Risk
9/18/2012
03:57 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Cyber Warfare Still Poses Legal Questions

A body of accepted international law on cyber warfare slowly is emerging, but more needs to be done to address new world of aggression, civilian and military officials said Tuesday.

Mission Intelligence: NRO's Newest Spy Satellites
Mission Intelligence: NRO's Newest Spy Satellites
(click image for larger view and for slideshow)
Legal norms are emerging in cybersecurity, but many questions about what is legal and what is not in cyber warfare remain unanswered, both in the U.S. and on the international stage, diplomatic and national security officials said Tuesday at an event hosted by U.S. Cyber Command at Fort Meade, Md.

"Attorneys and scholars face a variety of complex legal issues arising around the use of this new technology," Cyber Command chief of staff Rear Adm. Margaret Klein said at the conference. However, she was quick to add, as other speakers also added, that basic agreed-upon legal principles exist. For example: the United States government believes that operations in cyberspace should follow parallel rules for military operations in the real or "kinetic" world.

Klein said that although the leap to cyber warfare represents a shift in the way that the military carries out its operations, it is not dissimilar to other technological leaps that were also accompanied by a lag in the development of related legal norms. Unfortunately, the world is now moving at a much faster pace, and glacial development of the laws of cyber war is not something Klein wants to see. "We don't have that much time," she said.

[ Read White House, Cybersecurity Chiefs Back Proposed Legislation. ]

Col. Gary Brown, Cyber Command's outgoing staff judge advocate, said the laws of cyber espionage are underdeveloped. Typically, he said, international law is silent on espionage, but different norms might emerge in the cyber arena. "We're starting to see public condemnation of espionage and starting to see attribution to foreign nations," he said. "That's an indication that there might be something different about cyber espionage than regular espionage."

Other unanswered questions, according to State Department legal advisor and former Yale Law School dean Harold Koh, include how to deal with the fact that both the military and the private sector use the same communications and data infrastructure and how to address attribution. Furthermore, a number of countries don't agree with the U.S. even on areas of cyber law that U.S. officials consider settled, such as whether established principles of international law even apply to cyberspace at all.

However, Koh said, there are numerous areas in the law of cyber warfare that the U.S. government, at least, does consider to be established. For example, cyber activities might constitute a use of force under international law, and a nation's right to self-defense may be triggered by hacks that amount to either an armed attack--such as where the cyber attack results in loss of life or major property damage--or imminent threat. He also said that principles of a proportional response apply, and that attacks that cause unnecessary incidental loss of human life or property damage could be considered excessive.

"We will be safer the more we can rally other states to the view that these principles do establish meaningful constraints and that there is already law that establishes legal principles in cyberspace," Koh said.

InformationWeek Government's GovCloud 2012 is a day-long event where IT professionals in federal, state, and local government will develop a deeper understanding of the options available today. IT leaders in government and other experts will share best practices and their advice on how to make the right choices. Join us for this insightful gathering of government IT executives to hear firsthand about the challenges and opportunities of cloud computing. It happens in Washington, D.C., on Oct. 17.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-1421
Published: 2014-11-25
mountall 1.54, as used in Ubuntu 14.10, does not properly handle the umask when using the mount utility, which allows local users to bypass intended access restrictions via unspecified vectors.

CVE-2014-3605
Published: 2014-11-25
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-6407. Reason: This candidate is a reservation duplicate of CVE-2014-6407. Notes: All CVE users should reference CVE-2014-6407 instead of this candidate. All references and descriptions in this candidate have been removed to pre...

CVE-2014-6093
Published: 2014-11-25
Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 7.0.x before 7.0.0.2 CF29, 8.0.x through 8.0.0.1 CF14, and 8.5.x before 8.5.0 CF02 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

CVE-2014-6196
Published: 2014-11-25
Cross-site scripting (XSS) vulnerability in IBM Web Experience Factory (WEF) 6.1.5 through 8.5.0.1, as used in WebSphere Dashboard Framework (WDF) and Lotus Widget Factory (LWF), allows remote attackers to inject arbitrary web script or HTML by leveraging a Dojo builder error in an unspecified WebSp...

CVE-2014-7247
Published: 2014-11-25
Unspecified vulnerability in JustSystems Ichitaro 2008 through 2011; Ichitaro Government 6, 7, 2008, 2009, and 2010; Ichitaro Pro; Ichitaro Pro 2; Ichitaro 2011 Sou; Ichitaro 2012 Shou; Ichitaro 2013 Gen; and Ichitaro 2014 Tetsu allows remote attackers to execute arbitrary code via a crafted file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?