Dear gov cyber-ninjas, try not to kill people. Love from the lawyers A NATO-backed manual that attempts to pull together all the bits of international law regarding the "hostile use" of the internet has prohibited attacks against civilian targets. According to the legal experts who helped draw up the manual, attacks in cyberspace should avoid anything that might affect civilian targets such as …
> Politicians (and particularly those of the western "liberal interventionist" bend)
> Règles de Jeu
Choose one.
Our do-gooders have no problem offing several hundreds of thousand if it is "worth it" and mean progress towards the fairy World Of Good.
"hospitals, dams and nuclear power plants" are out... okay... I'm alrite with that!
What about other power plant types? air traffic systems? maritime systems? mobile systems? satellites (in space) and on the ground (set top box networks?)... internet capable vehicles? even drones? missile systems of not a nuclear ability?
How would one be able to define who and how someone is targetting civilian systems? could a malformed DNS response packet be sufficient?
I reckon this whole cyberwar thing is somewhat, just asking for trouble... :-( *shrugs*
War is War and in the end the victors can write the history books.
So if your reasons for declaring war are vague and you do kill lots of innocents, you can dress it up in your memoirs as justified by coming up with all sorts of obscure excuses and lies.
Just make sure that all you enemies are dead, every last one of them, so that they are not in a position to contradict your side of the story.
I can think of a few people this might apply to.
NATO, which now means the USA and the foreign mercenaries provided to it for fee by other governments in return for being allowed import and export privileges.
Essentially we again have the USA helping create yet a set of rules of war for other countries to obey, the violation of which it will use as an excuse for invasion, and which it will itself break on the grounds of necessity.
After telling everyone else these acts violate international law and urging sanctions against countries that commit such acts, when finally faced with the situation countries on other continents almost constantly face, the USA says "How can any country protect its citizens if it is unprepared to use torture?", "War necessitates incarcerating child soldiers" and now "How can civilization work if we don't sabotage enemy nuclear power facilities?"
Of the major powers, the USA is nicer and less corrupt than China and Russia, but it is still one of the most hypocritical immoral nations in the world.
These may be good rules, but if citizens of the world's #1 warrior worshiping nation doesn't see them as applying to themselves what is the point in having them?
Won't people to take their moral queues from Kathryn Bigelow ("the Leni Riefenstahl of Hollywood") be persuaded by Hollywood that this, like any other law of war, is made to be broken by any cowardly country that thinks it might suffer some military or civilian casualties if it obeys them?
I would assume in context, that the real intent is "it's not permissible to cyber-attack an enemy's defibrillator, even if they are a General".
Whether anyone will notice such attacks against less important targets is another matter.
At least someone is putting the effort into reminding governments that Cyber-war is real enough if you're on the receiving end.
They'll have to work on a simplified version, though - reducing it to maybe 10 principles expressed in terms that even a Cabinet Minister can understand without help from his/her assistants. Just so it is clear to them that taking a country down with virtual weapons is not really any more civilised than doing it with physical weapons.
Because the value of this "report" is around zero (I say around, because you can always use it to smash your face against when the hypocritical shit you spew as a world leader makes you feel a little bit uncomfortable)
Then again, the OTHER manual produced makes far more sense, though instead of dams and power plants, it talks about oil fields and water sources....
I have a passing familiarity with the LOAC (Law of Armed Conflict). This process simply applies existing jus in bello to a cyberwar context.
Civilians, medical facilities (and defibrillators, I suppose) and "facilities containing dangerous forces" are protected. That means that dams and nuclear power plants are not legitimate targets for attack. Power plants, airports and so on are legitimate targets if they are directly contributing to the war effort - mobile phone networks are not reasonable targets because the military will not use them (unless you're in the British Army, in which case it's better than Bowman).
One thing that interests me is that a fundamental principle of LOAC is that you must have a uniform/insignia and a chain of command. This is to enforce accountability and ensure that the LOAC is followed. Obviously this has never applied to cyberwar so far, so I'm not sure how any military is going to be held accountable when they can simply deny being behind a given cyber-attack.
The Geneva Conventions date from 1948, post-WW2, as a response to the horrific things that happened in that war. "Germany, you still haven't grasped the whole don't-shoot-prisoners thing, so we're going to make it very clear". A lot of the edge cases in WW2 guided the drafting of the Geneva Conventions.
So the firebombing of Dresden was legal, but now isn't - it violates the proportionality and distinction, and possibly military necessity, principles of LOAC. The dam destruction is actually legal by the four key principles, but violates the "dangerous forces" clause.
This is an interesting essay on that topic:
http://leesandlin.com/articles/LosingTheWar.htm
Basically, by 1944 it was clear that the Axis had lost. Everyone knew it, but they just wouldn't surrender, or even negotiate. Millions had already died, and millions more would die to finish the war - so blowing up some dams, or even using nuclear weapons, were rational decisions at the time.
The main media uses terms like cyberwar and cyber weapons without realizing that there is no definition of these. Cyberwar by most opinions has never occurred. Cyber weapon is a silly term mostly; IT uses 'trojan" and "bot:" to the point. The supposed activity in the Iranian nuke plant wasn't cyber war - it was espionage. War is defined (as best possible) in existing international law and agreements (Hague conventions, Geneva conventions for examples), and there is even a general Law of the Seas (e.g. UNCLOS). But there is no such code in Cyber. We need such before nations or non-state actors act inadvisably (e.g. 1-hack a nuclear plant; 2-boom). This approach from CCD COE is much more intelligent that say, US Cyber command, US DHS's cyber involvement (oh no no no) and much else the US has officially stated.
Real wars are caused by disputes over territory, but what is the point of a cyberwar, except as part of a real war?
What gives any authority the right to write the rules of cyberwar and expect them to be binding for others? What if free and independent individuals decided to collaborate and write their own rules, for instance, declaring that any person or organisation who initiates cyberwar is the enemy of all free people?
Why should we as individuals support or accept any responsibility for the actions of others committing cyber attacks beyond our control, supposedly on behalf of our nation, or other nations to whom our governments are linked?
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
