Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
Indicting Chinese Military Officers Is A Huge Mistake
Newest First  |  Oldest First  |  Threaded View
RyanSepe
RyanSepe,
 User Rank: Ninja
5/30/2014 | 11:40:48 AM
Re: Following orders is often criminalized
This was a very well thought out and articulated response. I agree with most of the points you propose however I think some need to be analyzed.

Equating tortue and genocide to cyber espionage is not equatable on any scale. Following orders is tricky but I believe there is a fine line between the above concepts where a person of good conscience would say that I am willing to perform cyber espionage if that is my job backed by my country over killing and torturing human beings.

There is a moral boundary that is crossed with cyber espionage, however the boundaries may be initialized differently within different environments. Prime example between Chinese and US laws. Meaning that a person could have developed a code of ethics that allows them to perform things differently in China that growing up in the US may not have allowed and vice-versa. If there isn't an overall universal standard, it is hard to enforce such laws on a grand scale.
anon3493590510
anon3493590510,
 User Rank: Apprentice
5/29/2014 | 10:48:54 PM
Following orders is often criminalized
On first reading the position offered in this post seems reasonable and well-founded. But it comes up short in important ways.

The idea that soldiers, following orders that are for them lawful, are immune to criminal sanction by other nations is just wrong. On the contrary, the principle of "comity" which fathers State Immunity laws in most nations makes legal recourse against foreign governments completely unattainable in the circumstances in question. This leaves only recourse against the individuals who actually commit the criminal acts.

Moreover there is an extensive and growing body of international law, certainly post-Nuremberg, that clearly makes individuals accountable for their actions, even under orders that are for them lawful. It is a matter of degree and legal evolution to consider hwo far those laws should reach. The reach may have started at genocide but it has moved beyond that to isolated incidents of torture.

I recognize that there is a vast degree of normative difference between torture and large scale commercial theft. But it is correct to recognize that it is in fact a matter of degree, not principle. The principle has long been breached.

One of the most important reasons for criminalizing the behaviour of individuals under orders of a nation state is to create deterence to the greatest effect possible.

If it is countered that in some or even many cricumstances the criminal actors have no choice, there are well-established defences of coersion and necessity. So the existence of an objective threat is not sufficient cause to abandon the law.

The irony, or perhaps hypocrisy is more accurate, in this case is that the nation state that has been the most obstructive of criminalizing individual behaviour under orders, specifically criminalizing torture, has been the United States.

The U.S. refuses to ratify and will not recognize the authority of the Internaional Crimnal Court to even hear cases of torture, much less cases of theft of intellectual property or commercial espionage.

The U.S. position is precisely that individuals under lawful orders of another nation are subject to prosecution by the United States at the will of the United States, but no one else is competent to prosecute anyone other than their own citizens. That "exceptionalism" does pose a real long term threat to U.S. interests because depriving an indepdent international tribunal of jurisdiction means that offended or hostile foreign governments have the moral foundation laid by the U.S. upon which to build their own national prosecutions of U.S. citizens.

So, while I agree with that particular conclusion I do not accept the proposition that the international community must or should be incapacitated in prosecuting international scale crimes, including commercial espionage. Whether those crimes are prosecuted at an international court or through enabling legislation by national courts, there is no longer a good case that they should go unprosecuted. This already happens with international commercial law, which is enforced by national courts of the nations that are party to, for example trade agreements.

The Snowden distraction actually makes the case for new international norms such as an agreement not to spy on one another's leaders.

Two factual points: what are the sources for the assertion that various Western governments engage in commercial espionage for the private gain of non-government entities? And, while it may or may not be true that the direct frutis of U.S. espionage are not provided for private gain, it is not true that the U.S. does not conduct espionage for commercial purposes. It engages in active spying as part of its trade negotiations and disputes and renders heroic efforts on behalf of relatively small groups of companies such as the pharmaceutical and pesticide companies. No one of them may be given specific intellectual property, but the entire international system is moved to their private advantage, in part with the use of espionage against friendly governments.


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Everything You Need to Know About DNS Attacks
It's important to understand DNS, potential attacks against it, and the tools and techniques required to defend DNS infrastructure. This report answers all the questions you were afraid to ask. Domain Name Service (DNS) is a critical part of any organization's digital infrastructure, but it's also one of the least understood. DNS is designed to be invisible to business professionals, IT stakeholders, and many security professionals, but DNS's threat surface is large and widely targeted. Attackers are causing a great deal of damage with an array of attacks such as denial of service, DNS cache poisoning, DNS hijackin, DNS tunneling, and DNS dangling. They are using DNS infrastructure to take control of inbound and outbound communications and preventing users from accessing the applications they are looking for. To stop attacks on DNS, security teams need to shore up the organization's security hygiene around DNS infrastructure, implement controls such as DNSSEC, and monitor DNS traffic
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-33196
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.
CVE-2023-33185
PUBLISHED: 2023-05-26
Django-SES is a drop-in mail backend for Django. The django_ses library implements a mail backend for Django using AWS Simple Email Service. The library exports the `SESEventWebhookView class` intended to receive signed requests from AWS to handle email bounces, subscriptions, etc. These requests ar...
CVE-2023-33187
PUBLISHED: 2023-05-26
Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `type="text"` via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates `ty...
CVE-2023-33194
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was...
CVE-2023-2879
PUBLISHED: 2023-05-26
GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file