Inside Cyber Warfare - Jeffrey Carr [31]
This limited view of the law of war is problematic for two reasons. First, because active defenses are a form of electronic force, it confines state computer defenses to passive defenses alone, which weakens state defense posture. Second, it forces states to rely on domestic criminal laws to deter cyber attacks, which are ineffective because several major states are unwilling to extradite or prosecute their attackers. Given these problems with the prevailing view of the law of war, states find themselves in a “response crisis” during a cyber attack, forced to decide between effective, but arguably illegal, active defenses, and the less effective, but legal, passive defenses and criminal laws.
More than anything else, the attribution requirement perpetuates the response crisis because it is virtually impossible to attribute cyber attacks during an attack. Although states can trace cyber attacks back to computer servers in another state, conclusively ascertaining the identity of the attacker requires intensive, time-consuming investigation with the assistance of the state of origin. Given the prohibition on responding with force until an attack has been attributed to a state or its agents, coupled with the fact that the vast majority of cyber attacks are conducted by nonstate actors, it should come as no surprise that states are reluctant to treat cyber attacks as acts of war and risk violating international law. This “attribution problem” locks states into the response crisis.
Treating cyber attacks as a criminal matter would not be problematic if passive defenses and criminal laws provided sufficient protection from them. Unfortunately, neither is adequate. While passive defenses are always the first line of defense and reduce the chances of a successful cyber attack, states cannot rely on them to completely secure their critical information systems. Furthermore, passive defenses do little to dissuade attackers from attempting their attacks in the first place. Deterrence comes from criminal laws and the penalties associated with them. However, criminal laws have proven to be impotent to deter international cyber attacks because several major states, such as China and Russia, allow their attackers to operate with impunity when their attackers target rival states.
The Road Ahead: A Proposal to Use Active Defenses
To escape this dilemma, states must use active defenses. Not only will active defenses greatly improve state cyber defenses, but it logically follows that using them will serve as a deterrent to cyber attacks since attackers will not want to subject themselves to counterattack.
As we’ll review in further detail later in this chapter, the legal authority for states to use active defenses flows from the longstanding duty that states have to prevent nonstate actors from using their territory to commit cross-border attacks. Traditionally, this duty only required states to prevent illegal acts that the state knew about beforehand; however, this duty has evolved in response to international terrorism and now requires states to act against groups generally known to carry out illegal acts. In the realm of cyber warfare, this duty should be interpreted to require states to enact and enforce criminal laws to deter cross-border cyber attacks. Otherwise, the current situation that states face with China and Russia will continue to exist. Requiring states to enact and enforce criminal laws against cyber attacks will solve the current crisis in one of two ways: either states will live up to their duty and start enforcing criminal laws against attackers, or states will violate their duty,