Inside Cyber Warfare - Jeffrey Carr [167]
* * *
[243] Ellen Nakashima, “US Eyes Preemptive Cyber-Defense Strategy,” Washington Post, August 29, 2010, A15.
[244] Ellen Nakashima, “The Dismantling of Saudi-CIA Web Site Illustrates Need for Clearer Cyberwar Policies,” Washington Post, March 19, 2010.
[245] Christopher Dickey et al., “The Shadow War,” Newsweek, December 20, 2010, p. 28, p. 31 (quoting Stewart Baker).
Cyber Attacks Under International Law: Nonstate Actors
International law presumes that armed conflict is initiated only at the direction of governments and not by private groups or individuals. Governments are the entities that maintain armed forces to participate in armed conflict, and those forces remain under the control and direction of the government. In the age of the Internet, however, nonstate actors such as “hacktivists” or patriotic hackers have complicated the legal landscape. During times of conflict or political tension between states, some members of a state’s citizenry may be motivated to support the country’s war effort or political position by taking direct action. Hacktivists or patriotic hackers are private citizens skilled in cyber attack capabilities who can, on their own, initiate a cyber attack against another state. They can do this without the consent, direction, or control of the state’s government. There have been incidents, however, where it is suspected that hacktivists were encouraged and assisted by the state. For example, when Estonia was subject to “denial of service” attacks in 2007 that disrupted government and commercial functions for weeks, evidence linked the Russian government to the attacks. The Russian government, however, denied any involvement, even though the evidence suggested that the Russian government may have encouraged “patriotic hackers” to conduct the attacks.[246] There are also reports that China is similarly relying on unofficial, semi-private hackers to carry out cyber attacks, while the government denies its involvement. According to Verisign’s iDefense lab, which investigated the attacks against Google in 2010, the IP addresses of the attack “correspond to a single foreign entity consisting either of agents of Chinese state or proxies thereof.”[247]
Under international law, if patriotic hackers carry out a cyber attack against another state that rises to the level of an “armed attack,” the victim state has the legal right, acting in self-defense, to use force against those hackers located within the state. In 1980 the International Court of Justice in the US v. Iran case held that the actions of a state’s citizens can be attributed to the government if the citizens “acted on behalf on [sic] the State, having been charged by some competent organ of the Iranian State to carry out a specific operation.”[248] The court also found that the Iranian government was responsible because it was aware of its obligations under international law to protect the US embassy and its staff, knew of the embassy’s need for help, had the means to assist the embassy, and failed to comply with its obligations.
Proving a link among nonstate actors, hacktivists, and the government may be difficult, impossible, or take too long to confirm in order for legal authority to take swift action. Under such circumstances, states may choose to exercise the right of self-defense in a covert manner, carrying out counter cyber measures directly or through other parties. Depending on the circumstances, a state may choose to carry out the covert action on its own through its intelligence or military forces, or it may choose an indirect avenue of having surrogates conduct the covert action. Delegating the right to others to act in a state’s self-defense has benefits as well as costs, and it ought to be considered carefully by policymakers. During the Cold War, for example, surrogate forces waged the major battles between the superpowers.
International law and state practice has established a state’s right of active defense against