Risk
9/18/2012
03:57 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%
Repost This

Cyber Warfare Still Poses Legal Questions

A body of accepted international law on cyber warfare slowly is emerging, but more needs to be done to address new world of aggression, civilian and military officials said Tuesday.

Mission Intelligence: NRO's Newest Spy Satellites
Mission Intelligence: NRO's Newest Spy Satellites
(click image for larger view and for slideshow)
Legal norms are emerging in cybersecurity, but many questions about what is legal and what is not in cyber warfare remain unanswered, both in the U.S. and on the international stage, diplomatic and national security officials said Tuesday at an event hosted by U.S. Cyber Command at Fort Meade, Md.

"Attorneys and scholars face a variety of complex legal issues arising around the use of this new technology," Cyber Command chief of staff Rear Adm. Margaret Klein said at the conference. However, she was quick to add, as other speakers also added, that basic agreed-upon legal principles exist. For example: the United States government believes that operations in cyberspace should follow parallel rules for military operations in the real or "kinetic" world.

Klein said that although the leap to cyber warfare represents a shift in the way that the military carries out its operations, it is not dissimilar to other technological leaps that were also accompanied by a lag in the development of related legal norms. Unfortunately, the world is now moving at a much faster pace, and glacial development of the laws of cyber war is not something Klein wants to see. "We don't have that much time," she said.

[ Read White House, Cybersecurity Chiefs Back Proposed Legislation. ]

Col. Gary Brown, Cyber Command's outgoing staff judge advocate, said the laws of cyber espionage are underdeveloped. Typically, he said, international law is silent on espionage, but different norms might emerge in the cyber arena. "We're starting to see public condemnation of espionage and starting to see attribution to foreign nations," he said. "That's an indication that there might be something different about cyber espionage than regular espionage."

Other unanswered questions, according to State Department legal advisor and former Yale Law School dean Harold Koh, include how to deal with the fact that both the military and the private sector use the same communications and data infrastructure and how to address attribution. Furthermore, a number of countries don't agree with the U.S. even on areas of cyber law that U.S. officials consider settled, such as whether established principles of international law even apply to cyberspace at all.

However, Koh said, there are numerous areas in the law of cyber warfare that the U.S. government, at least, does consider to be established. For example, cyber activities might constitute a use of force under international law, and a nation's right to self-defense may be triggered by hacks that amount to either an armed attack--such as where the cyber attack results in loss of life or major property damage--or imminent threat. He also said that principles of a proportional response apply, and that attacks that cause unnecessary incidental loss of human life or property damage could be considered excessive.

"We will be safer the more we can rally other states to the view that these principles do establish meaningful constraints and that there is already law that establishes legal principles in cyberspace," Koh said.

InformationWeek Government's GovCloud 2012 is a day-long event where IT professionals in federal, state, and local government will develop a deeper understanding of the options available today. IT leaders in government and other experts will share best practices and their advice on how to make the right choices. Join us for this insightful gathering of government IT executives to hear firsthand about the challenges and opportunities of cloud computing. It happens in Washington, D.C., on Oct. 17.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-3946
Published: 2014-04-24
Cisco IOS before 15.3(2)S allows remote attackers to bypass interface ACL restrictions in opportunistic circumstances by sending IPv6 packets in an unspecified scenario in which expected packet drops do not occur for "a small percentage" of the packets, aka Bug ID CSCty73682.

CVE-2012-5723
Published: 2014-04-24
Cisco ASR 1000 devices with software before 3.8S, when BDI routing is enabled, allow remote attackers to cause a denial of service (device reload) via crafted (1) broadcast or (2) multicast ICMP packets with fragmentation, aka Bug ID CSCub55948.

CVE-2013-6738
Published: 2014-04-24
Cross-site scripting (XSS) vulnerability in IBM SmartCloud Analytics Log Analysis 1.1 and 1.2 before 1.2.0.0-CSI-SCALA-IF0003 allows remote attackers to inject arbitrary web script or HTML via an invalid query parameter in a response from an OAuth authorization endpoint.

CVE-2014-2391
Published: 2014-04-24
The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain potent...

CVE-2014-2392
Published: 2014-04-24
The E-Mail autoconfiguration feature in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 places a password in a GET request, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer log...

Best of the Web