Risk
9/18/2012
03:57 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%
Repost This

Cyber Warfare Still Poses Legal Questions

A body of accepted international law on cyber warfare slowly is emerging, but more needs to be done to address new world of aggression, civilian and military officials said Tuesday.

Mission Intelligence: NRO's Newest Spy Satellites
Mission Intelligence: NRO's Newest Spy Satellites
(click image for larger view and for slideshow)
Legal norms are emerging in cybersecurity, but many questions about what is legal and what is not in cyber warfare remain unanswered, both in the U.S. and on the international stage, diplomatic and national security officials said Tuesday at an event hosted by U.S. Cyber Command at Fort Meade, Md.

"Attorneys and scholars face a variety of complex legal issues arising around the use of this new technology," Cyber Command chief of staff Rear Adm. Margaret Klein said at the conference. However, she was quick to add, as other speakers also added, that basic agreed-upon legal principles exist. For example: the United States government believes that operations in cyberspace should follow parallel rules for military operations in the real or "kinetic" world.

Klein said that although the leap to cyber warfare represents a shift in the way that the military carries out its operations, it is not dissimilar to other technological leaps that were also accompanied by a lag in the development of related legal norms. Unfortunately, the world is now moving at a much faster pace, and glacial development of the laws of cyber war is not something Klein wants to see. "We don't have that much time," she said.

[ Read White House, Cybersecurity Chiefs Back Proposed Legislation. ]

Col. Gary Brown, Cyber Command's outgoing staff judge advocate, said the laws of cyber espionage are underdeveloped. Typically, he said, international law is silent on espionage, but different norms might emerge in the cyber arena. "We're starting to see public condemnation of espionage and starting to see attribution to foreign nations," he said. "That's an indication that there might be something different about cyber espionage than regular espionage."

Other unanswered questions, according to State Department legal advisor and former Yale Law School dean Harold Koh, include how to deal with the fact that both the military and the private sector use the same communications and data infrastructure and how to address attribution. Furthermore, a number of countries don't agree with the U.S. even on areas of cyber law that U.S. officials consider settled, such as whether established principles of international law even apply to cyberspace at all.

However, Koh said, there are numerous areas in the law of cyber warfare that the U.S. government, at least, does consider to be established. For example, cyber activities might constitute a use of force under international law, and a nation's right to self-defense may be triggered by hacks that amount to either an armed attack--such as where the cyber attack results in loss of life or major property damage--or imminent threat. He also said that principles of a proportional response apply, and that attacks that cause unnecessary incidental loss of human life or property damage could be considered excessive.

"We will be safer the more we can rally other states to the view that these principles do establish meaningful constraints and that there is already law that establishes legal principles in cyberspace," Koh said.

InformationWeek Government's GovCloud 2012 is a day-long event where IT professionals in federal, state, and local government will develop a deeper understanding of the options available today. IT leaders in government and other experts will share best practices and their advice on how to make the right choices. Join us for this insightful gathering of government IT executives to hear firsthand about the challenges and opportunities of cloud computing. It happens in Washington, D.C., on Oct. 17.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-5704
Published: 2014-04-15
The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such."

CVE-2013-5705
Published: 2014-04-15
apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by using chunked transfer coding with a capitalized Chunked value in the Transfer-Encoding HTTP header.

CVE-2014-0341
Published: 2014-04-15
Multiple cross-site scripting (XSS) vulnerabilities in PivotX before 2.3.9 allow remote authenticated users to inject arbitrary web script or HTML via the title field to (1) templates_internal/pages.tpl, (2) templates_internal/home.tpl, or (3) templates_internal/entries.tpl; (4) an event field to ob...

CVE-2014-0342
Published: 2014-04-15
Multiple unrestricted file upload vulnerabilities in fileupload.php in PivotX before 2.3.9 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a (1) .php or (2) .php# extension, and then accessing it via unspecified vectors.

CVE-2014-0348
Published: 2014-04-15
The Artiva Agency Single Sign-On (SSO) implementation in Artiva Workstation 1.3.x before 1.3.9, Artiva Rm 3.1 MR7, Artiva Healthcare 5.2 MR5, and Artiva Architect 3.2 MR5, when the domain-name option is enabled, allows remote attackers to login to arbitrary domain accounts by using the corresponding...

Best of the Web