Risk
9/18/2012
03:57 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Cyber Warfare Still Poses Legal Questions

A body of accepted international law on cyber warfare slowly is emerging, but more needs to be done to address new world of aggression, civilian and military officials said Tuesday.

Mission Intelligence: NRO's Newest Spy Satellites
Mission Intelligence: NRO's Newest Spy Satellites
(click image for larger view and for slideshow)
Legal norms are emerging in cybersecurity, but many questions about what is legal and what is not in cyber warfare remain unanswered, both in the U.S. and on the international stage, diplomatic and national security officials said Tuesday at an event hosted by U.S. Cyber Command at Fort Meade, Md.

"Attorneys and scholars face a variety of complex legal issues arising around the use of this new technology," Cyber Command chief of staff Rear Adm. Margaret Klein said at the conference. However, she was quick to add, as other speakers also added, that basic agreed-upon legal principles exist. For example: the United States government believes that operations in cyberspace should follow parallel rules for military operations in the real or "kinetic" world.

Klein said that although the leap to cyber warfare represents a shift in the way that the military carries out its operations, it is not dissimilar to other technological leaps that were also accompanied by a lag in the development of related legal norms. Unfortunately, the world is now moving at a much faster pace, and glacial development of the laws of cyber war is not something Klein wants to see. "We don't have that much time," she said.

[ Read White House, Cybersecurity Chiefs Back Proposed Legislation. ]

Col. Gary Brown, Cyber Command's outgoing staff judge advocate, said the laws of cyber espionage are underdeveloped. Typically, he said, international law is silent on espionage, but different norms might emerge in the cyber arena. "We're starting to see public condemnation of espionage and starting to see attribution to foreign nations," he said. "That's an indication that there might be something different about cyber espionage than regular espionage."

Other unanswered questions, according to State Department legal advisor and former Yale Law School dean Harold Koh, include how to deal with the fact that both the military and the private sector use the same communications and data infrastructure and how to address attribution. Furthermore, a number of countries don't agree with the U.S. even on areas of cyber law that U.S. officials consider settled, such as whether established principles of international law even apply to cyberspace at all.

However, Koh said, there are numerous areas in the law of cyber warfare that the U.S. government, at least, does consider to be established. For example, cyber activities might constitute a use of force under international law, and a nation's right to self-defense may be triggered by hacks that amount to either an armed attack--such as where the cyber attack results in loss of life or major property damage--or imminent threat. He also said that principles of a proportional response apply, and that attacks that cause unnecessary incidental loss of human life or property damage could be considered excessive.

"We will be safer the more we can rally other states to the view that these principles do establish meaningful constraints and that there is already law that establishes legal principles in cyberspace," Koh said.

InformationWeek Government's GovCloud 2012 is a day-long event where IT professionals in federal, state, and local government will develop a deeper understanding of the options available today. IT leaders in government and other experts will share best practices and their advice on how to make the right choices. Join us for this insightful gathering of government IT executives to hear firsthand about the challenges and opportunities of cloud computing. It happens in Washington, D.C., on Oct. 17.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-9728
Published: 2015-08-31
The UDF filesystem implementation in the Linux kernel before 3.18.2 does not validate certain lengths, which allows local users to cause a denial of service (buffer over-read and system crash) via a crafted filesystem image, related to fs/udf/inode.c and fs/udf/symlink.c.

CVE-2014-9729
Published: 2015-08-31
The udf_read_inode function in fs/udf/inode.c in the Linux kernel before 3.18.2 does not ensure a certain data-structure size consistency, which allows local users to cause a denial of service (system crash) via a crafted UDF filesystem image.

CVE-2014-9730
Published: 2015-08-31
The udf_pc_to_char function in fs/udf/symlink.c in the Linux kernel before 3.18.2 relies on component lengths that are unused, which allows local users to cause a denial of service (system crash) via a crafted UDF filesystem image.

CVE-2014-9731
Published: 2015-08-31
The UDF filesystem implementation in the Linux kernel before 3.18.2 does not ensure that space is available for storing a symlink target's name along with a trailing \0 character, which allows local users to obtain sensitive information via a crafted filesystem image, related to fs/udf/symlink.c and...

CVE-2015-1333
Published: 2015-08-31
Memory leak in the __key_link_end function in security/keys/keyring.c in the Linux kernel before 4.1.4 allows local users to cause a denial of service (memory consumption) via many add_key system calls that refer to existing keys.

Dark Reading Radio
Archived Dark Reading Radio
Another Black Hat is in the books and Dark Reading was there. Join the editors as they share their top stories, biggest lessons, and best conversations from the premier security conference.