Risk
9/18/2012
03:57 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Cyber Warfare Still Poses Legal Questions

A body of accepted international law on cyber warfare slowly is emerging, but more needs to be done to address new world of aggression, civilian and military officials said Tuesday.

Mission Intelligence: NRO's Newest Spy Satellites
Mission Intelligence: NRO's Newest Spy Satellites
(click image for larger view and for slideshow)
Legal norms are emerging in cybersecurity, but many questions about what is legal and what is not in cyber warfare remain unanswered, both in the U.S. and on the international stage, diplomatic and national security officials said Tuesday at an event hosted by U.S. Cyber Command at Fort Meade, Md.

"Attorneys and scholars face a variety of complex legal issues arising around the use of this new technology," Cyber Command chief of staff Rear Adm. Margaret Klein said at the conference. However, she was quick to add, as other speakers also added, that basic agreed-upon legal principles exist. For example: the United States government believes that operations in cyberspace should follow parallel rules for military operations in the real or "kinetic" world.

Klein said that although the leap to cyber warfare represents a shift in the way that the military carries out its operations, it is not dissimilar to other technological leaps that were also accompanied by a lag in the development of related legal norms. Unfortunately, the world is now moving at a much faster pace, and glacial development of the laws of cyber war is not something Klein wants to see. "We don't have that much time," she said.

[ Read White House, Cybersecurity Chiefs Back Proposed Legislation. ]

Col. Gary Brown, Cyber Command's outgoing staff judge advocate, said the laws of cyber espionage are underdeveloped. Typically, he said, international law is silent on espionage, but different norms might emerge in the cyber arena. "We're starting to see public condemnation of espionage and starting to see attribution to foreign nations," he said. "That's an indication that there might be something different about cyber espionage than regular espionage."

Other unanswered questions, according to State Department legal advisor and former Yale Law School dean Harold Koh, include how to deal with the fact that both the military and the private sector use the same communications and data infrastructure and how to address attribution. Furthermore, a number of countries don't agree with the U.S. even on areas of cyber law that U.S. officials consider settled, such as whether established principles of international law even apply to cyberspace at all.

However, Koh said, there are numerous areas in the law of cyber warfare that the U.S. government, at least, does consider to be established. For example, cyber activities might constitute a use of force under international law, and a nation's right to self-defense may be triggered by hacks that amount to either an armed attack--such as where the cyber attack results in loss of life or major property damage--or imminent threat. He also said that principles of a proportional response apply, and that attacks that cause unnecessary incidental loss of human life or property damage could be considered excessive.

"We will be safer the more we can rally other states to the view that these principles do establish meaningful constraints and that there is already law that establishes legal principles in cyberspace," Koh said.

InformationWeek Government's GovCloud 2012 is a day-long event where IT professionals in federal, state, and local government will develop a deeper understanding of the options available today. IT leaders in government and other experts will share best practices and their advice on how to make the right choices. Join us for this insightful gathering of government IT executives to hear firsthand about the challenges and opportunities of cloud computing. It happens in Washington, D.C., on Oct. 17.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5208
Published: 2014-12-22
BKBCopyD.exe in the Batch Management Packages in Yokogawa CENTUM CS 3000 through R3.09.50 and CENTUM VP through R4.03.00 and R5.x through R5.04.00, and Exaopc through R3.72.10, does not require authentication, which allows remote attackers to read arbitrary files via a RETR operation, write to arbit...

CVE-2014-7286
Published: 2014-12-22
Buffer overflow in AClient in Symantec Deployment Solution 6.9 and earlier on Windows XP and Server 2003 allows local users to gain privileges via unspecified vectors.

CVE-2014-8015
Published: 2014-12-22
The Sponsor Portal in Cisco Identity Services Engine (ISE) allows remote authenticated users to obtain access to an arbitrary sponsor's guest account via a modified HTTP request, aka Bug ID CSCur64400.

CVE-2014-8017
Published: 2014-12-22
The periodic-backup feature in Cisco Identity Services Engine (ISE) allows remote attackers to discover backup-encryption passwords via a crafted request that triggers inclusion of a password in a reply, aka Bug ID CSCur41673.

CVE-2014-8018
Published: 2014-12-22
Multiple cross-site scripting (XSS) vulnerabilities in Business Voice Services Manager (BVSM) pages in the Application Software in Cisco Unified Communications Domain Manager 8 allow remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug IDs CSCur19651, CSCur18555, CSCur1...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.