December 2006

Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies

Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc

Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College

Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)

Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press

29

AUACSCSinksAY08

Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI

Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)

Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press

Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company

Detter Delupis I The law of war (2000) New York NY Cambridge University Press

Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)

Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College

Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor

Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)

Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)

Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf

Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)

Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College

Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College

Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)

Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA

30

AUACSCSinksAY08

Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)

Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)

Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College

Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology

Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College

Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)

OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center

OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College

OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications

Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991

Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College

Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center

Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)

31

AUACSCSinksAY08

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press

Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA

Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University

Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor

Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661

Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office

Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis

United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC

United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center

Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College

Wesley David C The Military Commander and the Law 2006

32

Page 12: Sinks 0407

AUACSCSinksAY08

authorization of the territorial staterdquo20 and currently only applies to aircraft Entry into the

airspace would require ldquoall aircraft to identify themselves file flight plans and report their

positionrdquo According to the 1944 Chicago Convention on International Civil Aviation nations

can enter into agreements that allow scheduled international civil air services which usually

include reciprocal agreements covering routes volume and other matters relating to air traffic

However these agreements only apply to civil aviation where state aircraft which include

aircraft belonging to the military customs public services and heads of states must follow more

restrictive procedures upon entering the airspace of a foreign nation21

There are several incidents where states have evoked their right for defending their

national security like the shooting down of a US military reconnaissance aircraft over Soviet

airspace by the Soviet Union in 196022 or the shooting down by Soviet fighter planes of a South

Korean airliner in 198323 The Soviet Union isnrsquot the only nation to protect its airspace as the

United States was responsible for shooting down an Iranian airliner thought to be an attacking

military plane over the Persian Gulf in 198824 These examples illustrate a nationrsquos sovereign

resolve to protect itself when a suspected adversary violated their airspace

Applying international law of airspace to cyberspace doesnrsquot seem too practical Civilian

signals entering a nationrsquos airspace would require nations to enter into agreements to allow

scheduled services and the persons receiving information through airspace would have to be

non-state sponsored Nationrsquos could regulate some cyberspace networks entering airspace like

radio communications that primarily use land-based infrastructure to function However the

very nature of computer networks and the ever-increasing global reach of communication

capabilities severely restrict a nationrsquos ability to monitor the millions of transmissions made on a

daily basis and these signals certainly wouldnrsquot be on any scheduled basis Therefore even if

8

AUACSCSinksAY08

nations made agreements concerning the cyberspace domain nations would have a difficult time

enforcing their terms of agreements unless the terms are very open-ended If they were so open-

ended then the agreement may not be necessary and based on my research nations realize the

futility of establishing these agreements as this author couldnrsquot find any reference to any

agreements that nations have entered into referencing the cyberspace domain

While the international law for civilian aircraft in airspace may not relate well or isnrsquot

feasible to enforce in the cyberspace domain does a nation have that same right to protect itself

from a suspected attack from cyberspace where the attackerrsquos signal enters airspace Does a

nation have the right to ldquoshoot downrdquo a cyberspace attack as it enters their domain through

airspace The whole idea behind restricting airspace from foreign military aircraft is because of

the strategic impact military aircraft can have on a nation As demonstrated in World War II

military aircraft carrying weapons of mass destruction can decimate cities and destroy a nation

with minimal effort The effects generated by military aircraft are quite destructive and garner

specific attention While an aircraft in of itself is relatively harmless the actions taken by the

crew can lead to devastating results

The same is true for cyber attacks The information passing through airspace in the

cyberspace domain is the vehicle however the crew conducting the operation is potentially

creating the same strategic results The cyber attack may not destroy cities but it certainly can

be destructive to a nationrsquos well-being by crippling power sources economic industries water

supply etc all at the blink of an eye while the victim takes several days to determine the

perpetrator Therefore while the international law for airspace may not be specifically relevant

the underlying principles are applicable as cyber attacks can have the same potential strategic

impact as an attack from a military aircraft

9

AUACSCSinksAY08

Space Outer space as defined by Doctor Boczek ldquois the space beyond the air surrounding the

earthrdquo As of 2005 international law doesnrsquot define a demarcation between airspace and outer

space but ldquostates agree that state sovereignty doesnrsquot extend without any limitsrdquo25 Proposals of

where airspace ends and when outer space begins are base on various scientific and technological

criteria (gravitational pull capabilities of air breathing aircraft etc26) Others scientists argue

that defining a boundary between airspace and outer space isnrsquot necessary as it would hinder the

progress of space technology and the legal status would depend on the nature of the activity

While no boundary exists airspace is finite and activity in outer space follows four

fundamentals principles First over flights of foreign satellites over a nation is permissible as

airspace doesnrsquot extend forever Second space ldquointernational law applies to outer space and

celestial bodiesrdquo Third according to the Outer Space Treaty of 1967 states canrsquot claim celestial

bodies or outer space which are not subject to national appropriation therefore are free for use

by all states Finally states must use outer space exclusively for peaceful purposes with specific

bans on weapons of mass destruction However states can use space for other military purposes

like intelligence surveillance and reconnaissance activities 27

Are these international laws and principles applicable to cyberspace Satellites are

certainly an integral part of the space domain Operators control satellites by using the

cyberspace domain and information passes between satellites and ground stations One can

argue that space is a sub-set of the cyberspace domain with satellites serving as computers in

space Global positioning system devices in vehicles interact with satellites all through an

elaborate network as part of the electromagnetic spectrum known as cyberspace Therefore

cyberspace is in space with millions of people using cyberspace everyday

10

AUACSCSinksAY08

The military uses space assets for intelligence surveillance and reconnaissance

knowledge management and command and control Agencies like the National Reconnaissance

Office and National Geospatial-Intelligence Agency obtain high-altitude imagery using a variety

of capabilities to include heat signature resonation Satellites can detect missile launches which

provide vital military information to senior leaders tasked with the security of their nation The

military networks to include decision briefs tasks and emails in Iraq and the Predator feeds in

Afghanistan travel through military and commercial satellites with all the information flowing

through the cyberspace domain With the heavy reliance of cyberspace to operate space assets

and the demands of information flowing through space by businesses it should come as no

surprise that space is a vital component for day-to-day operations of the military

Since cyberspace is an inherent component for space operations it is logical to assume

international law for outer space is applicable to cyberspace as long as an aggressor doesnt

violate the four premises and as long as weapons of mass destruction arenrsquot ldquostationed in outer

spacerdquo 28 Therefore a state would consider a cyber attack against a satellite as other than for

peaceful purposes and according to the fourth premise international law would apply

However what about a cyber attack using satellites as a means of conducting operations

Under todayrsquos current operations international elites havenrsquot considered a cyber attack passing

through space as a violation of international law When a senior leader in Qatar approves a

target set that is executed by a pilot in Nevada by an aircraft in Afghanistan all this information

is transmitted by cyberspace through space The result is that an aircraft renders an air or ground

target inoperable The effect is the same for cyberspace The information flows through space

by way of the cyberspace domain and the result is that an operator has rendered a target

11

AUACSCSinksAY08

inoperable As with airspace the information isnrsquot the cause of the damage but what an operator

does with the information is what constitutes the cyber attack

Land Cyber attacks using resources over land is relatively straightforward International

boundaries are defined as ldquoimaginary lines which separate territorial sovereigntyrdquo 29 which are

mutually agreed upon via international treaties Crossing an international border without

permission from the state is a violation of international law While an illegal immigrant crossing

a border to seek an opportunity to provide for his family is a violation of national law the United

Nation considers a nation-sponsored invasion of another nation that threatens the security and

stability of a nation as a breach in international law and an act of war

However international law doesnrsquot consider all border crossings as an act of war For

example when Nicaraguan troops and arms allegedly crossed the borders of El Salvador the

United Nations determined that incursions didnrsquot threaten El Salvadorrsquos territorial integrity and

stated that neither ldquothese incursions nor the alleged supply of arms may be relied upon as

justifying the exercise of the right of collective self-defenserdquo30 The victim state can repelled the

aggressive act but the United Nations Council wouldnrsquot condone any further military action

taken against the adversary opting for diplomatic or economic solution instead

Does international law apply when an adversary crosses international borders using

cyberspace as the means for conducting warfare operations When an adversarial state crosses a

statersquos boundaries using roads or bridges that connect the two nations the road is the resource

spanning the two nations If the adversary doesnrsquot do anything then returns to their sovereign

borders the aggressor hasnrsquot violated international law However when the adversary uses

weapon systems to affect serious damage the adversary has broken international law and a

12

AUACSCSinksAY08

nation may invoke their right for self-defense and may conduct full-scale operations to neutralize

the threat

A parallel notion is when an adversary uses a copper or fiber optic connection that spans

between two nations The adversary uses the land-based LAN connection as a means for

conducting cyber warfare operations The adversary may cross the borders using cyberspace yet

do nothing The affected state may push the adversary back to its borders but no further actions

are deemed appropriate However once the adversary uses the information transmitted over

cyberspace to cause severe operational or strategic damage the affected state now has the right

of self-defense Cyberspace is the means like the road or bridge for which the adversary

delivered the weapon The affected nation will consider the execution of the adversaryrsquos

information packet or weapon system as an act of aggression and the effect caused by the

weapon is what breeches international law

The difference between these two scenarios is that the adversary using the

electromagnetic spectrum hasnrsquot physically invaded a nationrsquos sovereign borders However

their digital presence crossed sovereign borders and as latter discussed in the paper adversaries

committing an act aggression against a state are now under the jurisdiction of the affected state

Sea ldquoThe territorial sea is a belt of sea adjacent to the (statersquos) coasthellipto include the airspace

aboverdquo as well as the seabed and subsoil31 The territorial sea is subject to the right of innocent

passage by foreign shops giving states the right to transport goods and passengers between ports

All of which is subject to the full sovereignty of the state which according to the United Nations

Convention on the Law of the Sea in 1982 and agreed upon by the majority of its membership in

1982 extends 12 miles from the coast32 The jurisdiction includes crimes where the

consequences extend to the coastal state and disturbs the peace of the country33 A cyber attack

13

AUACSCSinksAY08

conducted within the territorial sea of a nation would be no different from a cyber attack

conducted from within the nationrsquos land borders therefore cyber attacks against a state or even

another state conducted within the territorial seas are subject to current international laws Cyber

attacks originating outside the statersquos sovereign borders but results in affecting a statersquos

resources in their territorial seas would fall under the land and airspace breeches of territorial

sovereignty and would be subject to international law

The high seas on the other hand arenrsquot subject to the sovereignty of any one state The

high seas extend beyond the territorial sea and include the airspace the seabed and the subsoil34

and all states have the right to exercise freedoms on the high seas35 As similarly defined in

space ldquothe high seas shall be reserved for peaceful purposesrdquo as stated by Article 88 of the Law

of the Seas Cooperative36 which is defined as refraining from any threat or use of force (outside

of wartime conflicts)

The very nature of a cyber attack in the high seas lends itself to be a violation of

international law as nations are restricted to conducting peaceful operations in the high seas

The question is whom has jurisdiction of crimes committed in the high seas By applying the

Protective Security Principle of Jurisdiction where an actor threatens a statersquo security and

introducing the United Nationrsquos definition on the Illegal Use of Force extends to the high seas

and for that matter space giving states the right for self-defense as defined by the United Nations

as ldquoan armed attackrdquo The sheer name of cyber attack doesnrsquot immediately lend itself to an

ldquoarmedrdquo cyber attack However the effects generated from a cyber attack can be equivalent to a

traditional conventional attack and the international law would permit a state to take appropriate

countermeasures while notifying the United Nations Security Council37

14

AUACSCSinksAY08

Applying International Law to Cyber Warfare Today we live in an Information Age where communication through cyberspace has forever changed and flattened out worldhellipOur adversaries seek to operate from behind technical legal and international screens as they execute their costly attacks38

~General James E Cartwright Commander United States Strategic Command

Jurisdiction

Understanding the territorial sovereignty principles of a nation is important in applying

cyberspace and cyber warfare to existing international laws While some of these principles and

international laws may not be relevant for the cyberspace domain due to the far-reaching

capability of cyber warfare the jurisdiction of a nation further defines its ability to respond to

aggressive acts by nations in the cyberspace domain There are three jurisdictional principles

that provide nations the right to pursue aggressors that threaten a nationrsquos independence the

Territorial Principle Nationality Principle and the Protective Security Principle

For actions originating within the state the jurisdiction clearly falls within the territorial

principle where a ldquostate has jurisdiction over all crimes committed in its territoryhellipto include

airspace international waters and territorial seasrdquo39 The territorial jurisdiction is subject to

exceptions when dealing with persons from foreign states as in the most popular example of

immunity given to foreign diplomats In this case ldquostates may exercise jurisdiction over its

citizenhellipeven if they are physically outside the statesrsquo territoryrdquo as Doctor Boczek defines as the

Nationality Principle Nations usually agree upon on these concessions states prior to the offense

being committed40

Doctor Boczek defines the Protective Security Principle as a ldquojurisdictional principle

whereby a state my assume jurisdiction over and punish foreign nationals for certain conduct

outside its territory which is directed against its security territorial integrity and political

independencerdquo41 Some states would argue that criticism of a state or government is applicable

15

AUACSCSinksAY08

in applying this principle of jurisdiction However this is too broad of an interpretation and

should be confined to acts that are more tangible in nature like falsification of a statesrsquo official

documents conspiracy to violate immigration of custom laws and illicit drug trafficking42

Would a cyber attack that is deemed to challenge a nationrsquos banking community or bring

down a power source be a direct attack against its security and political independence The

international community easily sees the attack of a power source with kinetic weapons as a

violation of a territorial boundary and a breech of international law The United States viewed

the attack on the Trade Towers as an act of war launching the Global War on Terrorism Would

the United States have viewed the same devastation as if the attack occurred through cyberspace

Would the attack have been less of an act of war if the aggressor remotely controlled domestic

airliners from a foreign country Probably not What happens if the cyber attack caused a fire in

the lower floors of the buildings preventing people from escaping While less dramatic than an

airbus flying into the middle of the towers and maybe more difficult to demonize the crime the

result is the samemdashinnocent people suffering as a result of an adversary trying to threaten a

nationrsquos security

What happens if the suspected cyber attack has violated a nationrsquos territorial boundary in

order to attack a neighboring country or an ally Going from point A to point B in cyberspace is

rarely a direct connection As with the global nature of cyberspace itrsquos conceivable that

adversaries cross several nationsrsquo boundaries to conduct cyber attack operations The question

generated is who has jurisdiction

If the actor committing the crime had used an airplane each nation could claim

jurisdiction as the adversary violated their territorial boundaries and violated international law

More often than not the first state would have acted immediately upon the aggressive act and

16

AUACSCSinksAY08

would have prevented aggressors from completing their task by either forcing the aircraft to land

or turnaround or an even more escalated response of firing upon the aircraft In the air land or

sea the ability for a nationrsquos military forces to respond in a timely manner gives way to the

deterrence factor of not crossing a statersquos boundaries without receiving permission for fear of

reprisal A clear example of this was when Turkey denied the United States the ability deploy

the 4th Infantry Division from its borders at the beginning of Operation Iraqi Freedom Violating

Turkeyrsquos borders without permission would have brought about great repercussions that would

have made Operation Iraqi Freedom even more difficult and could have resulted in an escalation

of the war outside the Iraqi borders43 Another example is when Spain and France denied the

Unites States the use of their airspace when F-111s based in the United Kingdom conducted air

operations in Libya in an effort to eliminate Muammar Khadafy44

However the speeds at which these breeches in territorial boundaries occur make it

difficult for a nation to claim jurisdiction especially when nothing occurred within their

territorial sovereignty The cyber attacks didnrsquot result in any damage to nation as the information

packets passed through their sovereign borders According to territorial boundary description

described by Doctor Boczek the international community doesnrsquot consider the crossing the

border in of itself an act of warmdashserious damage is a driving factor in determining conflict

escalation In addition according to the territorial jurisdiction principle the cyber attack didnrsquot

threaten a nationrsquos security territorial integrity and political independence If the cyber attack or

information originated from within a sovereign territory by a third party then the two nations

would have to work together to resolve the issue and mutual jurisdiction would probably apply

However if the cyber attack didnrsquot physically manifest itself from within their sovereign

territory or the adversary didnrsquot use the nation as a staging area to launch a further attack the

17

AUACSCSinksAY08

international law and the jurisdiction principles would dictate the affected nation would have

jurisdiction

Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security

territorial integrity and political independence Cyberspace utilizes the other domains as a means

of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence

Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of

territorial sovereignty the Protective Security Principle does provide nations the ability to

enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos

sovereignty when it conducts cyber warfare operations However some elites donrsquot consider

cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense

International law specifically article 2 of the United Nations Charters states that a

members shall refrain in their international relations from the threat or use of force against the

territorial integrity or political independence of any state or in any other manner inconsistent

with the purposes of the United Nations which is intended to prohibit all types of force except

those carried out under the aegis of the United Nations or as provided for by the Security

Council45 The only exception to the United Nations Charters as it relates to the Use of Force is

the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed

attack46

International elites have discussed the term ldquouse of forcerdquo in the past because of the

development of chemical and biological weapons and had to move from a kinetic impact based

definition to a results-oriented approach47 Chemical and biological weapons lacked the

characteristic of an explosion or physical force yet these weapons certainly are capable of

destroying life and property Doctor Leigh Armistead a former information warfare instructor at

18

AUACSCSinksAY08

the Joint Forces Staff College cautions that the use of computer network attacks by the military

ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary

that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great

Russia introduced a proposal to the United Nations that banned the use of information

operations Even though the United Nations didnrsquot adopt the law the concern of international

community is fully aware of the impact cyber attacks can have on a nation

The concern over cyber warfare capabilities is that it can generate both non-kinetic and

kinetic effects There has always been the traditional kinetic solution for cyber warfare where a

precision guidance munition destroys a critical information system node Most people assume

computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos

computer system from the safety of onersquos own command and control center but the physical

destruction of a computer system or network by kinetic means also qualifies as cyber warfare

However cyber warfare has also evolved to the point where aggressors can achieve a kinetic

effect without the use of a traditional kinetic weapon A cyber attack on an information system

can shut down a particular node of a power plant causing the system to become inoperative

Even if there wasnrsquot an explosion the attack serves the same purpose

The question raised is do cyber attacks constitute an armed attack Scholars do agree that

some cyber attacks fit comfortably within the United Nations Charter For example a strategic

level cyber attack causing widespread damage and significant casualties would trigger the statersquos

right of self-defense In addition a cyber attack that precluded a conventional attack or a series

of cyber attacks causing significant damage would give a state the right of self-defense49 Few

would dispute that a country has the right under international law to respond with military force

19

AUACSCSinksAY08

if a state destroyed or significantly damaged another nationrsquos economic system for example the

New York or London stock exchanges

However some confusion and state-defined interpretation comes into play when the

frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard

Law School argues that cyber attacks require an expansion of the definition on the ldquouse of

forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot

be prohibited by international law50 International scholars recommend ldquoclearer rules of what

kinds of information warfare actions constitute an armed attackrdquo which drives permissible

responses of self-defense51 For example a state-sponsored cyber attack causes damage to a

victimrsquos factory or power plant however the nation claims the incident is an isolated instance

and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under

the United Nations Charter and the United Nations would consider any response retaliation

which would violate international law52

Another example involves a nation conducting a series of small attacks causing minimal

damage and then ceases Even though the aggressor used force to conduct cyber warfare

operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under

the United Nations Charter This type of attack is analogues to a small band of troops crossing a

border without causing significant damage53 According to the United Nations Charter the

national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders

and respond to the use of force Repelling the small band of troops and reestablishing their

sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration

of war and allies would have to respect the United Nations decision and couldnrsquot intervene The

same is true for the cyber attack A state can employ defensive measure to isolate and defeat the

20

AUACSCSinksAY08

incursion over the electromagnetic spectrum However the United Nations would see further

offensive operations or invasive operations as retaliation Therefore a nation must take the

incident whether it is signs of conventional forces on the ground or traces of cyber warfare

incursions in the electromagnetic spectrum to the United Nations to seek restitution

In both of these situations the international law becomes the target for change not

whether cyber warfare is in violation of international law If the law were to change the

international community would then consider the above situations acts of war even if an

adversary used conventional forces As written today the result of an operation remains the

driving factor in determining if an adversary has violated international law The means by which

an adversary conducts military operations may affect how nations react to the situation but

whether an adversary conducts the operation by means of the air land sea space or cyberspace

doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian

Triggs a public international lawyer and member of the Attorney General International Legal

Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over

offences abroad having an intended and substantial effect within a state may be justifiedrdquo54

Therefore the international community must evaluate the effect of a criminal act rather than the

means in which the act was committed

Others claim that because the Internet takes advantages of legal norms where non-state

actors can ignore Western notions of law55 more international laws are needed for cyberspace

However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using

other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the

Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked

aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts

21

AUACSCSinksAY08

against a staterdquo in the cyberspace domain The anonymity of the Internet and their total

disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and

national laws already exist in most countries that prohibit the use of the Internet for terrorist

activities therefore additional international laws wouldnrsquot prevent or deter terrorist from

committing such acts of aggression

International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed

Conflict includes the Martens Clause which extends established custom and humanitarian

principles to new technologies and addresses the ever-changing nature of warfare The

international community designed The Martens Clause ldquoto prevent future unnecessary andor

disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges

crimes by invoking the laws of humanity and public conscience hence their effects and not its

methods

The basic legal premise behind Law of Armed Conflict is that attacks must be limited to

military objectives and collateral damage must be proportionate to military advantages and

forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary

suffering but military commanders and planners need to be aware of the results a particular

action will invoke Russian leadership believes a computer network attack against their

homeland can be a means for executing a variety of escalating responses to include nuclear

attack58 Therefore it is imperative military commanders understand the impact any weapon

system can have on an adversary not just cyber attacks

Not all scholars agree that international law is insufficient to govern cyber warfare

Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace

and the Use of Force states that computer network attacks constitute an unlawful use of force in

22

AUACSCSinksAY08

cyberspace under traditional international law Sharp declared that an armed attack may occur

ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a

way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive

definition of cyber attacks may never be drafted59 The Congressional Research Service also

concluded that ldquothere is little likelihood that the international community will soon generate a

coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations

on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos

conclusion is that the effects of cyber warfare operations are the same as if an adversary

conducted conventional warfare operations where the effect of the attacks are the driving factors

in determining whether an adversary used force or not

The United States Government agrees with Sharprsquos conclusion The offensive

Information Operation strategy for the United States government as described by Doctor

Armistead ties the tools used to conduct military operations back to the desired effect which is

in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning

effects-based operations and operational art focus the Joint Force Commanderrsquos course of action

towards meeting objectives outlined in guidance provided by the National Command Authority

and senior military leadership62 Whether the tools are dropped pamphlets invasive network

attacks or bombs on targets the goal is to produce a desired effect to achieve the overall

objectives and cyber warfare can produce effects that challenge the national security of a nation

Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63

~General T Michael Moseley USAF

23

AUACSCSinksAY08

The cyberspace domain has been around for quite sometime but as technology continues

to advance businesses as well as governmental organizations are becoming more reliant on the

cyberspace domain With that reliance the protection of this critical domain becomes even more

important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the

electromagnetic spectrum by denying and disrupting information demands Scholars claim that

protection needs to include addressing existing international laws expanding them to incorporate

the ever-advancing capabilities emerging in the cyberspace domain

However territorial sovereignty of a nation and the principles of jurisdiction specifically

the Protective Security Principle give nations the right to exercise jurisdiction when an

aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64

While cyberspace is a domain requiring specific attention it relies on assets in the other domains

of land space sea and air in order to operate and international laws for the linear domains do

exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace

but during cyber warfare operations the principles behind the restrictions of foreign military

entering airspace do apply The strategic nature of cyber warfare operations correspond to the

same strategic impact that airpower can inflict upon a nation threatening their independence

While maybe not as dramatic as kinetic effects the results can be just as devastating

Space is relatively straightforward Since a nation canrsquot claim space and over flights of

foreign satellites over a nation is permissible nations must use space for peaceful purposes

Kinetic attacks against space assets are a violation of international law therefore nations would

consider cyber warfare operations against space assets as other than peaceful purposes and a

violation of international law Cyber attacks traversing space assets relate to current military

operations where the military uses space assets to conduct kinetic operations Since international

24

AUACSCSinksAY08

elites havenrsquot considered these kinetic operations as a breach of international law military

commanders can conduct cyber warfare operations through space without fear of violating

international laws for outer space

Crossing international borders without a nationrsquos permission and threatening their

sovereignty is a violation of international law While nations canrsquot consider all border crossings

as an act of war those acts of aggression that threaten the territorial integrity would elicit a

defensive response by the victim nation Whether incursions involve combat vehicles over a

highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are

threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not

have set foot in the nation but according the Protective Security Principle the victim nation has

jurisdiction

Conducting cyber warfare operations from the territorial sea is no different from

conducting operations from within a nationrsquos land or sea borders However the high seas are

very similar in nature to space in that they are reserved for peaceful purposes Therefore

conducting any means of warfare from within the high seas is a violation of international law

and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-

defense

According to Barkham ldquoinformation warfare attacks are in essence territorial

penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then

subject to the jurisdiction of the victim nation who then has the right for self-defense However

due to the global nature of cyberspace aggressors can cross multiple borders and determining

who has jurisdiction demands cooperation among nations The origin and any deliberate staging

locations of the cyber attack will drive who has jurisdiction The crossing of third party borders

25

AUACSCSinksAY08

by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the

aggressors threaten a nationrsquos independence or territorial integrity

Scholars consider cyber warfare operations that involve strategic and operational impacts

as being a means of using force and fall within the legal regime of existing international law

However scholars argue that because cyber warfare includes kinetic and non-kinetic results the

Use of Force definition needs expanding Yet they conclude that an exhaustive definition of

cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare

operations against existing case studies where the effects are evaluated as opposed to the means

even if the operations originated from outside the nationrsquos territorial jurisdiction There is some

authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to

have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade

non-state actors from conducting cyber warfare operations given their willingness to ignore

Western notions of war and their ability to conduct operations anonymously in cyberspace

International laws are in place to that address the ever-changing nature of warfare The

Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a

framework for addressing all warfare to include cyber warfare operations The international

community will need to measure the effects of an operation rather the means Whether its boots

on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a

nationrsquos response

26

AUACSCSinksAY08

End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)

27

AUACSCSinksAY08

44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

28

AUACSCSinksAY08

Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005

Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department

American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)

Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983

Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988

Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)

Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)

IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)

Joint Publication 3-13 Information Operations 13 February 2006

Joint Publication 5-0 Joint Operations Planning 26 December 2006

Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies

Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc

Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College

Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)

Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press

29

AUACSCSinksAY08

Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI

Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)

Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press

Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company

Detter Delupis I The law of war (2000) New York NY Cambridge University Press

Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)

Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College

Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor

Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)

Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)

Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf

Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)

Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College

Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College

Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)

Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA

30

AUACSCSinksAY08

Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)

Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)

Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College

Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology

Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College

Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)

OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center

OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College

OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications

Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991

Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College

Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center

Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)

31

AUACSCSinksAY08

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press

Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA

Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University

Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor

Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661

Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office

Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis

United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC

United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center

Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College

Wesley David C The Military Commander and the Law 2006

32

Page 13: Sinks 0407

AUACSCSinksAY08

nations made agreements concerning the cyberspace domain nations would have a difficult time

enforcing their terms of agreements unless the terms are very open-ended If they were so open-

ended then the agreement may not be necessary and based on my research nations realize the

futility of establishing these agreements as this author couldnrsquot find any reference to any

agreements that nations have entered into referencing the cyberspace domain

While the international law for civilian aircraft in airspace may not relate well or isnrsquot

feasible to enforce in the cyberspace domain does a nation have that same right to protect itself

from a suspected attack from cyberspace where the attackerrsquos signal enters airspace Does a

nation have the right to ldquoshoot downrdquo a cyberspace attack as it enters their domain through

airspace The whole idea behind restricting airspace from foreign military aircraft is because of

the strategic impact military aircraft can have on a nation As demonstrated in World War II

military aircraft carrying weapons of mass destruction can decimate cities and destroy a nation

with minimal effort The effects generated by military aircraft are quite destructive and garner

specific attention While an aircraft in of itself is relatively harmless the actions taken by the

crew can lead to devastating results

The same is true for cyber attacks The information passing through airspace in the

cyberspace domain is the vehicle however the crew conducting the operation is potentially

creating the same strategic results The cyber attack may not destroy cities but it certainly can

be destructive to a nationrsquos well-being by crippling power sources economic industries water

supply etc all at the blink of an eye while the victim takes several days to determine the

perpetrator Therefore while the international law for airspace may not be specifically relevant

the underlying principles are applicable as cyber attacks can have the same potential strategic

impact as an attack from a military aircraft

9

AUACSCSinksAY08

Space Outer space as defined by Doctor Boczek ldquois the space beyond the air surrounding the

earthrdquo As of 2005 international law doesnrsquot define a demarcation between airspace and outer

space but ldquostates agree that state sovereignty doesnrsquot extend without any limitsrdquo25 Proposals of

where airspace ends and when outer space begins are base on various scientific and technological

criteria (gravitational pull capabilities of air breathing aircraft etc26) Others scientists argue

that defining a boundary between airspace and outer space isnrsquot necessary as it would hinder the

progress of space technology and the legal status would depend on the nature of the activity

While no boundary exists airspace is finite and activity in outer space follows four

fundamentals principles First over flights of foreign satellites over a nation is permissible as

airspace doesnrsquot extend forever Second space ldquointernational law applies to outer space and

celestial bodiesrdquo Third according to the Outer Space Treaty of 1967 states canrsquot claim celestial

bodies or outer space which are not subject to national appropriation therefore are free for use

by all states Finally states must use outer space exclusively for peaceful purposes with specific

bans on weapons of mass destruction However states can use space for other military purposes

like intelligence surveillance and reconnaissance activities 27

Are these international laws and principles applicable to cyberspace Satellites are

certainly an integral part of the space domain Operators control satellites by using the

cyberspace domain and information passes between satellites and ground stations One can

argue that space is a sub-set of the cyberspace domain with satellites serving as computers in

space Global positioning system devices in vehicles interact with satellites all through an

elaborate network as part of the electromagnetic spectrum known as cyberspace Therefore

cyberspace is in space with millions of people using cyberspace everyday

10

AUACSCSinksAY08

The military uses space assets for intelligence surveillance and reconnaissance

knowledge management and command and control Agencies like the National Reconnaissance

Office and National Geospatial-Intelligence Agency obtain high-altitude imagery using a variety

of capabilities to include heat signature resonation Satellites can detect missile launches which

provide vital military information to senior leaders tasked with the security of their nation The

military networks to include decision briefs tasks and emails in Iraq and the Predator feeds in

Afghanistan travel through military and commercial satellites with all the information flowing

through the cyberspace domain With the heavy reliance of cyberspace to operate space assets

and the demands of information flowing through space by businesses it should come as no

surprise that space is a vital component for day-to-day operations of the military

Since cyberspace is an inherent component for space operations it is logical to assume

international law for outer space is applicable to cyberspace as long as an aggressor doesnt

violate the four premises and as long as weapons of mass destruction arenrsquot ldquostationed in outer

spacerdquo 28 Therefore a state would consider a cyber attack against a satellite as other than for

peaceful purposes and according to the fourth premise international law would apply

However what about a cyber attack using satellites as a means of conducting operations

Under todayrsquos current operations international elites havenrsquot considered a cyber attack passing

through space as a violation of international law When a senior leader in Qatar approves a

target set that is executed by a pilot in Nevada by an aircraft in Afghanistan all this information

is transmitted by cyberspace through space The result is that an aircraft renders an air or ground

target inoperable The effect is the same for cyberspace The information flows through space

by way of the cyberspace domain and the result is that an operator has rendered a target

11

AUACSCSinksAY08

inoperable As with airspace the information isnrsquot the cause of the damage but what an operator

does with the information is what constitutes the cyber attack

Land Cyber attacks using resources over land is relatively straightforward International

boundaries are defined as ldquoimaginary lines which separate territorial sovereigntyrdquo 29 which are

mutually agreed upon via international treaties Crossing an international border without

permission from the state is a violation of international law While an illegal immigrant crossing

a border to seek an opportunity to provide for his family is a violation of national law the United

Nation considers a nation-sponsored invasion of another nation that threatens the security and

stability of a nation as a breach in international law and an act of war

However international law doesnrsquot consider all border crossings as an act of war For

example when Nicaraguan troops and arms allegedly crossed the borders of El Salvador the

United Nations determined that incursions didnrsquot threaten El Salvadorrsquos territorial integrity and

stated that neither ldquothese incursions nor the alleged supply of arms may be relied upon as

justifying the exercise of the right of collective self-defenserdquo30 The victim state can repelled the

aggressive act but the United Nations Council wouldnrsquot condone any further military action

taken against the adversary opting for diplomatic or economic solution instead

Does international law apply when an adversary crosses international borders using

cyberspace as the means for conducting warfare operations When an adversarial state crosses a

statersquos boundaries using roads or bridges that connect the two nations the road is the resource

spanning the two nations If the adversary doesnrsquot do anything then returns to their sovereign

borders the aggressor hasnrsquot violated international law However when the adversary uses

weapon systems to affect serious damage the adversary has broken international law and a

12

AUACSCSinksAY08

nation may invoke their right for self-defense and may conduct full-scale operations to neutralize

the threat

A parallel notion is when an adversary uses a copper or fiber optic connection that spans

between two nations The adversary uses the land-based LAN connection as a means for

conducting cyber warfare operations The adversary may cross the borders using cyberspace yet

do nothing The affected state may push the adversary back to its borders but no further actions

are deemed appropriate However once the adversary uses the information transmitted over

cyberspace to cause severe operational or strategic damage the affected state now has the right

of self-defense Cyberspace is the means like the road or bridge for which the adversary

delivered the weapon The affected nation will consider the execution of the adversaryrsquos

information packet or weapon system as an act of aggression and the effect caused by the

weapon is what breeches international law

The difference between these two scenarios is that the adversary using the

electromagnetic spectrum hasnrsquot physically invaded a nationrsquos sovereign borders However

their digital presence crossed sovereign borders and as latter discussed in the paper adversaries

committing an act aggression against a state are now under the jurisdiction of the affected state

Sea ldquoThe territorial sea is a belt of sea adjacent to the (statersquos) coasthellipto include the airspace

aboverdquo as well as the seabed and subsoil31 The territorial sea is subject to the right of innocent

passage by foreign shops giving states the right to transport goods and passengers between ports

All of which is subject to the full sovereignty of the state which according to the United Nations

Convention on the Law of the Sea in 1982 and agreed upon by the majority of its membership in

1982 extends 12 miles from the coast32 The jurisdiction includes crimes where the

consequences extend to the coastal state and disturbs the peace of the country33 A cyber attack

13

AUACSCSinksAY08

conducted within the territorial sea of a nation would be no different from a cyber attack

conducted from within the nationrsquos land borders therefore cyber attacks against a state or even

another state conducted within the territorial seas are subject to current international laws Cyber

attacks originating outside the statersquos sovereign borders but results in affecting a statersquos

resources in their territorial seas would fall under the land and airspace breeches of territorial

sovereignty and would be subject to international law

The high seas on the other hand arenrsquot subject to the sovereignty of any one state The

high seas extend beyond the territorial sea and include the airspace the seabed and the subsoil34

and all states have the right to exercise freedoms on the high seas35 As similarly defined in

space ldquothe high seas shall be reserved for peaceful purposesrdquo as stated by Article 88 of the Law

of the Seas Cooperative36 which is defined as refraining from any threat or use of force (outside

of wartime conflicts)

The very nature of a cyber attack in the high seas lends itself to be a violation of

international law as nations are restricted to conducting peaceful operations in the high seas

The question is whom has jurisdiction of crimes committed in the high seas By applying the

Protective Security Principle of Jurisdiction where an actor threatens a statersquo security and

introducing the United Nationrsquos definition on the Illegal Use of Force extends to the high seas

and for that matter space giving states the right for self-defense as defined by the United Nations

as ldquoan armed attackrdquo The sheer name of cyber attack doesnrsquot immediately lend itself to an

ldquoarmedrdquo cyber attack However the effects generated from a cyber attack can be equivalent to a

traditional conventional attack and the international law would permit a state to take appropriate

countermeasures while notifying the United Nations Security Council37

14

AUACSCSinksAY08

Applying International Law to Cyber Warfare Today we live in an Information Age where communication through cyberspace has forever changed and flattened out worldhellipOur adversaries seek to operate from behind technical legal and international screens as they execute their costly attacks38

~General James E Cartwright Commander United States Strategic Command

Jurisdiction

Understanding the territorial sovereignty principles of a nation is important in applying

cyberspace and cyber warfare to existing international laws While some of these principles and

international laws may not be relevant for the cyberspace domain due to the far-reaching

capability of cyber warfare the jurisdiction of a nation further defines its ability to respond to

aggressive acts by nations in the cyberspace domain There are three jurisdictional principles

that provide nations the right to pursue aggressors that threaten a nationrsquos independence the

Territorial Principle Nationality Principle and the Protective Security Principle

For actions originating within the state the jurisdiction clearly falls within the territorial

principle where a ldquostate has jurisdiction over all crimes committed in its territoryhellipto include

airspace international waters and territorial seasrdquo39 The territorial jurisdiction is subject to

exceptions when dealing with persons from foreign states as in the most popular example of

immunity given to foreign diplomats In this case ldquostates may exercise jurisdiction over its

citizenhellipeven if they are physically outside the statesrsquo territoryrdquo as Doctor Boczek defines as the

Nationality Principle Nations usually agree upon on these concessions states prior to the offense

being committed40

Doctor Boczek defines the Protective Security Principle as a ldquojurisdictional principle

whereby a state my assume jurisdiction over and punish foreign nationals for certain conduct

outside its territory which is directed against its security territorial integrity and political

independencerdquo41 Some states would argue that criticism of a state or government is applicable

15

AUACSCSinksAY08

in applying this principle of jurisdiction However this is too broad of an interpretation and

should be confined to acts that are more tangible in nature like falsification of a statesrsquo official

documents conspiracy to violate immigration of custom laws and illicit drug trafficking42

Would a cyber attack that is deemed to challenge a nationrsquos banking community or bring

down a power source be a direct attack against its security and political independence The

international community easily sees the attack of a power source with kinetic weapons as a

violation of a territorial boundary and a breech of international law The United States viewed

the attack on the Trade Towers as an act of war launching the Global War on Terrorism Would

the United States have viewed the same devastation as if the attack occurred through cyberspace

Would the attack have been less of an act of war if the aggressor remotely controlled domestic

airliners from a foreign country Probably not What happens if the cyber attack caused a fire in

the lower floors of the buildings preventing people from escaping While less dramatic than an

airbus flying into the middle of the towers and maybe more difficult to demonize the crime the

result is the samemdashinnocent people suffering as a result of an adversary trying to threaten a

nationrsquos security

What happens if the suspected cyber attack has violated a nationrsquos territorial boundary in

order to attack a neighboring country or an ally Going from point A to point B in cyberspace is

rarely a direct connection As with the global nature of cyberspace itrsquos conceivable that

adversaries cross several nationsrsquo boundaries to conduct cyber attack operations The question

generated is who has jurisdiction

If the actor committing the crime had used an airplane each nation could claim

jurisdiction as the adversary violated their territorial boundaries and violated international law

More often than not the first state would have acted immediately upon the aggressive act and

16

AUACSCSinksAY08

would have prevented aggressors from completing their task by either forcing the aircraft to land

or turnaround or an even more escalated response of firing upon the aircraft In the air land or

sea the ability for a nationrsquos military forces to respond in a timely manner gives way to the

deterrence factor of not crossing a statersquos boundaries without receiving permission for fear of

reprisal A clear example of this was when Turkey denied the United States the ability deploy

the 4th Infantry Division from its borders at the beginning of Operation Iraqi Freedom Violating

Turkeyrsquos borders without permission would have brought about great repercussions that would

have made Operation Iraqi Freedom even more difficult and could have resulted in an escalation

of the war outside the Iraqi borders43 Another example is when Spain and France denied the

Unites States the use of their airspace when F-111s based in the United Kingdom conducted air

operations in Libya in an effort to eliminate Muammar Khadafy44

However the speeds at which these breeches in territorial boundaries occur make it

difficult for a nation to claim jurisdiction especially when nothing occurred within their

territorial sovereignty The cyber attacks didnrsquot result in any damage to nation as the information

packets passed through their sovereign borders According to territorial boundary description

described by Doctor Boczek the international community doesnrsquot consider the crossing the

border in of itself an act of warmdashserious damage is a driving factor in determining conflict

escalation In addition according to the territorial jurisdiction principle the cyber attack didnrsquot

threaten a nationrsquos security territorial integrity and political independence If the cyber attack or

information originated from within a sovereign territory by a third party then the two nations

would have to work together to resolve the issue and mutual jurisdiction would probably apply

However if the cyber attack didnrsquot physically manifest itself from within their sovereign

territory or the adversary didnrsquot use the nation as a staging area to launch a further attack the

17

AUACSCSinksAY08

international law and the jurisdiction principles would dictate the affected nation would have

jurisdiction

Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security

territorial integrity and political independence Cyberspace utilizes the other domains as a means

of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence

Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of

territorial sovereignty the Protective Security Principle does provide nations the ability to

enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos

sovereignty when it conducts cyber warfare operations However some elites donrsquot consider

cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense

International law specifically article 2 of the United Nations Charters states that a

members shall refrain in their international relations from the threat or use of force against the

territorial integrity or political independence of any state or in any other manner inconsistent

with the purposes of the United Nations which is intended to prohibit all types of force except

those carried out under the aegis of the United Nations or as provided for by the Security

Council45 The only exception to the United Nations Charters as it relates to the Use of Force is

the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed

attack46

International elites have discussed the term ldquouse of forcerdquo in the past because of the

development of chemical and biological weapons and had to move from a kinetic impact based

definition to a results-oriented approach47 Chemical and biological weapons lacked the

characteristic of an explosion or physical force yet these weapons certainly are capable of

destroying life and property Doctor Leigh Armistead a former information warfare instructor at

18

AUACSCSinksAY08

the Joint Forces Staff College cautions that the use of computer network attacks by the military

ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary

that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great

Russia introduced a proposal to the United Nations that banned the use of information

operations Even though the United Nations didnrsquot adopt the law the concern of international

community is fully aware of the impact cyber attacks can have on a nation

The concern over cyber warfare capabilities is that it can generate both non-kinetic and

kinetic effects There has always been the traditional kinetic solution for cyber warfare where a

precision guidance munition destroys a critical information system node Most people assume

computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos

computer system from the safety of onersquos own command and control center but the physical

destruction of a computer system or network by kinetic means also qualifies as cyber warfare

However cyber warfare has also evolved to the point where aggressors can achieve a kinetic

effect without the use of a traditional kinetic weapon A cyber attack on an information system

can shut down a particular node of a power plant causing the system to become inoperative

Even if there wasnrsquot an explosion the attack serves the same purpose

The question raised is do cyber attacks constitute an armed attack Scholars do agree that

some cyber attacks fit comfortably within the United Nations Charter For example a strategic

level cyber attack causing widespread damage and significant casualties would trigger the statersquos

right of self-defense In addition a cyber attack that precluded a conventional attack or a series

of cyber attacks causing significant damage would give a state the right of self-defense49 Few

would dispute that a country has the right under international law to respond with military force

19

AUACSCSinksAY08

if a state destroyed or significantly damaged another nationrsquos economic system for example the

New York or London stock exchanges

However some confusion and state-defined interpretation comes into play when the

frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard

Law School argues that cyber attacks require an expansion of the definition on the ldquouse of

forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot

be prohibited by international law50 International scholars recommend ldquoclearer rules of what

kinds of information warfare actions constitute an armed attackrdquo which drives permissible

responses of self-defense51 For example a state-sponsored cyber attack causes damage to a

victimrsquos factory or power plant however the nation claims the incident is an isolated instance

and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under

the United Nations Charter and the United Nations would consider any response retaliation

which would violate international law52

Another example involves a nation conducting a series of small attacks causing minimal

damage and then ceases Even though the aggressor used force to conduct cyber warfare

operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under

the United Nations Charter This type of attack is analogues to a small band of troops crossing a

border without causing significant damage53 According to the United Nations Charter the

national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders

and respond to the use of force Repelling the small band of troops and reestablishing their

sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration

of war and allies would have to respect the United Nations decision and couldnrsquot intervene The

same is true for the cyber attack A state can employ defensive measure to isolate and defeat the

20

AUACSCSinksAY08

incursion over the electromagnetic spectrum However the United Nations would see further

offensive operations or invasive operations as retaliation Therefore a nation must take the

incident whether it is signs of conventional forces on the ground or traces of cyber warfare

incursions in the electromagnetic spectrum to the United Nations to seek restitution

In both of these situations the international law becomes the target for change not

whether cyber warfare is in violation of international law If the law were to change the

international community would then consider the above situations acts of war even if an

adversary used conventional forces As written today the result of an operation remains the

driving factor in determining if an adversary has violated international law The means by which

an adversary conducts military operations may affect how nations react to the situation but

whether an adversary conducts the operation by means of the air land sea space or cyberspace

doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian

Triggs a public international lawyer and member of the Attorney General International Legal

Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over

offences abroad having an intended and substantial effect within a state may be justifiedrdquo54

Therefore the international community must evaluate the effect of a criminal act rather than the

means in which the act was committed

Others claim that because the Internet takes advantages of legal norms where non-state

actors can ignore Western notions of law55 more international laws are needed for cyberspace

However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using

other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the

Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked

aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts

21

AUACSCSinksAY08

against a staterdquo in the cyberspace domain The anonymity of the Internet and their total

disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and

national laws already exist in most countries that prohibit the use of the Internet for terrorist

activities therefore additional international laws wouldnrsquot prevent or deter terrorist from

committing such acts of aggression

International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed

Conflict includes the Martens Clause which extends established custom and humanitarian

principles to new technologies and addresses the ever-changing nature of warfare The

international community designed The Martens Clause ldquoto prevent future unnecessary andor

disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges

crimes by invoking the laws of humanity and public conscience hence their effects and not its

methods

The basic legal premise behind Law of Armed Conflict is that attacks must be limited to

military objectives and collateral damage must be proportionate to military advantages and

forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary

suffering but military commanders and planners need to be aware of the results a particular

action will invoke Russian leadership believes a computer network attack against their

homeland can be a means for executing a variety of escalating responses to include nuclear

attack58 Therefore it is imperative military commanders understand the impact any weapon

system can have on an adversary not just cyber attacks

Not all scholars agree that international law is insufficient to govern cyber warfare

Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace

and the Use of Force states that computer network attacks constitute an unlawful use of force in

22

AUACSCSinksAY08

cyberspace under traditional international law Sharp declared that an armed attack may occur

ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a

way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive

definition of cyber attacks may never be drafted59 The Congressional Research Service also

concluded that ldquothere is little likelihood that the international community will soon generate a

coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations

on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos

conclusion is that the effects of cyber warfare operations are the same as if an adversary

conducted conventional warfare operations where the effect of the attacks are the driving factors

in determining whether an adversary used force or not

The United States Government agrees with Sharprsquos conclusion The offensive

Information Operation strategy for the United States government as described by Doctor

Armistead ties the tools used to conduct military operations back to the desired effect which is

in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning

effects-based operations and operational art focus the Joint Force Commanderrsquos course of action

towards meeting objectives outlined in guidance provided by the National Command Authority

and senior military leadership62 Whether the tools are dropped pamphlets invasive network

attacks or bombs on targets the goal is to produce a desired effect to achieve the overall

objectives and cyber warfare can produce effects that challenge the national security of a nation

Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63

~General T Michael Moseley USAF

23

AUACSCSinksAY08

The cyberspace domain has been around for quite sometime but as technology continues

to advance businesses as well as governmental organizations are becoming more reliant on the

cyberspace domain With that reliance the protection of this critical domain becomes even more

important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the

electromagnetic spectrum by denying and disrupting information demands Scholars claim that

protection needs to include addressing existing international laws expanding them to incorporate

the ever-advancing capabilities emerging in the cyberspace domain

However territorial sovereignty of a nation and the principles of jurisdiction specifically

the Protective Security Principle give nations the right to exercise jurisdiction when an

aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64

While cyberspace is a domain requiring specific attention it relies on assets in the other domains

of land space sea and air in order to operate and international laws for the linear domains do

exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace

but during cyber warfare operations the principles behind the restrictions of foreign military

entering airspace do apply The strategic nature of cyber warfare operations correspond to the

same strategic impact that airpower can inflict upon a nation threatening their independence

While maybe not as dramatic as kinetic effects the results can be just as devastating

Space is relatively straightforward Since a nation canrsquot claim space and over flights of

foreign satellites over a nation is permissible nations must use space for peaceful purposes

Kinetic attacks against space assets are a violation of international law therefore nations would

consider cyber warfare operations against space assets as other than peaceful purposes and a

violation of international law Cyber attacks traversing space assets relate to current military

operations where the military uses space assets to conduct kinetic operations Since international

24

AUACSCSinksAY08

elites havenrsquot considered these kinetic operations as a breach of international law military

commanders can conduct cyber warfare operations through space without fear of violating

international laws for outer space

Crossing international borders without a nationrsquos permission and threatening their

sovereignty is a violation of international law While nations canrsquot consider all border crossings

as an act of war those acts of aggression that threaten the territorial integrity would elicit a

defensive response by the victim nation Whether incursions involve combat vehicles over a

highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are

threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not

have set foot in the nation but according the Protective Security Principle the victim nation has

jurisdiction

Conducting cyber warfare operations from the territorial sea is no different from

conducting operations from within a nationrsquos land or sea borders However the high seas are

very similar in nature to space in that they are reserved for peaceful purposes Therefore

conducting any means of warfare from within the high seas is a violation of international law

and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-

defense

According to Barkham ldquoinformation warfare attacks are in essence territorial

penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then

subject to the jurisdiction of the victim nation who then has the right for self-defense However

due to the global nature of cyberspace aggressors can cross multiple borders and determining

who has jurisdiction demands cooperation among nations The origin and any deliberate staging

locations of the cyber attack will drive who has jurisdiction The crossing of third party borders

25

AUACSCSinksAY08

by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the

aggressors threaten a nationrsquos independence or territorial integrity

Scholars consider cyber warfare operations that involve strategic and operational impacts

as being a means of using force and fall within the legal regime of existing international law

However scholars argue that because cyber warfare includes kinetic and non-kinetic results the

Use of Force definition needs expanding Yet they conclude that an exhaustive definition of

cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare

operations against existing case studies where the effects are evaluated as opposed to the means

even if the operations originated from outside the nationrsquos territorial jurisdiction There is some

authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to

have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade

non-state actors from conducting cyber warfare operations given their willingness to ignore

Western notions of war and their ability to conduct operations anonymously in cyberspace

International laws are in place to that address the ever-changing nature of warfare The

Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a

framework for addressing all warfare to include cyber warfare operations The international

community will need to measure the effects of an operation rather the means Whether its boots

on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a

nationrsquos response

26

AUACSCSinksAY08

End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)

27

AUACSCSinksAY08

44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

28

AUACSCSinksAY08

Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005

Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department

American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)

Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983

Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988

Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)

Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)

IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)

Joint Publication 3-13 Information Operations 13 February 2006

Joint Publication 5-0 Joint Operations Planning 26 December 2006

Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies

Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc

Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College

Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)

Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press

29

AUACSCSinksAY08

Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI

Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)

Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press

Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company

Detter Delupis I The law of war (2000) New York NY Cambridge University Press

Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)

Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College

Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor

Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)

Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)

Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf

Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)

Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College

Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College

Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)

Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA

30

AUACSCSinksAY08

Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)

Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)

Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College

Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology

Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College

Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)

OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center

OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College

OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications

Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991

Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College

Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center

Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)

31

AUACSCSinksAY08

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press

Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA

Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University

Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor

Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661

Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office

Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis

United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC

United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center

Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College

Wesley David C The Military Commander and the Law 2006

32

Page 14: Sinks 0407

AUACSCSinksAY08

Space Outer space as defined by Doctor Boczek ldquois the space beyond the air surrounding the

earthrdquo As of 2005 international law doesnrsquot define a demarcation between airspace and outer

space but ldquostates agree that state sovereignty doesnrsquot extend without any limitsrdquo25 Proposals of

where airspace ends and when outer space begins are base on various scientific and technological

criteria (gravitational pull capabilities of air breathing aircraft etc26) Others scientists argue

that defining a boundary between airspace and outer space isnrsquot necessary as it would hinder the

progress of space technology and the legal status would depend on the nature of the activity

While no boundary exists airspace is finite and activity in outer space follows four

fundamentals principles First over flights of foreign satellites over a nation is permissible as

airspace doesnrsquot extend forever Second space ldquointernational law applies to outer space and

celestial bodiesrdquo Third according to the Outer Space Treaty of 1967 states canrsquot claim celestial

bodies or outer space which are not subject to national appropriation therefore are free for use

by all states Finally states must use outer space exclusively for peaceful purposes with specific

bans on weapons of mass destruction However states can use space for other military purposes

like intelligence surveillance and reconnaissance activities 27

Are these international laws and principles applicable to cyberspace Satellites are

certainly an integral part of the space domain Operators control satellites by using the

cyberspace domain and information passes between satellites and ground stations One can

argue that space is a sub-set of the cyberspace domain with satellites serving as computers in

space Global positioning system devices in vehicles interact with satellites all through an

elaborate network as part of the electromagnetic spectrum known as cyberspace Therefore

cyberspace is in space with millions of people using cyberspace everyday

10

AUACSCSinksAY08

The military uses space assets for intelligence surveillance and reconnaissance

knowledge management and command and control Agencies like the National Reconnaissance

Office and National Geospatial-Intelligence Agency obtain high-altitude imagery using a variety

of capabilities to include heat signature resonation Satellites can detect missile launches which

provide vital military information to senior leaders tasked with the security of their nation The

military networks to include decision briefs tasks and emails in Iraq and the Predator feeds in

Afghanistan travel through military and commercial satellites with all the information flowing

through the cyberspace domain With the heavy reliance of cyberspace to operate space assets

and the demands of information flowing through space by businesses it should come as no

surprise that space is a vital component for day-to-day operations of the military

Since cyberspace is an inherent component for space operations it is logical to assume

international law for outer space is applicable to cyberspace as long as an aggressor doesnt

violate the four premises and as long as weapons of mass destruction arenrsquot ldquostationed in outer

spacerdquo 28 Therefore a state would consider a cyber attack against a satellite as other than for

peaceful purposes and according to the fourth premise international law would apply

However what about a cyber attack using satellites as a means of conducting operations

Under todayrsquos current operations international elites havenrsquot considered a cyber attack passing

through space as a violation of international law When a senior leader in Qatar approves a

target set that is executed by a pilot in Nevada by an aircraft in Afghanistan all this information

is transmitted by cyberspace through space The result is that an aircraft renders an air or ground

target inoperable The effect is the same for cyberspace The information flows through space

by way of the cyberspace domain and the result is that an operator has rendered a target

11

AUACSCSinksAY08

inoperable As with airspace the information isnrsquot the cause of the damage but what an operator

does with the information is what constitutes the cyber attack

Land Cyber attacks using resources over land is relatively straightforward International

boundaries are defined as ldquoimaginary lines which separate territorial sovereigntyrdquo 29 which are

mutually agreed upon via international treaties Crossing an international border without

permission from the state is a violation of international law While an illegal immigrant crossing

a border to seek an opportunity to provide for his family is a violation of national law the United

Nation considers a nation-sponsored invasion of another nation that threatens the security and

stability of a nation as a breach in international law and an act of war

However international law doesnrsquot consider all border crossings as an act of war For

example when Nicaraguan troops and arms allegedly crossed the borders of El Salvador the

United Nations determined that incursions didnrsquot threaten El Salvadorrsquos territorial integrity and

stated that neither ldquothese incursions nor the alleged supply of arms may be relied upon as

justifying the exercise of the right of collective self-defenserdquo30 The victim state can repelled the

aggressive act but the United Nations Council wouldnrsquot condone any further military action

taken against the adversary opting for diplomatic or economic solution instead

Does international law apply when an adversary crosses international borders using

cyberspace as the means for conducting warfare operations When an adversarial state crosses a

statersquos boundaries using roads or bridges that connect the two nations the road is the resource

spanning the two nations If the adversary doesnrsquot do anything then returns to their sovereign

borders the aggressor hasnrsquot violated international law However when the adversary uses

weapon systems to affect serious damage the adversary has broken international law and a

12

AUACSCSinksAY08

nation may invoke their right for self-defense and may conduct full-scale operations to neutralize

the threat

A parallel notion is when an adversary uses a copper or fiber optic connection that spans

between two nations The adversary uses the land-based LAN connection as a means for

conducting cyber warfare operations The adversary may cross the borders using cyberspace yet

do nothing The affected state may push the adversary back to its borders but no further actions

are deemed appropriate However once the adversary uses the information transmitted over

cyberspace to cause severe operational or strategic damage the affected state now has the right

of self-defense Cyberspace is the means like the road or bridge for which the adversary

delivered the weapon The affected nation will consider the execution of the adversaryrsquos

information packet or weapon system as an act of aggression and the effect caused by the

weapon is what breeches international law

The difference between these two scenarios is that the adversary using the

electromagnetic spectrum hasnrsquot physically invaded a nationrsquos sovereign borders However

their digital presence crossed sovereign borders and as latter discussed in the paper adversaries

committing an act aggression against a state are now under the jurisdiction of the affected state

Sea ldquoThe territorial sea is a belt of sea adjacent to the (statersquos) coasthellipto include the airspace

aboverdquo as well as the seabed and subsoil31 The territorial sea is subject to the right of innocent

passage by foreign shops giving states the right to transport goods and passengers between ports

All of which is subject to the full sovereignty of the state which according to the United Nations

Convention on the Law of the Sea in 1982 and agreed upon by the majority of its membership in

1982 extends 12 miles from the coast32 The jurisdiction includes crimes where the

consequences extend to the coastal state and disturbs the peace of the country33 A cyber attack

13

AUACSCSinksAY08

conducted within the territorial sea of a nation would be no different from a cyber attack

conducted from within the nationrsquos land borders therefore cyber attacks against a state or even

another state conducted within the territorial seas are subject to current international laws Cyber

attacks originating outside the statersquos sovereign borders but results in affecting a statersquos

resources in their territorial seas would fall under the land and airspace breeches of territorial

sovereignty and would be subject to international law

The high seas on the other hand arenrsquot subject to the sovereignty of any one state The

high seas extend beyond the territorial sea and include the airspace the seabed and the subsoil34

and all states have the right to exercise freedoms on the high seas35 As similarly defined in

space ldquothe high seas shall be reserved for peaceful purposesrdquo as stated by Article 88 of the Law

of the Seas Cooperative36 which is defined as refraining from any threat or use of force (outside

of wartime conflicts)

The very nature of a cyber attack in the high seas lends itself to be a violation of

international law as nations are restricted to conducting peaceful operations in the high seas

The question is whom has jurisdiction of crimes committed in the high seas By applying the

Protective Security Principle of Jurisdiction where an actor threatens a statersquo security and

introducing the United Nationrsquos definition on the Illegal Use of Force extends to the high seas

and for that matter space giving states the right for self-defense as defined by the United Nations

as ldquoan armed attackrdquo The sheer name of cyber attack doesnrsquot immediately lend itself to an

ldquoarmedrdquo cyber attack However the effects generated from a cyber attack can be equivalent to a

traditional conventional attack and the international law would permit a state to take appropriate

countermeasures while notifying the United Nations Security Council37

14

AUACSCSinksAY08

Applying International Law to Cyber Warfare Today we live in an Information Age where communication through cyberspace has forever changed and flattened out worldhellipOur adversaries seek to operate from behind technical legal and international screens as they execute their costly attacks38

~General James E Cartwright Commander United States Strategic Command

Jurisdiction

Understanding the territorial sovereignty principles of a nation is important in applying

cyberspace and cyber warfare to existing international laws While some of these principles and

international laws may not be relevant for the cyberspace domain due to the far-reaching

capability of cyber warfare the jurisdiction of a nation further defines its ability to respond to

aggressive acts by nations in the cyberspace domain There are three jurisdictional principles

that provide nations the right to pursue aggressors that threaten a nationrsquos independence the

Territorial Principle Nationality Principle and the Protective Security Principle

For actions originating within the state the jurisdiction clearly falls within the territorial

principle where a ldquostate has jurisdiction over all crimes committed in its territoryhellipto include

airspace international waters and territorial seasrdquo39 The territorial jurisdiction is subject to

exceptions when dealing with persons from foreign states as in the most popular example of

immunity given to foreign diplomats In this case ldquostates may exercise jurisdiction over its

citizenhellipeven if they are physically outside the statesrsquo territoryrdquo as Doctor Boczek defines as the

Nationality Principle Nations usually agree upon on these concessions states prior to the offense

being committed40

Doctor Boczek defines the Protective Security Principle as a ldquojurisdictional principle

whereby a state my assume jurisdiction over and punish foreign nationals for certain conduct

outside its territory which is directed against its security territorial integrity and political

independencerdquo41 Some states would argue that criticism of a state or government is applicable

15

AUACSCSinksAY08

in applying this principle of jurisdiction However this is too broad of an interpretation and

should be confined to acts that are more tangible in nature like falsification of a statesrsquo official

documents conspiracy to violate immigration of custom laws and illicit drug trafficking42

Would a cyber attack that is deemed to challenge a nationrsquos banking community or bring

down a power source be a direct attack against its security and political independence The

international community easily sees the attack of a power source with kinetic weapons as a

violation of a territorial boundary and a breech of international law The United States viewed

the attack on the Trade Towers as an act of war launching the Global War on Terrorism Would

the United States have viewed the same devastation as if the attack occurred through cyberspace

Would the attack have been less of an act of war if the aggressor remotely controlled domestic

airliners from a foreign country Probably not What happens if the cyber attack caused a fire in

the lower floors of the buildings preventing people from escaping While less dramatic than an

airbus flying into the middle of the towers and maybe more difficult to demonize the crime the

result is the samemdashinnocent people suffering as a result of an adversary trying to threaten a

nationrsquos security

What happens if the suspected cyber attack has violated a nationrsquos territorial boundary in

order to attack a neighboring country or an ally Going from point A to point B in cyberspace is

rarely a direct connection As with the global nature of cyberspace itrsquos conceivable that

adversaries cross several nationsrsquo boundaries to conduct cyber attack operations The question

generated is who has jurisdiction

If the actor committing the crime had used an airplane each nation could claim

jurisdiction as the adversary violated their territorial boundaries and violated international law

More often than not the first state would have acted immediately upon the aggressive act and

16

AUACSCSinksAY08

would have prevented aggressors from completing their task by either forcing the aircraft to land

or turnaround or an even more escalated response of firing upon the aircraft In the air land or

sea the ability for a nationrsquos military forces to respond in a timely manner gives way to the

deterrence factor of not crossing a statersquos boundaries without receiving permission for fear of

reprisal A clear example of this was when Turkey denied the United States the ability deploy

the 4th Infantry Division from its borders at the beginning of Operation Iraqi Freedom Violating

Turkeyrsquos borders without permission would have brought about great repercussions that would

have made Operation Iraqi Freedom even more difficult and could have resulted in an escalation

of the war outside the Iraqi borders43 Another example is when Spain and France denied the

Unites States the use of their airspace when F-111s based in the United Kingdom conducted air

operations in Libya in an effort to eliminate Muammar Khadafy44

However the speeds at which these breeches in territorial boundaries occur make it

difficult for a nation to claim jurisdiction especially when nothing occurred within their

territorial sovereignty The cyber attacks didnrsquot result in any damage to nation as the information

packets passed through their sovereign borders According to territorial boundary description

described by Doctor Boczek the international community doesnrsquot consider the crossing the

border in of itself an act of warmdashserious damage is a driving factor in determining conflict

escalation In addition according to the territorial jurisdiction principle the cyber attack didnrsquot

threaten a nationrsquos security territorial integrity and political independence If the cyber attack or

information originated from within a sovereign territory by a third party then the two nations

would have to work together to resolve the issue and mutual jurisdiction would probably apply

However if the cyber attack didnrsquot physically manifest itself from within their sovereign

territory or the adversary didnrsquot use the nation as a staging area to launch a further attack the

17

AUACSCSinksAY08

international law and the jurisdiction principles would dictate the affected nation would have

jurisdiction

Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security

territorial integrity and political independence Cyberspace utilizes the other domains as a means

of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence

Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of

territorial sovereignty the Protective Security Principle does provide nations the ability to

enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos

sovereignty when it conducts cyber warfare operations However some elites donrsquot consider

cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense

International law specifically article 2 of the United Nations Charters states that a

members shall refrain in their international relations from the threat or use of force against the

territorial integrity or political independence of any state or in any other manner inconsistent

with the purposes of the United Nations which is intended to prohibit all types of force except

those carried out under the aegis of the United Nations or as provided for by the Security

Council45 The only exception to the United Nations Charters as it relates to the Use of Force is

the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed

attack46

International elites have discussed the term ldquouse of forcerdquo in the past because of the

development of chemical and biological weapons and had to move from a kinetic impact based

definition to a results-oriented approach47 Chemical and biological weapons lacked the

characteristic of an explosion or physical force yet these weapons certainly are capable of

destroying life and property Doctor Leigh Armistead a former information warfare instructor at

18

AUACSCSinksAY08

the Joint Forces Staff College cautions that the use of computer network attacks by the military

ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary

that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great

Russia introduced a proposal to the United Nations that banned the use of information

operations Even though the United Nations didnrsquot adopt the law the concern of international

community is fully aware of the impact cyber attacks can have on a nation

The concern over cyber warfare capabilities is that it can generate both non-kinetic and

kinetic effects There has always been the traditional kinetic solution for cyber warfare where a

precision guidance munition destroys a critical information system node Most people assume

computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos

computer system from the safety of onersquos own command and control center but the physical

destruction of a computer system or network by kinetic means also qualifies as cyber warfare

However cyber warfare has also evolved to the point where aggressors can achieve a kinetic

effect without the use of a traditional kinetic weapon A cyber attack on an information system

can shut down a particular node of a power plant causing the system to become inoperative

Even if there wasnrsquot an explosion the attack serves the same purpose

The question raised is do cyber attacks constitute an armed attack Scholars do agree that

some cyber attacks fit comfortably within the United Nations Charter For example a strategic

level cyber attack causing widespread damage and significant casualties would trigger the statersquos

right of self-defense In addition a cyber attack that precluded a conventional attack or a series

of cyber attacks causing significant damage would give a state the right of self-defense49 Few

would dispute that a country has the right under international law to respond with military force

19

AUACSCSinksAY08

if a state destroyed or significantly damaged another nationrsquos economic system for example the

New York or London stock exchanges

However some confusion and state-defined interpretation comes into play when the

frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard

Law School argues that cyber attacks require an expansion of the definition on the ldquouse of

forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot

be prohibited by international law50 International scholars recommend ldquoclearer rules of what

kinds of information warfare actions constitute an armed attackrdquo which drives permissible

responses of self-defense51 For example a state-sponsored cyber attack causes damage to a

victimrsquos factory or power plant however the nation claims the incident is an isolated instance

and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under

the United Nations Charter and the United Nations would consider any response retaliation

which would violate international law52

Another example involves a nation conducting a series of small attacks causing minimal

damage and then ceases Even though the aggressor used force to conduct cyber warfare

operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under

the United Nations Charter This type of attack is analogues to a small band of troops crossing a

border without causing significant damage53 According to the United Nations Charter the

national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders

and respond to the use of force Repelling the small band of troops and reestablishing their

sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration

of war and allies would have to respect the United Nations decision and couldnrsquot intervene The

same is true for the cyber attack A state can employ defensive measure to isolate and defeat the

20

AUACSCSinksAY08

incursion over the electromagnetic spectrum However the United Nations would see further

offensive operations or invasive operations as retaliation Therefore a nation must take the

incident whether it is signs of conventional forces on the ground or traces of cyber warfare

incursions in the electromagnetic spectrum to the United Nations to seek restitution

In both of these situations the international law becomes the target for change not

whether cyber warfare is in violation of international law If the law were to change the

international community would then consider the above situations acts of war even if an

adversary used conventional forces As written today the result of an operation remains the

driving factor in determining if an adversary has violated international law The means by which

an adversary conducts military operations may affect how nations react to the situation but

whether an adversary conducts the operation by means of the air land sea space or cyberspace

doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian

Triggs a public international lawyer and member of the Attorney General International Legal

Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over

offences abroad having an intended and substantial effect within a state may be justifiedrdquo54

Therefore the international community must evaluate the effect of a criminal act rather than the

means in which the act was committed

Others claim that because the Internet takes advantages of legal norms where non-state

actors can ignore Western notions of law55 more international laws are needed for cyberspace

However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using

other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the

Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked

aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts

21

AUACSCSinksAY08

against a staterdquo in the cyberspace domain The anonymity of the Internet and their total

disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and

national laws already exist in most countries that prohibit the use of the Internet for terrorist

activities therefore additional international laws wouldnrsquot prevent or deter terrorist from

committing such acts of aggression

International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed

Conflict includes the Martens Clause which extends established custom and humanitarian

principles to new technologies and addresses the ever-changing nature of warfare The

international community designed The Martens Clause ldquoto prevent future unnecessary andor

disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges

crimes by invoking the laws of humanity and public conscience hence their effects and not its

methods

The basic legal premise behind Law of Armed Conflict is that attacks must be limited to

military objectives and collateral damage must be proportionate to military advantages and

forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary

suffering but military commanders and planners need to be aware of the results a particular

action will invoke Russian leadership believes a computer network attack against their

homeland can be a means for executing a variety of escalating responses to include nuclear

attack58 Therefore it is imperative military commanders understand the impact any weapon

system can have on an adversary not just cyber attacks

Not all scholars agree that international law is insufficient to govern cyber warfare

Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace

and the Use of Force states that computer network attacks constitute an unlawful use of force in

22

AUACSCSinksAY08

cyberspace under traditional international law Sharp declared that an armed attack may occur

ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a

way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive

definition of cyber attacks may never be drafted59 The Congressional Research Service also

concluded that ldquothere is little likelihood that the international community will soon generate a

coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations

on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos

conclusion is that the effects of cyber warfare operations are the same as if an adversary

conducted conventional warfare operations where the effect of the attacks are the driving factors

in determining whether an adversary used force or not

The United States Government agrees with Sharprsquos conclusion The offensive

Information Operation strategy for the United States government as described by Doctor

Armistead ties the tools used to conduct military operations back to the desired effect which is

in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning

effects-based operations and operational art focus the Joint Force Commanderrsquos course of action

towards meeting objectives outlined in guidance provided by the National Command Authority

and senior military leadership62 Whether the tools are dropped pamphlets invasive network

attacks or bombs on targets the goal is to produce a desired effect to achieve the overall

objectives and cyber warfare can produce effects that challenge the national security of a nation

Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63

~General T Michael Moseley USAF

23

AUACSCSinksAY08

The cyberspace domain has been around for quite sometime but as technology continues

to advance businesses as well as governmental organizations are becoming more reliant on the

cyberspace domain With that reliance the protection of this critical domain becomes even more

important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the

electromagnetic spectrum by denying and disrupting information demands Scholars claim that

protection needs to include addressing existing international laws expanding them to incorporate

the ever-advancing capabilities emerging in the cyberspace domain

However territorial sovereignty of a nation and the principles of jurisdiction specifically

the Protective Security Principle give nations the right to exercise jurisdiction when an

aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64

While cyberspace is a domain requiring specific attention it relies on assets in the other domains

of land space sea and air in order to operate and international laws for the linear domains do

exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace

but during cyber warfare operations the principles behind the restrictions of foreign military

entering airspace do apply The strategic nature of cyber warfare operations correspond to the

same strategic impact that airpower can inflict upon a nation threatening their independence

While maybe not as dramatic as kinetic effects the results can be just as devastating

Space is relatively straightforward Since a nation canrsquot claim space and over flights of

foreign satellites over a nation is permissible nations must use space for peaceful purposes

Kinetic attacks against space assets are a violation of international law therefore nations would

consider cyber warfare operations against space assets as other than peaceful purposes and a

violation of international law Cyber attacks traversing space assets relate to current military

operations where the military uses space assets to conduct kinetic operations Since international

24

AUACSCSinksAY08

elites havenrsquot considered these kinetic operations as a breach of international law military

commanders can conduct cyber warfare operations through space without fear of violating

international laws for outer space

Crossing international borders without a nationrsquos permission and threatening their

sovereignty is a violation of international law While nations canrsquot consider all border crossings

as an act of war those acts of aggression that threaten the territorial integrity would elicit a

defensive response by the victim nation Whether incursions involve combat vehicles over a

highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are

threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not

have set foot in the nation but according the Protective Security Principle the victim nation has

jurisdiction

Conducting cyber warfare operations from the territorial sea is no different from

conducting operations from within a nationrsquos land or sea borders However the high seas are

very similar in nature to space in that they are reserved for peaceful purposes Therefore

conducting any means of warfare from within the high seas is a violation of international law

and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-

defense

According to Barkham ldquoinformation warfare attacks are in essence territorial

penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then

subject to the jurisdiction of the victim nation who then has the right for self-defense However

due to the global nature of cyberspace aggressors can cross multiple borders and determining

who has jurisdiction demands cooperation among nations The origin and any deliberate staging

locations of the cyber attack will drive who has jurisdiction The crossing of third party borders

25

AUACSCSinksAY08

by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the

aggressors threaten a nationrsquos independence or territorial integrity

Scholars consider cyber warfare operations that involve strategic and operational impacts

as being a means of using force and fall within the legal regime of existing international law

However scholars argue that because cyber warfare includes kinetic and non-kinetic results the

Use of Force definition needs expanding Yet they conclude that an exhaustive definition of

cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare

operations against existing case studies where the effects are evaluated as opposed to the means

even if the operations originated from outside the nationrsquos territorial jurisdiction There is some

authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to

have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade

non-state actors from conducting cyber warfare operations given their willingness to ignore

Western notions of war and their ability to conduct operations anonymously in cyberspace

International laws are in place to that address the ever-changing nature of warfare The

Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a

framework for addressing all warfare to include cyber warfare operations The international

community will need to measure the effects of an operation rather the means Whether its boots

on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a

nationrsquos response

26

AUACSCSinksAY08

End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)

27

AUACSCSinksAY08

44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

28

AUACSCSinksAY08

Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005

Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department

American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)

Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983

Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988

Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)

Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)

IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)

Joint Publication 3-13 Information Operations 13 February 2006

Joint Publication 5-0 Joint Operations Planning 26 December 2006

Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies

Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc

Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College

Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)

Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press

29

AUACSCSinksAY08

Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI

Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)

Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press

Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company

Detter Delupis I The law of war (2000) New York NY Cambridge University Press

Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)

Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College

Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor

Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)

Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)

Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf

Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)

Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College

Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College

Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)

Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA

30

AUACSCSinksAY08

Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)

Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)

Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College

Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology

Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College

Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)

OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center

OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College

OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications

Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991

Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College

Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center

Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)

31

AUACSCSinksAY08

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press

Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA

Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University

Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor

Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661

Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office

Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis

United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC

United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center

Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College

Wesley David C The Military Commander and the Law 2006

32

Page 15: Sinks 0407

AUACSCSinksAY08

The military uses space assets for intelligence surveillance and reconnaissance

knowledge management and command and control Agencies like the National Reconnaissance

Office and National Geospatial-Intelligence Agency obtain high-altitude imagery using a variety

of capabilities to include heat signature resonation Satellites can detect missile launches which

provide vital military information to senior leaders tasked with the security of their nation The

military networks to include decision briefs tasks and emails in Iraq and the Predator feeds in

Afghanistan travel through military and commercial satellites with all the information flowing

through the cyberspace domain With the heavy reliance of cyberspace to operate space assets

and the demands of information flowing through space by businesses it should come as no

surprise that space is a vital component for day-to-day operations of the military

Since cyberspace is an inherent component for space operations it is logical to assume

international law for outer space is applicable to cyberspace as long as an aggressor doesnt

violate the four premises and as long as weapons of mass destruction arenrsquot ldquostationed in outer

spacerdquo 28 Therefore a state would consider a cyber attack against a satellite as other than for

peaceful purposes and according to the fourth premise international law would apply

However what about a cyber attack using satellites as a means of conducting operations

Under todayrsquos current operations international elites havenrsquot considered a cyber attack passing

through space as a violation of international law When a senior leader in Qatar approves a

target set that is executed by a pilot in Nevada by an aircraft in Afghanistan all this information

is transmitted by cyberspace through space The result is that an aircraft renders an air or ground

target inoperable The effect is the same for cyberspace The information flows through space

by way of the cyberspace domain and the result is that an operator has rendered a target

11

AUACSCSinksAY08

inoperable As with airspace the information isnrsquot the cause of the damage but what an operator

does with the information is what constitutes the cyber attack

Land Cyber attacks using resources over land is relatively straightforward International

boundaries are defined as ldquoimaginary lines which separate territorial sovereigntyrdquo 29 which are

mutually agreed upon via international treaties Crossing an international border without

permission from the state is a violation of international law While an illegal immigrant crossing

a border to seek an opportunity to provide for his family is a violation of national law the United

Nation considers a nation-sponsored invasion of another nation that threatens the security and

stability of a nation as a breach in international law and an act of war

However international law doesnrsquot consider all border crossings as an act of war For

example when Nicaraguan troops and arms allegedly crossed the borders of El Salvador the

United Nations determined that incursions didnrsquot threaten El Salvadorrsquos territorial integrity and

stated that neither ldquothese incursions nor the alleged supply of arms may be relied upon as

justifying the exercise of the right of collective self-defenserdquo30 The victim state can repelled the

aggressive act but the United Nations Council wouldnrsquot condone any further military action

taken against the adversary opting for diplomatic or economic solution instead

Does international law apply when an adversary crosses international borders using

cyberspace as the means for conducting warfare operations When an adversarial state crosses a

statersquos boundaries using roads or bridges that connect the two nations the road is the resource

spanning the two nations If the adversary doesnrsquot do anything then returns to their sovereign

borders the aggressor hasnrsquot violated international law However when the adversary uses

weapon systems to affect serious damage the adversary has broken international law and a

12

AUACSCSinksAY08

nation may invoke their right for self-defense and may conduct full-scale operations to neutralize

the threat

A parallel notion is when an adversary uses a copper or fiber optic connection that spans

between two nations The adversary uses the land-based LAN connection as a means for

conducting cyber warfare operations The adversary may cross the borders using cyberspace yet

do nothing The affected state may push the adversary back to its borders but no further actions

are deemed appropriate However once the adversary uses the information transmitted over

cyberspace to cause severe operational or strategic damage the affected state now has the right

of self-defense Cyberspace is the means like the road or bridge for which the adversary

delivered the weapon The affected nation will consider the execution of the adversaryrsquos

information packet or weapon system as an act of aggression and the effect caused by the

weapon is what breeches international law

The difference between these two scenarios is that the adversary using the

electromagnetic spectrum hasnrsquot physically invaded a nationrsquos sovereign borders However

their digital presence crossed sovereign borders and as latter discussed in the paper adversaries

committing an act aggression against a state are now under the jurisdiction of the affected state

Sea ldquoThe territorial sea is a belt of sea adjacent to the (statersquos) coasthellipto include the airspace

aboverdquo as well as the seabed and subsoil31 The territorial sea is subject to the right of innocent

passage by foreign shops giving states the right to transport goods and passengers between ports

All of which is subject to the full sovereignty of the state which according to the United Nations

Convention on the Law of the Sea in 1982 and agreed upon by the majority of its membership in

1982 extends 12 miles from the coast32 The jurisdiction includes crimes where the

consequences extend to the coastal state and disturbs the peace of the country33 A cyber attack

13

AUACSCSinksAY08

conducted within the territorial sea of a nation would be no different from a cyber attack

conducted from within the nationrsquos land borders therefore cyber attacks against a state or even

another state conducted within the territorial seas are subject to current international laws Cyber

attacks originating outside the statersquos sovereign borders but results in affecting a statersquos

resources in their territorial seas would fall under the land and airspace breeches of territorial

sovereignty and would be subject to international law

The high seas on the other hand arenrsquot subject to the sovereignty of any one state The

high seas extend beyond the territorial sea and include the airspace the seabed and the subsoil34

and all states have the right to exercise freedoms on the high seas35 As similarly defined in

space ldquothe high seas shall be reserved for peaceful purposesrdquo as stated by Article 88 of the Law

of the Seas Cooperative36 which is defined as refraining from any threat or use of force (outside

of wartime conflicts)

The very nature of a cyber attack in the high seas lends itself to be a violation of

international law as nations are restricted to conducting peaceful operations in the high seas

The question is whom has jurisdiction of crimes committed in the high seas By applying the

Protective Security Principle of Jurisdiction where an actor threatens a statersquo security and

introducing the United Nationrsquos definition on the Illegal Use of Force extends to the high seas

and for that matter space giving states the right for self-defense as defined by the United Nations

as ldquoan armed attackrdquo The sheer name of cyber attack doesnrsquot immediately lend itself to an

ldquoarmedrdquo cyber attack However the effects generated from a cyber attack can be equivalent to a

traditional conventional attack and the international law would permit a state to take appropriate

countermeasures while notifying the United Nations Security Council37

14

AUACSCSinksAY08

Applying International Law to Cyber Warfare Today we live in an Information Age where communication through cyberspace has forever changed and flattened out worldhellipOur adversaries seek to operate from behind technical legal and international screens as they execute their costly attacks38

~General James E Cartwright Commander United States Strategic Command

Jurisdiction

Understanding the territorial sovereignty principles of a nation is important in applying

cyberspace and cyber warfare to existing international laws While some of these principles and

international laws may not be relevant for the cyberspace domain due to the far-reaching

capability of cyber warfare the jurisdiction of a nation further defines its ability to respond to

aggressive acts by nations in the cyberspace domain There are three jurisdictional principles

that provide nations the right to pursue aggressors that threaten a nationrsquos independence the

Territorial Principle Nationality Principle and the Protective Security Principle

For actions originating within the state the jurisdiction clearly falls within the territorial

principle where a ldquostate has jurisdiction over all crimes committed in its territoryhellipto include

airspace international waters and territorial seasrdquo39 The territorial jurisdiction is subject to

exceptions when dealing with persons from foreign states as in the most popular example of

immunity given to foreign diplomats In this case ldquostates may exercise jurisdiction over its

citizenhellipeven if they are physically outside the statesrsquo territoryrdquo as Doctor Boczek defines as the

Nationality Principle Nations usually agree upon on these concessions states prior to the offense

being committed40

Doctor Boczek defines the Protective Security Principle as a ldquojurisdictional principle

whereby a state my assume jurisdiction over and punish foreign nationals for certain conduct

outside its territory which is directed against its security territorial integrity and political

independencerdquo41 Some states would argue that criticism of a state or government is applicable

15

AUACSCSinksAY08

in applying this principle of jurisdiction However this is too broad of an interpretation and

should be confined to acts that are more tangible in nature like falsification of a statesrsquo official

documents conspiracy to violate immigration of custom laws and illicit drug trafficking42

Would a cyber attack that is deemed to challenge a nationrsquos banking community or bring

down a power source be a direct attack against its security and political independence The

international community easily sees the attack of a power source with kinetic weapons as a

violation of a territorial boundary and a breech of international law The United States viewed

the attack on the Trade Towers as an act of war launching the Global War on Terrorism Would

the United States have viewed the same devastation as if the attack occurred through cyberspace

Would the attack have been less of an act of war if the aggressor remotely controlled domestic

airliners from a foreign country Probably not What happens if the cyber attack caused a fire in

the lower floors of the buildings preventing people from escaping While less dramatic than an

airbus flying into the middle of the towers and maybe more difficult to demonize the crime the

result is the samemdashinnocent people suffering as a result of an adversary trying to threaten a

nationrsquos security

What happens if the suspected cyber attack has violated a nationrsquos territorial boundary in

order to attack a neighboring country or an ally Going from point A to point B in cyberspace is

rarely a direct connection As with the global nature of cyberspace itrsquos conceivable that

adversaries cross several nationsrsquo boundaries to conduct cyber attack operations The question

generated is who has jurisdiction

If the actor committing the crime had used an airplane each nation could claim

jurisdiction as the adversary violated their territorial boundaries and violated international law

More often than not the first state would have acted immediately upon the aggressive act and

16

AUACSCSinksAY08

would have prevented aggressors from completing their task by either forcing the aircraft to land

or turnaround or an even more escalated response of firing upon the aircraft In the air land or

sea the ability for a nationrsquos military forces to respond in a timely manner gives way to the

deterrence factor of not crossing a statersquos boundaries without receiving permission for fear of

reprisal A clear example of this was when Turkey denied the United States the ability deploy

the 4th Infantry Division from its borders at the beginning of Operation Iraqi Freedom Violating

Turkeyrsquos borders without permission would have brought about great repercussions that would

have made Operation Iraqi Freedom even more difficult and could have resulted in an escalation

of the war outside the Iraqi borders43 Another example is when Spain and France denied the

Unites States the use of their airspace when F-111s based in the United Kingdom conducted air

operations in Libya in an effort to eliminate Muammar Khadafy44

However the speeds at which these breeches in territorial boundaries occur make it

difficult for a nation to claim jurisdiction especially when nothing occurred within their

territorial sovereignty The cyber attacks didnrsquot result in any damage to nation as the information

packets passed through their sovereign borders According to territorial boundary description

described by Doctor Boczek the international community doesnrsquot consider the crossing the

border in of itself an act of warmdashserious damage is a driving factor in determining conflict

escalation In addition according to the territorial jurisdiction principle the cyber attack didnrsquot

threaten a nationrsquos security territorial integrity and political independence If the cyber attack or

information originated from within a sovereign territory by a third party then the two nations

would have to work together to resolve the issue and mutual jurisdiction would probably apply

However if the cyber attack didnrsquot physically manifest itself from within their sovereign

territory or the adversary didnrsquot use the nation as a staging area to launch a further attack the

17

AUACSCSinksAY08

international law and the jurisdiction principles would dictate the affected nation would have

jurisdiction

Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security

territorial integrity and political independence Cyberspace utilizes the other domains as a means

of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence

Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of

territorial sovereignty the Protective Security Principle does provide nations the ability to

enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos

sovereignty when it conducts cyber warfare operations However some elites donrsquot consider

cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense

International law specifically article 2 of the United Nations Charters states that a

members shall refrain in their international relations from the threat or use of force against the

territorial integrity or political independence of any state or in any other manner inconsistent

with the purposes of the United Nations which is intended to prohibit all types of force except

those carried out under the aegis of the United Nations or as provided for by the Security

Council45 The only exception to the United Nations Charters as it relates to the Use of Force is

the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed

attack46

International elites have discussed the term ldquouse of forcerdquo in the past because of the

development of chemical and biological weapons and had to move from a kinetic impact based

definition to a results-oriented approach47 Chemical and biological weapons lacked the

characteristic of an explosion or physical force yet these weapons certainly are capable of

destroying life and property Doctor Leigh Armistead a former information warfare instructor at

18

AUACSCSinksAY08

the Joint Forces Staff College cautions that the use of computer network attacks by the military

ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary

that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great

Russia introduced a proposal to the United Nations that banned the use of information

operations Even though the United Nations didnrsquot adopt the law the concern of international

community is fully aware of the impact cyber attacks can have on a nation

The concern over cyber warfare capabilities is that it can generate both non-kinetic and

kinetic effects There has always been the traditional kinetic solution for cyber warfare where a

precision guidance munition destroys a critical information system node Most people assume

computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos

computer system from the safety of onersquos own command and control center but the physical

destruction of a computer system or network by kinetic means also qualifies as cyber warfare

However cyber warfare has also evolved to the point where aggressors can achieve a kinetic

effect without the use of a traditional kinetic weapon A cyber attack on an information system

can shut down a particular node of a power plant causing the system to become inoperative

Even if there wasnrsquot an explosion the attack serves the same purpose

The question raised is do cyber attacks constitute an armed attack Scholars do agree that

some cyber attacks fit comfortably within the United Nations Charter For example a strategic

level cyber attack causing widespread damage and significant casualties would trigger the statersquos

right of self-defense In addition a cyber attack that precluded a conventional attack or a series

of cyber attacks causing significant damage would give a state the right of self-defense49 Few

would dispute that a country has the right under international law to respond with military force

19

AUACSCSinksAY08

if a state destroyed or significantly damaged another nationrsquos economic system for example the

New York or London stock exchanges

However some confusion and state-defined interpretation comes into play when the

frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard

Law School argues that cyber attacks require an expansion of the definition on the ldquouse of

forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot

be prohibited by international law50 International scholars recommend ldquoclearer rules of what

kinds of information warfare actions constitute an armed attackrdquo which drives permissible

responses of self-defense51 For example a state-sponsored cyber attack causes damage to a

victimrsquos factory or power plant however the nation claims the incident is an isolated instance

and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under

the United Nations Charter and the United Nations would consider any response retaliation

which would violate international law52

Another example involves a nation conducting a series of small attacks causing minimal

damage and then ceases Even though the aggressor used force to conduct cyber warfare

operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under

the United Nations Charter This type of attack is analogues to a small band of troops crossing a

border without causing significant damage53 According to the United Nations Charter the

national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders

and respond to the use of force Repelling the small band of troops and reestablishing their

sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration

of war and allies would have to respect the United Nations decision and couldnrsquot intervene The

same is true for the cyber attack A state can employ defensive measure to isolate and defeat the

20

AUACSCSinksAY08

incursion over the electromagnetic spectrum However the United Nations would see further

offensive operations or invasive operations as retaliation Therefore a nation must take the

incident whether it is signs of conventional forces on the ground or traces of cyber warfare

incursions in the electromagnetic spectrum to the United Nations to seek restitution

In both of these situations the international law becomes the target for change not

whether cyber warfare is in violation of international law If the law were to change the

international community would then consider the above situations acts of war even if an

adversary used conventional forces As written today the result of an operation remains the

driving factor in determining if an adversary has violated international law The means by which

an adversary conducts military operations may affect how nations react to the situation but

whether an adversary conducts the operation by means of the air land sea space or cyberspace

doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian

Triggs a public international lawyer and member of the Attorney General International Legal

Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over

offences abroad having an intended and substantial effect within a state may be justifiedrdquo54

Therefore the international community must evaluate the effect of a criminal act rather than the

means in which the act was committed

Others claim that because the Internet takes advantages of legal norms where non-state

actors can ignore Western notions of law55 more international laws are needed for cyberspace

However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using

other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the

Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked

aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts

21

AUACSCSinksAY08

against a staterdquo in the cyberspace domain The anonymity of the Internet and their total

disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and

national laws already exist in most countries that prohibit the use of the Internet for terrorist

activities therefore additional international laws wouldnrsquot prevent or deter terrorist from

committing such acts of aggression

International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed

Conflict includes the Martens Clause which extends established custom and humanitarian

principles to new technologies and addresses the ever-changing nature of warfare The

international community designed The Martens Clause ldquoto prevent future unnecessary andor

disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges

crimes by invoking the laws of humanity and public conscience hence their effects and not its

methods

The basic legal premise behind Law of Armed Conflict is that attacks must be limited to

military objectives and collateral damage must be proportionate to military advantages and

forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary

suffering but military commanders and planners need to be aware of the results a particular

action will invoke Russian leadership believes a computer network attack against their

homeland can be a means for executing a variety of escalating responses to include nuclear

attack58 Therefore it is imperative military commanders understand the impact any weapon

system can have on an adversary not just cyber attacks

Not all scholars agree that international law is insufficient to govern cyber warfare

Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace

and the Use of Force states that computer network attacks constitute an unlawful use of force in

22

AUACSCSinksAY08

cyberspace under traditional international law Sharp declared that an armed attack may occur

ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a

way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive

definition of cyber attacks may never be drafted59 The Congressional Research Service also

concluded that ldquothere is little likelihood that the international community will soon generate a

coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations

on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos

conclusion is that the effects of cyber warfare operations are the same as if an adversary

conducted conventional warfare operations where the effect of the attacks are the driving factors

in determining whether an adversary used force or not

The United States Government agrees with Sharprsquos conclusion The offensive

Information Operation strategy for the United States government as described by Doctor

Armistead ties the tools used to conduct military operations back to the desired effect which is

in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning

effects-based operations and operational art focus the Joint Force Commanderrsquos course of action

towards meeting objectives outlined in guidance provided by the National Command Authority

and senior military leadership62 Whether the tools are dropped pamphlets invasive network

attacks or bombs on targets the goal is to produce a desired effect to achieve the overall

objectives and cyber warfare can produce effects that challenge the national security of a nation

Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63

~General T Michael Moseley USAF

23

AUACSCSinksAY08

The cyberspace domain has been around for quite sometime but as technology continues

to advance businesses as well as governmental organizations are becoming more reliant on the

cyberspace domain With that reliance the protection of this critical domain becomes even more

important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the

electromagnetic spectrum by denying and disrupting information demands Scholars claim that

protection needs to include addressing existing international laws expanding them to incorporate

the ever-advancing capabilities emerging in the cyberspace domain

However territorial sovereignty of a nation and the principles of jurisdiction specifically

the Protective Security Principle give nations the right to exercise jurisdiction when an

aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64

While cyberspace is a domain requiring specific attention it relies on assets in the other domains

of land space sea and air in order to operate and international laws for the linear domains do

exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace

but during cyber warfare operations the principles behind the restrictions of foreign military

entering airspace do apply The strategic nature of cyber warfare operations correspond to the

same strategic impact that airpower can inflict upon a nation threatening their independence

While maybe not as dramatic as kinetic effects the results can be just as devastating

Space is relatively straightforward Since a nation canrsquot claim space and over flights of

foreign satellites over a nation is permissible nations must use space for peaceful purposes

Kinetic attacks against space assets are a violation of international law therefore nations would

consider cyber warfare operations against space assets as other than peaceful purposes and a

violation of international law Cyber attacks traversing space assets relate to current military

operations where the military uses space assets to conduct kinetic operations Since international

24

AUACSCSinksAY08

elites havenrsquot considered these kinetic operations as a breach of international law military

commanders can conduct cyber warfare operations through space without fear of violating

international laws for outer space

Crossing international borders without a nationrsquos permission and threatening their

sovereignty is a violation of international law While nations canrsquot consider all border crossings

as an act of war those acts of aggression that threaten the territorial integrity would elicit a

defensive response by the victim nation Whether incursions involve combat vehicles over a

highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are

threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not

have set foot in the nation but according the Protective Security Principle the victim nation has

jurisdiction

Conducting cyber warfare operations from the territorial sea is no different from

conducting operations from within a nationrsquos land or sea borders However the high seas are

very similar in nature to space in that they are reserved for peaceful purposes Therefore

conducting any means of warfare from within the high seas is a violation of international law

and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-

defense

According to Barkham ldquoinformation warfare attacks are in essence territorial

penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then

subject to the jurisdiction of the victim nation who then has the right for self-defense However

due to the global nature of cyberspace aggressors can cross multiple borders and determining

who has jurisdiction demands cooperation among nations The origin and any deliberate staging

locations of the cyber attack will drive who has jurisdiction The crossing of third party borders

25

AUACSCSinksAY08

by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the

aggressors threaten a nationrsquos independence or territorial integrity

Scholars consider cyber warfare operations that involve strategic and operational impacts

as being a means of using force and fall within the legal regime of existing international law

However scholars argue that because cyber warfare includes kinetic and non-kinetic results the

Use of Force definition needs expanding Yet they conclude that an exhaustive definition of

cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare

operations against existing case studies where the effects are evaluated as opposed to the means

even if the operations originated from outside the nationrsquos territorial jurisdiction There is some

authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to

have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade

non-state actors from conducting cyber warfare operations given their willingness to ignore

Western notions of war and their ability to conduct operations anonymously in cyberspace

International laws are in place to that address the ever-changing nature of warfare The

Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a

framework for addressing all warfare to include cyber warfare operations The international

community will need to measure the effects of an operation rather the means Whether its boots

on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a

nationrsquos response

26

AUACSCSinksAY08

End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)

27

AUACSCSinksAY08

44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

28

AUACSCSinksAY08

Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005

Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department

American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)

Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983

Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988

Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)

Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)

IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)

Joint Publication 3-13 Information Operations 13 February 2006

Joint Publication 5-0 Joint Operations Planning 26 December 2006

Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies

Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc

Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College

Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)

Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press

29

AUACSCSinksAY08

Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI

Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)

Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press

Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company

Detter Delupis I The law of war (2000) New York NY Cambridge University Press

Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)

Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College

Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor

Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)

Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)

Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf

Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)

Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College

Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College

Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)

Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA

30

AUACSCSinksAY08

Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)

Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)

Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College

Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology

Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College

Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)

OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center

OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College

OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications

Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991

Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College

Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center

Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)

31

AUACSCSinksAY08

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press

Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA

Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University

Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor

Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661

Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office

Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis

United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC

United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center

Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College

Wesley David C The Military Commander and the Law 2006

32

Page 16: Sinks 0407

AUACSCSinksAY08

inoperable As with airspace the information isnrsquot the cause of the damage but what an operator

does with the information is what constitutes the cyber attack

Land Cyber attacks using resources over land is relatively straightforward International

boundaries are defined as ldquoimaginary lines which separate territorial sovereigntyrdquo 29 which are

mutually agreed upon via international treaties Crossing an international border without

permission from the state is a violation of international law While an illegal immigrant crossing

a border to seek an opportunity to provide for his family is a violation of national law the United

Nation considers a nation-sponsored invasion of another nation that threatens the security and

stability of a nation as a breach in international law and an act of war

However international law doesnrsquot consider all border crossings as an act of war For

example when Nicaraguan troops and arms allegedly crossed the borders of El Salvador the

United Nations determined that incursions didnrsquot threaten El Salvadorrsquos territorial integrity and

stated that neither ldquothese incursions nor the alleged supply of arms may be relied upon as

justifying the exercise of the right of collective self-defenserdquo30 The victim state can repelled the

aggressive act but the United Nations Council wouldnrsquot condone any further military action

taken against the adversary opting for diplomatic or economic solution instead

Does international law apply when an adversary crosses international borders using

cyberspace as the means for conducting warfare operations When an adversarial state crosses a

statersquos boundaries using roads or bridges that connect the two nations the road is the resource

spanning the two nations If the adversary doesnrsquot do anything then returns to their sovereign

borders the aggressor hasnrsquot violated international law However when the adversary uses

weapon systems to affect serious damage the adversary has broken international law and a

12

AUACSCSinksAY08

nation may invoke their right for self-defense and may conduct full-scale operations to neutralize

the threat

A parallel notion is when an adversary uses a copper or fiber optic connection that spans

between two nations The adversary uses the land-based LAN connection as a means for

conducting cyber warfare operations The adversary may cross the borders using cyberspace yet

do nothing The affected state may push the adversary back to its borders but no further actions

are deemed appropriate However once the adversary uses the information transmitted over

cyberspace to cause severe operational or strategic damage the affected state now has the right

of self-defense Cyberspace is the means like the road or bridge for which the adversary

delivered the weapon The affected nation will consider the execution of the adversaryrsquos

information packet or weapon system as an act of aggression and the effect caused by the

weapon is what breeches international law

The difference between these two scenarios is that the adversary using the

electromagnetic spectrum hasnrsquot physically invaded a nationrsquos sovereign borders However

their digital presence crossed sovereign borders and as latter discussed in the paper adversaries

committing an act aggression against a state are now under the jurisdiction of the affected state

Sea ldquoThe territorial sea is a belt of sea adjacent to the (statersquos) coasthellipto include the airspace

aboverdquo as well as the seabed and subsoil31 The territorial sea is subject to the right of innocent

passage by foreign shops giving states the right to transport goods and passengers between ports

All of which is subject to the full sovereignty of the state which according to the United Nations

Convention on the Law of the Sea in 1982 and agreed upon by the majority of its membership in

1982 extends 12 miles from the coast32 The jurisdiction includes crimes where the

consequences extend to the coastal state and disturbs the peace of the country33 A cyber attack

13

AUACSCSinksAY08

conducted within the territorial sea of a nation would be no different from a cyber attack

conducted from within the nationrsquos land borders therefore cyber attacks against a state or even

another state conducted within the territorial seas are subject to current international laws Cyber

attacks originating outside the statersquos sovereign borders but results in affecting a statersquos

resources in their territorial seas would fall under the land and airspace breeches of territorial

sovereignty and would be subject to international law

The high seas on the other hand arenrsquot subject to the sovereignty of any one state The

high seas extend beyond the territorial sea and include the airspace the seabed and the subsoil34

and all states have the right to exercise freedoms on the high seas35 As similarly defined in

space ldquothe high seas shall be reserved for peaceful purposesrdquo as stated by Article 88 of the Law

of the Seas Cooperative36 which is defined as refraining from any threat or use of force (outside

of wartime conflicts)

The very nature of a cyber attack in the high seas lends itself to be a violation of

international law as nations are restricted to conducting peaceful operations in the high seas

The question is whom has jurisdiction of crimes committed in the high seas By applying the

Protective Security Principle of Jurisdiction where an actor threatens a statersquo security and

introducing the United Nationrsquos definition on the Illegal Use of Force extends to the high seas

and for that matter space giving states the right for self-defense as defined by the United Nations

as ldquoan armed attackrdquo The sheer name of cyber attack doesnrsquot immediately lend itself to an

ldquoarmedrdquo cyber attack However the effects generated from a cyber attack can be equivalent to a

traditional conventional attack and the international law would permit a state to take appropriate

countermeasures while notifying the United Nations Security Council37

14

AUACSCSinksAY08

Applying International Law to Cyber Warfare Today we live in an Information Age where communication through cyberspace has forever changed and flattened out worldhellipOur adversaries seek to operate from behind technical legal and international screens as they execute their costly attacks38

~General James E Cartwright Commander United States Strategic Command

Jurisdiction

Understanding the territorial sovereignty principles of a nation is important in applying

cyberspace and cyber warfare to existing international laws While some of these principles and

international laws may not be relevant for the cyberspace domain due to the far-reaching

capability of cyber warfare the jurisdiction of a nation further defines its ability to respond to

aggressive acts by nations in the cyberspace domain There are three jurisdictional principles

that provide nations the right to pursue aggressors that threaten a nationrsquos independence the

Territorial Principle Nationality Principle and the Protective Security Principle

For actions originating within the state the jurisdiction clearly falls within the territorial

principle where a ldquostate has jurisdiction over all crimes committed in its territoryhellipto include

airspace international waters and territorial seasrdquo39 The territorial jurisdiction is subject to

exceptions when dealing with persons from foreign states as in the most popular example of

immunity given to foreign diplomats In this case ldquostates may exercise jurisdiction over its

citizenhellipeven if they are physically outside the statesrsquo territoryrdquo as Doctor Boczek defines as the

Nationality Principle Nations usually agree upon on these concessions states prior to the offense

being committed40

Doctor Boczek defines the Protective Security Principle as a ldquojurisdictional principle

whereby a state my assume jurisdiction over and punish foreign nationals for certain conduct

outside its territory which is directed against its security territorial integrity and political

independencerdquo41 Some states would argue that criticism of a state or government is applicable

15

AUACSCSinksAY08

in applying this principle of jurisdiction However this is too broad of an interpretation and

should be confined to acts that are more tangible in nature like falsification of a statesrsquo official

documents conspiracy to violate immigration of custom laws and illicit drug trafficking42

Would a cyber attack that is deemed to challenge a nationrsquos banking community or bring

down a power source be a direct attack against its security and political independence The

international community easily sees the attack of a power source with kinetic weapons as a

violation of a territorial boundary and a breech of international law The United States viewed

the attack on the Trade Towers as an act of war launching the Global War on Terrorism Would

the United States have viewed the same devastation as if the attack occurred through cyberspace

Would the attack have been less of an act of war if the aggressor remotely controlled domestic

airliners from a foreign country Probably not What happens if the cyber attack caused a fire in

the lower floors of the buildings preventing people from escaping While less dramatic than an

airbus flying into the middle of the towers and maybe more difficult to demonize the crime the

result is the samemdashinnocent people suffering as a result of an adversary trying to threaten a

nationrsquos security

What happens if the suspected cyber attack has violated a nationrsquos territorial boundary in

order to attack a neighboring country or an ally Going from point A to point B in cyberspace is

rarely a direct connection As with the global nature of cyberspace itrsquos conceivable that

adversaries cross several nationsrsquo boundaries to conduct cyber attack operations The question

generated is who has jurisdiction

If the actor committing the crime had used an airplane each nation could claim

jurisdiction as the adversary violated their territorial boundaries and violated international law

More often than not the first state would have acted immediately upon the aggressive act and

16

AUACSCSinksAY08

would have prevented aggressors from completing their task by either forcing the aircraft to land

or turnaround or an even more escalated response of firing upon the aircraft In the air land or

sea the ability for a nationrsquos military forces to respond in a timely manner gives way to the

deterrence factor of not crossing a statersquos boundaries without receiving permission for fear of

reprisal A clear example of this was when Turkey denied the United States the ability deploy

the 4th Infantry Division from its borders at the beginning of Operation Iraqi Freedom Violating

Turkeyrsquos borders without permission would have brought about great repercussions that would

have made Operation Iraqi Freedom even more difficult and could have resulted in an escalation

of the war outside the Iraqi borders43 Another example is when Spain and France denied the

Unites States the use of their airspace when F-111s based in the United Kingdom conducted air

operations in Libya in an effort to eliminate Muammar Khadafy44

However the speeds at which these breeches in territorial boundaries occur make it

difficult for a nation to claim jurisdiction especially when nothing occurred within their

territorial sovereignty The cyber attacks didnrsquot result in any damage to nation as the information

packets passed through their sovereign borders According to territorial boundary description

described by Doctor Boczek the international community doesnrsquot consider the crossing the

border in of itself an act of warmdashserious damage is a driving factor in determining conflict

escalation In addition according to the territorial jurisdiction principle the cyber attack didnrsquot

threaten a nationrsquos security territorial integrity and political independence If the cyber attack or

information originated from within a sovereign territory by a third party then the two nations

would have to work together to resolve the issue and mutual jurisdiction would probably apply

However if the cyber attack didnrsquot physically manifest itself from within their sovereign

territory or the adversary didnrsquot use the nation as a staging area to launch a further attack the

17

AUACSCSinksAY08

international law and the jurisdiction principles would dictate the affected nation would have

jurisdiction

Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security

territorial integrity and political independence Cyberspace utilizes the other domains as a means

of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence

Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of

territorial sovereignty the Protective Security Principle does provide nations the ability to

enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos

sovereignty when it conducts cyber warfare operations However some elites donrsquot consider

cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense

International law specifically article 2 of the United Nations Charters states that a

members shall refrain in their international relations from the threat or use of force against the

territorial integrity or political independence of any state or in any other manner inconsistent

with the purposes of the United Nations which is intended to prohibit all types of force except

those carried out under the aegis of the United Nations or as provided for by the Security

Council45 The only exception to the United Nations Charters as it relates to the Use of Force is

the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed

attack46

International elites have discussed the term ldquouse of forcerdquo in the past because of the

development of chemical and biological weapons and had to move from a kinetic impact based

definition to a results-oriented approach47 Chemical and biological weapons lacked the

characteristic of an explosion or physical force yet these weapons certainly are capable of

destroying life and property Doctor Leigh Armistead a former information warfare instructor at

18

AUACSCSinksAY08

the Joint Forces Staff College cautions that the use of computer network attacks by the military

ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary

that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great

Russia introduced a proposal to the United Nations that banned the use of information

operations Even though the United Nations didnrsquot adopt the law the concern of international

community is fully aware of the impact cyber attacks can have on a nation

The concern over cyber warfare capabilities is that it can generate both non-kinetic and

kinetic effects There has always been the traditional kinetic solution for cyber warfare where a

precision guidance munition destroys a critical information system node Most people assume

computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos

computer system from the safety of onersquos own command and control center but the physical

destruction of a computer system or network by kinetic means also qualifies as cyber warfare

However cyber warfare has also evolved to the point where aggressors can achieve a kinetic

effect without the use of a traditional kinetic weapon A cyber attack on an information system

can shut down a particular node of a power plant causing the system to become inoperative

Even if there wasnrsquot an explosion the attack serves the same purpose

The question raised is do cyber attacks constitute an armed attack Scholars do agree that

some cyber attacks fit comfortably within the United Nations Charter For example a strategic

level cyber attack causing widespread damage and significant casualties would trigger the statersquos

right of self-defense In addition a cyber attack that precluded a conventional attack or a series

of cyber attacks causing significant damage would give a state the right of self-defense49 Few

would dispute that a country has the right under international law to respond with military force

19

AUACSCSinksAY08

if a state destroyed or significantly damaged another nationrsquos economic system for example the

New York or London stock exchanges

However some confusion and state-defined interpretation comes into play when the

frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard

Law School argues that cyber attacks require an expansion of the definition on the ldquouse of

forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot

be prohibited by international law50 International scholars recommend ldquoclearer rules of what

kinds of information warfare actions constitute an armed attackrdquo which drives permissible

responses of self-defense51 For example a state-sponsored cyber attack causes damage to a

victimrsquos factory or power plant however the nation claims the incident is an isolated instance

and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under

the United Nations Charter and the United Nations would consider any response retaliation

which would violate international law52

Another example involves a nation conducting a series of small attacks causing minimal

damage and then ceases Even though the aggressor used force to conduct cyber warfare

operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under

the United Nations Charter This type of attack is analogues to a small band of troops crossing a

border without causing significant damage53 According to the United Nations Charter the

national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders

and respond to the use of force Repelling the small band of troops and reestablishing their

sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration

of war and allies would have to respect the United Nations decision and couldnrsquot intervene The

same is true for the cyber attack A state can employ defensive measure to isolate and defeat the

20

AUACSCSinksAY08

incursion over the electromagnetic spectrum However the United Nations would see further

offensive operations or invasive operations as retaliation Therefore a nation must take the

incident whether it is signs of conventional forces on the ground or traces of cyber warfare

incursions in the electromagnetic spectrum to the United Nations to seek restitution

In both of these situations the international law becomes the target for change not

whether cyber warfare is in violation of international law If the law were to change the

international community would then consider the above situations acts of war even if an

adversary used conventional forces As written today the result of an operation remains the

driving factor in determining if an adversary has violated international law The means by which

an adversary conducts military operations may affect how nations react to the situation but

whether an adversary conducts the operation by means of the air land sea space or cyberspace

doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian

Triggs a public international lawyer and member of the Attorney General International Legal

Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over

offences abroad having an intended and substantial effect within a state may be justifiedrdquo54

Therefore the international community must evaluate the effect of a criminal act rather than the

means in which the act was committed

Others claim that because the Internet takes advantages of legal norms where non-state

actors can ignore Western notions of law55 more international laws are needed for cyberspace

However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using

other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the

Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked

aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts

21

AUACSCSinksAY08

against a staterdquo in the cyberspace domain The anonymity of the Internet and their total

disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and

national laws already exist in most countries that prohibit the use of the Internet for terrorist

activities therefore additional international laws wouldnrsquot prevent or deter terrorist from

committing such acts of aggression

International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed

Conflict includes the Martens Clause which extends established custom and humanitarian

principles to new technologies and addresses the ever-changing nature of warfare The

international community designed The Martens Clause ldquoto prevent future unnecessary andor

disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges

crimes by invoking the laws of humanity and public conscience hence their effects and not its

methods

The basic legal premise behind Law of Armed Conflict is that attacks must be limited to

military objectives and collateral damage must be proportionate to military advantages and

forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary

suffering but military commanders and planners need to be aware of the results a particular

action will invoke Russian leadership believes a computer network attack against their

homeland can be a means for executing a variety of escalating responses to include nuclear

attack58 Therefore it is imperative military commanders understand the impact any weapon

system can have on an adversary not just cyber attacks

Not all scholars agree that international law is insufficient to govern cyber warfare

Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace

and the Use of Force states that computer network attacks constitute an unlawful use of force in

22

AUACSCSinksAY08

cyberspace under traditional international law Sharp declared that an armed attack may occur

ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a

way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive

definition of cyber attacks may never be drafted59 The Congressional Research Service also

concluded that ldquothere is little likelihood that the international community will soon generate a

coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations

on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos

conclusion is that the effects of cyber warfare operations are the same as if an adversary

conducted conventional warfare operations where the effect of the attacks are the driving factors

in determining whether an adversary used force or not

The United States Government agrees with Sharprsquos conclusion The offensive

Information Operation strategy for the United States government as described by Doctor

Armistead ties the tools used to conduct military operations back to the desired effect which is

in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning

effects-based operations and operational art focus the Joint Force Commanderrsquos course of action

towards meeting objectives outlined in guidance provided by the National Command Authority

and senior military leadership62 Whether the tools are dropped pamphlets invasive network

attacks or bombs on targets the goal is to produce a desired effect to achieve the overall

objectives and cyber warfare can produce effects that challenge the national security of a nation

Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63

~General T Michael Moseley USAF

23

AUACSCSinksAY08

The cyberspace domain has been around for quite sometime but as technology continues

to advance businesses as well as governmental organizations are becoming more reliant on the

cyberspace domain With that reliance the protection of this critical domain becomes even more

important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the

electromagnetic spectrum by denying and disrupting information demands Scholars claim that

protection needs to include addressing existing international laws expanding them to incorporate

the ever-advancing capabilities emerging in the cyberspace domain

However territorial sovereignty of a nation and the principles of jurisdiction specifically

the Protective Security Principle give nations the right to exercise jurisdiction when an

aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64

While cyberspace is a domain requiring specific attention it relies on assets in the other domains

of land space sea and air in order to operate and international laws for the linear domains do

exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace

but during cyber warfare operations the principles behind the restrictions of foreign military

entering airspace do apply The strategic nature of cyber warfare operations correspond to the

same strategic impact that airpower can inflict upon a nation threatening their independence

While maybe not as dramatic as kinetic effects the results can be just as devastating

Space is relatively straightforward Since a nation canrsquot claim space and over flights of

foreign satellites over a nation is permissible nations must use space for peaceful purposes

Kinetic attacks against space assets are a violation of international law therefore nations would

consider cyber warfare operations against space assets as other than peaceful purposes and a

violation of international law Cyber attacks traversing space assets relate to current military

operations where the military uses space assets to conduct kinetic operations Since international

24

AUACSCSinksAY08

elites havenrsquot considered these kinetic operations as a breach of international law military

commanders can conduct cyber warfare operations through space without fear of violating

international laws for outer space

Crossing international borders without a nationrsquos permission and threatening their

sovereignty is a violation of international law While nations canrsquot consider all border crossings

as an act of war those acts of aggression that threaten the territorial integrity would elicit a

defensive response by the victim nation Whether incursions involve combat vehicles over a

highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are

threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not

have set foot in the nation but according the Protective Security Principle the victim nation has

jurisdiction

Conducting cyber warfare operations from the territorial sea is no different from

conducting operations from within a nationrsquos land or sea borders However the high seas are

very similar in nature to space in that they are reserved for peaceful purposes Therefore

conducting any means of warfare from within the high seas is a violation of international law

and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-

defense

According to Barkham ldquoinformation warfare attacks are in essence territorial

penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then

subject to the jurisdiction of the victim nation who then has the right for self-defense However

due to the global nature of cyberspace aggressors can cross multiple borders and determining

who has jurisdiction demands cooperation among nations The origin and any deliberate staging

locations of the cyber attack will drive who has jurisdiction The crossing of third party borders

25

AUACSCSinksAY08

by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the

aggressors threaten a nationrsquos independence or territorial integrity

Scholars consider cyber warfare operations that involve strategic and operational impacts

as being a means of using force and fall within the legal regime of existing international law

However scholars argue that because cyber warfare includes kinetic and non-kinetic results the

Use of Force definition needs expanding Yet they conclude that an exhaustive definition of

cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare

operations against existing case studies where the effects are evaluated as opposed to the means

even if the operations originated from outside the nationrsquos territorial jurisdiction There is some

authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to

have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade

non-state actors from conducting cyber warfare operations given their willingness to ignore

Western notions of war and their ability to conduct operations anonymously in cyberspace

International laws are in place to that address the ever-changing nature of warfare The

Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a

framework for addressing all warfare to include cyber warfare operations The international

community will need to measure the effects of an operation rather the means Whether its boots

on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a

nationrsquos response

26

AUACSCSinksAY08

End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)

27

AUACSCSinksAY08

44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

28

AUACSCSinksAY08

Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005

Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department

American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)

Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983

Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988

Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)

Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)

IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)

Joint Publication 3-13 Information Operations 13 February 2006

Joint Publication 5-0 Joint Operations Planning 26 December 2006

Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies

Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc

Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College

Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)

Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press

29

AUACSCSinksAY08

Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI

Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)

Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press

Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company

Detter Delupis I The law of war (2000) New York NY Cambridge University Press

Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)

Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College

Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor

Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)

Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)

Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf

Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)

Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College

Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College

Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)

Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA

30

AUACSCSinksAY08

Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)

Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)

Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College

Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology

Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College

Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)

OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center

OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College

OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications

Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991

Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College

Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center

Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)

31

AUACSCSinksAY08

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press

Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA

Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University

Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor

Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661

Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office

Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis

United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC

United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center

Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College

Wesley David C The Military Commander and the Law 2006

32

Page 17: Sinks 0407

AUACSCSinksAY08

nation may invoke their right for self-defense and may conduct full-scale operations to neutralize

the threat

A parallel notion is when an adversary uses a copper or fiber optic connection that spans

between two nations The adversary uses the land-based LAN connection as a means for

conducting cyber warfare operations The adversary may cross the borders using cyberspace yet

do nothing The affected state may push the adversary back to its borders but no further actions

are deemed appropriate However once the adversary uses the information transmitted over

cyberspace to cause severe operational or strategic damage the affected state now has the right

of self-defense Cyberspace is the means like the road or bridge for which the adversary

delivered the weapon The affected nation will consider the execution of the adversaryrsquos

information packet or weapon system as an act of aggression and the effect caused by the

weapon is what breeches international law

The difference between these two scenarios is that the adversary using the

electromagnetic spectrum hasnrsquot physically invaded a nationrsquos sovereign borders However

their digital presence crossed sovereign borders and as latter discussed in the paper adversaries

committing an act aggression against a state are now under the jurisdiction of the affected state

Sea ldquoThe territorial sea is a belt of sea adjacent to the (statersquos) coasthellipto include the airspace

aboverdquo as well as the seabed and subsoil31 The territorial sea is subject to the right of innocent

passage by foreign shops giving states the right to transport goods and passengers between ports

All of which is subject to the full sovereignty of the state which according to the United Nations

Convention on the Law of the Sea in 1982 and agreed upon by the majority of its membership in

1982 extends 12 miles from the coast32 The jurisdiction includes crimes where the

consequences extend to the coastal state and disturbs the peace of the country33 A cyber attack

13

AUACSCSinksAY08

conducted within the territorial sea of a nation would be no different from a cyber attack

conducted from within the nationrsquos land borders therefore cyber attacks against a state or even

another state conducted within the territorial seas are subject to current international laws Cyber

attacks originating outside the statersquos sovereign borders but results in affecting a statersquos

resources in their territorial seas would fall under the land and airspace breeches of territorial

sovereignty and would be subject to international law

The high seas on the other hand arenrsquot subject to the sovereignty of any one state The

high seas extend beyond the territorial sea and include the airspace the seabed and the subsoil34

and all states have the right to exercise freedoms on the high seas35 As similarly defined in

space ldquothe high seas shall be reserved for peaceful purposesrdquo as stated by Article 88 of the Law

of the Seas Cooperative36 which is defined as refraining from any threat or use of force (outside

of wartime conflicts)

The very nature of a cyber attack in the high seas lends itself to be a violation of

international law as nations are restricted to conducting peaceful operations in the high seas

The question is whom has jurisdiction of crimes committed in the high seas By applying the

Protective Security Principle of Jurisdiction where an actor threatens a statersquo security and

introducing the United Nationrsquos definition on the Illegal Use of Force extends to the high seas

and for that matter space giving states the right for self-defense as defined by the United Nations

as ldquoan armed attackrdquo The sheer name of cyber attack doesnrsquot immediately lend itself to an

ldquoarmedrdquo cyber attack However the effects generated from a cyber attack can be equivalent to a

traditional conventional attack and the international law would permit a state to take appropriate

countermeasures while notifying the United Nations Security Council37

14

AUACSCSinksAY08

Applying International Law to Cyber Warfare Today we live in an Information Age where communication through cyberspace has forever changed and flattened out worldhellipOur adversaries seek to operate from behind technical legal and international screens as they execute their costly attacks38

~General James E Cartwright Commander United States Strategic Command

Jurisdiction

Understanding the territorial sovereignty principles of a nation is important in applying

cyberspace and cyber warfare to existing international laws While some of these principles and

international laws may not be relevant for the cyberspace domain due to the far-reaching

capability of cyber warfare the jurisdiction of a nation further defines its ability to respond to

aggressive acts by nations in the cyberspace domain There are three jurisdictional principles

that provide nations the right to pursue aggressors that threaten a nationrsquos independence the

Territorial Principle Nationality Principle and the Protective Security Principle

For actions originating within the state the jurisdiction clearly falls within the territorial

principle where a ldquostate has jurisdiction over all crimes committed in its territoryhellipto include

airspace international waters and territorial seasrdquo39 The territorial jurisdiction is subject to

exceptions when dealing with persons from foreign states as in the most popular example of

immunity given to foreign diplomats In this case ldquostates may exercise jurisdiction over its

citizenhellipeven if they are physically outside the statesrsquo territoryrdquo as Doctor Boczek defines as the

Nationality Principle Nations usually agree upon on these concessions states prior to the offense

being committed40

Doctor Boczek defines the Protective Security Principle as a ldquojurisdictional principle

whereby a state my assume jurisdiction over and punish foreign nationals for certain conduct

outside its territory which is directed against its security territorial integrity and political

independencerdquo41 Some states would argue that criticism of a state or government is applicable

15

AUACSCSinksAY08

in applying this principle of jurisdiction However this is too broad of an interpretation and

should be confined to acts that are more tangible in nature like falsification of a statesrsquo official

documents conspiracy to violate immigration of custom laws and illicit drug trafficking42

Would a cyber attack that is deemed to challenge a nationrsquos banking community or bring

down a power source be a direct attack against its security and political independence The

international community easily sees the attack of a power source with kinetic weapons as a

violation of a territorial boundary and a breech of international law The United States viewed

the attack on the Trade Towers as an act of war launching the Global War on Terrorism Would

the United States have viewed the same devastation as if the attack occurred through cyberspace

Would the attack have been less of an act of war if the aggressor remotely controlled domestic

airliners from a foreign country Probably not What happens if the cyber attack caused a fire in

the lower floors of the buildings preventing people from escaping While less dramatic than an

airbus flying into the middle of the towers and maybe more difficult to demonize the crime the

result is the samemdashinnocent people suffering as a result of an adversary trying to threaten a

nationrsquos security

What happens if the suspected cyber attack has violated a nationrsquos territorial boundary in

order to attack a neighboring country or an ally Going from point A to point B in cyberspace is

rarely a direct connection As with the global nature of cyberspace itrsquos conceivable that

adversaries cross several nationsrsquo boundaries to conduct cyber attack operations The question

generated is who has jurisdiction

If the actor committing the crime had used an airplane each nation could claim

jurisdiction as the adversary violated their territorial boundaries and violated international law

More often than not the first state would have acted immediately upon the aggressive act and

16

AUACSCSinksAY08

would have prevented aggressors from completing their task by either forcing the aircraft to land

or turnaround or an even more escalated response of firing upon the aircraft In the air land or

sea the ability for a nationrsquos military forces to respond in a timely manner gives way to the

deterrence factor of not crossing a statersquos boundaries without receiving permission for fear of

reprisal A clear example of this was when Turkey denied the United States the ability deploy

the 4th Infantry Division from its borders at the beginning of Operation Iraqi Freedom Violating

Turkeyrsquos borders without permission would have brought about great repercussions that would

have made Operation Iraqi Freedom even more difficult and could have resulted in an escalation

of the war outside the Iraqi borders43 Another example is when Spain and France denied the

Unites States the use of their airspace when F-111s based in the United Kingdom conducted air

operations in Libya in an effort to eliminate Muammar Khadafy44

However the speeds at which these breeches in territorial boundaries occur make it

difficult for a nation to claim jurisdiction especially when nothing occurred within their

territorial sovereignty The cyber attacks didnrsquot result in any damage to nation as the information

packets passed through their sovereign borders According to territorial boundary description

described by Doctor Boczek the international community doesnrsquot consider the crossing the

border in of itself an act of warmdashserious damage is a driving factor in determining conflict

escalation In addition according to the territorial jurisdiction principle the cyber attack didnrsquot

threaten a nationrsquos security territorial integrity and political independence If the cyber attack or

information originated from within a sovereign territory by a third party then the two nations

would have to work together to resolve the issue and mutual jurisdiction would probably apply

However if the cyber attack didnrsquot physically manifest itself from within their sovereign

territory or the adversary didnrsquot use the nation as a staging area to launch a further attack the

17

AUACSCSinksAY08

international law and the jurisdiction principles would dictate the affected nation would have

jurisdiction

Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security

territorial integrity and political independence Cyberspace utilizes the other domains as a means

of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence

Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of

territorial sovereignty the Protective Security Principle does provide nations the ability to

enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos

sovereignty when it conducts cyber warfare operations However some elites donrsquot consider

cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense

International law specifically article 2 of the United Nations Charters states that a

members shall refrain in their international relations from the threat or use of force against the

territorial integrity or political independence of any state or in any other manner inconsistent

with the purposes of the United Nations which is intended to prohibit all types of force except

those carried out under the aegis of the United Nations or as provided for by the Security

Council45 The only exception to the United Nations Charters as it relates to the Use of Force is

the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed

attack46

International elites have discussed the term ldquouse of forcerdquo in the past because of the

development of chemical and biological weapons and had to move from a kinetic impact based

definition to a results-oriented approach47 Chemical and biological weapons lacked the

characteristic of an explosion or physical force yet these weapons certainly are capable of

destroying life and property Doctor Leigh Armistead a former information warfare instructor at

18

AUACSCSinksAY08

the Joint Forces Staff College cautions that the use of computer network attacks by the military

ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary

that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great

Russia introduced a proposal to the United Nations that banned the use of information

operations Even though the United Nations didnrsquot adopt the law the concern of international

community is fully aware of the impact cyber attacks can have on a nation

The concern over cyber warfare capabilities is that it can generate both non-kinetic and

kinetic effects There has always been the traditional kinetic solution for cyber warfare where a

precision guidance munition destroys a critical information system node Most people assume

computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos

computer system from the safety of onersquos own command and control center but the physical

destruction of a computer system or network by kinetic means also qualifies as cyber warfare

However cyber warfare has also evolved to the point where aggressors can achieve a kinetic

effect without the use of a traditional kinetic weapon A cyber attack on an information system

can shut down a particular node of a power plant causing the system to become inoperative

Even if there wasnrsquot an explosion the attack serves the same purpose

The question raised is do cyber attacks constitute an armed attack Scholars do agree that

some cyber attacks fit comfortably within the United Nations Charter For example a strategic

level cyber attack causing widespread damage and significant casualties would trigger the statersquos

right of self-defense In addition a cyber attack that precluded a conventional attack or a series

of cyber attacks causing significant damage would give a state the right of self-defense49 Few

would dispute that a country has the right under international law to respond with military force

19

AUACSCSinksAY08

if a state destroyed or significantly damaged another nationrsquos economic system for example the

New York or London stock exchanges

However some confusion and state-defined interpretation comes into play when the

frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard

Law School argues that cyber attacks require an expansion of the definition on the ldquouse of

forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot

be prohibited by international law50 International scholars recommend ldquoclearer rules of what

kinds of information warfare actions constitute an armed attackrdquo which drives permissible

responses of self-defense51 For example a state-sponsored cyber attack causes damage to a

victimrsquos factory or power plant however the nation claims the incident is an isolated instance

and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under

the United Nations Charter and the United Nations would consider any response retaliation

which would violate international law52

Another example involves a nation conducting a series of small attacks causing minimal

damage and then ceases Even though the aggressor used force to conduct cyber warfare

operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under

the United Nations Charter This type of attack is analogues to a small band of troops crossing a

border without causing significant damage53 According to the United Nations Charter the

national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders

and respond to the use of force Repelling the small band of troops and reestablishing their

sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration

of war and allies would have to respect the United Nations decision and couldnrsquot intervene The

same is true for the cyber attack A state can employ defensive measure to isolate and defeat the

20

AUACSCSinksAY08

incursion over the electromagnetic spectrum However the United Nations would see further

offensive operations or invasive operations as retaliation Therefore a nation must take the

incident whether it is signs of conventional forces on the ground or traces of cyber warfare

incursions in the electromagnetic spectrum to the United Nations to seek restitution

In both of these situations the international law becomes the target for change not

whether cyber warfare is in violation of international law If the law were to change the

international community would then consider the above situations acts of war even if an

adversary used conventional forces As written today the result of an operation remains the

driving factor in determining if an adversary has violated international law The means by which

an adversary conducts military operations may affect how nations react to the situation but

whether an adversary conducts the operation by means of the air land sea space or cyberspace

doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian

Triggs a public international lawyer and member of the Attorney General International Legal

Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over

offences abroad having an intended and substantial effect within a state may be justifiedrdquo54

Therefore the international community must evaluate the effect of a criminal act rather than the

means in which the act was committed

Others claim that because the Internet takes advantages of legal norms where non-state

actors can ignore Western notions of law55 more international laws are needed for cyberspace

However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using

other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the

Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked

aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts

21

AUACSCSinksAY08

against a staterdquo in the cyberspace domain The anonymity of the Internet and their total

disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and

national laws already exist in most countries that prohibit the use of the Internet for terrorist

activities therefore additional international laws wouldnrsquot prevent or deter terrorist from

committing such acts of aggression

International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed

Conflict includes the Martens Clause which extends established custom and humanitarian

principles to new technologies and addresses the ever-changing nature of warfare The

international community designed The Martens Clause ldquoto prevent future unnecessary andor

disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges

crimes by invoking the laws of humanity and public conscience hence their effects and not its

methods

The basic legal premise behind Law of Armed Conflict is that attacks must be limited to

military objectives and collateral damage must be proportionate to military advantages and

forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary

suffering but military commanders and planners need to be aware of the results a particular

action will invoke Russian leadership believes a computer network attack against their

homeland can be a means for executing a variety of escalating responses to include nuclear

attack58 Therefore it is imperative military commanders understand the impact any weapon

system can have on an adversary not just cyber attacks

Not all scholars agree that international law is insufficient to govern cyber warfare

Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace

and the Use of Force states that computer network attacks constitute an unlawful use of force in

22

AUACSCSinksAY08

cyberspace under traditional international law Sharp declared that an armed attack may occur

ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a

way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive

definition of cyber attacks may never be drafted59 The Congressional Research Service also

concluded that ldquothere is little likelihood that the international community will soon generate a

coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations

on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos

conclusion is that the effects of cyber warfare operations are the same as if an adversary

conducted conventional warfare operations where the effect of the attacks are the driving factors

in determining whether an adversary used force or not

The United States Government agrees with Sharprsquos conclusion The offensive

Information Operation strategy for the United States government as described by Doctor

Armistead ties the tools used to conduct military operations back to the desired effect which is

in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning

effects-based operations and operational art focus the Joint Force Commanderrsquos course of action

towards meeting objectives outlined in guidance provided by the National Command Authority

and senior military leadership62 Whether the tools are dropped pamphlets invasive network

attacks or bombs on targets the goal is to produce a desired effect to achieve the overall

objectives and cyber warfare can produce effects that challenge the national security of a nation

Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63

~General T Michael Moseley USAF

23

AUACSCSinksAY08

The cyberspace domain has been around for quite sometime but as technology continues

to advance businesses as well as governmental organizations are becoming more reliant on the

cyberspace domain With that reliance the protection of this critical domain becomes even more

important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the

electromagnetic spectrum by denying and disrupting information demands Scholars claim that

protection needs to include addressing existing international laws expanding them to incorporate

the ever-advancing capabilities emerging in the cyberspace domain

However territorial sovereignty of a nation and the principles of jurisdiction specifically

the Protective Security Principle give nations the right to exercise jurisdiction when an

aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64

While cyberspace is a domain requiring specific attention it relies on assets in the other domains

of land space sea and air in order to operate and international laws for the linear domains do

exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace

but during cyber warfare operations the principles behind the restrictions of foreign military

entering airspace do apply The strategic nature of cyber warfare operations correspond to the

same strategic impact that airpower can inflict upon a nation threatening their independence

While maybe not as dramatic as kinetic effects the results can be just as devastating

Space is relatively straightforward Since a nation canrsquot claim space and over flights of

foreign satellites over a nation is permissible nations must use space for peaceful purposes

Kinetic attacks against space assets are a violation of international law therefore nations would

consider cyber warfare operations against space assets as other than peaceful purposes and a

violation of international law Cyber attacks traversing space assets relate to current military

operations where the military uses space assets to conduct kinetic operations Since international

24

AUACSCSinksAY08

elites havenrsquot considered these kinetic operations as a breach of international law military

commanders can conduct cyber warfare operations through space without fear of violating

international laws for outer space

Crossing international borders without a nationrsquos permission and threatening their

sovereignty is a violation of international law While nations canrsquot consider all border crossings

as an act of war those acts of aggression that threaten the territorial integrity would elicit a

defensive response by the victim nation Whether incursions involve combat vehicles over a

highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are

threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not

have set foot in the nation but according the Protective Security Principle the victim nation has

jurisdiction

Conducting cyber warfare operations from the territorial sea is no different from

conducting operations from within a nationrsquos land or sea borders However the high seas are

very similar in nature to space in that they are reserved for peaceful purposes Therefore

conducting any means of warfare from within the high seas is a violation of international law

and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-

defense

According to Barkham ldquoinformation warfare attacks are in essence territorial

penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then

subject to the jurisdiction of the victim nation who then has the right for self-defense However

due to the global nature of cyberspace aggressors can cross multiple borders and determining

who has jurisdiction demands cooperation among nations The origin and any deliberate staging

locations of the cyber attack will drive who has jurisdiction The crossing of third party borders

25

AUACSCSinksAY08

by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the

aggressors threaten a nationrsquos independence or territorial integrity

Scholars consider cyber warfare operations that involve strategic and operational impacts

as being a means of using force and fall within the legal regime of existing international law

However scholars argue that because cyber warfare includes kinetic and non-kinetic results the

Use of Force definition needs expanding Yet they conclude that an exhaustive definition of

cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare

operations against existing case studies where the effects are evaluated as opposed to the means

even if the operations originated from outside the nationrsquos territorial jurisdiction There is some

authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to

have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade

non-state actors from conducting cyber warfare operations given their willingness to ignore

Western notions of war and their ability to conduct operations anonymously in cyberspace

International laws are in place to that address the ever-changing nature of warfare The

Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a

framework for addressing all warfare to include cyber warfare operations The international

community will need to measure the effects of an operation rather the means Whether its boots

on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a

nationrsquos response

26

AUACSCSinksAY08

End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)

27

AUACSCSinksAY08

44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

28

AUACSCSinksAY08

Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005

Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department

American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)

Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983

Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988

Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)

Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)

IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)

Joint Publication 3-13 Information Operations 13 February 2006

Joint Publication 5-0 Joint Operations Planning 26 December 2006

Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies

Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc

Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College

Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)

Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press

29

AUACSCSinksAY08

Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI

Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)

Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press

Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company

Detter Delupis I The law of war (2000) New York NY Cambridge University Press

Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)

Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College

Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor

Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)

Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)

Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf

Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)

Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College

Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College

Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)

Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA

30

AUACSCSinksAY08

Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)

Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)

Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College

Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology

Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College

Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)

OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center

OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College

OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications

Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991

Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College

Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center

Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)

31

AUACSCSinksAY08

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press

Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA

Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University

Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor

Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661

Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office

Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis

United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC

United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center

Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College

Wesley David C The Military Commander and the Law 2006

32

Page 18: Sinks 0407

AUACSCSinksAY08

conducted within the territorial sea of a nation would be no different from a cyber attack

conducted from within the nationrsquos land borders therefore cyber attacks against a state or even

another state conducted within the territorial seas are subject to current international laws Cyber

attacks originating outside the statersquos sovereign borders but results in affecting a statersquos

resources in their territorial seas would fall under the land and airspace breeches of territorial

sovereignty and would be subject to international law

The high seas on the other hand arenrsquot subject to the sovereignty of any one state The

high seas extend beyond the territorial sea and include the airspace the seabed and the subsoil34

and all states have the right to exercise freedoms on the high seas35 As similarly defined in

space ldquothe high seas shall be reserved for peaceful purposesrdquo as stated by Article 88 of the Law

of the Seas Cooperative36 which is defined as refraining from any threat or use of force (outside

of wartime conflicts)

The very nature of a cyber attack in the high seas lends itself to be a violation of

international law as nations are restricted to conducting peaceful operations in the high seas

The question is whom has jurisdiction of crimes committed in the high seas By applying the

Protective Security Principle of Jurisdiction where an actor threatens a statersquo security and

introducing the United Nationrsquos definition on the Illegal Use of Force extends to the high seas

and for that matter space giving states the right for self-defense as defined by the United Nations

as ldquoan armed attackrdquo The sheer name of cyber attack doesnrsquot immediately lend itself to an

ldquoarmedrdquo cyber attack However the effects generated from a cyber attack can be equivalent to a

traditional conventional attack and the international law would permit a state to take appropriate

countermeasures while notifying the United Nations Security Council37

14

AUACSCSinksAY08

Applying International Law to Cyber Warfare Today we live in an Information Age where communication through cyberspace has forever changed and flattened out worldhellipOur adversaries seek to operate from behind technical legal and international screens as they execute their costly attacks38

~General James E Cartwright Commander United States Strategic Command

Jurisdiction

Understanding the territorial sovereignty principles of a nation is important in applying

cyberspace and cyber warfare to existing international laws While some of these principles and

international laws may not be relevant for the cyberspace domain due to the far-reaching

capability of cyber warfare the jurisdiction of a nation further defines its ability to respond to

aggressive acts by nations in the cyberspace domain There are three jurisdictional principles

that provide nations the right to pursue aggressors that threaten a nationrsquos independence the

Territorial Principle Nationality Principle and the Protective Security Principle

For actions originating within the state the jurisdiction clearly falls within the territorial

principle where a ldquostate has jurisdiction over all crimes committed in its territoryhellipto include

airspace international waters and territorial seasrdquo39 The territorial jurisdiction is subject to

exceptions when dealing with persons from foreign states as in the most popular example of

immunity given to foreign diplomats In this case ldquostates may exercise jurisdiction over its

citizenhellipeven if they are physically outside the statesrsquo territoryrdquo as Doctor Boczek defines as the

Nationality Principle Nations usually agree upon on these concessions states prior to the offense

being committed40

Doctor Boczek defines the Protective Security Principle as a ldquojurisdictional principle

whereby a state my assume jurisdiction over and punish foreign nationals for certain conduct

outside its territory which is directed against its security territorial integrity and political

independencerdquo41 Some states would argue that criticism of a state or government is applicable

15

AUACSCSinksAY08

in applying this principle of jurisdiction However this is too broad of an interpretation and

should be confined to acts that are more tangible in nature like falsification of a statesrsquo official

documents conspiracy to violate immigration of custom laws and illicit drug trafficking42

Would a cyber attack that is deemed to challenge a nationrsquos banking community or bring

down a power source be a direct attack against its security and political independence The

international community easily sees the attack of a power source with kinetic weapons as a

violation of a territorial boundary and a breech of international law The United States viewed

the attack on the Trade Towers as an act of war launching the Global War on Terrorism Would

the United States have viewed the same devastation as if the attack occurred through cyberspace

Would the attack have been less of an act of war if the aggressor remotely controlled domestic

airliners from a foreign country Probably not What happens if the cyber attack caused a fire in

the lower floors of the buildings preventing people from escaping While less dramatic than an

airbus flying into the middle of the towers and maybe more difficult to demonize the crime the

result is the samemdashinnocent people suffering as a result of an adversary trying to threaten a

nationrsquos security

What happens if the suspected cyber attack has violated a nationrsquos territorial boundary in

order to attack a neighboring country or an ally Going from point A to point B in cyberspace is

rarely a direct connection As with the global nature of cyberspace itrsquos conceivable that

adversaries cross several nationsrsquo boundaries to conduct cyber attack operations The question

generated is who has jurisdiction

If the actor committing the crime had used an airplane each nation could claim

jurisdiction as the adversary violated their territorial boundaries and violated international law

More often than not the first state would have acted immediately upon the aggressive act and

16

AUACSCSinksAY08

would have prevented aggressors from completing their task by either forcing the aircraft to land

or turnaround or an even more escalated response of firing upon the aircraft In the air land or

sea the ability for a nationrsquos military forces to respond in a timely manner gives way to the

deterrence factor of not crossing a statersquos boundaries without receiving permission for fear of

reprisal A clear example of this was when Turkey denied the United States the ability deploy

the 4th Infantry Division from its borders at the beginning of Operation Iraqi Freedom Violating

Turkeyrsquos borders without permission would have brought about great repercussions that would

have made Operation Iraqi Freedom even more difficult and could have resulted in an escalation

of the war outside the Iraqi borders43 Another example is when Spain and France denied the

Unites States the use of their airspace when F-111s based in the United Kingdom conducted air

operations in Libya in an effort to eliminate Muammar Khadafy44

However the speeds at which these breeches in territorial boundaries occur make it

difficult for a nation to claim jurisdiction especially when nothing occurred within their

territorial sovereignty The cyber attacks didnrsquot result in any damage to nation as the information

packets passed through their sovereign borders According to territorial boundary description

described by Doctor Boczek the international community doesnrsquot consider the crossing the

border in of itself an act of warmdashserious damage is a driving factor in determining conflict

escalation In addition according to the territorial jurisdiction principle the cyber attack didnrsquot

threaten a nationrsquos security territorial integrity and political independence If the cyber attack or

information originated from within a sovereign territory by a third party then the two nations

would have to work together to resolve the issue and mutual jurisdiction would probably apply

However if the cyber attack didnrsquot physically manifest itself from within their sovereign

territory or the adversary didnrsquot use the nation as a staging area to launch a further attack the

17

AUACSCSinksAY08

international law and the jurisdiction principles would dictate the affected nation would have

jurisdiction

Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security

territorial integrity and political independence Cyberspace utilizes the other domains as a means

of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence

Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of

territorial sovereignty the Protective Security Principle does provide nations the ability to

enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos

sovereignty when it conducts cyber warfare operations However some elites donrsquot consider

cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense

International law specifically article 2 of the United Nations Charters states that a

members shall refrain in their international relations from the threat or use of force against the

territorial integrity or political independence of any state or in any other manner inconsistent

with the purposes of the United Nations which is intended to prohibit all types of force except

those carried out under the aegis of the United Nations or as provided for by the Security

Council45 The only exception to the United Nations Charters as it relates to the Use of Force is

the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed

attack46

International elites have discussed the term ldquouse of forcerdquo in the past because of the

development of chemical and biological weapons and had to move from a kinetic impact based

definition to a results-oriented approach47 Chemical and biological weapons lacked the

characteristic of an explosion or physical force yet these weapons certainly are capable of

destroying life and property Doctor Leigh Armistead a former information warfare instructor at

18

AUACSCSinksAY08

the Joint Forces Staff College cautions that the use of computer network attacks by the military

ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary

that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great

Russia introduced a proposal to the United Nations that banned the use of information

operations Even though the United Nations didnrsquot adopt the law the concern of international

community is fully aware of the impact cyber attacks can have on a nation

The concern over cyber warfare capabilities is that it can generate both non-kinetic and

kinetic effects There has always been the traditional kinetic solution for cyber warfare where a

precision guidance munition destroys a critical information system node Most people assume

computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos

computer system from the safety of onersquos own command and control center but the physical

destruction of a computer system or network by kinetic means also qualifies as cyber warfare

However cyber warfare has also evolved to the point where aggressors can achieve a kinetic

effect without the use of a traditional kinetic weapon A cyber attack on an information system

can shut down a particular node of a power plant causing the system to become inoperative

Even if there wasnrsquot an explosion the attack serves the same purpose

The question raised is do cyber attacks constitute an armed attack Scholars do agree that

some cyber attacks fit comfortably within the United Nations Charter For example a strategic

level cyber attack causing widespread damage and significant casualties would trigger the statersquos

right of self-defense In addition a cyber attack that precluded a conventional attack or a series

of cyber attacks causing significant damage would give a state the right of self-defense49 Few

would dispute that a country has the right under international law to respond with military force

19

AUACSCSinksAY08

if a state destroyed or significantly damaged another nationrsquos economic system for example the

New York or London stock exchanges

However some confusion and state-defined interpretation comes into play when the

frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard

Law School argues that cyber attacks require an expansion of the definition on the ldquouse of

forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot

be prohibited by international law50 International scholars recommend ldquoclearer rules of what

kinds of information warfare actions constitute an armed attackrdquo which drives permissible

responses of self-defense51 For example a state-sponsored cyber attack causes damage to a

victimrsquos factory or power plant however the nation claims the incident is an isolated instance

and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under

the United Nations Charter and the United Nations would consider any response retaliation

which would violate international law52

Another example involves a nation conducting a series of small attacks causing minimal

damage and then ceases Even though the aggressor used force to conduct cyber warfare

operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under

the United Nations Charter This type of attack is analogues to a small band of troops crossing a

border without causing significant damage53 According to the United Nations Charter the

national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders

and respond to the use of force Repelling the small band of troops and reestablishing their

sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration

of war and allies would have to respect the United Nations decision and couldnrsquot intervene The

same is true for the cyber attack A state can employ defensive measure to isolate and defeat the

20

AUACSCSinksAY08

incursion over the electromagnetic spectrum However the United Nations would see further

offensive operations or invasive operations as retaliation Therefore a nation must take the

incident whether it is signs of conventional forces on the ground or traces of cyber warfare

incursions in the electromagnetic spectrum to the United Nations to seek restitution

In both of these situations the international law becomes the target for change not

whether cyber warfare is in violation of international law If the law were to change the

international community would then consider the above situations acts of war even if an

adversary used conventional forces As written today the result of an operation remains the

driving factor in determining if an adversary has violated international law The means by which

an adversary conducts military operations may affect how nations react to the situation but

whether an adversary conducts the operation by means of the air land sea space or cyberspace

doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian

Triggs a public international lawyer and member of the Attorney General International Legal

Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over

offences abroad having an intended and substantial effect within a state may be justifiedrdquo54

Therefore the international community must evaluate the effect of a criminal act rather than the

means in which the act was committed

Others claim that because the Internet takes advantages of legal norms where non-state

actors can ignore Western notions of law55 more international laws are needed for cyberspace

However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using

other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the

Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked

aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts

21

AUACSCSinksAY08

against a staterdquo in the cyberspace domain The anonymity of the Internet and their total

disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and

national laws already exist in most countries that prohibit the use of the Internet for terrorist

activities therefore additional international laws wouldnrsquot prevent or deter terrorist from

committing such acts of aggression

International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed

Conflict includes the Martens Clause which extends established custom and humanitarian

principles to new technologies and addresses the ever-changing nature of warfare The

international community designed The Martens Clause ldquoto prevent future unnecessary andor

disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges

crimes by invoking the laws of humanity and public conscience hence their effects and not its

methods

The basic legal premise behind Law of Armed Conflict is that attacks must be limited to

military objectives and collateral damage must be proportionate to military advantages and

forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary

suffering but military commanders and planners need to be aware of the results a particular

action will invoke Russian leadership believes a computer network attack against their

homeland can be a means for executing a variety of escalating responses to include nuclear

attack58 Therefore it is imperative military commanders understand the impact any weapon

system can have on an adversary not just cyber attacks

Not all scholars agree that international law is insufficient to govern cyber warfare

Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace

and the Use of Force states that computer network attacks constitute an unlawful use of force in

22

AUACSCSinksAY08

cyberspace under traditional international law Sharp declared that an armed attack may occur

ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a

way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive

definition of cyber attacks may never be drafted59 The Congressional Research Service also

concluded that ldquothere is little likelihood that the international community will soon generate a

coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations

on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos

conclusion is that the effects of cyber warfare operations are the same as if an adversary

conducted conventional warfare operations where the effect of the attacks are the driving factors

in determining whether an adversary used force or not

The United States Government agrees with Sharprsquos conclusion The offensive

Information Operation strategy for the United States government as described by Doctor

Armistead ties the tools used to conduct military operations back to the desired effect which is

in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning

effects-based operations and operational art focus the Joint Force Commanderrsquos course of action

towards meeting objectives outlined in guidance provided by the National Command Authority

and senior military leadership62 Whether the tools are dropped pamphlets invasive network

attacks or bombs on targets the goal is to produce a desired effect to achieve the overall

objectives and cyber warfare can produce effects that challenge the national security of a nation

Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63

~General T Michael Moseley USAF

23

AUACSCSinksAY08

The cyberspace domain has been around for quite sometime but as technology continues

to advance businesses as well as governmental organizations are becoming more reliant on the

cyberspace domain With that reliance the protection of this critical domain becomes even more

important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the

electromagnetic spectrum by denying and disrupting information demands Scholars claim that

protection needs to include addressing existing international laws expanding them to incorporate

the ever-advancing capabilities emerging in the cyberspace domain

However territorial sovereignty of a nation and the principles of jurisdiction specifically

the Protective Security Principle give nations the right to exercise jurisdiction when an

aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64

While cyberspace is a domain requiring specific attention it relies on assets in the other domains

of land space sea and air in order to operate and international laws for the linear domains do

exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace

but during cyber warfare operations the principles behind the restrictions of foreign military

entering airspace do apply The strategic nature of cyber warfare operations correspond to the

same strategic impact that airpower can inflict upon a nation threatening their independence

While maybe not as dramatic as kinetic effects the results can be just as devastating

Space is relatively straightforward Since a nation canrsquot claim space and over flights of

foreign satellites over a nation is permissible nations must use space for peaceful purposes

Kinetic attacks against space assets are a violation of international law therefore nations would

consider cyber warfare operations against space assets as other than peaceful purposes and a

violation of international law Cyber attacks traversing space assets relate to current military

operations where the military uses space assets to conduct kinetic operations Since international

24

AUACSCSinksAY08

elites havenrsquot considered these kinetic operations as a breach of international law military

commanders can conduct cyber warfare operations through space without fear of violating

international laws for outer space

Crossing international borders without a nationrsquos permission and threatening their

sovereignty is a violation of international law While nations canrsquot consider all border crossings

as an act of war those acts of aggression that threaten the territorial integrity would elicit a

defensive response by the victim nation Whether incursions involve combat vehicles over a

highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are

threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not

have set foot in the nation but according the Protective Security Principle the victim nation has

jurisdiction

Conducting cyber warfare operations from the territorial sea is no different from

conducting operations from within a nationrsquos land or sea borders However the high seas are

very similar in nature to space in that they are reserved for peaceful purposes Therefore

conducting any means of warfare from within the high seas is a violation of international law

and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-

defense

According to Barkham ldquoinformation warfare attacks are in essence territorial

penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then

subject to the jurisdiction of the victim nation who then has the right for self-defense However

due to the global nature of cyberspace aggressors can cross multiple borders and determining

who has jurisdiction demands cooperation among nations The origin and any deliberate staging

locations of the cyber attack will drive who has jurisdiction The crossing of third party borders

25

AUACSCSinksAY08

by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the

aggressors threaten a nationrsquos independence or territorial integrity

Scholars consider cyber warfare operations that involve strategic and operational impacts

as being a means of using force and fall within the legal regime of existing international law

However scholars argue that because cyber warfare includes kinetic and non-kinetic results the

Use of Force definition needs expanding Yet they conclude that an exhaustive definition of

cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare

operations against existing case studies where the effects are evaluated as opposed to the means

even if the operations originated from outside the nationrsquos territorial jurisdiction There is some

authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to

have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade

non-state actors from conducting cyber warfare operations given their willingness to ignore

Western notions of war and their ability to conduct operations anonymously in cyberspace

International laws are in place to that address the ever-changing nature of warfare The

Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a

framework for addressing all warfare to include cyber warfare operations The international

community will need to measure the effects of an operation rather the means Whether its boots

on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a

nationrsquos response

26

AUACSCSinksAY08

End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)

27

AUACSCSinksAY08

44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

28

AUACSCSinksAY08

Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005

Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department

American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)

Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983

Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988

Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)

Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)

IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)

Joint Publication 3-13 Information Operations 13 February 2006

Joint Publication 5-0 Joint Operations Planning 26 December 2006

Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies

Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc

Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College

Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)

Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press

29

AUACSCSinksAY08

Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI

Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)

Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press

Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company

Detter Delupis I The law of war (2000) New York NY Cambridge University Press

Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)

Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College

Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor

Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)

Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)

Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf

Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)

Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College

Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College

Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)

Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA

30

AUACSCSinksAY08

Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)

Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)

Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College

Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology

Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College

Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)

OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center

OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College

OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications

Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991

Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College

Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center

Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)

31

AUACSCSinksAY08

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press

Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA

Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University

Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor

Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661

Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office

Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis

United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC

United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center

Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College

Wesley David C The Military Commander and the Law 2006

32

Page 19: Sinks 0407

AUACSCSinksAY08

Applying International Law to Cyber Warfare Today we live in an Information Age where communication through cyberspace has forever changed and flattened out worldhellipOur adversaries seek to operate from behind technical legal and international screens as they execute their costly attacks38

~General James E Cartwright Commander United States Strategic Command

Jurisdiction

Understanding the territorial sovereignty principles of a nation is important in applying

cyberspace and cyber warfare to existing international laws While some of these principles and

international laws may not be relevant for the cyberspace domain due to the far-reaching

capability of cyber warfare the jurisdiction of a nation further defines its ability to respond to

aggressive acts by nations in the cyberspace domain There are three jurisdictional principles

that provide nations the right to pursue aggressors that threaten a nationrsquos independence the

Territorial Principle Nationality Principle and the Protective Security Principle

For actions originating within the state the jurisdiction clearly falls within the territorial

principle where a ldquostate has jurisdiction over all crimes committed in its territoryhellipto include

airspace international waters and territorial seasrdquo39 The territorial jurisdiction is subject to

exceptions when dealing with persons from foreign states as in the most popular example of

immunity given to foreign diplomats In this case ldquostates may exercise jurisdiction over its

citizenhellipeven if they are physically outside the statesrsquo territoryrdquo as Doctor Boczek defines as the

Nationality Principle Nations usually agree upon on these concessions states prior to the offense

being committed40

Doctor Boczek defines the Protective Security Principle as a ldquojurisdictional principle

whereby a state my assume jurisdiction over and punish foreign nationals for certain conduct

outside its territory which is directed against its security territorial integrity and political

independencerdquo41 Some states would argue that criticism of a state or government is applicable

15

AUACSCSinksAY08

in applying this principle of jurisdiction However this is too broad of an interpretation and

should be confined to acts that are more tangible in nature like falsification of a statesrsquo official

documents conspiracy to violate immigration of custom laws and illicit drug trafficking42

Would a cyber attack that is deemed to challenge a nationrsquos banking community or bring

down a power source be a direct attack against its security and political independence The

international community easily sees the attack of a power source with kinetic weapons as a

violation of a territorial boundary and a breech of international law The United States viewed

the attack on the Trade Towers as an act of war launching the Global War on Terrorism Would

the United States have viewed the same devastation as if the attack occurred through cyberspace

Would the attack have been less of an act of war if the aggressor remotely controlled domestic

airliners from a foreign country Probably not What happens if the cyber attack caused a fire in

the lower floors of the buildings preventing people from escaping While less dramatic than an

airbus flying into the middle of the towers and maybe more difficult to demonize the crime the

result is the samemdashinnocent people suffering as a result of an adversary trying to threaten a

nationrsquos security

What happens if the suspected cyber attack has violated a nationrsquos territorial boundary in

order to attack a neighboring country or an ally Going from point A to point B in cyberspace is

rarely a direct connection As with the global nature of cyberspace itrsquos conceivable that

adversaries cross several nationsrsquo boundaries to conduct cyber attack operations The question

generated is who has jurisdiction

If the actor committing the crime had used an airplane each nation could claim

jurisdiction as the adversary violated their territorial boundaries and violated international law

More often than not the first state would have acted immediately upon the aggressive act and

16

AUACSCSinksAY08

would have prevented aggressors from completing their task by either forcing the aircraft to land

or turnaround or an even more escalated response of firing upon the aircraft In the air land or

sea the ability for a nationrsquos military forces to respond in a timely manner gives way to the

deterrence factor of not crossing a statersquos boundaries without receiving permission for fear of

reprisal A clear example of this was when Turkey denied the United States the ability deploy

the 4th Infantry Division from its borders at the beginning of Operation Iraqi Freedom Violating

Turkeyrsquos borders without permission would have brought about great repercussions that would

have made Operation Iraqi Freedom even more difficult and could have resulted in an escalation

of the war outside the Iraqi borders43 Another example is when Spain and France denied the

Unites States the use of their airspace when F-111s based in the United Kingdom conducted air

operations in Libya in an effort to eliminate Muammar Khadafy44

However the speeds at which these breeches in territorial boundaries occur make it

difficult for a nation to claim jurisdiction especially when nothing occurred within their

territorial sovereignty The cyber attacks didnrsquot result in any damage to nation as the information

packets passed through their sovereign borders According to territorial boundary description

described by Doctor Boczek the international community doesnrsquot consider the crossing the

border in of itself an act of warmdashserious damage is a driving factor in determining conflict

escalation In addition according to the territorial jurisdiction principle the cyber attack didnrsquot

threaten a nationrsquos security territorial integrity and political independence If the cyber attack or

information originated from within a sovereign territory by a third party then the two nations

would have to work together to resolve the issue and mutual jurisdiction would probably apply

However if the cyber attack didnrsquot physically manifest itself from within their sovereign

territory or the adversary didnrsquot use the nation as a staging area to launch a further attack the

17

AUACSCSinksAY08

international law and the jurisdiction principles would dictate the affected nation would have

jurisdiction

Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security

territorial integrity and political independence Cyberspace utilizes the other domains as a means

of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence

Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of

territorial sovereignty the Protective Security Principle does provide nations the ability to

enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos

sovereignty when it conducts cyber warfare operations However some elites donrsquot consider

cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense

International law specifically article 2 of the United Nations Charters states that a

members shall refrain in their international relations from the threat or use of force against the

territorial integrity or political independence of any state or in any other manner inconsistent

with the purposes of the United Nations which is intended to prohibit all types of force except

those carried out under the aegis of the United Nations or as provided for by the Security

Council45 The only exception to the United Nations Charters as it relates to the Use of Force is

the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed

attack46

International elites have discussed the term ldquouse of forcerdquo in the past because of the

development of chemical and biological weapons and had to move from a kinetic impact based

definition to a results-oriented approach47 Chemical and biological weapons lacked the

characteristic of an explosion or physical force yet these weapons certainly are capable of

destroying life and property Doctor Leigh Armistead a former information warfare instructor at

18

AUACSCSinksAY08

the Joint Forces Staff College cautions that the use of computer network attacks by the military

ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary

that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great

Russia introduced a proposal to the United Nations that banned the use of information

operations Even though the United Nations didnrsquot adopt the law the concern of international

community is fully aware of the impact cyber attacks can have on a nation

The concern over cyber warfare capabilities is that it can generate both non-kinetic and

kinetic effects There has always been the traditional kinetic solution for cyber warfare where a

precision guidance munition destroys a critical information system node Most people assume

computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos

computer system from the safety of onersquos own command and control center but the physical

destruction of a computer system or network by kinetic means also qualifies as cyber warfare

However cyber warfare has also evolved to the point where aggressors can achieve a kinetic

effect without the use of a traditional kinetic weapon A cyber attack on an information system

can shut down a particular node of a power plant causing the system to become inoperative

Even if there wasnrsquot an explosion the attack serves the same purpose

The question raised is do cyber attacks constitute an armed attack Scholars do agree that

some cyber attacks fit comfortably within the United Nations Charter For example a strategic

level cyber attack causing widespread damage and significant casualties would trigger the statersquos

right of self-defense In addition a cyber attack that precluded a conventional attack or a series

of cyber attacks causing significant damage would give a state the right of self-defense49 Few

would dispute that a country has the right under international law to respond with military force

19

AUACSCSinksAY08

if a state destroyed or significantly damaged another nationrsquos economic system for example the

New York or London stock exchanges

However some confusion and state-defined interpretation comes into play when the

frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard

Law School argues that cyber attacks require an expansion of the definition on the ldquouse of

forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot

be prohibited by international law50 International scholars recommend ldquoclearer rules of what

kinds of information warfare actions constitute an armed attackrdquo which drives permissible

responses of self-defense51 For example a state-sponsored cyber attack causes damage to a

victimrsquos factory or power plant however the nation claims the incident is an isolated instance

and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under

the United Nations Charter and the United Nations would consider any response retaliation

which would violate international law52

Another example involves a nation conducting a series of small attacks causing minimal

damage and then ceases Even though the aggressor used force to conduct cyber warfare

operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under

the United Nations Charter This type of attack is analogues to a small band of troops crossing a

border without causing significant damage53 According to the United Nations Charter the

national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders

and respond to the use of force Repelling the small band of troops and reestablishing their

sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration

of war and allies would have to respect the United Nations decision and couldnrsquot intervene The

same is true for the cyber attack A state can employ defensive measure to isolate and defeat the

20

AUACSCSinksAY08

incursion over the electromagnetic spectrum However the United Nations would see further

offensive operations or invasive operations as retaliation Therefore a nation must take the

incident whether it is signs of conventional forces on the ground or traces of cyber warfare

incursions in the electromagnetic spectrum to the United Nations to seek restitution

In both of these situations the international law becomes the target for change not

whether cyber warfare is in violation of international law If the law were to change the

international community would then consider the above situations acts of war even if an

adversary used conventional forces As written today the result of an operation remains the

driving factor in determining if an adversary has violated international law The means by which

an adversary conducts military operations may affect how nations react to the situation but

whether an adversary conducts the operation by means of the air land sea space or cyberspace

doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian

Triggs a public international lawyer and member of the Attorney General International Legal

Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over

offences abroad having an intended and substantial effect within a state may be justifiedrdquo54

Therefore the international community must evaluate the effect of a criminal act rather than the

means in which the act was committed

Others claim that because the Internet takes advantages of legal norms where non-state

actors can ignore Western notions of law55 more international laws are needed for cyberspace

However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using

other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the

Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked

aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts

21

AUACSCSinksAY08

against a staterdquo in the cyberspace domain The anonymity of the Internet and their total

disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and

national laws already exist in most countries that prohibit the use of the Internet for terrorist

activities therefore additional international laws wouldnrsquot prevent or deter terrorist from

committing such acts of aggression

International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed

Conflict includes the Martens Clause which extends established custom and humanitarian

principles to new technologies and addresses the ever-changing nature of warfare The

international community designed The Martens Clause ldquoto prevent future unnecessary andor

disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges

crimes by invoking the laws of humanity and public conscience hence their effects and not its

methods

The basic legal premise behind Law of Armed Conflict is that attacks must be limited to

military objectives and collateral damage must be proportionate to military advantages and

forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary

suffering but military commanders and planners need to be aware of the results a particular

action will invoke Russian leadership believes a computer network attack against their

homeland can be a means for executing a variety of escalating responses to include nuclear

attack58 Therefore it is imperative military commanders understand the impact any weapon

system can have on an adversary not just cyber attacks

Not all scholars agree that international law is insufficient to govern cyber warfare

Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace

and the Use of Force states that computer network attacks constitute an unlawful use of force in

22

AUACSCSinksAY08

cyberspace under traditional international law Sharp declared that an armed attack may occur

ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a

way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive

definition of cyber attacks may never be drafted59 The Congressional Research Service also

concluded that ldquothere is little likelihood that the international community will soon generate a

coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations

on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos

conclusion is that the effects of cyber warfare operations are the same as if an adversary

conducted conventional warfare operations where the effect of the attacks are the driving factors

in determining whether an adversary used force or not

The United States Government agrees with Sharprsquos conclusion The offensive

Information Operation strategy for the United States government as described by Doctor

Armistead ties the tools used to conduct military operations back to the desired effect which is

in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning

effects-based operations and operational art focus the Joint Force Commanderrsquos course of action

towards meeting objectives outlined in guidance provided by the National Command Authority

and senior military leadership62 Whether the tools are dropped pamphlets invasive network

attacks or bombs on targets the goal is to produce a desired effect to achieve the overall

objectives and cyber warfare can produce effects that challenge the national security of a nation

Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63

~General T Michael Moseley USAF

23

AUACSCSinksAY08

The cyberspace domain has been around for quite sometime but as technology continues

to advance businesses as well as governmental organizations are becoming more reliant on the

cyberspace domain With that reliance the protection of this critical domain becomes even more

important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the

electromagnetic spectrum by denying and disrupting information demands Scholars claim that

protection needs to include addressing existing international laws expanding them to incorporate

the ever-advancing capabilities emerging in the cyberspace domain

However territorial sovereignty of a nation and the principles of jurisdiction specifically

the Protective Security Principle give nations the right to exercise jurisdiction when an

aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64

While cyberspace is a domain requiring specific attention it relies on assets in the other domains

of land space sea and air in order to operate and international laws for the linear domains do

exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace

but during cyber warfare operations the principles behind the restrictions of foreign military

entering airspace do apply The strategic nature of cyber warfare operations correspond to the

same strategic impact that airpower can inflict upon a nation threatening their independence

While maybe not as dramatic as kinetic effects the results can be just as devastating

Space is relatively straightforward Since a nation canrsquot claim space and over flights of

foreign satellites over a nation is permissible nations must use space for peaceful purposes

Kinetic attacks against space assets are a violation of international law therefore nations would

consider cyber warfare operations against space assets as other than peaceful purposes and a

violation of international law Cyber attacks traversing space assets relate to current military

operations where the military uses space assets to conduct kinetic operations Since international

24

AUACSCSinksAY08

elites havenrsquot considered these kinetic operations as a breach of international law military

commanders can conduct cyber warfare operations through space without fear of violating

international laws for outer space

Crossing international borders without a nationrsquos permission and threatening their

sovereignty is a violation of international law While nations canrsquot consider all border crossings

as an act of war those acts of aggression that threaten the territorial integrity would elicit a

defensive response by the victim nation Whether incursions involve combat vehicles over a

highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are

threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not

have set foot in the nation but according the Protective Security Principle the victim nation has

jurisdiction

Conducting cyber warfare operations from the territorial sea is no different from

conducting operations from within a nationrsquos land or sea borders However the high seas are

very similar in nature to space in that they are reserved for peaceful purposes Therefore

conducting any means of warfare from within the high seas is a violation of international law

and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-

defense

According to Barkham ldquoinformation warfare attacks are in essence territorial

penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then

subject to the jurisdiction of the victim nation who then has the right for self-defense However

due to the global nature of cyberspace aggressors can cross multiple borders and determining

who has jurisdiction demands cooperation among nations The origin and any deliberate staging

locations of the cyber attack will drive who has jurisdiction The crossing of third party borders

25

AUACSCSinksAY08

by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the

aggressors threaten a nationrsquos independence or territorial integrity

Scholars consider cyber warfare operations that involve strategic and operational impacts

as being a means of using force and fall within the legal regime of existing international law

However scholars argue that because cyber warfare includes kinetic and non-kinetic results the

Use of Force definition needs expanding Yet they conclude that an exhaustive definition of

cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare

operations against existing case studies where the effects are evaluated as opposed to the means

even if the operations originated from outside the nationrsquos territorial jurisdiction There is some

authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to

have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade

non-state actors from conducting cyber warfare operations given their willingness to ignore

Western notions of war and their ability to conduct operations anonymously in cyberspace

International laws are in place to that address the ever-changing nature of warfare The

Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a

framework for addressing all warfare to include cyber warfare operations The international

community will need to measure the effects of an operation rather the means Whether its boots

on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a

nationrsquos response

26

AUACSCSinksAY08

End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)

27

AUACSCSinksAY08

44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

28

AUACSCSinksAY08

Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005

Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department

American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)

Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983

Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988

Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)

Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)

IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)

Joint Publication 3-13 Information Operations 13 February 2006

Joint Publication 5-0 Joint Operations Planning 26 December 2006

Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies

Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc

Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College

Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)

Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press

29

AUACSCSinksAY08

Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI

Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)

Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press

Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company

Detter Delupis I The law of war (2000) New York NY Cambridge University Press

Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)

Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College

Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor

Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)

Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)

Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf

Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)

Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College

Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College

Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)

Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA

30

AUACSCSinksAY08

Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)

Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)

Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College

Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology

Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College

Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)

OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center

OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College

OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications

Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991

Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College

Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center

Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)

31

AUACSCSinksAY08

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press

Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA

Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University

Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor

Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661

Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office

Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis

United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC

United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center

Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College

Wesley David C The Military Commander and the Law 2006

32

Page 20: Sinks 0407

AUACSCSinksAY08

in applying this principle of jurisdiction However this is too broad of an interpretation and

should be confined to acts that are more tangible in nature like falsification of a statesrsquo official

documents conspiracy to violate immigration of custom laws and illicit drug trafficking42

Would a cyber attack that is deemed to challenge a nationrsquos banking community or bring

down a power source be a direct attack against its security and political independence The

international community easily sees the attack of a power source with kinetic weapons as a

violation of a territorial boundary and a breech of international law The United States viewed

the attack on the Trade Towers as an act of war launching the Global War on Terrorism Would

the United States have viewed the same devastation as if the attack occurred through cyberspace

Would the attack have been less of an act of war if the aggressor remotely controlled domestic

airliners from a foreign country Probably not What happens if the cyber attack caused a fire in

the lower floors of the buildings preventing people from escaping While less dramatic than an

airbus flying into the middle of the towers and maybe more difficult to demonize the crime the

result is the samemdashinnocent people suffering as a result of an adversary trying to threaten a

nationrsquos security

What happens if the suspected cyber attack has violated a nationrsquos territorial boundary in

order to attack a neighboring country or an ally Going from point A to point B in cyberspace is

rarely a direct connection As with the global nature of cyberspace itrsquos conceivable that

adversaries cross several nationsrsquo boundaries to conduct cyber attack operations The question

generated is who has jurisdiction

If the actor committing the crime had used an airplane each nation could claim

jurisdiction as the adversary violated their territorial boundaries and violated international law

More often than not the first state would have acted immediately upon the aggressive act and

16

AUACSCSinksAY08

would have prevented aggressors from completing their task by either forcing the aircraft to land

or turnaround or an even more escalated response of firing upon the aircraft In the air land or

sea the ability for a nationrsquos military forces to respond in a timely manner gives way to the

deterrence factor of not crossing a statersquos boundaries without receiving permission for fear of

reprisal A clear example of this was when Turkey denied the United States the ability deploy

the 4th Infantry Division from its borders at the beginning of Operation Iraqi Freedom Violating

Turkeyrsquos borders without permission would have brought about great repercussions that would

have made Operation Iraqi Freedom even more difficult and could have resulted in an escalation

of the war outside the Iraqi borders43 Another example is when Spain and France denied the

Unites States the use of their airspace when F-111s based in the United Kingdom conducted air

operations in Libya in an effort to eliminate Muammar Khadafy44

However the speeds at which these breeches in territorial boundaries occur make it

difficult for a nation to claim jurisdiction especially when nothing occurred within their

territorial sovereignty The cyber attacks didnrsquot result in any damage to nation as the information

packets passed through their sovereign borders According to territorial boundary description

described by Doctor Boczek the international community doesnrsquot consider the crossing the

border in of itself an act of warmdashserious damage is a driving factor in determining conflict

escalation In addition according to the territorial jurisdiction principle the cyber attack didnrsquot

threaten a nationrsquos security territorial integrity and political independence If the cyber attack or

information originated from within a sovereign territory by a third party then the two nations

would have to work together to resolve the issue and mutual jurisdiction would probably apply

However if the cyber attack didnrsquot physically manifest itself from within their sovereign

territory or the adversary didnrsquot use the nation as a staging area to launch a further attack the

17

AUACSCSinksAY08

international law and the jurisdiction principles would dictate the affected nation would have

jurisdiction

Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security

territorial integrity and political independence Cyberspace utilizes the other domains as a means

of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence

Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of

territorial sovereignty the Protective Security Principle does provide nations the ability to

enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos

sovereignty when it conducts cyber warfare operations However some elites donrsquot consider

cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense

International law specifically article 2 of the United Nations Charters states that a

members shall refrain in their international relations from the threat or use of force against the

territorial integrity or political independence of any state or in any other manner inconsistent

with the purposes of the United Nations which is intended to prohibit all types of force except

those carried out under the aegis of the United Nations or as provided for by the Security

Council45 The only exception to the United Nations Charters as it relates to the Use of Force is

the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed

attack46

International elites have discussed the term ldquouse of forcerdquo in the past because of the

development of chemical and biological weapons and had to move from a kinetic impact based

definition to a results-oriented approach47 Chemical and biological weapons lacked the

characteristic of an explosion or physical force yet these weapons certainly are capable of

destroying life and property Doctor Leigh Armistead a former information warfare instructor at

18

AUACSCSinksAY08

the Joint Forces Staff College cautions that the use of computer network attacks by the military

ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary

that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great

Russia introduced a proposal to the United Nations that banned the use of information

operations Even though the United Nations didnrsquot adopt the law the concern of international

community is fully aware of the impact cyber attacks can have on a nation

The concern over cyber warfare capabilities is that it can generate both non-kinetic and

kinetic effects There has always been the traditional kinetic solution for cyber warfare where a

precision guidance munition destroys a critical information system node Most people assume

computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos

computer system from the safety of onersquos own command and control center but the physical

destruction of a computer system or network by kinetic means also qualifies as cyber warfare

However cyber warfare has also evolved to the point where aggressors can achieve a kinetic

effect without the use of a traditional kinetic weapon A cyber attack on an information system

can shut down a particular node of a power plant causing the system to become inoperative

Even if there wasnrsquot an explosion the attack serves the same purpose

The question raised is do cyber attacks constitute an armed attack Scholars do agree that

some cyber attacks fit comfortably within the United Nations Charter For example a strategic

level cyber attack causing widespread damage and significant casualties would trigger the statersquos

right of self-defense In addition a cyber attack that precluded a conventional attack or a series

of cyber attacks causing significant damage would give a state the right of self-defense49 Few

would dispute that a country has the right under international law to respond with military force

19

AUACSCSinksAY08

if a state destroyed or significantly damaged another nationrsquos economic system for example the

New York or London stock exchanges

However some confusion and state-defined interpretation comes into play when the

frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard

Law School argues that cyber attacks require an expansion of the definition on the ldquouse of

forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot

be prohibited by international law50 International scholars recommend ldquoclearer rules of what

kinds of information warfare actions constitute an armed attackrdquo which drives permissible

responses of self-defense51 For example a state-sponsored cyber attack causes damage to a

victimrsquos factory or power plant however the nation claims the incident is an isolated instance

and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under

the United Nations Charter and the United Nations would consider any response retaliation

which would violate international law52

Another example involves a nation conducting a series of small attacks causing minimal

damage and then ceases Even though the aggressor used force to conduct cyber warfare

operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under

the United Nations Charter This type of attack is analogues to a small band of troops crossing a

border without causing significant damage53 According to the United Nations Charter the

national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders

and respond to the use of force Repelling the small band of troops and reestablishing their

sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration

of war and allies would have to respect the United Nations decision and couldnrsquot intervene The

same is true for the cyber attack A state can employ defensive measure to isolate and defeat the

20

AUACSCSinksAY08

incursion over the electromagnetic spectrum However the United Nations would see further

offensive operations or invasive operations as retaliation Therefore a nation must take the

incident whether it is signs of conventional forces on the ground or traces of cyber warfare

incursions in the electromagnetic spectrum to the United Nations to seek restitution

In both of these situations the international law becomes the target for change not

whether cyber warfare is in violation of international law If the law were to change the

international community would then consider the above situations acts of war even if an

adversary used conventional forces As written today the result of an operation remains the

driving factor in determining if an adversary has violated international law The means by which

an adversary conducts military operations may affect how nations react to the situation but

whether an adversary conducts the operation by means of the air land sea space or cyberspace

doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian

Triggs a public international lawyer and member of the Attorney General International Legal

Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over

offences abroad having an intended and substantial effect within a state may be justifiedrdquo54

Therefore the international community must evaluate the effect of a criminal act rather than the

means in which the act was committed

Others claim that because the Internet takes advantages of legal norms where non-state

actors can ignore Western notions of law55 more international laws are needed for cyberspace

However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using

other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the

Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked

aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts

21

AUACSCSinksAY08

against a staterdquo in the cyberspace domain The anonymity of the Internet and their total

disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and

national laws already exist in most countries that prohibit the use of the Internet for terrorist

activities therefore additional international laws wouldnrsquot prevent or deter terrorist from

committing such acts of aggression

International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed

Conflict includes the Martens Clause which extends established custom and humanitarian

principles to new technologies and addresses the ever-changing nature of warfare The

international community designed The Martens Clause ldquoto prevent future unnecessary andor

disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges

crimes by invoking the laws of humanity and public conscience hence their effects and not its

methods

The basic legal premise behind Law of Armed Conflict is that attacks must be limited to

military objectives and collateral damage must be proportionate to military advantages and

forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary

suffering but military commanders and planners need to be aware of the results a particular

action will invoke Russian leadership believes a computer network attack against their

homeland can be a means for executing a variety of escalating responses to include nuclear

attack58 Therefore it is imperative military commanders understand the impact any weapon

system can have on an adversary not just cyber attacks

Not all scholars agree that international law is insufficient to govern cyber warfare

Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace

and the Use of Force states that computer network attacks constitute an unlawful use of force in

22

AUACSCSinksAY08

cyberspace under traditional international law Sharp declared that an armed attack may occur

ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a

way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive

definition of cyber attacks may never be drafted59 The Congressional Research Service also

concluded that ldquothere is little likelihood that the international community will soon generate a

coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations

on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos

conclusion is that the effects of cyber warfare operations are the same as if an adversary

conducted conventional warfare operations where the effect of the attacks are the driving factors

in determining whether an adversary used force or not

The United States Government agrees with Sharprsquos conclusion The offensive

Information Operation strategy for the United States government as described by Doctor

Armistead ties the tools used to conduct military operations back to the desired effect which is

in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning

effects-based operations and operational art focus the Joint Force Commanderrsquos course of action

towards meeting objectives outlined in guidance provided by the National Command Authority

and senior military leadership62 Whether the tools are dropped pamphlets invasive network

attacks or bombs on targets the goal is to produce a desired effect to achieve the overall

objectives and cyber warfare can produce effects that challenge the national security of a nation

Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63

~General T Michael Moseley USAF

23

AUACSCSinksAY08

The cyberspace domain has been around for quite sometime but as technology continues

to advance businesses as well as governmental organizations are becoming more reliant on the

cyberspace domain With that reliance the protection of this critical domain becomes even more

important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the

electromagnetic spectrum by denying and disrupting information demands Scholars claim that

protection needs to include addressing existing international laws expanding them to incorporate

the ever-advancing capabilities emerging in the cyberspace domain

However territorial sovereignty of a nation and the principles of jurisdiction specifically

the Protective Security Principle give nations the right to exercise jurisdiction when an

aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64

While cyberspace is a domain requiring specific attention it relies on assets in the other domains

of land space sea and air in order to operate and international laws for the linear domains do

exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace

but during cyber warfare operations the principles behind the restrictions of foreign military

entering airspace do apply The strategic nature of cyber warfare operations correspond to the

same strategic impact that airpower can inflict upon a nation threatening their independence

While maybe not as dramatic as kinetic effects the results can be just as devastating

Space is relatively straightforward Since a nation canrsquot claim space and over flights of

foreign satellites over a nation is permissible nations must use space for peaceful purposes

Kinetic attacks against space assets are a violation of international law therefore nations would

consider cyber warfare operations against space assets as other than peaceful purposes and a

violation of international law Cyber attacks traversing space assets relate to current military

operations where the military uses space assets to conduct kinetic operations Since international

24

AUACSCSinksAY08

elites havenrsquot considered these kinetic operations as a breach of international law military

commanders can conduct cyber warfare operations through space without fear of violating

international laws for outer space

Crossing international borders without a nationrsquos permission and threatening their

sovereignty is a violation of international law While nations canrsquot consider all border crossings

as an act of war those acts of aggression that threaten the territorial integrity would elicit a

defensive response by the victim nation Whether incursions involve combat vehicles over a

highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are

threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not

have set foot in the nation but according the Protective Security Principle the victim nation has

jurisdiction

Conducting cyber warfare operations from the territorial sea is no different from

conducting operations from within a nationrsquos land or sea borders However the high seas are

very similar in nature to space in that they are reserved for peaceful purposes Therefore

conducting any means of warfare from within the high seas is a violation of international law

and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-

defense

According to Barkham ldquoinformation warfare attacks are in essence territorial

penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then

subject to the jurisdiction of the victim nation who then has the right for self-defense However

due to the global nature of cyberspace aggressors can cross multiple borders and determining

who has jurisdiction demands cooperation among nations The origin and any deliberate staging

locations of the cyber attack will drive who has jurisdiction The crossing of third party borders

25

AUACSCSinksAY08

by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the

aggressors threaten a nationrsquos independence or territorial integrity

Scholars consider cyber warfare operations that involve strategic and operational impacts

as being a means of using force and fall within the legal regime of existing international law

However scholars argue that because cyber warfare includes kinetic and non-kinetic results the

Use of Force definition needs expanding Yet they conclude that an exhaustive definition of

cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare

operations against existing case studies where the effects are evaluated as opposed to the means

even if the operations originated from outside the nationrsquos territorial jurisdiction There is some

authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to

have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade

non-state actors from conducting cyber warfare operations given their willingness to ignore

Western notions of war and their ability to conduct operations anonymously in cyberspace

International laws are in place to that address the ever-changing nature of warfare The

Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a

framework for addressing all warfare to include cyber warfare operations The international

community will need to measure the effects of an operation rather the means Whether its boots

on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a

nationrsquos response

26

AUACSCSinksAY08

End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)

27

AUACSCSinksAY08

44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

28

AUACSCSinksAY08

Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005

Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department

American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)

Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983

Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988

Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)

Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)

IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)

Joint Publication 3-13 Information Operations 13 February 2006

Joint Publication 5-0 Joint Operations Planning 26 December 2006

Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies

Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc

Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College

Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)

Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press

29

AUACSCSinksAY08

Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI

Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)

Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press

Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company

Detter Delupis I The law of war (2000) New York NY Cambridge University Press

Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)

Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College

Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor

Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)

Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)

Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf

Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)

Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College

Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College

Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)

Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA

30

AUACSCSinksAY08

Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)

Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)

Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College

Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology

Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College

Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)

OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center

OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College

OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications

Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991

Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College

Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center

Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)

31

AUACSCSinksAY08

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press

Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA

Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University

Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor

Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661

Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office

Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis

United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC

United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center

Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College

Wesley David C The Military Commander and the Law 2006

32

Page 21: Sinks 0407

AUACSCSinksAY08

would have prevented aggressors from completing their task by either forcing the aircraft to land

or turnaround or an even more escalated response of firing upon the aircraft In the air land or

sea the ability for a nationrsquos military forces to respond in a timely manner gives way to the

deterrence factor of not crossing a statersquos boundaries without receiving permission for fear of

reprisal A clear example of this was when Turkey denied the United States the ability deploy

the 4th Infantry Division from its borders at the beginning of Operation Iraqi Freedom Violating

Turkeyrsquos borders without permission would have brought about great repercussions that would

have made Operation Iraqi Freedom even more difficult and could have resulted in an escalation

of the war outside the Iraqi borders43 Another example is when Spain and France denied the

Unites States the use of their airspace when F-111s based in the United Kingdom conducted air

operations in Libya in an effort to eliminate Muammar Khadafy44

However the speeds at which these breeches in territorial boundaries occur make it

difficult for a nation to claim jurisdiction especially when nothing occurred within their

territorial sovereignty The cyber attacks didnrsquot result in any damage to nation as the information

packets passed through their sovereign borders According to territorial boundary description

described by Doctor Boczek the international community doesnrsquot consider the crossing the

border in of itself an act of warmdashserious damage is a driving factor in determining conflict

escalation In addition according to the territorial jurisdiction principle the cyber attack didnrsquot

threaten a nationrsquos security territorial integrity and political independence If the cyber attack or

information originated from within a sovereign territory by a third party then the two nations

would have to work together to resolve the issue and mutual jurisdiction would probably apply

However if the cyber attack didnrsquot physically manifest itself from within their sovereign

territory or the adversary didnrsquot use the nation as a staging area to launch a further attack the

17

AUACSCSinksAY08

international law and the jurisdiction principles would dictate the affected nation would have

jurisdiction

Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security

territorial integrity and political independence Cyberspace utilizes the other domains as a means

of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence

Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of

territorial sovereignty the Protective Security Principle does provide nations the ability to

enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos

sovereignty when it conducts cyber warfare operations However some elites donrsquot consider

cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense

International law specifically article 2 of the United Nations Charters states that a

members shall refrain in their international relations from the threat or use of force against the

territorial integrity or political independence of any state or in any other manner inconsistent

with the purposes of the United Nations which is intended to prohibit all types of force except

those carried out under the aegis of the United Nations or as provided for by the Security

Council45 The only exception to the United Nations Charters as it relates to the Use of Force is

the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed

attack46

International elites have discussed the term ldquouse of forcerdquo in the past because of the

development of chemical and biological weapons and had to move from a kinetic impact based

definition to a results-oriented approach47 Chemical and biological weapons lacked the

characteristic of an explosion or physical force yet these weapons certainly are capable of

destroying life and property Doctor Leigh Armistead a former information warfare instructor at

18

AUACSCSinksAY08

the Joint Forces Staff College cautions that the use of computer network attacks by the military

ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary

that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great

Russia introduced a proposal to the United Nations that banned the use of information

operations Even though the United Nations didnrsquot adopt the law the concern of international

community is fully aware of the impact cyber attacks can have on a nation

The concern over cyber warfare capabilities is that it can generate both non-kinetic and

kinetic effects There has always been the traditional kinetic solution for cyber warfare where a

precision guidance munition destroys a critical information system node Most people assume

computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos

computer system from the safety of onersquos own command and control center but the physical

destruction of a computer system or network by kinetic means also qualifies as cyber warfare

However cyber warfare has also evolved to the point where aggressors can achieve a kinetic

effect without the use of a traditional kinetic weapon A cyber attack on an information system

can shut down a particular node of a power plant causing the system to become inoperative

Even if there wasnrsquot an explosion the attack serves the same purpose

The question raised is do cyber attacks constitute an armed attack Scholars do agree that

some cyber attacks fit comfortably within the United Nations Charter For example a strategic

level cyber attack causing widespread damage and significant casualties would trigger the statersquos

right of self-defense In addition a cyber attack that precluded a conventional attack or a series

of cyber attacks causing significant damage would give a state the right of self-defense49 Few

would dispute that a country has the right under international law to respond with military force

19

AUACSCSinksAY08

if a state destroyed or significantly damaged another nationrsquos economic system for example the

New York or London stock exchanges

However some confusion and state-defined interpretation comes into play when the

frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard

Law School argues that cyber attacks require an expansion of the definition on the ldquouse of

forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot

be prohibited by international law50 International scholars recommend ldquoclearer rules of what

kinds of information warfare actions constitute an armed attackrdquo which drives permissible

responses of self-defense51 For example a state-sponsored cyber attack causes damage to a

victimrsquos factory or power plant however the nation claims the incident is an isolated instance

and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under

the United Nations Charter and the United Nations would consider any response retaliation

which would violate international law52

Another example involves a nation conducting a series of small attacks causing minimal

damage and then ceases Even though the aggressor used force to conduct cyber warfare

operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under

the United Nations Charter This type of attack is analogues to a small band of troops crossing a

border without causing significant damage53 According to the United Nations Charter the

national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders

and respond to the use of force Repelling the small band of troops and reestablishing their

sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration

of war and allies would have to respect the United Nations decision and couldnrsquot intervene The

same is true for the cyber attack A state can employ defensive measure to isolate and defeat the

20

AUACSCSinksAY08

incursion over the electromagnetic spectrum However the United Nations would see further

offensive operations or invasive operations as retaliation Therefore a nation must take the

incident whether it is signs of conventional forces on the ground or traces of cyber warfare

incursions in the electromagnetic spectrum to the United Nations to seek restitution

In both of these situations the international law becomes the target for change not

whether cyber warfare is in violation of international law If the law were to change the

international community would then consider the above situations acts of war even if an

adversary used conventional forces As written today the result of an operation remains the

driving factor in determining if an adversary has violated international law The means by which

an adversary conducts military operations may affect how nations react to the situation but

whether an adversary conducts the operation by means of the air land sea space or cyberspace

doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian

Triggs a public international lawyer and member of the Attorney General International Legal

Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over

offences abroad having an intended and substantial effect within a state may be justifiedrdquo54

Therefore the international community must evaluate the effect of a criminal act rather than the

means in which the act was committed

Others claim that because the Internet takes advantages of legal norms where non-state

actors can ignore Western notions of law55 more international laws are needed for cyberspace

However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using

other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the

Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked

aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts

21

AUACSCSinksAY08

against a staterdquo in the cyberspace domain The anonymity of the Internet and their total

disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and

national laws already exist in most countries that prohibit the use of the Internet for terrorist

activities therefore additional international laws wouldnrsquot prevent or deter terrorist from

committing such acts of aggression

International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed

Conflict includes the Martens Clause which extends established custom and humanitarian

principles to new technologies and addresses the ever-changing nature of warfare The

international community designed The Martens Clause ldquoto prevent future unnecessary andor

disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges

crimes by invoking the laws of humanity and public conscience hence their effects and not its

methods

The basic legal premise behind Law of Armed Conflict is that attacks must be limited to

military objectives and collateral damage must be proportionate to military advantages and

forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary

suffering but military commanders and planners need to be aware of the results a particular

action will invoke Russian leadership believes a computer network attack against their

homeland can be a means for executing a variety of escalating responses to include nuclear

attack58 Therefore it is imperative military commanders understand the impact any weapon

system can have on an adversary not just cyber attacks

Not all scholars agree that international law is insufficient to govern cyber warfare

Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace

and the Use of Force states that computer network attacks constitute an unlawful use of force in

22

AUACSCSinksAY08

cyberspace under traditional international law Sharp declared that an armed attack may occur

ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a

way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive

definition of cyber attacks may never be drafted59 The Congressional Research Service also

concluded that ldquothere is little likelihood that the international community will soon generate a

coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations

on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos

conclusion is that the effects of cyber warfare operations are the same as if an adversary

conducted conventional warfare operations where the effect of the attacks are the driving factors

in determining whether an adversary used force or not

The United States Government agrees with Sharprsquos conclusion The offensive

Information Operation strategy for the United States government as described by Doctor

Armistead ties the tools used to conduct military operations back to the desired effect which is

in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning

effects-based operations and operational art focus the Joint Force Commanderrsquos course of action

towards meeting objectives outlined in guidance provided by the National Command Authority

and senior military leadership62 Whether the tools are dropped pamphlets invasive network

attacks or bombs on targets the goal is to produce a desired effect to achieve the overall

objectives and cyber warfare can produce effects that challenge the national security of a nation

Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63

~General T Michael Moseley USAF

23

AUACSCSinksAY08

The cyberspace domain has been around for quite sometime but as technology continues

to advance businesses as well as governmental organizations are becoming more reliant on the

cyberspace domain With that reliance the protection of this critical domain becomes even more

important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the

electromagnetic spectrum by denying and disrupting information demands Scholars claim that

protection needs to include addressing existing international laws expanding them to incorporate

the ever-advancing capabilities emerging in the cyberspace domain

However territorial sovereignty of a nation and the principles of jurisdiction specifically

the Protective Security Principle give nations the right to exercise jurisdiction when an

aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64

While cyberspace is a domain requiring specific attention it relies on assets in the other domains

of land space sea and air in order to operate and international laws for the linear domains do

exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace

but during cyber warfare operations the principles behind the restrictions of foreign military

entering airspace do apply The strategic nature of cyber warfare operations correspond to the

same strategic impact that airpower can inflict upon a nation threatening their independence

While maybe not as dramatic as kinetic effects the results can be just as devastating

Space is relatively straightforward Since a nation canrsquot claim space and over flights of

foreign satellites over a nation is permissible nations must use space for peaceful purposes

Kinetic attacks against space assets are a violation of international law therefore nations would

consider cyber warfare operations against space assets as other than peaceful purposes and a

violation of international law Cyber attacks traversing space assets relate to current military

operations where the military uses space assets to conduct kinetic operations Since international

24

AUACSCSinksAY08

elites havenrsquot considered these kinetic operations as a breach of international law military

commanders can conduct cyber warfare operations through space without fear of violating

international laws for outer space

Crossing international borders without a nationrsquos permission and threatening their

sovereignty is a violation of international law While nations canrsquot consider all border crossings

as an act of war those acts of aggression that threaten the territorial integrity would elicit a

defensive response by the victim nation Whether incursions involve combat vehicles over a

highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are

threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not

have set foot in the nation but according the Protective Security Principle the victim nation has

jurisdiction

Conducting cyber warfare operations from the territorial sea is no different from

conducting operations from within a nationrsquos land or sea borders However the high seas are

very similar in nature to space in that they are reserved for peaceful purposes Therefore

conducting any means of warfare from within the high seas is a violation of international law

and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-

defense

According to Barkham ldquoinformation warfare attacks are in essence territorial

penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then

subject to the jurisdiction of the victim nation who then has the right for self-defense However

due to the global nature of cyberspace aggressors can cross multiple borders and determining

who has jurisdiction demands cooperation among nations The origin and any deliberate staging

locations of the cyber attack will drive who has jurisdiction The crossing of third party borders

25

AUACSCSinksAY08

by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the

aggressors threaten a nationrsquos independence or territorial integrity

Scholars consider cyber warfare operations that involve strategic and operational impacts

as being a means of using force and fall within the legal regime of existing international law

However scholars argue that because cyber warfare includes kinetic and non-kinetic results the

Use of Force definition needs expanding Yet they conclude that an exhaustive definition of

cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare

operations against existing case studies where the effects are evaluated as opposed to the means

even if the operations originated from outside the nationrsquos territorial jurisdiction There is some

authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to

have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade

non-state actors from conducting cyber warfare operations given their willingness to ignore

Western notions of war and their ability to conduct operations anonymously in cyberspace

International laws are in place to that address the ever-changing nature of warfare The

Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a

framework for addressing all warfare to include cyber warfare operations The international

community will need to measure the effects of an operation rather the means Whether its boots

on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a

nationrsquos response

26

AUACSCSinksAY08

End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)

27

AUACSCSinksAY08

44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

28

AUACSCSinksAY08

Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005

Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department

American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)

Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983

Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988

Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)

Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)

IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)

Joint Publication 3-13 Information Operations 13 February 2006

Joint Publication 5-0 Joint Operations Planning 26 December 2006

Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies

Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc

Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College

Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)

Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press

29

AUACSCSinksAY08

Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI

Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)

Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press

Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company

Detter Delupis I The law of war (2000) New York NY Cambridge University Press

Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)

Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College

Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor

Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)

Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)

Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf

Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)

Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College

Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College

Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)

Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA

30

AUACSCSinksAY08

Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)

Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)

Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College

Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology

Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College

Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)

OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center

OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College

OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications

Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991

Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College

Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center

Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)

31

AUACSCSinksAY08

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press

Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA

Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University

Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor

Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661

Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office

Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis

United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC

United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center

Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College

Wesley David C The Military Commander and the Law 2006

32

Page 22: Sinks 0407

AUACSCSinksAY08

international law and the jurisdiction principles would dictate the affected nation would have

jurisdiction

Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security

territorial integrity and political independence Cyberspace utilizes the other domains as a means

of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence

Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of

territorial sovereignty the Protective Security Principle does provide nations the ability to

enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos

sovereignty when it conducts cyber warfare operations However some elites donrsquot consider

cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense

International law specifically article 2 of the United Nations Charters states that a

members shall refrain in their international relations from the threat or use of force against the

territorial integrity or political independence of any state or in any other manner inconsistent

with the purposes of the United Nations which is intended to prohibit all types of force except

those carried out under the aegis of the United Nations or as provided for by the Security

Council45 The only exception to the United Nations Charters as it relates to the Use of Force is

the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed

attack46

International elites have discussed the term ldquouse of forcerdquo in the past because of the

development of chemical and biological weapons and had to move from a kinetic impact based

definition to a results-oriented approach47 Chemical and biological weapons lacked the

characteristic of an explosion or physical force yet these weapons certainly are capable of

destroying life and property Doctor Leigh Armistead a former information warfare instructor at

18

AUACSCSinksAY08

the Joint Forces Staff College cautions that the use of computer network attacks by the military

ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary

that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great

Russia introduced a proposal to the United Nations that banned the use of information

operations Even though the United Nations didnrsquot adopt the law the concern of international

community is fully aware of the impact cyber attacks can have on a nation

The concern over cyber warfare capabilities is that it can generate both non-kinetic and

kinetic effects There has always been the traditional kinetic solution for cyber warfare where a

precision guidance munition destroys a critical information system node Most people assume

computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos

computer system from the safety of onersquos own command and control center but the physical

destruction of a computer system or network by kinetic means also qualifies as cyber warfare

However cyber warfare has also evolved to the point where aggressors can achieve a kinetic

effect without the use of a traditional kinetic weapon A cyber attack on an information system

can shut down a particular node of a power plant causing the system to become inoperative

Even if there wasnrsquot an explosion the attack serves the same purpose

The question raised is do cyber attacks constitute an armed attack Scholars do agree that

some cyber attacks fit comfortably within the United Nations Charter For example a strategic

level cyber attack causing widespread damage and significant casualties would trigger the statersquos

right of self-defense In addition a cyber attack that precluded a conventional attack or a series

of cyber attacks causing significant damage would give a state the right of self-defense49 Few

would dispute that a country has the right under international law to respond with military force

19

AUACSCSinksAY08

if a state destroyed or significantly damaged another nationrsquos economic system for example the

New York or London stock exchanges

However some confusion and state-defined interpretation comes into play when the

frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard

Law School argues that cyber attacks require an expansion of the definition on the ldquouse of

forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot

be prohibited by international law50 International scholars recommend ldquoclearer rules of what

kinds of information warfare actions constitute an armed attackrdquo which drives permissible

responses of self-defense51 For example a state-sponsored cyber attack causes damage to a

victimrsquos factory or power plant however the nation claims the incident is an isolated instance

and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under

the United Nations Charter and the United Nations would consider any response retaliation

which would violate international law52

Another example involves a nation conducting a series of small attacks causing minimal

damage and then ceases Even though the aggressor used force to conduct cyber warfare

operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under

the United Nations Charter This type of attack is analogues to a small band of troops crossing a

border without causing significant damage53 According to the United Nations Charter the

national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders

and respond to the use of force Repelling the small band of troops and reestablishing their

sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration

of war and allies would have to respect the United Nations decision and couldnrsquot intervene The

same is true for the cyber attack A state can employ defensive measure to isolate and defeat the

20

AUACSCSinksAY08

incursion over the electromagnetic spectrum However the United Nations would see further

offensive operations or invasive operations as retaliation Therefore a nation must take the

incident whether it is signs of conventional forces on the ground or traces of cyber warfare

incursions in the electromagnetic spectrum to the United Nations to seek restitution

In both of these situations the international law becomes the target for change not

whether cyber warfare is in violation of international law If the law were to change the

international community would then consider the above situations acts of war even if an

adversary used conventional forces As written today the result of an operation remains the

driving factor in determining if an adversary has violated international law The means by which

an adversary conducts military operations may affect how nations react to the situation but

whether an adversary conducts the operation by means of the air land sea space or cyberspace

doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian

Triggs a public international lawyer and member of the Attorney General International Legal

Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over

offences abroad having an intended and substantial effect within a state may be justifiedrdquo54

Therefore the international community must evaluate the effect of a criminal act rather than the

means in which the act was committed

Others claim that because the Internet takes advantages of legal norms where non-state

actors can ignore Western notions of law55 more international laws are needed for cyberspace

However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using

other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the

Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked

aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts

21

AUACSCSinksAY08

against a staterdquo in the cyberspace domain The anonymity of the Internet and their total

disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and

national laws already exist in most countries that prohibit the use of the Internet for terrorist

activities therefore additional international laws wouldnrsquot prevent or deter terrorist from

committing such acts of aggression

International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed

Conflict includes the Martens Clause which extends established custom and humanitarian

principles to new technologies and addresses the ever-changing nature of warfare The

international community designed The Martens Clause ldquoto prevent future unnecessary andor

disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges

crimes by invoking the laws of humanity and public conscience hence their effects and not its

methods

The basic legal premise behind Law of Armed Conflict is that attacks must be limited to

military objectives and collateral damage must be proportionate to military advantages and

forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary

suffering but military commanders and planners need to be aware of the results a particular

action will invoke Russian leadership believes a computer network attack against their

homeland can be a means for executing a variety of escalating responses to include nuclear

attack58 Therefore it is imperative military commanders understand the impact any weapon

system can have on an adversary not just cyber attacks

Not all scholars agree that international law is insufficient to govern cyber warfare

Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace

and the Use of Force states that computer network attacks constitute an unlawful use of force in

22

AUACSCSinksAY08

cyberspace under traditional international law Sharp declared that an armed attack may occur

ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a

way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive

definition of cyber attacks may never be drafted59 The Congressional Research Service also

concluded that ldquothere is little likelihood that the international community will soon generate a

coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations

on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos

conclusion is that the effects of cyber warfare operations are the same as if an adversary

conducted conventional warfare operations where the effect of the attacks are the driving factors

in determining whether an adversary used force or not

The United States Government agrees with Sharprsquos conclusion The offensive

Information Operation strategy for the United States government as described by Doctor

Armistead ties the tools used to conduct military operations back to the desired effect which is

in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning

effects-based operations and operational art focus the Joint Force Commanderrsquos course of action

towards meeting objectives outlined in guidance provided by the National Command Authority

and senior military leadership62 Whether the tools are dropped pamphlets invasive network

attacks or bombs on targets the goal is to produce a desired effect to achieve the overall

objectives and cyber warfare can produce effects that challenge the national security of a nation

Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63

~General T Michael Moseley USAF

23

AUACSCSinksAY08

The cyberspace domain has been around for quite sometime but as technology continues

to advance businesses as well as governmental organizations are becoming more reliant on the

cyberspace domain With that reliance the protection of this critical domain becomes even more

important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the

electromagnetic spectrum by denying and disrupting information demands Scholars claim that

protection needs to include addressing existing international laws expanding them to incorporate

the ever-advancing capabilities emerging in the cyberspace domain

However territorial sovereignty of a nation and the principles of jurisdiction specifically

the Protective Security Principle give nations the right to exercise jurisdiction when an

aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64

While cyberspace is a domain requiring specific attention it relies on assets in the other domains

of land space sea and air in order to operate and international laws for the linear domains do

exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace

but during cyber warfare operations the principles behind the restrictions of foreign military

entering airspace do apply The strategic nature of cyber warfare operations correspond to the

same strategic impact that airpower can inflict upon a nation threatening their independence

While maybe not as dramatic as kinetic effects the results can be just as devastating

Space is relatively straightforward Since a nation canrsquot claim space and over flights of

foreign satellites over a nation is permissible nations must use space for peaceful purposes

Kinetic attacks against space assets are a violation of international law therefore nations would

consider cyber warfare operations against space assets as other than peaceful purposes and a

violation of international law Cyber attacks traversing space assets relate to current military

operations where the military uses space assets to conduct kinetic operations Since international

24

AUACSCSinksAY08

elites havenrsquot considered these kinetic operations as a breach of international law military

commanders can conduct cyber warfare operations through space without fear of violating

international laws for outer space

Crossing international borders without a nationrsquos permission and threatening their

sovereignty is a violation of international law While nations canrsquot consider all border crossings

as an act of war those acts of aggression that threaten the territorial integrity would elicit a

defensive response by the victim nation Whether incursions involve combat vehicles over a

highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are

threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not

have set foot in the nation but according the Protective Security Principle the victim nation has

jurisdiction

Conducting cyber warfare operations from the territorial sea is no different from

conducting operations from within a nationrsquos land or sea borders However the high seas are

very similar in nature to space in that they are reserved for peaceful purposes Therefore

conducting any means of warfare from within the high seas is a violation of international law

and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-

defense

According to Barkham ldquoinformation warfare attacks are in essence territorial

penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then

subject to the jurisdiction of the victim nation who then has the right for self-defense However

due to the global nature of cyberspace aggressors can cross multiple borders and determining

who has jurisdiction demands cooperation among nations The origin and any deliberate staging

locations of the cyber attack will drive who has jurisdiction The crossing of third party borders

25

AUACSCSinksAY08

by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the

aggressors threaten a nationrsquos independence or territorial integrity

Scholars consider cyber warfare operations that involve strategic and operational impacts

as being a means of using force and fall within the legal regime of existing international law

However scholars argue that because cyber warfare includes kinetic and non-kinetic results the

Use of Force definition needs expanding Yet they conclude that an exhaustive definition of

cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare

operations against existing case studies where the effects are evaluated as opposed to the means

even if the operations originated from outside the nationrsquos territorial jurisdiction There is some

authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to

have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade

non-state actors from conducting cyber warfare operations given their willingness to ignore

Western notions of war and their ability to conduct operations anonymously in cyberspace

International laws are in place to that address the ever-changing nature of warfare The

Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a

framework for addressing all warfare to include cyber warfare operations The international

community will need to measure the effects of an operation rather the means Whether its boots

on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a

nationrsquos response

26

AUACSCSinksAY08

End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)

27

AUACSCSinksAY08

44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

28

AUACSCSinksAY08

Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005

Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department

American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)

Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983

Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988

Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)

Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)

IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)

Joint Publication 3-13 Information Operations 13 February 2006

Joint Publication 5-0 Joint Operations Planning 26 December 2006

Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies

Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc

Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College

Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)

Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press

29

AUACSCSinksAY08

Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI

Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)

Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press

Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company

Detter Delupis I The law of war (2000) New York NY Cambridge University Press

Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)

Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College

Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor

Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)

Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)

Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf

Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)

Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College

Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College

Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)

Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA

30

AUACSCSinksAY08

Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)

Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)

Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College

Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology

Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College

Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)

OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center

OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College

OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications

Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991

Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College

Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center

Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)

31

AUACSCSinksAY08

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press

Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA

Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University

Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor

Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661

Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office

Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis

United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC

United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center

Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College

Wesley David C The Military Commander and the Law 2006

32

Page 23: Sinks 0407

AUACSCSinksAY08

the Joint Forces Staff College cautions that the use of computer network attacks by the military

ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary

that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great

Russia introduced a proposal to the United Nations that banned the use of information

operations Even though the United Nations didnrsquot adopt the law the concern of international

community is fully aware of the impact cyber attacks can have on a nation

The concern over cyber warfare capabilities is that it can generate both non-kinetic and

kinetic effects There has always been the traditional kinetic solution for cyber warfare where a

precision guidance munition destroys a critical information system node Most people assume

computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos

computer system from the safety of onersquos own command and control center but the physical

destruction of a computer system or network by kinetic means also qualifies as cyber warfare

However cyber warfare has also evolved to the point where aggressors can achieve a kinetic

effect without the use of a traditional kinetic weapon A cyber attack on an information system

can shut down a particular node of a power plant causing the system to become inoperative

Even if there wasnrsquot an explosion the attack serves the same purpose

The question raised is do cyber attacks constitute an armed attack Scholars do agree that

some cyber attacks fit comfortably within the United Nations Charter For example a strategic

level cyber attack causing widespread damage and significant casualties would trigger the statersquos

right of self-defense In addition a cyber attack that precluded a conventional attack or a series

of cyber attacks causing significant damage would give a state the right of self-defense49 Few

would dispute that a country has the right under international law to respond with military force

19

AUACSCSinksAY08

if a state destroyed or significantly damaged another nationrsquos economic system for example the

New York or London stock exchanges

However some confusion and state-defined interpretation comes into play when the

frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard

Law School argues that cyber attacks require an expansion of the definition on the ldquouse of

forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot

be prohibited by international law50 International scholars recommend ldquoclearer rules of what

kinds of information warfare actions constitute an armed attackrdquo which drives permissible

responses of self-defense51 For example a state-sponsored cyber attack causes damage to a

victimrsquos factory or power plant however the nation claims the incident is an isolated instance

and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under

the United Nations Charter and the United Nations would consider any response retaliation

which would violate international law52

Another example involves a nation conducting a series of small attacks causing minimal

damage and then ceases Even though the aggressor used force to conduct cyber warfare

operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under

the United Nations Charter This type of attack is analogues to a small band of troops crossing a

border without causing significant damage53 According to the United Nations Charter the

national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders

and respond to the use of force Repelling the small band of troops and reestablishing their

sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration

of war and allies would have to respect the United Nations decision and couldnrsquot intervene The

same is true for the cyber attack A state can employ defensive measure to isolate and defeat the

20

AUACSCSinksAY08

incursion over the electromagnetic spectrum However the United Nations would see further

offensive operations or invasive operations as retaliation Therefore a nation must take the

incident whether it is signs of conventional forces on the ground or traces of cyber warfare

incursions in the electromagnetic spectrum to the United Nations to seek restitution

In both of these situations the international law becomes the target for change not

whether cyber warfare is in violation of international law If the law were to change the

international community would then consider the above situations acts of war even if an

adversary used conventional forces As written today the result of an operation remains the

driving factor in determining if an adversary has violated international law The means by which

an adversary conducts military operations may affect how nations react to the situation but

whether an adversary conducts the operation by means of the air land sea space or cyberspace

doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian

Triggs a public international lawyer and member of the Attorney General International Legal

Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over

offences abroad having an intended and substantial effect within a state may be justifiedrdquo54

Therefore the international community must evaluate the effect of a criminal act rather than the

means in which the act was committed

Others claim that because the Internet takes advantages of legal norms where non-state

actors can ignore Western notions of law55 more international laws are needed for cyberspace

However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using

other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the

Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked

aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts

21

AUACSCSinksAY08

against a staterdquo in the cyberspace domain The anonymity of the Internet and their total

disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and

national laws already exist in most countries that prohibit the use of the Internet for terrorist

activities therefore additional international laws wouldnrsquot prevent or deter terrorist from

committing such acts of aggression

International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed

Conflict includes the Martens Clause which extends established custom and humanitarian

principles to new technologies and addresses the ever-changing nature of warfare The

international community designed The Martens Clause ldquoto prevent future unnecessary andor

disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges

crimes by invoking the laws of humanity and public conscience hence their effects and not its

methods

The basic legal premise behind Law of Armed Conflict is that attacks must be limited to

military objectives and collateral damage must be proportionate to military advantages and

forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary

suffering but military commanders and planners need to be aware of the results a particular

action will invoke Russian leadership believes a computer network attack against their

homeland can be a means for executing a variety of escalating responses to include nuclear

attack58 Therefore it is imperative military commanders understand the impact any weapon

system can have on an adversary not just cyber attacks

Not all scholars agree that international law is insufficient to govern cyber warfare

Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace

and the Use of Force states that computer network attacks constitute an unlawful use of force in

22

AUACSCSinksAY08

cyberspace under traditional international law Sharp declared that an armed attack may occur

ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a

way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive

definition of cyber attacks may never be drafted59 The Congressional Research Service also

concluded that ldquothere is little likelihood that the international community will soon generate a

coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations

on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos

conclusion is that the effects of cyber warfare operations are the same as if an adversary

conducted conventional warfare operations where the effect of the attacks are the driving factors

in determining whether an adversary used force or not

The United States Government agrees with Sharprsquos conclusion The offensive

Information Operation strategy for the United States government as described by Doctor

Armistead ties the tools used to conduct military operations back to the desired effect which is

in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning

effects-based operations and operational art focus the Joint Force Commanderrsquos course of action

towards meeting objectives outlined in guidance provided by the National Command Authority

and senior military leadership62 Whether the tools are dropped pamphlets invasive network

attacks or bombs on targets the goal is to produce a desired effect to achieve the overall

objectives and cyber warfare can produce effects that challenge the national security of a nation

Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63

~General T Michael Moseley USAF

23

AUACSCSinksAY08

The cyberspace domain has been around for quite sometime but as technology continues

to advance businesses as well as governmental organizations are becoming more reliant on the

cyberspace domain With that reliance the protection of this critical domain becomes even more

important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the

electromagnetic spectrum by denying and disrupting information demands Scholars claim that

protection needs to include addressing existing international laws expanding them to incorporate

the ever-advancing capabilities emerging in the cyberspace domain

However territorial sovereignty of a nation and the principles of jurisdiction specifically

the Protective Security Principle give nations the right to exercise jurisdiction when an

aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64

While cyberspace is a domain requiring specific attention it relies on assets in the other domains

of land space sea and air in order to operate and international laws for the linear domains do

exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace

but during cyber warfare operations the principles behind the restrictions of foreign military

entering airspace do apply The strategic nature of cyber warfare operations correspond to the

same strategic impact that airpower can inflict upon a nation threatening their independence

While maybe not as dramatic as kinetic effects the results can be just as devastating

Space is relatively straightforward Since a nation canrsquot claim space and over flights of

foreign satellites over a nation is permissible nations must use space for peaceful purposes

Kinetic attacks against space assets are a violation of international law therefore nations would

consider cyber warfare operations against space assets as other than peaceful purposes and a

violation of international law Cyber attacks traversing space assets relate to current military

operations where the military uses space assets to conduct kinetic operations Since international

24

AUACSCSinksAY08

elites havenrsquot considered these kinetic operations as a breach of international law military

commanders can conduct cyber warfare operations through space without fear of violating

international laws for outer space

Crossing international borders without a nationrsquos permission and threatening their

sovereignty is a violation of international law While nations canrsquot consider all border crossings

as an act of war those acts of aggression that threaten the territorial integrity would elicit a

defensive response by the victim nation Whether incursions involve combat vehicles over a

highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are

threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not

have set foot in the nation but according the Protective Security Principle the victim nation has

jurisdiction

Conducting cyber warfare operations from the territorial sea is no different from

conducting operations from within a nationrsquos land or sea borders However the high seas are

very similar in nature to space in that they are reserved for peaceful purposes Therefore

conducting any means of warfare from within the high seas is a violation of international law

and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-

defense

According to Barkham ldquoinformation warfare attacks are in essence territorial

penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then

subject to the jurisdiction of the victim nation who then has the right for self-defense However

due to the global nature of cyberspace aggressors can cross multiple borders and determining

who has jurisdiction demands cooperation among nations The origin and any deliberate staging

locations of the cyber attack will drive who has jurisdiction The crossing of third party borders

25

AUACSCSinksAY08

by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the

aggressors threaten a nationrsquos independence or territorial integrity

Scholars consider cyber warfare operations that involve strategic and operational impacts

as being a means of using force and fall within the legal regime of existing international law

However scholars argue that because cyber warfare includes kinetic and non-kinetic results the

Use of Force definition needs expanding Yet they conclude that an exhaustive definition of

cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare

operations against existing case studies where the effects are evaluated as opposed to the means

even if the operations originated from outside the nationrsquos territorial jurisdiction There is some

authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to

have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade

non-state actors from conducting cyber warfare operations given their willingness to ignore

Western notions of war and their ability to conduct operations anonymously in cyberspace

International laws are in place to that address the ever-changing nature of warfare The

Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a

framework for addressing all warfare to include cyber warfare operations The international

community will need to measure the effects of an operation rather the means Whether its boots

on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a

nationrsquos response

26

AUACSCSinksAY08

End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)

27

AUACSCSinksAY08

44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

28

AUACSCSinksAY08

Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005

Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department

American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)

Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983

Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988

Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)

Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)

IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)

Joint Publication 3-13 Information Operations 13 February 2006

Joint Publication 5-0 Joint Operations Planning 26 December 2006

Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies

Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc

Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College

Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)

Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press

29

AUACSCSinksAY08

Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI

Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)

Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press

Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company

Detter Delupis I The law of war (2000) New York NY Cambridge University Press

Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)

Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College

Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor

Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)

Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)

Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf

Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)

Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College

Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College

Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)

Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA

30

AUACSCSinksAY08

Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)

Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)

Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College

Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology

Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College

Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)

OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center

OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College

OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications

Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991

Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College

Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center

Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)

31

AUACSCSinksAY08

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press

Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA

Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University

Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor

Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661

Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office

Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis

United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC

United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center

Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College

Wesley David C The Military Commander and the Law 2006

32

Page 24: Sinks 0407

AUACSCSinksAY08

if a state destroyed or significantly damaged another nationrsquos economic system for example the

New York or London stock exchanges

However some confusion and state-defined interpretation comes into play when the

frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard

Law School argues that cyber attacks require an expansion of the definition on the ldquouse of

forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot

be prohibited by international law50 International scholars recommend ldquoclearer rules of what

kinds of information warfare actions constitute an armed attackrdquo which drives permissible

responses of self-defense51 For example a state-sponsored cyber attack causes damage to a

victimrsquos factory or power plant however the nation claims the incident is an isolated instance

and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under

the United Nations Charter and the United Nations would consider any response retaliation

which would violate international law52

Another example involves a nation conducting a series of small attacks causing minimal

damage and then ceases Even though the aggressor used force to conduct cyber warfare

operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under

the United Nations Charter This type of attack is analogues to a small band of troops crossing a

border without causing significant damage53 According to the United Nations Charter the

national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders

and respond to the use of force Repelling the small band of troops and reestablishing their

sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration

of war and allies would have to respect the United Nations decision and couldnrsquot intervene The

same is true for the cyber attack A state can employ defensive measure to isolate and defeat the

20

AUACSCSinksAY08

incursion over the electromagnetic spectrum However the United Nations would see further

offensive operations or invasive operations as retaliation Therefore a nation must take the

incident whether it is signs of conventional forces on the ground or traces of cyber warfare

incursions in the electromagnetic spectrum to the United Nations to seek restitution

In both of these situations the international law becomes the target for change not

whether cyber warfare is in violation of international law If the law were to change the

international community would then consider the above situations acts of war even if an

adversary used conventional forces As written today the result of an operation remains the

driving factor in determining if an adversary has violated international law The means by which

an adversary conducts military operations may affect how nations react to the situation but

whether an adversary conducts the operation by means of the air land sea space or cyberspace

doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian

Triggs a public international lawyer and member of the Attorney General International Legal

Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over

offences abroad having an intended and substantial effect within a state may be justifiedrdquo54

Therefore the international community must evaluate the effect of a criminal act rather than the

means in which the act was committed

Others claim that because the Internet takes advantages of legal norms where non-state

actors can ignore Western notions of law55 more international laws are needed for cyberspace

However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using

other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the

Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked

aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts

21

AUACSCSinksAY08

against a staterdquo in the cyberspace domain The anonymity of the Internet and their total

disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and

national laws already exist in most countries that prohibit the use of the Internet for terrorist

activities therefore additional international laws wouldnrsquot prevent or deter terrorist from

committing such acts of aggression

International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed

Conflict includes the Martens Clause which extends established custom and humanitarian

principles to new technologies and addresses the ever-changing nature of warfare The

international community designed The Martens Clause ldquoto prevent future unnecessary andor

disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges

crimes by invoking the laws of humanity and public conscience hence their effects and not its

methods

The basic legal premise behind Law of Armed Conflict is that attacks must be limited to

military objectives and collateral damage must be proportionate to military advantages and

forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary

suffering but military commanders and planners need to be aware of the results a particular

action will invoke Russian leadership believes a computer network attack against their

homeland can be a means for executing a variety of escalating responses to include nuclear

attack58 Therefore it is imperative military commanders understand the impact any weapon

system can have on an adversary not just cyber attacks

Not all scholars agree that international law is insufficient to govern cyber warfare

Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace

and the Use of Force states that computer network attacks constitute an unlawful use of force in

22

AUACSCSinksAY08

cyberspace under traditional international law Sharp declared that an armed attack may occur

ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a

way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive

definition of cyber attacks may never be drafted59 The Congressional Research Service also

concluded that ldquothere is little likelihood that the international community will soon generate a

coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations

on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos

conclusion is that the effects of cyber warfare operations are the same as if an adversary

conducted conventional warfare operations where the effect of the attacks are the driving factors

in determining whether an adversary used force or not

The United States Government agrees with Sharprsquos conclusion The offensive

Information Operation strategy for the United States government as described by Doctor

Armistead ties the tools used to conduct military operations back to the desired effect which is

in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning

effects-based operations and operational art focus the Joint Force Commanderrsquos course of action

towards meeting objectives outlined in guidance provided by the National Command Authority

and senior military leadership62 Whether the tools are dropped pamphlets invasive network

attacks or bombs on targets the goal is to produce a desired effect to achieve the overall

objectives and cyber warfare can produce effects that challenge the national security of a nation

Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63

~General T Michael Moseley USAF

23

AUACSCSinksAY08

The cyberspace domain has been around for quite sometime but as technology continues

to advance businesses as well as governmental organizations are becoming more reliant on the

cyberspace domain With that reliance the protection of this critical domain becomes even more

important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the

electromagnetic spectrum by denying and disrupting information demands Scholars claim that

protection needs to include addressing existing international laws expanding them to incorporate

the ever-advancing capabilities emerging in the cyberspace domain

However territorial sovereignty of a nation and the principles of jurisdiction specifically

the Protective Security Principle give nations the right to exercise jurisdiction when an

aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64

While cyberspace is a domain requiring specific attention it relies on assets in the other domains

of land space sea and air in order to operate and international laws for the linear domains do

exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace

but during cyber warfare operations the principles behind the restrictions of foreign military

entering airspace do apply The strategic nature of cyber warfare operations correspond to the

same strategic impact that airpower can inflict upon a nation threatening their independence

While maybe not as dramatic as kinetic effects the results can be just as devastating

Space is relatively straightforward Since a nation canrsquot claim space and over flights of

foreign satellites over a nation is permissible nations must use space for peaceful purposes

Kinetic attacks against space assets are a violation of international law therefore nations would

consider cyber warfare operations against space assets as other than peaceful purposes and a

violation of international law Cyber attacks traversing space assets relate to current military

operations where the military uses space assets to conduct kinetic operations Since international

24

AUACSCSinksAY08

elites havenrsquot considered these kinetic operations as a breach of international law military

commanders can conduct cyber warfare operations through space without fear of violating

international laws for outer space

Crossing international borders without a nationrsquos permission and threatening their

sovereignty is a violation of international law While nations canrsquot consider all border crossings

as an act of war those acts of aggression that threaten the territorial integrity would elicit a

defensive response by the victim nation Whether incursions involve combat vehicles over a

highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are

threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not

have set foot in the nation but according the Protective Security Principle the victim nation has

jurisdiction

Conducting cyber warfare operations from the territorial sea is no different from

conducting operations from within a nationrsquos land or sea borders However the high seas are

very similar in nature to space in that they are reserved for peaceful purposes Therefore

conducting any means of warfare from within the high seas is a violation of international law

and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-

defense

According to Barkham ldquoinformation warfare attacks are in essence territorial

penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then

subject to the jurisdiction of the victim nation who then has the right for self-defense However

due to the global nature of cyberspace aggressors can cross multiple borders and determining

who has jurisdiction demands cooperation among nations The origin and any deliberate staging

locations of the cyber attack will drive who has jurisdiction The crossing of third party borders

25

AUACSCSinksAY08

by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the

aggressors threaten a nationrsquos independence or territorial integrity

Scholars consider cyber warfare operations that involve strategic and operational impacts

as being a means of using force and fall within the legal regime of existing international law

However scholars argue that because cyber warfare includes kinetic and non-kinetic results the

Use of Force definition needs expanding Yet they conclude that an exhaustive definition of

cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare

operations against existing case studies where the effects are evaluated as opposed to the means

even if the operations originated from outside the nationrsquos territorial jurisdiction There is some

authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to

have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade

non-state actors from conducting cyber warfare operations given their willingness to ignore

Western notions of war and their ability to conduct operations anonymously in cyberspace

International laws are in place to that address the ever-changing nature of warfare The

Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a

framework for addressing all warfare to include cyber warfare operations The international

community will need to measure the effects of an operation rather the means Whether its boots

on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a

nationrsquos response

26

AUACSCSinksAY08

End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)

27

AUACSCSinksAY08

44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

28

AUACSCSinksAY08

Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005

Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department

American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)

Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983

Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988

Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)

Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)

IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)

Joint Publication 3-13 Information Operations 13 February 2006

Joint Publication 5-0 Joint Operations Planning 26 December 2006

Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies

Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc

Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College

Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)

Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press

29

AUACSCSinksAY08

Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI

Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)

Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press

Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company

Detter Delupis I The law of war (2000) New York NY Cambridge University Press

Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)

Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College

Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor

Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)

Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)

Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf

Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)

Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College

Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College

Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)

Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA

30

AUACSCSinksAY08

Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)

Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)

Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College

Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology

Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College

Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)

OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center

OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College

OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications

Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991

Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College

Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center

Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)

31

AUACSCSinksAY08

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press

Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA

Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University

Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor

Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661

Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office

Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis

United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC

United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center

Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College

Wesley David C The Military Commander and the Law 2006

32

Page 25: Sinks 0407

AUACSCSinksAY08

incursion over the electromagnetic spectrum However the United Nations would see further

offensive operations or invasive operations as retaliation Therefore a nation must take the

incident whether it is signs of conventional forces on the ground or traces of cyber warfare

incursions in the electromagnetic spectrum to the United Nations to seek restitution

In both of these situations the international law becomes the target for change not

whether cyber warfare is in violation of international law If the law were to change the

international community would then consider the above situations acts of war even if an

adversary used conventional forces As written today the result of an operation remains the

driving factor in determining if an adversary has violated international law The means by which

an adversary conducts military operations may affect how nations react to the situation but

whether an adversary conducts the operation by means of the air land sea space or cyberspace

doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian

Triggs a public international lawyer and member of the Attorney General International Legal

Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over

offences abroad having an intended and substantial effect within a state may be justifiedrdquo54

Therefore the international community must evaluate the effect of a criminal act rather than the

means in which the act was committed

Others claim that because the Internet takes advantages of legal norms where non-state

actors can ignore Western notions of law55 more international laws are needed for cyberspace

However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using

other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the

Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked

aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts

21

AUACSCSinksAY08

against a staterdquo in the cyberspace domain The anonymity of the Internet and their total

disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and

national laws already exist in most countries that prohibit the use of the Internet for terrorist

activities therefore additional international laws wouldnrsquot prevent or deter terrorist from

committing such acts of aggression

International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed

Conflict includes the Martens Clause which extends established custom and humanitarian

principles to new technologies and addresses the ever-changing nature of warfare The

international community designed The Martens Clause ldquoto prevent future unnecessary andor

disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges

crimes by invoking the laws of humanity and public conscience hence their effects and not its

methods

The basic legal premise behind Law of Armed Conflict is that attacks must be limited to

military objectives and collateral damage must be proportionate to military advantages and

forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary

suffering but military commanders and planners need to be aware of the results a particular

action will invoke Russian leadership believes a computer network attack against their

homeland can be a means for executing a variety of escalating responses to include nuclear

attack58 Therefore it is imperative military commanders understand the impact any weapon

system can have on an adversary not just cyber attacks

Not all scholars agree that international law is insufficient to govern cyber warfare

Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace

and the Use of Force states that computer network attacks constitute an unlawful use of force in

22

AUACSCSinksAY08

cyberspace under traditional international law Sharp declared that an armed attack may occur

ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a

way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive

definition of cyber attacks may never be drafted59 The Congressional Research Service also

concluded that ldquothere is little likelihood that the international community will soon generate a

coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations

on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos

conclusion is that the effects of cyber warfare operations are the same as if an adversary

conducted conventional warfare operations where the effect of the attacks are the driving factors

in determining whether an adversary used force or not

The United States Government agrees with Sharprsquos conclusion The offensive

Information Operation strategy for the United States government as described by Doctor

Armistead ties the tools used to conduct military operations back to the desired effect which is

in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning

effects-based operations and operational art focus the Joint Force Commanderrsquos course of action

towards meeting objectives outlined in guidance provided by the National Command Authority

and senior military leadership62 Whether the tools are dropped pamphlets invasive network

attacks or bombs on targets the goal is to produce a desired effect to achieve the overall

objectives and cyber warfare can produce effects that challenge the national security of a nation

Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63

~General T Michael Moseley USAF

23

AUACSCSinksAY08

The cyberspace domain has been around for quite sometime but as technology continues

to advance businesses as well as governmental organizations are becoming more reliant on the

cyberspace domain With that reliance the protection of this critical domain becomes even more

important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the

electromagnetic spectrum by denying and disrupting information demands Scholars claim that

protection needs to include addressing existing international laws expanding them to incorporate

the ever-advancing capabilities emerging in the cyberspace domain

However territorial sovereignty of a nation and the principles of jurisdiction specifically

the Protective Security Principle give nations the right to exercise jurisdiction when an

aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64

While cyberspace is a domain requiring specific attention it relies on assets in the other domains

of land space sea and air in order to operate and international laws for the linear domains do

exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace

but during cyber warfare operations the principles behind the restrictions of foreign military

entering airspace do apply The strategic nature of cyber warfare operations correspond to the

same strategic impact that airpower can inflict upon a nation threatening their independence

While maybe not as dramatic as kinetic effects the results can be just as devastating

Space is relatively straightforward Since a nation canrsquot claim space and over flights of

foreign satellites over a nation is permissible nations must use space for peaceful purposes

Kinetic attacks against space assets are a violation of international law therefore nations would

consider cyber warfare operations against space assets as other than peaceful purposes and a

violation of international law Cyber attacks traversing space assets relate to current military

operations where the military uses space assets to conduct kinetic operations Since international

24

AUACSCSinksAY08

elites havenrsquot considered these kinetic operations as a breach of international law military

commanders can conduct cyber warfare operations through space without fear of violating

international laws for outer space

Crossing international borders without a nationrsquos permission and threatening their

sovereignty is a violation of international law While nations canrsquot consider all border crossings

as an act of war those acts of aggression that threaten the territorial integrity would elicit a

defensive response by the victim nation Whether incursions involve combat vehicles over a

highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are

threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not

have set foot in the nation but according the Protective Security Principle the victim nation has

jurisdiction

Conducting cyber warfare operations from the territorial sea is no different from

conducting operations from within a nationrsquos land or sea borders However the high seas are

very similar in nature to space in that they are reserved for peaceful purposes Therefore

conducting any means of warfare from within the high seas is a violation of international law

and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-

defense

According to Barkham ldquoinformation warfare attacks are in essence territorial

penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then

subject to the jurisdiction of the victim nation who then has the right for self-defense However

due to the global nature of cyberspace aggressors can cross multiple borders and determining

who has jurisdiction demands cooperation among nations The origin and any deliberate staging

locations of the cyber attack will drive who has jurisdiction The crossing of third party borders

25

AUACSCSinksAY08

by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the

aggressors threaten a nationrsquos independence or territorial integrity

Scholars consider cyber warfare operations that involve strategic and operational impacts

as being a means of using force and fall within the legal regime of existing international law

However scholars argue that because cyber warfare includes kinetic and non-kinetic results the

Use of Force definition needs expanding Yet they conclude that an exhaustive definition of

cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare

operations against existing case studies where the effects are evaluated as opposed to the means

even if the operations originated from outside the nationrsquos territorial jurisdiction There is some

authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to

have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade

non-state actors from conducting cyber warfare operations given their willingness to ignore

Western notions of war and their ability to conduct operations anonymously in cyberspace

International laws are in place to that address the ever-changing nature of warfare The

Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a

framework for addressing all warfare to include cyber warfare operations The international

community will need to measure the effects of an operation rather the means Whether its boots

on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a

nationrsquos response

26

AUACSCSinksAY08

End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)

27

AUACSCSinksAY08

44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

28

AUACSCSinksAY08

Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005

Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department

American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)

Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983

Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988

Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)

Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)

IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)

Joint Publication 3-13 Information Operations 13 February 2006

Joint Publication 5-0 Joint Operations Planning 26 December 2006

Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies

Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc

Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College

Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)

Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press

29

AUACSCSinksAY08

Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI

Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)

Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press

Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company

Detter Delupis I The law of war (2000) New York NY Cambridge University Press

Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)

Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College

Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor

Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)

Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)

Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf

Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)

Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College

Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College

Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)

Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA

30

AUACSCSinksAY08

Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)

Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)

Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College

Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology

Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College

Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)

OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center

OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College

OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications

Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991

Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College

Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center

Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)

31

AUACSCSinksAY08

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press

Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA

Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University

Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor

Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661

Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office

Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis

United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC

United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center

Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College

Wesley David C The Military Commander and the Law 2006

32

Page 26: Sinks 0407

AUACSCSinksAY08

against a staterdquo in the cyberspace domain The anonymity of the Internet and their total

disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and

national laws already exist in most countries that prohibit the use of the Internet for terrorist

activities therefore additional international laws wouldnrsquot prevent or deter terrorist from

committing such acts of aggression

International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed

Conflict includes the Martens Clause which extends established custom and humanitarian

principles to new technologies and addresses the ever-changing nature of warfare The

international community designed The Martens Clause ldquoto prevent future unnecessary andor

disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges

crimes by invoking the laws of humanity and public conscience hence their effects and not its

methods

The basic legal premise behind Law of Armed Conflict is that attacks must be limited to

military objectives and collateral damage must be proportionate to military advantages and

forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary

suffering but military commanders and planners need to be aware of the results a particular

action will invoke Russian leadership believes a computer network attack against their

homeland can be a means for executing a variety of escalating responses to include nuclear

attack58 Therefore it is imperative military commanders understand the impact any weapon

system can have on an adversary not just cyber attacks

Not all scholars agree that international law is insufficient to govern cyber warfare

Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace

and the Use of Force states that computer network attacks constitute an unlawful use of force in

22

AUACSCSinksAY08

cyberspace under traditional international law Sharp declared that an armed attack may occur

ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a

way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive

definition of cyber attacks may never be drafted59 The Congressional Research Service also

concluded that ldquothere is little likelihood that the international community will soon generate a

coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations

on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos

conclusion is that the effects of cyber warfare operations are the same as if an adversary

conducted conventional warfare operations where the effect of the attacks are the driving factors

in determining whether an adversary used force or not

The United States Government agrees with Sharprsquos conclusion The offensive

Information Operation strategy for the United States government as described by Doctor

Armistead ties the tools used to conduct military operations back to the desired effect which is

in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning

effects-based operations and operational art focus the Joint Force Commanderrsquos course of action

towards meeting objectives outlined in guidance provided by the National Command Authority

and senior military leadership62 Whether the tools are dropped pamphlets invasive network

attacks or bombs on targets the goal is to produce a desired effect to achieve the overall

objectives and cyber warfare can produce effects that challenge the national security of a nation

Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63

~General T Michael Moseley USAF

23

AUACSCSinksAY08

The cyberspace domain has been around for quite sometime but as technology continues

to advance businesses as well as governmental organizations are becoming more reliant on the

cyberspace domain With that reliance the protection of this critical domain becomes even more

important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the

electromagnetic spectrum by denying and disrupting information demands Scholars claim that

protection needs to include addressing existing international laws expanding them to incorporate

the ever-advancing capabilities emerging in the cyberspace domain

However territorial sovereignty of a nation and the principles of jurisdiction specifically

the Protective Security Principle give nations the right to exercise jurisdiction when an

aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64

While cyberspace is a domain requiring specific attention it relies on assets in the other domains

of land space sea and air in order to operate and international laws for the linear domains do

exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace

but during cyber warfare operations the principles behind the restrictions of foreign military

entering airspace do apply The strategic nature of cyber warfare operations correspond to the

same strategic impact that airpower can inflict upon a nation threatening their independence

While maybe not as dramatic as kinetic effects the results can be just as devastating

Space is relatively straightforward Since a nation canrsquot claim space and over flights of

foreign satellites over a nation is permissible nations must use space for peaceful purposes

Kinetic attacks against space assets are a violation of international law therefore nations would

consider cyber warfare operations against space assets as other than peaceful purposes and a

violation of international law Cyber attacks traversing space assets relate to current military

operations where the military uses space assets to conduct kinetic operations Since international

24

AUACSCSinksAY08

elites havenrsquot considered these kinetic operations as a breach of international law military

commanders can conduct cyber warfare operations through space without fear of violating

international laws for outer space

Crossing international borders without a nationrsquos permission and threatening their

sovereignty is a violation of international law While nations canrsquot consider all border crossings

as an act of war those acts of aggression that threaten the territorial integrity would elicit a

defensive response by the victim nation Whether incursions involve combat vehicles over a

highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are

threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not

have set foot in the nation but according the Protective Security Principle the victim nation has

jurisdiction

Conducting cyber warfare operations from the territorial sea is no different from

conducting operations from within a nationrsquos land or sea borders However the high seas are

very similar in nature to space in that they are reserved for peaceful purposes Therefore

conducting any means of warfare from within the high seas is a violation of international law

and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-

defense

According to Barkham ldquoinformation warfare attacks are in essence territorial

penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then

subject to the jurisdiction of the victim nation who then has the right for self-defense However

due to the global nature of cyberspace aggressors can cross multiple borders and determining

who has jurisdiction demands cooperation among nations The origin and any deliberate staging

locations of the cyber attack will drive who has jurisdiction The crossing of third party borders

25

AUACSCSinksAY08

by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the

aggressors threaten a nationrsquos independence or territorial integrity

Scholars consider cyber warfare operations that involve strategic and operational impacts

as being a means of using force and fall within the legal regime of existing international law

However scholars argue that because cyber warfare includes kinetic and non-kinetic results the

Use of Force definition needs expanding Yet they conclude that an exhaustive definition of

cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare

operations against existing case studies where the effects are evaluated as opposed to the means

even if the operations originated from outside the nationrsquos territorial jurisdiction There is some

authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to

have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade

non-state actors from conducting cyber warfare operations given their willingness to ignore

Western notions of war and their ability to conduct operations anonymously in cyberspace

International laws are in place to that address the ever-changing nature of warfare The

Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a

framework for addressing all warfare to include cyber warfare operations The international

community will need to measure the effects of an operation rather the means Whether its boots

on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a

nationrsquos response

26

AUACSCSinksAY08

End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)

27

AUACSCSinksAY08

44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

28

AUACSCSinksAY08

Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005

Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department

American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)

Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983

Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988

Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)

Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)

IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)

Joint Publication 3-13 Information Operations 13 February 2006

Joint Publication 5-0 Joint Operations Planning 26 December 2006

Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies

Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc

Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College

Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)

Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press

29

AUACSCSinksAY08

Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI

Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)

Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press

Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company

Detter Delupis I The law of war (2000) New York NY Cambridge University Press

Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)

Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College

Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor

Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)

Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)

Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf

Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)

Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College

Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College

Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)

Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA

30

AUACSCSinksAY08

Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)

Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)

Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College

Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology

Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College

Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)

OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center

OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College

OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications

Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991

Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College

Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center

Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)

31

AUACSCSinksAY08

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press

Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA

Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University

Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor

Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661

Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office

Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis

United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC

United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center

Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College

Wesley David C The Military Commander and the Law 2006

32

Page 27: Sinks 0407

AUACSCSinksAY08

cyberspace under traditional international law Sharp declared that an armed attack may occur

ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a

way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive

definition of cyber attacks may never be drafted59 The Congressional Research Service also

concluded that ldquothere is little likelihood that the international community will soon generate a

coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations

on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos

conclusion is that the effects of cyber warfare operations are the same as if an adversary

conducted conventional warfare operations where the effect of the attacks are the driving factors

in determining whether an adversary used force or not

The United States Government agrees with Sharprsquos conclusion The offensive

Information Operation strategy for the United States government as described by Doctor

Armistead ties the tools used to conduct military operations back to the desired effect which is

in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning

effects-based operations and operational art focus the Joint Force Commanderrsquos course of action

towards meeting objectives outlined in guidance provided by the National Command Authority

and senior military leadership62 Whether the tools are dropped pamphlets invasive network

attacks or bombs on targets the goal is to produce a desired effect to achieve the overall

objectives and cyber warfare can produce effects that challenge the national security of a nation

Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63

~General T Michael Moseley USAF

23

AUACSCSinksAY08

The cyberspace domain has been around for quite sometime but as technology continues

to advance businesses as well as governmental organizations are becoming more reliant on the

cyberspace domain With that reliance the protection of this critical domain becomes even more

important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the

electromagnetic spectrum by denying and disrupting information demands Scholars claim that

protection needs to include addressing existing international laws expanding them to incorporate

the ever-advancing capabilities emerging in the cyberspace domain

However territorial sovereignty of a nation and the principles of jurisdiction specifically

the Protective Security Principle give nations the right to exercise jurisdiction when an

aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64

While cyberspace is a domain requiring specific attention it relies on assets in the other domains

of land space sea and air in order to operate and international laws for the linear domains do

exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace

but during cyber warfare operations the principles behind the restrictions of foreign military

entering airspace do apply The strategic nature of cyber warfare operations correspond to the

same strategic impact that airpower can inflict upon a nation threatening their independence

While maybe not as dramatic as kinetic effects the results can be just as devastating

Space is relatively straightforward Since a nation canrsquot claim space and over flights of

foreign satellites over a nation is permissible nations must use space for peaceful purposes

Kinetic attacks against space assets are a violation of international law therefore nations would

consider cyber warfare operations against space assets as other than peaceful purposes and a

violation of international law Cyber attacks traversing space assets relate to current military

operations where the military uses space assets to conduct kinetic operations Since international

24

AUACSCSinksAY08

elites havenrsquot considered these kinetic operations as a breach of international law military

commanders can conduct cyber warfare operations through space without fear of violating

international laws for outer space

Crossing international borders without a nationrsquos permission and threatening their

sovereignty is a violation of international law While nations canrsquot consider all border crossings

as an act of war those acts of aggression that threaten the territorial integrity would elicit a

defensive response by the victim nation Whether incursions involve combat vehicles over a

highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are

threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not

have set foot in the nation but according the Protective Security Principle the victim nation has

jurisdiction

Conducting cyber warfare operations from the territorial sea is no different from

conducting operations from within a nationrsquos land or sea borders However the high seas are

very similar in nature to space in that they are reserved for peaceful purposes Therefore

conducting any means of warfare from within the high seas is a violation of international law

and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-

defense

According to Barkham ldquoinformation warfare attacks are in essence territorial

penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then

subject to the jurisdiction of the victim nation who then has the right for self-defense However

due to the global nature of cyberspace aggressors can cross multiple borders and determining

who has jurisdiction demands cooperation among nations The origin and any deliberate staging

locations of the cyber attack will drive who has jurisdiction The crossing of third party borders

25

AUACSCSinksAY08

by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the

aggressors threaten a nationrsquos independence or territorial integrity

Scholars consider cyber warfare operations that involve strategic and operational impacts

as being a means of using force and fall within the legal regime of existing international law

However scholars argue that because cyber warfare includes kinetic and non-kinetic results the

Use of Force definition needs expanding Yet they conclude that an exhaustive definition of

cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare

operations against existing case studies where the effects are evaluated as opposed to the means

even if the operations originated from outside the nationrsquos territorial jurisdiction There is some

authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to

have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade

non-state actors from conducting cyber warfare operations given their willingness to ignore

Western notions of war and their ability to conduct operations anonymously in cyberspace

International laws are in place to that address the ever-changing nature of warfare The

Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a

framework for addressing all warfare to include cyber warfare operations The international

community will need to measure the effects of an operation rather the means Whether its boots

on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a

nationrsquos response

26

AUACSCSinksAY08

End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)

27

AUACSCSinksAY08

44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

28

AUACSCSinksAY08

Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005

Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department

American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)

Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983

Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988

Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)

Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)

IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)

Joint Publication 3-13 Information Operations 13 February 2006

Joint Publication 5-0 Joint Operations Planning 26 December 2006

Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies

Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc

Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College

Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)

Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press

29

AUACSCSinksAY08

Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI

Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)

Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press

Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company

Detter Delupis I The law of war (2000) New York NY Cambridge University Press

Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)

Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College

Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor

Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)

Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)

Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf

Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)

Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College

Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College

Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)

Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA

30

AUACSCSinksAY08

Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)

Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)

Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College

Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology

Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College

Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)

OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center

OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College

OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications

Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991

Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College

Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center

Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)

31

AUACSCSinksAY08

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press

Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA

Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University

Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor

Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661

Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office

Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis

United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC

United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center

Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College

Wesley David C The Military Commander and the Law 2006

32

Page 28: Sinks 0407

AUACSCSinksAY08

The cyberspace domain has been around for quite sometime but as technology continues

to advance businesses as well as governmental organizations are becoming more reliant on the

cyberspace domain With that reliance the protection of this critical domain becomes even more

important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the

electromagnetic spectrum by denying and disrupting information demands Scholars claim that

protection needs to include addressing existing international laws expanding them to incorporate

the ever-advancing capabilities emerging in the cyberspace domain

However territorial sovereignty of a nation and the principles of jurisdiction specifically

the Protective Security Principle give nations the right to exercise jurisdiction when an

aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64

While cyberspace is a domain requiring specific attention it relies on assets in the other domains

of land space sea and air in order to operate and international laws for the linear domains do

exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace

but during cyber warfare operations the principles behind the restrictions of foreign military

entering airspace do apply The strategic nature of cyber warfare operations correspond to the

same strategic impact that airpower can inflict upon a nation threatening their independence

While maybe not as dramatic as kinetic effects the results can be just as devastating

Space is relatively straightforward Since a nation canrsquot claim space and over flights of

foreign satellites over a nation is permissible nations must use space for peaceful purposes

Kinetic attacks against space assets are a violation of international law therefore nations would

consider cyber warfare operations against space assets as other than peaceful purposes and a

violation of international law Cyber attacks traversing space assets relate to current military

operations where the military uses space assets to conduct kinetic operations Since international

24

AUACSCSinksAY08

elites havenrsquot considered these kinetic operations as a breach of international law military

commanders can conduct cyber warfare operations through space without fear of violating

international laws for outer space

Crossing international borders without a nationrsquos permission and threatening their

sovereignty is a violation of international law While nations canrsquot consider all border crossings

as an act of war those acts of aggression that threaten the territorial integrity would elicit a

defensive response by the victim nation Whether incursions involve combat vehicles over a

highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are

threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not

have set foot in the nation but according the Protective Security Principle the victim nation has

jurisdiction

Conducting cyber warfare operations from the territorial sea is no different from

conducting operations from within a nationrsquos land or sea borders However the high seas are

very similar in nature to space in that they are reserved for peaceful purposes Therefore

conducting any means of warfare from within the high seas is a violation of international law

and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-

defense

According to Barkham ldquoinformation warfare attacks are in essence territorial

penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then

subject to the jurisdiction of the victim nation who then has the right for self-defense However

due to the global nature of cyberspace aggressors can cross multiple borders and determining

who has jurisdiction demands cooperation among nations The origin and any deliberate staging

locations of the cyber attack will drive who has jurisdiction The crossing of third party borders

25

AUACSCSinksAY08

by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the

aggressors threaten a nationrsquos independence or territorial integrity

Scholars consider cyber warfare operations that involve strategic and operational impacts

as being a means of using force and fall within the legal regime of existing international law

However scholars argue that because cyber warfare includes kinetic and non-kinetic results the

Use of Force definition needs expanding Yet they conclude that an exhaustive definition of

cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare

operations against existing case studies where the effects are evaluated as opposed to the means

even if the operations originated from outside the nationrsquos territorial jurisdiction There is some

authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to

have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade

non-state actors from conducting cyber warfare operations given their willingness to ignore

Western notions of war and their ability to conduct operations anonymously in cyberspace

International laws are in place to that address the ever-changing nature of warfare The

Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a

framework for addressing all warfare to include cyber warfare operations The international

community will need to measure the effects of an operation rather the means Whether its boots

on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a

nationrsquos response

26

AUACSCSinksAY08

End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)

27

AUACSCSinksAY08

44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

28

AUACSCSinksAY08

Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005

Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department

American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)

Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983

Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988

Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)

Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)

IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)

Joint Publication 3-13 Information Operations 13 February 2006

Joint Publication 5-0 Joint Operations Planning 26 December 2006

Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies

Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc

Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College

Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)

Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press

29

AUACSCSinksAY08

Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI

Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)

Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press

Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company

Detter Delupis I The law of war (2000) New York NY Cambridge University Press

Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)

Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College

Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor

Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)

Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)

Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf

Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)

Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College

Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College

Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)

Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA

30

AUACSCSinksAY08

Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)

Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)

Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College

Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology

Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College

Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)

OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center

OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College

OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications

Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991

Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College

Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center

Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)

31

AUACSCSinksAY08

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press

Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA

Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University

Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor

Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661

Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office

Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis

United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC

United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center

Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College

Wesley David C The Military Commander and the Law 2006

32

Page 29: Sinks 0407

AUACSCSinksAY08

elites havenrsquot considered these kinetic operations as a breach of international law military

commanders can conduct cyber warfare operations through space without fear of violating

international laws for outer space

Crossing international borders without a nationrsquos permission and threatening their

sovereignty is a violation of international law While nations canrsquot consider all border crossings

as an act of war those acts of aggression that threaten the territorial integrity would elicit a

defensive response by the victim nation Whether incursions involve combat vehicles over a

highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are

threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not

have set foot in the nation but according the Protective Security Principle the victim nation has

jurisdiction

Conducting cyber warfare operations from the territorial sea is no different from

conducting operations from within a nationrsquos land or sea borders However the high seas are

very similar in nature to space in that they are reserved for peaceful purposes Therefore

conducting any means of warfare from within the high seas is a violation of international law

and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-

defense

According to Barkham ldquoinformation warfare attacks are in essence territorial

penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then

subject to the jurisdiction of the victim nation who then has the right for self-defense However

due to the global nature of cyberspace aggressors can cross multiple borders and determining

who has jurisdiction demands cooperation among nations The origin and any deliberate staging

locations of the cyber attack will drive who has jurisdiction The crossing of third party borders

25

AUACSCSinksAY08

by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the

aggressors threaten a nationrsquos independence or territorial integrity

Scholars consider cyber warfare operations that involve strategic and operational impacts

as being a means of using force and fall within the legal regime of existing international law

However scholars argue that because cyber warfare includes kinetic and non-kinetic results the

Use of Force definition needs expanding Yet they conclude that an exhaustive definition of

cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare

operations against existing case studies where the effects are evaluated as opposed to the means

even if the operations originated from outside the nationrsquos territorial jurisdiction There is some

authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to

have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade

non-state actors from conducting cyber warfare operations given their willingness to ignore

Western notions of war and their ability to conduct operations anonymously in cyberspace

International laws are in place to that address the ever-changing nature of warfare The

Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a

framework for addressing all warfare to include cyber warfare operations The international

community will need to measure the effects of an operation rather the means Whether its boots

on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a

nationrsquos response

26

AUACSCSinksAY08

End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)

27

AUACSCSinksAY08

44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

28

AUACSCSinksAY08

Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005

Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department

American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)

Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983

Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988

Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)

Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)

IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)

Joint Publication 3-13 Information Operations 13 February 2006

Joint Publication 5-0 Joint Operations Planning 26 December 2006

Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies

Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc

Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College

Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)

Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press

29

AUACSCSinksAY08

Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI

Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)

Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press

Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company

Detter Delupis I The law of war (2000) New York NY Cambridge University Press

Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)

Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College

Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor

Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)

Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)

Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf

Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)

Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College

Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College

Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)

Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA

30

AUACSCSinksAY08

Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)

Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)

Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College

Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology

Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College

Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)

OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center

OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College

OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications

Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991

Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College

Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center

Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)

31

AUACSCSinksAY08

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press

Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA

Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University

Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor

Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661

Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office

Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis

United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC

United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center

Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College

Wesley David C The Military Commander and the Law 2006

32

Page 30: Sinks 0407

AUACSCSinksAY08

by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the

aggressors threaten a nationrsquos independence or territorial integrity

Scholars consider cyber warfare operations that involve strategic and operational impacts

as being a means of using force and fall within the legal regime of existing international law

However scholars argue that because cyber warfare includes kinetic and non-kinetic results the

Use of Force definition needs expanding Yet they conclude that an exhaustive definition of

cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare

operations against existing case studies where the effects are evaluated as opposed to the means

even if the operations originated from outside the nationrsquos territorial jurisdiction There is some

authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to

have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade

non-state actors from conducting cyber warfare operations given their willingness to ignore

Western notions of war and their ability to conduct operations anonymously in cyberspace

International laws are in place to that address the ever-changing nature of warfare The

Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a

framework for addressing all warfare to include cyber warfare operations The international

community will need to measure the effects of an operation rather the means Whether its boots

on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a

nationrsquos response

26

AUACSCSinksAY08

End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)

27

AUACSCSinksAY08

44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

28

AUACSCSinksAY08

Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005

Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department

American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)

Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983

Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988

Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)

Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)

IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)

Joint Publication 3-13 Information Operations 13 February 2006

Joint Publication 5-0 Joint Operations Planning 26 December 2006

Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies

Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc

Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College

Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)

Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press

29

AUACSCSinksAY08

Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI

Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)

Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press

Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company

Detter Delupis I The law of war (2000) New York NY Cambridge University Press

Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)

Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College

Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor

Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)

Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)

Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf

Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)

Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College

Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College

Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)

Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA

30

AUACSCSinksAY08

Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)

Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)

Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College

Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology

Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College

Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)

OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center

OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College

OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications

Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991

Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College

Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center

Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)

31

AUACSCSinksAY08

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press

Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA

Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University

Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor

Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661

Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office

Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis

United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC

United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center

Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College

Wesley David C The Military Commander and the Law 2006

32

Page 31: Sinks 0407

AUACSCSinksAY08

End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)

27

AUACSCSinksAY08

44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

28

AUACSCSinksAY08

Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005

Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department

American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)

Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983

Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988

Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)

Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)

IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)

Joint Publication 3-13 Information Operations 13 February 2006

Joint Publication 5-0 Joint Operations Planning 26 December 2006

Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies

Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc

Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College

Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)

Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press

29

AUACSCSinksAY08

Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI

Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)

Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press

Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company

Detter Delupis I The law of war (2000) New York NY Cambridge University Press

Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)

Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College

Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor

Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)

Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)

Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf

Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)

Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College

Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College

Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)

Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA

30

AUACSCSinksAY08

Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)

Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)

Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College

Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology

Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College

Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)

OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center

OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College

OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications

Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991

Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College

Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center

Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)

31

AUACSCSinksAY08

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press

Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA

Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University

Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor

Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661

Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office

Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis

United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC

United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center

Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College

Wesley David C The Military Commander and the Law 2006

32

Page 32: Sinks 0407

AUACSCSinksAY08

44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

28

AUACSCSinksAY08

Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005

Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department

American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)

Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983

Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988

Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)

Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)

IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)

Joint Publication 3-13 Information Operations 13 February 2006

Joint Publication 5-0 Joint Operations Planning 26 December 2006

Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies

Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc

Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College

Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)

Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press

29

AUACSCSinksAY08

Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI

Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)

Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press

Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company

Detter Delupis I The law of war (2000) New York NY Cambridge University Press

Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)

Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College

Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor

Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)

Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)

Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf

Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)

Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College

Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College

Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)

Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA

30

AUACSCSinksAY08

Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)

Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)

Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College

Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology

Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College

Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)

OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center

OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College

OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications

Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991

Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College

Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center

Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)

31

AUACSCSinksAY08

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press

Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA

Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University

Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor

Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661

Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office

Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis

United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC

United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center

Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College

Wesley David C The Military Commander and the Law 2006

32

Page 33: Sinks 0407

AUACSCSinksAY08

Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005

Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department

American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402

Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)

Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983

Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988

Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)

Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)

IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)

Joint Publication 3-13 Information Operations 13 February 2006

Joint Publication 5-0 Joint Operations Planning 26 December 2006

Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies

Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc

Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College

Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)

Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press

29

AUACSCSinksAY08

Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI

Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)

Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press

Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company

Detter Delupis I The law of war (2000) New York NY Cambridge University Press

Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)

Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College

Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor

Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)

Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)

Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf

Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)

Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College

Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College

Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)

Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA

30

AUACSCSinksAY08

Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)

Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)

Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College

Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology

Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College

Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)

OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center

OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College

OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications

Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991

Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College

Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center

Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)

31

AUACSCSinksAY08

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press

Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA

Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University

Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor

Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661

Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office

Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis

United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC

United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center

Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College

Wesley David C The Military Commander and the Law 2006

32

Page 34: Sinks 0407

AUACSCSinksAY08

Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI

Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)

Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press

Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company

Detter Delupis I The law of war (2000) New York NY Cambridge University Press

Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)

Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College

Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor

Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)

Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)

Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf

Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)

Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College

Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College

Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)

Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA

30

AUACSCSinksAY08

Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)

Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)

Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College

Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology

Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College

Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)

OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center

OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College

OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications

Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991

Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College

Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center

Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)

31

AUACSCSinksAY08

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press

Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA

Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University

Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor

Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661

Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office

Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis

United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC

United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center

Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College

Wesley David C The Military Commander and the Law 2006

32

Page 35: Sinks 0407

AUACSCSinksAY08

Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)

Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)

Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College

Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology

Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College

Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)

OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center

OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College

OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications

Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991

Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College

Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center

Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)

31

AUACSCSinksAY08

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press

Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA

Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University

Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor

Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661

Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office

Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis

United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC

United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center

Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College

Wesley David C The Military Commander and the Law 2006

32

Page 36: Sinks 0407

AUACSCSinksAY08

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies

Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press

Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA

Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University

Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor

Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661

Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office

Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis

United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC

United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center

Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College

Wesley David C The Military Commander and the Law 2006

32