Upload
naqeeb-ahmed-kazia
View
56
Download
0
Embed Size (px)
Citation preview
AUACSCSinksAY08
AIR COMMAND AND STAFF COLLEGE
AIR UNIVERSITY
Cyber Warfare and International Law
by
Michael A Sinks Major USAF
A Research Report Submitted to the Faculty
In Partial Fulfillment of the Graduation Requirements
Advisor Maj Lance E Mathews
Maxwell Air Force Base Alabama
April 2008
AUACSCSinksAY08
Disclaimer
The views expressed in this academic research paper are those of the author(s) and do not
reflect the official policy or position of the US government or the Department of Defense In
accordance with Air Force Instruction 51-303 it is not copyrighted but is the property of the
United States government
ii
AUACSCSinksAY08
Abstract
In land sea and air battles military combatants can see the enemy coming whether itrsquos
the whites of their eyes or a blip on a screen International boundaries easily define when an
aggressor threatens the sovereignty of a nation giving the victim nation the right of jurisdiction
and there are specific international laws that address military operations in space In addition
the international community has defined when an adversaryrsquos use of force threatens a nationrsquos
territorial integrity and political independence
However the global nature of cyberspace and the speed of which victims can experience
cyber attacks force nations to deal with the legal challenges associated with over-the-horizon
military operations Jurisdiction over a cyber attack compounds the legal issues surrounding an
aggressive act that can have a wide-range of effects In addition nations face a very difficult
task in attributing an aggressive act to a particular actor and responding to asymmetric
techniques in cyberspace presents nations with an even more challenging and complicated issue
particularly in the legal regime
Cyberspace relies heavily on the other physical domains to operate and international laws
exist that govern the physical domains or air land sea and space The far-reaching nature of
cyberspace generates jurisdiction challenges that arenrsquot associated with the other domains but
the jurisdiction principles can apply to cyber warfare While scholars argue about the definition
of the Use of Force cyber warfare can have strategic and operational impacts that fall neatly
within existing definitions Finally international committees and oversight organizations have
generated legal precedents that apply to cyber warfare operations Therefore while cyberspace
is its own domain and there are unique demands placed on nations by cyber warfare existing
international laws and definitions are applicable to cyber warfare
iii
AUACSCSinksAY08
Table of Contents
DISCLAIMER II
ABSTRACT III
TABLE OF CONTENTS IV
INTRODUCTION 1
WHAT IS CYBER WARFARE 3 Defining Cyberspace 3 What Cyberspace is Not 4 Defining Cyber Warfare 5
TERRITORIAL SOVEREIGNTY 6 Airspace 7 Space 10 Land 12 Sea 13
APPLYING INTERNATIONAL LAW TO CYBER WARFARE 15 Jurisdiction 15 Use of Force 18 International Laws 22
CONCLUSION 23
END NOTES 27
BIBLIOGRAPHY 29
iv
AUACSCSinksAY08
Introduction We need to be able to think in terms of target effects I picture myself around that same targeting table where you have the fighter pilot the bomber pilot the special operations people and the information warrior As you go down the target list each one takes a turn raising his or her hand saying ldquoI can take that targetrdquo1
~ General (Retired) John P Jumper
The worldrsquos growing reliance on information technology to improve efficiency has
opened a threat to all who become reliant on cyberspace to conduct operationshellipa threat that has
many sources of predators ranging from pranksters to white-collar criminals to terrorists Yet
cyberspace has limited international laws to govern a worldwide domain that is ever expanding
as third world nations begin to invest in information technology and enter the cyberspace realm
to enhance business and military operations As nations begin to rely more on cyberspace as an
effective means of conducting business and military operations the more these operations will
become susceptible to outside aggressive influences whether itrsquos from economic invasions or
disruption of military operations
In addition the threat of military operations in the cyberspace domain is real The
Russian military has incorporated cyber warfare into their doctrine in order to gain information
advantage by affecting an adversaryrsquos information system decision-making processes command
and control and even the populace2 China is pursuing a battalion-sized force of computer
experts trained ldquoto carry out computer network attacks as a means of seeking asymmetrical
advantages over an adversaryrdquo3 The threat doesnrsquot reside just within state actors non-state
actors are incorporating cyber warfare operations into their realm of capabilities Hezbollah has
outlined a strategy to cripple the Israeli government by disrupting normal economic and societal
operations by targeting official websites crashing financial sites knocking out the internet
servers and targeting e-commerce sites4
In land sea and air battles military combatants can see the enemy coming whether itrsquos
1
AUACSCSinksAY08
the whites of their eyes or a blip on a screen International boundaries easily define when an
aggressor threatens the sovereignty of a nation giving the victim nation the right of jurisdiction
and there are specific international laws that address military operations in space In addition
the international community has defined when an adversaryrsquos use of force threatens a nationrsquos
territorial integrity and political independence
However the global nature of cyberspace and the speed of which victims can experience
cyber attacks force nations to deal with the legal challenges associated with over-the-horizon
military operations as commanders can experience battlefield affects with little or no warning
Moreover cyber attacks are much more difficult to define Jurisdiction over a cyber attack that
occurs 7000 miles away that crosses multiple physical domains and spans several international
borders compounds the legal issues surrounding an aggressive act that can have a wide-range of
effects Add the fact that determining the perpetrator proves to be less than speedy as most
cyber warriors can use the Internet ldquoanonymously or as a shell game to hide identitiesrdquo5 nations
face a very difficult task in attributing an aggressive act to a particular actor Responding to
asymmetric techniques tactics and procedures by state and non-state actors have proven to be
difficult for conventional forces Introducing asymmetric tactics in cyberspace presents nations
an even more challenging and complicated issue particularly in the legal regime
Therefore this paper will analyze the need for international guidance for conducting warfare
operations in the cyberspace domain This paper will define cyberspace and cyber warfare in an
effort to set the stage for illustrating the global nature of cyberspace and its reliance on the other
physical domains to conduct military operations The paper will define the international law as it
relates to territorial boundaries and outline the jurisdiction principles that allow a nation to act
against an adversary This paper outlines the definition of the Use of Force and how it
2
AUACSCSinksAY08
corresponds to the cyberspace domain and cyber warfare and with the final discussion centered
on the international laws that already exist which help shape international law for cyberspace
What is Cyber Warfare Very few of the new manifestations in war can be ascribed to new inventions or new departures in ideas6
~Carl Von Clausewitz
Defining Cyberspace William Gibson coined the term ldquocyberspacerdquo in his 1984 novel Neuromancer in order to
describe ldquoa shared virtual environment whose inhabitants objects and spaces comprise data that
is visualized heard and touchedrdquo7 However the most common of definitions today refer to the
Internet or the World Wide Web and usually consists of an information-sharing environment
between computers8 However the military has defined cyberspace to advocate a worldwide
spectrum of more than just information sharing among computers
In the National Military Strategy for Cyberspace Operations cyberspace is defined as a
domain characterized by the use of electronics and the electromagnetic spectrum to store
modify and exchange data via networked systems and associated physical infrastructure9 Joint
doctrine has adopted a computer-centric definition where cyberspace is ldquothe notional
environment in which digitized information is communicated over networksrdquo10 The National
Military Strategy and joint doctrine definitions advocate a worldwide information environment
that isnrsquot limited to the Internet or to just computers Matter of fact the expanded definitions
suggest that cyberspace consists of all networks to include highly sensitive military
governmental and commercial networks that may or may not use commercial means to store
modify and exchange data These systems include exchange networks like tactical digital
information links (TADIL) links between command and control platforms and air ground and
sea weapon systems In addition because the definition includes the electromagnetic spectrum
3
AUACSCSinksAY08
cyberspace includes ldquocapabilities that are currently considered electronic warfarerdquo11 which Great
Britain exploited in World War II when they introduced radar technology in World War II and is
still applicable with communication and navigational jamming capabilities used in todayrsquos
conflicts
While cyberspace is a unique domain that military commanders must protect in order to
conduct operations more effectively and offers commanders another dimension in which to
exploit weaknesses in an adversaryrsquos ability to project power cyberspace doesnrsquot exist on its
own According to Lt Col Fahrenkreg in the published Air University article title Cyberspace
Define ldquocyberspace exists across the other domains of air land sea and spacerdquo12 There are
clear delineations between the sea land and air Commanders know where the land ends and the
sea begins While there are some discussions as to where airspace ends and space begins the
capabilities and roles associated with each domain are clear Therefore to depict cyberspace as
an autonomous domain is unrealistic as the physical infrastructure of cyberspace and the means
of sharing information within the cyberspace domain resides in one or more of the four linear
domains
What Cyberspace is Not The most confused notion about cyberspace is that information operations and
cyberspace are one in the same Joint Publication 3-13 Information Operations describes the
information environment as a collection of leaders decision makers and systems that process
collect disseminate or act on information consisting of three dimensions the physical
informational and cognitive dimensions13 The goal of information operations is to influence the
cognitive dimension by affecting the decision-making process known affectionately by the Air
Force as the OODA Loop (Observe Orient Decide and Act)14 By disrupting and corrupting
4
AUACSCSinksAY08
information processes military commanders can influence or usurp adversarial human and
automated decision making in the physical and informational dimensions
As stated by Lt Col Fahrenkreg the confusion between cyberspace and information
operations comes from the misunderstanding of cyberspace as an operation rather than a
domain15 Information operation is a capability available to the combatant commander to
generate an effect in one of the five domains It just so happens that cyberspace tends to be the
primary means of delivering the Information Operation capability
Cyberspace connects the physical dimensions with the cognitive process and is a means
to create effects to include disrupting degrading denying the enemy the use of strategic and
operational assets to include command and controls systems power plants telecommunications
and other like targets to affect a statersquos operational and strategic centers of gravity Cyberspace
isnrsquot information or the data residing on a computer but is the means in which users transfer
store or modify information Cyberspace isnrsquot the data sent to a precision guided munition but
the means in which the originator passes the information Cyberspace is the digital super
highway of the electromagnetic spectrum with the ones zeros and electrons as the passengers
Defining Cyber Warfare According to the Institute for Advanced Study of Information Warfare (ASIW) cyber
warfare has become a form of information warfare which ASIW defines as ldquothe offensive and
defensive use of information and information systems to deny exploit corrupt or destroy and
adversaryrsquos information information-based processes information systems and computer-based
networks while protecting onersquos own Such actions are designed to achieve advantages over
military adversariesrdquo16 While this definition doesnrsquot specifically address the electromagnetic
spectrum the definition focuses on information-sharing systems which is where crux of the
cyberspace domain revolves around
5
AUACSCSinksAY08
Joint doctrine defines cyber warfare as those areas of operations that affect the
electromagnetic spectrum to include Computer Network Operations and Electronic Warfare
which are two of the five core operational capabilities of Information Operations Electronic
warfare operations operates across ldquoradio visible micro directed energy and all other
frequenciesrdquo and overlaps with network warfare operations which include ldquoradio nets satellite
links tactical digital information links (TADIL) telemetry digital track files
telecommunications and wireless communication network and systemsrdquo all of which operate
within the electromagnetic spectrum17
Cyber warfare consists of defensive and offensive operations Defensive operations
arenrsquot limited to severing connections or blocking attempts of an adversary trying to corrupt data
modify transmissions or destroy information systems Defensive operations include the
elimination of the adversaryrsquos capability of conducting operations which may involve crossing
sovereign borders in order to complete the task However defensive network operations come in
more than just one form The movies portray computer experts hovering over computers trying
to affect each otherrsquos operations However cyber warfare includes the use of traditional kinetic
effect to disrupt computer network operations of the enemy as a fighter-bomber delivering a
500-pound bomb to destroy a vital mode in a computer network may serve the same purpose as a
computer-centric network attack While this isnrsquot as sexy as a network attack that spans the
globe to degrade the enemyrsquos ability operation within the cyberspace domain the effects are the
same
Territorial Sovereignty In total war it is quite impossible to draw any precise line between military and non-military problems18
~Sir Winston Churchill
6
AUACSCSinksAY08
Cyberspace is certainly a domain that requires unique attention in order for commanders
to effectively and efficiently prosecute combat operations Cyberspace spans the globe using
the physical infrastructure residing within the other linear domains As users pass information
from one site to another data crosses boundaries by means of the cyberspace domain Data
leaves the Iraq area of operation via satellite to a receiving site in Germany Operators route the
information to the United States either through another satellite or by ground to sea-based cables
bound for computer nodes within the United States before arriving in South Carolina where
automated network tools redirect the information to the receiverrsquos location
An adversary attempting to modify corrupt or destroy this information traveling within
the cyberspace domain would at one time or another would cross sovereign borders through air
land sea or space The adversaryrsquos physical presence may not apply as they could conduct
operations from the comforts of their home however a nation could detect the adversaryrsquos
digital presence and could feel the impact of their actions from within their sovereign borders
Therefore as these adversaries span the globe using the cyberspace domain that relies on the
other linear domains to exist does international law apply when boundaries are crossed The
following sections will address the international laws of each physical domain and evaluate how
their principles apply to the cyberspace domain
Airspace Airspace as defined by Doctor Boleslaw A Boczek the internationally renowned expert
on international law ldquois the air pillow above the subjacent territoryrdquo to include ldquoairspace above
international waters and the territorial seardquo The airspace is under complete and exclusive
sovereignty of the subject state19 With that states have jurisdiction over their airspace and
require identification of foreign aircraft along with their intentions According to Dr Boczek
book International Law A Dictionary ldquoentry of national spacehellipmay take place only with the
7
AUACSCSinksAY08
authorization of the territorial staterdquo20 and currently only applies to aircraft Entry into the
airspace would require ldquoall aircraft to identify themselves file flight plans and report their
positionrdquo According to the 1944 Chicago Convention on International Civil Aviation nations
can enter into agreements that allow scheduled international civil air services which usually
include reciprocal agreements covering routes volume and other matters relating to air traffic
However these agreements only apply to civil aviation where state aircraft which include
aircraft belonging to the military customs public services and heads of states must follow more
restrictive procedures upon entering the airspace of a foreign nation21
There are several incidents where states have evoked their right for defending their
national security like the shooting down of a US military reconnaissance aircraft over Soviet
airspace by the Soviet Union in 196022 or the shooting down by Soviet fighter planes of a South
Korean airliner in 198323 The Soviet Union isnrsquot the only nation to protect its airspace as the
United States was responsible for shooting down an Iranian airliner thought to be an attacking
military plane over the Persian Gulf in 198824 These examples illustrate a nationrsquos sovereign
resolve to protect itself when a suspected adversary violated their airspace
Applying international law of airspace to cyberspace doesnrsquot seem too practical Civilian
signals entering a nationrsquos airspace would require nations to enter into agreements to allow
scheduled services and the persons receiving information through airspace would have to be
non-state sponsored Nationrsquos could regulate some cyberspace networks entering airspace like
radio communications that primarily use land-based infrastructure to function However the
very nature of computer networks and the ever-increasing global reach of communication
capabilities severely restrict a nationrsquos ability to monitor the millions of transmissions made on a
daily basis and these signals certainly wouldnrsquot be on any scheduled basis Therefore even if
8
AUACSCSinksAY08
nations made agreements concerning the cyberspace domain nations would have a difficult time
enforcing their terms of agreements unless the terms are very open-ended If they were so open-
ended then the agreement may not be necessary and based on my research nations realize the
futility of establishing these agreements as this author couldnrsquot find any reference to any
agreements that nations have entered into referencing the cyberspace domain
While the international law for civilian aircraft in airspace may not relate well or isnrsquot
feasible to enforce in the cyberspace domain does a nation have that same right to protect itself
from a suspected attack from cyberspace where the attackerrsquos signal enters airspace Does a
nation have the right to ldquoshoot downrdquo a cyberspace attack as it enters their domain through
airspace The whole idea behind restricting airspace from foreign military aircraft is because of
the strategic impact military aircraft can have on a nation As demonstrated in World War II
military aircraft carrying weapons of mass destruction can decimate cities and destroy a nation
with minimal effort The effects generated by military aircraft are quite destructive and garner
specific attention While an aircraft in of itself is relatively harmless the actions taken by the
crew can lead to devastating results
The same is true for cyber attacks The information passing through airspace in the
cyberspace domain is the vehicle however the crew conducting the operation is potentially
creating the same strategic results The cyber attack may not destroy cities but it certainly can
be destructive to a nationrsquos well-being by crippling power sources economic industries water
supply etc all at the blink of an eye while the victim takes several days to determine the
perpetrator Therefore while the international law for airspace may not be specifically relevant
the underlying principles are applicable as cyber attacks can have the same potential strategic
impact as an attack from a military aircraft
9
AUACSCSinksAY08
Space Outer space as defined by Doctor Boczek ldquois the space beyond the air surrounding the
earthrdquo As of 2005 international law doesnrsquot define a demarcation between airspace and outer
space but ldquostates agree that state sovereignty doesnrsquot extend without any limitsrdquo25 Proposals of
where airspace ends and when outer space begins are base on various scientific and technological
criteria (gravitational pull capabilities of air breathing aircraft etc26) Others scientists argue
that defining a boundary between airspace and outer space isnrsquot necessary as it would hinder the
progress of space technology and the legal status would depend on the nature of the activity
While no boundary exists airspace is finite and activity in outer space follows four
fundamentals principles First over flights of foreign satellites over a nation is permissible as
airspace doesnrsquot extend forever Second space ldquointernational law applies to outer space and
celestial bodiesrdquo Third according to the Outer Space Treaty of 1967 states canrsquot claim celestial
bodies or outer space which are not subject to national appropriation therefore are free for use
by all states Finally states must use outer space exclusively for peaceful purposes with specific
bans on weapons of mass destruction However states can use space for other military purposes
like intelligence surveillance and reconnaissance activities 27
Are these international laws and principles applicable to cyberspace Satellites are
certainly an integral part of the space domain Operators control satellites by using the
cyberspace domain and information passes between satellites and ground stations One can
argue that space is a sub-set of the cyberspace domain with satellites serving as computers in
space Global positioning system devices in vehicles interact with satellites all through an
elaborate network as part of the electromagnetic spectrum known as cyberspace Therefore
cyberspace is in space with millions of people using cyberspace everyday
10
AUACSCSinksAY08
The military uses space assets for intelligence surveillance and reconnaissance
knowledge management and command and control Agencies like the National Reconnaissance
Office and National Geospatial-Intelligence Agency obtain high-altitude imagery using a variety
of capabilities to include heat signature resonation Satellites can detect missile launches which
provide vital military information to senior leaders tasked with the security of their nation The
military networks to include decision briefs tasks and emails in Iraq and the Predator feeds in
Afghanistan travel through military and commercial satellites with all the information flowing
through the cyberspace domain With the heavy reliance of cyberspace to operate space assets
and the demands of information flowing through space by businesses it should come as no
surprise that space is a vital component for day-to-day operations of the military
Since cyberspace is an inherent component for space operations it is logical to assume
international law for outer space is applicable to cyberspace as long as an aggressor doesnt
violate the four premises and as long as weapons of mass destruction arenrsquot ldquostationed in outer
spacerdquo 28 Therefore a state would consider a cyber attack against a satellite as other than for
peaceful purposes and according to the fourth premise international law would apply
However what about a cyber attack using satellites as a means of conducting operations
Under todayrsquos current operations international elites havenrsquot considered a cyber attack passing
through space as a violation of international law When a senior leader in Qatar approves a
target set that is executed by a pilot in Nevada by an aircraft in Afghanistan all this information
is transmitted by cyberspace through space The result is that an aircraft renders an air or ground
target inoperable The effect is the same for cyberspace The information flows through space
by way of the cyberspace domain and the result is that an operator has rendered a target
11
AUACSCSinksAY08
inoperable As with airspace the information isnrsquot the cause of the damage but what an operator
does with the information is what constitutes the cyber attack
Land Cyber attacks using resources over land is relatively straightforward International
boundaries are defined as ldquoimaginary lines which separate territorial sovereigntyrdquo 29 which are
mutually agreed upon via international treaties Crossing an international border without
permission from the state is a violation of international law While an illegal immigrant crossing
a border to seek an opportunity to provide for his family is a violation of national law the United
Nation considers a nation-sponsored invasion of another nation that threatens the security and
stability of a nation as a breach in international law and an act of war
However international law doesnrsquot consider all border crossings as an act of war For
example when Nicaraguan troops and arms allegedly crossed the borders of El Salvador the
United Nations determined that incursions didnrsquot threaten El Salvadorrsquos territorial integrity and
stated that neither ldquothese incursions nor the alleged supply of arms may be relied upon as
justifying the exercise of the right of collective self-defenserdquo30 The victim state can repelled the
aggressive act but the United Nations Council wouldnrsquot condone any further military action
taken against the adversary opting for diplomatic or economic solution instead
Does international law apply when an adversary crosses international borders using
cyberspace as the means for conducting warfare operations When an adversarial state crosses a
statersquos boundaries using roads or bridges that connect the two nations the road is the resource
spanning the two nations If the adversary doesnrsquot do anything then returns to their sovereign
borders the aggressor hasnrsquot violated international law However when the adversary uses
weapon systems to affect serious damage the adversary has broken international law and a
12
AUACSCSinksAY08
nation may invoke their right for self-defense and may conduct full-scale operations to neutralize
the threat
A parallel notion is when an adversary uses a copper or fiber optic connection that spans
between two nations The adversary uses the land-based LAN connection as a means for
conducting cyber warfare operations The adversary may cross the borders using cyberspace yet
do nothing The affected state may push the adversary back to its borders but no further actions
are deemed appropriate However once the adversary uses the information transmitted over
cyberspace to cause severe operational or strategic damage the affected state now has the right
of self-defense Cyberspace is the means like the road or bridge for which the adversary
delivered the weapon The affected nation will consider the execution of the adversaryrsquos
information packet or weapon system as an act of aggression and the effect caused by the
weapon is what breeches international law
The difference between these two scenarios is that the adversary using the
electromagnetic spectrum hasnrsquot physically invaded a nationrsquos sovereign borders However
their digital presence crossed sovereign borders and as latter discussed in the paper adversaries
committing an act aggression against a state are now under the jurisdiction of the affected state
Sea ldquoThe territorial sea is a belt of sea adjacent to the (statersquos) coasthellipto include the airspace
aboverdquo as well as the seabed and subsoil31 The territorial sea is subject to the right of innocent
passage by foreign shops giving states the right to transport goods and passengers between ports
All of which is subject to the full sovereignty of the state which according to the United Nations
Convention on the Law of the Sea in 1982 and agreed upon by the majority of its membership in
1982 extends 12 miles from the coast32 The jurisdiction includes crimes where the
consequences extend to the coastal state and disturbs the peace of the country33 A cyber attack
13
AUACSCSinksAY08
conducted within the territorial sea of a nation would be no different from a cyber attack
conducted from within the nationrsquos land borders therefore cyber attacks against a state or even
another state conducted within the territorial seas are subject to current international laws Cyber
attacks originating outside the statersquos sovereign borders but results in affecting a statersquos
resources in their territorial seas would fall under the land and airspace breeches of territorial
sovereignty and would be subject to international law
The high seas on the other hand arenrsquot subject to the sovereignty of any one state The
high seas extend beyond the territorial sea and include the airspace the seabed and the subsoil34
and all states have the right to exercise freedoms on the high seas35 As similarly defined in
space ldquothe high seas shall be reserved for peaceful purposesrdquo as stated by Article 88 of the Law
of the Seas Cooperative36 which is defined as refraining from any threat or use of force (outside
of wartime conflicts)
The very nature of a cyber attack in the high seas lends itself to be a violation of
international law as nations are restricted to conducting peaceful operations in the high seas
The question is whom has jurisdiction of crimes committed in the high seas By applying the
Protective Security Principle of Jurisdiction where an actor threatens a statersquo security and
introducing the United Nationrsquos definition on the Illegal Use of Force extends to the high seas
and for that matter space giving states the right for self-defense as defined by the United Nations
as ldquoan armed attackrdquo The sheer name of cyber attack doesnrsquot immediately lend itself to an
ldquoarmedrdquo cyber attack However the effects generated from a cyber attack can be equivalent to a
traditional conventional attack and the international law would permit a state to take appropriate
countermeasures while notifying the United Nations Security Council37
14
AUACSCSinksAY08
Applying International Law to Cyber Warfare Today we live in an Information Age where communication through cyberspace has forever changed and flattened out worldhellipOur adversaries seek to operate from behind technical legal and international screens as they execute their costly attacks38
~General James E Cartwright Commander United States Strategic Command
Jurisdiction
Understanding the territorial sovereignty principles of a nation is important in applying
cyberspace and cyber warfare to existing international laws While some of these principles and
international laws may not be relevant for the cyberspace domain due to the far-reaching
capability of cyber warfare the jurisdiction of a nation further defines its ability to respond to
aggressive acts by nations in the cyberspace domain There are three jurisdictional principles
that provide nations the right to pursue aggressors that threaten a nationrsquos independence the
Territorial Principle Nationality Principle and the Protective Security Principle
For actions originating within the state the jurisdiction clearly falls within the territorial
principle where a ldquostate has jurisdiction over all crimes committed in its territoryhellipto include
airspace international waters and territorial seasrdquo39 The territorial jurisdiction is subject to
exceptions when dealing with persons from foreign states as in the most popular example of
immunity given to foreign diplomats In this case ldquostates may exercise jurisdiction over its
citizenhellipeven if they are physically outside the statesrsquo territoryrdquo as Doctor Boczek defines as the
Nationality Principle Nations usually agree upon on these concessions states prior to the offense
being committed40
Doctor Boczek defines the Protective Security Principle as a ldquojurisdictional principle
whereby a state my assume jurisdiction over and punish foreign nationals for certain conduct
outside its territory which is directed against its security territorial integrity and political
independencerdquo41 Some states would argue that criticism of a state or government is applicable
15
AUACSCSinksAY08
in applying this principle of jurisdiction However this is too broad of an interpretation and
should be confined to acts that are more tangible in nature like falsification of a statesrsquo official
documents conspiracy to violate immigration of custom laws and illicit drug trafficking42
Would a cyber attack that is deemed to challenge a nationrsquos banking community or bring
down a power source be a direct attack against its security and political independence The
international community easily sees the attack of a power source with kinetic weapons as a
violation of a territorial boundary and a breech of international law The United States viewed
the attack on the Trade Towers as an act of war launching the Global War on Terrorism Would
the United States have viewed the same devastation as if the attack occurred through cyberspace
Would the attack have been less of an act of war if the aggressor remotely controlled domestic
airliners from a foreign country Probably not What happens if the cyber attack caused a fire in
the lower floors of the buildings preventing people from escaping While less dramatic than an
airbus flying into the middle of the towers and maybe more difficult to demonize the crime the
result is the samemdashinnocent people suffering as a result of an adversary trying to threaten a
nationrsquos security
What happens if the suspected cyber attack has violated a nationrsquos territorial boundary in
order to attack a neighboring country or an ally Going from point A to point B in cyberspace is
rarely a direct connection As with the global nature of cyberspace itrsquos conceivable that
adversaries cross several nationsrsquo boundaries to conduct cyber attack operations The question
generated is who has jurisdiction
If the actor committing the crime had used an airplane each nation could claim
jurisdiction as the adversary violated their territorial boundaries and violated international law
More often than not the first state would have acted immediately upon the aggressive act and
16
AUACSCSinksAY08
would have prevented aggressors from completing their task by either forcing the aircraft to land
or turnaround or an even more escalated response of firing upon the aircraft In the air land or
sea the ability for a nationrsquos military forces to respond in a timely manner gives way to the
deterrence factor of not crossing a statersquos boundaries without receiving permission for fear of
reprisal A clear example of this was when Turkey denied the United States the ability deploy
the 4th Infantry Division from its borders at the beginning of Operation Iraqi Freedom Violating
Turkeyrsquos borders without permission would have brought about great repercussions that would
have made Operation Iraqi Freedom even more difficult and could have resulted in an escalation
of the war outside the Iraqi borders43 Another example is when Spain and France denied the
Unites States the use of their airspace when F-111s based in the United Kingdom conducted air
operations in Libya in an effort to eliminate Muammar Khadafy44
However the speeds at which these breeches in territorial boundaries occur make it
difficult for a nation to claim jurisdiction especially when nothing occurred within their
territorial sovereignty The cyber attacks didnrsquot result in any damage to nation as the information
packets passed through their sovereign borders According to territorial boundary description
described by Doctor Boczek the international community doesnrsquot consider the crossing the
border in of itself an act of warmdashserious damage is a driving factor in determining conflict
escalation In addition according to the territorial jurisdiction principle the cyber attack didnrsquot
threaten a nationrsquos security territorial integrity and political independence If the cyber attack or
information originated from within a sovereign territory by a third party then the two nations
would have to work together to resolve the issue and mutual jurisdiction would probably apply
However if the cyber attack didnrsquot physically manifest itself from within their sovereign
territory or the adversary didnrsquot use the nation as a staging area to launch a further attack the
17
AUACSCSinksAY08
international law and the jurisdiction principles would dictate the affected nation would have
jurisdiction
Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security
territorial integrity and political independence Cyberspace utilizes the other domains as a means
of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence
Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of
territorial sovereignty the Protective Security Principle does provide nations the ability to
enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos
sovereignty when it conducts cyber warfare operations However some elites donrsquot consider
cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense
International law specifically article 2 of the United Nations Charters states that a
members shall refrain in their international relations from the threat or use of force against the
territorial integrity or political independence of any state or in any other manner inconsistent
with the purposes of the United Nations which is intended to prohibit all types of force except
those carried out under the aegis of the United Nations or as provided for by the Security
Council45 The only exception to the United Nations Charters as it relates to the Use of Force is
the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed
attack46
International elites have discussed the term ldquouse of forcerdquo in the past because of the
development of chemical and biological weapons and had to move from a kinetic impact based
definition to a results-oriented approach47 Chemical and biological weapons lacked the
characteristic of an explosion or physical force yet these weapons certainly are capable of
destroying life and property Doctor Leigh Armistead a former information warfare instructor at
18
AUACSCSinksAY08
the Joint Forces Staff College cautions that the use of computer network attacks by the military
ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary
that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great
Russia introduced a proposal to the United Nations that banned the use of information
operations Even though the United Nations didnrsquot adopt the law the concern of international
community is fully aware of the impact cyber attacks can have on a nation
The concern over cyber warfare capabilities is that it can generate both non-kinetic and
kinetic effects There has always been the traditional kinetic solution for cyber warfare where a
precision guidance munition destroys a critical information system node Most people assume
computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos
computer system from the safety of onersquos own command and control center but the physical
destruction of a computer system or network by kinetic means also qualifies as cyber warfare
However cyber warfare has also evolved to the point where aggressors can achieve a kinetic
effect without the use of a traditional kinetic weapon A cyber attack on an information system
can shut down a particular node of a power plant causing the system to become inoperative
Even if there wasnrsquot an explosion the attack serves the same purpose
The question raised is do cyber attacks constitute an armed attack Scholars do agree that
some cyber attacks fit comfortably within the United Nations Charter For example a strategic
level cyber attack causing widespread damage and significant casualties would trigger the statersquos
right of self-defense In addition a cyber attack that precluded a conventional attack or a series
of cyber attacks causing significant damage would give a state the right of self-defense49 Few
would dispute that a country has the right under international law to respond with military force
19
AUACSCSinksAY08
if a state destroyed or significantly damaged another nationrsquos economic system for example the
New York or London stock exchanges
However some confusion and state-defined interpretation comes into play when the
frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard
Law School argues that cyber attacks require an expansion of the definition on the ldquouse of
forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot
be prohibited by international law50 International scholars recommend ldquoclearer rules of what
kinds of information warfare actions constitute an armed attackrdquo which drives permissible
responses of self-defense51 For example a state-sponsored cyber attack causes damage to a
victimrsquos factory or power plant however the nation claims the incident is an isolated instance
and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under
the United Nations Charter and the United Nations would consider any response retaliation
which would violate international law52
Another example involves a nation conducting a series of small attacks causing minimal
damage and then ceases Even though the aggressor used force to conduct cyber warfare
operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under
the United Nations Charter This type of attack is analogues to a small band of troops crossing a
border without causing significant damage53 According to the United Nations Charter the
national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders
and respond to the use of force Repelling the small band of troops and reestablishing their
sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration
of war and allies would have to respect the United Nations decision and couldnrsquot intervene The
same is true for the cyber attack A state can employ defensive measure to isolate and defeat the
20
AUACSCSinksAY08
incursion over the electromagnetic spectrum However the United Nations would see further
offensive operations or invasive operations as retaliation Therefore a nation must take the
incident whether it is signs of conventional forces on the ground or traces of cyber warfare
incursions in the electromagnetic spectrum to the United Nations to seek restitution
In both of these situations the international law becomes the target for change not
whether cyber warfare is in violation of international law If the law were to change the
international community would then consider the above situations acts of war even if an
adversary used conventional forces As written today the result of an operation remains the
driving factor in determining if an adversary has violated international law The means by which
an adversary conducts military operations may affect how nations react to the situation but
whether an adversary conducts the operation by means of the air land sea space or cyberspace
doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian
Triggs a public international lawyer and member of the Attorney General International Legal
Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over
offences abroad having an intended and substantial effect within a state may be justifiedrdquo54
Therefore the international community must evaluate the effect of a criminal act rather than the
means in which the act was committed
Others claim that because the Internet takes advantages of legal norms where non-state
actors can ignore Western notions of law55 more international laws are needed for cyberspace
However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using
other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the
Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked
aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts
21
AUACSCSinksAY08
against a staterdquo in the cyberspace domain The anonymity of the Internet and their total
disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and
national laws already exist in most countries that prohibit the use of the Internet for terrorist
activities therefore additional international laws wouldnrsquot prevent or deter terrorist from
committing such acts of aggression
International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed
Conflict includes the Martens Clause which extends established custom and humanitarian
principles to new technologies and addresses the ever-changing nature of warfare The
international community designed The Martens Clause ldquoto prevent future unnecessary andor
disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges
crimes by invoking the laws of humanity and public conscience hence their effects and not its
methods
The basic legal premise behind Law of Armed Conflict is that attacks must be limited to
military objectives and collateral damage must be proportionate to military advantages and
forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary
suffering but military commanders and planners need to be aware of the results a particular
action will invoke Russian leadership believes a computer network attack against their
homeland can be a means for executing a variety of escalating responses to include nuclear
attack58 Therefore it is imperative military commanders understand the impact any weapon
system can have on an adversary not just cyber attacks
Not all scholars agree that international law is insufficient to govern cyber warfare
Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace
and the Use of Force states that computer network attacks constitute an unlawful use of force in
22
AUACSCSinksAY08
cyberspace under traditional international law Sharp declared that an armed attack may occur
ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a
way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive
definition of cyber attacks may never be drafted59 The Congressional Research Service also
concluded that ldquothere is little likelihood that the international community will soon generate a
coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations
on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos
conclusion is that the effects of cyber warfare operations are the same as if an adversary
conducted conventional warfare operations where the effect of the attacks are the driving factors
in determining whether an adversary used force or not
The United States Government agrees with Sharprsquos conclusion The offensive
Information Operation strategy for the United States government as described by Doctor
Armistead ties the tools used to conduct military operations back to the desired effect which is
in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning
effects-based operations and operational art focus the Joint Force Commanderrsquos course of action
towards meeting objectives outlined in guidance provided by the National Command Authority
and senior military leadership62 Whether the tools are dropped pamphlets invasive network
attacks or bombs on targets the goal is to produce a desired effect to achieve the overall
objectives and cyber warfare can produce effects that challenge the national security of a nation
Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63
~General T Michael Moseley USAF
23
AUACSCSinksAY08
The cyberspace domain has been around for quite sometime but as technology continues
to advance businesses as well as governmental organizations are becoming more reliant on the
cyberspace domain With that reliance the protection of this critical domain becomes even more
important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the
electromagnetic spectrum by denying and disrupting information demands Scholars claim that
protection needs to include addressing existing international laws expanding them to incorporate
the ever-advancing capabilities emerging in the cyberspace domain
However territorial sovereignty of a nation and the principles of jurisdiction specifically
the Protective Security Principle give nations the right to exercise jurisdiction when an
aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64
While cyberspace is a domain requiring specific attention it relies on assets in the other domains
of land space sea and air in order to operate and international laws for the linear domains do
exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace
but during cyber warfare operations the principles behind the restrictions of foreign military
entering airspace do apply The strategic nature of cyber warfare operations correspond to the
same strategic impact that airpower can inflict upon a nation threatening their independence
While maybe not as dramatic as kinetic effects the results can be just as devastating
Space is relatively straightforward Since a nation canrsquot claim space and over flights of
foreign satellites over a nation is permissible nations must use space for peaceful purposes
Kinetic attacks against space assets are a violation of international law therefore nations would
consider cyber warfare operations against space assets as other than peaceful purposes and a
violation of international law Cyber attacks traversing space assets relate to current military
operations where the military uses space assets to conduct kinetic operations Since international
24
AUACSCSinksAY08
elites havenrsquot considered these kinetic operations as a breach of international law military
commanders can conduct cyber warfare operations through space without fear of violating
international laws for outer space
Crossing international borders without a nationrsquos permission and threatening their
sovereignty is a violation of international law While nations canrsquot consider all border crossings
as an act of war those acts of aggression that threaten the territorial integrity would elicit a
defensive response by the victim nation Whether incursions involve combat vehicles over a
highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are
threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not
have set foot in the nation but according the Protective Security Principle the victim nation has
jurisdiction
Conducting cyber warfare operations from the territorial sea is no different from
conducting operations from within a nationrsquos land or sea borders However the high seas are
very similar in nature to space in that they are reserved for peaceful purposes Therefore
conducting any means of warfare from within the high seas is a violation of international law
and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-
defense
According to Barkham ldquoinformation warfare attacks are in essence territorial
penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then
subject to the jurisdiction of the victim nation who then has the right for self-defense However
due to the global nature of cyberspace aggressors can cross multiple borders and determining
who has jurisdiction demands cooperation among nations The origin and any deliberate staging
locations of the cyber attack will drive who has jurisdiction The crossing of third party borders
25
AUACSCSinksAY08
by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the
aggressors threaten a nationrsquos independence or territorial integrity
Scholars consider cyber warfare operations that involve strategic and operational impacts
as being a means of using force and fall within the legal regime of existing international law
However scholars argue that because cyber warfare includes kinetic and non-kinetic results the
Use of Force definition needs expanding Yet they conclude that an exhaustive definition of
cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare
operations against existing case studies where the effects are evaluated as opposed to the means
even if the operations originated from outside the nationrsquos territorial jurisdiction There is some
authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to
have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade
non-state actors from conducting cyber warfare operations given their willingness to ignore
Western notions of war and their ability to conduct operations anonymously in cyberspace
International laws are in place to that address the ever-changing nature of warfare The
Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a
framework for addressing all warfare to include cyber warfare operations The international
community will need to measure the effects of an operation rather the means Whether its boots
on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a
nationrsquos response
26
AUACSCSinksAY08
End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)
27
AUACSCSinksAY08
44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
28
AUACSCSinksAY08
Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005
Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department
American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)
Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983
Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988
Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)
Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)
IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)
Joint Publication 3-13 Information Operations 13 February 2006
Joint Publication 5-0 Joint Operations Planning 26 December 2006
Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies
Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc
Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College
Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)
Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press
29
AUACSCSinksAY08
Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI
Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)
Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press
Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company
Detter Delupis I The law of war (2000) New York NY Cambridge University Press
Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)
Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College
Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor
Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)
Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)
Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf
Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)
Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College
Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College
Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)
Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA
30
AUACSCSinksAY08
Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)
Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)
Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College
Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology
Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College
Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)
OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center
OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College
OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications
Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991
Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College
Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center
Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)
31
AUACSCSinksAY08
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press
Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA
Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University
Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor
Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661
Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office
Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis
United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC
United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center
Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College
Wesley David C The Military Commander and the Law 2006
32
AUACSCSinksAY08
Disclaimer
The views expressed in this academic research paper are those of the author(s) and do not
reflect the official policy or position of the US government or the Department of Defense In
accordance with Air Force Instruction 51-303 it is not copyrighted but is the property of the
United States government
ii
AUACSCSinksAY08
Abstract
In land sea and air battles military combatants can see the enemy coming whether itrsquos
the whites of their eyes or a blip on a screen International boundaries easily define when an
aggressor threatens the sovereignty of a nation giving the victim nation the right of jurisdiction
and there are specific international laws that address military operations in space In addition
the international community has defined when an adversaryrsquos use of force threatens a nationrsquos
territorial integrity and political independence
However the global nature of cyberspace and the speed of which victims can experience
cyber attacks force nations to deal with the legal challenges associated with over-the-horizon
military operations Jurisdiction over a cyber attack compounds the legal issues surrounding an
aggressive act that can have a wide-range of effects In addition nations face a very difficult
task in attributing an aggressive act to a particular actor and responding to asymmetric
techniques in cyberspace presents nations with an even more challenging and complicated issue
particularly in the legal regime
Cyberspace relies heavily on the other physical domains to operate and international laws
exist that govern the physical domains or air land sea and space The far-reaching nature of
cyberspace generates jurisdiction challenges that arenrsquot associated with the other domains but
the jurisdiction principles can apply to cyber warfare While scholars argue about the definition
of the Use of Force cyber warfare can have strategic and operational impacts that fall neatly
within existing definitions Finally international committees and oversight organizations have
generated legal precedents that apply to cyber warfare operations Therefore while cyberspace
is its own domain and there are unique demands placed on nations by cyber warfare existing
international laws and definitions are applicable to cyber warfare
iii
AUACSCSinksAY08
Table of Contents
DISCLAIMER II
ABSTRACT III
TABLE OF CONTENTS IV
INTRODUCTION 1
WHAT IS CYBER WARFARE 3 Defining Cyberspace 3 What Cyberspace is Not 4 Defining Cyber Warfare 5
TERRITORIAL SOVEREIGNTY 6 Airspace 7 Space 10 Land 12 Sea 13
APPLYING INTERNATIONAL LAW TO CYBER WARFARE 15 Jurisdiction 15 Use of Force 18 International Laws 22
CONCLUSION 23
END NOTES 27
BIBLIOGRAPHY 29
iv
AUACSCSinksAY08
Introduction We need to be able to think in terms of target effects I picture myself around that same targeting table where you have the fighter pilot the bomber pilot the special operations people and the information warrior As you go down the target list each one takes a turn raising his or her hand saying ldquoI can take that targetrdquo1
~ General (Retired) John P Jumper
The worldrsquos growing reliance on information technology to improve efficiency has
opened a threat to all who become reliant on cyberspace to conduct operationshellipa threat that has
many sources of predators ranging from pranksters to white-collar criminals to terrorists Yet
cyberspace has limited international laws to govern a worldwide domain that is ever expanding
as third world nations begin to invest in information technology and enter the cyberspace realm
to enhance business and military operations As nations begin to rely more on cyberspace as an
effective means of conducting business and military operations the more these operations will
become susceptible to outside aggressive influences whether itrsquos from economic invasions or
disruption of military operations
In addition the threat of military operations in the cyberspace domain is real The
Russian military has incorporated cyber warfare into their doctrine in order to gain information
advantage by affecting an adversaryrsquos information system decision-making processes command
and control and even the populace2 China is pursuing a battalion-sized force of computer
experts trained ldquoto carry out computer network attacks as a means of seeking asymmetrical
advantages over an adversaryrdquo3 The threat doesnrsquot reside just within state actors non-state
actors are incorporating cyber warfare operations into their realm of capabilities Hezbollah has
outlined a strategy to cripple the Israeli government by disrupting normal economic and societal
operations by targeting official websites crashing financial sites knocking out the internet
servers and targeting e-commerce sites4
In land sea and air battles military combatants can see the enemy coming whether itrsquos
1
AUACSCSinksAY08
the whites of their eyes or a blip on a screen International boundaries easily define when an
aggressor threatens the sovereignty of a nation giving the victim nation the right of jurisdiction
and there are specific international laws that address military operations in space In addition
the international community has defined when an adversaryrsquos use of force threatens a nationrsquos
territorial integrity and political independence
However the global nature of cyberspace and the speed of which victims can experience
cyber attacks force nations to deal with the legal challenges associated with over-the-horizon
military operations as commanders can experience battlefield affects with little or no warning
Moreover cyber attacks are much more difficult to define Jurisdiction over a cyber attack that
occurs 7000 miles away that crosses multiple physical domains and spans several international
borders compounds the legal issues surrounding an aggressive act that can have a wide-range of
effects Add the fact that determining the perpetrator proves to be less than speedy as most
cyber warriors can use the Internet ldquoanonymously or as a shell game to hide identitiesrdquo5 nations
face a very difficult task in attributing an aggressive act to a particular actor Responding to
asymmetric techniques tactics and procedures by state and non-state actors have proven to be
difficult for conventional forces Introducing asymmetric tactics in cyberspace presents nations
an even more challenging and complicated issue particularly in the legal regime
Therefore this paper will analyze the need for international guidance for conducting warfare
operations in the cyberspace domain This paper will define cyberspace and cyber warfare in an
effort to set the stage for illustrating the global nature of cyberspace and its reliance on the other
physical domains to conduct military operations The paper will define the international law as it
relates to territorial boundaries and outline the jurisdiction principles that allow a nation to act
against an adversary This paper outlines the definition of the Use of Force and how it
2
AUACSCSinksAY08
corresponds to the cyberspace domain and cyber warfare and with the final discussion centered
on the international laws that already exist which help shape international law for cyberspace
What is Cyber Warfare Very few of the new manifestations in war can be ascribed to new inventions or new departures in ideas6
~Carl Von Clausewitz
Defining Cyberspace William Gibson coined the term ldquocyberspacerdquo in his 1984 novel Neuromancer in order to
describe ldquoa shared virtual environment whose inhabitants objects and spaces comprise data that
is visualized heard and touchedrdquo7 However the most common of definitions today refer to the
Internet or the World Wide Web and usually consists of an information-sharing environment
between computers8 However the military has defined cyberspace to advocate a worldwide
spectrum of more than just information sharing among computers
In the National Military Strategy for Cyberspace Operations cyberspace is defined as a
domain characterized by the use of electronics and the electromagnetic spectrum to store
modify and exchange data via networked systems and associated physical infrastructure9 Joint
doctrine has adopted a computer-centric definition where cyberspace is ldquothe notional
environment in which digitized information is communicated over networksrdquo10 The National
Military Strategy and joint doctrine definitions advocate a worldwide information environment
that isnrsquot limited to the Internet or to just computers Matter of fact the expanded definitions
suggest that cyberspace consists of all networks to include highly sensitive military
governmental and commercial networks that may or may not use commercial means to store
modify and exchange data These systems include exchange networks like tactical digital
information links (TADIL) links between command and control platforms and air ground and
sea weapon systems In addition because the definition includes the electromagnetic spectrum
3
AUACSCSinksAY08
cyberspace includes ldquocapabilities that are currently considered electronic warfarerdquo11 which Great
Britain exploited in World War II when they introduced radar technology in World War II and is
still applicable with communication and navigational jamming capabilities used in todayrsquos
conflicts
While cyberspace is a unique domain that military commanders must protect in order to
conduct operations more effectively and offers commanders another dimension in which to
exploit weaknesses in an adversaryrsquos ability to project power cyberspace doesnrsquot exist on its
own According to Lt Col Fahrenkreg in the published Air University article title Cyberspace
Define ldquocyberspace exists across the other domains of air land sea and spacerdquo12 There are
clear delineations between the sea land and air Commanders know where the land ends and the
sea begins While there are some discussions as to where airspace ends and space begins the
capabilities and roles associated with each domain are clear Therefore to depict cyberspace as
an autonomous domain is unrealistic as the physical infrastructure of cyberspace and the means
of sharing information within the cyberspace domain resides in one or more of the four linear
domains
What Cyberspace is Not The most confused notion about cyberspace is that information operations and
cyberspace are one in the same Joint Publication 3-13 Information Operations describes the
information environment as a collection of leaders decision makers and systems that process
collect disseminate or act on information consisting of three dimensions the physical
informational and cognitive dimensions13 The goal of information operations is to influence the
cognitive dimension by affecting the decision-making process known affectionately by the Air
Force as the OODA Loop (Observe Orient Decide and Act)14 By disrupting and corrupting
4
AUACSCSinksAY08
information processes military commanders can influence or usurp adversarial human and
automated decision making in the physical and informational dimensions
As stated by Lt Col Fahrenkreg the confusion between cyberspace and information
operations comes from the misunderstanding of cyberspace as an operation rather than a
domain15 Information operation is a capability available to the combatant commander to
generate an effect in one of the five domains It just so happens that cyberspace tends to be the
primary means of delivering the Information Operation capability
Cyberspace connects the physical dimensions with the cognitive process and is a means
to create effects to include disrupting degrading denying the enemy the use of strategic and
operational assets to include command and controls systems power plants telecommunications
and other like targets to affect a statersquos operational and strategic centers of gravity Cyberspace
isnrsquot information or the data residing on a computer but is the means in which users transfer
store or modify information Cyberspace isnrsquot the data sent to a precision guided munition but
the means in which the originator passes the information Cyberspace is the digital super
highway of the electromagnetic spectrum with the ones zeros and electrons as the passengers
Defining Cyber Warfare According to the Institute for Advanced Study of Information Warfare (ASIW) cyber
warfare has become a form of information warfare which ASIW defines as ldquothe offensive and
defensive use of information and information systems to deny exploit corrupt or destroy and
adversaryrsquos information information-based processes information systems and computer-based
networks while protecting onersquos own Such actions are designed to achieve advantages over
military adversariesrdquo16 While this definition doesnrsquot specifically address the electromagnetic
spectrum the definition focuses on information-sharing systems which is where crux of the
cyberspace domain revolves around
5
AUACSCSinksAY08
Joint doctrine defines cyber warfare as those areas of operations that affect the
electromagnetic spectrum to include Computer Network Operations and Electronic Warfare
which are two of the five core operational capabilities of Information Operations Electronic
warfare operations operates across ldquoradio visible micro directed energy and all other
frequenciesrdquo and overlaps with network warfare operations which include ldquoradio nets satellite
links tactical digital information links (TADIL) telemetry digital track files
telecommunications and wireless communication network and systemsrdquo all of which operate
within the electromagnetic spectrum17
Cyber warfare consists of defensive and offensive operations Defensive operations
arenrsquot limited to severing connections or blocking attempts of an adversary trying to corrupt data
modify transmissions or destroy information systems Defensive operations include the
elimination of the adversaryrsquos capability of conducting operations which may involve crossing
sovereign borders in order to complete the task However defensive network operations come in
more than just one form The movies portray computer experts hovering over computers trying
to affect each otherrsquos operations However cyber warfare includes the use of traditional kinetic
effect to disrupt computer network operations of the enemy as a fighter-bomber delivering a
500-pound bomb to destroy a vital mode in a computer network may serve the same purpose as a
computer-centric network attack While this isnrsquot as sexy as a network attack that spans the
globe to degrade the enemyrsquos ability operation within the cyberspace domain the effects are the
same
Territorial Sovereignty In total war it is quite impossible to draw any precise line between military and non-military problems18
~Sir Winston Churchill
6
AUACSCSinksAY08
Cyberspace is certainly a domain that requires unique attention in order for commanders
to effectively and efficiently prosecute combat operations Cyberspace spans the globe using
the physical infrastructure residing within the other linear domains As users pass information
from one site to another data crosses boundaries by means of the cyberspace domain Data
leaves the Iraq area of operation via satellite to a receiving site in Germany Operators route the
information to the United States either through another satellite or by ground to sea-based cables
bound for computer nodes within the United States before arriving in South Carolina where
automated network tools redirect the information to the receiverrsquos location
An adversary attempting to modify corrupt or destroy this information traveling within
the cyberspace domain would at one time or another would cross sovereign borders through air
land sea or space The adversaryrsquos physical presence may not apply as they could conduct
operations from the comforts of their home however a nation could detect the adversaryrsquos
digital presence and could feel the impact of their actions from within their sovereign borders
Therefore as these adversaries span the globe using the cyberspace domain that relies on the
other linear domains to exist does international law apply when boundaries are crossed The
following sections will address the international laws of each physical domain and evaluate how
their principles apply to the cyberspace domain
Airspace Airspace as defined by Doctor Boleslaw A Boczek the internationally renowned expert
on international law ldquois the air pillow above the subjacent territoryrdquo to include ldquoairspace above
international waters and the territorial seardquo The airspace is under complete and exclusive
sovereignty of the subject state19 With that states have jurisdiction over their airspace and
require identification of foreign aircraft along with their intentions According to Dr Boczek
book International Law A Dictionary ldquoentry of national spacehellipmay take place only with the
7
AUACSCSinksAY08
authorization of the territorial staterdquo20 and currently only applies to aircraft Entry into the
airspace would require ldquoall aircraft to identify themselves file flight plans and report their
positionrdquo According to the 1944 Chicago Convention on International Civil Aviation nations
can enter into agreements that allow scheduled international civil air services which usually
include reciprocal agreements covering routes volume and other matters relating to air traffic
However these agreements only apply to civil aviation where state aircraft which include
aircraft belonging to the military customs public services and heads of states must follow more
restrictive procedures upon entering the airspace of a foreign nation21
There are several incidents where states have evoked their right for defending their
national security like the shooting down of a US military reconnaissance aircraft over Soviet
airspace by the Soviet Union in 196022 or the shooting down by Soviet fighter planes of a South
Korean airliner in 198323 The Soviet Union isnrsquot the only nation to protect its airspace as the
United States was responsible for shooting down an Iranian airliner thought to be an attacking
military plane over the Persian Gulf in 198824 These examples illustrate a nationrsquos sovereign
resolve to protect itself when a suspected adversary violated their airspace
Applying international law of airspace to cyberspace doesnrsquot seem too practical Civilian
signals entering a nationrsquos airspace would require nations to enter into agreements to allow
scheduled services and the persons receiving information through airspace would have to be
non-state sponsored Nationrsquos could regulate some cyberspace networks entering airspace like
radio communications that primarily use land-based infrastructure to function However the
very nature of computer networks and the ever-increasing global reach of communication
capabilities severely restrict a nationrsquos ability to monitor the millions of transmissions made on a
daily basis and these signals certainly wouldnrsquot be on any scheduled basis Therefore even if
8
AUACSCSinksAY08
nations made agreements concerning the cyberspace domain nations would have a difficult time
enforcing their terms of agreements unless the terms are very open-ended If they were so open-
ended then the agreement may not be necessary and based on my research nations realize the
futility of establishing these agreements as this author couldnrsquot find any reference to any
agreements that nations have entered into referencing the cyberspace domain
While the international law for civilian aircraft in airspace may not relate well or isnrsquot
feasible to enforce in the cyberspace domain does a nation have that same right to protect itself
from a suspected attack from cyberspace where the attackerrsquos signal enters airspace Does a
nation have the right to ldquoshoot downrdquo a cyberspace attack as it enters their domain through
airspace The whole idea behind restricting airspace from foreign military aircraft is because of
the strategic impact military aircraft can have on a nation As demonstrated in World War II
military aircraft carrying weapons of mass destruction can decimate cities and destroy a nation
with minimal effort The effects generated by military aircraft are quite destructive and garner
specific attention While an aircraft in of itself is relatively harmless the actions taken by the
crew can lead to devastating results
The same is true for cyber attacks The information passing through airspace in the
cyberspace domain is the vehicle however the crew conducting the operation is potentially
creating the same strategic results The cyber attack may not destroy cities but it certainly can
be destructive to a nationrsquos well-being by crippling power sources economic industries water
supply etc all at the blink of an eye while the victim takes several days to determine the
perpetrator Therefore while the international law for airspace may not be specifically relevant
the underlying principles are applicable as cyber attacks can have the same potential strategic
impact as an attack from a military aircraft
9
AUACSCSinksAY08
Space Outer space as defined by Doctor Boczek ldquois the space beyond the air surrounding the
earthrdquo As of 2005 international law doesnrsquot define a demarcation between airspace and outer
space but ldquostates agree that state sovereignty doesnrsquot extend without any limitsrdquo25 Proposals of
where airspace ends and when outer space begins are base on various scientific and technological
criteria (gravitational pull capabilities of air breathing aircraft etc26) Others scientists argue
that defining a boundary between airspace and outer space isnrsquot necessary as it would hinder the
progress of space technology and the legal status would depend on the nature of the activity
While no boundary exists airspace is finite and activity in outer space follows four
fundamentals principles First over flights of foreign satellites over a nation is permissible as
airspace doesnrsquot extend forever Second space ldquointernational law applies to outer space and
celestial bodiesrdquo Third according to the Outer Space Treaty of 1967 states canrsquot claim celestial
bodies or outer space which are not subject to national appropriation therefore are free for use
by all states Finally states must use outer space exclusively for peaceful purposes with specific
bans on weapons of mass destruction However states can use space for other military purposes
like intelligence surveillance and reconnaissance activities 27
Are these international laws and principles applicable to cyberspace Satellites are
certainly an integral part of the space domain Operators control satellites by using the
cyberspace domain and information passes between satellites and ground stations One can
argue that space is a sub-set of the cyberspace domain with satellites serving as computers in
space Global positioning system devices in vehicles interact with satellites all through an
elaborate network as part of the electromagnetic spectrum known as cyberspace Therefore
cyberspace is in space with millions of people using cyberspace everyday
10
AUACSCSinksAY08
The military uses space assets for intelligence surveillance and reconnaissance
knowledge management and command and control Agencies like the National Reconnaissance
Office and National Geospatial-Intelligence Agency obtain high-altitude imagery using a variety
of capabilities to include heat signature resonation Satellites can detect missile launches which
provide vital military information to senior leaders tasked with the security of their nation The
military networks to include decision briefs tasks and emails in Iraq and the Predator feeds in
Afghanistan travel through military and commercial satellites with all the information flowing
through the cyberspace domain With the heavy reliance of cyberspace to operate space assets
and the demands of information flowing through space by businesses it should come as no
surprise that space is a vital component for day-to-day operations of the military
Since cyberspace is an inherent component for space operations it is logical to assume
international law for outer space is applicable to cyberspace as long as an aggressor doesnt
violate the four premises and as long as weapons of mass destruction arenrsquot ldquostationed in outer
spacerdquo 28 Therefore a state would consider a cyber attack against a satellite as other than for
peaceful purposes and according to the fourth premise international law would apply
However what about a cyber attack using satellites as a means of conducting operations
Under todayrsquos current operations international elites havenrsquot considered a cyber attack passing
through space as a violation of international law When a senior leader in Qatar approves a
target set that is executed by a pilot in Nevada by an aircraft in Afghanistan all this information
is transmitted by cyberspace through space The result is that an aircraft renders an air or ground
target inoperable The effect is the same for cyberspace The information flows through space
by way of the cyberspace domain and the result is that an operator has rendered a target
11
AUACSCSinksAY08
inoperable As with airspace the information isnrsquot the cause of the damage but what an operator
does with the information is what constitutes the cyber attack
Land Cyber attacks using resources over land is relatively straightforward International
boundaries are defined as ldquoimaginary lines which separate territorial sovereigntyrdquo 29 which are
mutually agreed upon via international treaties Crossing an international border without
permission from the state is a violation of international law While an illegal immigrant crossing
a border to seek an opportunity to provide for his family is a violation of national law the United
Nation considers a nation-sponsored invasion of another nation that threatens the security and
stability of a nation as a breach in international law and an act of war
However international law doesnrsquot consider all border crossings as an act of war For
example when Nicaraguan troops and arms allegedly crossed the borders of El Salvador the
United Nations determined that incursions didnrsquot threaten El Salvadorrsquos territorial integrity and
stated that neither ldquothese incursions nor the alleged supply of arms may be relied upon as
justifying the exercise of the right of collective self-defenserdquo30 The victim state can repelled the
aggressive act but the United Nations Council wouldnrsquot condone any further military action
taken against the adversary opting for diplomatic or economic solution instead
Does international law apply when an adversary crosses international borders using
cyberspace as the means for conducting warfare operations When an adversarial state crosses a
statersquos boundaries using roads or bridges that connect the two nations the road is the resource
spanning the two nations If the adversary doesnrsquot do anything then returns to their sovereign
borders the aggressor hasnrsquot violated international law However when the adversary uses
weapon systems to affect serious damage the adversary has broken international law and a
12
AUACSCSinksAY08
nation may invoke their right for self-defense and may conduct full-scale operations to neutralize
the threat
A parallel notion is when an adversary uses a copper or fiber optic connection that spans
between two nations The adversary uses the land-based LAN connection as a means for
conducting cyber warfare operations The adversary may cross the borders using cyberspace yet
do nothing The affected state may push the adversary back to its borders but no further actions
are deemed appropriate However once the adversary uses the information transmitted over
cyberspace to cause severe operational or strategic damage the affected state now has the right
of self-defense Cyberspace is the means like the road or bridge for which the adversary
delivered the weapon The affected nation will consider the execution of the adversaryrsquos
information packet or weapon system as an act of aggression and the effect caused by the
weapon is what breeches international law
The difference between these two scenarios is that the adversary using the
electromagnetic spectrum hasnrsquot physically invaded a nationrsquos sovereign borders However
their digital presence crossed sovereign borders and as latter discussed in the paper adversaries
committing an act aggression against a state are now under the jurisdiction of the affected state
Sea ldquoThe territorial sea is a belt of sea adjacent to the (statersquos) coasthellipto include the airspace
aboverdquo as well as the seabed and subsoil31 The territorial sea is subject to the right of innocent
passage by foreign shops giving states the right to transport goods and passengers between ports
All of which is subject to the full sovereignty of the state which according to the United Nations
Convention on the Law of the Sea in 1982 and agreed upon by the majority of its membership in
1982 extends 12 miles from the coast32 The jurisdiction includes crimes where the
consequences extend to the coastal state and disturbs the peace of the country33 A cyber attack
13
AUACSCSinksAY08
conducted within the territorial sea of a nation would be no different from a cyber attack
conducted from within the nationrsquos land borders therefore cyber attacks against a state or even
another state conducted within the territorial seas are subject to current international laws Cyber
attacks originating outside the statersquos sovereign borders but results in affecting a statersquos
resources in their territorial seas would fall under the land and airspace breeches of territorial
sovereignty and would be subject to international law
The high seas on the other hand arenrsquot subject to the sovereignty of any one state The
high seas extend beyond the territorial sea and include the airspace the seabed and the subsoil34
and all states have the right to exercise freedoms on the high seas35 As similarly defined in
space ldquothe high seas shall be reserved for peaceful purposesrdquo as stated by Article 88 of the Law
of the Seas Cooperative36 which is defined as refraining from any threat or use of force (outside
of wartime conflicts)
The very nature of a cyber attack in the high seas lends itself to be a violation of
international law as nations are restricted to conducting peaceful operations in the high seas
The question is whom has jurisdiction of crimes committed in the high seas By applying the
Protective Security Principle of Jurisdiction where an actor threatens a statersquo security and
introducing the United Nationrsquos definition on the Illegal Use of Force extends to the high seas
and for that matter space giving states the right for self-defense as defined by the United Nations
as ldquoan armed attackrdquo The sheer name of cyber attack doesnrsquot immediately lend itself to an
ldquoarmedrdquo cyber attack However the effects generated from a cyber attack can be equivalent to a
traditional conventional attack and the international law would permit a state to take appropriate
countermeasures while notifying the United Nations Security Council37
14
AUACSCSinksAY08
Applying International Law to Cyber Warfare Today we live in an Information Age where communication through cyberspace has forever changed and flattened out worldhellipOur adversaries seek to operate from behind technical legal and international screens as they execute their costly attacks38
~General James E Cartwright Commander United States Strategic Command
Jurisdiction
Understanding the territorial sovereignty principles of a nation is important in applying
cyberspace and cyber warfare to existing international laws While some of these principles and
international laws may not be relevant for the cyberspace domain due to the far-reaching
capability of cyber warfare the jurisdiction of a nation further defines its ability to respond to
aggressive acts by nations in the cyberspace domain There are three jurisdictional principles
that provide nations the right to pursue aggressors that threaten a nationrsquos independence the
Territorial Principle Nationality Principle and the Protective Security Principle
For actions originating within the state the jurisdiction clearly falls within the territorial
principle where a ldquostate has jurisdiction over all crimes committed in its territoryhellipto include
airspace international waters and territorial seasrdquo39 The territorial jurisdiction is subject to
exceptions when dealing with persons from foreign states as in the most popular example of
immunity given to foreign diplomats In this case ldquostates may exercise jurisdiction over its
citizenhellipeven if they are physically outside the statesrsquo territoryrdquo as Doctor Boczek defines as the
Nationality Principle Nations usually agree upon on these concessions states prior to the offense
being committed40
Doctor Boczek defines the Protective Security Principle as a ldquojurisdictional principle
whereby a state my assume jurisdiction over and punish foreign nationals for certain conduct
outside its territory which is directed against its security territorial integrity and political
independencerdquo41 Some states would argue that criticism of a state or government is applicable
15
AUACSCSinksAY08
in applying this principle of jurisdiction However this is too broad of an interpretation and
should be confined to acts that are more tangible in nature like falsification of a statesrsquo official
documents conspiracy to violate immigration of custom laws and illicit drug trafficking42
Would a cyber attack that is deemed to challenge a nationrsquos banking community or bring
down a power source be a direct attack against its security and political independence The
international community easily sees the attack of a power source with kinetic weapons as a
violation of a territorial boundary and a breech of international law The United States viewed
the attack on the Trade Towers as an act of war launching the Global War on Terrorism Would
the United States have viewed the same devastation as if the attack occurred through cyberspace
Would the attack have been less of an act of war if the aggressor remotely controlled domestic
airliners from a foreign country Probably not What happens if the cyber attack caused a fire in
the lower floors of the buildings preventing people from escaping While less dramatic than an
airbus flying into the middle of the towers and maybe more difficult to demonize the crime the
result is the samemdashinnocent people suffering as a result of an adversary trying to threaten a
nationrsquos security
What happens if the suspected cyber attack has violated a nationrsquos territorial boundary in
order to attack a neighboring country or an ally Going from point A to point B in cyberspace is
rarely a direct connection As with the global nature of cyberspace itrsquos conceivable that
adversaries cross several nationsrsquo boundaries to conduct cyber attack operations The question
generated is who has jurisdiction
If the actor committing the crime had used an airplane each nation could claim
jurisdiction as the adversary violated their territorial boundaries and violated international law
More often than not the first state would have acted immediately upon the aggressive act and
16
AUACSCSinksAY08
would have prevented aggressors from completing their task by either forcing the aircraft to land
or turnaround or an even more escalated response of firing upon the aircraft In the air land or
sea the ability for a nationrsquos military forces to respond in a timely manner gives way to the
deterrence factor of not crossing a statersquos boundaries without receiving permission for fear of
reprisal A clear example of this was when Turkey denied the United States the ability deploy
the 4th Infantry Division from its borders at the beginning of Operation Iraqi Freedom Violating
Turkeyrsquos borders without permission would have brought about great repercussions that would
have made Operation Iraqi Freedom even more difficult and could have resulted in an escalation
of the war outside the Iraqi borders43 Another example is when Spain and France denied the
Unites States the use of their airspace when F-111s based in the United Kingdom conducted air
operations in Libya in an effort to eliminate Muammar Khadafy44
However the speeds at which these breeches in territorial boundaries occur make it
difficult for a nation to claim jurisdiction especially when nothing occurred within their
territorial sovereignty The cyber attacks didnrsquot result in any damage to nation as the information
packets passed through their sovereign borders According to territorial boundary description
described by Doctor Boczek the international community doesnrsquot consider the crossing the
border in of itself an act of warmdashserious damage is a driving factor in determining conflict
escalation In addition according to the territorial jurisdiction principle the cyber attack didnrsquot
threaten a nationrsquos security territorial integrity and political independence If the cyber attack or
information originated from within a sovereign territory by a third party then the two nations
would have to work together to resolve the issue and mutual jurisdiction would probably apply
However if the cyber attack didnrsquot physically manifest itself from within their sovereign
territory or the adversary didnrsquot use the nation as a staging area to launch a further attack the
17
AUACSCSinksAY08
international law and the jurisdiction principles would dictate the affected nation would have
jurisdiction
Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security
territorial integrity and political independence Cyberspace utilizes the other domains as a means
of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence
Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of
territorial sovereignty the Protective Security Principle does provide nations the ability to
enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos
sovereignty when it conducts cyber warfare operations However some elites donrsquot consider
cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense
International law specifically article 2 of the United Nations Charters states that a
members shall refrain in their international relations from the threat or use of force against the
territorial integrity or political independence of any state or in any other manner inconsistent
with the purposes of the United Nations which is intended to prohibit all types of force except
those carried out under the aegis of the United Nations or as provided for by the Security
Council45 The only exception to the United Nations Charters as it relates to the Use of Force is
the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed
attack46
International elites have discussed the term ldquouse of forcerdquo in the past because of the
development of chemical and biological weapons and had to move from a kinetic impact based
definition to a results-oriented approach47 Chemical and biological weapons lacked the
characteristic of an explosion or physical force yet these weapons certainly are capable of
destroying life and property Doctor Leigh Armistead a former information warfare instructor at
18
AUACSCSinksAY08
the Joint Forces Staff College cautions that the use of computer network attacks by the military
ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary
that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great
Russia introduced a proposal to the United Nations that banned the use of information
operations Even though the United Nations didnrsquot adopt the law the concern of international
community is fully aware of the impact cyber attacks can have on a nation
The concern over cyber warfare capabilities is that it can generate both non-kinetic and
kinetic effects There has always been the traditional kinetic solution for cyber warfare where a
precision guidance munition destroys a critical information system node Most people assume
computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos
computer system from the safety of onersquos own command and control center but the physical
destruction of a computer system or network by kinetic means also qualifies as cyber warfare
However cyber warfare has also evolved to the point where aggressors can achieve a kinetic
effect without the use of a traditional kinetic weapon A cyber attack on an information system
can shut down a particular node of a power plant causing the system to become inoperative
Even if there wasnrsquot an explosion the attack serves the same purpose
The question raised is do cyber attacks constitute an armed attack Scholars do agree that
some cyber attacks fit comfortably within the United Nations Charter For example a strategic
level cyber attack causing widespread damage and significant casualties would trigger the statersquos
right of self-defense In addition a cyber attack that precluded a conventional attack or a series
of cyber attacks causing significant damage would give a state the right of self-defense49 Few
would dispute that a country has the right under international law to respond with military force
19
AUACSCSinksAY08
if a state destroyed or significantly damaged another nationrsquos economic system for example the
New York or London stock exchanges
However some confusion and state-defined interpretation comes into play when the
frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard
Law School argues that cyber attacks require an expansion of the definition on the ldquouse of
forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot
be prohibited by international law50 International scholars recommend ldquoclearer rules of what
kinds of information warfare actions constitute an armed attackrdquo which drives permissible
responses of self-defense51 For example a state-sponsored cyber attack causes damage to a
victimrsquos factory or power plant however the nation claims the incident is an isolated instance
and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under
the United Nations Charter and the United Nations would consider any response retaliation
which would violate international law52
Another example involves a nation conducting a series of small attacks causing minimal
damage and then ceases Even though the aggressor used force to conduct cyber warfare
operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under
the United Nations Charter This type of attack is analogues to a small band of troops crossing a
border without causing significant damage53 According to the United Nations Charter the
national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders
and respond to the use of force Repelling the small band of troops and reestablishing their
sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration
of war and allies would have to respect the United Nations decision and couldnrsquot intervene The
same is true for the cyber attack A state can employ defensive measure to isolate and defeat the
20
AUACSCSinksAY08
incursion over the electromagnetic spectrum However the United Nations would see further
offensive operations or invasive operations as retaliation Therefore a nation must take the
incident whether it is signs of conventional forces on the ground or traces of cyber warfare
incursions in the electromagnetic spectrum to the United Nations to seek restitution
In both of these situations the international law becomes the target for change not
whether cyber warfare is in violation of international law If the law were to change the
international community would then consider the above situations acts of war even if an
adversary used conventional forces As written today the result of an operation remains the
driving factor in determining if an adversary has violated international law The means by which
an adversary conducts military operations may affect how nations react to the situation but
whether an adversary conducts the operation by means of the air land sea space or cyberspace
doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian
Triggs a public international lawyer and member of the Attorney General International Legal
Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over
offences abroad having an intended and substantial effect within a state may be justifiedrdquo54
Therefore the international community must evaluate the effect of a criminal act rather than the
means in which the act was committed
Others claim that because the Internet takes advantages of legal norms where non-state
actors can ignore Western notions of law55 more international laws are needed for cyberspace
However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using
other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the
Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked
aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts
21
AUACSCSinksAY08
against a staterdquo in the cyberspace domain The anonymity of the Internet and their total
disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and
national laws already exist in most countries that prohibit the use of the Internet for terrorist
activities therefore additional international laws wouldnrsquot prevent or deter terrorist from
committing such acts of aggression
International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed
Conflict includes the Martens Clause which extends established custom and humanitarian
principles to new technologies and addresses the ever-changing nature of warfare The
international community designed The Martens Clause ldquoto prevent future unnecessary andor
disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges
crimes by invoking the laws of humanity and public conscience hence their effects and not its
methods
The basic legal premise behind Law of Armed Conflict is that attacks must be limited to
military objectives and collateral damage must be proportionate to military advantages and
forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary
suffering but military commanders and planners need to be aware of the results a particular
action will invoke Russian leadership believes a computer network attack against their
homeland can be a means for executing a variety of escalating responses to include nuclear
attack58 Therefore it is imperative military commanders understand the impact any weapon
system can have on an adversary not just cyber attacks
Not all scholars agree that international law is insufficient to govern cyber warfare
Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace
and the Use of Force states that computer network attacks constitute an unlawful use of force in
22
AUACSCSinksAY08
cyberspace under traditional international law Sharp declared that an armed attack may occur
ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a
way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive
definition of cyber attacks may never be drafted59 The Congressional Research Service also
concluded that ldquothere is little likelihood that the international community will soon generate a
coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations
on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos
conclusion is that the effects of cyber warfare operations are the same as if an adversary
conducted conventional warfare operations where the effect of the attacks are the driving factors
in determining whether an adversary used force or not
The United States Government agrees with Sharprsquos conclusion The offensive
Information Operation strategy for the United States government as described by Doctor
Armistead ties the tools used to conduct military operations back to the desired effect which is
in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning
effects-based operations and operational art focus the Joint Force Commanderrsquos course of action
towards meeting objectives outlined in guidance provided by the National Command Authority
and senior military leadership62 Whether the tools are dropped pamphlets invasive network
attacks or bombs on targets the goal is to produce a desired effect to achieve the overall
objectives and cyber warfare can produce effects that challenge the national security of a nation
Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63
~General T Michael Moseley USAF
23
AUACSCSinksAY08
The cyberspace domain has been around for quite sometime but as technology continues
to advance businesses as well as governmental organizations are becoming more reliant on the
cyberspace domain With that reliance the protection of this critical domain becomes even more
important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the
electromagnetic spectrum by denying and disrupting information demands Scholars claim that
protection needs to include addressing existing international laws expanding them to incorporate
the ever-advancing capabilities emerging in the cyberspace domain
However territorial sovereignty of a nation and the principles of jurisdiction specifically
the Protective Security Principle give nations the right to exercise jurisdiction when an
aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64
While cyberspace is a domain requiring specific attention it relies on assets in the other domains
of land space sea and air in order to operate and international laws for the linear domains do
exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace
but during cyber warfare operations the principles behind the restrictions of foreign military
entering airspace do apply The strategic nature of cyber warfare operations correspond to the
same strategic impact that airpower can inflict upon a nation threatening their independence
While maybe not as dramatic as kinetic effects the results can be just as devastating
Space is relatively straightforward Since a nation canrsquot claim space and over flights of
foreign satellites over a nation is permissible nations must use space for peaceful purposes
Kinetic attacks against space assets are a violation of international law therefore nations would
consider cyber warfare operations against space assets as other than peaceful purposes and a
violation of international law Cyber attacks traversing space assets relate to current military
operations where the military uses space assets to conduct kinetic operations Since international
24
AUACSCSinksAY08
elites havenrsquot considered these kinetic operations as a breach of international law military
commanders can conduct cyber warfare operations through space without fear of violating
international laws for outer space
Crossing international borders without a nationrsquos permission and threatening their
sovereignty is a violation of international law While nations canrsquot consider all border crossings
as an act of war those acts of aggression that threaten the territorial integrity would elicit a
defensive response by the victim nation Whether incursions involve combat vehicles over a
highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are
threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not
have set foot in the nation but according the Protective Security Principle the victim nation has
jurisdiction
Conducting cyber warfare operations from the territorial sea is no different from
conducting operations from within a nationrsquos land or sea borders However the high seas are
very similar in nature to space in that they are reserved for peaceful purposes Therefore
conducting any means of warfare from within the high seas is a violation of international law
and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-
defense
According to Barkham ldquoinformation warfare attacks are in essence territorial
penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then
subject to the jurisdiction of the victim nation who then has the right for self-defense However
due to the global nature of cyberspace aggressors can cross multiple borders and determining
who has jurisdiction demands cooperation among nations The origin and any deliberate staging
locations of the cyber attack will drive who has jurisdiction The crossing of third party borders
25
AUACSCSinksAY08
by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the
aggressors threaten a nationrsquos independence or territorial integrity
Scholars consider cyber warfare operations that involve strategic and operational impacts
as being a means of using force and fall within the legal regime of existing international law
However scholars argue that because cyber warfare includes kinetic and non-kinetic results the
Use of Force definition needs expanding Yet they conclude that an exhaustive definition of
cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare
operations against existing case studies where the effects are evaluated as opposed to the means
even if the operations originated from outside the nationrsquos territorial jurisdiction There is some
authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to
have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade
non-state actors from conducting cyber warfare operations given their willingness to ignore
Western notions of war and their ability to conduct operations anonymously in cyberspace
International laws are in place to that address the ever-changing nature of warfare The
Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a
framework for addressing all warfare to include cyber warfare operations The international
community will need to measure the effects of an operation rather the means Whether its boots
on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a
nationrsquos response
26
AUACSCSinksAY08
End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)
27
AUACSCSinksAY08
44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
28
AUACSCSinksAY08
Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005
Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department
American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)
Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983
Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988
Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)
Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)
IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)
Joint Publication 3-13 Information Operations 13 February 2006
Joint Publication 5-0 Joint Operations Planning 26 December 2006
Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies
Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc
Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College
Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)
Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press
29
AUACSCSinksAY08
Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI
Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)
Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press
Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company
Detter Delupis I The law of war (2000) New York NY Cambridge University Press
Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)
Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College
Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor
Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)
Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)
Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf
Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)
Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College
Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College
Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)
Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA
30
AUACSCSinksAY08
Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)
Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)
Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College
Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology
Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College
Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)
OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center
OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College
OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications
Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991
Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College
Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center
Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)
31
AUACSCSinksAY08
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press
Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA
Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University
Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor
Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661
Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office
Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis
United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC
United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center
Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College
Wesley David C The Military Commander and the Law 2006
32
AUACSCSinksAY08
Abstract
In land sea and air battles military combatants can see the enemy coming whether itrsquos
the whites of their eyes or a blip on a screen International boundaries easily define when an
aggressor threatens the sovereignty of a nation giving the victim nation the right of jurisdiction
and there are specific international laws that address military operations in space In addition
the international community has defined when an adversaryrsquos use of force threatens a nationrsquos
territorial integrity and political independence
However the global nature of cyberspace and the speed of which victims can experience
cyber attacks force nations to deal with the legal challenges associated with over-the-horizon
military operations Jurisdiction over a cyber attack compounds the legal issues surrounding an
aggressive act that can have a wide-range of effects In addition nations face a very difficult
task in attributing an aggressive act to a particular actor and responding to asymmetric
techniques in cyberspace presents nations with an even more challenging and complicated issue
particularly in the legal regime
Cyberspace relies heavily on the other physical domains to operate and international laws
exist that govern the physical domains or air land sea and space The far-reaching nature of
cyberspace generates jurisdiction challenges that arenrsquot associated with the other domains but
the jurisdiction principles can apply to cyber warfare While scholars argue about the definition
of the Use of Force cyber warfare can have strategic and operational impacts that fall neatly
within existing definitions Finally international committees and oversight organizations have
generated legal precedents that apply to cyber warfare operations Therefore while cyberspace
is its own domain and there are unique demands placed on nations by cyber warfare existing
international laws and definitions are applicable to cyber warfare
iii
AUACSCSinksAY08
Table of Contents
DISCLAIMER II
ABSTRACT III
TABLE OF CONTENTS IV
INTRODUCTION 1
WHAT IS CYBER WARFARE 3 Defining Cyberspace 3 What Cyberspace is Not 4 Defining Cyber Warfare 5
TERRITORIAL SOVEREIGNTY 6 Airspace 7 Space 10 Land 12 Sea 13
APPLYING INTERNATIONAL LAW TO CYBER WARFARE 15 Jurisdiction 15 Use of Force 18 International Laws 22
CONCLUSION 23
END NOTES 27
BIBLIOGRAPHY 29
iv
AUACSCSinksAY08
Introduction We need to be able to think in terms of target effects I picture myself around that same targeting table where you have the fighter pilot the bomber pilot the special operations people and the information warrior As you go down the target list each one takes a turn raising his or her hand saying ldquoI can take that targetrdquo1
~ General (Retired) John P Jumper
The worldrsquos growing reliance on information technology to improve efficiency has
opened a threat to all who become reliant on cyberspace to conduct operationshellipa threat that has
many sources of predators ranging from pranksters to white-collar criminals to terrorists Yet
cyberspace has limited international laws to govern a worldwide domain that is ever expanding
as third world nations begin to invest in information technology and enter the cyberspace realm
to enhance business and military operations As nations begin to rely more on cyberspace as an
effective means of conducting business and military operations the more these operations will
become susceptible to outside aggressive influences whether itrsquos from economic invasions or
disruption of military operations
In addition the threat of military operations in the cyberspace domain is real The
Russian military has incorporated cyber warfare into their doctrine in order to gain information
advantage by affecting an adversaryrsquos information system decision-making processes command
and control and even the populace2 China is pursuing a battalion-sized force of computer
experts trained ldquoto carry out computer network attacks as a means of seeking asymmetrical
advantages over an adversaryrdquo3 The threat doesnrsquot reside just within state actors non-state
actors are incorporating cyber warfare operations into their realm of capabilities Hezbollah has
outlined a strategy to cripple the Israeli government by disrupting normal economic and societal
operations by targeting official websites crashing financial sites knocking out the internet
servers and targeting e-commerce sites4
In land sea and air battles military combatants can see the enemy coming whether itrsquos
1
AUACSCSinksAY08
the whites of their eyes or a blip on a screen International boundaries easily define when an
aggressor threatens the sovereignty of a nation giving the victim nation the right of jurisdiction
and there are specific international laws that address military operations in space In addition
the international community has defined when an adversaryrsquos use of force threatens a nationrsquos
territorial integrity and political independence
However the global nature of cyberspace and the speed of which victims can experience
cyber attacks force nations to deal with the legal challenges associated with over-the-horizon
military operations as commanders can experience battlefield affects with little or no warning
Moreover cyber attacks are much more difficult to define Jurisdiction over a cyber attack that
occurs 7000 miles away that crosses multiple physical domains and spans several international
borders compounds the legal issues surrounding an aggressive act that can have a wide-range of
effects Add the fact that determining the perpetrator proves to be less than speedy as most
cyber warriors can use the Internet ldquoanonymously or as a shell game to hide identitiesrdquo5 nations
face a very difficult task in attributing an aggressive act to a particular actor Responding to
asymmetric techniques tactics and procedures by state and non-state actors have proven to be
difficult for conventional forces Introducing asymmetric tactics in cyberspace presents nations
an even more challenging and complicated issue particularly in the legal regime
Therefore this paper will analyze the need for international guidance for conducting warfare
operations in the cyberspace domain This paper will define cyberspace and cyber warfare in an
effort to set the stage for illustrating the global nature of cyberspace and its reliance on the other
physical domains to conduct military operations The paper will define the international law as it
relates to territorial boundaries and outline the jurisdiction principles that allow a nation to act
against an adversary This paper outlines the definition of the Use of Force and how it
2
AUACSCSinksAY08
corresponds to the cyberspace domain and cyber warfare and with the final discussion centered
on the international laws that already exist which help shape international law for cyberspace
What is Cyber Warfare Very few of the new manifestations in war can be ascribed to new inventions or new departures in ideas6
~Carl Von Clausewitz
Defining Cyberspace William Gibson coined the term ldquocyberspacerdquo in his 1984 novel Neuromancer in order to
describe ldquoa shared virtual environment whose inhabitants objects and spaces comprise data that
is visualized heard and touchedrdquo7 However the most common of definitions today refer to the
Internet or the World Wide Web and usually consists of an information-sharing environment
between computers8 However the military has defined cyberspace to advocate a worldwide
spectrum of more than just information sharing among computers
In the National Military Strategy for Cyberspace Operations cyberspace is defined as a
domain characterized by the use of electronics and the electromagnetic spectrum to store
modify and exchange data via networked systems and associated physical infrastructure9 Joint
doctrine has adopted a computer-centric definition where cyberspace is ldquothe notional
environment in which digitized information is communicated over networksrdquo10 The National
Military Strategy and joint doctrine definitions advocate a worldwide information environment
that isnrsquot limited to the Internet or to just computers Matter of fact the expanded definitions
suggest that cyberspace consists of all networks to include highly sensitive military
governmental and commercial networks that may or may not use commercial means to store
modify and exchange data These systems include exchange networks like tactical digital
information links (TADIL) links between command and control platforms and air ground and
sea weapon systems In addition because the definition includes the electromagnetic spectrum
3
AUACSCSinksAY08
cyberspace includes ldquocapabilities that are currently considered electronic warfarerdquo11 which Great
Britain exploited in World War II when they introduced radar technology in World War II and is
still applicable with communication and navigational jamming capabilities used in todayrsquos
conflicts
While cyberspace is a unique domain that military commanders must protect in order to
conduct operations more effectively and offers commanders another dimension in which to
exploit weaknesses in an adversaryrsquos ability to project power cyberspace doesnrsquot exist on its
own According to Lt Col Fahrenkreg in the published Air University article title Cyberspace
Define ldquocyberspace exists across the other domains of air land sea and spacerdquo12 There are
clear delineations between the sea land and air Commanders know where the land ends and the
sea begins While there are some discussions as to where airspace ends and space begins the
capabilities and roles associated with each domain are clear Therefore to depict cyberspace as
an autonomous domain is unrealistic as the physical infrastructure of cyberspace and the means
of sharing information within the cyberspace domain resides in one or more of the four linear
domains
What Cyberspace is Not The most confused notion about cyberspace is that information operations and
cyberspace are one in the same Joint Publication 3-13 Information Operations describes the
information environment as a collection of leaders decision makers and systems that process
collect disseminate or act on information consisting of three dimensions the physical
informational and cognitive dimensions13 The goal of information operations is to influence the
cognitive dimension by affecting the decision-making process known affectionately by the Air
Force as the OODA Loop (Observe Orient Decide and Act)14 By disrupting and corrupting
4
AUACSCSinksAY08
information processes military commanders can influence or usurp adversarial human and
automated decision making in the physical and informational dimensions
As stated by Lt Col Fahrenkreg the confusion between cyberspace and information
operations comes from the misunderstanding of cyberspace as an operation rather than a
domain15 Information operation is a capability available to the combatant commander to
generate an effect in one of the five domains It just so happens that cyberspace tends to be the
primary means of delivering the Information Operation capability
Cyberspace connects the physical dimensions with the cognitive process and is a means
to create effects to include disrupting degrading denying the enemy the use of strategic and
operational assets to include command and controls systems power plants telecommunications
and other like targets to affect a statersquos operational and strategic centers of gravity Cyberspace
isnrsquot information or the data residing on a computer but is the means in which users transfer
store or modify information Cyberspace isnrsquot the data sent to a precision guided munition but
the means in which the originator passes the information Cyberspace is the digital super
highway of the electromagnetic spectrum with the ones zeros and electrons as the passengers
Defining Cyber Warfare According to the Institute for Advanced Study of Information Warfare (ASIW) cyber
warfare has become a form of information warfare which ASIW defines as ldquothe offensive and
defensive use of information and information systems to deny exploit corrupt or destroy and
adversaryrsquos information information-based processes information systems and computer-based
networks while protecting onersquos own Such actions are designed to achieve advantages over
military adversariesrdquo16 While this definition doesnrsquot specifically address the electromagnetic
spectrum the definition focuses on information-sharing systems which is where crux of the
cyberspace domain revolves around
5
AUACSCSinksAY08
Joint doctrine defines cyber warfare as those areas of operations that affect the
electromagnetic spectrum to include Computer Network Operations and Electronic Warfare
which are two of the five core operational capabilities of Information Operations Electronic
warfare operations operates across ldquoradio visible micro directed energy and all other
frequenciesrdquo and overlaps with network warfare operations which include ldquoradio nets satellite
links tactical digital information links (TADIL) telemetry digital track files
telecommunications and wireless communication network and systemsrdquo all of which operate
within the electromagnetic spectrum17
Cyber warfare consists of defensive and offensive operations Defensive operations
arenrsquot limited to severing connections or blocking attempts of an adversary trying to corrupt data
modify transmissions or destroy information systems Defensive operations include the
elimination of the adversaryrsquos capability of conducting operations which may involve crossing
sovereign borders in order to complete the task However defensive network operations come in
more than just one form The movies portray computer experts hovering over computers trying
to affect each otherrsquos operations However cyber warfare includes the use of traditional kinetic
effect to disrupt computer network operations of the enemy as a fighter-bomber delivering a
500-pound bomb to destroy a vital mode in a computer network may serve the same purpose as a
computer-centric network attack While this isnrsquot as sexy as a network attack that spans the
globe to degrade the enemyrsquos ability operation within the cyberspace domain the effects are the
same
Territorial Sovereignty In total war it is quite impossible to draw any precise line between military and non-military problems18
~Sir Winston Churchill
6
AUACSCSinksAY08
Cyberspace is certainly a domain that requires unique attention in order for commanders
to effectively and efficiently prosecute combat operations Cyberspace spans the globe using
the physical infrastructure residing within the other linear domains As users pass information
from one site to another data crosses boundaries by means of the cyberspace domain Data
leaves the Iraq area of operation via satellite to a receiving site in Germany Operators route the
information to the United States either through another satellite or by ground to sea-based cables
bound for computer nodes within the United States before arriving in South Carolina where
automated network tools redirect the information to the receiverrsquos location
An adversary attempting to modify corrupt or destroy this information traveling within
the cyberspace domain would at one time or another would cross sovereign borders through air
land sea or space The adversaryrsquos physical presence may not apply as they could conduct
operations from the comforts of their home however a nation could detect the adversaryrsquos
digital presence and could feel the impact of their actions from within their sovereign borders
Therefore as these adversaries span the globe using the cyberspace domain that relies on the
other linear domains to exist does international law apply when boundaries are crossed The
following sections will address the international laws of each physical domain and evaluate how
their principles apply to the cyberspace domain
Airspace Airspace as defined by Doctor Boleslaw A Boczek the internationally renowned expert
on international law ldquois the air pillow above the subjacent territoryrdquo to include ldquoairspace above
international waters and the territorial seardquo The airspace is under complete and exclusive
sovereignty of the subject state19 With that states have jurisdiction over their airspace and
require identification of foreign aircraft along with their intentions According to Dr Boczek
book International Law A Dictionary ldquoentry of national spacehellipmay take place only with the
7
AUACSCSinksAY08
authorization of the territorial staterdquo20 and currently only applies to aircraft Entry into the
airspace would require ldquoall aircraft to identify themselves file flight plans and report their
positionrdquo According to the 1944 Chicago Convention on International Civil Aviation nations
can enter into agreements that allow scheduled international civil air services which usually
include reciprocal agreements covering routes volume and other matters relating to air traffic
However these agreements only apply to civil aviation where state aircraft which include
aircraft belonging to the military customs public services and heads of states must follow more
restrictive procedures upon entering the airspace of a foreign nation21
There are several incidents where states have evoked their right for defending their
national security like the shooting down of a US military reconnaissance aircraft over Soviet
airspace by the Soviet Union in 196022 or the shooting down by Soviet fighter planes of a South
Korean airliner in 198323 The Soviet Union isnrsquot the only nation to protect its airspace as the
United States was responsible for shooting down an Iranian airliner thought to be an attacking
military plane over the Persian Gulf in 198824 These examples illustrate a nationrsquos sovereign
resolve to protect itself when a suspected adversary violated their airspace
Applying international law of airspace to cyberspace doesnrsquot seem too practical Civilian
signals entering a nationrsquos airspace would require nations to enter into agreements to allow
scheduled services and the persons receiving information through airspace would have to be
non-state sponsored Nationrsquos could regulate some cyberspace networks entering airspace like
radio communications that primarily use land-based infrastructure to function However the
very nature of computer networks and the ever-increasing global reach of communication
capabilities severely restrict a nationrsquos ability to monitor the millions of transmissions made on a
daily basis and these signals certainly wouldnrsquot be on any scheduled basis Therefore even if
8
AUACSCSinksAY08
nations made agreements concerning the cyberspace domain nations would have a difficult time
enforcing their terms of agreements unless the terms are very open-ended If they were so open-
ended then the agreement may not be necessary and based on my research nations realize the
futility of establishing these agreements as this author couldnrsquot find any reference to any
agreements that nations have entered into referencing the cyberspace domain
While the international law for civilian aircraft in airspace may not relate well or isnrsquot
feasible to enforce in the cyberspace domain does a nation have that same right to protect itself
from a suspected attack from cyberspace where the attackerrsquos signal enters airspace Does a
nation have the right to ldquoshoot downrdquo a cyberspace attack as it enters their domain through
airspace The whole idea behind restricting airspace from foreign military aircraft is because of
the strategic impact military aircraft can have on a nation As demonstrated in World War II
military aircraft carrying weapons of mass destruction can decimate cities and destroy a nation
with minimal effort The effects generated by military aircraft are quite destructive and garner
specific attention While an aircraft in of itself is relatively harmless the actions taken by the
crew can lead to devastating results
The same is true for cyber attacks The information passing through airspace in the
cyberspace domain is the vehicle however the crew conducting the operation is potentially
creating the same strategic results The cyber attack may not destroy cities but it certainly can
be destructive to a nationrsquos well-being by crippling power sources economic industries water
supply etc all at the blink of an eye while the victim takes several days to determine the
perpetrator Therefore while the international law for airspace may not be specifically relevant
the underlying principles are applicable as cyber attacks can have the same potential strategic
impact as an attack from a military aircraft
9
AUACSCSinksAY08
Space Outer space as defined by Doctor Boczek ldquois the space beyond the air surrounding the
earthrdquo As of 2005 international law doesnrsquot define a demarcation between airspace and outer
space but ldquostates agree that state sovereignty doesnrsquot extend without any limitsrdquo25 Proposals of
where airspace ends and when outer space begins are base on various scientific and technological
criteria (gravitational pull capabilities of air breathing aircraft etc26) Others scientists argue
that defining a boundary between airspace and outer space isnrsquot necessary as it would hinder the
progress of space technology and the legal status would depend on the nature of the activity
While no boundary exists airspace is finite and activity in outer space follows four
fundamentals principles First over flights of foreign satellites over a nation is permissible as
airspace doesnrsquot extend forever Second space ldquointernational law applies to outer space and
celestial bodiesrdquo Third according to the Outer Space Treaty of 1967 states canrsquot claim celestial
bodies or outer space which are not subject to national appropriation therefore are free for use
by all states Finally states must use outer space exclusively for peaceful purposes with specific
bans on weapons of mass destruction However states can use space for other military purposes
like intelligence surveillance and reconnaissance activities 27
Are these international laws and principles applicable to cyberspace Satellites are
certainly an integral part of the space domain Operators control satellites by using the
cyberspace domain and information passes between satellites and ground stations One can
argue that space is a sub-set of the cyberspace domain with satellites serving as computers in
space Global positioning system devices in vehicles interact with satellites all through an
elaborate network as part of the electromagnetic spectrum known as cyberspace Therefore
cyberspace is in space with millions of people using cyberspace everyday
10
AUACSCSinksAY08
The military uses space assets for intelligence surveillance and reconnaissance
knowledge management and command and control Agencies like the National Reconnaissance
Office and National Geospatial-Intelligence Agency obtain high-altitude imagery using a variety
of capabilities to include heat signature resonation Satellites can detect missile launches which
provide vital military information to senior leaders tasked with the security of their nation The
military networks to include decision briefs tasks and emails in Iraq and the Predator feeds in
Afghanistan travel through military and commercial satellites with all the information flowing
through the cyberspace domain With the heavy reliance of cyberspace to operate space assets
and the demands of information flowing through space by businesses it should come as no
surprise that space is a vital component for day-to-day operations of the military
Since cyberspace is an inherent component for space operations it is logical to assume
international law for outer space is applicable to cyberspace as long as an aggressor doesnt
violate the four premises and as long as weapons of mass destruction arenrsquot ldquostationed in outer
spacerdquo 28 Therefore a state would consider a cyber attack against a satellite as other than for
peaceful purposes and according to the fourth premise international law would apply
However what about a cyber attack using satellites as a means of conducting operations
Under todayrsquos current operations international elites havenrsquot considered a cyber attack passing
through space as a violation of international law When a senior leader in Qatar approves a
target set that is executed by a pilot in Nevada by an aircraft in Afghanistan all this information
is transmitted by cyberspace through space The result is that an aircraft renders an air or ground
target inoperable The effect is the same for cyberspace The information flows through space
by way of the cyberspace domain and the result is that an operator has rendered a target
11
AUACSCSinksAY08
inoperable As with airspace the information isnrsquot the cause of the damage but what an operator
does with the information is what constitutes the cyber attack
Land Cyber attacks using resources over land is relatively straightforward International
boundaries are defined as ldquoimaginary lines which separate territorial sovereigntyrdquo 29 which are
mutually agreed upon via international treaties Crossing an international border without
permission from the state is a violation of international law While an illegal immigrant crossing
a border to seek an opportunity to provide for his family is a violation of national law the United
Nation considers a nation-sponsored invasion of another nation that threatens the security and
stability of a nation as a breach in international law and an act of war
However international law doesnrsquot consider all border crossings as an act of war For
example when Nicaraguan troops and arms allegedly crossed the borders of El Salvador the
United Nations determined that incursions didnrsquot threaten El Salvadorrsquos territorial integrity and
stated that neither ldquothese incursions nor the alleged supply of arms may be relied upon as
justifying the exercise of the right of collective self-defenserdquo30 The victim state can repelled the
aggressive act but the United Nations Council wouldnrsquot condone any further military action
taken against the adversary opting for diplomatic or economic solution instead
Does international law apply when an adversary crosses international borders using
cyberspace as the means for conducting warfare operations When an adversarial state crosses a
statersquos boundaries using roads or bridges that connect the two nations the road is the resource
spanning the two nations If the adversary doesnrsquot do anything then returns to their sovereign
borders the aggressor hasnrsquot violated international law However when the adversary uses
weapon systems to affect serious damage the adversary has broken international law and a
12
AUACSCSinksAY08
nation may invoke their right for self-defense and may conduct full-scale operations to neutralize
the threat
A parallel notion is when an adversary uses a copper or fiber optic connection that spans
between two nations The adversary uses the land-based LAN connection as a means for
conducting cyber warfare operations The adversary may cross the borders using cyberspace yet
do nothing The affected state may push the adversary back to its borders but no further actions
are deemed appropriate However once the adversary uses the information transmitted over
cyberspace to cause severe operational or strategic damage the affected state now has the right
of self-defense Cyberspace is the means like the road or bridge for which the adversary
delivered the weapon The affected nation will consider the execution of the adversaryrsquos
information packet or weapon system as an act of aggression and the effect caused by the
weapon is what breeches international law
The difference between these two scenarios is that the adversary using the
electromagnetic spectrum hasnrsquot physically invaded a nationrsquos sovereign borders However
their digital presence crossed sovereign borders and as latter discussed in the paper adversaries
committing an act aggression against a state are now under the jurisdiction of the affected state
Sea ldquoThe territorial sea is a belt of sea adjacent to the (statersquos) coasthellipto include the airspace
aboverdquo as well as the seabed and subsoil31 The territorial sea is subject to the right of innocent
passage by foreign shops giving states the right to transport goods and passengers between ports
All of which is subject to the full sovereignty of the state which according to the United Nations
Convention on the Law of the Sea in 1982 and agreed upon by the majority of its membership in
1982 extends 12 miles from the coast32 The jurisdiction includes crimes where the
consequences extend to the coastal state and disturbs the peace of the country33 A cyber attack
13
AUACSCSinksAY08
conducted within the territorial sea of a nation would be no different from a cyber attack
conducted from within the nationrsquos land borders therefore cyber attacks against a state or even
another state conducted within the territorial seas are subject to current international laws Cyber
attacks originating outside the statersquos sovereign borders but results in affecting a statersquos
resources in their territorial seas would fall under the land and airspace breeches of territorial
sovereignty and would be subject to international law
The high seas on the other hand arenrsquot subject to the sovereignty of any one state The
high seas extend beyond the territorial sea and include the airspace the seabed and the subsoil34
and all states have the right to exercise freedoms on the high seas35 As similarly defined in
space ldquothe high seas shall be reserved for peaceful purposesrdquo as stated by Article 88 of the Law
of the Seas Cooperative36 which is defined as refraining from any threat or use of force (outside
of wartime conflicts)
The very nature of a cyber attack in the high seas lends itself to be a violation of
international law as nations are restricted to conducting peaceful operations in the high seas
The question is whom has jurisdiction of crimes committed in the high seas By applying the
Protective Security Principle of Jurisdiction where an actor threatens a statersquo security and
introducing the United Nationrsquos definition on the Illegal Use of Force extends to the high seas
and for that matter space giving states the right for self-defense as defined by the United Nations
as ldquoan armed attackrdquo The sheer name of cyber attack doesnrsquot immediately lend itself to an
ldquoarmedrdquo cyber attack However the effects generated from a cyber attack can be equivalent to a
traditional conventional attack and the international law would permit a state to take appropriate
countermeasures while notifying the United Nations Security Council37
14
AUACSCSinksAY08
Applying International Law to Cyber Warfare Today we live in an Information Age where communication through cyberspace has forever changed and flattened out worldhellipOur adversaries seek to operate from behind technical legal and international screens as they execute their costly attacks38
~General James E Cartwright Commander United States Strategic Command
Jurisdiction
Understanding the territorial sovereignty principles of a nation is important in applying
cyberspace and cyber warfare to existing international laws While some of these principles and
international laws may not be relevant for the cyberspace domain due to the far-reaching
capability of cyber warfare the jurisdiction of a nation further defines its ability to respond to
aggressive acts by nations in the cyberspace domain There are three jurisdictional principles
that provide nations the right to pursue aggressors that threaten a nationrsquos independence the
Territorial Principle Nationality Principle and the Protective Security Principle
For actions originating within the state the jurisdiction clearly falls within the territorial
principle where a ldquostate has jurisdiction over all crimes committed in its territoryhellipto include
airspace international waters and territorial seasrdquo39 The territorial jurisdiction is subject to
exceptions when dealing with persons from foreign states as in the most popular example of
immunity given to foreign diplomats In this case ldquostates may exercise jurisdiction over its
citizenhellipeven if they are physically outside the statesrsquo territoryrdquo as Doctor Boczek defines as the
Nationality Principle Nations usually agree upon on these concessions states prior to the offense
being committed40
Doctor Boczek defines the Protective Security Principle as a ldquojurisdictional principle
whereby a state my assume jurisdiction over and punish foreign nationals for certain conduct
outside its territory which is directed against its security territorial integrity and political
independencerdquo41 Some states would argue that criticism of a state or government is applicable
15
AUACSCSinksAY08
in applying this principle of jurisdiction However this is too broad of an interpretation and
should be confined to acts that are more tangible in nature like falsification of a statesrsquo official
documents conspiracy to violate immigration of custom laws and illicit drug trafficking42
Would a cyber attack that is deemed to challenge a nationrsquos banking community or bring
down a power source be a direct attack against its security and political independence The
international community easily sees the attack of a power source with kinetic weapons as a
violation of a territorial boundary and a breech of international law The United States viewed
the attack on the Trade Towers as an act of war launching the Global War on Terrorism Would
the United States have viewed the same devastation as if the attack occurred through cyberspace
Would the attack have been less of an act of war if the aggressor remotely controlled domestic
airliners from a foreign country Probably not What happens if the cyber attack caused a fire in
the lower floors of the buildings preventing people from escaping While less dramatic than an
airbus flying into the middle of the towers and maybe more difficult to demonize the crime the
result is the samemdashinnocent people suffering as a result of an adversary trying to threaten a
nationrsquos security
What happens if the suspected cyber attack has violated a nationrsquos territorial boundary in
order to attack a neighboring country or an ally Going from point A to point B in cyberspace is
rarely a direct connection As with the global nature of cyberspace itrsquos conceivable that
adversaries cross several nationsrsquo boundaries to conduct cyber attack operations The question
generated is who has jurisdiction
If the actor committing the crime had used an airplane each nation could claim
jurisdiction as the adversary violated their territorial boundaries and violated international law
More often than not the first state would have acted immediately upon the aggressive act and
16
AUACSCSinksAY08
would have prevented aggressors from completing their task by either forcing the aircraft to land
or turnaround or an even more escalated response of firing upon the aircraft In the air land or
sea the ability for a nationrsquos military forces to respond in a timely manner gives way to the
deterrence factor of not crossing a statersquos boundaries without receiving permission for fear of
reprisal A clear example of this was when Turkey denied the United States the ability deploy
the 4th Infantry Division from its borders at the beginning of Operation Iraqi Freedom Violating
Turkeyrsquos borders without permission would have brought about great repercussions that would
have made Operation Iraqi Freedom even more difficult and could have resulted in an escalation
of the war outside the Iraqi borders43 Another example is when Spain and France denied the
Unites States the use of their airspace when F-111s based in the United Kingdom conducted air
operations in Libya in an effort to eliminate Muammar Khadafy44
However the speeds at which these breeches in territorial boundaries occur make it
difficult for a nation to claim jurisdiction especially when nothing occurred within their
territorial sovereignty The cyber attacks didnrsquot result in any damage to nation as the information
packets passed through their sovereign borders According to territorial boundary description
described by Doctor Boczek the international community doesnrsquot consider the crossing the
border in of itself an act of warmdashserious damage is a driving factor in determining conflict
escalation In addition according to the territorial jurisdiction principle the cyber attack didnrsquot
threaten a nationrsquos security territorial integrity and political independence If the cyber attack or
information originated from within a sovereign territory by a third party then the two nations
would have to work together to resolve the issue and mutual jurisdiction would probably apply
However if the cyber attack didnrsquot physically manifest itself from within their sovereign
territory or the adversary didnrsquot use the nation as a staging area to launch a further attack the
17
AUACSCSinksAY08
international law and the jurisdiction principles would dictate the affected nation would have
jurisdiction
Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security
territorial integrity and political independence Cyberspace utilizes the other domains as a means
of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence
Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of
territorial sovereignty the Protective Security Principle does provide nations the ability to
enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos
sovereignty when it conducts cyber warfare operations However some elites donrsquot consider
cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense
International law specifically article 2 of the United Nations Charters states that a
members shall refrain in their international relations from the threat or use of force against the
territorial integrity or political independence of any state or in any other manner inconsistent
with the purposes of the United Nations which is intended to prohibit all types of force except
those carried out under the aegis of the United Nations or as provided for by the Security
Council45 The only exception to the United Nations Charters as it relates to the Use of Force is
the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed
attack46
International elites have discussed the term ldquouse of forcerdquo in the past because of the
development of chemical and biological weapons and had to move from a kinetic impact based
definition to a results-oriented approach47 Chemical and biological weapons lacked the
characteristic of an explosion or physical force yet these weapons certainly are capable of
destroying life and property Doctor Leigh Armistead a former information warfare instructor at
18
AUACSCSinksAY08
the Joint Forces Staff College cautions that the use of computer network attacks by the military
ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary
that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great
Russia introduced a proposal to the United Nations that banned the use of information
operations Even though the United Nations didnrsquot adopt the law the concern of international
community is fully aware of the impact cyber attacks can have on a nation
The concern over cyber warfare capabilities is that it can generate both non-kinetic and
kinetic effects There has always been the traditional kinetic solution for cyber warfare where a
precision guidance munition destroys a critical information system node Most people assume
computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos
computer system from the safety of onersquos own command and control center but the physical
destruction of a computer system or network by kinetic means also qualifies as cyber warfare
However cyber warfare has also evolved to the point where aggressors can achieve a kinetic
effect without the use of a traditional kinetic weapon A cyber attack on an information system
can shut down a particular node of a power plant causing the system to become inoperative
Even if there wasnrsquot an explosion the attack serves the same purpose
The question raised is do cyber attacks constitute an armed attack Scholars do agree that
some cyber attacks fit comfortably within the United Nations Charter For example a strategic
level cyber attack causing widespread damage and significant casualties would trigger the statersquos
right of self-defense In addition a cyber attack that precluded a conventional attack or a series
of cyber attacks causing significant damage would give a state the right of self-defense49 Few
would dispute that a country has the right under international law to respond with military force
19
AUACSCSinksAY08
if a state destroyed or significantly damaged another nationrsquos economic system for example the
New York or London stock exchanges
However some confusion and state-defined interpretation comes into play when the
frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard
Law School argues that cyber attacks require an expansion of the definition on the ldquouse of
forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot
be prohibited by international law50 International scholars recommend ldquoclearer rules of what
kinds of information warfare actions constitute an armed attackrdquo which drives permissible
responses of self-defense51 For example a state-sponsored cyber attack causes damage to a
victimrsquos factory or power plant however the nation claims the incident is an isolated instance
and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under
the United Nations Charter and the United Nations would consider any response retaliation
which would violate international law52
Another example involves a nation conducting a series of small attacks causing minimal
damage and then ceases Even though the aggressor used force to conduct cyber warfare
operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under
the United Nations Charter This type of attack is analogues to a small band of troops crossing a
border without causing significant damage53 According to the United Nations Charter the
national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders
and respond to the use of force Repelling the small band of troops and reestablishing their
sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration
of war and allies would have to respect the United Nations decision and couldnrsquot intervene The
same is true for the cyber attack A state can employ defensive measure to isolate and defeat the
20
AUACSCSinksAY08
incursion over the electromagnetic spectrum However the United Nations would see further
offensive operations or invasive operations as retaliation Therefore a nation must take the
incident whether it is signs of conventional forces on the ground or traces of cyber warfare
incursions in the electromagnetic spectrum to the United Nations to seek restitution
In both of these situations the international law becomes the target for change not
whether cyber warfare is in violation of international law If the law were to change the
international community would then consider the above situations acts of war even if an
adversary used conventional forces As written today the result of an operation remains the
driving factor in determining if an adversary has violated international law The means by which
an adversary conducts military operations may affect how nations react to the situation but
whether an adversary conducts the operation by means of the air land sea space or cyberspace
doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian
Triggs a public international lawyer and member of the Attorney General International Legal
Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over
offences abroad having an intended and substantial effect within a state may be justifiedrdquo54
Therefore the international community must evaluate the effect of a criminal act rather than the
means in which the act was committed
Others claim that because the Internet takes advantages of legal norms where non-state
actors can ignore Western notions of law55 more international laws are needed for cyberspace
However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using
other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the
Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked
aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts
21
AUACSCSinksAY08
against a staterdquo in the cyberspace domain The anonymity of the Internet and their total
disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and
national laws already exist in most countries that prohibit the use of the Internet for terrorist
activities therefore additional international laws wouldnrsquot prevent or deter terrorist from
committing such acts of aggression
International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed
Conflict includes the Martens Clause which extends established custom and humanitarian
principles to new technologies and addresses the ever-changing nature of warfare The
international community designed The Martens Clause ldquoto prevent future unnecessary andor
disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges
crimes by invoking the laws of humanity and public conscience hence their effects and not its
methods
The basic legal premise behind Law of Armed Conflict is that attacks must be limited to
military objectives and collateral damage must be proportionate to military advantages and
forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary
suffering but military commanders and planners need to be aware of the results a particular
action will invoke Russian leadership believes a computer network attack against their
homeland can be a means for executing a variety of escalating responses to include nuclear
attack58 Therefore it is imperative military commanders understand the impact any weapon
system can have on an adversary not just cyber attacks
Not all scholars agree that international law is insufficient to govern cyber warfare
Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace
and the Use of Force states that computer network attacks constitute an unlawful use of force in
22
AUACSCSinksAY08
cyberspace under traditional international law Sharp declared that an armed attack may occur
ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a
way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive
definition of cyber attacks may never be drafted59 The Congressional Research Service also
concluded that ldquothere is little likelihood that the international community will soon generate a
coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations
on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos
conclusion is that the effects of cyber warfare operations are the same as if an adversary
conducted conventional warfare operations where the effect of the attacks are the driving factors
in determining whether an adversary used force or not
The United States Government agrees with Sharprsquos conclusion The offensive
Information Operation strategy for the United States government as described by Doctor
Armistead ties the tools used to conduct military operations back to the desired effect which is
in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning
effects-based operations and operational art focus the Joint Force Commanderrsquos course of action
towards meeting objectives outlined in guidance provided by the National Command Authority
and senior military leadership62 Whether the tools are dropped pamphlets invasive network
attacks or bombs on targets the goal is to produce a desired effect to achieve the overall
objectives and cyber warfare can produce effects that challenge the national security of a nation
Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63
~General T Michael Moseley USAF
23
AUACSCSinksAY08
The cyberspace domain has been around for quite sometime but as technology continues
to advance businesses as well as governmental organizations are becoming more reliant on the
cyberspace domain With that reliance the protection of this critical domain becomes even more
important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the
electromagnetic spectrum by denying and disrupting information demands Scholars claim that
protection needs to include addressing existing international laws expanding them to incorporate
the ever-advancing capabilities emerging in the cyberspace domain
However territorial sovereignty of a nation and the principles of jurisdiction specifically
the Protective Security Principle give nations the right to exercise jurisdiction when an
aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64
While cyberspace is a domain requiring specific attention it relies on assets in the other domains
of land space sea and air in order to operate and international laws for the linear domains do
exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace
but during cyber warfare operations the principles behind the restrictions of foreign military
entering airspace do apply The strategic nature of cyber warfare operations correspond to the
same strategic impact that airpower can inflict upon a nation threatening their independence
While maybe not as dramatic as kinetic effects the results can be just as devastating
Space is relatively straightforward Since a nation canrsquot claim space and over flights of
foreign satellites over a nation is permissible nations must use space for peaceful purposes
Kinetic attacks against space assets are a violation of international law therefore nations would
consider cyber warfare operations against space assets as other than peaceful purposes and a
violation of international law Cyber attacks traversing space assets relate to current military
operations where the military uses space assets to conduct kinetic operations Since international
24
AUACSCSinksAY08
elites havenrsquot considered these kinetic operations as a breach of international law military
commanders can conduct cyber warfare operations through space without fear of violating
international laws for outer space
Crossing international borders without a nationrsquos permission and threatening their
sovereignty is a violation of international law While nations canrsquot consider all border crossings
as an act of war those acts of aggression that threaten the territorial integrity would elicit a
defensive response by the victim nation Whether incursions involve combat vehicles over a
highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are
threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not
have set foot in the nation but according the Protective Security Principle the victim nation has
jurisdiction
Conducting cyber warfare operations from the territorial sea is no different from
conducting operations from within a nationrsquos land or sea borders However the high seas are
very similar in nature to space in that they are reserved for peaceful purposes Therefore
conducting any means of warfare from within the high seas is a violation of international law
and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-
defense
According to Barkham ldquoinformation warfare attacks are in essence territorial
penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then
subject to the jurisdiction of the victim nation who then has the right for self-defense However
due to the global nature of cyberspace aggressors can cross multiple borders and determining
who has jurisdiction demands cooperation among nations The origin and any deliberate staging
locations of the cyber attack will drive who has jurisdiction The crossing of third party borders
25
AUACSCSinksAY08
by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the
aggressors threaten a nationrsquos independence or territorial integrity
Scholars consider cyber warfare operations that involve strategic and operational impacts
as being a means of using force and fall within the legal regime of existing international law
However scholars argue that because cyber warfare includes kinetic and non-kinetic results the
Use of Force definition needs expanding Yet they conclude that an exhaustive definition of
cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare
operations against existing case studies where the effects are evaluated as opposed to the means
even if the operations originated from outside the nationrsquos territorial jurisdiction There is some
authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to
have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade
non-state actors from conducting cyber warfare operations given their willingness to ignore
Western notions of war and their ability to conduct operations anonymously in cyberspace
International laws are in place to that address the ever-changing nature of warfare The
Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a
framework for addressing all warfare to include cyber warfare operations The international
community will need to measure the effects of an operation rather the means Whether its boots
on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a
nationrsquos response
26
AUACSCSinksAY08
End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)
27
AUACSCSinksAY08
44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
28
AUACSCSinksAY08
Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005
Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department
American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)
Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983
Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988
Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)
Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)
IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)
Joint Publication 3-13 Information Operations 13 February 2006
Joint Publication 5-0 Joint Operations Planning 26 December 2006
Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies
Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc
Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College
Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)
Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press
29
AUACSCSinksAY08
Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI
Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)
Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press
Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company
Detter Delupis I The law of war (2000) New York NY Cambridge University Press
Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)
Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College
Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor
Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)
Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)
Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf
Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)
Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College
Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College
Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)
Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA
30
AUACSCSinksAY08
Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)
Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)
Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College
Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology
Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College
Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)
OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center
OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College
OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications
Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991
Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College
Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center
Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)
31
AUACSCSinksAY08
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press
Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA
Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University
Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor
Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661
Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office
Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis
United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC
United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center
Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College
Wesley David C The Military Commander and the Law 2006
32
AUACSCSinksAY08
Table of Contents
DISCLAIMER II
ABSTRACT III
TABLE OF CONTENTS IV
INTRODUCTION 1
WHAT IS CYBER WARFARE 3 Defining Cyberspace 3 What Cyberspace is Not 4 Defining Cyber Warfare 5
TERRITORIAL SOVEREIGNTY 6 Airspace 7 Space 10 Land 12 Sea 13
APPLYING INTERNATIONAL LAW TO CYBER WARFARE 15 Jurisdiction 15 Use of Force 18 International Laws 22
CONCLUSION 23
END NOTES 27
BIBLIOGRAPHY 29
iv
AUACSCSinksAY08
Introduction We need to be able to think in terms of target effects I picture myself around that same targeting table where you have the fighter pilot the bomber pilot the special operations people and the information warrior As you go down the target list each one takes a turn raising his or her hand saying ldquoI can take that targetrdquo1
~ General (Retired) John P Jumper
The worldrsquos growing reliance on information technology to improve efficiency has
opened a threat to all who become reliant on cyberspace to conduct operationshellipa threat that has
many sources of predators ranging from pranksters to white-collar criminals to terrorists Yet
cyberspace has limited international laws to govern a worldwide domain that is ever expanding
as third world nations begin to invest in information technology and enter the cyberspace realm
to enhance business and military operations As nations begin to rely more on cyberspace as an
effective means of conducting business and military operations the more these operations will
become susceptible to outside aggressive influences whether itrsquos from economic invasions or
disruption of military operations
In addition the threat of military operations in the cyberspace domain is real The
Russian military has incorporated cyber warfare into their doctrine in order to gain information
advantage by affecting an adversaryrsquos information system decision-making processes command
and control and even the populace2 China is pursuing a battalion-sized force of computer
experts trained ldquoto carry out computer network attacks as a means of seeking asymmetrical
advantages over an adversaryrdquo3 The threat doesnrsquot reside just within state actors non-state
actors are incorporating cyber warfare operations into their realm of capabilities Hezbollah has
outlined a strategy to cripple the Israeli government by disrupting normal economic and societal
operations by targeting official websites crashing financial sites knocking out the internet
servers and targeting e-commerce sites4
In land sea and air battles military combatants can see the enemy coming whether itrsquos
1
AUACSCSinksAY08
the whites of their eyes or a blip on a screen International boundaries easily define when an
aggressor threatens the sovereignty of a nation giving the victim nation the right of jurisdiction
and there are specific international laws that address military operations in space In addition
the international community has defined when an adversaryrsquos use of force threatens a nationrsquos
territorial integrity and political independence
However the global nature of cyberspace and the speed of which victims can experience
cyber attacks force nations to deal with the legal challenges associated with over-the-horizon
military operations as commanders can experience battlefield affects with little or no warning
Moreover cyber attacks are much more difficult to define Jurisdiction over a cyber attack that
occurs 7000 miles away that crosses multiple physical domains and spans several international
borders compounds the legal issues surrounding an aggressive act that can have a wide-range of
effects Add the fact that determining the perpetrator proves to be less than speedy as most
cyber warriors can use the Internet ldquoanonymously or as a shell game to hide identitiesrdquo5 nations
face a very difficult task in attributing an aggressive act to a particular actor Responding to
asymmetric techniques tactics and procedures by state and non-state actors have proven to be
difficult for conventional forces Introducing asymmetric tactics in cyberspace presents nations
an even more challenging and complicated issue particularly in the legal regime
Therefore this paper will analyze the need for international guidance for conducting warfare
operations in the cyberspace domain This paper will define cyberspace and cyber warfare in an
effort to set the stage for illustrating the global nature of cyberspace and its reliance on the other
physical domains to conduct military operations The paper will define the international law as it
relates to territorial boundaries and outline the jurisdiction principles that allow a nation to act
against an adversary This paper outlines the definition of the Use of Force and how it
2
AUACSCSinksAY08
corresponds to the cyberspace domain and cyber warfare and with the final discussion centered
on the international laws that already exist which help shape international law for cyberspace
What is Cyber Warfare Very few of the new manifestations in war can be ascribed to new inventions or new departures in ideas6
~Carl Von Clausewitz
Defining Cyberspace William Gibson coined the term ldquocyberspacerdquo in his 1984 novel Neuromancer in order to
describe ldquoa shared virtual environment whose inhabitants objects and spaces comprise data that
is visualized heard and touchedrdquo7 However the most common of definitions today refer to the
Internet or the World Wide Web and usually consists of an information-sharing environment
between computers8 However the military has defined cyberspace to advocate a worldwide
spectrum of more than just information sharing among computers
In the National Military Strategy for Cyberspace Operations cyberspace is defined as a
domain characterized by the use of electronics and the electromagnetic spectrum to store
modify and exchange data via networked systems and associated physical infrastructure9 Joint
doctrine has adopted a computer-centric definition where cyberspace is ldquothe notional
environment in which digitized information is communicated over networksrdquo10 The National
Military Strategy and joint doctrine definitions advocate a worldwide information environment
that isnrsquot limited to the Internet or to just computers Matter of fact the expanded definitions
suggest that cyberspace consists of all networks to include highly sensitive military
governmental and commercial networks that may or may not use commercial means to store
modify and exchange data These systems include exchange networks like tactical digital
information links (TADIL) links between command and control platforms and air ground and
sea weapon systems In addition because the definition includes the electromagnetic spectrum
3
AUACSCSinksAY08
cyberspace includes ldquocapabilities that are currently considered electronic warfarerdquo11 which Great
Britain exploited in World War II when they introduced radar technology in World War II and is
still applicable with communication and navigational jamming capabilities used in todayrsquos
conflicts
While cyberspace is a unique domain that military commanders must protect in order to
conduct operations more effectively and offers commanders another dimension in which to
exploit weaknesses in an adversaryrsquos ability to project power cyberspace doesnrsquot exist on its
own According to Lt Col Fahrenkreg in the published Air University article title Cyberspace
Define ldquocyberspace exists across the other domains of air land sea and spacerdquo12 There are
clear delineations between the sea land and air Commanders know where the land ends and the
sea begins While there are some discussions as to where airspace ends and space begins the
capabilities and roles associated with each domain are clear Therefore to depict cyberspace as
an autonomous domain is unrealistic as the physical infrastructure of cyberspace and the means
of sharing information within the cyberspace domain resides in one or more of the four linear
domains
What Cyberspace is Not The most confused notion about cyberspace is that information operations and
cyberspace are one in the same Joint Publication 3-13 Information Operations describes the
information environment as a collection of leaders decision makers and systems that process
collect disseminate or act on information consisting of three dimensions the physical
informational and cognitive dimensions13 The goal of information operations is to influence the
cognitive dimension by affecting the decision-making process known affectionately by the Air
Force as the OODA Loop (Observe Orient Decide and Act)14 By disrupting and corrupting
4
AUACSCSinksAY08
information processes military commanders can influence or usurp adversarial human and
automated decision making in the physical and informational dimensions
As stated by Lt Col Fahrenkreg the confusion between cyberspace and information
operations comes from the misunderstanding of cyberspace as an operation rather than a
domain15 Information operation is a capability available to the combatant commander to
generate an effect in one of the five domains It just so happens that cyberspace tends to be the
primary means of delivering the Information Operation capability
Cyberspace connects the physical dimensions with the cognitive process and is a means
to create effects to include disrupting degrading denying the enemy the use of strategic and
operational assets to include command and controls systems power plants telecommunications
and other like targets to affect a statersquos operational and strategic centers of gravity Cyberspace
isnrsquot information or the data residing on a computer but is the means in which users transfer
store or modify information Cyberspace isnrsquot the data sent to a precision guided munition but
the means in which the originator passes the information Cyberspace is the digital super
highway of the electromagnetic spectrum with the ones zeros and electrons as the passengers
Defining Cyber Warfare According to the Institute for Advanced Study of Information Warfare (ASIW) cyber
warfare has become a form of information warfare which ASIW defines as ldquothe offensive and
defensive use of information and information systems to deny exploit corrupt or destroy and
adversaryrsquos information information-based processes information systems and computer-based
networks while protecting onersquos own Such actions are designed to achieve advantages over
military adversariesrdquo16 While this definition doesnrsquot specifically address the electromagnetic
spectrum the definition focuses on information-sharing systems which is where crux of the
cyberspace domain revolves around
5
AUACSCSinksAY08
Joint doctrine defines cyber warfare as those areas of operations that affect the
electromagnetic spectrum to include Computer Network Operations and Electronic Warfare
which are two of the five core operational capabilities of Information Operations Electronic
warfare operations operates across ldquoradio visible micro directed energy and all other
frequenciesrdquo and overlaps with network warfare operations which include ldquoradio nets satellite
links tactical digital information links (TADIL) telemetry digital track files
telecommunications and wireless communication network and systemsrdquo all of which operate
within the electromagnetic spectrum17
Cyber warfare consists of defensive and offensive operations Defensive operations
arenrsquot limited to severing connections or blocking attempts of an adversary trying to corrupt data
modify transmissions or destroy information systems Defensive operations include the
elimination of the adversaryrsquos capability of conducting operations which may involve crossing
sovereign borders in order to complete the task However defensive network operations come in
more than just one form The movies portray computer experts hovering over computers trying
to affect each otherrsquos operations However cyber warfare includes the use of traditional kinetic
effect to disrupt computer network operations of the enemy as a fighter-bomber delivering a
500-pound bomb to destroy a vital mode in a computer network may serve the same purpose as a
computer-centric network attack While this isnrsquot as sexy as a network attack that spans the
globe to degrade the enemyrsquos ability operation within the cyberspace domain the effects are the
same
Territorial Sovereignty In total war it is quite impossible to draw any precise line between military and non-military problems18
~Sir Winston Churchill
6
AUACSCSinksAY08
Cyberspace is certainly a domain that requires unique attention in order for commanders
to effectively and efficiently prosecute combat operations Cyberspace spans the globe using
the physical infrastructure residing within the other linear domains As users pass information
from one site to another data crosses boundaries by means of the cyberspace domain Data
leaves the Iraq area of operation via satellite to a receiving site in Germany Operators route the
information to the United States either through another satellite or by ground to sea-based cables
bound for computer nodes within the United States before arriving in South Carolina where
automated network tools redirect the information to the receiverrsquos location
An adversary attempting to modify corrupt or destroy this information traveling within
the cyberspace domain would at one time or another would cross sovereign borders through air
land sea or space The adversaryrsquos physical presence may not apply as they could conduct
operations from the comforts of their home however a nation could detect the adversaryrsquos
digital presence and could feel the impact of their actions from within their sovereign borders
Therefore as these adversaries span the globe using the cyberspace domain that relies on the
other linear domains to exist does international law apply when boundaries are crossed The
following sections will address the international laws of each physical domain and evaluate how
their principles apply to the cyberspace domain
Airspace Airspace as defined by Doctor Boleslaw A Boczek the internationally renowned expert
on international law ldquois the air pillow above the subjacent territoryrdquo to include ldquoairspace above
international waters and the territorial seardquo The airspace is under complete and exclusive
sovereignty of the subject state19 With that states have jurisdiction over their airspace and
require identification of foreign aircraft along with their intentions According to Dr Boczek
book International Law A Dictionary ldquoentry of national spacehellipmay take place only with the
7
AUACSCSinksAY08
authorization of the territorial staterdquo20 and currently only applies to aircraft Entry into the
airspace would require ldquoall aircraft to identify themselves file flight plans and report their
positionrdquo According to the 1944 Chicago Convention on International Civil Aviation nations
can enter into agreements that allow scheduled international civil air services which usually
include reciprocal agreements covering routes volume and other matters relating to air traffic
However these agreements only apply to civil aviation where state aircraft which include
aircraft belonging to the military customs public services and heads of states must follow more
restrictive procedures upon entering the airspace of a foreign nation21
There are several incidents where states have evoked their right for defending their
national security like the shooting down of a US military reconnaissance aircraft over Soviet
airspace by the Soviet Union in 196022 or the shooting down by Soviet fighter planes of a South
Korean airliner in 198323 The Soviet Union isnrsquot the only nation to protect its airspace as the
United States was responsible for shooting down an Iranian airliner thought to be an attacking
military plane over the Persian Gulf in 198824 These examples illustrate a nationrsquos sovereign
resolve to protect itself when a suspected adversary violated their airspace
Applying international law of airspace to cyberspace doesnrsquot seem too practical Civilian
signals entering a nationrsquos airspace would require nations to enter into agreements to allow
scheduled services and the persons receiving information through airspace would have to be
non-state sponsored Nationrsquos could regulate some cyberspace networks entering airspace like
radio communications that primarily use land-based infrastructure to function However the
very nature of computer networks and the ever-increasing global reach of communication
capabilities severely restrict a nationrsquos ability to monitor the millions of transmissions made on a
daily basis and these signals certainly wouldnrsquot be on any scheduled basis Therefore even if
8
AUACSCSinksAY08
nations made agreements concerning the cyberspace domain nations would have a difficult time
enforcing their terms of agreements unless the terms are very open-ended If they were so open-
ended then the agreement may not be necessary and based on my research nations realize the
futility of establishing these agreements as this author couldnrsquot find any reference to any
agreements that nations have entered into referencing the cyberspace domain
While the international law for civilian aircraft in airspace may not relate well or isnrsquot
feasible to enforce in the cyberspace domain does a nation have that same right to protect itself
from a suspected attack from cyberspace where the attackerrsquos signal enters airspace Does a
nation have the right to ldquoshoot downrdquo a cyberspace attack as it enters their domain through
airspace The whole idea behind restricting airspace from foreign military aircraft is because of
the strategic impact military aircraft can have on a nation As demonstrated in World War II
military aircraft carrying weapons of mass destruction can decimate cities and destroy a nation
with minimal effort The effects generated by military aircraft are quite destructive and garner
specific attention While an aircraft in of itself is relatively harmless the actions taken by the
crew can lead to devastating results
The same is true for cyber attacks The information passing through airspace in the
cyberspace domain is the vehicle however the crew conducting the operation is potentially
creating the same strategic results The cyber attack may not destroy cities but it certainly can
be destructive to a nationrsquos well-being by crippling power sources economic industries water
supply etc all at the blink of an eye while the victim takes several days to determine the
perpetrator Therefore while the international law for airspace may not be specifically relevant
the underlying principles are applicable as cyber attacks can have the same potential strategic
impact as an attack from a military aircraft
9
AUACSCSinksAY08
Space Outer space as defined by Doctor Boczek ldquois the space beyond the air surrounding the
earthrdquo As of 2005 international law doesnrsquot define a demarcation between airspace and outer
space but ldquostates agree that state sovereignty doesnrsquot extend without any limitsrdquo25 Proposals of
where airspace ends and when outer space begins are base on various scientific and technological
criteria (gravitational pull capabilities of air breathing aircraft etc26) Others scientists argue
that defining a boundary between airspace and outer space isnrsquot necessary as it would hinder the
progress of space technology and the legal status would depend on the nature of the activity
While no boundary exists airspace is finite and activity in outer space follows four
fundamentals principles First over flights of foreign satellites over a nation is permissible as
airspace doesnrsquot extend forever Second space ldquointernational law applies to outer space and
celestial bodiesrdquo Third according to the Outer Space Treaty of 1967 states canrsquot claim celestial
bodies or outer space which are not subject to national appropriation therefore are free for use
by all states Finally states must use outer space exclusively for peaceful purposes with specific
bans on weapons of mass destruction However states can use space for other military purposes
like intelligence surveillance and reconnaissance activities 27
Are these international laws and principles applicable to cyberspace Satellites are
certainly an integral part of the space domain Operators control satellites by using the
cyberspace domain and information passes between satellites and ground stations One can
argue that space is a sub-set of the cyberspace domain with satellites serving as computers in
space Global positioning system devices in vehicles interact with satellites all through an
elaborate network as part of the electromagnetic spectrum known as cyberspace Therefore
cyberspace is in space with millions of people using cyberspace everyday
10
AUACSCSinksAY08
The military uses space assets for intelligence surveillance and reconnaissance
knowledge management and command and control Agencies like the National Reconnaissance
Office and National Geospatial-Intelligence Agency obtain high-altitude imagery using a variety
of capabilities to include heat signature resonation Satellites can detect missile launches which
provide vital military information to senior leaders tasked with the security of their nation The
military networks to include decision briefs tasks and emails in Iraq and the Predator feeds in
Afghanistan travel through military and commercial satellites with all the information flowing
through the cyberspace domain With the heavy reliance of cyberspace to operate space assets
and the demands of information flowing through space by businesses it should come as no
surprise that space is a vital component for day-to-day operations of the military
Since cyberspace is an inherent component for space operations it is logical to assume
international law for outer space is applicable to cyberspace as long as an aggressor doesnt
violate the four premises and as long as weapons of mass destruction arenrsquot ldquostationed in outer
spacerdquo 28 Therefore a state would consider a cyber attack against a satellite as other than for
peaceful purposes and according to the fourth premise international law would apply
However what about a cyber attack using satellites as a means of conducting operations
Under todayrsquos current operations international elites havenrsquot considered a cyber attack passing
through space as a violation of international law When a senior leader in Qatar approves a
target set that is executed by a pilot in Nevada by an aircraft in Afghanistan all this information
is transmitted by cyberspace through space The result is that an aircraft renders an air or ground
target inoperable The effect is the same for cyberspace The information flows through space
by way of the cyberspace domain and the result is that an operator has rendered a target
11
AUACSCSinksAY08
inoperable As with airspace the information isnrsquot the cause of the damage but what an operator
does with the information is what constitutes the cyber attack
Land Cyber attacks using resources over land is relatively straightforward International
boundaries are defined as ldquoimaginary lines which separate territorial sovereigntyrdquo 29 which are
mutually agreed upon via international treaties Crossing an international border without
permission from the state is a violation of international law While an illegal immigrant crossing
a border to seek an opportunity to provide for his family is a violation of national law the United
Nation considers a nation-sponsored invasion of another nation that threatens the security and
stability of a nation as a breach in international law and an act of war
However international law doesnrsquot consider all border crossings as an act of war For
example when Nicaraguan troops and arms allegedly crossed the borders of El Salvador the
United Nations determined that incursions didnrsquot threaten El Salvadorrsquos territorial integrity and
stated that neither ldquothese incursions nor the alleged supply of arms may be relied upon as
justifying the exercise of the right of collective self-defenserdquo30 The victim state can repelled the
aggressive act but the United Nations Council wouldnrsquot condone any further military action
taken against the adversary opting for diplomatic or economic solution instead
Does international law apply when an adversary crosses international borders using
cyberspace as the means for conducting warfare operations When an adversarial state crosses a
statersquos boundaries using roads or bridges that connect the two nations the road is the resource
spanning the two nations If the adversary doesnrsquot do anything then returns to their sovereign
borders the aggressor hasnrsquot violated international law However when the adversary uses
weapon systems to affect serious damage the adversary has broken international law and a
12
AUACSCSinksAY08
nation may invoke their right for self-defense and may conduct full-scale operations to neutralize
the threat
A parallel notion is when an adversary uses a copper or fiber optic connection that spans
between two nations The adversary uses the land-based LAN connection as a means for
conducting cyber warfare operations The adversary may cross the borders using cyberspace yet
do nothing The affected state may push the adversary back to its borders but no further actions
are deemed appropriate However once the adversary uses the information transmitted over
cyberspace to cause severe operational or strategic damage the affected state now has the right
of self-defense Cyberspace is the means like the road or bridge for which the adversary
delivered the weapon The affected nation will consider the execution of the adversaryrsquos
information packet or weapon system as an act of aggression and the effect caused by the
weapon is what breeches international law
The difference between these two scenarios is that the adversary using the
electromagnetic spectrum hasnrsquot physically invaded a nationrsquos sovereign borders However
their digital presence crossed sovereign borders and as latter discussed in the paper adversaries
committing an act aggression against a state are now under the jurisdiction of the affected state
Sea ldquoThe territorial sea is a belt of sea adjacent to the (statersquos) coasthellipto include the airspace
aboverdquo as well as the seabed and subsoil31 The territorial sea is subject to the right of innocent
passage by foreign shops giving states the right to transport goods and passengers between ports
All of which is subject to the full sovereignty of the state which according to the United Nations
Convention on the Law of the Sea in 1982 and agreed upon by the majority of its membership in
1982 extends 12 miles from the coast32 The jurisdiction includes crimes where the
consequences extend to the coastal state and disturbs the peace of the country33 A cyber attack
13
AUACSCSinksAY08
conducted within the territorial sea of a nation would be no different from a cyber attack
conducted from within the nationrsquos land borders therefore cyber attacks against a state or even
another state conducted within the territorial seas are subject to current international laws Cyber
attacks originating outside the statersquos sovereign borders but results in affecting a statersquos
resources in their territorial seas would fall under the land and airspace breeches of territorial
sovereignty and would be subject to international law
The high seas on the other hand arenrsquot subject to the sovereignty of any one state The
high seas extend beyond the territorial sea and include the airspace the seabed and the subsoil34
and all states have the right to exercise freedoms on the high seas35 As similarly defined in
space ldquothe high seas shall be reserved for peaceful purposesrdquo as stated by Article 88 of the Law
of the Seas Cooperative36 which is defined as refraining from any threat or use of force (outside
of wartime conflicts)
The very nature of a cyber attack in the high seas lends itself to be a violation of
international law as nations are restricted to conducting peaceful operations in the high seas
The question is whom has jurisdiction of crimes committed in the high seas By applying the
Protective Security Principle of Jurisdiction where an actor threatens a statersquo security and
introducing the United Nationrsquos definition on the Illegal Use of Force extends to the high seas
and for that matter space giving states the right for self-defense as defined by the United Nations
as ldquoan armed attackrdquo The sheer name of cyber attack doesnrsquot immediately lend itself to an
ldquoarmedrdquo cyber attack However the effects generated from a cyber attack can be equivalent to a
traditional conventional attack and the international law would permit a state to take appropriate
countermeasures while notifying the United Nations Security Council37
14
AUACSCSinksAY08
Applying International Law to Cyber Warfare Today we live in an Information Age where communication through cyberspace has forever changed and flattened out worldhellipOur adversaries seek to operate from behind technical legal and international screens as they execute their costly attacks38
~General James E Cartwright Commander United States Strategic Command
Jurisdiction
Understanding the territorial sovereignty principles of a nation is important in applying
cyberspace and cyber warfare to existing international laws While some of these principles and
international laws may not be relevant for the cyberspace domain due to the far-reaching
capability of cyber warfare the jurisdiction of a nation further defines its ability to respond to
aggressive acts by nations in the cyberspace domain There are three jurisdictional principles
that provide nations the right to pursue aggressors that threaten a nationrsquos independence the
Territorial Principle Nationality Principle and the Protective Security Principle
For actions originating within the state the jurisdiction clearly falls within the territorial
principle where a ldquostate has jurisdiction over all crimes committed in its territoryhellipto include
airspace international waters and territorial seasrdquo39 The territorial jurisdiction is subject to
exceptions when dealing with persons from foreign states as in the most popular example of
immunity given to foreign diplomats In this case ldquostates may exercise jurisdiction over its
citizenhellipeven if they are physically outside the statesrsquo territoryrdquo as Doctor Boczek defines as the
Nationality Principle Nations usually agree upon on these concessions states prior to the offense
being committed40
Doctor Boczek defines the Protective Security Principle as a ldquojurisdictional principle
whereby a state my assume jurisdiction over and punish foreign nationals for certain conduct
outside its territory which is directed against its security territorial integrity and political
independencerdquo41 Some states would argue that criticism of a state or government is applicable
15
AUACSCSinksAY08
in applying this principle of jurisdiction However this is too broad of an interpretation and
should be confined to acts that are more tangible in nature like falsification of a statesrsquo official
documents conspiracy to violate immigration of custom laws and illicit drug trafficking42
Would a cyber attack that is deemed to challenge a nationrsquos banking community or bring
down a power source be a direct attack against its security and political independence The
international community easily sees the attack of a power source with kinetic weapons as a
violation of a territorial boundary and a breech of international law The United States viewed
the attack on the Trade Towers as an act of war launching the Global War on Terrorism Would
the United States have viewed the same devastation as if the attack occurred through cyberspace
Would the attack have been less of an act of war if the aggressor remotely controlled domestic
airliners from a foreign country Probably not What happens if the cyber attack caused a fire in
the lower floors of the buildings preventing people from escaping While less dramatic than an
airbus flying into the middle of the towers and maybe more difficult to demonize the crime the
result is the samemdashinnocent people suffering as a result of an adversary trying to threaten a
nationrsquos security
What happens if the suspected cyber attack has violated a nationrsquos territorial boundary in
order to attack a neighboring country or an ally Going from point A to point B in cyberspace is
rarely a direct connection As with the global nature of cyberspace itrsquos conceivable that
adversaries cross several nationsrsquo boundaries to conduct cyber attack operations The question
generated is who has jurisdiction
If the actor committing the crime had used an airplane each nation could claim
jurisdiction as the adversary violated their territorial boundaries and violated international law
More often than not the first state would have acted immediately upon the aggressive act and
16
AUACSCSinksAY08
would have prevented aggressors from completing their task by either forcing the aircraft to land
or turnaround or an even more escalated response of firing upon the aircraft In the air land or
sea the ability for a nationrsquos military forces to respond in a timely manner gives way to the
deterrence factor of not crossing a statersquos boundaries without receiving permission for fear of
reprisal A clear example of this was when Turkey denied the United States the ability deploy
the 4th Infantry Division from its borders at the beginning of Operation Iraqi Freedom Violating
Turkeyrsquos borders without permission would have brought about great repercussions that would
have made Operation Iraqi Freedom even more difficult and could have resulted in an escalation
of the war outside the Iraqi borders43 Another example is when Spain and France denied the
Unites States the use of their airspace when F-111s based in the United Kingdom conducted air
operations in Libya in an effort to eliminate Muammar Khadafy44
However the speeds at which these breeches in territorial boundaries occur make it
difficult for a nation to claim jurisdiction especially when nothing occurred within their
territorial sovereignty The cyber attacks didnrsquot result in any damage to nation as the information
packets passed through their sovereign borders According to territorial boundary description
described by Doctor Boczek the international community doesnrsquot consider the crossing the
border in of itself an act of warmdashserious damage is a driving factor in determining conflict
escalation In addition according to the territorial jurisdiction principle the cyber attack didnrsquot
threaten a nationrsquos security territorial integrity and political independence If the cyber attack or
information originated from within a sovereign territory by a third party then the two nations
would have to work together to resolve the issue and mutual jurisdiction would probably apply
However if the cyber attack didnrsquot physically manifest itself from within their sovereign
territory or the adversary didnrsquot use the nation as a staging area to launch a further attack the
17
AUACSCSinksAY08
international law and the jurisdiction principles would dictate the affected nation would have
jurisdiction
Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security
territorial integrity and political independence Cyberspace utilizes the other domains as a means
of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence
Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of
territorial sovereignty the Protective Security Principle does provide nations the ability to
enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos
sovereignty when it conducts cyber warfare operations However some elites donrsquot consider
cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense
International law specifically article 2 of the United Nations Charters states that a
members shall refrain in their international relations from the threat or use of force against the
territorial integrity or political independence of any state or in any other manner inconsistent
with the purposes of the United Nations which is intended to prohibit all types of force except
those carried out under the aegis of the United Nations or as provided for by the Security
Council45 The only exception to the United Nations Charters as it relates to the Use of Force is
the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed
attack46
International elites have discussed the term ldquouse of forcerdquo in the past because of the
development of chemical and biological weapons and had to move from a kinetic impact based
definition to a results-oriented approach47 Chemical and biological weapons lacked the
characteristic of an explosion or physical force yet these weapons certainly are capable of
destroying life and property Doctor Leigh Armistead a former information warfare instructor at
18
AUACSCSinksAY08
the Joint Forces Staff College cautions that the use of computer network attacks by the military
ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary
that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great
Russia introduced a proposal to the United Nations that banned the use of information
operations Even though the United Nations didnrsquot adopt the law the concern of international
community is fully aware of the impact cyber attacks can have on a nation
The concern over cyber warfare capabilities is that it can generate both non-kinetic and
kinetic effects There has always been the traditional kinetic solution for cyber warfare where a
precision guidance munition destroys a critical information system node Most people assume
computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos
computer system from the safety of onersquos own command and control center but the physical
destruction of a computer system or network by kinetic means also qualifies as cyber warfare
However cyber warfare has also evolved to the point where aggressors can achieve a kinetic
effect without the use of a traditional kinetic weapon A cyber attack on an information system
can shut down a particular node of a power plant causing the system to become inoperative
Even if there wasnrsquot an explosion the attack serves the same purpose
The question raised is do cyber attacks constitute an armed attack Scholars do agree that
some cyber attacks fit comfortably within the United Nations Charter For example a strategic
level cyber attack causing widespread damage and significant casualties would trigger the statersquos
right of self-defense In addition a cyber attack that precluded a conventional attack or a series
of cyber attacks causing significant damage would give a state the right of self-defense49 Few
would dispute that a country has the right under international law to respond with military force
19
AUACSCSinksAY08
if a state destroyed or significantly damaged another nationrsquos economic system for example the
New York or London stock exchanges
However some confusion and state-defined interpretation comes into play when the
frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard
Law School argues that cyber attacks require an expansion of the definition on the ldquouse of
forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot
be prohibited by international law50 International scholars recommend ldquoclearer rules of what
kinds of information warfare actions constitute an armed attackrdquo which drives permissible
responses of self-defense51 For example a state-sponsored cyber attack causes damage to a
victimrsquos factory or power plant however the nation claims the incident is an isolated instance
and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under
the United Nations Charter and the United Nations would consider any response retaliation
which would violate international law52
Another example involves a nation conducting a series of small attacks causing minimal
damage and then ceases Even though the aggressor used force to conduct cyber warfare
operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under
the United Nations Charter This type of attack is analogues to a small band of troops crossing a
border without causing significant damage53 According to the United Nations Charter the
national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders
and respond to the use of force Repelling the small band of troops and reestablishing their
sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration
of war and allies would have to respect the United Nations decision and couldnrsquot intervene The
same is true for the cyber attack A state can employ defensive measure to isolate and defeat the
20
AUACSCSinksAY08
incursion over the electromagnetic spectrum However the United Nations would see further
offensive operations or invasive operations as retaliation Therefore a nation must take the
incident whether it is signs of conventional forces on the ground or traces of cyber warfare
incursions in the electromagnetic spectrum to the United Nations to seek restitution
In both of these situations the international law becomes the target for change not
whether cyber warfare is in violation of international law If the law were to change the
international community would then consider the above situations acts of war even if an
adversary used conventional forces As written today the result of an operation remains the
driving factor in determining if an adversary has violated international law The means by which
an adversary conducts military operations may affect how nations react to the situation but
whether an adversary conducts the operation by means of the air land sea space or cyberspace
doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian
Triggs a public international lawyer and member of the Attorney General International Legal
Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over
offences abroad having an intended and substantial effect within a state may be justifiedrdquo54
Therefore the international community must evaluate the effect of a criminal act rather than the
means in which the act was committed
Others claim that because the Internet takes advantages of legal norms where non-state
actors can ignore Western notions of law55 more international laws are needed for cyberspace
However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using
other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the
Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked
aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts
21
AUACSCSinksAY08
against a staterdquo in the cyberspace domain The anonymity of the Internet and their total
disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and
national laws already exist in most countries that prohibit the use of the Internet for terrorist
activities therefore additional international laws wouldnrsquot prevent or deter terrorist from
committing such acts of aggression
International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed
Conflict includes the Martens Clause which extends established custom and humanitarian
principles to new technologies and addresses the ever-changing nature of warfare The
international community designed The Martens Clause ldquoto prevent future unnecessary andor
disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges
crimes by invoking the laws of humanity and public conscience hence their effects and not its
methods
The basic legal premise behind Law of Armed Conflict is that attacks must be limited to
military objectives and collateral damage must be proportionate to military advantages and
forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary
suffering but military commanders and planners need to be aware of the results a particular
action will invoke Russian leadership believes a computer network attack against their
homeland can be a means for executing a variety of escalating responses to include nuclear
attack58 Therefore it is imperative military commanders understand the impact any weapon
system can have on an adversary not just cyber attacks
Not all scholars agree that international law is insufficient to govern cyber warfare
Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace
and the Use of Force states that computer network attacks constitute an unlawful use of force in
22
AUACSCSinksAY08
cyberspace under traditional international law Sharp declared that an armed attack may occur
ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a
way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive
definition of cyber attacks may never be drafted59 The Congressional Research Service also
concluded that ldquothere is little likelihood that the international community will soon generate a
coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations
on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos
conclusion is that the effects of cyber warfare operations are the same as if an adversary
conducted conventional warfare operations where the effect of the attacks are the driving factors
in determining whether an adversary used force or not
The United States Government agrees with Sharprsquos conclusion The offensive
Information Operation strategy for the United States government as described by Doctor
Armistead ties the tools used to conduct military operations back to the desired effect which is
in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning
effects-based operations and operational art focus the Joint Force Commanderrsquos course of action
towards meeting objectives outlined in guidance provided by the National Command Authority
and senior military leadership62 Whether the tools are dropped pamphlets invasive network
attacks or bombs on targets the goal is to produce a desired effect to achieve the overall
objectives and cyber warfare can produce effects that challenge the national security of a nation
Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63
~General T Michael Moseley USAF
23
AUACSCSinksAY08
The cyberspace domain has been around for quite sometime but as technology continues
to advance businesses as well as governmental organizations are becoming more reliant on the
cyberspace domain With that reliance the protection of this critical domain becomes even more
important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the
electromagnetic spectrum by denying and disrupting information demands Scholars claim that
protection needs to include addressing existing international laws expanding them to incorporate
the ever-advancing capabilities emerging in the cyberspace domain
However territorial sovereignty of a nation and the principles of jurisdiction specifically
the Protective Security Principle give nations the right to exercise jurisdiction when an
aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64
While cyberspace is a domain requiring specific attention it relies on assets in the other domains
of land space sea and air in order to operate and international laws for the linear domains do
exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace
but during cyber warfare operations the principles behind the restrictions of foreign military
entering airspace do apply The strategic nature of cyber warfare operations correspond to the
same strategic impact that airpower can inflict upon a nation threatening their independence
While maybe not as dramatic as kinetic effects the results can be just as devastating
Space is relatively straightforward Since a nation canrsquot claim space and over flights of
foreign satellites over a nation is permissible nations must use space for peaceful purposes
Kinetic attacks against space assets are a violation of international law therefore nations would
consider cyber warfare operations against space assets as other than peaceful purposes and a
violation of international law Cyber attacks traversing space assets relate to current military
operations where the military uses space assets to conduct kinetic operations Since international
24
AUACSCSinksAY08
elites havenrsquot considered these kinetic operations as a breach of international law military
commanders can conduct cyber warfare operations through space without fear of violating
international laws for outer space
Crossing international borders without a nationrsquos permission and threatening their
sovereignty is a violation of international law While nations canrsquot consider all border crossings
as an act of war those acts of aggression that threaten the territorial integrity would elicit a
defensive response by the victim nation Whether incursions involve combat vehicles over a
highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are
threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not
have set foot in the nation but according the Protective Security Principle the victim nation has
jurisdiction
Conducting cyber warfare operations from the territorial sea is no different from
conducting operations from within a nationrsquos land or sea borders However the high seas are
very similar in nature to space in that they are reserved for peaceful purposes Therefore
conducting any means of warfare from within the high seas is a violation of international law
and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-
defense
According to Barkham ldquoinformation warfare attacks are in essence territorial
penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then
subject to the jurisdiction of the victim nation who then has the right for self-defense However
due to the global nature of cyberspace aggressors can cross multiple borders and determining
who has jurisdiction demands cooperation among nations The origin and any deliberate staging
locations of the cyber attack will drive who has jurisdiction The crossing of third party borders
25
AUACSCSinksAY08
by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the
aggressors threaten a nationrsquos independence or territorial integrity
Scholars consider cyber warfare operations that involve strategic and operational impacts
as being a means of using force and fall within the legal regime of existing international law
However scholars argue that because cyber warfare includes kinetic and non-kinetic results the
Use of Force definition needs expanding Yet they conclude that an exhaustive definition of
cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare
operations against existing case studies where the effects are evaluated as opposed to the means
even if the operations originated from outside the nationrsquos territorial jurisdiction There is some
authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to
have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade
non-state actors from conducting cyber warfare operations given their willingness to ignore
Western notions of war and their ability to conduct operations anonymously in cyberspace
International laws are in place to that address the ever-changing nature of warfare The
Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a
framework for addressing all warfare to include cyber warfare operations The international
community will need to measure the effects of an operation rather the means Whether its boots
on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a
nationrsquos response
26
AUACSCSinksAY08
End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)
27
AUACSCSinksAY08
44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
28
AUACSCSinksAY08
Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005
Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department
American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)
Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983
Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988
Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)
Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)
IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)
Joint Publication 3-13 Information Operations 13 February 2006
Joint Publication 5-0 Joint Operations Planning 26 December 2006
Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies
Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc
Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College
Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)
Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press
29
AUACSCSinksAY08
Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI
Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)
Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press
Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company
Detter Delupis I The law of war (2000) New York NY Cambridge University Press
Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)
Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College
Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor
Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)
Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)
Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf
Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)
Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College
Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College
Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)
Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA
30
AUACSCSinksAY08
Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)
Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)
Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College
Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology
Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College
Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)
OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center
OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College
OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications
Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991
Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College
Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center
Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)
31
AUACSCSinksAY08
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press
Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA
Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University
Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor
Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661
Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office
Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis
United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC
United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center
Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College
Wesley David C The Military Commander and the Law 2006
32
AUACSCSinksAY08
Introduction We need to be able to think in terms of target effects I picture myself around that same targeting table where you have the fighter pilot the bomber pilot the special operations people and the information warrior As you go down the target list each one takes a turn raising his or her hand saying ldquoI can take that targetrdquo1
~ General (Retired) John P Jumper
The worldrsquos growing reliance on information technology to improve efficiency has
opened a threat to all who become reliant on cyberspace to conduct operationshellipa threat that has
many sources of predators ranging from pranksters to white-collar criminals to terrorists Yet
cyberspace has limited international laws to govern a worldwide domain that is ever expanding
as third world nations begin to invest in information technology and enter the cyberspace realm
to enhance business and military operations As nations begin to rely more on cyberspace as an
effective means of conducting business and military operations the more these operations will
become susceptible to outside aggressive influences whether itrsquos from economic invasions or
disruption of military operations
In addition the threat of military operations in the cyberspace domain is real The
Russian military has incorporated cyber warfare into their doctrine in order to gain information
advantage by affecting an adversaryrsquos information system decision-making processes command
and control and even the populace2 China is pursuing a battalion-sized force of computer
experts trained ldquoto carry out computer network attacks as a means of seeking asymmetrical
advantages over an adversaryrdquo3 The threat doesnrsquot reside just within state actors non-state
actors are incorporating cyber warfare operations into their realm of capabilities Hezbollah has
outlined a strategy to cripple the Israeli government by disrupting normal economic and societal
operations by targeting official websites crashing financial sites knocking out the internet
servers and targeting e-commerce sites4
In land sea and air battles military combatants can see the enemy coming whether itrsquos
1
AUACSCSinksAY08
the whites of their eyes or a blip on a screen International boundaries easily define when an
aggressor threatens the sovereignty of a nation giving the victim nation the right of jurisdiction
and there are specific international laws that address military operations in space In addition
the international community has defined when an adversaryrsquos use of force threatens a nationrsquos
territorial integrity and political independence
However the global nature of cyberspace and the speed of which victims can experience
cyber attacks force nations to deal with the legal challenges associated with over-the-horizon
military operations as commanders can experience battlefield affects with little or no warning
Moreover cyber attacks are much more difficult to define Jurisdiction over a cyber attack that
occurs 7000 miles away that crosses multiple physical domains and spans several international
borders compounds the legal issues surrounding an aggressive act that can have a wide-range of
effects Add the fact that determining the perpetrator proves to be less than speedy as most
cyber warriors can use the Internet ldquoanonymously or as a shell game to hide identitiesrdquo5 nations
face a very difficult task in attributing an aggressive act to a particular actor Responding to
asymmetric techniques tactics and procedures by state and non-state actors have proven to be
difficult for conventional forces Introducing asymmetric tactics in cyberspace presents nations
an even more challenging and complicated issue particularly in the legal regime
Therefore this paper will analyze the need for international guidance for conducting warfare
operations in the cyberspace domain This paper will define cyberspace and cyber warfare in an
effort to set the stage for illustrating the global nature of cyberspace and its reliance on the other
physical domains to conduct military operations The paper will define the international law as it
relates to territorial boundaries and outline the jurisdiction principles that allow a nation to act
against an adversary This paper outlines the definition of the Use of Force and how it
2
AUACSCSinksAY08
corresponds to the cyberspace domain and cyber warfare and with the final discussion centered
on the international laws that already exist which help shape international law for cyberspace
What is Cyber Warfare Very few of the new manifestations in war can be ascribed to new inventions or new departures in ideas6
~Carl Von Clausewitz
Defining Cyberspace William Gibson coined the term ldquocyberspacerdquo in his 1984 novel Neuromancer in order to
describe ldquoa shared virtual environment whose inhabitants objects and spaces comprise data that
is visualized heard and touchedrdquo7 However the most common of definitions today refer to the
Internet or the World Wide Web and usually consists of an information-sharing environment
between computers8 However the military has defined cyberspace to advocate a worldwide
spectrum of more than just information sharing among computers
In the National Military Strategy for Cyberspace Operations cyberspace is defined as a
domain characterized by the use of electronics and the electromagnetic spectrum to store
modify and exchange data via networked systems and associated physical infrastructure9 Joint
doctrine has adopted a computer-centric definition where cyberspace is ldquothe notional
environment in which digitized information is communicated over networksrdquo10 The National
Military Strategy and joint doctrine definitions advocate a worldwide information environment
that isnrsquot limited to the Internet or to just computers Matter of fact the expanded definitions
suggest that cyberspace consists of all networks to include highly sensitive military
governmental and commercial networks that may or may not use commercial means to store
modify and exchange data These systems include exchange networks like tactical digital
information links (TADIL) links between command and control platforms and air ground and
sea weapon systems In addition because the definition includes the electromagnetic spectrum
3
AUACSCSinksAY08
cyberspace includes ldquocapabilities that are currently considered electronic warfarerdquo11 which Great
Britain exploited in World War II when they introduced radar technology in World War II and is
still applicable with communication and navigational jamming capabilities used in todayrsquos
conflicts
While cyberspace is a unique domain that military commanders must protect in order to
conduct operations more effectively and offers commanders another dimension in which to
exploit weaknesses in an adversaryrsquos ability to project power cyberspace doesnrsquot exist on its
own According to Lt Col Fahrenkreg in the published Air University article title Cyberspace
Define ldquocyberspace exists across the other domains of air land sea and spacerdquo12 There are
clear delineations between the sea land and air Commanders know where the land ends and the
sea begins While there are some discussions as to where airspace ends and space begins the
capabilities and roles associated with each domain are clear Therefore to depict cyberspace as
an autonomous domain is unrealistic as the physical infrastructure of cyberspace and the means
of sharing information within the cyberspace domain resides in one or more of the four linear
domains
What Cyberspace is Not The most confused notion about cyberspace is that information operations and
cyberspace are one in the same Joint Publication 3-13 Information Operations describes the
information environment as a collection of leaders decision makers and systems that process
collect disseminate or act on information consisting of three dimensions the physical
informational and cognitive dimensions13 The goal of information operations is to influence the
cognitive dimension by affecting the decision-making process known affectionately by the Air
Force as the OODA Loop (Observe Orient Decide and Act)14 By disrupting and corrupting
4
AUACSCSinksAY08
information processes military commanders can influence or usurp adversarial human and
automated decision making in the physical and informational dimensions
As stated by Lt Col Fahrenkreg the confusion between cyberspace and information
operations comes from the misunderstanding of cyberspace as an operation rather than a
domain15 Information operation is a capability available to the combatant commander to
generate an effect in one of the five domains It just so happens that cyberspace tends to be the
primary means of delivering the Information Operation capability
Cyberspace connects the physical dimensions with the cognitive process and is a means
to create effects to include disrupting degrading denying the enemy the use of strategic and
operational assets to include command and controls systems power plants telecommunications
and other like targets to affect a statersquos operational and strategic centers of gravity Cyberspace
isnrsquot information or the data residing on a computer but is the means in which users transfer
store or modify information Cyberspace isnrsquot the data sent to a precision guided munition but
the means in which the originator passes the information Cyberspace is the digital super
highway of the electromagnetic spectrum with the ones zeros and electrons as the passengers
Defining Cyber Warfare According to the Institute for Advanced Study of Information Warfare (ASIW) cyber
warfare has become a form of information warfare which ASIW defines as ldquothe offensive and
defensive use of information and information systems to deny exploit corrupt or destroy and
adversaryrsquos information information-based processes information systems and computer-based
networks while protecting onersquos own Such actions are designed to achieve advantages over
military adversariesrdquo16 While this definition doesnrsquot specifically address the electromagnetic
spectrum the definition focuses on information-sharing systems which is where crux of the
cyberspace domain revolves around
5
AUACSCSinksAY08
Joint doctrine defines cyber warfare as those areas of operations that affect the
electromagnetic spectrum to include Computer Network Operations and Electronic Warfare
which are two of the five core operational capabilities of Information Operations Electronic
warfare operations operates across ldquoradio visible micro directed energy and all other
frequenciesrdquo and overlaps with network warfare operations which include ldquoradio nets satellite
links tactical digital information links (TADIL) telemetry digital track files
telecommunications and wireless communication network and systemsrdquo all of which operate
within the electromagnetic spectrum17
Cyber warfare consists of defensive and offensive operations Defensive operations
arenrsquot limited to severing connections or blocking attempts of an adversary trying to corrupt data
modify transmissions or destroy information systems Defensive operations include the
elimination of the adversaryrsquos capability of conducting operations which may involve crossing
sovereign borders in order to complete the task However defensive network operations come in
more than just one form The movies portray computer experts hovering over computers trying
to affect each otherrsquos operations However cyber warfare includes the use of traditional kinetic
effect to disrupt computer network operations of the enemy as a fighter-bomber delivering a
500-pound bomb to destroy a vital mode in a computer network may serve the same purpose as a
computer-centric network attack While this isnrsquot as sexy as a network attack that spans the
globe to degrade the enemyrsquos ability operation within the cyberspace domain the effects are the
same
Territorial Sovereignty In total war it is quite impossible to draw any precise line between military and non-military problems18
~Sir Winston Churchill
6
AUACSCSinksAY08
Cyberspace is certainly a domain that requires unique attention in order for commanders
to effectively and efficiently prosecute combat operations Cyberspace spans the globe using
the physical infrastructure residing within the other linear domains As users pass information
from one site to another data crosses boundaries by means of the cyberspace domain Data
leaves the Iraq area of operation via satellite to a receiving site in Germany Operators route the
information to the United States either through another satellite or by ground to sea-based cables
bound for computer nodes within the United States before arriving in South Carolina where
automated network tools redirect the information to the receiverrsquos location
An adversary attempting to modify corrupt or destroy this information traveling within
the cyberspace domain would at one time or another would cross sovereign borders through air
land sea or space The adversaryrsquos physical presence may not apply as they could conduct
operations from the comforts of their home however a nation could detect the adversaryrsquos
digital presence and could feel the impact of their actions from within their sovereign borders
Therefore as these adversaries span the globe using the cyberspace domain that relies on the
other linear domains to exist does international law apply when boundaries are crossed The
following sections will address the international laws of each physical domain and evaluate how
their principles apply to the cyberspace domain
Airspace Airspace as defined by Doctor Boleslaw A Boczek the internationally renowned expert
on international law ldquois the air pillow above the subjacent territoryrdquo to include ldquoairspace above
international waters and the territorial seardquo The airspace is under complete and exclusive
sovereignty of the subject state19 With that states have jurisdiction over their airspace and
require identification of foreign aircraft along with their intentions According to Dr Boczek
book International Law A Dictionary ldquoentry of national spacehellipmay take place only with the
7
AUACSCSinksAY08
authorization of the territorial staterdquo20 and currently only applies to aircraft Entry into the
airspace would require ldquoall aircraft to identify themselves file flight plans and report their
positionrdquo According to the 1944 Chicago Convention on International Civil Aviation nations
can enter into agreements that allow scheduled international civil air services which usually
include reciprocal agreements covering routes volume and other matters relating to air traffic
However these agreements only apply to civil aviation where state aircraft which include
aircraft belonging to the military customs public services and heads of states must follow more
restrictive procedures upon entering the airspace of a foreign nation21
There are several incidents where states have evoked their right for defending their
national security like the shooting down of a US military reconnaissance aircraft over Soviet
airspace by the Soviet Union in 196022 or the shooting down by Soviet fighter planes of a South
Korean airliner in 198323 The Soviet Union isnrsquot the only nation to protect its airspace as the
United States was responsible for shooting down an Iranian airliner thought to be an attacking
military plane over the Persian Gulf in 198824 These examples illustrate a nationrsquos sovereign
resolve to protect itself when a suspected adversary violated their airspace
Applying international law of airspace to cyberspace doesnrsquot seem too practical Civilian
signals entering a nationrsquos airspace would require nations to enter into agreements to allow
scheduled services and the persons receiving information through airspace would have to be
non-state sponsored Nationrsquos could regulate some cyberspace networks entering airspace like
radio communications that primarily use land-based infrastructure to function However the
very nature of computer networks and the ever-increasing global reach of communication
capabilities severely restrict a nationrsquos ability to monitor the millions of transmissions made on a
daily basis and these signals certainly wouldnrsquot be on any scheduled basis Therefore even if
8
AUACSCSinksAY08
nations made agreements concerning the cyberspace domain nations would have a difficult time
enforcing their terms of agreements unless the terms are very open-ended If they were so open-
ended then the agreement may not be necessary and based on my research nations realize the
futility of establishing these agreements as this author couldnrsquot find any reference to any
agreements that nations have entered into referencing the cyberspace domain
While the international law for civilian aircraft in airspace may not relate well or isnrsquot
feasible to enforce in the cyberspace domain does a nation have that same right to protect itself
from a suspected attack from cyberspace where the attackerrsquos signal enters airspace Does a
nation have the right to ldquoshoot downrdquo a cyberspace attack as it enters their domain through
airspace The whole idea behind restricting airspace from foreign military aircraft is because of
the strategic impact military aircraft can have on a nation As demonstrated in World War II
military aircraft carrying weapons of mass destruction can decimate cities and destroy a nation
with minimal effort The effects generated by military aircraft are quite destructive and garner
specific attention While an aircraft in of itself is relatively harmless the actions taken by the
crew can lead to devastating results
The same is true for cyber attacks The information passing through airspace in the
cyberspace domain is the vehicle however the crew conducting the operation is potentially
creating the same strategic results The cyber attack may not destroy cities but it certainly can
be destructive to a nationrsquos well-being by crippling power sources economic industries water
supply etc all at the blink of an eye while the victim takes several days to determine the
perpetrator Therefore while the international law for airspace may not be specifically relevant
the underlying principles are applicable as cyber attacks can have the same potential strategic
impact as an attack from a military aircraft
9
AUACSCSinksAY08
Space Outer space as defined by Doctor Boczek ldquois the space beyond the air surrounding the
earthrdquo As of 2005 international law doesnrsquot define a demarcation between airspace and outer
space but ldquostates agree that state sovereignty doesnrsquot extend without any limitsrdquo25 Proposals of
where airspace ends and when outer space begins are base on various scientific and technological
criteria (gravitational pull capabilities of air breathing aircraft etc26) Others scientists argue
that defining a boundary between airspace and outer space isnrsquot necessary as it would hinder the
progress of space technology and the legal status would depend on the nature of the activity
While no boundary exists airspace is finite and activity in outer space follows four
fundamentals principles First over flights of foreign satellites over a nation is permissible as
airspace doesnrsquot extend forever Second space ldquointernational law applies to outer space and
celestial bodiesrdquo Third according to the Outer Space Treaty of 1967 states canrsquot claim celestial
bodies or outer space which are not subject to national appropriation therefore are free for use
by all states Finally states must use outer space exclusively for peaceful purposes with specific
bans on weapons of mass destruction However states can use space for other military purposes
like intelligence surveillance and reconnaissance activities 27
Are these international laws and principles applicable to cyberspace Satellites are
certainly an integral part of the space domain Operators control satellites by using the
cyberspace domain and information passes between satellites and ground stations One can
argue that space is a sub-set of the cyberspace domain with satellites serving as computers in
space Global positioning system devices in vehicles interact with satellites all through an
elaborate network as part of the electromagnetic spectrum known as cyberspace Therefore
cyberspace is in space with millions of people using cyberspace everyday
10
AUACSCSinksAY08
The military uses space assets for intelligence surveillance and reconnaissance
knowledge management and command and control Agencies like the National Reconnaissance
Office and National Geospatial-Intelligence Agency obtain high-altitude imagery using a variety
of capabilities to include heat signature resonation Satellites can detect missile launches which
provide vital military information to senior leaders tasked with the security of their nation The
military networks to include decision briefs tasks and emails in Iraq and the Predator feeds in
Afghanistan travel through military and commercial satellites with all the information flowing
through the cyberspace domain With the heavy reliance of cyberspace to operate space assets
and the demands of information flowing through space by businesses it should come as no
surprise that space is a vital component for day-to-day operations of the military
Since cyberspace is an inherent component for space operations it is logical to assume
international law for outer space is applicable to cyberspace as long as an aggressor doesnt
violate the four premises and as long as weapons of mass destruction arenrsquot ldquostationed in outer
spacerdquo 28 Therefore a state would consider a cyber attack against a satellite as other than for
peaceful purposes and according to the fourth premise international law would apply
However what about a cyber attack using satellites as a means of conducting operations
Under todayrsquos current operations international elites havenrsquot considered a cyber attack passing
through space as a violation of international law When a senior leader in Qatar approves a
target set that is executed by a pilot in Nevada by an aircraft in Afghanistan all this information
is transmitted by cyberspace through space The result is that an aircraft renders an air or ground
target inoperable The effect is the same for cyberspace The information flows through space
by way of the cyberspace domain and the result is that an operator has rendered a target
11
AUACSCSinksAY08
inoperable As with airspace the information isnrsquot the cause of the damage but what an operator
does with the information is what constitutes the cyber attack
Land Cyber attacks using resources over land is relatively straightforward International
boundaries are defined as ldquoimaginary lines which separate territorial sovereigntyrdquo 29 which are
mutually agreed upon via international treaties Crossing an international border without
permission from the state is a violation of international law While an illegal immigrant crossing
a border to seek an opportunity to provide for his family is a violation of national law the United
Nation considers a nation-sponsored invasion of another nation that threatens the security and
stability of a nation as a breach in international law and an act of war
However international law doesnrsquot consider all border crossings as an act of war For
example when Nicaraguan troops and arms allegedly crossed the borders of El Salvador the
United Nations determined that incursions didnrsquot threaten El Salvadorrsquos territorial integrity and
stated that neither ldquothese incursions nor the alleged supply of arms may be relied upon as
justifying the exercise of the right of collective self-defenserdquo30 The victim state can repelled the
aggressive act but the United Nations Council wouldnrsquot condone any further military action
taken against the adversary opting for diplomatic or economic solution instead
Does international law apply when an adversary crosses international borders using
cyberspace as the means for conducting warfare operations When an adversarial state crosses a
statersquos boundaries using roads or bridges that connect the two nations the road is the resource
spanning the two nations If the adversary doesnrsquot do anything then returns to their sovereign
borders the aggressor hasnrsquot violated international law However when the adversary uses
weapon systems to affect serious damage the adversary has broken international law and a
12
AUACSCSinksAY08
nation may invoke their right for self-defense and may conduct full-scale operations to neutralize
the threat
A parallel notion is when an adversary uses a copper or fiber optic connection that spans
between two nations The adversary uses the land-based LAN connection as a means for
conducting cyber warfare operations The adversary may cross the borders using cyberspace yet
do nothing The affected state may push the adversary back to its borders but no further actions
are deemed appropriate However once the adversary uses the information transmitted over
cyberspace to cause severe operational or strategic damage the affected state now has the right
of self-defense Cyberspace is the means like the road or bridge for which the adversary
delivered the weapon The affected nation will consider the execution of the adversaryrsquos
information packet or weapon system as an act of aggression and the effect caused by the
weapon is what breeches international law
The difference between these two scenarios is that the adversary using the
electromagnetic spectrum hasnrsquot physically invaded a nationrsquos sovereign borders However
their digital presence crossed sovereign borders and as latter discussed in the paper adversaries
committing an act aggression against a state are now under the jurisdiction of the affected state
Sea ldquoThe territorial sea is a belt of sea adjacent to the (statersquos) coasthellipto include the airspace
aboverdquo as well as the seabed and subsoil31 The territorial sea is subject to the right of innocent
passage by foreign shops giving states the right to transport goods and passengers between ports
All of which is subject to the full sovereignty of the state which according to the United Nations
Convention on the Law of the Sea in 1982 and agreed upon by the majority of its membership in
1982 extends 12 miles from the coast32 The jurisdiction includes crimes where the
consequences extend to the coastal state and disturbs the peace of the country33 A cyber attack
13
AUACSCSinksAY08
conducted within the territorial sea of a nation would be no different from a cyber attack
conducted from within the nationrsquos land borders therefore cyber attacks against a state or even
another state conducted within the territorial seas are subject to current international laws Cyber
attacks originating outside the statersquos sovereign borders but results in affecting a statersquos
resources in their territorial seas would fall under the land and airspace breeches of territorial
sovereignty and would be subject to international law
The high seas on the other hand arenrsquot subject to the sovereignty of any one state The
high seas extend beyond the territorial sea and include the airspace the seabed and the subsoil34
and all states have the right to exercise freedoms on the high seas35 As similarly defined in
space ldquothe high seas shall be reserved for peaceful purposesrdquo as stated by Article 88 of the Law
of the Seas Cooperative36 which is defined as refraining from any threat or use of force (outside
of wartime conflicts)
The very nature of a cyber attack in the high seas lends itself to be a violation of
international law as nations are restricted to conducting peaceful operations in the high seas
The question is whom has jurisdiction of crimes committed in the high seas By applying the
Protective Security Principle of Jurisdiction where an actor threatens a statersquo security and
introducing the United Nationrsquos definition on the Illegal Use of Force extends to the high seas
and for that matter space giving states the right for self-defense as defined by the United Nations
as ldquoan armed attackrdquo The sheer name of cyber attack doesnrsquot immediately lend itself to an
ldquoarmedrdquo cyber attack However the effects generated from a cyber attack can be equivalent to a
traditional conventional attack and the international law would permit a state to take appropriate
countermeasures while notifying the United Nations Security Council37
14
AUACSCSinksAY08
Applying International Law to Cyber Warfare Today we live in an Information Age where communication through cyberspace has forever changed and flattened out worldhellipOur adversaries seek to operate from behind technical legal and international screens as they execute their costly attacks38
~General James E Cartwright Commander United States Strategic Command
Jurisdiction
Understanding the territorial sovereignty principles of a nation is important in applying
cyberspace and cyber warfare to existing international laws While some of these principles and
international laws may not be relevant for the cyberspace domain due to the far-reaching
capability of cyber warfare the jurisdiction of a nation further defines its ability to respond to
aggressive acts by nations in the cyberspace domain There are three jurisdictional principles
that provide nations the right to pursue aggressors that threaten a nationrsquos independence the
Territorial Principle Nationality Principle and the Protective Security Principle
For actions originating within the state the jurisdiction clearly falls within the territorial
principle where a ldquostate has jurisdiction over all crimes committed in its territoryhellipto include
airspace international waters and territorial seasrdquo39 The territorial jurisdiction is subject to
exceptions when dealing with persons from foreign states as in the most popular example of
immunity given to foreign diplomats In this case ldquostates may exercise jurisdiction over its
citizenhellipeven if they are physically outside the statesrsquo territoryrdquo as Doctor Boczek defines as the
Nationality Principle Nations usually agree upon on these concessions states prior to the offense
being committed40
Doctor Boczek defines the Protective Security Principle as a ldquojurisdictional principle
whereby a state my assume jurisdiction over and punish foreign nationals for certain conduct
outside its territory which is directed against its security territorial integrity and political
independencerdquo41 Some states would argue that criticism of a state or government is applicable
15
AUACSCSinksAY08
in applying this principle of jurisdiction However this is too broad of an interpretation and
should be confined to acts that are more tangible in nature like falsification of a statesrsquo official
documents conspiracy to violate immigration of custom laws and illicit drug trafficking42
Would a cyber attack that is deemed to challenge a nationrsquos banking community or bring
down a power source be a direct attack against its security and political independence The
international community easily sees the attack of a power source with kinetic weapons as a
violation of a territorial boundary and a breech of international law The United States viewed
the attack on the Trade Towers as an act of war launching the Global War on Terrorism Would
the United States have viewed the same devastation as if the attack occurred through cyberspace
Would the attack have been less of an act of war if the aggressor remotely controlled domestic
airliners from a foreign country Probably not What happens if the cyber attack caused a fire in
the lower floors of the buildings preventing people from escaping While less dramatic than an
airbus flying into the middle of the towers and maybe more difficult to demonize the crime the
result is the samemdashinnocent people suffering as a result of an adversary trying to threaten a
nationrsquos security
What happens if the suspected cyber attack has violated a nationrsquos territorial boundary in
order to attack a neighboring country or an ally Going from point A to point B in cyberspace is
rarely a direct connection As with the global nature of cyberspace itrsquos conceivable that
adversaries cross several nationsrsquo boundaries to conduct cyber attack operations The question
generated is who has jurisdiction
If the actor committing the crime had used an airplane each nation could claim
jurisdiction as the adversary violated their territorial boundaries and violated international law
More often than not the first state would have acted immediately upon the aggressive act and
16
AUACSCSinksAY08
would have prevented aggressors from completing their task by either forcing the aircraft to land
or turnaround or an even more escalated response of firing upon the aircraft In the air land or
sea the ability for a nationrsquos military forces to respond in a timely manner gives way to the
deterrence factor of not crossing a statersquos boundaries without receiving permission for fear of
reprisal A clear example of this was when Turkey denied the United States the ability deploy
the 4th Infantry Division from its borders at the beginning of Operation Iraqi Freedom Violating
Turkeyrsquos borders without permission would have brought about great repercussions that would
have made Operation Iraqi Freedom even more difficult and could have resulted in an escalation
of the war outside the Iraqi borders43 Another example is when Spain and France denied the
Unites States the use of their airspace when F-111s based in the United Kingdom conducted air
operations in Libya in an effort to eliminate Muammar Khadafy44
However the speeds at which these breeches in territorial boundaries occur make it
difficult for a nation to claim jurisdiction especially when nothing occurred within their
territorial sovereignty The cyber attacks didnrsquot result in any damage to nation as the information
packets passed through their sovereign borders According to territorial boundary description
described by Doctor Boczek the international community doesnrsquot consider the crossing the
border in of itself an act of warmdashserious damage is a driving factor in determining conflict
escalation In addition according to the territorial jurisdiction principle the cyber attack didnrsquot
threaten a nationrsquos security territorial integrity and political independence If the cyber attack or
information originated from within a sovereign territory by a third party then the two nations
would have to work together to resolve the issue and mutual jurisdiction would probably apply
However if the cyber attack didnrsquot physically manifest itself from within their sovereign
territory or the adversary didnrsquot use the nation as a staging area to launch a further attack the
17
AUACSCSinksAY08
international law and the jurisdiction principles would dictate the affected nation would have
jurisdiction
Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security
territorial integrity and political independence Cyberspace utilizes the other domains as a means
of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence
Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of
territorial sovereignty the Protective Security Principle does provide nations the ability to
enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos
sovereignty when it conducts cyber warfare operations However some elites donrsquot consider
cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense
International law specifically article 2 of the United Nations Charters states that a
members shall refrain in their international relations from the threat or use of force against the
territorial integrity or political independence of any state or in any other manner inconsistent
with the purposes of the United Nations which is intended to prohibit all types of force except
those carried out under the aegis of the United Nations or as provided for by the Security
Council45 The only exception to the United Nations Charters as it relates to the Use of Force is
the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed
attack46
International elites have discussed the term ldquouse of forcerdquo in the past because of the
development of chemical and biological weapons and had to move from a kinetic impact based
definition to a results-oriented approach47 Chemical and biological weapons lacked the
characteristic of an explosion or physical force yet these weapons certainly are capable of
destroying life and property Doctor Leigh Armistead a former information warfare instructor at
18
AUACSCSinksAY08
the Joint Forces Staff College cautions that the use of computer network attacks by the military
ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary
that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great
Russia introduced a proposal to the United Nations that banned the use of information
operations Even though the United Nations didnrsquot adopt the law the concern of international
community is fully aware of the impact cyber attacks can have on a nation
The concern over cyber warfare capabilities is that it can generate both non-kinetic and
kinetic effects There has always been the traditional kinetic solution for cyber warfare where a
precision guidance munition destroys a critical information system node Most people assume
computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos
computer system from the safety of onersquos own command and control center but the physical
destruction of a computer system or network by kinetic means also qualifies as cyber warfare
However cyber warfare has also evolved to the point where aggressors can achieve a kinetic
effect without the use of a traditional kinetic weapon A cyber attack on an information system
can shut down a particular node of a power plant causing the system to become inoperative
Even if there wasnrsquot an explosion the attack serves the same purpose
The question raised is do cyber attacks constitute an armed attack Scholars do agree that
some cyber attacks fit comfortably within the United Nations Charter For example a strategic
level cyber attack causing widespread damage and significant casualties would trigger the statersquos
right of self-defense In addition a cyber attack that precluded a conventional attack or a series
of cyber attacks causing significant damage would give a state the right of self-defense49 Few
would dispute that a country has the right under international law to respond with military force
19
AUACSCSinksAY08
if a state destroyed or significantly damaged another nationrsquos economic system for example the
New York or London stock exchanges
However some confusion and state-defined interpretation comes into play when the
frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard
Law School argues that cyber attacks require an expansion of the definition on the ldquouse of
forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot
be prohibited by international law50 International scholars recommend ldquoclearer rules of what
kinds of information warfare actions constitute an armed attackrdquo which drives permissible
responses of self-defense51 For example a state-sponsored cyber attack causes damage to a
victimrsquos factory or power plant however the nation claims the incident is an isolated instance
and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under
the United Nations Charter and the United Nations would consider any response retaliation
which would violate international law52
Another example involves a nation conducting a series of small attacks causing minimal
damage and then ceases Even though the aggressor used force to conduct cyber warfare
operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under
the United Nations Charter This type of attack is analogues to a small band of troops crossing a
border without causing significant damage53 According to the United Nations Charter the
national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders
and respond to the use of force Repelling the small band of troops and reestablishing their
sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration
of war and allies would have to respect the United Nations decision and couldnrsquot intervene The
same is true for the cyber attack A state can employ defensive measure to isolate and defeat the
20
AUACSCSinksAY08
incursion over the electromagnetic spectrum However the United Nations would see further
offensive operations or invasive operations as retaliation Therefore a nation must take the
incident whether it is signs of conventional forces on the ground or traces of cyber warfare
incursions in the electromagnetic spectrum to the United Nations to seek restitution
In both of these situations the international law becomes the target for change not
whether cyber warfare is in violation of international law If the law were to change the
international community would then consider the above situations acts of war even if an
adversary used conventional forces As written today the result of an operation remains the
driving factor in determining if an adversary has violated international law The means by which
an adversary conducts military operations may affect how nations react to the situation but
whether an adversary conducts the operation by means of the air land sea space or cyberspace
doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian
Triggs a public international lawyer and member of the Attorney General International Legal
Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over
offences abroad having an intended and substantial effect within a state may be justifiedrdquo54
Therefore the international community must evaluate the effect of a criminal act rather than the
means in which the act was committed
Others claim that because the Internet takes advantages of legal norms where non-state
actors can ignore Western notions of law55 more international laws are needed for cyberspace
However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using
other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the
Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked
aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts
21
AUACSCSinksAY08
against a staterdquo in the cyberspace domain The anonymity of the Internet and their total
disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and
national laws already exist in most countries that prohibit the use of the Internet for terrorist
activities therefore additional international laws wouldnrsquot prevent or deter terrorist from
committing such acts of aggression
International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed
Conflict includes the Martens Clause which extends established custom and humanitarian
principles to new technologies and addresses the ever-changing nature of warfare The
international community designed The Martens Clause ldquoto prevent future unnecessary andor
disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges
crimes by invoking the laws of humanity and public conscience hence their effects and not its
methods
The basic legal premise behind Law of Armed Conflict is that attacks must be limited to
military objectives and collateral damage must be proportionate to military advantages and
forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary
suffering but military commanders and planners need to be aware of the results a particular
action will invoke Russian leadership believes a computer network attack against their
homeland can be a means for executing a variety of escalating responses to include nuclear
attack58 Therefore it is imperative military commanders understand the impact any weapon
system can have on an adversary not just cyber attacks
Not all scholars agree that international law is insufficient to govern cyber warfare
Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace
and the Use of Force states that computer network attacks constitute an unlawful use of force in
22
AUACSCSinksAY08
cyberspace under traditional international law Sharp declared that an armed attack may occur
ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a
way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive
definition of cyber attacks may never be drafted59 The Congressional Research Service also
concluded that ldquothere is little likelihood that the international community will soon generate a
coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations
on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos
conclusion is that the effects of cyber warfare operations are the same as if an adversary
conducted conventional warfare operations where the effect of the attacks are the driving factors
in determining whether an adversary used force or not
The United States Government agrees with Sharprsquos conclusion The offensive
Information Operation strategy for the United States government as described by Doctor
Armistead ties the tools used to conduct military operations back to the desired effect which is
in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning
effects-based operations and operational art focus the Joint Force Commanderrsquos course of action
towards meeting objectives outlined in guidance provided by the National Command Authority
and senior military leadership62 Whether the tools are dropped pamphlets invasive network
attacks or bombs on targets the goal is to produce a desired effect to achieve the overall
objectives and cyber warfare can produce effects that challenge the national security of a nation
Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63
~General T Michael Moseley USAF
23
AUACSCSinksAY08
The cyberspace domain has been around for quite sometime but as technology continues
to advance businesses as well as governmental organizations are becoming more reliant on the
cyberspace domain With that reliance the protection of this critical domain becomes even more
important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the
electromagnetic spectrum by denying and disrupting information demands Scholars claim that
protection needs to include addressing existing international laws expanding them to incorporate
the ever-advancing capabilities emerging in the cyberspace domain
However territorial sovereignty of a nation and the principles of jurisdiction specifically
the Protective Security Principle give nations the right to exercise jurisdiction when an
aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64
While cyberspace is a domain requiring specific attention it relies on assets in the other domains
of land space sea and air in order to operate and international laws for the linear domains do
exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace
but during cyber warfare operations the principles behind the restrictions of foreign military
entering airspace do apply The strategic nature of cyber warfare operations correspond to the
same strategic impact that airpower can inflict upon a nation threatening their independence
While maybe not as dramatic as kinetic effects the results can be just as devastating
Space is relatively straightforward Since a nation canrsquot claim space and over flights of
foreign satellites over a nation is permissible nations must use space for peaceful purposes
Kinetic attacks against space assets are a violation of international law therefore nations would
consider cyber warfare operations against space assets as other than peaceful purposes and a
violation of international law Cyber attacks traversing space assets relate to current military
operations where the military uses space assets to conduct kinetic operations Since international
24
AUACSCSinksAY08
elites havenrsquot considered these kinetic operations as a breach of international law military
commanders can conduct cyber warfare operations through space without fear of violating
international laws for outer space
Crossing international borders without a nationrsquos permission and threatening their
sovereignty is a violation of international law While nations canrsquot consider all border crossings
as an act of war those acts of aggression that threaten the territorial integrity would elicit a
defensive response by the victim nation Whether incursions involve combat vehicles over a
highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are
threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not
have set foot in the nation but according the Protective Security Principle the victim nation has
jurisdiction
Conducting cyber warfare operations from the territorial sea is no different from
conducting operations from within a nationrsquos land or sea borders However the high seas are
very similar in nature to space in that they are reserved for peaceful purposes Therefore
conducting any means of warfare from within the high seas is a violation of international law
and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-
defense
According to Barkham ldquoinformation warfare attacks are in essence territorial
penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then
subject to the jurisdiction of the victim nation who then has the right for self-defense However
due to the global nature of cyberspace aggressors can cross multiple borders and determining
who has jurisdiction demands cooperation among nations The origin and any deliberate staging
locations of the cyber attack will drive who has jurisdiction The crossing of third party borders
25
AUACSCSinksAY08
by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the
aggressors threaten a nationrsquos independence or territorial integrity
Scholars consider cyber warfare operations that involve strategic and operational impacts
as being a means of using force and fall within the legal regime of existing international law
However scholars argue that because cyber warfare includes kinetic and non-kinetic results the
Use of Force definition needs expanding Yet they conclude that an exhaustive definition of
cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare
operations against existing case studies where the effects are evaluated as opposed to the means
even if the operations originated from outside the nationrsquos territorial jurisdiction There is some
authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to
have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade
non-state actors from conducting cyber warfare operations given their willingness to ignore
Western notions of war and their ability to conduct operations anonymously in cyberspace
International laws are in place to that address the ever-changing nature of warfare The
Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a
framework for addressing all warfare to include cyber warfare operations The international
community will need to measure the effects of an operation rather the means Whether its boots
on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a
nationrsquos response
26
AUACSCSinksAY08
End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)
27
AUACSCSinksAY08
44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
28
AUACSCSinksAY08
Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005
Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department
American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)
Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983
Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988
Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)
Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)
IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)
Joint Publication 3-13 Information Operations 13 February 2006
Joint Publication 5-0 Joint Operations Planning 26 December 2006
Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies
Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc
Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College
Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)
Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press
29
AUACSCSinksAY08
Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI
Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)
Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press
Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company
Detter Delupis I The law of war (2000) New York NY Cambridge University Press
Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)
Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College
Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor
Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)
Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)
Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf
Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)
Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College
Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College
Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)
Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA
30
AUACSCSinksAY08
Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)
Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)
Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College
Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology
Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College
Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)
OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center
OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College
OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications
Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991
Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College
Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center
Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)
31
AUACSCSinksAY08
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press
Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA
Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University
Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor
Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661
Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office
Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis
United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC
United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center
Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College
Wesley David C The Military Commander and the Law 2006
32
AUACSCSinksAY08
the whites of their eyes or a blip on a screen International boundaries easily define when an
aggressor threatens the sovereignty of a nation giving the victim nation the right of jurisdiction
and there are specific international laws that address military operations in space In addition
the international community has defined when an adversaryrsquos use of force threatens a nationrsquos
territorial integrity and political independence
However the global nature of cyberspace and the speed of which victims can experience
cyber attacks force nations to deal with the legal challenges associated with over-the-horizon
military operations as commanders can experience battlefield affects with little or no warning
Moreover cyber attacks are much more difficult to define Jurisdiction over a cyber attack that
occurs 7000 miles away that crosses multiple physical domains and spans several international
borders compounds the legal issues surrounding an aggressive act that can have a wide-range of
effects Add the fact that determining the perpetrator proves to be less than speedy as most
cyber warriors can use the Internet ldquoanonymously or as a shell game to hide identitiesrdquo5 nations
face a very difficult task in attributing an aggressive act to a particular actor Responding to
asymmetric techniques tactics and procedures by state and non-state actors have proven to be
difficult for conventional forces Introducing asymmetric tactics in cyberspace presents nations
an even more challenging and complicated issue particularly in the legal regime
Therefore this paper will analyze the need for international guidance for conducting warfare
operations in the cyberspace domain This paper will define cyberspace and cyber warfare in an
effort to set the stage for illustrating the global nature of cyberspace and its reliance on the other
physical domains to conduct military operations The paper will define the international law as it
relates to territorial boundaries and outline the jurisdiction principles that allow a nation to act
against an adversary This paper outlines the definition of the Use of Force and how it
2
AUACSCSinksAY08
corresponds to the cyberspace domain and cyber warfare and with the final discussion centered
on the international laws that already exist which help shape international law for cyberspace
What is Cyber Warfare Very few of the new manifestations in war can be ascribed to new inventions or new departures in ideas6
~Carl Von Clausewitz
Defining Cyberspace William Gibson coined the term ldquocyberspacerdquo in his 1984 novel Neuromancer in order to
describe ldquoa shared virtual environment whose inhabitants objects and spaces comprise data that
is visualized heard and touchedrdquo7 However the most common of definitions today refer to the
Internet or the World Wide Web and usually consists of an information-sharing environment
between computers8 However the military has defined cyberspace to advocate a worldwide
spectrum of more than just information sharing among computers
In the National Military Strategy for Cyberspace Operations cyberspace is defined as a
domain characterized by the use of electronics and the electromagnetic spectrum to store
modify and exchange data via networked systems and associated physical infrastructure9 Joint
doctrine has adopted a computer-centric definition where cyberspace is ldquothe notional
environment in which digitized information is communicated over networksrdquo10 The National
Military Strategy and joint doctrine definitions advocate a worldwide information environment
that isnrsquot limited to the Internet or to just computers Matter of fact the expanded definitions
suggest that cyberspace consists of all networks to include highly sensitive military
governmental and commercial networks that may or may not use commercial means to store
modify and exchange data These systems include exchange networks like tactical digital
information links (TADIL) links between command and control platforms and air ground and
sea weapon systems In addition because the definition includes the electromagnetic spectrum
3
AUACSCSinksAY08
cyberspace includes ldquocapabilities that are currently considered electronic warfarerdquo11 which Great
Britain exploited in World War II when they introduced radar technology in World War II and is
still applicable with communication and navigational jamming capabilities used in todayrsquos
conflicts
While cyberspace is a unique domain that military commanders must protect in order to
conduct operations more effectively and offers commanders another dimension in which to
exploit weaknesses in an adversaryrsquos ability to project power cyberspace doesnrsquot exist on its
own According to Lt Col Fahrenkreg in the published Air University article title Cyberspace
Define ldquocyberspace exists across the other domains of air land sea and spacerdquo12 There are
clear delineations between the sea land and air Commanders know where the land ends and the
sea begins While there are some discussions as to where airspace ends and space begins the
capabilities and roles associated with each domain are clear Therefore to depict cyberspace as
an autonomous domain is unrealistic as the physical infrastructure of cyberspace and the means
of sharing information within the cyberspace domain resides in one or more of the four linear
domains
What Cyberspace is Not The most confused notion about cyberspace is that information operations and
cyberspace are one in the same Joint Publication 3-13 Information Operations describes the
information environment as a collection of leaders decision makers and systems that process
collect disseminate or act on information consisting of three dimensions the physical
informational and cognitive dimensions13 The goal of information operations is to influence the
cognitive dimension by affecting the decision-making process known affectionately by the Air
Force as the OODA Loop (Observe Orient Decide and Act)14 By disrupting and corrupting
4
AUACSCSinksAY08
information processes military commanders can influence or usurp adversarial human and
automated decision making in the physical and informational dimensions
As stated by Lt Col Fahrenkreg the confusion between cyberspace and information
operations comes from the misunderstanding of cyberspace as an operation rather than a
domain15 Information operation is a capability available to the combatant commander to
generate an effect in one of the five domains It just so happens that cyberspace tends to be the
primary means of delivering the Information Operation capability
Cyberspace connects the physical dimensions with the cognitive process and is a means
to create effects to include disrupting degrading denying the enemy the use of strategic and
operational assets to include command and controls systems power plants telecommunications
and other like targets to affect a statersquos operational and strategic centers of gravity Cyberspace
isnrsquot information or the data residing on a computer but is the means in which users transfer
store or modify information Cyberspace isnrsquot the data sent to a precision guided munition but
the means in which the originator passes the information Cyberspace is the digital super
highway of the electromagnetic spectrum with the ones zeros and electrons as the passengers
Defining Cyber Warfare According to the Institute for Advanced Study of Information Warfare (ASIW) cyber
warfare has become a form of information warfare which ASIW defines as ldquothe offensive and
defensive use of information and information systems to deny exploit corrupt or destroy and
adversaryrsquos information information-based processes information systems and computer-based
networks while protecting onersquos own Such actions are designed to achieve advantages over
military adversariesrdquo16 While this definition doesnrsquot specifically address the electromagnetic
spectrum the definition focuses on information-sharing systems which is where crux of the
cyberspace domain revolves around
5
AUACSCSinksAY08
Joint doctrine defines cyber warfare as those areas of operations that affect the
electromagnetic spectrum to include Computer Network Operations and Electronic Warfare
which are two of the five core operational capabilities of Information Operations Electronic
warfare operations operates across ldquoradio visible micro directed energy and all other
frequenciesrdquo and overlaps with network warfare operations which include ldquoradio nets satellite
links tactical digital information links (TADIL) telemetry digital track files
telecommunications and wireless communication network and systemsrdquo all of which operate
within the electromagnetic spectrum17
Cyber warfare consists of defensive and offensive operations Defensive operations
arenrsquot limited to severing connections or blocking attempts of an adversary trying to corrupt data
modify transmissions or destroy information systems Defensive operations include the
elimination of the adversaryrsquos capability of conducting operations which may involve crossing
sovereign borders in order to complete the task However defensive network operations come in
more than just one form The movies portray computer experts hovering over computers trying
to affect each otherrsquos operations However cyber warfare includes the use of traditional kinetic
effect to disrupt computer network operations of the enemy as a fighter-bomber delivering a
500-pound bomb to destroy a vital mode in a computer network may serve the same purpose as a
computer-centric network attack While this isnrsquot as sexy as a network attack that spans the
globe to degrade the enemyrsquos ability operation within the cyberspace domain the effects are the
same
Territorial Sovereignty In total war it is quite impossible to draw any precise line between military and non-military problems18
~Sir Winston Churchill
6
AUACSCSinksAY08
Cyberspace is certainly a domain that requires unique attention in order for commanders
to effectively and efficiently prosecute combat operations Cyberspace spans the globe using
the physical infrastructure residing within the other linear domains As users pass information
from one site to another data crosses boundaries by means of the cyberspace domain Data
leaves the Iraq area of operation via satellite to a receiving site in Germany Operators route the
information to the United States either through another satellite or by ground to sea-based cables
bound for computer nodes within the United States before arriving in South Carolina where
automated network tools redirect the information to the receiverrsquos location
An adversary attempting to modify corrupt or destroy this information traveling within
the cyberspace domain would at one time or another would cross sovereign borders through air
land sea or space The adversaryrsquos physical presence may not apply as they could conduct
operations from the comforts of their home however a nation could detect the adversaryrsquos
digital presence and could feel the impact of their actions from within their sovereign borders
Therefore as these adversaries span the globe using the cyberspace domain that relies on the
other linear domains to exist does international law apply when boundaries are crossed The
following sections will address the international laws of each physical domain and evaluate how
their principles apply to the cyberspace domain
Airspace Airspace as defined by Doctor Boleslaw A Boczek the internationally renowned expert
on international law ldquois the air pillow above the subjacent territoryrdquo to include ldquoairspace above
international waters and the territorial seardquo The airspace is under complete and exclusive
sovereignty of the subject state19 With that states have jurisdiction over their airspace and
require identification of foreign aircraft along with their intentions According to Dr Boczek
book International Law A Dictionary ldquoentry of national spacehellipmay take place only with the
7
AUACSCSinksAY08
authorization of the territorial staterdquo20 and currently only applies to aircraft Entry into the
airspace would require ldquoall aircraft to identify themselves file flight plans and report their
positionrdquo According to the 1944 Chicago Convention on International Civil Aviation nations
can enter into agreements that allow scheduled international civil air services which usually
include reciprocal agreements covering routes volume and other matters relating to air traffic
However these agreements only apply to civil aviation where state aircraft which include
aircraft belonging to the military customs public services and heads of states must follow more
restrictive procedures upon entering the airspace of a foreign nation21
There are several incidents where states have evoked their right for defending their
national security like the shooting down of a US military reconnaissance aircraft over Soviet
airspace by the Soviet Union in 196022 or the shooting down by Soviet fighter planes of a South
Korean airliner in 198323 The Soviet Union isnrsquot the only nation to protect its airspace as the
United States was responsible for shooting down an Iranian airliner thought to be an attacking
military plane over the Persian Gulf in 198824 These examples illustrate a nationrsquos sovereign
resolve to protect itself when a suspected adversary violated their airspace
Applying international law of airspace to cyberspace doesnrsquot seem too practical Civilian
signals entering a nationrsquos airspace would require nations to enter into agreements to allow
scheduled services and the persons receiving information through airspace would have to be
non-state sponsored Nationrsquos could regulate some cyberspace networks entering airspace like
radio communications that primarily use land-based infrastructure to function However the
very nature of computer networks and the ever-increasing global reach of communication
capabilities severely restrict a nationrsquos ability to monitor the millions of transmissions made on a
daily basis and these signals certainly wouldnrsquot be on any scheduled basis Therefore even if
8
AUACSCSinksAY08
nations made agreements concerning the cyberspace domain nations would have a difficult time
enforcing their terms of agreements unless the terms are very open-ended If they were so open-
ended then the agreement may not be necessary and based on my research nations realize the
futility of establishing these agreements as this author couldnrsquot find any reference to any
agreements that nations have entered into referencing the cyberspace domain
While the international law for civilian aircraft in airspace may not relate well or isnrsquot
feasible to enforce in the cyberspace domain does a nation have that same right to protect itself
from a suspected attack from cyberspace where the attackerrsquos signal enters airspace Does a
nation have the right to ldquoshoot downrdquo a cyberspace attack as it enters their domain through
airspace The whole idea behind restricting airspace from foreign military aircraft is because of
the strategic impact military aircraft can have on a nation As demonstrated in World War II
military aircraft carrying weapons of mass destruction can decimate cities and destroy a nation
with minimal effort The effects generated by military aircraft are quite destructive and garner
specific attention While an aircraft in of itself is relatively harmless the actions taken by the
crew can lead to devastating results
The same is true for cyber attacks The information passing through airspace in the
cyberspace domain is the vehicle however the crew conducting the operation is potentially
creating the same strategic results The cyber attack may not destroy cities but it certainly can
be destructive to a nationrsquos well-being by crippling power sources economic industries water
supply etc all at the blink of an eye while the victim takes several days to determine the
perpetrator Therefore while the international law for airspace may not be specifically relevant
the underlying principles are applicable as cyber attacks can have the same potential strategic
impact as an attack from a military aircraft
9
AUACSCSinksAY08
Space Outer space as defined by Doctor Boczek ldquois the space beyond the air surrounding the
earthrdquo As of 2005 international law doesnrsquot define a demarcation between airspace and outer
space but ldquostates agree that state sovereignty doesnrsquot extend without any limitsrdquo25 Proposals of
where airspace ends and when outer space begins are base on various scientific and technological
criteria (gravitational pull capabilities of air breathing aircraft etc26) Others scientists argue
that defining a boundary between airspace and outer space isnrsquot necessary as it would hinder the
progress of space technology and the legal status would depend on the nature of the activity
While no boundary exists airspace is finite and activity in outer space follows four
fundamentals principles First over flights of foreign satellites over a nation is permissible as
airspace doesnrsquot extend forever Second space ldquointernational law applies to outer space and
celestial bodiesrdquo Third according to the Outer Space Treaty of 1967 states canrsquot claim celestial
bodies or outer space which are not subject to national appropriation therefore are free for use
by all states Finally states must use outer space exclusively for peaceful purposes with specific
bans on weapons of mass destruction However states can use space for other military purposes
like intelligence surveillance and reconnaissance activities 27
Are these international laws and principles applicable to cyberspace Satellites are
certainly an integral part of the space domain Operators control satellites by using the
cyberspace domain and information passes between satellites and ground stations One can
argue that space is a sub-set of the cyberspace domain with satellites serving as computers in
space Global positioning system devices in vehicles interact with satellites all through an
elaborate network as part of the electromagnetic spectrum known as cyberspace Therefore
cyberspace is in space with millions of people using cyberspace everyday
10
AUACSCSinksAY08
The military uses space assets for intelligence surveillance and reconnaissance
knowledge management and command and control Agencies like the National Reconnaissance
Office and National Geospatial-Intelligence Agency obtain high-altitude imagery using a variety
of capabilities to include heat signature resonation Satellites can detect missile launches which
provide vital military information to senior leaders tasked with the security of their nation The
military networks to include decision briefs tasks and emails in Iraq and the Predator feeds in
Afghanistan travel through military and commercial satellites with all the information flowing
through the cyberspace domain With the heavy reliance of cyberspace to operate space assets
and the demands of information flowing through space by businesses it should come as no
surprise that space is a vital component for day-to-day operations of the military
Since cyberspace is an inherent component for space operations it is logical to assume
international law for outer space is applicable to cyberspace as long as an aggressor doesnt
violate the four premises and as long as weapons of mass destruction arenrsquot ldquostationed in outer
spacerdquo 28 Therefore a state would consider a cyber attack against a satellite as other than for
peaceful purposes and according to the fourth premise international law would apply
However what about a cyber attack using satellites as a means of conducting operations
Under todayrsquos current operations international elites havenrsquot considered a cyber attack passing
through space as a violation of international law When a senior leader in Qatar approves a
target set that is executed by a pilot in Nevada by an aircraft in Afghanistan all this information
is transmitted by cyberspace through space The result is that an aircraft renders an air or ground
target inoperable The effect is the same for cyberspace The information flows through space
by way of the cyberspace domain and the result is that an operator has rendered a target
11
AUACSCSinksAY08
inoperable As with airspace the information isnrsquot the cause of the damage but what an operator
does with the information is what constitutes the cyber attack
Land Cyber attacks using resources over land is relatively straightforward International
boundaries are defined as ldquoimaginary lines which separate territorial sovereigntyrdquo 29 which are
mutually agreed upon via international treaties Crossing an international border without
permission from the state is a violation of international law While an illegal immigrant crossing
a border to seek an opportunity to provide for his family is a violation of national law the United
Nation considers a nation-sponsored invasion of another nation that threatens the security and
stability of a nation as a breach in international law and an act of war
However international law doesnrsquot consider all border crossings as an act of war For
example when Nicaraguan troops and arms allegedly crossed the borders of El Salvador the
United Nations determined that incursions didnrsquot threaten El Salvadorrsquos territorial integrity and
stated that neither ldquothese incursions nor the alleged supply of arms may be relied upon as
justifying the exercise of the right of collective self-defenserdquo30 The victim state can repelled the
aggressive act but the United Nations Council wouldnrsquot condone any further military action
taken against the adversary opting for diplomatic or economic solution instead
Does international law apply when an adversary crosses international borders using
cyberspace as the means for conducting warfare operations When an adversarial state crosses a
statersquos boundaries using roads or bridges that connect the two nations the road is the resource
spanning the two nations If the adversary doesnrsquot do anything then returns to their sovereign
borders the aggressor hasnrsquot violated international law However when the adversary uses
weapon systems to affect serious damage the adversary has broken international law and a
12
AUACSCSinksAY08
nation may invoke their right for self-defense and may conduct full-scale operations to neutralize
the threat
A parallel notion is when an adversary uses a copper or fiber optic connection that spans
between two nations The adversary uses the land-based LAN connection as a means for
conducting cyber warfare operations The adversary may cross the borders using cyberspace yet
do nothing The affected state may push the adversary back to its borders but no further actions
are deemed appropriate However once the adversary uses the information transmitted over
cyberspace to cause severe operational or strategic damage the affected state now has the right
of self-defense Cyberspace is the means like the road or bridge for which the adversary
delivered the weapon The affected nation will consider the execution of the adversaryrsquos
information packet or weapon system as an act of aggression and the effect caused by the
weapon is what breeches international law
The difference between these two scenarios is that the adversary using the
electromagnetic spectrum hasnrsquot physically invaded a nationrsquos sovereign borders However
their digital presence crossed sovereign borders and as latter discussed in the paper adversaries
committing an act aggression against a state are now under the jurisdiction of the affected state
Sea ldquoThe territorial sea is a belt of sea adjacent to the (statersquos) coasthellipto include the airspace
aboverdquo as well as the seabed and subsoil31 The territorial sea is subject to the right of innocent
passage by foreign shops giving states the right to transport goods and passengers between ports
All of which is subject to the full sovereignty of the state which according to the United Nations
Convention on the Law of the Sea in 1982 and agreed upon by the majority of its membership in
1982 extends 12 miles from the coast32 The jurisdiction includes crimes where the
consequences extend to the coastal state and disturbs the peace of the country33 A cyber attack
13
AUACSCSinksAY08
conducted within the territorial sea of a nation would be no different from a cyber attack
conducted from within the nationrsquos land borders therefore cyber attacks against a state or even
another state conducted within the territorial seas are subject to current international laws Cyber
attacks originating outside the statersquos sovereign borders but results in affecting a statersquos
resources in their territorial seas would fall under the land and airspace breeches of territorial
sovereignty and would be subject to international law
The high seas on the other hand arenrsquot subject to the sovereignty of any one state The
high seas extend beyond the territorial sea and include the airspace the seabed and the subsoil34
and all states have the right to exercise freedoms on the high seas35 As similarly defined in
space ldquothe high seas shall be reserved for peaceful purposesrdquo as stated by Article 88 of the Law
of the Seas Cooperative36 which is defined as refraining from any threat or use of force (outside
of wartime conflicts)
The very nature of a cyber attack in the high seas lends itself to be a violation of
international law as nations are restricted to conducting peaceful operations in the high seas
The question is whom has jurisdiction of crimes committed in the high seas By applying the
Protective Security Principle of Jurisdiction where an actor threatens a statersquo security and
introducing the United Nationrsquos definition on the Illegal Use of Force extends to the high seas
and for that matter space giving states the right for self-defense as defined by the United Nations
as ldquoan armed attackrdquo The sheer name of cyber attack doesnrsquot immediately lend itself to an
ldquoarmedrdquo cyber attack However the effects generated from a cyber attack can be equivalent to a
traditional conventional attack and the international law would permit a state to take appropriate
countermeasures while notifying the United Nations Security Council37
14
AUACSCSinksAY08
Applying International Law to Cyber Warfare Today we live in an Information Age where communication through cyberspace has forever changed and flattened out worldhellipOur adversaries seek to operate from behind technical legal and international screens as they execute their costly attacks38
~General James E Cartwright Commander United States Strategic Command
Jurisdiction
Understanding the territorial sovereignty principles of a nation is important in applying
cyberspace and cyber warfare to existing international laws While some of these principles and
international laws may not be relevant for the cyberspace domain due to the far-reaching
capability of cyber warfare the jurisdiction of a nation further defines its ability to respond to
aggressive acts by nations in the cyberspace domain There are three jurisdictional principles
that provide nations the right to pursue aggressors that threaten a nationrsquos independence the
Territorial Principle Nationality Principle and the Protective Security Principle
For actions originating within the state the jurisdiction clearly falls within the territorial
principle where a ldquostate has jurisdiction over all crimes committed in its territoryhellipto include
airspace international waters and territorial seasrdquo39 The territorial jurisdiction is subject to
exceptions when dealing with persons from foreign states as in the most popular example of
immunity given to foreign diplomats In this case ldquostates may exercise jurisdiction over its
citizenhellipeven if they are physically outside the statesrsquo territoryrdquo as Doctor Boczek defines as the
Nationality Principle Nations usually agree upon on these concessions states prior to the offense
being committed40
Doctor Boczek defines the Protective Security Principle as a ldquojurisdictional principle
whereby a state my assume jurisdiction over and punish foreign nationals for certain conduct
outside its territory which is directed against its security territorial integrity and political
independencerdquo41 Some states would argue that criticism of a state or government is applicable
15
AUACSCSinksAY08
in applying this principle of jurisdiction However this is too broad of an interpretation and
should be confined to acts that are more tangible in nature like falsification of a statesrsquo official
documents conspiracy to violate immigration of custom laws and illicit drug trafficking42
Would a cyber attack that is deemed to challenge a nationrsquos banking community or bring
down a power source be a direct attack against its security and political independence The
international community easily sees the attack of a power source with kinetic weapons as a
violation of a territorial boundary and a breech of international law The United States viewed
the attack on the Trade Towers as an act of war launching the Global War on Terrorism Would
the United States have viewed the same devastation as if the attack occurred through cyberspace
Would the attack have been less of an act of war if the aggressor remotely controlled domestic
airliners from a foreign country Probably not What happens if the cyber attack caused a fire in
the lower floors of the buildings preventing people from escaping While less dramatic than an
airbus flying into the middle of the towers and maybe more difficult to demonize the crime the
result is the samemdashinnocent people suffering as a result of an adversary trying to threaten a
nationrsquos security
What happens if the suspected cyber attack has violated a nationrsquos territorial boundary in
order to attack a neighboring country or an ally Going from point A to point B in cyberspace is
rarely a direct connection As with the global nature of cyberspace itrsquos conceivable that
adversaries cross several nationsrsquo boundaries to conduct cyber attack operations The question
generated is who has jurisdiction
If the actor committing the crime had used an airplane each nation could claim
jurisdiction as the adversary violated their territorial boundaries and violated international law
More often than not the first state would have acted immediately upon the aggressive act and
16
AUACSCSinksAY08
would have prevented aggressors from completing their task by either forcing the aircraft to land
or turnaround or an even more escalated response of firing upon the aircraft In the air land or
sea the ability for a nationrsquos military forces to respond in a timely manner gives way to the
deterrence factor of not crossing a statersquos boundaries without receiving permission for fear of
reprisal A clear example of this was when Turkey denied the United States the ability deploy
the 4th Infantry Division from its borders at the beginning of Operation Iraqi Freedom Violating
Turkeyrsquos borders without permission would have brought about great repercussions that would
have made Operation Iraqi Freedom even more difficult and could have resulted in an escalation
of the war outside the Iraqi borders43 Another example is when Spain and France denied the
Unites States the use of their airspace when F-111s based in the United Kingdom conducted air
operations in Libya in an effort to eliminate Muammar Khadafy44
However the speeds at which these breeches in territorial boundaries occur make it
difficult for a nation to claim jurisdiction especially when nothing occurred within their
territorial sovereignty The cyber attacks didnrsquot result in any damage to nation as the information
packets passed through their sovereign borders According to territorial boundary description
described by Doctor Boczek the international community doesnrsquot consider the crossing the
border in of itself an act of warmdashserious damage is a driving factor in determining conflict
escalation In addition according to the territorial jurisdiction principle the cyber attack didnrsquot
threaten a nationrsquos security territorial integrity and political independence If the cyber attack or
information originated from within a sovereign territory by a third party then the two nations
would have to work together to resolve the issue and mutual jurisdiction would probably apply
However if the cyber attack didnrsquot physically manifest itself from within their sovereign
territory or the adversary didnrsquot use the nation as a staging area to launch a further attack the
17
AUACSCSinksAY08
international law and the jurisdiction principles would dictate the affected nation would have
jurisdiction
Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security
territorial integrity and political independence Cyberspace utilizes the other domains as a means
of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence
Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of
territorial sovereignty the Protective Security Principle does provide nations the ability to
enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos
sovereignty when it conducts cyber warfare operations However some elites donrsquot consider
cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense
International law specifically article 2 of the United Nations Charters states that a
members shall refrain in their international relations from the threat or use of force against the
territorial integrity or political independence of any state or in any other manner inconsistent
with the purposes of the United Nations which is intended to prohibit all types of force except
those carried out under the aegis of the United Nations or as provided for by the Security
Council45 The only exception to the United Nations Charters as it relates to the Use of Force is
the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed
attack46
International elites have discussed the term ldquouse of forcerdquo in the past because of the
development of chemical and biological weapons and had to move from a kinetic impact based
definition to a results-oriented approach47 Chemical and biological weapons lacked the
characteristic of an explosion or physical force yet these weapons certainly are capable of
destroying life and property Doctor Leigh Armistead a former information warfare instructor at
18
AUACSCSinksAY08
the Joint Forces Staff College cautions that the use of computer network attacks by the military
ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary
that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great
Russia introduced a proposal to the United Nations that banned the use of information
operations Even though the United Nations didnrsquot adopt the law the concern of international
community is fully aware of the impact cyber attacks can have on a nation
The concern over cyber warfare capabilities is that it can generate both non-kinetic and
kinetic effects There has always been the traditional kinetic solution for cyber warfare where a
precision guidance munition destroys a critical information system node Most people assume
computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos
computer system from the safety of onersquos own command and control center but the physical
destruction of a computer system or network by kinetic means also qualifies as cyber warfare
However cyber warfare has also evolved to the point where aggressors can achieve a kinetic
effect without the use of a traditional kinetic weapon A cyber attack on an information system
can shut down a particular node of a power plant causing the system to become inoperative
Even if there wasnrsquot an explosion the attack serves the same purpose
The question raised is do cyber attacks constitute an armed attack Scholars do agree that
some cyber attacks fit comfortably within the United Nations Charter For example a strategic
level cyber attack causing widespread damage and significant casualties would trigger the statersquos
right of self-defense In addition a cyber attack that precluded a conventional attack or a series
of cyber attacks causing significant damage would give a state the right of self-defense49 Few
would dispute that a country has the right under international law to respond with military force
19
AUACSCSinksAY08
if a state destroyed or significantly damaged another nationrsquos economic system for example the
New York or London stock exchanges
However some confusion and state-defined interpretation comes into play when the
frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard
Law School argues that cyber attacks require an expansion of the definition on the ldquouse of
forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot
be prohibited by international law50 International scholars recommend ldquoclearer rules of what
kinds of information warfare actions constitute an armed attackrdquo which drives permissible
responses of self-defense51 For example a state-sponsored cyber attack causes damage to a
victimrsquos factory or power plant however the nation claims the incident is an isolated instance
and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under
the United Nations Charter and the United Nations would consider any response retaliation
which would violate international law52
Another example involves a nation conducting a series of small attacks causing minimal
damage and then ceases Even though the aggressor used force to conduct cyber warfare
operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under
the United Nations Charter This type of attack is analogues to a small band of troops crossing a
border without causing significant damage53 According to the United Nations Charter the
national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders
and respond to the use of force Repelling the small band of troops and reestablishing their
sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration
of war and allies would have to respect the United Nations decision and couldnrsquot intervene The
same is true for the cyber attack A state can employ defensive measure to isolate and defeat the
20
AUACSCSinksAY08
incursion over the electromagnetic spectrum However the United Nations would see further
offensive operations or invasive operations as retaliation Therefore a nation must take the
incident whether it is signs of conventional forces on the ground or traces of cyber warfare
incursions in the electromagnetic spectrum to the United Nations to seek restitution
In both of these situations the international law becomes the target for change not
whether cyber warfare is in violation of international law If the law were to change the
international community would then consider the above situations acts of war even if an
adversary used conventional forces As written today the result of an operation remains the
driving factor in determining if an adversary has violated international law The means by which
an adversary conducts military operations may affect how nations react to the situation but
whether an adversary conducts the operation by means of the air land sea space or cyberspace
doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian
Triggs a public international lawyer and member of the Attorney General International Legal
Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over
offences abroad having an intended and substantial effect within a state may be justifiedrdquo54
Therefore the international community must evaluate the effect of a criminal act rather than the
means in which the act was committed
Others claim that because the Internet takes advantages of legal norms where non-state
actors can ignore Western notions of law55 more international laws are needed for cyberspace
However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using
other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the
Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked
aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts
21
AUACSCSinksAY08
against a staterdquo in the cyberspace domain The anonymity of the Internet and their total
disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and
national laws already exist in most countries that prohibit the use of the Internet for terrorist
activities therefore additional international laws wouldnrsquot prevent or deter terrorist from
committing such acts of aggression
International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed
Conflict includes the Martens Clause which extends established custom and humanitarian
principles to new technologies and addresses the ever-changing nature of warfare The
international community designed The Martens Clause ldquoto prevent future unnecessary andor
disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges
crimes by invoking the laws of humanity and public conscience hence their effects and not its
methods
The basic legal premise behind Law of Armed Conflict is that attacks must be limited to
military objectives and collateral damage must be proportionate to military advantages and
forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary
suffering but military commanders and planners need to be aware of the results a particular
action will invoke Russian leadership believes a computer network attack against their
homeland can be a means for executing a variety of escalating responses to include nuclear
attack58 Therefore it is imperative military commanders understand the impact any weapon
system can have on an adversary not just cyber attacks
Not all scholars agree that international law is insufficient to govern cyber warfare
Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace
and the Use of Force states that computer network attacks constitute an unlawful use of force in
22
AUACSCSinksAY08
cyberspace under traditional international law Sharp declared that an armed attack may occur
ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a
way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive
definition of cyber attacks may never be drafted59 The Congressional Research Service also
concluded that ldquothere is little likelihood that the international community will soon generate a
coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations
on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos
conclusion is that the effects of cyber warfare operations are the same as if an adversary
conducted conventional warfare operations where the effect of the attacks are the driving factors
in determining whether an adversary used force or not
The United States Government agrees with Sharprsquos conclusion The offensive
Information Operation strategy for the United States government as described by Doctor
Armistead ties the tools used to conduct military operations back to the desired effect which is
in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning
effects-based operations and operational art focus the Joint Force Commanderrsquos course of action
towards meeting objectives outlined in guidance provided by the National Command Authority
and senior military leadership62 Whether the tools are dropped pamphlets invasive network
attacks or bombs on targets the goal is to produce a desired effect to achieve the overall
objectives and cyber warfare can produce effects that challenge the national security of a nation
Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63
~General T Michael Moseley USAF
23
AUACSCSinksAY08
The cyberspace domain has been around for quite sometime but as technology continues
to advance businesses as well as governmental organizations are becoming more reliant on the
cyberspace domain With that reliance the protection of this critical domain becomes even more
important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the
electromagnetic spectrum by denying and disrupting information demands Scholars claim that
protection needs to include addressing existing international laws expanding them to incorporate
the ever-advancing capabilities emerging in the cyberspace domain
However territorial sovereignty of a nation and the principles of jurisdiction specifically
the Protective Security Principle give nations the right to exercise jurisdiction when an
aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64
While cyberspace is a domain requiring specific attention it relies on assets in the other domains
of land space sea and air in order to operate and international laws for the linear domains do
exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace
but during cyber warfare operations the principles behind the restrictions of foreign military
entering airspace do apply The strategic nature of cyber warfare operations correspond to the
same strategic impact that airpower can inflict upon a nation threatening their independence
While maybe not as dramatic as kinetic effects the results can be just as devastating
Space is relatively straightforward Since a nation canrsquot claim space and over flights of
foreign satellites over a nation is permissible nations must use space for peaceful purposes
Kinetic attacks against space assets are a violation of international law therefore nations would
consider cyber warfare operations against space assets as other than peaceful purposes and a
violation of international law Cyber attacks traversing space assets relate to current military
operations where the military uses space assets to conduct kinetic operations Since international
24
AUACSCSinksAY08
elites havenrsquot considered these kinetic operations as a breach of international law military
commanders can conduct cyber warfare operations through space without fear of violating
international laws for outer space
Crossing international borders without a nationrsquos permission and threatening their
sovereignty is a violation of international law While nations canrsquot consider all border crossings
as an act of war those acts of aggression that threaten the territorial integrity would elicit a
defensive response by the victim nation Whether incursions involve combat vehicles over a
highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are
threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not
have set foot in the nation but according the Protective Security Principle the victim nation has
jurisdiction
Conducting cyber warfare operations from the territorial sea is no different from
conducting operations from within a nationrsquos land or sea borders However the high seas are
very similar in nature to space in that they are reserved for peaceful purposes Therefore
conducting any means of warfare from within the high seas is a violation of international law
and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-
defense
According to Barkham ldquoinformation warfare attacks are in essence territorial
penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then
subject to the jurisdiction of the victim nation who then has the right for self-defense However
due to the global nature of cyberspace aggressors can cross multiple borders and determining
who has jurisdiction demands cooperation among nations The origin and any deliberate staging
locations of the cyber attack will drive who has jurisdiction The crossing of third party borders
25
AUACSCSinksAY08
by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the
aggressors threaten a nationrsquos independence or territorial integrity
Scholars consider cyber warfare operations that involve strategic and operational impacts
as being a means of using force and fall within the legal regime of existing international law
However scholars argue that because cyber warfare includes kinetic and non-kinetic results the
Use of Force definition needs expanding Yet they conclude that an exhaustive definition of
cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare
operations against existing case studies where the effects are evaluated as opposed to the means
even if the operations originated from outside the nationrsquos territorial jurisdiction There is some
authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to
have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade
non-state actors from conducting cyber warfare operations given their willingness to ignore
Western notions of war and their ability to conduct operations anonymously in cyberspace
International laws are in place to that address the ever-changing nature of warfare The
Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a
framework for addressing all warfare to include cyber warfare operations The international
community will need to measure the effects of an operation rather the means Whether its boots
on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a
nationrsquos response
26
AUACSCSinksAY08
End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)
27
AUACSCSinksAY08
44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
28
AUACSCSinksAY08
Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005
Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department
American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)
Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983
Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988
Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)
Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)
IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)
Joint Publication 3-13 Information Operations 13 February 2006
Joint Publication 5-0 Joint Operations Planning 26 December 2006
Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies
Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc
Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College
Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)
Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press
29
AUACSCSinksAY08
Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI
Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)
Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press
Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company
Detter Delupis I The law of war (2000) New York NY Cambridge University Press
Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)
Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College
Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor
Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)
Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)
Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf
Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)
Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College
Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College
Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)
Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA
30
AUACSCSinksAY08
Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)
Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)
Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College
Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology
Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College
Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)
OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center
OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College
OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications
Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991
Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College
Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center
Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)
31
AUACSCSinksAY08
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press
Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA
Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University
Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor
Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661
Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office
Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis
United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC
United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center
Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College
Wesley David C The Military Commander and the Law 2006
32
AUACSCSinksAY08
corresponds to the cyberspace domain and cyber warfare and with the final discussion centered
on the international laws that already exist which help shape international law for cyberspace
What is Cyber Warfare Very few of the new manifestations in war can be ascribed to new inventions or new departures in ideas6
~Carl Von Clausewitz
Defining Cyberspace William Gibson coined the term ldquocyberspacerdquo in his 1984 novel Neuromancer in order to
describe ldquoa shared virtual environment whose inhabitants objects and spaces comprise data that
is visualized heard and touchedrdquo7 However the most common of definitions today refer to the
Internet or the World Wide Web and usually consists of an information-sharing environment
between computers8 However the military has defined cyberspace to advocate a worldwide
spectrum of more than just information sharing among computers
In the National Military Strategy for Cyberspace Operations cyberspace is defined as a
domain characterized by the use of electronics and the electromagnetic spectrum to store
modify and exchange data via networked systems and associated physical infrastructure9 Joint
doctrine has adopted a computer-centric definition where cyberspace is ldquothe notional
environment in which digitized information is communicated over networksrdquo10 The National
Military Strategy and joint doctrine definitions advocate a worldwide information environment
that isnrsquot limited to the Internet or to just computers Matter of fact the expanded definitions
suggest that cyberspace consists of all networks to include highly sensitive military
governmental and commercial networks that may or may not use commercial means to store
modify and exchange data These systems include exchange networks like tactical digital
information links (TADIL) links between command and control platforms and air ground and
sea weapon systems In addition because the definition includes the electromagnetic spectrum
3
AUACSCSinksAY08
cyberspace includes ldquocapabilities that are currently considered electronic warfarerdquo11 which Great
Britain exploited in World War II when they introduced radar technology in World War II and is
still applicable with communication and navigational jamming capabilities used in todayrsquos
conflicts
While cyberspace is a unique domain that military commanders must protect in order to
conduct operations more effectively and offers commanders another dimension in which to
exploit weaknesses in an adversaryrsquos ability to project power cyberspace doesnrsquot exist on its
own According to Lt Col Fahrenkreg in the published Air University article title Cyberspace
Define ldquocyberspace exists across the other domains of air land sea and spacerdquo12 There are
clear delineations between the sea land and air Commanders know where the land ends and the
sea begins While there are some discussions as to where airspace ends and space begins the
capabilities and roles associated with each domain are clear Therefore to depict cyberspace as
an autonomous domain is unrealistic as the physical infrastructure of cyberspace and the means
of sharing information within the cyberspace domain resides in one or more of the four linear
domains
What Cyberspace is Not The most confused notion about cyberspace is that information operations and
cyberspace are one in the same Joint Publication 3-13 Information Operations describes the
information environment as a collection of leaders decision makers and systems that process
collect disseminate or act on information consisting of three dimensions the physical
informational and cognitive dimensions13 The goal of information operations is to influence the
cognitive dimension by affecting the decision-making process known affectionately by the Air
Force as the OODA Loop (Observe Orient Decide and Act)14 By disrupting and corrupting
4
AUACSCSinksAY08
information processes military commanders can influence or usurp adversarial human and
automated decision making in the physical and informational dimensions
As stated by Lt Col Fahrenkreg the confusion between cyberspace and information
operations comes from the misunderstanding of cyberspace as an operation rather than a
domain15 Information operation is a capability available to the combatant commander to
generate an effect in one of the five domains It just so happens that cyberspace tends to be the
primary means of delivering the Information Operation capability
Cyberspace connects the physical dimensions with the cognitive process and is a means
to create effects to include disrupting degrading denying the enemy the use of strategic and
operational assets to include command and controls systems power plants telecommunications
and other like targets to affect a statersquos operational and strategic centers of gravity Cyberspace
isnrsquot information or the data residing on a computer but is the means in which users transfer
store or modify information Cyberspace isnrsquot the data sent to a precision guided munition but
the means in which the originator passes the information Cyberspace is the digital super
highway of the electromagnetic spectrum with the ones zeros and electrons as the passengers
Defining Cyber Warfare According to the Institute for Advanced Study of Information Warfare (ASIW) cyber
warfare has become a form of information warfare which ASIW defines as ldquothe offensive and
defensive use of information and information systems to deny exploit corrupt or destroy and
adversaryrsquos information information-based processes information systems and computer-based
networks while protecting onersquos own Such actions are designed to achieve advantages over
military adversariesrdquo16 While this definition doesnrsquot specifically address the electromagnetic
spectrum the definition focuses on information-sharing systems which is where crux of the
cyberspace domain revolves around
5
AUACSCSinksAY08
Joint doctrine defines cyber warfare as those areas of operations that affect the
electromagnetic spectrum to include Computer Network Operations and Electronic Warfare
which are two of the five core operational capabilities of Information Operations Electronic
warfare operations operates across ldquoradio visible micro directed energy and all other
frequenciesrdquo and overlaps with network warfare operations which include ldquoradio nets satellite
links tactical digital information links (TADIL) telemetry digital track files
telecommunications and wireless communication network and systemsrdquo all of which operate
within the electromagnetic spectrum17
Cyber warfare consists of defensive and offensive operations Defensive operations
arenrsquot limited to severing connections or blocking attempts of an adversary trying to corrupt data
modify transmissions or destroy information systems Defensive operations include the
elimination of the adversaryrsquos capability of conducting operations which may involve crossing
sovereign borders in order to complete the task However defensive network operations come in
more than just one form The movies portray computer experts hovering over computers trying
to affect each otherrsquos operations However cyber warfare includes the use of traditional kinetic
effect to disrupt computer network operations of the enemy as a fighter-bomber delivering a
500-pound bomb to destroy a vital mode in a computer network may serve the same purpose as a
computer-centric network attack While this isnrsquot as sexy as a network attack that spans the
globe to degrade the enemyrsquos ability operation within the cyberspace domain the effects are the
same
Territorial Sovereignty In total war it is quite impossible to draw any precise line between military and non-military problems18
~Sir Winston Churchill
6
AUACSCSinksAY08
Cyberspace is certainly a domain that requires unique attention in order for commanders
to effectively and efficiently prosecute combat operations Cyberspace spans the globe using
the physical infrastructure residing within the other linear domains As users pass information
from one site to another data crosses boundaries by means of the cyberspace domain Data
leaves the Iraq area of operation via satellite to a receiving site in Germany Operators route the
information to the United States either through another satellite or by ground to sea-based cables
bound for computer nodes within the United States before arriving in South Carolina where
automated network tools redirect the information to the receiverrsquos location
An adversary attempting to modify corrupt or destroy this information traveling within
the cyberspace domain would at one time or another would cross sovereign borders through air
land sea or space The adversaryrsquos physical presence may not apply as they could conduct
operations from the comforts of their home however a nation could detect the adversaryrsquos
digital presence and could feel the impact of their actions from within their sovereign borders
Therefore as these adversaries span the globe using the cyberspace domain that relies on the
other linear domains to exist does international law apply when boundaries are crossed The
following sections will address the international laws of each physical domain and evaluate how
their principles apply to the cyberspace domain
Airspace Airspace as defined by Doctor Boleslaw A Boczek the internationally renowned expert
on international law ldquois the air pillow above the subjacent territoryrdquo to include ldquoairspace above
international waters and the territorial seardquo The airspace is under complete and exclusive
sovereignty of the subject state19 With that states have jurisdiction over their airspace and
require identification of foreign aircraft along with their intentions According to Dr Boczek
book International Law A Dictionary ldquoentry of national spacehellipmay take place only with the
7
AUACSCSinksAY08
authorization of the territorial staterdquo20 and currently only applies to aircraft Entry into the
airspace would require ldquoall aircraft to identify themselves file flight plans and report their
positionrdquo According to the 1944 Chicago Convention on International Civil Aviation nations
can enter into agreements that allow scheduled international civil air services which usually
include reciprocal agreements covering routes volume and other matters relating to air traffic
However these agreements only apply to civil aviation where state aircraft which include
aircraft belonging to the military customs public services and heads of states must follow more
restrictive procedures upon entering the airspace of a foreign nation21
There are several incidents where states have evoked their right for defending their
national security like the shooting down of a US military reconnaissance aircraft over Soviet
airspace by the Soviet Union in 196022 or the shooting down by Soviet fighter planes of a South
Korean airliner in 198323 The Soviet Union isnrsquot the only nation to protect its airspace as the
United States was responsible for shooting down an Iranian airliner thought to be an attacking
military plane over the Persian Gulf in 198824 These examples illustrate a nationrsquos sovereign
resolve to protect itself when a suspected adversary violated their airspace
Applying international law of airspace to cyberspace doesnrsquot seem too practical Civilian
signals entering a nationrsquos airspace would require nations to enter into agreements to allow
scheduled services and the persons receiving information through airspace would have to be
non-state sponsored Nationrsquos could regulate some cyberspace networks entering airspace like
radio communications that primarily use land-based infrastructure to function However the
very nature of computer networks and the ever-increasing global reach of communication
capabilities severely restrict a nationrsquos ability to monitor the millions of transmissions made on a
daily basis and these signals certainly wouldnrsquot be on any scheduled basis Therefore even if
8
AUACSCSinksAY08
nations made agreements concerning the cyberspace domain nations would have a difficult time
enforcing their terms of agreements unless the terms are very open-ended If they were so open-
ended then the agreement may not be necessary and based on my research nations realize the
futility of establishing these agreements as this author couldnrsquot find any reference to any
agreements that nations have entered into referencing the cyberspace domain
While the international law for civilian aircraft in airspace may not relate well or isnrsquot
feasible to enforce in the cyberspace domain does a nation have that same right to protect itself
from a suspected attack from cyberspace where the attackerrsquos signal enters airspace Does a
nation have the right to ldquoshoot downrdquo a cyberspace attack as it enters their domain through
airspace The whole idea behind restricting airspace from foreign military aircraft is because of
the strategic impact military aircraft can have on a nation As demonstrated in World War II
military aircraft carrying weapons of mass destruction can decimate cities and destroy a nation
with minimal effort The effects generated by military aircraft are quite destructive and garner
specific attention While an aircraft in of itself is relatively harmless the actions taken by the
crew can lead to devastating results
The same is true for cyber attacks The information passing through airspace in the
cyberspace domain is the vehicle however the crew conducting the operation is potentially
creating the same strategic results The cyber attack may not destroy cities but it certainly can
be destructive to a nationrsquos well-being by crippling power sources economic industries water
supply etc all at the blink of an eye while the victim takes several days to determine the
perpetrator Therefore while the international law for airspace may not be specifically relevant
the underlying principles are applicable as cyber attacks can have the same potential strategic
impact as an attack from a military aircraft
9
AUACSCSinksAY08
Space Outer space as defined by Doctor Boczek ldquois the space beyond the air surrounding the
earthrdquo As of 2005 international law doesnrsquot define a demarcation between airspace and outer
space but ldquostates agree that state sovereignty doesnrsquot extend without any limitsrdquo25 Proposals of
where airspace ends and when outer space begins are base on various scientific and technological
criteria (gravitational pull capabilities of air breathing aircraft etc26) Others scientists argue
that defining a boundary between airspace and outer space isnrsquot necessary as it would hinder the
progress of space technology and the legal status would depend on the nature of the activity
While no boundary exists airspace is finite and activity in outer space follows four
fundamentals principles First over flights of foreign satellites over a nation is permissible as
airspace doesnrsquot extend forever Second space ldquointernational law applies to outer space and
celestial bodiesrdquo Third according to the Outer Space Treaty of 1967 states canrsquot claim celestial
bodies or outer space which are not subject to national appropriation therefore are free for use
by all states Finally states must use outer space exclusively for peaceful purposes with specific
bans on weapons of mass destruction However states can use space for other military purposes
like intelligence surveillance and reconnaissance activities 27
Are these international laws and principles applicable to cyberspace Satellites are
certainly an integral part of the space domain Operators control satellites by using the
cyberspace domain and information passes between satellites and ground stations One can
argue that space is a sub-set of the cyberspace domain with satellites serving as computers in
space Global positioning system devices in vehicles interact with satellites all through an
elaborate network as part of the electromagnetic spectrum known as cyberspace Therefore
cyberspace is in space with millions of people using cyberspace everyday
10
AUACSCSinksAY08
The military uses space assets for intelligence surveillance and reconnaissance
knowledge management and command and control Agencies like the National Reconnaissance
Office and National Geospatial-Intelligence Agency obtain high-altitude imagery using a variety
of capabilities to include heat signature resonation Satellites can detect missile launches which
provide vital military information to senior leaders tasked with the security of their nation The
military networks to include decision briefs tasks and emails in Iraq and the Predator feeds in
Afghanistan travel through military and commercial satellites with all the information flowing
through the cyberspace domain With the heavy reliance of cyberspace to operate space assets
and the demands of information flowing through space by businesses it should come as no
surprise that space is a vital component for day-to-day operations of the military
Since cyberspace is an inherent component for space operations it is logical to assume
international law for outer space is applicable to cyberspace as long as an aggressor doesnt
violate the four premises and as long as weapons of mass destruction arenrsquot ldquostationed in outer
spacerdquo 28 Therefore a state would consider a cyber attack against a satellite as other than for
peaceful purposes and according to the fourth premise international law would apply
However what about a cyber attack using satellites as a means of conducting operations
Under todayrsquos current operations international elites havenrsquot considered a cyber attack passing
through space as a violation of international law When a senior leader in Qatar approves a
target set that is executed by a pilot in Nevada by an aircraft in Afghanistan all this information
is transmitted by cyberspace through space The result is that an aircraft renders an air or ground
target inoperable The effect is the same for cyberspace The information flows through space
by way of the cyberspace domain and the result is that an operator has rendered a target
11
AUACSCSinksAY08
inoperable As with airspace the information isnrsquot the cause of the damage but what an operator
does with the information is what constitutes the cyber attack
Land Cyber attacks using resources over land is relatively straightforward International
boundaries are defined as ldquoimaginary lines which separate territorial sovereigntyrdquo 29 which are
mutually agreed upon via international treaties Crossing an international border without
permission from the state is a violation of international law While an illegal immigrant crossing
a border to seek an opportunity to provide for his family is a violation of national law the United
Nation considers a nation-sponsored invasion of another nation that threatens the security and
stability of a nation as a breach in international law and an act of war
However international law doesnrsquot consider all border crossings as an act of war For
example when Nicaraguan troops and arms allegedly crossed the borders of El Salvador the
United Nations determined that incursions didnrsquot threaten El Salvadorrsquos territorial integrity and
stated that neither ldquothese incursions nor the alleged supply of arms may be relied upon as
justifying the exercise of the right of collective self-defenserdquo30 The victim state can repelled the
aggressive act but the United Nations Council wouldnrsquot condone any further military action
taken against the adversary opting for diplomatic or economic solution instead
Does international law apply when an adversary crosses international borders using
cyberspace as the means for conducting warfare operations When an adversarial state crosses a
statersquos boundaries using roads or bridges that connect the two nations the road is the resource
spanning the two nations If the adversary doesnrsquot do anything then returns to their sovereign
borders the aggressor hasnrsquot violated international law However when the adversary uses
weapon systems to affect serious damage the adversary has broken international law and a
12
AUACSCSinksAY08
nation may invoke their right for self-defense and may conduct full-scale operations to neutralize
the threat
A parallel notion is when an adversary uses a copper or fiber optic connection that spans
between two nations The adversary uses the land-based LAN connection as a means for
conducting cyber warfare operations The adversary may cross the borders using cyberspace yet
do nothing The affected state may push the adversary back to its borders but no further actions
are deemed appropriate However once the adversary uses the information transmitted over
cyberspace to cause severe operational or strategic damage the affected state now has the right
of self-defense Cyberspace is the means like the road or bridge for which the adversary
delivered the weapon The affected nation will consider the execution of the adversaryrsquos
information packet or weapon system as an act of aggression and the effect caused by the
weapon is what breeches international law
The difference between these two scenarios is that the adversary using the
electromagnetic spectrum hasnrsquot physically invaded a nationrsquos sovereign borders However
their digital presence crossed sovereign borders and as latter discussed in the paper adversaries
committing an act aggression against a state are now under the jurisdiction of the affected state
Sea ldquoThe territorial sea is a belt of sea adjacent to the (statersquos) coasthellipto include the airspace
aboverdquo as well as the seabed and subsoil31 The territorial sea is subject to the right of innocent
passage by foreign shops giving states the right to transport goods and passengers between ports
All of which is subject to the full sovereignty of the state which according to the United Nations
Convention on the Law of the Sea in 1982 and agreed upon by the majority of its membership in
1982 extends 12 miles from the coast32 The jurisdiction includes crimes where the
consequences extend to the coastal state and disturbs the peace of the country33 A cyber attack
13
AUACSCSinksAY08
conducted within the territorial sea of a nation would be no different from a cyber attack
conducted from within the nationrsquos land borders therefore cyber attacks against a state or even
another state conducted within the territorial seas are subject to current international laws Cyber
attacks originating outside the statersquos sovereign borders but results in affecting a statersquos
resources in their territorial seas would fall under the land and airspace breeches of territorial
sovereignty and would be subject to international law
The high seas on the other hand arenrsquot subject to the sovereignty of any one state The
high seas extend beyond the territorial sea and include the airspace the seabed and the subsoil34
and all states have the right to exercise freedoms on the high seas35 As similarly defined in
space ldquothe high seas shall be reserved for peaceful purposesrdquo as stated by Article 88 of the Law
of the Seas Cooperative36 which is defined as refraining from any threat or use of force (outside
of wartime conflicts)
The very nature of a cyber attack in the high seas lends itself to be a violation of
international law as nations are restricted to conducting peaceful operations in the high seas
The question is whom has jurisdiction of crimes committed in the high seas By applying the
Protective Security Principle of Jurisdiction where an actor threatens a statersquo security and
introducing the United Nationrsquos definition on the Illegal Use of Force extends to the high seas
and for that matter space giving states the right for self-defense as defined by the United Nations
as ldquoan armed attackrdquo The sheer name of cyber attack doesnrsquot immediately lend itself to an
ldquoarmedrdquo cyber attack However the effects generated from a cyber attack can be equivalent to a
traditional conventional attack and the international law would permit a state to take appropriate
countermeasures while notifying the United Nations Security Council37
14
AUACSCSinksAY08
Applying International Law to Cyber Warfare Today we live in an Information Age where communication through cyberspace has forever changed and flattened out worldhellipOur adversaries seek to operate from behind technical legal and international screens as they execute their costly attacks38
~General James E Cartwright Commander United States Strategic Command
Jurisdiction
Understanding the territorial sovereignty principles of a nation is important in applying
cyberspace and cyber warfare to existing international laws While some of these principles and
international laws may not be relevant for the cyberspace domain due to the far-reaching
capability of cyber warfare the jurisdiction of a nation further defines its ability to respond to
aggressive acts by nations in the cyberspace domain There are three jurisdictional principles
that provide nations the right to pursue aggressors that threaten a nationrsquos independence the
Territorial Principle Nationality Principle and the Protective Security Principle
For actions originating within the state the jurisdiction clearly falls within the territorial
principle where a ldquostate has jurisdiction over all crimes committed in its territoryhellipto include
airspace international waters and territorial seasrdquo39 The territorial jurisdiction is subject to
exceptions when dealing with persons from foreign states as in the most popular example of
immunity given to foreign diplomats In this case ldquostates may exercise jurisdiction over its
citizenhellipeven if they are physically outside the statesrsquo territoryrdquo as Doctor Boczek defines as the
Nationality Principle Nations usually agree upon on these concessions states prior to the offense
being committed40
Doctor Boczek defines the Protective Security Principle as a ldquojurisdictional principle
whereby a state my assume jurisdiction over and punish foreign nationals for certain conduct
outside its territory which is directed against its security territorial integrity and political
independencerdquo41 Some states would argue that criticism of a state or government is applicable
15
AUACSCSinksAY08
in applying this principle of jurisdiction However this is too broad of an interpretation and
should be confined to acts that are more tangible in nature like falsification of a statesrsquo official
documents conspiracy to violate immigration of custom laws and illicit drug trafficking42
Would a cyber attack that is deemed to challenge a nationrsquos banking community or bring
down a power source be a direct attack against its security and political independence The
international community easily sees the attack of a power source with kinetic weapons as a
violation of a territorial boundary and a breech of international law The United States viewed
the attack on the Trade Towers as an act of war launching the Global War on Terrorism Would
the United States have viewed the same devastation as if the attack occurred through cyberspace
Would the attack have been less of an act of war if the aggressor remotely controlled domestic
airliners from a foreign country Probably not What happens if the cyber attack caused a fire in
the lower floors of the buildings preventing people from escaping While less dramatic than an
airbus flying into the middle of the towers and maybe more difficult to demonize the crime the
result is the samemdashinnocent people suffering as a result of an adversary trying to threaten a
nationrsquos security
What happens if the suspected cyber attack has violated a nationrsquos territorial boundary in
order to attack a neighboring country or an ally Going from point A to point B in cyberspace is
rarely a direct connection As with the global nature of cyberspace itrsquos conceivable that
adversaries cross several nationsrsquo boundaries to conduct cyber attack operations The question
generated is who has jurisdiction
If the actor committing the crime had used an airplane each nation could claim
jurisdiction as the adversary violated their territorial boundaries and violated international law
More often than not the first state would have acted immediately upon the aggressive act and
16
AUACSCSinksAY08
would have prevented aggressors from completing their task by either forcing the aircraft to land
or turnaround or an even more escalated response of firing upon the aircraft In the air land or
sea the ability for a nationrsquos military forces to respond in a timely manner gives way to the
deterrence factor of not crossing a statersquos boundaries without receiving permission for fear of
reprisal A clear example of this was when Turkey denied the United States the ability deploy
the 4th Infantry Division from its borders at the beginning of Operation Iraqi Freedom Violating
Turkeyrsquos borders without permission would have brought about great repercussions that would
have made Operation Iraqi Freedom even more difficult and could have resulted in an escalation
of the war outside the Iraqi borders43 Another example is when Spain and France denied the
Unites States the use of their airspace when F-111s based in the United Kingdom conducted air
operations in Libya in an effort to eliminate Muammar Khadafy44
However the speeds at which these breeches in territorial boundaries occur make it
difficult for a nation to claim jurisdiction especially when nothing occurred within their
territorial sovereignty The cyber attacks didnrsquot result in any damage to nation as the information
packets passed through their sovereign borders According to territorial boundary description
described by Doctor Boczek the international community doesnrsquot consider the crossing the
border in of itself an act of warmdashserious damage is a driving factor in determining conflict
escalation In addition according to the territorial jurisdiction principle the cyber attack didnrsquot
threaten a nationrsquos security territorial integrity and political independence If the cyber attack or
information originated from within a sovereign territory by a third party then the two nations
would have to work together to resolve the issue and mutual jurisdiction would probably apply
However if the cyber attack didnrsquot physically manifest itself from within their sovereign
territory or the adversary didnrsquot use the nation as a staging area to launch a further attack the
17
AUACSCSinksAY08
international law and the jurisdiction principles would dictate the affected nation would have
jurisdiction
Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security
territorial integrity and political independence Cyberspace utilizes the other domains as a means
of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence
Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of
territorial sovereignty the Protective Security Principle does provide nations the ability to
enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos
sovereignty when it conducts cyber warfare operations However some elites donrsquot consider
cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense
International law specifically article 2 of the United Nations Charters states that a
members shall refrain in their international relations from the threat or use of force against the
territorial integrity or political independence of any state or in any other manner inconsistent
with the purposes of the United Nations which is intended to prohibit all types of force except
those carried out under the aegis of the United Nations or as provided for by the Security
Council45 The only exception to the United Nations Charters as it relates to the Use of Force is
the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed
attack46
International elites have discussed the term ldquouse of forcerdquo in the past because of the
development of chemical and biological weapons and had to move from a kinetic impact based
definition to a results-oriented approach47 Chemical and biological weapons lacked the
characteristic of an explosion or physical force yet these weapons certainly are capable of
destroying life and property Doctor Leigh Armistead a former information warfare instructor at
18
AUACSCSinksAY08
the Joint Forces Staff College cautions that the use of computer network attacks by the military
ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary
that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great
Russia introduced a proposal to the United Nations that banned the use of information
operations Even though the United Nations didnrsquot adopt the law the concern of international
community is fully aware of the impact cyber attacks can have on a nation
The concern over cyber warfare capabilities is that it can generate both non-kinetic and
kinetic effects There has always been the traditional kinetic solution for cyber warfare where a
precision guidance munition destroys a critical information system node Most people assume
computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos
computer system from the safety of onersquos own command and control center but the physical
destruction of a computer system or network by kinetic means also qualifies as cyber warfare
However cyber warfare has also evolved to the point where aggressors can achieve a kinetic
effect without the use of a traditional kinetic weapon A cyber attack on an information system
can shut down a particular node of a power plant causing the system to become inoperative
Even if there wasnrsquot an explosion the attack serves the same purpose
The question raised is do cyber attacks constitute an armed attack Scholars do agree that
some cyber attacks fit comfortably within the United Nations Charter For example a strategic
level cyber attack causing widespread damage and significant casualties would trigger the statersquos
right of self-defense In addition a cyber attack that precluded a conventional attack or a series
of cyber attacks causing significant damage would give a state the right of self-defense49 Few
would dispute that a country has the right under international law to respond with military force
19
AUACSCSinksAY08
if a state destroyed or significantly damaged another nationrsquos economic system for example the
New York or London stock exchanges
However some confusion and state-defined interpretation comes into play when the
frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard
Law School argues that cyber attacks require an expansion of the definition on the ldquouse of
forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot
be prohibited by international law50 International scholars recommend ldquoclearer rules of what
kinds of information warfare actions constitute an armed attackrdquo which drives permissible
responses of self-defense51 For example a state-sponsored cyber attack causes damage to a
victimrsquos factory or power plant however the nation claims the incident is an isolated instance
and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under
the United Nations Charter and the United Nations would consider any response retaliation
which would violate international law52
Another example involves a nation conducting a series of small attacks causing minimal
damage and then ceases Even though the aggressor used force to conduct cyber warfare
operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under
the United Nations Charter This type of attack is analogues to a small band of troops crossing a
border without causing significant damage53 According to the United Nations Charter the
national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders
and respond to the use of force Repelling the small band of troops and reestablishing their
sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration
of war and allies would have to respect the United Nations decision and couldnrsquot intervene The
same is true for the cyber attack A state can employ defensive measure to isolate and defeat the
20
AUACSCSinksAY08
incursion over the electromagnetic spectrum However the United Nations would see further
offensive operations or invasive operations as retaliation Therefore a nation must take the
incident whether it is signs of conventional forces on the ground or traces of cyber warfare
incursions in the electromagnetic spectrum to the United Nations to seek restitution
In both of these situations the international law becomes the target for change not
whether cyber warfare is in violation of international law If the law were to change the
international community would then consider the above situations acts of war even if an
adversary used conventional forces As written today the result of an operation remains the
driving factor in determining if an adversary has violated international law The means by which
an adversary conducts military operations may affect how nations react to the situation but
whether an adversary conducts the operation by means of the air land sea space or cyberspace
doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian
Triggs a public international lawyer and member of the Attorney General International Legal
Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over
offences abroad having an intended and substantial effect within a state may be justifiedrdquo54
Therefore the international community must evaluate the effect of a criminal act rather than the
means in which the act was committed
Others claim that because the Internet takes advantages of legal norms where non-state
actors can ignore Western notions of law55 more international laws are needed for cyberspace
However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using
other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the
Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked
aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts
21
AUACSCSinksAY08
against a staterdquo in the cyberspace domain The anonymity of the Internet and their total
disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and
national laws already exist in most countries that prohibit the use of the Internet for terrorist
activities therefore additional international laws wouldnrsquot prevent or deter terrorist from
committing such acts of aggression
International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed
Conflict includes the Martens Clause which extends established custom and humanitarian
principles to new technologies and addresses the ever-changing nature of warfare The
international community designed The Martens Clause ldquoto prevent future unnecessary andor
disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges
crimes by invoking the laws of humanity and public conscience hence their effects and not its
methods
The basic legal premise behind Law of Armed Conflict is that attacks must be limited to
military objectives and collateral damage must be proportionate to military advantages and
forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary
suffering but military commanders and planners need to be aware of the results a particular
action will invoke Russian leadership believes a computer network attack against their
homeland can be a means for executing a variety of escalating responses to include nuclear
attack58 Therefore it is imperative military commanders understand the impact any weapon
system can have on an adversary not just cyber attacks
Not all scholars agree that international law is insufficient to govern cyber warfare
Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace
and the Use of Force states that computer network attacks constitute an unlawful use of force in
22
AUACSCSinksAY08
cyberspace under traditional international law Sharp declared that an armed attack may occur
ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a
way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive
definition of cyber attacks may never be drafted59 The Congressional Research Service also
concluded that ldquothere is little likelihood that the international community will soon generate a
coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations
on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos
conclusion is that the effects of cyber warfare operations are the same as if an adversary
conducted conventional warfare operations where the effect of the attacks are the driving factors
in determining whether an adversary used force or not
The United States Government agrees with Sharprsquos conclusion The offensive
Information Operation strategy for the United States government as described by Doctor
Armistead ties the tools used to conduct military operations back to the desired effect which is
in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning
effects-based operations and operational art focus the Joint Force Commanderrsquos course of action
towards meeting objectives outlined in guidance provided by the National Command Authority
and senior military leadership62 Whether the tools are dropped pamphlets invasive network
attacks or bombs on targets the goal is to produce a desired effect to achieve the overall
objectives and cyber warfare can produce effects that challenge the national security of a nation
Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63
~General T Michael Moseley USAF
23
AUACSCSinksAY08
The cyberspace domain has been around for quite sometime but as technology continues
to advance businesses as well as governmental organizations are becoming more reliant on the
cyberspace domain With that reliance the protection of this critical domain becomes even more
important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the
electromagnetic spectrum by denying and disrupting information demands Scholars claim that
protection needs to include addressing existing international laws expanding them to incorporate
the ever-advancing capabilities emerging in the cyberspace domain
However territorial sovereignty of a nation and the principles of jurisdiction specifically
the Protective Security Principle give nations the right to exercise jurisdiction when an
aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64
While cyberspace is a domain requiring specific attention it relies on assets in the other domains
of land space sea and air in order to operate and international laws for the linear domains do
exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace
but during cyber warfare operations the principles behind the restrictions of foreign military
entering airspace do apply The strategic nature of cyber warfare operations correspond to the
same strategic impact that airpower can inflict upon a nation threatening their independence
While maybe not as dramatic as kinetic effects the results can be just as devastating
Space is relatively straightforward Since a nation canrsquot claim space and over flights of
foreign satellites over a nation is permissible nations must use space for peaceful purposes
Kinetic attacks against space assets are a violation of international law therefore nations would
consider cyber warfare operations against space assets as other than peaceful purposes and a
violation of international law Cyber attacks traversing space assets relate to current military
operations where the military uses space assets to conduct kinetic operations Since international
24
AUACSCSinksAY08
elites havenrsquot considered these kinetic operations as a breach of international law military
commanders can conduct cyber warfare operations through space without fear of violating
international laws for outer space
Crossing international borders without a nationrsquos permission and threatening their
sovereignty is a violation of international law While nations canrsquot consider all border crossings
as an act of war those acts of aggression that threaten the territorial integrity would elicit a
defensive response by the victim nation Whether incursions involve combat vehicles over a
highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are
threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not
have set foot in the nation but according the Protective Security Principle the victim nation has
jurisdiction
Conducting cyber warfare operations from the territorial sea is no different from
conducting operations from within a nationrsquos land or sea borders However the high seas are
very similar in nature to space in that they are reserved for peaceful purposes Therefore
conducting any means of warfare from within the high seas is a violation of international law
and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-
defense
According to Barkham ldquoinformation warfare attacks are in essence territorial
penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then
subject to the jurisdiction of the victim nation who then has the right for self-defense However
due to the global nature of cyberspace aggressors can cross multiple borders and determining
who has jurisdiction demands cooperation among nations The origin and any deliberate staging
locations of the cyber attack will drive who has jurisdiction The crossing of third party borders
25
AUACSCSinksAY08
by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the
aggressors threaten a nationrsquos independence or territorial integrity
Scholars consider cyber warfare operations that involve strategic and operational impacts
as being a means of using force and fall within the legal regime of existing international law
However scholars argue that because cyber warfare includes kinetic and non-kinetic results the
Use of Force definition needs expanding Yet they conclude that an exhaustive definition of
cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare
operations against existing case studies where the effects are evaluated as opposed to the means
even if the operations originated from outside the nationrsquos territorial jurisdiction There is some
authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to
have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade
non-state actors from conducting cyber warfare operations given their willingness to ignore
Western notions of war and their ability to conduct operations anonymously in cyberspace
International laws are in place to that address the ever-changing nature of warfare The
Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a
framework for addressing all warfare to include cyber warfare operations The international
community will need to measure the effects of an operation rather the means Whether its boots
on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a
nationrsquos response
26
AUACSCSinksAY08
End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)
27
AUACSCSinksAY08
44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
28
AUACSCSinksAY08
Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005
Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department
American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)
Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983
Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988
Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)
Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)
IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)
Joint Publication 3-13 Information Operations 13 February 2006
Joint Publication 5-0 Joint Operations Planning 26 December 2006
Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies
Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc
Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College
Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)
Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press
29
AUACSCSinksAY08
Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI
Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)
Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press
Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company
Detter Delupis I The law of war (2000) New York NY Cambridge University Press
Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)
Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College
Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor
Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)
Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)
Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf
Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)
Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College
Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College
Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)
Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA
30
AUACSCSinksAY08
Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)
Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)
Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College
Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology
Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College
Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)
OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center
OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College
OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications
Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991
Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College
Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center
Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)
31
AUACSCSinksAY08
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press
Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA
Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University
Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor
Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661
Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office
Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis
United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC
United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center
Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College
Wesley David C The Military Commander and the Law 2006
32
AUACSCSinksAY08
cyberspace includes ldquocapabilities that are currently considered electronic warfarerdquo11 which Great
Britain exploited in World War II when they introduced radar technology in World War II and is
still applicable with communication and navigational jamming capabilities used in todayrsquos
conflicts
While cyberspace is a unique domain that military commanders must protect in order to
conduct operations more effectively and offers commanders another dimension in which to
exploit weaknesses in an adversaryrsquos ability to project power cyberspace doesnrsquot exist on its
own According to Lt Col Fahrenkreg in the published Air University article title Cyberspace
Define ldquocyberspace exists across the other domains of air land sea and spacerdquo12 There are
clear delineations between the sea land and air Commanders know where the land ends and the
sea begins While there are some discussions as to where airspace ends and space begins the
capabilities and roles associated with each domain are clear Therefore to depict cyberspace as
an autonomous domain is unrealistic as the physical infrastructure of cyberspace and the means
of sharing information within the cyberspace domain resides in one or more of the four linear
domains
What Cyberspace is Not The most confused notion about cyberspace is that information operations and
cyberspace are one in the same Joint Publication 3-13 Information Operations describes the
information environment as a collection of leaders decision makers and systems that process
collect disseminate or act on information consisting of three dimensions the physical
informational and cognitive dimensions13 The goal of information operations is to influence the
cognitive dimension by affecting the decision-making process known affectionately by the Air
Force as the OODA Loop (Observe Orient Decide and Act)14 By disrupting and corrupting
4
AUACSCSinksAY08
information processes military commanders can influence or usurp adversarial human and
automated decision making in the physical and informational dimensions
As stated by Lt Col Fahrenkreg the confusion between cyberspace and information
operations comes from the misunderstanding of cyberspace as an operation rather than a
domain15 Information operation is a capability available to the combatant commander to
generate an effect in one of the five domains It just so happens that cyberspace tends to be the
primary means of delivering the Information Operation capability
Cyberspace connects the physical dimensions with the cognitive process and is a means
to create effects to include disrupting degrading denying the enemy the use of strategic and
operational assets to include command and controls systems power plants telecommunications
and other like targets to affect a statersquos operational and strategic centers of gravity Cyberspace
isnrsquot information or the data residing on a computer but is the means in which users transfer
store or modify information Cyberspace isnrsquot the data sent to a precision guided munition but
the means in which the originator passes the information Cyberspace is the digital super
highway of the electromagnetic spectrum with the ones zeros and electrons as the passengers
Defining Cyber Warfare According to the Institute for Advanced Study of Information Warfare (ASIW) cyber
warfare has become a form of information warfare which ASIW defines as ldquothe offensive and
defensive use of information and information systems to deny exploit corrupt or destroy and
adversaryrsquos information information-based processes information systems and computer-based
networks while protecting onersquos own Such actions are designed to achieve advantages over
military adversariesrdquo16 While this definition doesnrsquot specifically address the electromagnetic
spectrum the definition focuses on information-sharing systems which is where crux of the
cyberspace domain revolves around
5
AUACSCSinksAY08
Joint doctrine defines cyber warfare as those areas of operations that affect the
electromagnetic spectrum to include Computer Network Operations and Electronic Warfare
which are two of the five core operational capabilities of Information Operations Electronic
warfare operations operates across ldquoradio visible micro directed energy and all other
frequenciesrdquo and overlaps with network warfare operations which include ldquoradio nets satellite
links tactical digital information links (TADIL) telemetry digital track files
telecommunications and wireless communication network and systemsrdquo all of which operate
within the electromagnetic spectrum17
Cyber warfare consists of defensive and offensive operations Defensive operations
arenrsquot limited to severing connections or blocking attempts of an adversary trying to corrupt data
modify transmissions or destroy information systems Defensive operations include the
elimination of the adversaryrsquos capability of conducting operations which may involve crossing
sovereign borders in order to complete the task However defensive network operations come in
more than just one form The movies portray computer experts hovering over computers trying
to affect each otherrsquos operations However cyber warfare includes the use of traditional kinetic
effect to disrupt computer network operations of the enemy as a fighter-bomber delivering a
500-pound bomb to destroy a vital mode in a computer network may serve the same purpose as a
computer-centric network attack While this isnrsquot as sexy as a network attack that spans the
globe to degrade the enemyrsquos ability operation within the cyberspace domain the effects are the
same
Territorial Sovereignty In total war it is quite impossible to draw any precise line between military and non-military problems18
~Sir Winston Churchill
6
AUACSCSinksAY08
Cyberspace is certainly a domain that requires unique attention in order for commanders
to effectively and efficiently prosecute combat operations Cyberspace spans the globe using
the physical infrastructure residing within the other linear domains As users pass information
from one site to another data crosses boundaries by means of the cyberspace domain Data
leaves the Iraq area of operation via satellite to a receiving site in Germany Operators route the
information to the United States either through another satellite or by ground to sea-based cables
bound for computer nodes within the United States before arriving in South Carolina where
automated network tools redirect the information to the receiverrsquos location
An adversary attempting to modify corrupt or destroy this information traveling within
the cyberspace domain would at one time or another would cross sovereign borders through air
land sea or space The adversaryrsquos physical presence may not apply as they could conduct
operations from the comforts of their home however a nation could detect the adversaryrsquos
digital presence and could feel the impact of their actions from within their sovereign borders
Therefore as these adversaries span the globe using the cyberspace domain that relies on the
other linear domains to exist does international law apply when boundaries are crossed The
following sections will address the international laws of each physical domain and evaluate how
their principles apply to the cyberspace domain
Airspace Airspace as defined by Doctor Boleslaw A Boczek the internationally renowned expert
on international law ldquois the air pillow above the subjacent territoryrdquo to include ldquoairspace above
international waters and the territorial seardquo The airspace is under complete and exclusive
sovereignty of the subject state19 With that states have jurisdiction over their airspace and
require identification of foreign aircraft along with their intentions According to Dr Boczek
book International Law A Dictionary ldquoentry of national spacehellipmay take place only with the
7
AUACSCSinksAY08
authorization of the territorial staterdquo20 and currently only applies to aircraft Entry into the
airspace would require ldquoall aircraft to identify themselves file flight plans and report their
positionrdquo According to the 1944 Chicago Convention on International Civil Aviation nations
can enter into agreements that allow scheduled international civil air services which usually
include reciprocal agreements covering routes volume and other matters relating to air traffic
However these agreements only apply to civil aviation where state aircraft which include
aircraft belonging to the military customs public services and heads of states must follow more
restrictive procedures upon entering the airspace of a foreign nation21
There are several incidents where states have evoked their right for defending their
national security like the shooting down of a US military reconnaissance aircraft over Soviet
airspace by the Soviet Union in 196022 or the shooting down by Soviet fighter planes of a South
Korean airliner in 198323 The Soviet Union isnrsquot the only nation to protect its airspace as the
United States was responsible for shooting down an Iranian airliner thought to be an attacking
military plane over the Persian Gulf in 198824 These examples illustrate a nationrsquos sovereign
resolve to protect itself when a suspected adversary violated their airspace
Applying international law of airspace to cyberspace doesnrsquot seem too practical Civilian
signals entering a nationrsquos airspace would require nations to enter into agreements to allow
scheduled services and the persons receiving information through airspace would have to be
non-state sponsored Nationrsquos could regulate some cyberspace networks entering airspace like
radio communications that primarily use land-based infrastructure to function However the
very nature of computer networks and the ever-increasing global reach of communication
capabilities severely restrict a nationrsquos ability to monitor the millions of transmissions made on a
daily basis and these signals certainly wouldnrsquot be on any scheduled basis Therefore even if
8
AUACSCSinksAY08
nations made agreements concerning the cyberspace domain nations would have a difficult time
enforcing their terms of agreements unless the terms are very open-ended If they were so open-
ended then the agreement may not be necessary and based on my research nations realize the
futility of establishing these agreements as this author couldnrsquot find any reference to any
agreements that nations have entered into referencing the cyberspace domain
While the international law for civilian aircraft in airspace may not relate well or isnrsquot
feasible to enforce in the cyberspace domain does a nation have that same right to protect itself
from a suspected attack from cyberspace where the attackerrsquos signal enters airspace Does a
nation have the right to ldquoshoot downrdquo a cyberspace attack as it enters their domain through
airspace The whole idea behind restricting airspace from foreign military aircraft is because of
the strategic impact military aircraft can have on a nation As demonstrated in World War II
military aircraft carrying weapons of mass destruction can decimate cities and destroy a nation
with minimal effort The effects generated by military aircraft are quite destructive and garner
specific attention While an aircraft in of itself is relatively harmless the actions taken by the
crew can lead to devastating results
The same is true for cyber attacks The information passing through airspace in the
cyberspace domain is the vehicle however the crew conducting the operation is potentially
creating the same strategic results The cyber attack may not destroy cities but it certainly can
be destructive to a nationrsquos well-being by crippling power sources economic industries water
supply etc all at the blink of an eye while the victim takes several days to determine the
perpetrator Therefore while the international law for airspace may not be specifically relevant
the underlying principles are applicable as cyber attacks can have the same potential strategic
impact as an attack from a military aircraft
9
AUACSCSinksAY08
Space Outer space as defined by Doctor Boczek ldquois the space beyond the air surrounding the
earthrdquo As of 2005 international law doesnrsquot define a demarcation between airspace and outer
space but ldquostates agree that state sovereignty doesnrsquot extend without any limitsrdquo25 Proposals of
where airspace ends and when outer space begins are base on various scientific and technological
criteria (gravitational pull capabilities of air breathing aircraft etc26) Others scientists argue
that defining a boundary between airspace and outer space isnrsquot necessary as it would hinder the
progress of space technology and the legal status would depend on the nature of the activity
While no boundary exists airspace is finite and activity in outer space follows four
fundamentals principles First over flights of foreign satellites over a nation is permissible as
airspace doesnrsquot extend forever Second space ldquointernational law applies to outer space and
celestial bodiesrdquo Third according to the Outer Space Treaty of 1967 states canrsquot claim celestial
bodies or outer space which are not subject to national appropriation therefore are free for use
by all states Finally states must use outer space exclusively for peaceful purposes with specific
bans on weapons of mass destruction However states can use space for other military purposes
like intelligence surveillance and reconnaissance activities 27
Are these international laws and principles applicable to cyberspace Satellites are
certainly an integral part of the space domain Operators control satellites by using the
cyberspace domain and information passes between satellites and ground stations One can
argue that space is a sub-set of the cyberspace domain with satellites serving as computers in
space Global positioning system devices in vehicles interact with satellites all through an
elaborate network as part of the electromagnetic spectrum known as cyberspace Therefore
cyberspace is in space with millions of people using cyberspace everyday
10
AUACSCSinksAY08
The military uses space assets for intelligence surveillance and reconnaissance
knowledge management and command and control Agencies like the National Reconnaissance
Office and National Geospatial-Intelligence Agency obtain high-altitude imagery using a variety
of capabilities to include heat signature resonation Satellites can detect missile launches which
provide vital military information to senior leaders tasked with the security of their nation The
military networks to include decision briefs tasks and emails in Iraq and the Predator feeds in
Afghanistan travel through military and commercial satellites with all the information flowing
through the cyberspace domain With the heavy reliance of cyberspace to operate space assets
and the demands of information flowing through space by businesses it should come as no
surprise that space is a vital component for day-to-day operations of the military
Since cyberspace is an inherent component for space operations it is logical to assume
international law for outer space is applicable to cyberspace as long as an aggressor doesnt
violate the four premises and as long as weapons of mass destruction arenrsquot ldquostationed in outer
spacerdquo 28 Therefore a state would consider a cyber attack against a satellite as other than for
peaceful purposes and according to the fourth premise international law would apply
However what about a cyber attack using satellites as a means of conducting operations
Under todayrsquos current operations international elites havenrsquot considered a cyber attack passing
through space as a violation of international law When a senior leader in Qatar approves a
target set that is executed by a pilot in Nevada by an aircraft in Afghanistan all this information
is transmitted by cyberspace through space The result is that an aircraft renders an air or ground
target inoperable The effect is the same for cyberspace The information flows through space
by way of the cyberspace domain and the result is that an operator has rendered a target
11
AUACSCSinksAY08
inoperable As with airspace the information isnrsquot the cause of the damage but what an operator
does with the information is what constitutes the cyber attack
Land Cyber attacks using resources over land is relatively straightforward International
boundaries are defined as ldquoimaginary lines which separate territorial sovereigntyrdquo 29 which are
mutually agreed upon via international treaties Crossing an international border without
permission from the state is a violation of international law While an illegal immigrant crossing
a border to seek an opportunity to provide for his family is a violation of national law the United
Nation considers a nation-sponsored invasion of another nation that threatens the security and
stability of a nation as a breach in international law and an act of war
However international law doesnrsquot consider all border crossings as an act of war For
example when Nicaraguan troops and arms allegedly crossed the borders of El Salvador the
United Nations determined that incursions didnrsquot threaten El Salvadorrsquos territorial integrity and
stated that neither ldquothese incursions nor the alleged supply of arms may be relied upon as
justifying the exercise of the right of collective self-defenserdquo30 The victim state can repelled the
aggressive act but the United Nations Council wouldnrsquot condone any further military action
taken against the adversary opting for diplomatic or economic solution instead
Does international law apply when an adversary crosses international borders using
cyberspace as the means for conducting warfare operations When an adversarial state crosses a
statersquos boundaries using roads or bridges that connect the two nations the road is the resource
spanning the two nations If the adversary doesnrsquot do anything then returns to their sovereign
borders the aggressor hasnrsquot violated international law However when the adversary uses
weapon systems to affect serious damage the adversary has broken international law and a
12
AUACSCSinksAY08
nation may invoke their right for self-defense and may conduct full-scale operations to neutralize
the threat
A parallel notion is when an adversary uses a copper or fiber optic connection that spans
between two nations The adversary uses the land-based LAN connection as a means for
conducting cyber warfare operations The adversary may cross the borders using cyberspace yet
do nothing The affected state may push the adversary back to its borders but no further actions
are deemed appropriate However once the adversary uses the information transmitted over
cyberspace to cause severe operational or strategic damage the affected state now has the right
of self-defense Cyberspace is the means like the road or bridge for which the adversary
delivered the weapon The affected nation will consider the execution of the adversaryrsquos
information packet or weapon system as an act of aggression and the effect caused by the
weapon is what breeches international law
The difference between these two scenarios is that the adversary using the
electromagnetic spectrum hasnrsquot physically invaded a nationrsquos sovereign borders However
their digital presence crossed sovereign borders and as latter discussed in the paper adversaries
committing an act aggression against a state are now under the jurisdiction of the affected state
Sea ldquoThe territorial sea is a belt of sea adjacent to the (statersquos) coasthellipto include the airspace
aboverdquo as well as the seabed and subsoil31 The territorial sea is subject to the right of innocent
passage by foreign shops giving states the right to transport goods and passengers between ports
All of which is subject to the full sovereignty of the state which according to the United Nations
Convention on the Law of the Sea in 1982 and agreed upon by the majority of its membership in
1982 extends 12 miles from the coast32 The jurisdiction includes crimes where the
consequences extend to the coastal state and disturbs the peace of the country33 A cyber attack
13
AUACSCSinksAY08
conducted within the territorial sea of a nation would be no different from a cyber attack
conducted from within the nationrsquos land borders therefore cyber attacks against a state or even
another state conducted within the territorial seas are subject to current international laws Cyber
attacks originating outside the statersquos sovereign borders but results in affecting a statersquos
resources in their territorial seas would fall under the land and airspace breeches of territorial
sovereignty and would be subject to international law
The high seas on the other hand arenrsquot subject to the sovereignty of any one state The
high seas extend beyond the territorial sea and include the airspace the seabed and the subsoil34
and all states have the right to exercise freedoms on the high seas35 As similarly defined in
space ldquothe high seas shall be reserved for peaceful purposesrdquo as stated by Article 88 of the Law
of the Seas Cooperative36 which is defined as refraining from any threat or use of force (outside
of wartime conflicts)
The very nature of a cyber attack in the high seas lends itself to be a violation of
international law as nations are restricted to conducting peaceful operations in the high seas
The question is whom has jurisdiction of crimes committed in the high seas By applying the
Protective Security Principle of Jurisdiction where an actor threatens a statersquo security and
introducing the United Nationrsquos definition on the Illegal Use of Force extends to the high seas
and for that matter space giving states the right for self-defense as defined by the United Nations
as ldquoan armed attackrdquo The sheer name of cyber attack doesnrsquot immediately lend itself to an
ldquoarmedrdquo cyber attack However the effects generated from a cyber attack can be equivalent to a
traditional conventional attack and the international law would permit a state to take appropriate
countermeasures while notifying the United Nations Security Council37
14
AUACSCSinksAY08
Applying International Law to Cyber Warfare Today we live in an Information Age where communication through cyberspace has forever changed and flattened out worldhellipOur adversaries seek to operate from behind technical legal and international screens as they execute their costly attacks38
~General James E Cartwright Commander United States Strategic Command
Jurisdiction
Understanding the territorial sovereignty principles of a nation is important in applying
cyberspace and cyber warfare to existing international laws While some of these principles and
international laws may not be relevant for the cyberspace domain due to the far-reaching
capability of cyber warfare the jurisdiction of a nation further defines its ability to respond to
aggressive acts by nations in the cyberspace domain There are three jurisdictional principles
that provide nations the right to pursue aggressors that threaten a nationrsquos independence the
Territorial Principle Nationality Principle and the Protective Security Principle
For actions originating within the state the jurisdiction clearly falls within the territorial
principle where a ldquostate has jurisdiction over all crimes committed in its territoryhellipto include
airspace international waters and territorial seasrdquo39 The territorial jurisdiction is subject to
exceptions when dealing with persons from foreign states as in the most popular example of
immunity given to foreign diplomats In this case ldquostates may exercise jurisdiction over its
citizenhellipeven if they are physically outside the statesrsquo territoryrdquo as Doctor Boczek defines as the
Nationality Principle Nations usually agree upon on these concessions states prior to the offense
being committed40
Doctor Boczek defines the Protective Security Principle as a ldquojurisdictional principle
whereby a state my assume jurisdiction over and punish foreign nationals for certain conduct
outside its territory which is directed against its security territorial integrity and political
independencerdquo41 Some states would argue that criticism of a state or government is applicable
15
AUACSCSinksAY08
in applying this principle of jurisdiction However this is too broad of an interpretation and
should be confined to acts that are more tangible in nature like falsification of a statesrsquo official
documents conspiracy to violate immigration of custom laws and illicit drug trafficking42
Would a cyber attack that is deemed to challenge a nationrsquos banking community or bring
down a power source be a direct attack against its security and political independence The
international community easily sees the attack of a power source with kinetic weapons as a
violation of a territorial boundary and a breech of international law The United States viewed
the attack on the Trade Towers as an act of war launching the Global War on Terrorism Would
the United States have viewed the same devastation as if the attack occurred through cyberspace
Would the attack have been less of an act of war if the aggressor remotely controlled domestic
airliners from a foreign country Probably not What happens if the cyber attack caused a fire in
the lower floors of the buildings preventing people from escaping While less dramatic than an
airbus flying into the middle of the towers and maybe more difficult to demonize the crime the
result is the samemdashinnocent people suffering as a result of an adversary trying to threaten a
nationrsquos security
What happens if the suspected cyber attack has violated a nationrsquos territorial boundary in
order to attack a neighboring country or an ally Going from point A to point B in cyberspace is
rarely a direct connection As with the global nature of cyberspace itrsquos conceivable that
adversaries cross several nationsrsquo boundaries to conduct cyber attack operations The question
generated is who has jurisdiction
If the actor committing the crime had used an airplane each nation could claim
jurisdiction as the adversary violated their territorial boundaries and violated international law
More often than not the first state would have acted immediately upon the aggressive act and
16
AUACSCSinksAY08
would have prevented aggressors from completing their task by either forcing the aircraft to land
or turnaround or an even more escalated response of firing upon the aircraft In the air land or
sea the ability for a nationrsquos military forces to respond in a timely manner gives way to the
deterrence factor of not crossing a statersquos boundaries without receiving permission for fear of
reprisal A clear example of this was when Turkey denied the United States the ability deploy
the 4th Infantry Division from its borders at the beginning of Operation Iraqi Freedom Violating
Turkeyrsquos borders without permission would have brought about great repercussions that would
have made Operation Iraqi Freedom even more difficult and could have resulted in an escalation
of the war outside the Iraqi borders43 Another example is when Spain and France denied the
Unites States the use of their airspace when F-111s based in the United Kingdom conducted air
operations in Libya in an effort to eliminate Muammar Khadafy44
However the speeds at which these breeches in territorial boundaries occur make it
difficult for a nation to claim jurisdiction especially when nothing occurred within their
territorial sovereignty The cyber attacks didnrsquot result in any damage to nation as the information
packets passed through their sovereign borders According to territorial boundary description
described by Doctor Boczek the international community doesnrsquot consider the crossing the
border in of itself an act of warmdashserious damage is a driving factor in determining conflict
escalation In addition according to the territorial jurisdiction principle the cyber attack didnrsquot
threaten a nationrsquos security territorial integrity and political independence If the cyber attack or
information originated from within a sovereign territory by a third party then the two nations
would have to work together to resolve the issue and mutual jurisdiction would probably apply
However if the cyber attack didnrsquot physically manifest itself from within their sovereign
territory or the adversary didnrsquot use the nation as a staging area to launch a further attack the
17
AUACSCSinksAY08
international law and the jurisdiction principles would dictate the affected nation would have
jurisdiction
Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security
territorial integrity and political independence Cyberspace utilizes the other domains as a means
of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence
Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of
territorial sovereignty the Protective Security Principle does provide nations the ability to
enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos
sovereignty when it conducts cyber warfare operations However some elites donrsquot consider
cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense
International law specifically article 2 of the United Nations Charters states that a
members shall refrain in their international relations from the threat or use of force against the
territorial integrity or political independence of any state or in any other manner inconsistent
with the purposes of the United Nations which is intended to prohibit all types of force except
those carried out under the aegis of the United Nations or as provided for by the Security
Council45 The only exception to the United Nations Charters as it relates to the Use of Force is
the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed
attack46
International elites have discussed the term ldquouse of forcerdquo in the past because of the
development of chemical and biological weapons and had to move from a kinetic impact based
definition to a results-oriented approach47 Chemical and biological weapons lacked the
characteristic of an explosion or physical force yet these weapons certainly are capable of
destroying life and property Doctor Leigh Armistead a former information warfare instructor at
18
AUACSCSinksAY08
the Joint Forces Staff College cautions that the use of computer network attacks by the military
ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary
that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great
Russia introduced a proposal to the United Nations that banned the use of information
operations Even though the United Nations didnrsquot adopt the law the concern of international
community is fully aware of the impact cyber attacks can have on a nation
The concern over cyber warfare capabilities is that it can generate both non-kinetic and
kinetic effects There has always been the traditional kinetic solution for cyber warfare where a
precision guidance munition destroys a critical information system node Most people assume
computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos
computer system from the safety of onersquos own command and control center but the physical
destruction of a computer system or network by kinetic means also qualifies as cyber warfare
However cyber warfare has also evolved to the point where aggressors can achieve a kinetic
effect without the use of a traditional kinetic weapon A cyber attack on an information system
can shut down a particular node of a power plant causing the system to become inoperative
Even if there wasnrsquot an explosion the attack serves the same purpose
The question raised is do cyber attacks constitute an armed attack Scholars do agree that
some cyber attacks fit comfortably within the United Nations Charter For example a strategic
level cyber attack causing widespread damage and significant casualties would trigger the statersquos
right of self-defense In addition a cyber attack that precluded a conventional attack or a series
of cyber attacks causing significant damage would give a state the right of self-defense49 Few
would dispute that a country has the right under international law to respond with military force
19
AUACSCSinksAY08
if a state destroyed or significantly damaged another nationrsquos economic system for example the
New York or London stock exchanges
However some confusion and state-defined interpretation comes into play when the
frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard
Law School argues that cyber attacks require an expansion of the definition on the ldquouse of
forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot
be prohibited by international law50 International scholars recommend ldquoclearer rules of what
kinds of information warfare actions constitute an armed attackrdquo which drives permissible
responses of self-defense51 For example a state-sponsored cyber attack causes damage to a
victimrsquos factory or power plant however the nation claims the incident is an isolated instance
and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under
the United Nations Charter and the United Nations would consider any response retaliation
which would violate international law52
Another example involves a nation conducting a series of small attacks causing minimal
damage and then ceases Even though the aggressor used force to conduct cyber warfare
operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under
the United Nations Charter This type of attack is analogues to a small band of troops crossing a
border without causing significant damage53 According to the United Nations Charter the
national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders
and respond to the use of force Repelling the small band of troops and reestablishing their
sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration
of war and allies would have to respect the United Nations decision and couldnrsquot intervene The
same is true for the cyber attack A state can employ defensive measure to isolate and defeat the
20
AUACSCSinksAY08
incursion over the electromagnetic spectrum However the United Nations would see further
offensive operations or invasive operations as retaliation Therefore a nation must take the
incident whether it is signs of conventional forces on the ground or traces of cyber warfare
incursions in the electromagnetic spectrum to the United Nations to seek restitution
In both of these situations the international law becomes the target for change not
whether cyber warfare is in violation of international law If the law were to change the
international community would then consider the above situations acts of war even if an
adversary used conventional forces As written today the result of an operation remains the
driving factor in determining if an adversary has violated international law The means by which
an adversary conducts military operations may affect how nations react to the situation but
whether an adversary conducts the operation by means of the air land sea space or cyberspace
doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian
Triggs a public international lawyer and member of the Attorney General International Legal
Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over
offences abroad having an intended and substantial effect within a state may be justifiedrdquo54
Therefore the international community must evaluate the effect of a criminal act rather than the
means in which the act was committed
Others claim that because the Internet takes advantages of legal norms where non-state
actors can ignore Western notions of law55 more international laws are needed for cyberspace
However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using
other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the
Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked
aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts
21
AUACSCSinksAY08
against a staterdquo in the cyberspace domain The anonymity of the Internet and their total
disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and
national laws already exist in most countries that prohibit the use of the Internet for terrorist
activities therefore additional international laws wouldnrsquot prevent or deter terrorist from
committing such acts of aggression
International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed
Conflict includes the Martens Clause which extends established custom and humanitarian
principles to new technologies and addresses the ever-changing nature of warfare The
international community designed The Martens Clause ldquoto prevent future unnecessary andor
disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges
crimes by invoking the laws of humanity and public conscience hence their effects and not its
methods
The basic legal premise behind Law of Armed Conflict is that attacks must be limited to
military objectives and collateral damage must be proportionate to military advantages and
forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary
suffering but military commanders and planners need to be aware of the results a particular
action will invoke Russian leadership believes a computer network attack against their
homeland can be a means for executing a variety of escalating responses to include nuclear
attack58 Therefore it is imperative military commanders understand the impact any weapon
system can have on an adversary not just cyber attacks
Not all scholars agree that international law is insufficient to govern cyber warfare
Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace
and the Use of Force states that computer network attacks constitute an unlawful use of force in
22
AUACSCSinksAY08
cyberspace under traditional international law Sharp declared that an armed attack may occur
ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a
way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive
definition of cyber attacks may never be drafted59 The Congressional Research Service also
concluded that ldquothere is little likelihood that the international community will soon generate a
coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations
on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos
conclusion is that the effects of cyber warfare operations are the same as if an adversary
conducted conventional warfare operations where the effect of the attacks are the driving factors
in determining whether an adversary used force or not
The United States Government agrees with Sharprsquos conclusion The offensive
Information Operation strategy for the United States government as described by Doctor
Armistead ties the tools used to conduct military operations back to the desired effect which is
in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning
effects-based operations and operational art focus the Joint Force Commanderrsquos course of action
towards meeting objectives outlined in guidance provided by the National Command Authority
and senior military leadership62 Whether the tools are dropped pamphlets invasive network
attacks or bombs on targets the goal is to produce a desired effect to achieve the overall
objectives and cyber warfare can produce effects that challenge the national security of a nation
Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63
~General T Michael Moseley USAF
23
AUACSCSinksAY08
The cyberspace domain has been around for quite sometime but as technology continues
to advance businesses as well as governmental organizations are becoming more reliant on the
cyberspace domain With that reliance the protection of this critical domain becomes even more
important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the
electromagnetic spectrum by denying and disrupting information demands Scholars claim that
protection needs to include addressing existing international laws expanding them to incorporate
the ever-advancing capabilities emerging in the cyberspace domain
However territorial sovereignty of a nation and the principles of jurisdiction specifically
the Protective Security Principle give nations the right to exercise jurisdiction when an
aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64
While cyberspace is a domain requiring specific attention it relies on assets in the other domains
of land space sea and air in order to operate and international laws for the linear domains do
exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace
but during cyber warfare operations the principles behind the restrictions of foreign military
entering airspace do apply The strategic nature of cyber warfare operations correspond to the
same strategic impact that airpower can inflict upon a nation threatening their independence
While maybe not as dramatic as kinetic effects the results can be just as devastating
Space is relatively straightforward Since a nation canrsquot claim space and over flights of
foreign satellites over a nation is permissible nations must use space for peaceful purposes
Kinetic attacks against space assets are a violation of international law therefore nations would
consider cyber warfare operations against space assets as other than peaceful purposes and a
violation of international law Cyber attacks traversing space assets relate to current military
operations where the military uses space assets to conduct kinetic operations Since international
24
AUACSCSinksAY08
elites havenrsquot considered these kinetic operations as a breach of international law military
commanders can conduct cyber warfare operations through space without fear of violating
international laws for outer space
Crossing international borders without a nationrsquos permission and threatening their
sovereignty is a violation of international law While nations canrsquot consider all border crossings
as an act of war those acts of aggression that threaten the territorial integrity would elicit a
defensive response by the victim nation Whether incursions involve combat vehicles over a
highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are
threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not
have set foot in the nation but according the Protective Security Principle the victim nation has
jurisdiction
Conducting cyber warfare operations from the territorial sea is no different from
conducting operations from within a nationrsquos land or sea borders However the high seas are
very similar in nature to space in that they are reserved for peaceful purposes Therefore
conducting any means of warfare from within the high seas is a violation of international law
and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-
defense
According to Barkham ldquoinformation warfare attacks are in essence territorial
penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then
subject to the jurisdiction of the victim nation who then has the right for self-defense However
due to the global nature of cyberspace aggressors can cross multiple borders and determining
who has jurisdiction demands cooperation among nations The origin and any deliberate staging
locations of the cyber attack will drive who has jurisdiction The crossing of third party borders
25
AUACSCSinksAY08
by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the
aggressors threaten a nationrsquos independence or territorial integrity
Scholars consider cyber warfare operations that involve strategic and operational impacts
as being a means of using force and fall within the legal regime of existing international law
However scholars argue that because cyber warfare includes kinetic and non-kinetic results the
Use of Force definition needs expanding Yet they conclude that an exhaustive definition of
cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare
operations against existing case studies where the effects are evaluated as opposed to the means
even if the operations originated from outside the nationrsquos territorial jurisdiction There is some
authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to
have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade
non-state actors from conducting cyber warfare operations given their willingness to ignore
Western notions of war and their ability to conduct operations anonymously in cyberspace
International laws are in place to that address the ever-changing nature of warfare The
Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a
framework for addressing all warfare to include cyber warfare operations The international
community will need to measure the effects of an operation rather the means Whether its boots
on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a
nationrsquos response
26
AUACSCSinksAY08
End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)
27
AUACSCSinksAY08
44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
28
AUACSCSinksAY08
Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005
Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department
American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)
Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983
Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988
Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)
Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)
IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)
Joint Publication 3-13 Information Operations 13 February 2006
Joint Publication 5-0 Joint Operations Planning 26 December 2006
Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies
Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc
Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College
Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)
Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press
29
AUACSCSinksAY08
Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI
Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)
Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press
Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company
Detter Delupis I The law of war (2000) New York NY Cambridge University Press
Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)
Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College
Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor
Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)
Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)
Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf
Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)
Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College
Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College
Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)
Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA
30
AUACSCSinksAY08
Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)
Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)
Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College
Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology
Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College
Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)
OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center
OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College
OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications
Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991
Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College
Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center
Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)
31
AUACSCSinksAY08
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press
Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA
Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University
Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor
Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661
Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office
Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis
United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC
United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center
Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College
Wesley David C The Military Commander and the Law 2006
32
AUACSCSinksAY08
information processes military commanders can influence or usurp adversarial human and
automated decision making in the physical and informational dimensions
As stated by Lt Col Fahrenkreg the confusion between cyberspace and information
operations comes from the misunderstanding of cyberspace as an operation rather than a
domain15 Information operation is a capability available to the combatant commander to
generate an effect in one of the five domains It just so happens that cyberspace tends to be the
primary means of delivering the Information Operation capability
Cyberspace connects the physical dimensions with the cognitive process and is a means
to create effects to include disrupting degrading denying the enemy the use of strategic and
operational assets to include command and controls systems power plants telecommunications
and other like targets to affect a statersquos operational and strategic centers of gravity Cyberspace
isnrsquot information or the data residing on a computer but is the means in which users transfer
store or modify information Cyberspace isnrsquot the data sent to a precision guided munition but
the means in which the originator passes the information Cyberspace is the digital super
highway of the electromagnetic spectrum with the ones zeros and electrons as the passengers
Defining Cyber Warfare According to the Institute for Advanced Study of Information Warfare (ASIW) cyber
warfare has become a form of information warfare which ASIW defines as ldquothe offensive and
defensive use of information and information systems to deny exploit corrupt or destroy and
adversaryrsquos information information-based processes information systems and computer-based
networks while protecting onersquos own Such actions are designed to achieve advantages over
military adversariesrdquo16 While this definition doesnrsquot specifically address the electromagnetic
spectrum the definition focuses on information-sharing systems which is where crux of the
cyberspace domain revolves around
5
AUACSCSinksAY08
Joint doctrine defines cyber warfare as those areas of operations that affect the
electromagnetic spectrum to include Computer Network Operations and Electronic Warfare
which are two of the five core operational capabilities of Information Operations Electronic
warfare operations operates across ldquoradio visible micro directed energy and all other
frequenciesrdquo and overlaps with network warfare operations which include ldquoradio nets satellite
links tactical digital information links (TADIL) telemetry digital track files
telecommunications and wireless communication network and systemsrdquo all of which operate
within the electromagnetic spectrum17
Cyber warfare consists of defensive and offensive operations Defensive operations
arenrsquot limited to severing connections or blocking attempts of an adversary trying to corrupt data
modify transmissions or destroy information systems Defensive operations include the
elimination of the adversaryrsquos capability of conducting operations which may involve crossing
sovereign borders in order to complete the task However defensive network operations come in
more than just one form The movies portray computer experts hovering over computers trying
to affect each otherrsquos operations However cyber warfare includes the use of traditional kinetic
effect to disrupt computer network operations of the enemy as a fighter-bomber delivering a
500-pound bomb to destroy a vital mode in a computer network may serve the same purpose as a
computer-centric network attack While this isnrsquot as sexy as a network attack that spans the
globe to degrade the enemyrsquos ability operation within the cyberspace domain the effects are the
same
Territorial Sovereignty In total war it is quite impossible to draw any precise line between military and non-military problems18
~Sir Winston Churchill
6
AUACSCSinksAY08
Cyberspace is certainly a domain that requires unique attention in order for commanders
to effectively and efficiently prosecute combat operations Cyberspace spans the globe using
the physical infrastructure residing within the other linear domains As users pass information
from one site to another data crosses boundaries by means of the cyberspace domain Data
leaves the Iraq area of operation via satellite to a receiving site in Germany Operators route the
information to the United States either through another satellite or by ground to sea-based cables
bound for computer nodes within the United States before arriving in South Carolina where
automated network tools redirect the information to the receiverrsquos location
An adversary attempting to modify corrupt or destroy this information traveling within
the cyberspace domain would at one time or another would cross sovereign borders through air
land sea or space The adversaryrsquos physical presence may not apply as they could conduct
operations from the comforts of their home however a nation could detect the adversaryrsquos
digital presence and could feel the impact of their actions from within their sovereign borders
Therefore as these adversaries span the globe using the cyberspace domain that relies on the
other linear domains to exist does international law apply when boundaries are crossed The
following sections will address the international laws of each physical domain and evaluate how
their principles apply to the cyberspace domain
Airspace Airspace as defined by Doctor Boleslaw A Boczek the internationally renowned expert
on international law ldquois the air pillow above the subjacent territoryrdquo to include ldquoairspace above
international waters and the territorial seardquo The airspace is under complete and exclusive
sovereignty of the subject state19 With that states have jurisdiction over their airspace and
require identification of foreign aircraft along with their intentions According to Dr Boczek
book International Law A Dictionary ldquoentry of national spacehellipmay take place only with the
7
AUACSCSinksAY08
authorization of the territorial staterdquo20 and currently only applies to aircraft Entry into the
airspace would require ldquoall aircraft to identify themselves file flight plans and report their
positionrdquo According to the 1944 Chicago Convention on International Civil Aviation nations
can enter into agreements that allow scheduled international civil air services which usually
include reciprocal agreements covering routes volume and other matters relating to air traffic
However these agreements only apply to civil aviation where state aircraft which include
aircraft belonging to the military customs public services and heads of states must follow more
restrictive procedures upon entering the airspace of a foreign nation21
There are several incidents where states have evoked their right for defending their
national security like the shooting down of a US military reconnaissance aircraft over Soviet
airspace by the Soviet Union in 196022 or the shooting down by Soviet fighter planes of a South
Korean airliner in 198323 The Soviet Union isnrsquot the only nation to protect its airspace as the
United States was responsible for shooting down an Iranian airliner thought to be an attacking
military plane over the Persian Gulf in 198824 These examples illustrate a nationrsquos sovereign
resolve to protect itself when a suspected adversary violated their airspace
Applying international law of airspace to cyberspace doesnrsquot seem too practical Civilian
signals entering a nationrsquos airspace would require nations to enter into agreements to allow
scheduled services and the persons receiving information through airspace would have to be
non-state sponsored Nationrsquos could regulate some cyberspace networks entering airspace like
radio communications that primarily use land-based infrastructure to function However the
very nature of computer networks and the ever-increasing global reach of communication
capabilities severely restrict a nationrsquos ability to monitor the millions of transmissions made on a
daily basis and these signals certainly wouldnrsquot be on any scheduled basis Therefore even if
8
AUACSCSinksAY08
nations made agreements concerning the cyberspace domain nations would have a difficult time
enforcing their terms of agreements unless the terms are very open-ended If they were so open-
ended then the agreement may not be necessary and based on my research nations realize the
futility of establishing these agreements as this author couldnrsquot find any reference to any
agreements that nations have entered into referencing the cyberspace domain
While the international law for civilian aircraft in airspace may not relate well or isnrsquot
feasible to enforce in the cyberspace domain does a nation have that same right to protect itself
from a suspected attack from cyberspace where the attackerrsquos signal enters airspace Does a
nation have the right to ldquoshoot downrdquo a cyberspace attack as it enters their domain through
airspace The whole idea behind restricting airspace from foreign military aircraft is because of
the strategic impact military aircraft can have on a nation As demonstrated in World War II
military aircraft carrying weapons of mass destruction can decimate cities and destroy a nation
with minimal effort The effects generated by military aircraft are quite destructive and garner
specific attention While an aircraft in of itself is relatively harmless the actions taken by the
crew can lead to devastating results
The same is true for cyber attacks The information passing through airspace in the
cyberspace domain is the vehicle however the crew conducting the operation is potentially
creating the same strategic results The cyber attack may not destroy cities but it certainly can
be destructive to a nationrsquos well-being by crippling power sources economic industries water
supply etc all at the blink of an eye while the victim takes several days to determine the
perpetrator Therefore while the international law for airspace may not be specifically relevant
the underlying principles are applicable as cyber attacks can have the same potential strategic
impact as an attack from a military aircraft
9
AUACSCSinksAY08
Space Outer space as defined by Doctor Boczek ldquois the space beyond the air surrounding the
earthrdquo As of 2005 international law doesnrsquot define a demarcation between airspace and outer
space but ldquostates agree that state sovereignty doesnrsquot extend without any limitsrdquo25 Proposals of
where airspace ends and when outer space begins are base on various scientific and technological
criteria (gravitational pull capabilities of air breathing aircraft etc26) Others scientists argue
that defining a boundary between airspace and outer space isnrsquot necessary as it would hinder the
progress of space technology and the legal status would depend on the nature of the activity
While no boundary exists airspace is finite and activity in outer space follows four
fundamentals principles First over flights of foreign satellites over a nation is permissible as
airspace doesnrsquot extend forever Second space ldquointernational law applies to outer space and
celestial bodiesrdquo Third according to the Outer Space Treaty of 1967 states canrsquot claim celestial
bodies or outer space which are not subject to national appropriation therefore are free for use
by all states Finally states must use outer space exclusively for peaceful purposes with specific
bans on weapons of mass destruction However states can use space for other military purposes
like intelligence surveillance and reconnaissance activities 27
Are these international laws and principles applicable to cyberspace Satellites are
certainly an integral part of the space domain Operators control satellites by using the
cyberspace domain and information passes between satellites and ground stations One can
argue that space is a sub-set of the cyberspace domain with satellites serving as computers in
space Global positioning system devices in vehicles interact with satellites all through an
elaborate network as part of the electromagnetic spectrum known as cyberspace Therefore
cyberspace is in space with millions of people using cyberspace everyday
10
AUACSCSinksAY08
The military uses space assets for intelligence surveillance and reconnaissance
knowledge management and command and control Agencies like the National Reconnaissance
Office and National Geospatial-Intelligence Agency obtain high-altitude imagery using a variety
of capabilities to include heat signature resonation Satellites can detect missile launches which
provide vital military information to senior leaders tasked with the security of their nation The
military networks to include decision briefs tasks and emails in Iraq and the Predator feeds in
Afghanistan travel through military and commercial satellites with all the information flowing
through the cyberspace domain With the heavy reliance of cyberspace to operate space assets
and the demands of information flowing through space by businesses it should come as no
surprise that space is a vital component for day-to-day operations of the military
Since cyberspace is an inherent component for space operations it is logical to assume
international law for outer space is applicable to cyberspace as long as an aggressor doesnt
violate the four premises and as long as weapons of mass destruction arenrsquot ldquostationed in outer
spacerdquo 28 Therefore a state would consider a cyber attack against a satellite as other than for
peaceful purposes and according to the fourth premise international law would apply
However what about a cyber attack using satellites as a means of conducting operations
Under todayrsquos current operations international elites havenrsquot considered a cyber attack passing
through space as a violation of international law When a senior leader in Qatar approves a
target set that is executed by a pilot in Nevada by an aircraft in Afghanistan all this information
is transmitted by cyberspace through space The result is that an aircraft renders an air or ground
target inoperable The effect is the same for cyberspace The information flows through space
by way of the cyberspace domain and the result is that an operator has rendered a target
11
AUACSCSinksAY08
inoperable As with airspace the information isnrsquot the cause of the damage but what an operator
does with the information is what constitutes the cyber attack
Land Cyber attacks using resources over land is relatively straightforward International
boundaries are defined as ldquoimaginary lines which separate territorial sovereigntyrdquo 29 which are
mutually agreed upon via international treaties Crossing an international border without
permission from the state is a violation of international law While an illegal immigrant crossing
a border to seek an opportunity to provide for his family is a violation of national law the United
Nation considers a nation-sponsored invasion of another nation that threatens the security and
stability of a nation as a breach in international law and an act of war
However international law doesnrsquot consider all border crossings as an act of war For
example when Nicaraguan troops and arms allegedly crossed the borders of El Salvador the
United Nations determined that incursions didnrsquot threaten El Salvadorrsquos territorial integrity and
stated that neither ldquothese incursions nor the alleged supply of arms may be relied upon as
justifying the exercise of the right of collective self-defenserdquo30 The victim state can repelled the
aggressive act but the United Nations Council wouldnrsquot condone any further military action
taken against the adversary opting for diplomatic or economic solution instead
Does international law apply when an adversary crosses international borders using
cyberspace as the means for conducting warfare operations When an adversarial state crosses a
statersquos boundaries using roads or bridges that connect the two nations the road is the resource
spanning the two nations If the adversary doesnrsquot do anything then returns to their sovereign
borders the aggressor hasnrsquot violated international law However when the adversary uses
weapon systems to affect serious damage the adversary has broken international law and a
12
AUACSCSinksAY08
nation may invoke their right for self-defense and may conduct full-scale operations to neutralize
the threat
A parallel notion is when an adversary uses a copper or fiber optic connection that spans
between two nations The adversary uses the land-based LAN connection as a means for
conducting cyber warfare operations The adversary may cross the borders using cyberspace yet
do nothing The affected state may push the adversary back to its borders but no further actions
are deemed appropriate However once the adversary uses the information transmitted over
cyberspace to cause severe operational or strategic damage the affected state now has the right
of self-defense Cyberspace is the means like the road or bridge for which the adversary
delivered the weapon The affected nation will consider the execution of the adversaryrsquos
information packet or weapon system as an act of aggression and the effect caused by the
weapon is what breeches international law
The difference between these two scenarios is that the adversary using the
electromagnetic spectrum hasnrsquot physically invaded a nationrsquos sovereign borders However
their digital presence crossed sovereign borders and as latter discussed in the paper adversaries
committing an act aggression against a state are now under the jurisdiction of the affected state
Sea ldquoThe territorial sea is a belt of sea adjacent to the (statersquos) coasthellipto include the airspace
aboverdquo as well as the seabed and subsoil31 The territorial sea is subject to the right of innocent
passage by foreign shops giving states the right to transport goods and passengers between ports
All of which is subject to the full sovereignty of the state which according to the United Nations
Convention on the Law of the Sea in 1982 and agreed upon by the majority of its membership in
1982 extends 12 miles from the coast32 The jurisdiction includes crimes where the
consequences extend to the coastal state and disturbs the peace of the country33 A cyber attack
13
AUACSCSinksAY08
conducted within the territorial sea of a nation would be no different from a cyber attack
conducted from within the nationrsquos land borders therefore cyber attacks against a state or even
another state conducted within the territorial seas are subject to current international laws Cyber
attacks originating outside the statersquos sovereign borders but results in affecting a statersquos
resources in their territorial seas would fall under the land and airspace breeches of territorial
sovereignty and would be subject to international law
The high seas on the other hand arenrsquot subject to the sovereignty of any one state The
high seas extend beyond the territorial sea and include the airspace the seabed and the subsoil34
and all states have the right to exercise freedoms on the high seas35 As similarly defined in
space ldquothe high seas shall be reserved for peaceful purposesrdquo as stated by Article 88 of the Law
of the Seas Cooperative36 which is defined as refraining from any threat or use of force (outside
of wartime conflicts)
The very nature of a cyber attack in the high seas lends itself to be a violation of
international law as nations are restricted to conducting peaceful operations in the high seas
The question is whom has jurisdiction of crimes committed in the high seas By applying the
Protective Security Principle of Jurisdiction where an actor threatens a statersquo security and
introducing the United Nationrsquos definition on the Illegal Use of Force extends to the high seas
and for that matter space giving states the right for self-defense as defined by the United Nations
as ldquoan armed attackrdquo The sheer name of cyber attack doesnrsquot immediately lend itself to an
ldquoarmedrdquo cyber attack However the effects generated from a cyber attack can be equivalent to a
traditional conventional attack and the international law would permit a state to take appropriate
countermeasures while notifying the United Nations Security Council37
14
AUACSCSinksAY08
Applying International Law to Cyber Warfare Today we live in an Information Age where communication through cyberspace has forever changed and flattened out worldhellipOur adversaries seek to operate from behind technical legal and international screens as they execute their costly attacks38
~General James E Cartwright Commander United States Strategic Command
Jurisdiction
Understanding the territorial sovereignty principles of a nation is important in applying
cyberspace and cyber warfare to existing international laws While some of these principles and
international laws may not be relevant for the cyberspace domain due to the far-reaching
capability of cyber warfare the jurisdiction of a nation further defines its ability to respond to
aggressive acts by nations in the cyberspace domain There are three jurisdictional principles
that provide nations the right to pursue aggressors that threaten a nationrsquos independence the
Territorial Principle Nationality Principle and the Protective Security Principle
For actions originating within the state the jurisdiction clearly falls within the territorial
principle where a ldquostate has jurisdiction over all crimes committed in its territoryhellipto include
airspace international waters and territorial seasrdquo39 The territorial jurisdiction is subject to
exceptions when dealing with persons from foreign states as in the most popular example of
immunity given to foreign diplomats In this case ldquostates may exercise jurisdiction over its
citizenhellipeven if they are physically outside the statesrsquo territoryrdquo as Doctor Boczek defines as the
Nationality Principle Nations usually agree upon on these concessions states prior to the offense
being committed40
Doctor Boczek defines the Protective Security Principle as a ldquojurisdictional principle
whereby a state my assume jurisdiction over and punish foreign nationals for certain conduct
outside its territory which is directed against its security territorial integrity and political
independencerdquo41 Some states would argue that criticism of a state or government is applicable
15
AUACSCSinksAY08
in applying this principle of jurisdiction However this is too broad of an interpretation and
should be confined to acts that are more tangible in nature like falsification of a statesrsquo official
documents conspiracy to violate immigration of custom laws and illicit drug trafficking42
Would a cyber attack that is deemed to challenge a nationrsquos banking community or bring
down a power source be a direct attack against its security and political independence The
international community easily sees the attack of a power source with kinetic weapons as a
violation of a territorial boundary and a breech of international law The United States viewed
the attack on the Trade Towers as an act of war launching the Global War on Terrorism Would
the United States have viewed the same devastation as if the attack occurred through cyberspace
Would the attack have been less of an act of war if the aggressor remotely controlled domestic
airliners from a foreign country Probably not What happens if the cyber attack caused a fire in
the lower floors of the buildings preventing people from escaping While less dramatic than an
airbus flying into the middle of the towers and maybe more difficult to demonize the crime the
result is the samemdashinnocent people suffering as a result of an adversary trying to threaten a
nationrsquos security
What happens if the suspected cyber attack has violated a nationrsquos territorial boundary in
order to attack a neighboring country or an ally Going from point A to point B in cyberspace is
rarely a direct connection As with the global nature of cyberspace itrsquos conceivable that
adversaries cross several nationsrsquo boundaries to conduct cyber attack operations The question
generated is who has jurisdiction
If the actor committing the crime had used an airplane each nation could claim
jurisdiction as the adversary violated their territorial boundaries and violated international law
More often than not the first state would have acted immediately upon the aggressive act and
16
AUACSCSinksAY08
would have prevented aggressors from completing their task by either forcing the aircraft to land
or turnaround or an even more escalated response of firing upon the aircraft In the air land or
sea the ability for a nationrsquos military forces to respond in a timely manner gives way to the
deterrence factor of not crossing a statersquos boundaries without receiving permission for fear of
reprisal A clear example of this was when Turkey denied the United States the ability deploy
the 4th Infantry Division from its borders at the beginning of Operation Iraqi Freedom Violating
Turkeyrsquos borders without permission would have brought about great repercussions that would
have made Operation Iraqi Freedom even more difficult and could have resulted in an escalation
of the war outside the Iraqi borders43 Another example is when Spain and France denied the
Unites States the use of their airspace when F-111s based in the United Kingdom conducted air
operations in Libya in an effort to eliminate Muammar Khadafy44
However the speeds at which these breeches in territorial boundaries occur make it
difficult for a nation to claim jurisdiction especially when nothing occurred within their
territorial sovereignty The cyber attacks didnrsquot result in any damage to nation as the information
packets passed through their sovereign borders According to territorial boundary description
described by Doctor Boczek the international community doesnrsquot consider the crossing the
border in of itself an act of warmdashserious damage is a driving factor in determining conflict
escalation In addition according to the territorial jurisdiction principle the cyber attack didnrsquot
threaten a nationrsquos security territorial integrity and political independence If the cyber attack or
information originated from within a sovereign territory by a third party then the two nations
would have to work together to resolve the issue and mutual jurisdiction would probably apply
However if the cyber attack didnrsquot physically manifest itself from within their sovereign
territory or the adversary didnrsquot use the nation as a staging area to launch a further attack the
17
AUACSCSinksAY08
international law and the jurisdiction principles would dictate the affected nation would have
jurisdiction
Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security
territorial integrity and political independence Cyberspace utilizes the other domains as a means
of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence
Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of
territorial sovereignty the Protective Security Principle does provide nations the ability to
enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos
sovereignty when it conducts cyber warfare operations However some elites donrsquot consider
cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense
International law specifically article 2 of the United Nations Charters states that a
members shall refrain in their international relations from the threat or use of force against the
territorial integrity or political independence of any state or in any other manner inconsistent
with the purposes of the United Nations which is intended to prohibit all types of force except
those carried out under the aegis of the United Nations or as provided for by the Security
Council45 The only exception to the United Nations Charters as it relates to the Use of Force is
the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed
attack46
International elites have discussed the term ldquouse of forcerdquo in the past because of the
development of chemical and biological weapons and had to move from a kinetic impact based
definition to a results-oriented approach47 Chemical and biological weapons lacked the
characteristic of an explosion or physical force yet these weapons certainly are capable of
destroying life and property Doctor Leigh Armistead a former information warfare instructor at
18
AUACSCSinksAY08
the Joint Forces Staff College cautions that the use of computer network attacks by the military
ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary
that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great
Russia introduced a proposal to the United Nations that banned the use of information
operations Even though the United Nations didnrsquot adopt the law the concern of international
community is fully aware of the impact cyber attacks can have on a nation
The concern over cyber warfare capabilities is that it can generate both non-kinetic and
kinetic effects There has always been the traditional kinetic solution for cyber warfare where a
precision guidance munition destroys a critical information system node Most people assume
computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos
computer system from the safety of onersquos own command and control center but the physical
destruction of a computer system or network by kinetic means also qualifies as cyber warfare
However cyber warfare has also evolved to the point where aggressors can achieve a kinetic
effect without the use of a traditional kinetic weapon A cyber attack on an information system
can shut down a particular node of a power plant causing the system to become inoperative
Even if there wasnrsquot an explosion the attack serves the same purpose
The question raised is do cyber attacks constitute an armed attack Scholars do agree that
some cyber attacks fit comfortably within the United Nations Charter For example a strategic
level cyber attack causing widespread damage and significant casualties would trigger the statersquos
right of self-defense In addition a cyber attack that precluded a conventional attack or a series
of cyber attacks causing significant damage would give a state the right of self-defense49 Few
would dispute that a country has the right under international law to respond with military force
19
AUACSCSinksAY08
if a state destroyed or significantly damaged another nationrsquos economic system for example the
New York or London stock exchanges
However some confusion and state-defined interpretation comes into play when the
frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard
Law School argues that cyber attacks require an expansion of the definition on the ldquouse of
forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot
be prohibited by international law50 International scholars recommend ldquoclearer rules of what
kinds of information warfare actions constitute an armed attackrdquo which drives permissible
responses of self-defense51 For example a state-sponsored cyber attack causes damage to a
victimrsquos factory or power plant however the nation claims the incident is an isolated instance
and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under
the United Nations Charter and the United Nations would consider any response retaliation
which would violate international law52
Another example involves a nation conducting a series of small attacks causing minimal
damage and then ceases Even though the aggressor used force to conduct cyber warfare
operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under
the United Nations Charter This type of attack is analogues to a small band of troops crossing a
border without causing significant damage53 According to the United Nations Charter the
national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders
and respond to the use of force Repelling the small band of troops and reestablishing their
sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration
of war and allies would have to respect the United Nations decision and couldnrsquot intervene The
same is true for the cyber attack A state can employ defensive measure to isolate and defeat the
20
AUACSCSinksAY08
incursion over the electromagnetic spectrum However the United Nations would see further
offensive operations or invasive operations as retaliation Therefore a nation must take the
incident whether it is signs of conventional forces on the ground or traces of cyber warfare
incursions in the electromagnetic spectrum to the United Nations to seek restitution
In both of these situations the international law becomes the target for change not
whether cyber warfare is in violation of international law If the law were to change the
international community would then consider the above situations acts of war even if an
adversary used conventional forces As written today the result of an operation remains the
driving factor in determining if an adversary has violated international law The means by which
an adversary conducts military operations may affect how nations react to the situation but
whether an adversary conducts the operation by means of the air land sea space or cyberspace
doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian
Triggs a public international lawyer and member of the Attorney General International Legal
Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over
offences abroad having an intended and substantial effect within a state may be justifiedrdquo54
Therefore the international community must evaluate the effect of a criminal act rather than the
means in which the act was committed
Others claim that because the Internet takes advantages of legal norms where non-state
actors can ignore Western notions of law55 more international laws are needed for cyberspace
However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using
other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the
Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked
aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts
21
AUACSCSinksAY08
against a staterdquo in the cyberspace domain The anonymity of the Internet and their total
disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and
national laws already exist in most countries that prohibit the use of the Internet for terrorist
activities therefore additional international laws wouldnrsquot prevent or deter terrorist from
committing such acts of aggression
International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed
Conflict includes the Martens Clause which extends established custom and humanitarian
principles to new technologies and addresses the ever-changing nature of warfare The
international community designed The Martens Clause ldquoto prevent future unnecessary andor
disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges
crimes by invoking the laws of humanity and public conscience hence their effects and not its
methods
The basic legal premise behind Law of Armed Conflict is that attacks must be limited to
military objectives and collateral damage must be proportionate to military advantages and
forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary
suffering but military commanders and planners need to be aware of the results a particular
action will invoke Russian leadership believes a computer network attack against their
homeland can be a means for executing a variety of escalating responses to include nuclear
attack58 Therefore it is imperative military commanders understand the impact any weapon
system can have on an adversary not just cyber attacks
Not all scholars agree that international law is insufficient to govern cyber warfare
Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace
and the Use of Force states that computer network attacks constitute an unlawful use of force in
22
AUACSCSinksAY08
cyberspace under traditional international law Sharp declared that an armed attack may occur
ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a
way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive
definition of cyber attacks may never be drafted59 The Congressional Research Service also
concluded that ldquothere is little likelihood that the international community will soon generate a
coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations
on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos
conclusion is that the effects of cyber warfare operations are the same as if an adversary
conducted conventional warfare operations where the effect of the attacks are the driving factors
in determining whether an adversary used force or not
The United States Government agrees with Sharprsquos conclusion The offensive
Information Operation strategy for the United States government as described by Doctor
Armistead ties the tools used to conduct military operations back to the desired effect which is
in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning
effects-based operations and operational art focus the Joint Force Commanderrsquos course of action
towards meeting objectives outlined in guidance provided by the National Command Authority
and senior military leadership62 Whether the tools are dropped pamphlets invasive network
attacks or bombs on targets the goal is to produce a desired effect to achieve the overall
objectives and cyber warfare can produce effects that challenge the national security of a nation
Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63
~General T Michael Moseley USAF
23
AUACSCSinksAY08
The cyberspace domain has been around for quite sometime but as technology continues
to advance businesses as well as governmental organizations are becoming more reliant on the
cyberspace domain With that reliance the protection of this critical domain becomes even more
important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the
electromagnetic spectrum by denying and disrupting information demands Scholars claim that
protection needs to include addressing existing international laws expanding them to incorporate
the ever-advancing capabilities emerging in the cyberspace domain
However territorial sovereignty of a nation and the principles of jurisdiction specifically
the Protective Security Principle give nations the right to exercise jurisdiction when an
aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64
While cyberspace is a domain requiring specific attention it relies on assets in the other domains
of land space sea and air in order to operate and international laws for the linear domains do
exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace
but during cyber warfare operations the principles behind the restrictions of foreign military
entering airspace do apply The strategic nature of cyber warfare operations correspond to the
same strategic impact that airpower can inflict upon a nation threatening their independence
While maybe not as dramatic as kinetic effects the results can be just as devastating
Space is relatively straightforward Since a nation canrsquot claim space and over flights of
foreign satellites over a nation is permissible nations must use space for peaceful purposes
Kinetic attacks against space assets are a violation of international law therefore nations would
consider cyber warfare operations against space assets as other than peaceful purposes and a
violation of international law Cyber attacks traversing space assets relate to current military
operations where the military uses space assets to conduct kinetic operations Since international
24
AUACSCSinksAY08
elites havenrsquot considered these kinetic operations as a breach of international law military
commanders can conduct cyber warfare operations through space without fear of violating
international laws for outer space
Crossing international borders without a nationrsquos permission and threatening their
sovereignty is a violation of international law While nations canrsquot consider all border crossings
as an act of war those acts of aggression that threaten the territorial integrity would elicit a
defensive response by the victim nation Whether incursions involve combat vehicles over a
highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are
threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not
have set foot in the nation but according the Protective Security Principle the victim nation has
jurisdiction
Conducting cyber warfare operations from the territorial sea is no different from
conducting operations from within a nationrsquos land or sea borders However the high seas are
very similar in nature to space in that they are reserved for peaceful purposes Therefore
conducting any means of warfare from within the high seas is a violation of international law
and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-
defense
According to Barkham ldquoinformation warfare attacks are in essence territorial
penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then
subject to the jurisdiction of the victim nation who then has the right for self-defense However
due to the global nature of cyberspace aggressors can cross multiple borders and determining
who has jurisdiction demands cooperation among nations The origin and any deliberate staging
locations of the cyber attack will drive who has jurisdiction The crossing of third party borders
25
AUACSCSinksAY08
by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the
aggressors threaten a nationrsquos independence or territorial integrity
Scholars consider cyber warfare operations that involve strategic and operational impacts
as being a means of using force and fall within the legal regime of existing international law
However scholars argue that because cyber warfare includes kinetic and non-kinetic results the
Use of Force definition needs expanding Yet they conclude that an exhaustive definition of
cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare
operations against existing case studies where the effects are evaluated as opposed to the means
even if the operations originated from outside the nationrsquos territorial jurisdiction There is some
authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to
have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade
non-state actors from conducting cyber warfare operations given their willingness to ignore
Western notions of war and their ability to conduct operations anonymously in cyberspace
International laws are in place to that address the ever-changing nature of warfare The
Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a
framework for addressing all warfare to include cyber warfare operations The international
community will need to measure the effects of an operation rather the means Whether its boots
on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a
nationrsquos response
26
AUACSCSinksAY08
End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)
27
AUACSCSinksAY08
44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
28
AUACSCSinksAY08
Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005
Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department
American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)
Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983
Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988
Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)
Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)
IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)
Joint Publication 3-13 Information Operations 13 February 2006
Joint Publication 5-0 Joint Operations Planning 26 December 2006
Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies
Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc
Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College
Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)
Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press
29
AUACSCSinksAY08
Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI
Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)
Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press
Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company
Detter Delupis I The law of war (2000) New York NY Cambridge University Press
Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)
Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College
Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor
Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)
Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)
Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf
Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)
Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College
Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College
Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)
Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA
30
AUACSCSinksAY08
Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)
Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)
Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College
Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology
Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College
Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)
OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center
OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College
OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications
Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991
Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College
Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center
Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)
31
AUACSCSinksAY08
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press
Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA
Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University
Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor
Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661
Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office
Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis
United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC
United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center
Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College
Wesley David C The Military Commander and the Law 2006
32
AUACSCSinksAY08
Joint doctrine defines cyber warfare as those areas of operations that affect the
electromagnetic spectrum to include Computer Network Operations and Electronic Warfare
which are two of the five core operational capabilities of Information Operations Electronic
warfare operations operates across ldquoradio visible micro directed energy and all other
frequenciesrdquo and overlaps with network warfare operations which include ldquoradio nets satellite
links tactical digital information links (TADIL) telemetry digital track files
telecommunications and wireless communication network and systemsrdquo all of which operate
within the electromagnetic spectrum17
Cyber warfare consists of defensive and offensive operations Defensive operations
arenrsquot limited to severing connections or blocking attempts of an adversary trying to corrupt data
modify transmissions or destroy information systems Defensive operations include the
elimination of the adversaryrsquos capability of conducting operations which may involve crossing
sovereign borders in order to complete the task However defensive network operations come in
more than just one form The movies portray computer experts hovering over computers trying
to affect each otherrsquos operations However cyber warfare includes the use of traditional kinetic
effect to disrupt computer network operations of the enemy as a fighter-bomber delivering a
500-pound bomb to destroy a vital mode in a computer network may serve the same purpose as a
computer-centric network attack While this isnrsquot as sexy as a network attack that spans the
globe to degrade the enemyrsquos ability operation within the cyberspace domain the effects are the
same
Territorial Sovereignty In total war it is quite impossible to draw any precise line between military and non-military problems18
~Sir Winston Churchill
6
AUACSCSinksAY08
Cyberspace is certainly a domain that requires unique attention in order for commanders
to effectively and efficiently prosecute combat operations Cyberspace spans the globe using
the physical infrastructure residing within the other linear domains As users pass information
from one site to another data crosses boundaries by means of the cyberspace domain Data
leaves the Iraq area of operation via satellite to a receiving site in Germany Operators route the
information to the United States either through another satellite or by ground to sea-based cables
bound for computer nodes within the United States before arriving in South Carolina where
automated network tools redirect the information to the receiverrsquos location
An adversary attempting to modify corrupt or destroy this information traveling within
the cyberspace domain would at one time or another would cross sovereign borders through air
land sea or space The adversaryrsquos physical presence may not apply as they could conduct
operations from the comforts of their home however a nation could detect the adversaryrsquos
digital presence and could feel the impact of their actions from within their sovereign borders
Therefore as these adversaries span the globe using the cyberspace domain that relies on the
other linear domains to exist does international law apply when boundaries are crossed The
following sections will address the international laws of each physical domain and evaluate how
their principles apply to the cyberspace domain
Airspace Airspace as defined by Doctor Boleslaw A Boczek the internationally renowned expert
on international law ldquois the air pillow above the subjacent territoryrdquo to include ldquoairspace above
international waters and the territorial seardquo The airspace is under complete and exclusive
sovereignty of the subject state19 With that states have jurisdiction over their airspace and
require identification of foreign aircraft along with their intentions According to Dr Boczek
book International Law A Dictionary ldquoentry of national spacehellipmay take place only with the
7
AUACSCSinksAY08
authorization of the territorial staterdquo20 and currently only applies to aircraft Entry into the
airspace would require ldquoall aircraft to identify themselves file flight plans and report their
positionrdquo According to the 1944 Chicago Convention on International Civil Aviation nations
can enter into agreements that allow scheduled international civil air services which usually
include reciprocal agreements covering routes volume and other matters relating to air traffic
However these agreements only apply to civil aviation where state aircraft which include
aircraft belonging to the military customs public services and heads of states must follow more
restrictive procedures upon entering the airspace of a foreign nation21
There are several incidents where states have evoked their right for defending their
national security like the shooting down of a US military reconnaissance aircraft over Soviet
airspace by the Soviet Union in 196022 or the shooting down by Soviet fighter planes of a South
Korean airliner in 198323 The Soviet Union isnrsquot the only nation to protect its airspace as the
United States was responsible for shooting down an Iranian airliner thought to be an attacking
military plane over the Persian Gulf in 198824 These examples illustrate a nationrsquos sovereign
resolve to protect itself when a suspected adversary violated their airspace
Applying international law of airspace to cyberspace doesnrsquot seem too practical Civilian
signals entering a nationrsquos airspace would require nations to enter into agreements to allow
scheduled services and the persons receiving information through airspace would have to be
non-state sponsored Nationrsquos could regulate some cyberspace networks entering airspace like
radio communications that primarily use land-based infrastructure to function However the
very nature of computer networks and the ever-increasing global reach of communication
capabilities severely restrict a nationrsquos ability to monitor the millions of transmissions made on a
daily basis and these signals certainly wouldnrsquot be on any scheduled basis Therefore even if
8
AUACSCSinksAY08
nations made agreements concerning the cyberspace domain nations would have a difficult time
enforcing their terms of agreements unless the terms are very open-ended If they were so open-
ended then the agreement may not be necessary and based on my research nations realize the
futility of establishing these agreements as this author couldnrsquot find any reference to any
agreements that nations have entered into referencing the cyberspace domain
While the international law for civilian aircraft in airspace may not relate well or isnrsquot
feasible to enforce in the cyberspace domain does a nation have that same right to protect itself
from a suspected attack from cyberspace where the attackerrsquos signal enters airspace Does a
nation have the right to ldquoshoot downrdquo a cyberspace attack as it enters their domain through
airspace The whole idea behind restricting airspace from foreign military aircraft is because of
the strategic impact military aircraft can have on a nation As demonstrated in World War II
military aircraft carrying weapons of mass destruction can decimate cities and destroy a nation
with minimal effort The effects generated by military aircraft are quite destructive and garner
specific attention While an aircraft in of itself is relatively harmless the actions taken by the
crew can lead to devastating results
The same is true for cyber attacks The information passing through airspace in the
cyberspace domain is the vehicle however the crew conducting the operation is potentially
creating the same strategic results The cyber attack may not destroy cities but it certainly can
be destructive to a nationrsquos well-being by crippling power sources economic industries water
supply etc all at the blink of an eye while the victim takes several days to determine the
perpetrator Therefore while the international law for airspace may not be specifically relevant
the underlying principles are applicable as cyber attacks can have the same potential strategic
impact as an attack from a military aircraft
9
AUACSCSinksAY08
Space Outer space as defined by Doctor Boczek ldquois the space beyond the air surrounding the
earthrdquo As of 2005 international law doesnrsquot define a demarcation between airspace and outer
space but ldquostates agree that state sovereignty doesnrsquot extend without any limitsrdquo25 Proposals of
where airspace ends and when outer space begins are base on various scientific and technological
criteria (gravitational pull capabilities of air breathing aircraft etc26) Others scientists argue
that defining a boundary between airspace and outer space isnrsquot necessary as it would hinder the
progress of space technology and the legal status would depend on the nature of the activity
While no boundary exists airspace is finite and activity in outer space follows four
fundamentals principles First over flights of foreign satellites over a nation is permissible as
airspace doesnrsquot extend forever Second space ldquointernational law applies to outer space and
celestial bodiesrdquo Third according to the Outer Space Treaty of 1967 states canrsquot claim celestial
bodies or outer space which are not subject to national appropriation therefore are free for use
by all states Finally states must use outer space exclusively for peaceful purposes with specific
bans on weapons of mass destruction However states can use space for other military purposes
like intelligence surveillance and reconnaissance activities 27
Are these international laws and principles applicable to cyberspace Satellites are
certainly an integral part of the space domain Operators control satellites by using the
cyberspace domain and information passes between satellites and ground stations One can
argue that space is a sub-set of the cyberspace domain with satellites serving as computers in
space Global positioning system devices in vehicles interact with satellites all through an
elaborate network as part of the electromagnetic spectrum known as cyberspace Therefore
cyberspace is in space with millions of people using cyberspace everyday
10
AUACSCSinksAY08
The military uses space assets for intelligence surveillance and reconnaissance
knowledge management and command and control Agencies like the National Reconnaissance
Office and National Geospatial-Intelligence Agency obtain high-altitude imagery using a variety
of capabilities to include heat signature resonation Satellites can detect missile launches which
provide vital military information to senior leaders tasked with the security of their nation The
military networks to include decision briefs tasks and emails in Iraq and the Predator feeds in
Afghanistan travel through military and commercial satellites with all the information flowing
through the cyberspace domain With the heavy reliance of cyberspace to operate space assets
and the demands of information flowing through space by businesses it should come as no
surprise that space is a vital component for day-to-day operations of the military
Since cyberspace is an inherent component for space operations it is logical to assume
international law for outer space is applicable to cyberspace as long as an aggressor doesnt
violate the four premises and as long as weapons of mass destruction arenrsquot ldquostationed in outer
spacerdquo 28 Therefore a state would consider a cyber attack against a satellite as other than for
peaceful purposes and according to the fourth premise international law would apply
However what about a cyber attack using satellites as a means of conducting operations
Under todayrsquos current operations international elites havenrsquot considered a cyber attack passing
through space as a violation of international law When a senior leader in Qatar approves a
target set that is executed by a pilot in Nevada by an aircraft in Afghanistan all this information
is transmitted by cyberspace through space The result is that an aircraft renders an air or ground
target inoperable The effect is the same for cyberspace The information flows through space
by way of the cyberspace domain and the result is that an operator has rendered a target
11
AUACSCSinksAY08
inoperable As with airspace the information isnrsquot the cause of the damage but what an operator
does with the information is what constitutes the cyber attack
Land Cyber attacks using resources over land is relatively straightforward International
boundaries are defined as ldquoimaginary lines which separate territorial sovereigntyrdquo 29 which are
mutually agreed upon via international treaties Crossing an international border without
permission from the state is a violation of international law While an illegal immigrant crossing
a border to seek an opportunity to provide for his family is a violation of national law the United
Nation considers a nation-sponsored invasion of another nation that threatens the security and
stability of a nation as a breach in international law and an act of war
However international law doesnrsquot consider all border crossings as an act of war For
example when Nicaraguan troops and arms allegedly crossed the borders of El Salvador the
United Nations determined that incursions didnrsquot threaten El Salvadorrsquos territorial integrity and
stated that neither ldquothese incursions nor the alleged supply of arms may be relied upon as
justifying the exercise of the right of collective self-defenserdquo30 The victim state can repelled the
aggressive act but the United Nations Council wouldnrsquot condone any further military action
taken against the adversary opting for diplomatic or economic solution instead
Does international law apply when an adversary crosses international borders using
cyberspace as the means for conducting warfare operations When an adversarial state crosses a
statersquos boundaries using roads or bridges that connect the two nations the road is the resource
spanning the two nations If the adversary doesnrsquot do anything then returns to their sovereign
borders the aggressor hasnrsquot violated international law However when the adversary uses
weapon systems to affect serious damage the adversary has broken international law and a
12
AUACSCSinksAY08
nation may invoke their right for self-defense and may conduct full-scale operations to neutralize
the threat
A parallel notion is when an adversary uses a copper or fiber optic connection that spans
between two nations The adversary uses the land-based LAN connection as a means for
conducting cyber warfare operations The adversary may cross the borders using cyberspace yet
do nothing The affected state may push the adversary back to its borders but no further actions
are deemed appropriate However once the adversary uses the information transmitted over
cyberspace to cause severe operational or strategic damage the affected state now has the right
of self-defense Cyberspace is the means like the road or bridge for which the adversary
delivered the weapon The affected nation will consider the execution of the adversaryrsquos
information packet or weapon system as an act of aggression and the effect caused by the
weapon is what breeches international law
The difference between these two scenarios is that the adversary using the
electromagnetic spectrum hasnrsquot physically invaded a nationrsquos sovereign borders However
their digital presence crossed sovereign borders and as latter discussed in the paper adversaries
committing an act aggression against a state are now under the jurisdiction of the affected state
Sea ldquoThe territorial sea is a belt of sea adjacent to the (statersquos) coasthellipto include the airspace
aboverdquo as well as the seabed and subsoil31 The territorial sea is subject to the right of innocent
passage by foreign shops giving states the right to transport goods and passengers between ports
All of which is subject to the full sovereignty of the state which according to the United Nations
Convention on the Law of the Sea in 1982 and agreed upon by the majority of its membership in
1982 extends 12 miles from the coast32 The jurisdiction includes crimes where the
consequences extend to the coastal state and disturbs the peace of the country33 A cyber attack
13
AUACSCSinksAY08
conducted within the territorial sea of a nation would be no different from a cyber attack
conducted from within the nationrsquos land borders therefore cyber attacks against a state or even
another state conducted within the territorial seas are subject to current international laws Cyber
attacks originating outside the statersquos sovereign borders but results in affecting a statersquos
resources in their territorial seas would fall under the land and airspace breeches of territorial
sovereignty and would be subject to international law
The high seas on the other hand arenrsquot subject to the sovereignty of any one state The
high seas extend beyond the territorial sea and include the airspace the seabed and the subsoil34
and all states have the right to exercise freedoms on the high seas35 As similarly defined in
space ldquothe high seas shall be reserved for peaceful purposesrdquo as stated by Article 88 of the Law
of the Seas Cooperative36 which is defined as refraining from any threat or use of force (outside
of wartime conflicts)
The very nature of a cyber attack in the high seas lends itself to be a violation of
international law as nations are restricted to conducting peaceful operations in the high seas
The question is whom has jurisdiction of crimes committed in the high seas By applying the
Protective Security Principle of Jurisdiction where an actor threatens a statersquo security and
introducing the United Nationrsquos definition on the Illegal Use of Force extends to the high seas
and for that matter space giving states the right for self-defense as defined by the United Nations
as ldquoan armed attackrdquo The sheer name of cyber attack doesnrsquot immediately lend itself to an
ldquoarmedrdquo cyber attack However the effects generated from a cyber attack can be equivalent to a
traditional conventional attack and the international law would permit a state to take appropriate
countermeasures while notifying the United Nations Security Council37
14
AUACSCSinksAY08
Applying International Law to Cyber Warfare Today we live in an Information Age where communication through cyberspace has forever changed and flattened out worldhellipOur adversaries seek to operate from behind technical legal and international screens as they execute their costly attacks38
~General James E Cartwright Commander United States Strategic Command
Jurisdiction
Understanding the territorial sovereignty principles of a nation is important in applying
cyberspace and cyber warfare to existing international laws While some of these principles and
international laws may not be relevant for the cyberspace domain due to the far-reaching
capability of cyber warfare the jurisdiction of a nation further defines its ability to respond to
aggressive acts by nations in the cyberspace domain There are three jurisdictional principles
that provide nations the right to pursue aggressors that threaten a nationrsquos independence the
Territorial Principle Nationality Principle and the Protective Security Principle
For actions originating within the state the jurisdiction clearly falls within the territorial
principle where a ldquostate has jurisdiction over all crimes committed in its territoryhellipto include
airspace international waters and territorial seasrdquo39 The territorial jurisdiction is subject to
exceptions when dealing with persons from foreign states as in the most popular example of
immunity given to foreign diplomats In this case ldquostates may exercise jurisdiction over its
citizenhellipeven if they are physically outside the statesrsquo territoryrdquo as Doctor Boczek defines as the
Nationality Principle Nations usually agree upon on these concessions states prior to the offense
being committed40
Doctor Boczek defines the Protective Security Principle as a ldquojurisdictional principle
whereby a state my assume jurisdiction over and punish foreign nationals for certain conduct
outside its territory which is directed against its security territorial integrity and political
independencerdquo41 Some states would argue that criticism of a state or government is applicable
15
AUACSCSinksAY08
in applying this principle of jurisdiction However this is too broad of an interpretation and
should be confined to acts that are more tangible in nature like falsification of a statesrsquo official
documents conspiracy to violate immigration of custom laws and illicit drug trafficking42
Would a cyber attack that is deemed to challenge a nationrsquos banking community or bring
down a power source be a direct attack against its security and political independence The
international community easily sees the attack of a power source with kinetic weapons as a
violation of a territorial boundary and a breech of international law The United States viewed
the attack on the Trade Towers as an act of war launching the Global War on Terrorism Would
the United States have viewed the same devastation as if the attack occurred through cyberspace
Would the attack have been less of an act of war if the aggressor remotely controlled domestic
airliners from a foreign country Probably not What happens if the cyber attack caused a fire in
the lower floors of the buildings preventing people from escaping While less dramatic than an
airbus flying into the middle of the towers and maybe more difficult to demonize the crime the
result is the samemdashinnocent people suffering as a result of an adversary trying to threaten a
nationrsquos security
What happens if the suspected cyber attack has violated a nationrsquos territorial boundary in
order to attack a neighboring country or an ally Going from point A to point B in cyberspace is
rarely a direct connection As with the global nature of cyberspace itrsquos conceivable that
adversaries cross several nationsrsquo boundaries to conduct cyber attack operations The question
generated is who has jurisdiction
If the actor committing the crime had used an airplane each nation could claim
jurisdiction as the adversary violated their territorial boundaries and violated international law
More often than not the first state would have acted immediately upon the aggressive act and
16
AUACSCSinksAY08
would have prevented aggressors from completing their task by either forcing the aircraft to land
or turnaround or an even more escalated response of firing upon the aircraft In the air land or
sea the ability for a nationrsquos military forces to respond in a timely manner gives way to the
deterrence factor of not crossing a statersquos boundaries without receiving permission for fear of
reprisal A clear example of this was when Turkey denied the United States the ability deploy
the 4th Infantry Division from its borders at the beginning of Operation Iraqi Freedom Violating
Turkeyrsquos borders without permission would have brought about great repercussions that would
have made Operation Iraqi Freedom even more difficult and could have resulted in an escalation
of the war outside the Iraqi borders43 Another example is when Spain and France denied the
Unites States the use of their airspace when F-111s based in the United Kingdom conducted air
operations in Libya in an effort to eliminate Muammar Khadafy44
However the speeds at which these breeches in territorial boundaries occur make it
difficult for a nation to claim jurisdiction especially when nothing occurred within their
territorial sovereignty The cyber attacks didnrsquot result in any damage to nation as the information
packets passed through their sovereign borders According to territorial boundary description
described by Doctor Boczek the international community doesnrsquot consider the crossing the
border in of itself an act of warmdashserious damage is a driving factor in determining conflict
escalation In addition according to the territorial jurisdiction principle the cyber attack didnrsquot
threaten a nationrsquos security territorial integrity and political independence If the cyber attack or
information originated from within a sovereign territory by a third party then the two nations
would have to work together to resolve the issue and mutual jurisdiction would probably apply
However if the cyber attack didnrsquot physically manifest itself from within their sovereign
territory or the adversary didnrsquot use the nation as a staging area to launch a further attack the
17
AUACSCSinksAY08
international law and the jurisdiction principles would dictate the affected nation would have
jurisdiction
Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security
territorial integrity and political independence Cyberspace utilizes the other domains as a means
of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence
Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of
territorial sovereignty the Protective Security Principle does provide nations the ability to
enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos
sovereignty when it conducts cyber warfare operations However some elites donrsquot consider
cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense
International law specifically article 2 of the United Nations Charters states that a
members shall refrain in their international relations from the threat or use of force against the
territorial integrity or political independence of any state or in any other manner inconsistent
with the purposes of the United Nations which is intended to prohibit all types of force except
those carried out under the aegis of the United Nations or as provided for by the Security
Council45 The only exception to the United Nations Charters as it relates to the Use of Force is
the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed
attack46
International elites have discussed the term ldquouse of forcerdquo in the past because of the
development of chemical and biological weapons and had to move from a kinetic impact based
definition to a results-oriented approach47 Chemical and biological weapons lacked the
characteristic of an explosion or physical force yet these weapons certainly are capable of
destroying life and property Doctor Leigh Armistead a former information warfare instructor at
18
AUACSCSinksAY08
the Joint Forces Staff College cautions that the use of computer network attacks by the military
ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary
that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great
Russia introduced a proposal to the United Nations that banned the use of information
operations Even though the United Nations didnrsquot adopt the law the concern of international
community is fully aware of the impact cyber attacks can have on a nation
The concern over cyber warfare capabilities is that it can generate both non-kinetic and
kinetic effects There has always been the traditional kinetic solution for cyber warfare where a
precision guidance munition destroys a critical information system node Most people assume
computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos
computer system from the safety of onersquos own command and control center but the physical
destruction of a computer system or network by kinetic means also qualifies as cyber warfare
However cyber warfare has also evolved to the point where aggressors can achieve a kinetic
effect without the use of a traditional kinetic weapon A cyber attack on an information system
can shut down a particular node of a power plant causing the system to become inoperative
Even if there wasnrsquot an explosion the attack serves the same purpose
The question raised is do cyber attacks constitute an armed attack Scholars do agree that
some cyber attacks fit comfortably within the United Nations Charter For example a strategic
level cyber attack causing widespread damage and significant casualties would trigger the statersquos
right of self-defense In addition a cyber attack that precluded a conventional attack or a series
of cyber attacks causing significant damage would give a state the right of self-defense49 Few
would dispute that a country has the right under international law to respond with military force
19
AUACSCSinksAY08
if a state destroyed or significantly damaged another nationrsquos economic system for example the
New York or London stock exchanges
However some confusion and state-defined interpretation comes into play when the
frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard
Law School argues that cyber attacks require an expansion of the definition on the ldquouse of
forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot
be prohibited by international law50 International scholars recommend ldquoclearer rules of what
kinds of information warfare actions constitute an armed attackrdquo which drives permissible
responses of self-defense51 For example a state-sponsored cyber attack causes damage to a
victimrsquos factory or power plant however the nation claims the incident is an isolated instance
and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under
the United Nations Charter and the United Nations would consider any response retaliation
which would violate international law52
Another example involves a nation conducting a series of small attacks causing minimal
damage and then ceases Even though the aggressor used force to conduct cyber warfare
operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under
the United Nations Charter This type of attack is analogues to a small band of troops crossing a
border without causing significant damage53 According to the United Nations Charter the
national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders
and respond to the use of force Repelling the small band of troops and reestablishing their
sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration
of war and allies would have to respect the United Nations decision and couldnrsquot intervene The
same is true for the cyber attack A state can employ defensive measure to isolate and defeat the
20
AUACSCSinksAY08
incursion over the electromagnetic spectrum However the United Nations would see further
offensive operations or invasive operations as retaliation Therefore a nation must take the
incident whether it is signs of conventional forces on the ground or traces of cyber warfare
incursions in the electromagnetic spectrum to the United Nations to seek restitution
In both of these situations the international law becomes the target for change not
whether cyber warfare is in violation of international law If the law were to change the
international community would then consider the above situations acts of war even if an
adversary used conventional forces As written today the result of an operation remains the
driving factor in determining if an adversary has violated international law The means by which
an adversary conducts military operations may affect how nations react to the situation but
whether an adversary conducts the operation by means of the air land sea space or cyberspace
doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian
Triggs a public international lawyer and member of the Attorney General International Legal
Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over
offences abroad having an intended and substantial effect within a state may be justifiedrdquo54
Therefore the international community must evaluate the effect of a criminal act rather than the
means in which the act was committed
Others claim that because the Internet takes advantages of legal norms where non-state
actors can ignore Western notions of law55 more international laws are needed for cyberspace
However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using
other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the
Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked
aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts
21
AUACSCSinksAY08
against a staterdquo in the cyberspace domain The anonymity of the Internet and their total
disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and
national laws already exist in most countries that prohibit the use of the Internet for terrorist
activities therefore additional international laws wouldnrsquot prevent or deter terrorist from
committing such acts of aggression
International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed
Conflict includes the Martens Clause which extends established custom and humanitarian
principles to new technologies and addresses the ever-changing nature of warfare The
international community designed The Martens Clause ldquoto prevent future unnecessary andor
disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges
crimes by invoking the laws of humanity and public conscience hence their effects and not its
methods
The basic legal premise behind Law of Armed Conflict is that attacks must be limited to
military objectives and collateral damage must be proportionate to military advantages and
forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary
suffering but military commanders and planners need to be aware of the results a particular
action will invoke Russian leadership believes a computer network attack against their
homeland can be a means for executing a variety of escalating responses to include nuclear
attack58 Therefore it is imperative military commanders understand the impact any weapon
system can have on an adversary not just cyber attacks
Not all scholars agree that international law is insufficient to govern cyber warfare
Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace
and the Use of Force states that computer network attacks constitute an unlawful use of force in
22
AUACSCSinksAY08
cyberspace under traditional international law Sharp declared that an armed attack may occur
ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a
way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive
definition of cyber attacks may never be drafted59 The Congressional Research Service also
concluded that ldquothere is little likelihood that the international community will soon generate a
coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations
on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos
conclusion is that the effects of cyber warfare operations are the same as if an adversary
conducted conventional warfare operations where the effect of the attacks are the driving factors
in determining whether an adversary used force or not
The United States Government agrees with Sharprsquos conclusion The offensive
Information Operation strategy for the United States government as described by Doctor
Armistead ties the tools used to conduct military operations back to the desired effect which is
in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning
effects-based operations and operational art focus the Joint Force Commanderrsquos course of action
towards meeting objectives outlined in guidance provided by the National Command Authority
and senior military leadership62 Whether the tools are dropped pamphlets invasive network
attacks or bombs on targets the goal is to produce a desired effect to achieve the overall
objectives and cyber warfare can produce effects that challenge the national security of a nation
Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63
~General T Michael Moseley USAF
23
AUACSCSinksAY08
The cyberspace domain has been around for quite sometime but as technology continues
to advance businesses as well as governmental organizations are becoming more reliant on the
cyberspace domain With that reliance the protection of this critical domain becomes even more
important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the
electromagnetic spectrum by denying and disrupting information demands Scholars claim that
protection needs to include addressing existing international laws expanding them to incorporate
the ever-advancing capabilities emerging in the cyberspace domain
However territorial sovereignty of a nation and the principles of jurisdiction specifically
the Protective Security Principle give nations the right to exercise jurisdiction when an
aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64
While cyberspace is a domain requiring specific attention it relies on assets in the other domains
of land space sea and air in order to operate and international laws for the linear domains do
exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace
but during cyber warfare operations the principles behind the restrictions of foreign military
entering airspace do apply The strategic nature of cyber warfare operations correspond to the
same strategic impact that airpower can inflict upon a nation threatening their independence
While maybe not as dramatic as kinetic effects the results can be just as devastating
Space is relatively straightforward Since a nation canrsquot claim space and over flights of
foreign satellites over a nation is permissible nations must use space for peaceful purposes
Kinetic attacks against space assets are a violation of international law therefore nations would
consider cyber warfare operations against space assets as other than peaceful purposes and a
violation of international law Cyber attacks traversing space assets relate to current military
operations where the military uses space assets to conduct kinetic operations Since international
24
AUACSCSinksAY08
elites havenrsquot considered these kinetic operations as a breach of international law military
commanders can conduct cyber warfare operations through space without fear of violating
international laws for outer space
Crossing international borders without a nationrsquos permission and threatening their
sovereignty is a violation of international law While nations canrsquot consider all border crossings
as an act of war those acts of aggression that threaten the territorial integrity would elicit a
defensive response by the victim nation Whether incursions involve combat vehicles over a
highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are
threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not
have set foot in the nation but according the Protective Security Principle the victim nation has
jurisdiction
Conducting cyber warfare operations from the territorial sea is no different from
conducting operations from within a nationrsquos land or sea borders However the high seas are
very similar in nature to space in that they are reserved for peaceful purposes Therefore
conducting any means of warfare from within the high seas is a violation of international law
and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-
defense
According to Barkham ldquoinformation warfare attacks are in essence territorial
penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then
subject to the jurisdiction of the victim nation who then has the right for self-defense However
due to the global nature of cyberspace aggressors can cross multiple borders and determining
who has jurisdiction demands cooperation among nations The origin and any deliberate staging
locations of the cyber attack will drive who has jurisdiction The crossing of third party borders
25
AUACSCSinksAY08
by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the
aggressors threaten a nationrsquos independence or territorial integrity
Scholars consider cyber warfare operations that involve strategic and operational impacts
as being a means of using force and fall within the legal regime of existing international law
However scholars argue that because cyber warfare includes kinetic and non-kinetic results the
Use of Force definition needs expanding Yet they conclude that an exhaustive definition of
cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare
operations against existing case studies where the effects are evaluated as opposed to the means
even if the operations originated from outside the nationrsquos territorial jurisdiction There is some
authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to
have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade
non-state actors from conducting cyber warfare operations given their willingness to ignore
Western notions of war and their ability to conduct operations anonymously in cyberspace
International laws are in place to that address the ever-changing nature of warfare The
Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a
framework for addressing all warfare to include cyber warfare operations The international
community will need to measure the effects of an operation rather the means Whether its boots
on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a
nationrsquos response
26
AUACSCSinksAY08
End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)
27
AUACSCSinksAY08
44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
28
AUACSCSinksAY08
Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005
Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department
American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)
Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983
Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988
Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)
Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)
IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)
Joint Publication 3-13 Information Operations 13 February 2006
Joint Publication 5-0 Joint Operations Planning 26 December 2006
Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies
Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc
Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College
Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)
Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press
29
AUACSCSinksAY08
Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI
Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)
Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press
Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company
Detter Delupis I The law of war (2000) New York NY Cambridge University Press
Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)
Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College
Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor
Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)
Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)
Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf
Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)
Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College
Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College
Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)
Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA
30
AUACSCSinksAY08
Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)
Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)
Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College
Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology
Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College
Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)
OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center
OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College
OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications
Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991
Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College
Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center
Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)
31
AUACSCSinksAY08
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press
Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA
Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University
Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor
Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661
Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office
Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis
United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC
United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center
Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College
Wesley David C The Military Commander and the Law 2006
32
AUACSCSinksAY08
Cyberspace is certainly a domain that requires unique attention in order for commanders
to effectively and efficiently prosecute combat operations Cyberspace spans the globe using
the physical infrastructure residing within the other linear domains As users pass information
from one site to another data crosses boundaries by means of the cyberspace domain Data
leaves the Iraq area of operation via satellite to a receiving site in Germany Operators route the
information to the United States either through another satellite or by ground to sea-based cables
bound for computer nodes within the United States before arriving in South Carolina where
automated network tools redirect the information to the receiverrsquos location
An adversary attempting to modify corrupt or destroy this information traveling within
the cyberspace domain would at one time or another would cross sovereign borders through air
land sea or space The adversaryrsquos physical presence may not apply as they could conduct
operations from the comforts of their home however a nation could detect the adversaryrsquos
digital presence and could feel the impact of their actions from within their sovereign borders
Therefore as these adversaries span the globe using the cyberspace domain that relies on the
other linear domains to exist does international law apply when boundaries are crossed The
following sections will address the international laws of each physical domain and evaluate how
their principles apply to the cyberspace domain
Airspace Airspace as defined by Doctor Boleslaw A Boczek the internationally renowned expert
on international law ldquois the air pillow above the subjacent territoryrdquo to include ldquoairspace above
international waters and the territorial seardquo The airspace is under complete and exclusive
sovereignty of the subject state19 With that states have jurisdiction over their airspace and
require identification of foreign aircraft along with their intentions According to Dr Boczek
book International Law A Dictionary ldquoentry of national spacehellipmay take place only with the
7
AUACSCSinksAY08
authorization of the territorial staterdquo20 and currently only applies to aircraft Entry into the
airspace would require ldquoall aircraft to identify themselves file flight plans and report their
positionrdquo According to the 1944 Chicago Convention on International Civil Aviation nations
can enter into agreements that allow scheduled international civil air services which usually
include reciprocal agreements covering routes volume and other matters relating to air traffic
However these agreements only apply to civil aviation where state aircraft which include
aircraft belonging to the military customs public services and heads of states must follow more
restrictive procedures upon entering the airspace of a foreign nation21
There are several incidents where states have evoked their right for defending their
national security like the shooting down of a US military reconnaissance aircraft over Soviet
airspace by the Soviet Union in 196022 or the shooting down by Soviet fighter planes of a South
Korean airliner in 198323 The Soviet Union isnrsquot the only nation to protect its airspace as the
United States was responsible for shooting down an Iranian airliner thought to be an attacking
military plane over the Persian Gulf in 198824 These examples illustrate a nationrsquos sovereign
resolve to protect itself when a suspected adversary violated their airspace
Applying international law of airspace to cyberspace doesnrsquot seem too practical Civilian
signals entering a nationrsquos airspace would require nations to enter into agreements to allow
scheduled services and the persons receiving information through airspace would have to be
non-state sponsored Nationrsquos could regulate some cyberspace networks entering airspace like
radio communications that primarily use land-based infrastructure to function However the
very nature of computer networks and the ever-increasing global reach of communication
capabilities severely restrict a nationrsquos ability to monitor the millions of transmissions made on a
daily basis and these signals certainly wouldnrsquot be on any scheduled basis Therefore even if
8
AUACSCSinksAY08
nations made agreements concerning the cyberspace domain nations would have a difficult time
enforcing their terms of agreements unless the terms are very open-ended If they were so open-
ended then the agreement may not be necessary and based on my research nations realize the
futility of establishing these agreements as this author couldnrsquot find any reference to any
agreements that nations have entered into referencing the cyberspace domain
While the international law for civilian aircraft in airspace may not relate well or isnrsquot
feasible to enforce in the cyberspace domain does a nation have that same right to protect itself
from a suspected attack from cyberspace where the attackerrsquos signal enters airspace Does a
nation have the right to ldquoshoot downrdquo a cyberspace attack as it enters their domain through
airspace The whole idea behind restricting airspace from foreign military aircraft is because of
the strategic impact military aircraft can have on a nation As demonstrated in World War II
military aircraft carrying weapons of mass destruction can decimate cities and destroy a nation
with minimal effort The effects generated by military aircraft are quite destructive and garner
specific attention While an aircraft in of itself is relatively harmless the actions taken by the
crew can lead to devastating results
The same is true for cyber attacks The information passing through airspace in the
cyberspace domain is the vehicle however the crew conducting the operation is potentially
creating the same strategic results The cyber attack may not destroy cities but it certainly can
be destructive to a nationrsquos well-being by crippling power sources economic industries water
supply etc all at the blink of an eye while the victim takes several days to determine the
perpetrator Therefore while the international law for airspace may not be specifically relevant
the underlying principles are applicable as cyber attacks can have the same potential strategic
impact as an attack from a military aircraft
9
AUACSCSinksAY08
Space Outer space as defined by Doctor Boczek ldquois the space beyond the air surrounding the
earthrdquo As of 2005 international law doesnrsquot define a demarcation between airspace and outer
space but ldquostates agree that state sovereignty doesnrsquot extend without any limitsrdquo25 Proposals of
where airspace ends and when outer space begins are base on various scientific and technological
criteria (gravitational pull capabilities of air breathing aircraft etc26) Others scientists argue
that defining a boundary between airspace and outer space isnrsquot necessary as it would hinder the
progress of space technology and the legal status would depend on the nature of the activity
While no boundary exists airspace is finite and activity in outer space follows four
fundamentals principles First over flights of foreign satellites over a nation is permissible as
airspace doesnrsquot extend forever Second space ldquointernational law applies to outer space and
celestial bodiesrdquo Third according to the Outer Space Treaty of 1967 states canrsquot claim celestial
bodies or outer space which are not subject to national appropriation therefore are free for use
by all states Finally states must use outer space exclusively for peaceful purposes with specific
bans on weapons of mass destruction However states can use space for other military purposes
like intelligence surveillance and reconnaissance activities 27
Are these international laws and principles applicable to cyberspace Satellites are
certainly an integral part of the space domain Operators control satellites by using the
cyberspace domain and information passes between satellites and ground stations One can
argue that space is a sub-set of the cyberspace domain with satellites serving as computers in
space Global positioning system devices in vehicles interact with satellites all through an
elaborate network as part of the electromagnetic spectrum known as cyberspace Therefore
cyberspace is in space with millions of people using cyberspace everyday
10
AUACSCSinksAY08
The military uses space assets for intelligence surveillance and reconnaissance
knowledge management and command and control Agencies like the National Reconnaissance
Office and National Geospatial-Intelligence Agency obtain high-altitude imagery using a variety
of capabilities to include heat signature resonation Satellites can detect missile launches which
provide vital military information to senior leaders tasked with the security of their nation The
military networks to include decision briefs tasks and emails in Iraq and the Predator feeds in
Afghanistan travel through military and commercial satellites with all the information flowing
through the cyberspace domain With the heavy reliance of cyberspace to operate space assets
and the demands of information flowing through space by businesses it should come as no
surprise that space is a vital component for day-to-day operations of the military
Since cyberspace is an inherent component for space operations it is logical to assume
international law for outer space is applicable to cyberspace as long as an aggressor doesnt
violate the four premises and as long as weapons of mass destruction arenrsquot ldquostationed in outer
spacerdquo 28 Therefore a state would consider a cyber attack against a satellite as other than for
peaceful purposes and according to the fourth premise international law would apply
However what about a cyber attack using satellites as a means of conducting operations
Under todayrsquos current operations international elites havenrsquot considered a cyber attack passing
through space as a violation of international law When a senior leader in Qatar approves a
target set that is executed by a pilot in Nevada by an aircraft in Afghanistan all this information
is transmitted by cyberspace through space The result is that an aircraft renders an air or ground
target inoperable The effect is the same for cyberspace The information flows through space
by way of the cyberspace domain and the result is that an operator has rendered a target
11
AUACSCSinksAY08
inoperable As with airspace the information isnrsquot the cause of the damage but what an operator
does with the information is what constitutes the cyber attack
Land Cyber attacks using resources over land is relatively straightforward International
boundaries are defined as ldquoimaginary lines which separate territorial sovereigntyrdquo 29 which are
mutually agreed upon via international treaties Crossing an international border without
permission from the state is a violation of international law While an illegal immigrant crossing
a border to seek an opportunity to provide for his family is a violation of national law the United
Nation considers a nation-sponsored invasion of another nation that threatens the security and
stability of a nation as a breach in international law and an act of war
However international law doesnrsquot consider all border crossings as an act of war For
example when Nicaraguan troops and arms allegedly crossed the borders of El Salvador the
United Nations determined that incursions didnrsquot threaten El Salvadorrsquos territorial integrity and
stated that neither ldquothese incursions nor the alleged supply of arms may be relied upon as
justifying the exercise of the right of collective self-defenserdquo30 The victim state can repelled the
aggressive act but the United Nations Council wouldnrsquot condone any further military action
taken against the adversary opting for diplomatic or economic solution instead
Does international law apply when an adversary crosses international borders using
cyberspace as the means for conducting warfare operations When an adversarial state crosses a
statersquos boundaries using roads or bridges that connect the two nations the road is the resource
spanning the two nations If the adversary doesnrsquot do anything then returns to their sovereign
borders the aggressor hasnrsquot violated international law However when the adversary uses
weapon systems to affect serious damage the adversary has broken international law and a
12
AUACSCSinksAY08
nation may invoke their right for self-defense and may conduct full-scale operations to neutralize
the threat
A parallel notion is when an adversary uses a copper or fiber optic connection that spans
between two nations The adversary uses the land-based LAN connection as a means for
conducting cyber warfare operations The adversary may cross the borders using cyberspace yet
do nothing The affected state may push the adversary back to its borders but no further actions
are deemed appropriate However once the adversary uses the information transmitted over
cyberspace to cause severe operational or strategic damage the affected state now has the right
of self-defense Cyberspace is the means like the road or bridge for which the adversary
delivered the weapon The affected nation will consider the execution of the adversaryrsquos
information packet or weapon system as an act of aggression and the effect caused by the
weapon is what breeches international law
The difference between these two scenarios is that the adversary using the
electromagnetic spectrum hasnrsquot physically invaded a nationrsquos sovereign borders However
their digital presence crossed sovereign borders and as latter discussed in the paper adversaries
committing an act aggression against a state are now under the jurisdiction of the affected state
Sea ldquoThe territorial sea is a belt of sea adjacent to the (statersquos) coasthellipto include the airspace
aboverdquo as well as the seabed and subsoil31 The territorial sea is subject to the right of innocent
passage by foreign shops giving states the right to transport goods and passengers between ports
All of which is subject to the full sovereignty of the state which according to the United Nations
Convention on the Law of the Sea in 1982 and agreed upon by the majority of its membership in
1982 extends 12 miles from the coast32 The jurisdiction includes crimes where the
consequences extend to the coastal state and disturbs the peace of the country33 A cyber attack
13
AUACSCSinksAY08
conducted within the territorial sea of a nation would be no different from a cyber attack
conducted from within the nationrsquos land borders therefore cyber attacks against a state or even
another state conducted within the territorial seas are subject to current international laws Cyber
attacks originating outside the statersquos sovereign borders but results in affecting a statersquos
resources in their territorial seas would fall under the land and airspace breeches of territorial
sovereignty and would be subject to international law
The high seas on the other hand arenrsquot subject to the sovereignty of any one state The
high seas extend beyond the territorial sea and include the airspace the seabed and the subsoil34
and all states have the right to exercise freedoms on the high seas35 As similarly defined in
space ldquothe high seas shall be reserved for peaceful purposesrdquo as stated by Article 88 of the Law
of the Seas Cooperative36 which is defined as refraining from any threat or use of force (outside
of wartime conflicts)
The very nature of a cyber attack in the high seas lends itself to be a violation of
international law as nations are restricted to conducting peaceful operations in the high seas
The question is whom has jurisdiction of crimes committed in the high seas By applying the
Protective Security Principle of Jurisdiction where an actor threatens a statersquo security and
introducing the United Nationrsquos definition on the Illegal Use of Force extends to the high seas
and for that matter space giving states the right for self-defense as defined by the United Nations
as ldquoan armed attackrdquo The sheer name of cyber attack doesnrsquot immediately lend itself to an
ldquoarmedrdquo cyber attack However the effects generated from a cyber attack can be equivalent to a
traditional conventional attack and the international law would permit a state to take appropriate
countermeasures while notifying the United Nations Security Council37
14
AUACSCSinksAY08
Applying International Law to Cyber Warfare Today we live in an Information Age where communication through cyberspace has forever changed and flattened out worldhellipOur adversaries seek to operate from behind technical legal and international screens as they execute their costly attacks38
~General James E Cartwright Commander United States Strategic Command
Jurisdiction
Understanding the territorial sovereignty principles of a nation is important in applying
cyberspace and cyber warfare to existing international laws While some of these principles and
international laws may not be relevant for the cyberspace domain due to the far-reaching
capability of cyber warfare the jurisdiction of a nation further defines its ability to respond to
aggressive acts by nations in the cyberspace domain There are three jurisdictional principles
that provide nations the right to pursue aggressors that threaten a nationrsquos independence the
Territorial Principle Nationality Principle and the Protective Security Principle
For actions originating within the state the jurisdiction clearly falls within the territorial
principle where a ldquostate has jurisdiction over all crimes committed in its territoryhellipto include
airspace international waters and territorial seasrdquo39 The territorial jurisdiction is subject to
exceptions when dealing with persons from foreign states as in the most popular example of
immunity given to foreign diplomats In this case ldquostates may exercise jurisdiction over its
citizenhellipeven if they are physically outside the statesrsquo territoryrdquo as Doctor Boczek defines as the
Nationality Principle Nations usually agree upon on these concessions states prior to the offense
being committed40
Doctor Boczek defines the Protective Security Principle as a ldquojurisdictional principle
whereby a state my assume jurisdiction over and punish foreign nationals for certain conduct
outside its territory which is directed against its security territorial integrity and political
independencerdquo41 Some states would argue that criticism of a state or government is applicable
15
AUACSCSinksAY08
in applying this principle of jurisdiction However this is too broad of an interpretation and
should be confined to acts that are more tangible in nature like falsification of a statesrsquo official
documents conspiracy to violate immigration of custom laws and illicit drug trafficking42
Would a cyber attack that is deemed to challenge a nationrsquos banking community or bring
down a power source be a direct attack against its security and political independence The
international community easily sees the attack of a power source with kinetic weapons as a
violation of a territorial boundary and a breech of international law The United States viewed
the attack on the Trade Towers as an act of war launching the Global War on Terrorism Would
the United States have viewed the same devastation as if the attack occurred through cyberspace
Would the attack have been less of an act of war if the aggressor remotely controlled domestic
airliners from a foreign country Probably not What happens if the cyber attack caused a fire in
the lower floors of the buildings preventing people from escaping While less dramatic than an
airbus flying into the middle of the towers and maybe more difficult to demonize the crime the
result is the samemdashinnocent people suffering as a result of an adversary trying to threaten a
nationrsquos security
What happens if the suspected cyber attack has violated a nationrsquos territorial boundary in
order to attack a neighboring country or an ally Going from point A to point B in cyberspace is
rarely a direct connection As with the global nature of cyberspace itrsquos conceivable that
adversaries cross several nationsrsquo boundaries to conduct cyber attack operations The question
generated is who has jurisdiction
If the actor committing the crime had used an airplane each nation could claim
jurisdiction as the adversary violated their territorial boundaries and violated international law
More often than not the first state would have acted immediately upon the aggressive act and
16
AUACSCSinksAY08
would have prevented aggressors from completing their task by either forcing the aircraft to land
or turnaround or an even more escalated response of firing upon the aircraft In the air land or
sea the ability for a nationrsquos military forces to respond in a timely manner gives way to the
deterrence factor of not crossing a statersquos boundaries without receiving permission for fear of
reprisal A clear example of this was when Turkey denied the United States the ability deploy
the 4th Infantry Division from its borders at the beginning of Operation Iraqi Freedom Violating
Turkeyrsquos borders without permission would have brought about great repercussions that would
have made Operation Iraqi Freedom even more difficult and could have resulted in an escalation
of the war outside the Iraqi borders43 Another example is when Spain and France denied the
Unites States the use of their airspace when F-111s based in the United Kingdom conducted air
operations in Libya in an effort to eliminate Muammar Khadafy44
However the speeds at which these breeches in territorial boundaries occur make it
difficult for a nation to claim jurisdiction especially when nothing occurred within their
territorial sovereignty The cyber attacks didnrsquot result in any damage to nation as the information
packets passed through their sovereign borders According to territorial boundary description
described by Doctor Boczek the international community doesnrsquot consider the crossing the
border in of itself an act of warmdashserious damage is a driving factor in determining conflict
escalation In addition according to the territorial jurisdiction principle the cyber attack didnrsquot
threaten a nationrsquos security territorial integrity and political independence If the cyber attack or
information originated from within a sovereign territory by a third party then the two nations
would have to work together to resolve the issue and mutual jurisdiction would probably apply
However if the cyber attack didnrsquot physically manifest itself from within their sovereign
territory or the adversary didnrsquot use the nation as a staging area to launch a further attack the
17
AUACSCSinksAY08
international law and the jurisdiction principles would dictate the affected nation would have
jurisdiction
Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security
territorial integrity and political independence Cyberspace utilizes the other domains as a means
of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence
Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of
territorial sovereignty the Protective Security Principle does provide nations the ability to
enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos
sovereignty when it conducts cyber warfare operations However some elites donrsquot consider
cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense
International law specifically article 2 of the United Nations Charters states that a
members shall refrain in their international relations from the threat or use of force against the
territorial integrity or political independence of any state or in any other manner inconsistent
with the purposes of the United Nations which is intended to prohibit all types of force except
those carried out under the aegis of the United Nations or as provided for by the Security
Council45 The only exception to the United Nations Charters as it relates to the Use of Force is
the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed
attack46
International elites have discussed the term ldquouse of forcerdquo in the past because of the
development of chemical and biological weapons and had to move from a kinetic impact based
definition to a results-oriented approach47 Chemical and biological weapons lacked the
characteristic of an explosion or physical force yet these weapons certainly are capable of
destroying life and property Doctor Leigh Armistead a former information warfare instructor at
18
AUACSCSinksAY08
the Joint Forces Staff College cautions that the use of computer network attacks by the military
ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary
that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great
Russia introduced a proposal to the United Nations that banned the use of information
operations Even though the United Nations didnrsquot adopt the law the concern of international
community is fully aware of the impact cyber attacks can have on a nation
The concern over cyber warfare capabilities is that it can generate both non-kinetic and
kinetic effects There has always been the traditional kinetic solution for cyber warfare where a
precision guidance munition destroys a critical information system node Most people assume
computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos
computer system from the safety of onersquos own command and control center but the physical
destruction of a computer system or network by kinetic means also qualifies as cyber warfare
However cyber warfare has also evolved to the point where aggressors can achieve a kinetic
effect without the use of a traditional kinetic weapon A cyber attack on an information system
can shut down a particular node of a power plant causing the system to become inoperative
Even if there wasnrsquot an explosion the attack serves the same purpose
The question raised is do cyber attacks constitute an armed attack Scholars do agree that
some cyber attacks fit comfortably within the United Nations Charter For example a strategic
level cyber attack causing widespread damage and significant casualties would trigger the statersquos
right of self-defense In addition a cyber attack that precluded a conventional attack or a series
of cyber attacks causing significant damage would give a state the right of self-defense49 Few
would dispute that a country has the right under international law to respond with military force
19
AUACSCSinksAY08
if a state destroyed or significantly damaged another nationrsquos economic system for example the
New York or London stock exchanges
However some confusion and state-defined interpretation comes into play when the
frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard
Law School argues that cyber attacks require an expansion of the definition on the ldquouse of
forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot
be prohibited by international law50 International scholars recommend ldquoclearer rules of what
kinds of information warfare actions constitute an armed attackrdquo which drives permissible
responses of self-defense51 For example a state-sponsored cyber attack causes damage to a
victimrsquos factory or power plant however the nation claims the incident is an isolated instance
and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under
the United Nations Charter and the United Nations would consider any response retaliation
which would violate international law52
Another example involves a nation conducting a series of small attacks causing minimal
damage and then ceases Even though the aggressor used force to conduct cyber warfare
operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under
the United Nations Charter This type of attack is analogues to a small band of troops crossing a
border without causing significant damage53 According to the United Nations Charter the
national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders
and respond to the use of force Repelling the small band of troops and reestablishing their
sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration
of war and allies would have to respect the United Nations decision and couldnrsquot intervene The
same is true for the cyber attack A state can employ defensive measure to isolate and defeat the
20
AUACSCSinksAY08
incursion over the electromagnetic spectrum However the United Nations would see further
offensive operations or invasive operations as retaliation Therefore a nation must take the
incident whether it is signs of conventional forces on the ground or traces of cyber warfare
incursions in the electromagnetic spectrum to the United Nations to seek restitution
In both of these situations the international law becomes the target for change not
whether cyber warfare is in violation of international law If the law were to change the
international community would then consider the above situations acts of war even if an
adversary used conventional forces As written today the result of an operation remains the
driving factor in determining if an adversary has violated international law The means by which
an adversary conducts military operations may affect how nations react to the situation but
whether an adversary conducts the operation by means of the air land sea space or cyberspace
doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian
Triggs a public international lawyer and member of the Attorney General International Legal
Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over
offences abroad having an intended and substantial effect within a state may be justifiedrdquo54
Therefore the international community must evaluate the effect of a criminal act rather than the
means in which the act was committed
Others claim that because the Internet takes advantages of legal norms where non-state
actors can ignore Western notions of law55 more international laws are needed for cyberspace
However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using
other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the
Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked
aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts
21
AUACSCSinksAY08
against a staterdquo in the cyberspace domain The anonymity of the Internet and their total
disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and
national laws already exist in most countries that prohibit the use of the Internet for terrorist
activities therefore additional international laws wouldnrsquot prevent or deter terrorist from
committing such acts of aggression
International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed
Conflict includes the Martens Clause which extends established custom and humanitarian
principles to new technologies and addresses the ever-changing nature of warfare The
international community designed The Martens Clause ldquoto prevent future unnecessary andor
disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges
crimes by invoking the laws of humanity and public conscience hence their effects and not its
methods
The basic legal premise behind Law of Armed Conflict is that attacks must be limited to
military objectives and collateral damage must be proportionate to military advantages and
forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary
suffering but military commanders and planners need to be aware of the results a particular
action will invoke Russian leadership believes a computer network attack against their
homeland can be a means for executing a variety of escalating responses to include nuclear
attack58 Therefore it is imperative military commanders understand the impact any weapon
system can have on an adversary not just cyber attacks
Not all scholars agree that international law is insufficient to govern cyber warfare
Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace
and the Use of Force states that computer network attacks constitute an unlawful use of force in
22
AUACSCSinksAY08
cyberspace under traditional international law Sharp declared that an armed attack may occur
ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a
way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive
definition of cyber attacks may never be drafted59 The Congressional Research Service also
concluded that ldquothere is little likelihood that the international community will soon generate a
coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations
on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos
conclusion is that the effects of cyber warfare operations are the same as if an adversary
conducted conventional warfare operations where the effect of the attacks are the driving factors
in determining whether an adversary used force or not
The United States Government agrees with Sharprsquos conclusion The offensive
Information Operation strategy for the United States government as described by Doctor
Armistead ties the tools used to conduct military operations back to the desired effect which is
in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning
effects-based operations and operational art focus the Joint Force Commanderrsquos course of action
towards meeting objectives outlined in guidance provided by the National Command Authority
and senior military leadership62 Whether the tools are dropped pamphlets invasive network
attacks or bombs on targets the goal is to produce a desired effect to achieve the overall
objectives and cyber warfare can produce effects that challenge the national security of a nation
Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63
~General T Michael Moseley USAF
23
AUACSCSinksAY08
The cyberspace domain has been around for quite sometime but as technology continues
to advance businesses as well as governmental organizations are becoming more reliant on the
cyberspace domain With that reliance the protection of this critical domain becomes even more
important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the
electromagnetic spectrum by denying and disrupting information demands Scholars claim that
protection needs to include addressing existing international laws expanding them to incorporate
the ever-advancing capabilities emerging in the cyberspace domain
However territorial sovereignty of a nation and the principles of jurisdiction specifically
the Protective Security Principle give nations the right to exercise jurisdiction when an
aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64
While cyberspace is a domain requiring specific attention it relies on assets in the other domains
of land space sea and air in order to operate and international laws for the linear domains do
exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace
but during cyber warfare operations the principles behind the restrictions of foreign military
entering airspace do apply The strategic nature of cyber warfare operations correspond to the
same strategic impact that airpower can inflict upon a nation threatening their independence
While maybe not as dramatic as kinetic effects the results can be just as devastating
Space is relatively straightforward Since a nation canrsquot claim space and over flights of
foreign satellites over a nation is permissible nations must use space for peaceful purposes
Kinetic attacks against space assets are a violation of international law therefore nations would
consider cyber warfare operations against space assets as other than peaceful purposes and a
violation of international law Cyber attacks traversing space assets relate to current military
operations where the military uses space assets to conduct kinetic operations Since international
24
AUACSCSinksAY08
elites havenrsquot considered these kinetic operations as a breach of international law military
commanders can conduct cyber warfare operations through space without fear of violating
international laws for outer space
Crossing international borders without a nationrsquos permission and threatening their
sovereignty is a violation of international law While nations canrsquot consider all border crossings
as an act of war those acts of aggression that threaten the territorial integrity would elicit a
defensive response by the victim nation Whether incursions involve combat vehicles over a
highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are
threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not
have set foot in the nation but according the Protective Security Principle the victim nation has
jurisdiction
Conducting cyber warfare operations from the territorial sea is no different from
conducting operations from within a nationrsquos land or sea borders However the high seas are
very similar in nature to space in that they are reserved for peaceful purposes Therefore
conducting any means of warfare from within the high seas is a violation of international law
and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-
defense
According to Barkham ldquoinformation warfare attacks are in essence territorial
penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then
subject to the jurisdiction of the victim nation who then has the right for self-defense However
due to the global nature of cyberspace aggressors can cross multiple borders and determining
who has jurisdiction demands cooperation among nations The origin and any deliberate staging
locations of the cyber attack will drive who has jurisdiction The crossing of third party borders
25
AUACSCSinksAY08
by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the
aggressors threaten a nationrsquos independence or territorial integrity
Scholars consider cyber warfare operations that involve strategic and operational impacts
as being a means of using force and fall within the legal regime of existing international law
However scholars argue that because cyber warfare includes kinetic and non-kinetic results the
Use of Force definition needs expanding Yet they conclude that an exhaustive definition of
cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare
operations against existing case studies where the effects are evaluated as opposed to the means
even if the operations originated from outside the nationrsquos territorial jurisdiction There is some
authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to
have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade
non-state actors from conducting cyber warfare operations given their willingness to ignore
Western notions of war and their ability to conduct operations anonymously in cyberspace
International laws are in place to that address the ever-changing nature of warfare The
Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a
framework for addressing all warfare to include cyber warfare operations The international
community will need to measure the effects of an operation rather the means Whether its boots
on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a
nationrsquos response
26
AUACSCSinksAY08
End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)
27
AUACSCSinksAY08
44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
28
AUACSCSinksAY08
Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005
Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department
American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)
Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983
Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988
Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)
Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)
IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)
Joint Publication 3-13 Information Operations 13 February 2006
Joint Publication 5-0 Joint Operations Planning 26 December 2006
Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies
Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc
Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College
Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)
Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press
29
AUACSCSinksAY08
Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI
Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)
Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press
Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company
Detter Delupis I The law of war (2000) New York NY Cambridge University Press
Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)
Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College
Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor
Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)
Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)
Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf
Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)
Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College
Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College
Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)
Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA
30
AUACSCSinksAY08
Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)
Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)
Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College
Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology
Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College
Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)
OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center
OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College
OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications
Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991
Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College
Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center
Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)
31
AUACSCSinksAY08
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press
Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA
Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University
Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor
Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661
Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office
Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis
United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC
United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center
Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College
Wesley David C The Military Commander and the Law 2006
32
AUACSCSinksAY08
authorization of the territorial staterdquo20 and currently only applies to aircraft Entry into the
airspace would require ldquoall aircraft to identify themselves file flight plans and report their
positionrdquo According to the 1944 Chicago Convention on International Civil Aviation nations
can enter into agreements that allow scheduled international civil air services which usually
include reciprocal agreements covering routes volume and other matters relating to air traffic
However these agreements only apply to civil aviation where state aircraft which include
aircraft belonging to the military customs public services and heads of states must follow more
restrictive procedures upon entering the airspace of a foreign nation21
There are several incidents where states have evoked their right for defending their
national security like the shooting down of a US military reconnaissance aircraft over Soviet
airspace by the Soviet Union in 196022 or the shooting down by Soviet fighter planes of a South
Korean airliner in 198323 The Soviet Union isnrsquot the only nation to protect its airspace as the
United States was responsible for shooting down an Iranian airliner thought to be an attacking
military plane over the Persian Gulf in 198824 These examples illustrate a nationrsquos sovereign
resolve to protect itself when a suspected adversary violated their airspace
Applying international law of airspace to cyberspace doesnrsquot seem too practical Civilian
signals entering a nationrsquos airspace would require nations to enter into agreements to allow
scheduled services and the persons receiving information through airspace would have to be
non-state sponsored Nationrsquos could regulate some cyberspace networks entering airspace like
radio communications that primarily use land-based infrastructure to function However the
very nature of computer networks and the ever-increasing global reach of communication
capabilities severely restrict a nationrsquos ability to monitor the millions of transmissions made on a
daily basis and these signals certainly wouldnrsquot be on any scheduled basis Therefore even if
8
AUACSCSinksAY08
nations made agreements concerning the cyberspace domain nations would have a difficult time
enforcing their terms of agreements unless the terms are very open-ended If they were so open-
ended then the agreement may not be necessary and based on my research nations realize the
futility of establishing these agreements as this author couldnrsquot find any reference to any
agreements that nations have entered into referencing the cyberspace domain
While the international law for civilian aircraft in airspace may not relate well or isnrsquot
feasible to enforce in the cyberspace domain does a nation have that same right to protect itself
from a suspected attack from cyberspace where the attackerrsquos signal enters airspace Does a
nation have the right to ldquoshoot downrdquo a cyberspace attack as it enters their domain through
airspace The whole idea behind restricting airspace from foreign military aircraft is because of
the strategic impact military aircraft can have on a nation As demonstrated in World War II
military aircraft carrying weapons of mass destruction can decimate cities and destroy a nation
with minimal effort The effects generated by military aircraft are quite destructive and garner
specific attention While an aircraft in of itself is relatively harmless the actions taken by the
crew can lead to devastating results
The same is true for cyber attacks The information passing through airspace in the
cyberspace domain is the vehicle however the crew conducting the operation is potentially
creating the same strategic results The cyber attack may not destroy cities but it certainly can
be destructive to a nationrsquos well-being by crippling power sources economic industries water
supply etc all at the blink of an eye while the victim takes several days to determine the
perpetrator Therefore while the international law for airspace may not be specifically relevant
the underlying principles are applicable as cyber attacks can have the same potential strategic
impact as an attack from a military aircraft
9
AUACSCSinksAY08
Space Outer space as defined by Doctor Boczek ldquois the space beyond the air surrounding the
earthrdquo As of 2005 international law doesnrsquot define a demarcation between airspace and outer
space but ldquostates agree that state sovereignty doesnrsquot extend without any limitsrdquo25 Proposals of
where airspace ends and when outer space begins are base on various scientific and technological
criteria (gravitational pull capabilities of air breathing aircraft etc26) Others scientists argue
that defining a boundary between airspace and outer space isnrsquot necessary as it would hinder the
progress of space technology and the legal status would depend on the nature of the activity
While no boundary exists airspace is finite and activity in outer space follows four
fundamentals principles First over flights of foreign satellites over a nation is permissible as
airspace doesnrsquot extend forever Second space ldquointernational law applies to outer space and
celestial bodiesrdquo Third according to the Outer Space Treaty of 1967 states canrsquot claim celestial
bodies or outer space which are not subject to national appropriation therefore are free for use
by all states Finally states must use outer space exclusively for peaceful purposes with specific
bans on weapons of mass destruction However states can use space for other military purposes
like intelligence surveillance and reconnaissance activities 27
Are these international laws and principles applicable to cyberspace Satellites are
certainly an integral part of the space domain Operators control satellites by using the
cyberspace domain and information passes between satellites and ground stations One can
argue that space is a sub-set of the cyberspace domain with satellites serving as computers in
space Global positioning system devices in vehicles interact with satellites all through an
elaborate network as part of the electromagnetic spectrum known as cyberspace Therefore
cyberspace is in space with millions of people using cyberspace everyday
10
AUACSCSinksAY08
The military uses space assets for intelligence surveillance and reconnaissance
knowledge management and command and control Agencies like the National Reconnaissance
Office and National Geospatial-Intelligence Agency obtain high-altitude imagery using a variety
of capabilities to include heat signature resonation Satellites can detect missile launches which
provide vital military information to senior leaders tasked with the security of their nation The
military networks to include decision briefs tasks and emails in Iraq and the Predator feeds in
Afghanistan travel through military and commercial satellites with all the information flowing
through the cyberspace domain With the heavy reliance of cyberspace to operate space assets
and the demands of information flowing through space by businesses it should come as no
surprise that space is a vital component for day-to-day operations of the military
Since cyberspace is an inherent component for space operations it is logical to assume
international law for outer space is applicable to cyberspace as long as an aggressor doesnt
violate the four premises and as long as weapons of mass destruction arenrsquot ldquostationed in outer
spacerdquo 28 Therefore a state would consider a cyber attack against a satellite as other than for
peaceful purposes and according to the fourth premise international law would apply
However what about a cyber attack using satellites as a means of conducting operations
Under todayrsquos current operations international elites havenrsquot considered a cyber attack passing
through space as a violation of international law When a senior leader in Qatar approves a
target set that is executed by a pilot in Nevada by an aircraft in Afghanistan all this information
is transmitted by cyberspace through space The result is that an aircraft renders an air or ground
target inoperable The effect is the same for cyberspace The information flows through space
by way of the cyberspace domain and the result is that an operator has rendered a target
11
AUACSCSinksAY08
inoperable As with airspace the information isnrsquot the cause of the damage but what an operator
does with the information is what constitutes the cyber attack
Land Cyber attacks using resources over land is relatively straightforward International
boundaries are defined as ldquoimaginary lines which separate territorial sovereigntyrdquo 29 which are
mutually agreed upon via international treaties Crossing an international border without
permission from the state is a violation of international law While an illegal immigrant crossing
a border to seek an opportunity to provide for his family is a violation of national law the United
Nation considers a nation-sponsored invasion of another nation that threatens the security and
stability of a nation as a breach in international law and an act of war
However international law doesnrsquot consider all border crossings as an act of war For
example when Nicaraguan troops and arms allegedly crossed the borders of El Salvador the
United Nations determined that incursions didnrsquot threaten El Salvadorrsquos territorial integrity and
stated that neither ldquothese incursions nor the alleged supply of arms may be relied upon as
justifying the exercise of the right of collective self-defenserdquo30 The victim state can repelled the
aggressive act but the United Nations Council wouldnrsquot condone any further military action
taken against the adversary opting for diplomatic or economic solution instead
Does international law apply when an adversary crosses international borders using
cyberspace as the means for conducting warfare operations When an adversarial state crosses a
statersquos boundaries using roads or bridges that connect the two nations the road is the resource
spanning the two nations If the adversary doesnrsquot do anything then returns to their sovereign
borders the aggressor hasnrsquot violated international law However when the adversary uses
weapon systems to affect serious damage the adversary has broken international law and a
12
AUACSCSinksAY08
nation may invoke their right for self-defense and may conduct full-scale operations to neutralize
the threat
A parallel notion is when an adversary uses a copper or fiber optic connection that spans
between two nations The adversary uses the land-based LAN connection as a means for
conducting cyber warfare operations The adversary may cross the borders using cyberspace yet
do nothing The affected state may push the adversary back to its borders but no further actions
are deemed appropriate However once the adversary uses the information transmitted over
cyberspace to cause severe operational or strategic damage the affected state now has the right
of self-defense Cyberspace is the means like the road or bridge for which the adversary
delivered the weapon The affected nation will consider the execution of the adversaryrsquos
information packet or weapon system as an act of aggression and the effect caused by the
weapon is what breeches international law
The difference between these two scenarios is that the adversary using the
electromagnetic spectrum hasnrsquot physically invaded a nationrsquos sovereign borders However
their digital presence crossed sovereign borders and as latter discussed in the paper adversaries
committing an act aggression against a state are now under the jurisdiction of the affected state
Sea ldquoThe territorial sea is a belt of sea adjacent to the (statersquos) coasthellipto include the airspace
aboverdquo as well as the seabed and subsoil31 The territorial sea is subject to the right of innocent
passage by foreign shops giving states the right to transport goods and passengers between ports
All of which is subject to the full sovereignty of the state which according to the United Nations
Convention on the Law of the Sea in 1982 and agreed upon by the majority of its membership in
1982 extends 12 miles from the coast32 The jurisdiction includes crimes where the
consequences extend to the coastal state and disturbs the peace of the country33 A cyber attack
13
AUACSCSinksAY08
conducted within the territorial sea of a nation would be no different from a cyber attack
conducted from within the nationrsquos land borders therefore cyber attacks against a state or even
another state conducted within the territorial seas are subject to current international laws Cyber
attacks originating outside the statersquos sovereign borders but results in affecting a statersquos
resources in their territorial seas would fall under the land and airspace breeches of territorial
sovereignty and would be subject to international law
The high seas on the other hand arenrsquot subject to the sovereignty of any one state The
high seas extend beyond the territorial sea and include the airspace the seabed and the subsoil34
and all states have the right to exercise freedoms on the high seas35 As similarly defined in
space ldquothe high seas shall be reserved for peaceful purposesrdquo as stated by Article 88 of the Law
of the Seas Cooperative36 which is defined as refraining from any threat or use of force (outside
of wartime conflicts)
The very nature of a cyber attack in the high seas lends itself to be a violation of
international law as nations are restricted to conducting peaceful operations in the high seas
The question is whom has jurisdiction of crimes committed in the high seas By applying the
Protective Security Principle of Jurisdiction where an actor threatens a statersquo security and
introducing the United Nationrsquos definition on the Illegal Use of Force extends to the high seas
and for that matter space giving states the right for self-defense as defined by the United Nations
as ldquoan armed attackrdquo The sheer name of cyber attack doesnrsquot immediately lend itself to an
ldquoarmedrdquo cyber attack However the effects generated from a cyber attack can be equivalent to a
traditional conventional attack and the international law would permit a state to take appropriate
countermeasures while notifying the United Nations Security Council37
14
AUACSCSinksAY08
Applying International Law to Cyber Warfare Today we live in an Information Age where communication through cyberspace has forever changed and flattened out worldhellipOur adversaries seek to operate from behind technical legal and international screens as they execute their costly attacks38
~General James E Cartwright Commander United States Strategic Command
Jurisdiction
Understanding the territorial sovereignty principles of a nation is important in applying
cyberspace and cyber warfare to existing international laws While some of these principles and
international laws may not be relevant for the cyberspace domain due to the far-reaching
capability of cyber warfare the jurisdiction of a nation further defines its ability to respond to
aggressive acts by nations in the cyberspace domain There are three jurisdictional principles
that provide nations the right to pursue aggressors that threaten a nationrsquos independence the
Territorial Principle Nationality Principle and the Protective Security Principle
For actions originating within the state the jurisdiction clearly falls within the territorial
principle where a ldquostate has jurisdiction over all crimes committed in its territoryhellipto include
airspace international waters and territorial seasrdquo39 The territorial jurisdiction is subject to
exceptions when dealing with persons from foreign states as in the most popular example of
immunity given to foreign diplomats In this case ldquostates may exercise jurisdiction over its
citizenhellipeven if they are physically outside the statesrsquo territoryrdquo as Doctor Boczek defines as the
Nationality Principle Nations usually agree upon on these concessions states prior to the offense
being committed40
Doctor Boczek defines the Protective Security Principle as a ldquojurisdictional principle
whereby a state my assume jurisdiction over and punish foreign nationals for certain conduct
outside its territory which is directed against its security territorial integrity and political
independencerdquo41 Some states would argue that criticism of a state or government is applicable
15
AUACSCSinksAY08
in applying this principle of jurisdiction However this is too broad of an interpretation and
should be confined to acts that are more tangible in nature like falsification of a statesrsquo official
documents conspiracy to violate immigration of custom laws and illicit drug trafficking42
Would a cyber attack that is deemed to challenge a nationrsquos banking community or bring
down a power source be a direct attack against its security and political independence The
international community easily sees the attack of a power source with kinetic weapons as a
violation of a territorial boundary and a breech of international law The United States viewed
the attack on the Trade Towers as an act of war launching the Global War on Terrorism Would
the United States have viewed the same devastation as if the attack occurred through cyberspace
Would the attack have been less of an act of war if the aggressor remotely controlled domestic
airliners from a foreign country Probably not What happens if the cyber attack caused a fire in
the lower floors of the buildings preventing people from escaping While less dramatic than an
airbus flying into the middle of the towers and maybe more difficult to demonize the crime the
result is the samemdashinnocent people suffering as a result of an adversary trying to threaten a
nationrsquos security
What happens if the suspected cyber attack has violated a nationrsquos territorial boundary in
order to attack a neighboring country or an ally Going from point A to point B in cyberspace is
rarely a direct connection As with the global nature of cyberspace itrsquos conceivable that
adversaries cross several nationsrsquo boundaries to conduct cyber attack operations The question
generated is who has jurisdiction
If the actor committing the crime had used an airplane each nation could claim
jurisdiction as the adversary violated their territorial boundaries and violated international law
More often than not the first state would have acted immediately upon the aggressive act and
16
AUACSCSinksAY08
would have prevented aggressors from completing their task by either forcing the aircraft to land
or turnaround or an even more escalated response of firing upon the aircraft In the air land or
sea the ability for a nationrsquos military forces to respond in a timely manner gives way to the
deterrence factor of not crossing a statersquos boundaries without receiving permission for fear of
reprisal A clear example of this was when Turkey denied the United States the ability deploy
the 4th Infantry Division from its borders at the beginning of Operation Iraqi Freedom Violating
Turkeyrsquos borders without permission would have brought about great repercussions that would
have made Operation Iraqi Freedom even more difficult and could have resulted in an escalation
of the war outside the Iraqi borders43 Another example is when Spain and France denied the
Unites States the use of their airspace when F-111s based in the United Kingdom conducted air
operations in Libya in an effort to eliminate Muammar Khadafy44
However the speeds at which these breeches in territorial boundaries occur make it
difficult for a nation to claim jurisdiction especially when nothing occurred within their
territorial sovereignty The cyber attacks didnrsquot result in any damage to nation as the information
packets passed through their sovereign borders According to territorial boundary description
described by Doctor Boczek the international community doesnrsquot consider the crossing the
border in of itself an act of warmdashserious damage is a driving factor in determining conflict
escalation In addition according to the territorial jurisdiction principle the cyber attack didnrsquot
threaten a nationrsquos security territorial integrity and political independence If the cyber attack or
information originated from within a sovereign territory by a third party then the two nations
would have to work together to resolve the issue and mutual jurisdiction would probably apply
However if the cyber attack didnrsquot physically manifest itself from within their sovereign
territory or the adversary didnrsquot use the nation as a staging area to launch a further attack the
17
AUACSCSinksAY08
international law and the jurisdiction principles would dictate the affected nation would have
jurisdiction
Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security
territorial integrity and political independence Cyberspace utilizes the other domains as a means
of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence
Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of
territorial sovereignty the Protective Security Principle does provide nations the ability to
enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos
sovereignty when it conducts cyber warfare operations However some elites donrsquot consider
cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense
International law specifically article 2 of the United Nations Charters states that a
members shall refrain in their international relations from the threat or use of force against the
territorial integrity or political independence of any state or in any other manner inconsistent
with the purposes of the United Nations which is intended to prohibit all types of force except
those carried out under the aegis of the United Nations or as provided for by the Security
Council45 The only exception to the United Nations Charters as it relates to the Use of Force is
the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed
attack46
International elites have discussed the term ldquouse of forcerdquo in the past because of the
development of chemical and biological weapons and had to move from a kinetic impact based
definition to a results-oriented approach47 Chemical and biological weapons lacked the
characteristic of an explosion or physical force yet these weapons certainly are capable of
destroying life and property Doctor Leigh Armistead a former information warfare instructor at
18
AUACSCSinksAY08
the Joint Forces Staff College cautions that the use of computer network attacks by the military
ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary
that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great
Russia introduced a proposal to the United Nations that banned the use of information
operations Even though the United Nations didnrsquot adopt the law the concern of international
community is fully aware of the impact cyber attacks can have on a nation
The concern over cyber warfare capabilities is that it can generate both non-kinetic and
kinetic effects There has always been the traditional kinetic solution for cyber warfare where a
precision guidance munition destroys a critical information system node Most people assume
computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos
computer system from the safety of onersquos own command and control center but the physical
destruction of a computer system or network by kinetic means also qualifies as cyber warfare
However cyber warfare has also evolved to the point where aggressors can achieve a kinetic
effect without the use of a traditional kinetic weapon A cyber attack on an information system
can shut down a particular node of a power plant causing the system to become inoperative
Even if there wasnrsquot an explosion the attack serves the same purpose
The question raised is do cyber attacks constitute an armed attack Scholars do agree that
some cyber attacks fit comfortably within the United Nations Charter For example a strategic
level cyber attack causing widespread damage and significant casualties would trigger the statersquos
right of self-defense In addition a cyber attack that precluded a conventional attack or a series
of cyber attacks causing significant damage would give a state the right of self-defense49 Few
would dispute that a country has the right under international law to respond with military force
19
AUACSCSinksAY08
if a state destroyed or significantly damaged another nationrsquos economic system for example the
New York or London stock exchanges
However some confusion and state-defined interpretation comes into play when the
frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard
Law School argues that cyber attacks require an expansion of the definition on the ldquouse of
forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot
be prohibited by international law50 International scholars recommend ldquoclearer rules of what
kinds of information warfare actions constitute an armed attackrdquo which drives permissible
responses of self-defense51 For example a state-sponsored cyber attack causes damage to a
victimrsquos factory or power plant however the nation claims the incident is an isolated instance
and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under
the United Nations Charter and the United Nations would consider any response retaliation
which would violate international law52
Another example involves a nation conducting a series of small attacks causing minimal
damage and then ceases Even though the aggressor used force to conduct cyber warfare
operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under
the United Nations Charter This type of attack is analogues to a small band of troops crossing a
border without causing significant damage53 According to the United Nations Charter the
national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders
and respond to the use of force Repelling the small band of troops and reestablishing their
sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration
of war and allies would have to respect the United Nations decision and couldnrsquot intervene The
same is true for the cyber attack A state can employ defensive measure to isolate and defeat the
20
AUACSCSinksAY08
incursion over the electromagnetic spectrum However the United Nations would see further
offensive operations or invasive operations as retaliation Therefore a nation must take the
incident whether it is signs of conventional forces on the ground or traces of cyber warfare
incursions in the electromagnetic spectrum to the United Nations to seek restitution
In both of these situations the international law becomes the target for change not
whether cyber warfare is in violation of international law If the law were to change the
international community would then consider the above situations acts of war even if an
adversary used conventional forces As written today the result of an operation remains the
driving factor in determining if an adversary has violated international law The means by which
an adversary conducts military operations may affect how nations react to the situation but
whether an adversary conducts the operation by means of the air land sea space or cyberspace
doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian
Triggs a public international lawyer and member of the Attorney General International Legal
Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over
offences abroad having an intended and substantial effect within a state may be justifiedrdquo54
Therefore the international community must evaluate the effect of a criminal act rather than the
means in which the act was committed
Others claim that because the Internet takes advantages of legal norms where non-state
actors can ignore Western notions of law55 more international laws are needed for cyberspace
However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using
other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the
Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked
aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts
21
AUACSCSinksAY08
against a staterdquo in the cyberspace domain The anonymity of the Internet and their total
disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and
national laws already exist in most countries that prohibit the use of the Internet for terrorist
activities therefore additional international laws wouldnrsquot prevent or deter terrorist from
committing such acts of aggression
International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed
Conflict includes the Martens Clause which extends established custom and humanitarian
principles to new technologies and addresses the ever-changing nature of warfare The
international community designed The Martens Clause ldquoto prevent future unnecessary andor
disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges
crimes by invoking the laws of humanity and public conscience hence their effects and not its
methods
The basic legal premise behind Law of Armed Conflict is that attacks must be limited to
military objectives and collateral damage must be proportionate to military advantages and
forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary
suffering but military commanders and planners need to be aware of the results a particular
action will invoke Russian leadership believes a computer network attack against their
homeland can be a means for executing a variety of escalating responses to include nuclear
attack58 Therefore it is imperative military commanders understand the impact any weapon
system can have on an adversary not just cyber attacks
Not all scholars agree that international law is insufficient to govern cyber warfare
Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace
and the Use of Force states that computer network attacks constitute an unlawful use of force in
22
AUACSCSinksAY08
cyberspace under traditional international law Sharp declared that an armed attack may occur
ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a
way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive
definition of cyber attacks may never be drafted59 The Congressional Research Service also
concluded that ldquothere is little likelihood that the international community will soon generate a
coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations
on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos
conclusion is that the effects of cyber warfare operations are the same as if an adversary
conducted conventional warfare operations where the effect of the attacks are the driving factors
in determining whether an adversary used force or not
The United States Government agrees with Sharprsquos conclusion The offensive
Information Operation strategy for the United States government as described by Doctor
Armistead ties the tools used to conduct military operations back to the desired effect which is
in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning
effects-based operations and operational art focus the Joint Force Commanderrsquos course of action
towards meeting objectives outlined in guidance provided by the National Command Authority
and senior military leadership62 Whether the tools are dropped pamphlets invasive network
attacks or bombs on targets the goal is to produce a desired effect to achieve the overall
objectives and cyber warfare can produce effects that challenge the national security of a nation
Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63
~General T Michael Moseley USAF
23
AUACSCSinksAY08
The cyberspace domain has been around for quite sometime but as technology continues
to advance businesses as well as governmental organizations are becoming more reliant on the
cyberspace domain With that reliance the protection of this critical domain becomes even more
important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the
electromagnetic spectrum by denying and disrupting information demands Scholars claim that
protection needs to include addressing existing international laws expanding them to incorporate
the ever-advancing capabilities emerging in the cyberspace domain
However territorial sovereignty of a nation and the principles of jurisdiction specifically
the Protective Security Principle give nations the right to exercise jurisdiction when an
aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64
While cyberspace is a domain requiring specific attention it relies on assets in the other domains
of land space sea and air in order to operate and international laws for the linear domains do
exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace
but during cyber warfare operations the principles behind the restrictions of foreign military
entering airspace do apply The strategic nature of cyber warfare operations correspond to the
same strategic impact that airpower can inflict upon a nation threatening their independence
While maybe not as dramatic as kinetic effects the results can be just as devastating
Space is relatively straightforward Since a nation canrsquot claim space and over flights of
foreign satellites over a nation is permissible nations must use space for peaceful purposes
Kinetic attacks against space assets are a violation of international law therefore nations would
consider cyber warfare operations against space assets as other than peaceful purposes and a
violation of international law Cyber attacks traversing space assets relate to current military
operations where the military uses space assets to conduct kinetic operations Since international
24
AUACSCSinksAY08
elites havenrsquot considered these kinetic operations as a breach of international law military
commanders can conduct cyber warfare operations through space without fear of violating
international laws for outer space
Crossing international borders without a nationrsquos permission and threatening their
sovereignty is a violation of international law While nations canrsquot consider all border crossings
as an act of war those acts of aggression that threaten the territorial integrity would elicit a
defensive response by the victim nation Whether incursions involve combat vehicles over a
highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are
threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not
have set foot in the nation but according the Protective Security Principle the victim nation has
jurisdiction
Conducting cyber warfare operations from the territorial sea is no different from
conducting operations from within a nationrsquos land or sea borders However the high seas are
very similar in nature to space in that they are reserved for peaceful purposes Therefore
conducting any means of warfare from within the high seas is a violation of international law
and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-
defense
According to Barkham ldquoinformation warfare attacks are in essence territorial
penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then
subject to the jurisdiction of the victim nation who then has the right for self-defense However
due to the global nature of cyberspace aggressors can cross multiple borders and determining
who has jurisdiction demands cooperation among nations The origin and any deliberate staging
locations of the cyber attack will drive who has jurisdiction The crossing of third party borders
25
AUACSCSinksAY08
by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the
aggressors threaten a nationrsquos independence or territorial integrity
Scholars consider cyber warfare operations that involve strategic and operational impacts
as being a means of using force and fall within the legal regime of existing international law
However scholars argue that because cyber warfare includes kinetic and non-kinetic results the
Use of Force definition needs expanding Yet they conclude that an exhaustive definition of
cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare
operations against existing case studies where the effects are evaluated as opposed to the means
even if the operations originated from outside the nationrsquos territorial jurisdiction There is some
authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to
have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade
non-state actors from conducting cyber warfare operations given their willingness to ignore
Western notions of war and their ability to conduct operations anonymously in cyberspace
International laws are in place to that address the ever-changing nature of warfare The
Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a
framework for addressing all warfare to include cyber warfare operations The international
community will need to measure the effects of an operation rather the means Whether its boots
on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a
nationrsquos response
26
AUACSCSinksAY08
End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)
27
AUACSCSinksAY08
44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
28
AUACSCSinksAY08
Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005
Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department
American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)
Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983
Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988
Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)
Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)
IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)
Joint Publication 3-13 Information Operations 13 February 2006
Joint Publication 5-0 Joint Operations Planning 26 December 2006
Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies
Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc
Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College
Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)
Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press
29
AUACSCSinksAY08
Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI
Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)
Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press
Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company
Detter Delupis I The law of war (2000) New York NY Cambridge University Press
Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)
Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College
Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor
Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)
Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)
Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf
Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)
Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College
Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College
Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)
Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA
30
AUACSCSinksAY08
Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)
Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)
Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College
Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology
Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College
Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)
OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center
OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College
OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications
Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991
Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College
Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center
Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)
31
AUACSCSinksAY08
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press
Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA
Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University
Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor
Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661
Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office
Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis
United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC
United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center
Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College
Wesley David C The Military Commander and the Law 2006
32
AUACSCSinksAY08
nations made agreements concerning the cyberspace domain nations would have a difficult time
enforcing their terms of agreements unless the terms are very open-ended If they were so open-
ended then the agreement may not be necessary and based on my research nations realize the
futility of establishing these agreements as this author couldnrsquot find any reference to any
agreements that nations have entered into referencing the cyberspace domain
While the international law for civilian aircraft in airspace may not relate well or isnrsquot
feasible to enforce in the cyberspace domain does a nation have that same right to protect itself
from a suspected attack from cyberspace where the attackerrsquos signal enters airspace Does a
nation have the right to ldquoshoot downrdquo a cyberspace attack as it enters their domain through
airspace The whole idea behind restricting airspace from foreign military aircraft is because of
the strategic impact military aircraft can have on a nation As demonstrated in World War II
military aircraft carrying weapons of mass destruction can decimate cities and destroy a nation
with minimal effort The effects generated by military aircraft are quite destructive and garner
specific attention While an aircraft in of itself is relatively harmless the actions taken by the
crew can lead to devastating results
The same is true for cyber attacks The information passing through airspace in the
cyberspace domain is the vehicle however the crew conducting the operation is potentially
creating the same strategic results The cyber attack may not destroy cities but it certainly can
be destructive to a nationrsquos well-being by crippling power sources economic industries water
supply etc all at the blink of an eye while the victim takes several days to determine the
perpetrator Therefore while the international law for airspace may not be specifically relevant
the underlying principles are applicable as cyber attacks can have the same potential strategic
impact as an attack from a military aircraft
9
AUACSCSinksAY08
Space Outer space as defined by Doctor Boczek ldquois the space beyond the air surrounding the
earthrdquo As of 2005 international law doesnrsquot define a demarcation between airspace and outer
space but ldquostates agree that state sovereignty doesnrsquot extend without any limitsrdquo25 Proposals of
where airspace ends and when outer space begins are base on various scientific and technological
criteria (gravitational pull capabilities of air breathing aircraft etc26) Others scientists argue
that defining a boundary between airspace and outer space isnrsquot necessary as it would hinder the
progress of space technology and the legal status would depend on the nature of the activity
While no boundary exists airspace is finite and activity in outer space follows four
fundamentals principles First over flights of foreign satellites over a nation is permissible as
airspace doesnrsquot extend forever Second space ldquointernational law applies to outer space and
celestial bodiesrdquo Third according to the Outer Space Treaty of 1967 states canrsquot claim celestial
bodies or outer space which are not subject to national appropriation therefore are free for use
by all states Finally states must use outer space exclusively for peaceful purposes with specific
bans on weapons of mass destruction However states can use space for other military purposes
like intelligence surveillance and reconnaissance activities 27
Are these international laws and principles applicable to cyberspace Satellites are
certainly an integral part of the space domain Operators control satellites by using the
cyberspace domain and information passes between satellites and ground stations One can
argue that space is a sub-set of the cyberspace domain with satellites serving as computers in
space Global positioning system devices in vehicles interact with satellites all through an
elaborate network as part of the electromagnetic spectrum known as cyberspace Therefore
cyberspace is in space with millions of people using cyberspace everyday
10
AUACSCSinksAY08
The military uses space assets for intelligence surveillance and reconnaissance
knowledge management and command and control Agencies like the National Reconnaissance
Office and National Geospatial-Intelligence Agency obtain high-altitude imagery using a variety
of capabilities to include heat signature resonation Satellites can detect missile launches which
provide vital military information to senior leaders tasked with the security of their nation The
military networks to include decision briefs tasks and emails in Iraq and the Predator feeds in
Afghanistan travel through military and commercial satellites with all the information flowing
through the cyberspace domain With the heavy reliance of cyberspace to operate space assets
and the demands of information flowing through space by businesses it should come as no
surprise that space is a vital component for day-to-day operations of the military
Since cyberspace is an inherent component for space operations it is logical to assume
international law for outer space is applicable to cyberspace as long as an aggressor doesnt
violate the four premises and as long as weapons of mass destruction arenrsquot ldquostationed in outer
spacerdquo 28 Therefore a state would consider a cyber attack against a satellite as other than for
peaceful purposes and according to the fourth premise international law would apply
However what about a cyber attack using satellites as a means of conducting operations
Under todayrsquos current operations international elites havenrsquot considered a cyber attack passing
through space as a violation of international law When a senior leader in Qatar approves a
target set that is executed by a pilot in Nevada by an aircraft in Afghanistan all this information
is transmitted by cyberspace through space The result is that an aircraft renders an air or ground
target inoperable The effect is the same for cyberspace The information flows through space
by way of the cyberspace domain and the result is that an operator has rendered a target
11
AUACSCSinksAY08
inoperable As with airspace the information isnrsquot the cause of the damage but what an operator
does with the information is what constitutes the cyber attack
Land Cyber attacks using resources over land is relatively straightforward International
boundaries are defined as ldquoimaginary lines which separate territorial sovereigntyrdquo 29 which are
mutually agreed upon via international treaties Crossing an international border without
permission from the state is a violation of international law While an illegal immigrant crossing
a border to seek an opportunity to provide for his family is a violation of national law the United
Nation considers a nation-sponsored invasion of another nation that threatens the security and
stability of a nation as a breach in international law and an act of war
However international law doesnrsquot consider all border crossings as an act of war For
example when Nicaraguan troops and arms allegedly crossed the borders of El Salvador the
United Nations determined that incursions didnrsquot threaten El Salvadorrsquos territorial integrity and
stated that neither ldquothese incursions nor the alleged supply of arms may be relied upon as
justifying the exercise of the right of collective self-defenserdquo30 The victim state can repelled the
aggressive act but the United Nations Council wouldnrsquot condone any further military action
taken against the adversary opting for diplomatic or economic solution instead
Does international law apply when an adversary crosses international borders using
cyberspace as the means for conducting warfare operations When an adversarial state crosses a
statersquos boundaries using roads or bridges that connect the two nations the road is the resource
spanning the two nations If the adversary doesnrsquot do anything then returns to their sovereign
borders the aggressor hasnrsquot violated international law However when the adversary uses
weapon systems to affect serious damage the adversary has broken international law and a
12
AUACSCSinksAY08
nation may invoke their right for self-defense and may conduct full-scale operations to neutralize
the threat
A parallel notion is when an adversary uses a copper or fiber optic connection that spans
between two nations The adversary uses the land-based LAN connection as a means for
conducting cyber warfare operations The adversary may cross the borders using cyberspace yet
do nothing The affected state may push the adversary back to its borders but no further actions
are deemed appropriate However once the adversary uses the information transmitted over
cyberspace to cause severe operational or strategic damage the affected state now has the right
of self-defense Cyberspace is the means like the road or bridge for which the adversary
delivered the weapon The affected nation will consider the execution of the adversaryrsquos
information packet or weapon system as an act of aggression and the effect caused by the
weapon is what breeches international law
The difference between these two scenarios is that the adversary using the
electromagnetic spectrum hasnrsquot physically invaded a nationrsquos sovereign borders However
their digital presence crossed sovereign borders and as latter discussed in the paper adversaries
committing an act aggression against a state are now under the jurisdiction of the affected state
Sea ldquoThe territorial sea is a belt of sea adjacent to the (statersquos) coasthellipto include the airspace
aboverdquo as well as the seabed and subsoil31 The territorial sea is subject to the right of innocent
passage by foreign shops giving states the right to transport goods and passengers between ports
All of which is subject to the full sovereignty of the state which according to the United Nations
Convention on the Law of the Sea in 1982 and agreed upon by the majority of its membership in
1982 extends 12 miles from the coast32 The jurisdiction includes crimes where the
consequences extend to the coastal state and disturbs the peace of the country33 A cyber attack
13
AUACSCSinksAY08
conducted within the territorial sea of a nation would be no different from a cyber attack
conducted from within the nationrsquos land borders therefore cyber attacks against a state or even
another state conducted within the territorial seas are subject to current international laws Cyber
attacks originating outside the statersquos sovereign borders but results in affecting a statersquos
resources in their territorial seas would fall under the land and airspace breeches of territorial
sovereignty and would be subject to international law
The high seas on the other hand arenrsquot subject to the sovereignty of any one state The
high seas extend beyond the territorial sea and include the airspace the seabed and the subsoil34
and all states have the right to exercise freedoms on the high seas35 As similarly defined in
space ldquothe high seas shall be reserved for peaceful purposesrdquo as stated by Article 88 of the Law
of the Seas Cooperative36 which is defined as refraining from any threat or use of force (outside
of wartime conflicts)
The very nature of a cyber attack in the high seas lends itself to be a violation of
international law as nations are restricted to conducting peaceful operations in the high seas
The question is whom has jurisdiction of crimes committed in the high seas By applying the
Protective Security Principle of Jurisdiction where an actor threatens a statersquo security and
introducing the United Nationrsquos definition on the Illegal Use of Force extends to the high seas
and for that matter space giving states the right for self-defense as defined by the United Nations
as ldquoan armed attackrdquo The sheer name of cyber attack doesnrsquot immediately lend itself to an
ldquoarmedrdquo cyber attack However the effects generated from a cyber attack can be equivalent to a
traditional conventional attack and the international law would permit a state to take appropriate
countermeasures while notifying the United Nations Security Council37
14
AUACSCSinksAY08
Applying International Law to Cyber Warfare Today we live in an Information Age where communication through cyberspace has forever changed and flattened out worldhellipOur adversaries seek to operate from behind technical legal and international screens as they execute their costly attacks38
~General James E Cartwright Commander United States Strategic Command
Jurisdiction
Understanding the territorial sovereignty principles of a nation is important in applying
cyberspace and cyber warfare to existing international laws While some of these principles and
international laws may not be relevant for the cyberspace domain due to the far-reaching
capability of cyber warfare the jurisdiction of a nation further defines its ability to respond to
aggressive acts by nations in the cyberspace domain There are three jurisdictional principles
that provide nations the right to pursue aggressors that threaten a nationrsquos independence the
Territorial Principle Nationality Principle and the Protective Security Principle
For actions originating within the state the jurisdiction clearly falls within the territorial
principle where a ldquostate has jurisdiction over all crimes committed in its territoryhellipto include
airspace international waters and territorial seasrdquo39 The territorial jurisdiction is subject to
exceptions when dealing with persons from foreign states as in the most popular example of
immunity given to foreign diplomats In this case ldquostates may exercise jurisdiction over its
citizenhellipeven if they are physically outside the statesrsquo territoryrdquo as Doctor Boczek defines as the
Nationality Principle Nations usually agree upon on these concessions states prior to the offense
being committed40
Doctor Boczek defines the Protective Security Principle as a ldquojurisdictional principle
whereby a state my assume jurisdiction over and punish foreign nationals for certain conduct
outside its territory which is directed against its security territorial integrity and political
independencerdquo41 Some states would argue that criticism of a state or government is applicable
15
AUACSCSinksAY08
in applying this principle of jurisdiction However this is too broad of an interpretation and
should be confined to acts that are more tangible in nature like falsification of a statesrsquo official
documents conspiracy to violate immigration of custom laws and illicit drug trafficking42
Would a cyber attack that is deemed to challenge a nationrsquos banking community or bring
down a power source be a direct attack against its security and political independence The
international community easily sees the attack of a power source with kinetic weapons as a
violation of a territorial boundary and a breech of international law The United States viewed
the attack on the Trade Towers as an act of war launching the Global War on Terrorism Would
the United States have viewed the same devastation as if the attack occurred through cyberspace
Would the attack have been less of an act of war if the aggressor remotely controlled domestic
airliners from a foreign country Probably not What happens if the cyber attack caused a fire in
the lower floors of the buildings preventing people from escaping While less dramatic than an
airbus flying into the middle of the towers and maybe more difficult to demonize the crime the
result is the samemdashinnocent people suffering as a result of an adversary trying to threaten a
nationrsquos security
What happens if the suspected cyber attack has violated a nationrsquos territorial boundary in
order to attack a neighboring country or an ally Going from point A to point B in cyberspace is
rarely a direct connection As with the global nature of cyberspace itrsquos conceivable that
adversaries cross several nationsrsquo boundaries to conduct cyber attack operations The question
generated is who has jurisdiction
If the actor committing the crime had used an airplane each nation could claim
jurisdiction as the adversary violated their territorial boundaries and violated international law
More often than not the first state would have acted immediately upon the aggressive act and
16
AUACSCSinksAY08
would have prevented aggressors from completing their task by either forcing the aircraft to land
or turnaround or an even more escalated response of firing upon the aircraft In the air land or
sea the ability for a nationrsquos military forces to respond in a timely manner gives way to the
deterrence factor of not crossing a statersquos boundaries without receiving permission for fear of
reprisal A clear example of this was when Turkey denied the United States the ability deploy
the 4th Infantry Division from its borders at the beginning of Operation Iraqi Freedom Violating
Turkeyrsquos borders without permission would have brought about great repercussions that would
have made Operation Iraqi Freedom even more difficult and could have resulted in an escalation
of the war outside the Iraqi borders43 Another example is when Spain and France denied the
Unites States the use of their airspace when F-111s based in the United Kingdom conducted air
operations in Libya in an effort to eliminate Muammar Khadafy44
However the speeds at which these breeches in territorial boundaries occur make it
difficult for a nation to claim jurisdiction especially when nothing occurred within their
territorial sovereignty The cyber attacks didnrsquot result in any damage to nation as the information
packets passed through their sovereign borders According to territorial boundary description
described by Doctor Boczek the international community doesnrsquot consider the crossing the
border in of itself an act of warmdashserious damage is a driving factor in determining conflict
escalation In addition according to the territorial jurisdiction principle the cyber attack didnrsquot
threaten a nationrsquos security territorial integrity and political independence If the cyber attack or
information originated from within a sovereign territory by a third party then the two nations
would have to work together to resolve the issue and mutual jurisdiction would probably apply
However if the cyber attack didnrsquot physically manifest itself from within their sovereign
territory or the adversary didnrsquot use the nation as a staging area to launch a further attack the
17
AUACSCSinksAY08
international law and the jurisdiction principles would dictate the affected nation would have
jurisdiction
Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security
territorial integrity and political independence Cyberspace utilizes the other domains as a means
of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence
Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of
territorial sovereignty the Protective Security Principle does provide nations the ability to
enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos
sovereignty when it conducts cyber warfare operations However some elites donrsquot consider
cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense
International law specifically article 2 of the United Nations Charters states that a
members shall refrain in their international relations from the threat or use of force against the
territorial integrity or political independence of any state or in any other manner inconsistent
with the purposes of the United Nations which is intended to prohibit all types of force except
those carried out under the aegis of the United Nations or as provided for by the Security
Council45 The only exception to the United Nations Charters as it relates to the Use of Force is
the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed
attack46
International elites have discussed the term ldquouse of forcerdquo in the past because of the
development of chemical and biological weapons and had to move from a kinetic impact based
definition to a results-oriented approach47 Chemical and biological weapons lacked the
characteristic of an explosion or physical force yet these weapons certainly are capable of
destroying life and property Doctor Leigh Armistead a former information warfare instructor at
18
AUACSCSinksAY08
the Joint Forces Staff College cautions that the use of computer network attacks by the military
ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary
that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great
Russia introduced a proposal to the United Nations that banned the use of information
operations Even though the United Nations didnrsquot adopt the law the concern of international
community is fully aware of the impact cyber attacks can have on a nation
The concern over cyber warfare capabilities is that it can generate both non-kinetic and
kinetic effects There has always been the traditional kinetic solution for cyber warfare where a
precision guidance munition destroys a critical information system node Most people assume
computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos
computer system from the safety of onersquos own command and control center but the physical
destruction of a computer system or network by kinetic means also qualifies as cyber warfare
However cyber warfare has also evolved to the point where aggressors can achieve a kinetic
effect without the use of a traditional kinetic weapon A cyber attack on an information system
can shut down a particular node of a power plant causing the system to become inoperative
Even if there wasnrsquot an explosion the attack serves the same purpose
The question raised is do cyber attacks constitute an armed attack Scholars do agree that
some cyber attacks fit comfortably within the United Nations Charter For example a strategic
level cyber attack causing widespread damage and significant casualties would trigger the statersquos
right of self-defense In addition a cyber attack that precluded a conventional attack or a series
of cyber attacks causing significant damage would give a state the right of self-defense49 Few
would dispute that a country has the right under international law to respond with military force
19
AUACSCSinksAY08
if a state destroyed or significantly damaged another nationrsquos economic system for example the
New York or London stock exchanges
However some confusion and state-defined interpretation comes into play when the
frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard
Law School argues that cyber attacks require an expansion of the definition on the ldquouse of
forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot
be prohibited by international law50 International scholars recommend ldquoclearer rules of what
kinds of information warfare actions constitute an armed attackrdquo which drives permissible
responses of self-defense51 For example a state-sponsored cyber attack causes damage to a
victimrsquos factory or power plant however the nation claims the incident is an isolated instance
and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under
the United Nations Charter and the United Nations would consider any response retaliation
which would violate international law52
Another example involves a nation conducting a series of small attacks causing minimal
damage and then ceases Even though the aggressor used force to conduct cyber warfare
operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under
the United Nations Charter This type of attack is analogues to a small band of troops crossing a
border without causing significant damage53 According to the United Nations Charter the
national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders
and respond to the use of force Repelling the small band of troops and reestablishing their
sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration
of war and allies would have to respect the United Nations decision and couldnrsquot intervene The
same is true for the cyber attack A state can employ defensive measure to isolate and defeat the
20
AUACSCSinksAY08
incursion over the electromagnetic spectrum However the United Nations would see further
offensive operations or invasive operations as retaliation Therefore a nation must take the
incident whether it is signs of conventional forces on the ground or traces of cyber warfare
incursions in the electromagnetic spectrum to the United Nations to seek restitution
In both of these situations the international law becomes the target for change not
whether cyber warfare is in violation of international law If the law were to change the
international community would then consider the above situations acts of war even if an
adversary used conventional forces As written today the result of an operation remains the
driving factor in determining if an adversary has violated international law The means by which
an adversary conducts military operations may affect how nations react to the situation but
whether an adversary conducts the operation by means of the air land sea space or cyberspace
doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian
Triggs a public international lawyer and member of the Attorney General International Legal
Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over
offences abroad having an intended and substantial effect within a state may be justifiedrdquo54
Therefore the international community must evaluate the effect of a criminal act rather than the
means in which the act was committed
Others claim that because the Internet takes advantages of legal norms where non-state
actors can ignore Western notions of law55 more international laws are needed for cyberspace
However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using
other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the
Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked
aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts
21
AUACSCSinksAY08
against a staterdquo in the cyberspace domain The anonymity of the Internet and their total
disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and
national laws already exist in most countries that prohibit the use of the Internet for terrorist
activities therefore additional international laws wouldnrsquot prevent or deter terrorist from
committing such acts of aggression
International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed
Conflict includes the Martens Clause which extends established custom and humanitarian
principles to new technologies and addresses the ever-changing nature of warfare The
international community designed The Martens Clause ldquoto prevent future unnecessary andor
disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges
crimes by invoking the laws of humanity and public conscience hence their effects and not its
methods
The basic legal premise behind Law of Armed Conflict is that attacks must be limited to
military objectives and collateral damage must be proportionate to military advantages and
forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary
suffering but military commanders and planners need to be aware of the results a particular
action will invoke Russian leadership believes a computer network attack against their
homeland can be a means for executing a variety of escalating responses to include nuclear
attack58 Therefore it is imperative military commanders understand the impact any weapon
system can have on an adversary not just cyber attacks
Not all scholars agree that international law is insufficient to govern cyber warfare
Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace
and the Use of Force states that computer network attacks constitute an unlawful use of force in
22
AUACSCSinksAY08
cyberspace under traditional international law Sharp declared that an armed attack may occur
ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a
way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive
definition of cyber attacks may never be drafted59 The Congressional Research Service also
concluded that ldquothere is little likelihood that the international community will soon generate a
coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations
on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos
conclusion is that the effects of cyber warfare operations are the same as if an adversary
conducted conventional warfare operations where the effect of the attacks are the driving factors
in determining whether an adversary used force or not
The United States Government agrees with Sharprsquos conclusion The offensive
Information Operation strategy for the United States government as described by Doctor
Armistead ties the tools used to conduct military operations back to the desired effect which is
in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning
effects-based operations and operational art focus the Joint Force Commanderrsquos course of action
towards meeting objectives outlined in guidance provided by the National Command Authority
and senior military leadership62 Whether the tools are dropped pamphlets invasive network
attacks or bombs on targets the goal is to produce a desired effect to achieve the overall
objectives and cyber warfare can produce effects that challenge the national security of a nation
Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63
~General T Michael Moseley USAF
23
AUACSCSinksAY08
The cyberspace domain has been around for quite sometime but as technology continues
to advance businesses as well as governmental organizations are becoming more reliant on the
cyberspace domain With that reliance the protection of this critical domain becomes even more
important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the
electromagnetic spectrum by denying and disrupting information demands Scholars claim that
protection needs to include addressing existing international laws expanding them to incorporate
the ever-advancing capabilities emerging in the cyberspace domain
However territorial sovereignty of a nation and the principles of jurisdiction specifically
the Protective Security Principle give nations the right to exercise jurisdiction when an
aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64
While cyberspace is a domain requiring specific attention it relies on assets in the other domains
of land space sea and air in order to operate and international laws for the linear domains do
exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace
but during cyber warfare operations the principles behind the restrictions of foreign military
entering airspace do apply The strategic nature of cyber warfare operations correspond to the
same strategic impact that airpower can inflict upon a nation threatening their independence
While maybe not as dramatic as kinetic effects the results can be just as devastating
Space is relatively straightforward Since a nation canrsquot claim space and over flights of
foreign satellites over a nation is permissible nations must use space for peaceful purposes
Kinetic attacks against space assets are a violation of international law therefore nations would
consider cyber warfare operations against space assets as other than peaceful purposes and a
violation of international law Cyber attacks traversing space assets relate to current military
operations where the military uses space assets to conduct kinetic operations Since international
24
AUACSCSinksAY08
elites havenrsquot considered these kinetic operations as a breach of international law military
commanders can conduct cyber warfare operations through space without fear of violating
international laws for outer space
Crossing international borders without a nationrsquos permission and threatening their
sovereignty is a violation of international law While nations canrsquot consider all border crossings
as an act of war those acts of aggression that threaten the territorial integrity would elicit a
defensive response by the victim nation Whether incursions involve combat vehicles over a
highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are
threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not
have set foot in the nation but according the Protective Security Principle the victim nation has
jurisdiction
Conducting cyber warfare operations from the territorial sea is no different from
conducting operations from within a nationrsquos land or sea borders However the high seas are
very similar in nature to space in that they are reserved for peaceful purposes Therefore
conducting any means of warfare from within the high seas is a violation of international law
and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-
defense
According to Barkham ldquoinformation warfare attacks are in essence territorial
penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then
subject to the jurisdiction of the victim nation who then has the right for self-defense However
due to the global nature of cyberspace aggressors can cross multiple borders and determining
who has jurisdiction demands cooperation among nations The origin and any deliberate staging
locations of the cyber attack will drive who has jurisdiction The crossing of third party borders
25
AUACSCSinksAY08
by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the
aggressors threaten a nationrsquos independence or territorial integrity
Scholars consider cyber warfare operations that involve strategic and operational impacts
as being a means of using force and fall within the legal regime of existing international law
However scholars argue that because cyber warfare includes kinetic and non-kinetic results the
Use of Force definition needs expanding Yet they conclude that an exhaustive definition of
cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare
operations against existing case studies where the effects are evaluated as opposed to the means
even if the operations originated from outside the nationrsquos territorial jurisdiction There is some
authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to
have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade
non-state actors from conducting cyber warfare operations given their willingness to ignore
Western notions of war and their ability to conduct operations anonymously in cyberspace
International laws are in place to that address the ever-changing nature of warfare The
Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a
framework for addressing all warfare to include cyber warfare operations The international
community will need to measure the effects of an operation rather the means Whether its boots
on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a
nationrsquos response
26
AUACSCSinksAY08
End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)
27
AUACSCSinksAY08
44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
28
AUACSCSinksAY08
Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005
Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department
American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)
Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983
Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988
Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)
Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)
IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)
Joint Publication 3-13 Information Operations 13 February 2006
Joint Publication 5-0 Joint Operations Planning 26 December 2006
Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies
Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc
Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College
Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)
Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press
29
AUACSCSinksAY08
Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI
Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)
Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press
Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company
Detter Delupis I The law of war (2000) New York NY Cambridge University Press
Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)
Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College
Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor
Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)
Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)
Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf
Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)
Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College
Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College
Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)
Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA
30
AUACSCSinksAY08
Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)
Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)
Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College
Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology
Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College
Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)
OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center
OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College
OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications
Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991
Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College
Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center
Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)
31
AUACSCSinksAY08
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press
Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA
Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University
Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor
Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661
Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office
Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis
United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC
United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center
Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College
Wesley David C The Military Commander and the Law 2006
32
AUACSCSinksAY08
Space Outer space as defined by Doctor Boczek ldquois the space beyond the air surrounding the
earthrdquo As of 2005 international law doesnrsquot define a demarcation between airspace and outer
space but ldquostates agree that state sovereignty doesnrsquot extend without any limitsrdquo25 Proposals of
where airspace ends and when outer space begins are base on various scientific and technological
criteria (gravitational pull capabilities of air breathing aircraft etc26) Others scientists argue
that defining a boundary between airspace and outer space isnrsquot necessary as it would hinder the
progress of space technology and the legal status would depend on the nature of the activity
While no boundary exists airspace is finite and activity in outer space follows four
fundamentals principles First over flights of foreign satellites over a nation is permissible as
airspace doesnrsquot extend forever Second space ldquointernational law applies to outer space and
celestial bodiesrdquo Third according to the Outer Space Treaty of 1967 states canrsquot claim celestial
bodies or outer space which are not subject to national appropriation therefore are free for use
by all states Finally states must use outer space exclusively for peaceful purposes with specific
bans on weapons of mass destruction However states can use space for other military purposes
like intelligence surveillance and reconnaissance activities 27
Are these international laws and principles applicable to cyberspace Satellites are
certainly an integral part of the space domain Operators control satellites by using the
cyberspace domain and information passes between satellites and ground stations One can
argue that space is a sub-set of the cyberspace domain with satellites serving as computers in
space Global positioning system devices in vehicles interact with satellites all through an
elaborate network as part of the electromagnetic spectrum known as cyberspace Therefore
cyberspace is in space with millions of people using cyberspace everyday
10
AUACSCSinksAY08
The military uses space assets for intelligence surveillance and reconnaissance
knowledge management and command and control Agencies like the National Reconnaissance
Office and National Geospatial-Intelligence Agency obtain high-altitude imagery using a variety
of capabilities to include heat signature resonation Satellites can detect missile launches which
provide vital military information to senior leaders tasked with the security of their nation The
military networks to include decision briefs tasks and emails in Iraq and the Predator feeds in
Afghanistan travel through military and commercial satellites with all the information flowing
through the cyberspace domain With the heavy reliance of cyberspace to operate space assets
and the demands of information flowing through space by businesses it should come as no
surprise that space is a vital component for day-to-day operations of the military
Since cyberspace is an inherent component for space operations it is logical to assume
international law for outer space is applicable to cyberspace as long as an aggressor doesnt
violate the four premises and as long as weapons of mass destruction arenrsquot ldquostationed in outer
spacerdquo 28 Therefore a state would consider a cyber attack against a satellite as other than for
peaceful purposes and according to the fourth premise international law would apply
However what about a cyber attack using satellites as a means of conducting operations
Under todayrsquos current operations international elites havenrsquot considered a cyber attack passing
through space as a violation of international law When a senior leader in Qatar approves a
target set that is executed by a pilot in Nevada by an aircraft in Afghanistan all this information
is transmitted by cyberspace through space The result is that an aircraft renders an air or ground
target inoperable The effect is the same for cyberspace The information flows through space
by way of the cyberspace domain and the result is that an operator has rendered a target
11
AUACSCSinksAY08
inoperable As with airspace the information isnrsquot the cause of the damage but what an operator
does with the information is what constitutes the cyber attack
Land Cyber attacks using resources over land is relatively straightforward International
boundaries are defined as ldquoimaginary lines which separate territorial sovereigntyrdquo 29 which are
mutually agreed upon via international treaties Crossing an international border without
permission from the state is a violation of international law While an illegal immigrant crossing
a border to seek an opportunity to provide for his family is a violation of national law the United
Nation considers a nation-sponsored invasion of another nation that threatens the security and
stability of a nation as a breach in international law and an act of war
However international law doesnrsquot consider all border crossings as an act of war For
example when Nicaraguan troops and arms allegedly crossed the borders of El Salvador the
United Nations determined that incursions didnrsquot threaten El Salvadorrsquos territorial integrity and
stated that neither ldquothese incursions nor the alleged supply of arms may be relied upon as
justifying the exercise of the right of collective self-defenserdquo30 The victim state can repelled the
aggressive act but the United Nations Council wouldnrsquot condone any further military action
taken against the adversary opting for diplomatic or economic solution instead
Does international law apply when an adversary crosses international borders using
cyberspace as the means for conducting warfare operations When an adversarial state crosses a
statersquos boundaries using roads or bridges that connect the two nations the road is the resource
spanning the two nations If the adversary doesnrsquot do anything then returns to their sovereign
borders the aggressor hasnrsquot violated international law However when the adversary uses
weapon systems to affect serious damage the adversary has broken international law and a
12
AUACSCSinksAY08
nation may invoke their right for self-defense and may conduct full-scale operations to neutralize
the threat
A parallel notion is when an adversary uses a copper or fiber optic connection that spans
between two nations The adversary uses the land-based LAN connection as a means for
conducting cyber warfare operations The adversary may cross the borders using cyberspace yet
do nothing The affected state may push the adversary back to its borders but no further actions
are deemed appropriate However once the adversary uses the information transmitted over
cyberspace to cause severe operational or strategic damage the affected state now has the right
of self-defense Cyberspace is the means like the road or bridge for which the adversary
delivered the weapon The affected nation will consider the execution of the adversaryrsquos
information packet or weapon system as an act of aggression and the effect caused by the
weapon is what breeches international law
The difference between these two scenarios is that the adversary using the
electromagnetic spectrum hasnrsquot physically invaded a nationrsquos sovereign borders However
their digital presence crossed sovereign borders and as latter discussed in the paper adversaries
committing an act aggression against a state are now under the jurisdiction of the affected state
Sea ldquoThe territorial sea is a belt of sea adjacent to the (statersquos) coasthellipto include the airspace
aboverdquo as well as the seabed and subsoil31 The territorial sea is subject to the right of innocent
passage by foreign shops giving states the right to transport goods and passengers between ports
All of which is subject to the full sovereignty of the state which according to the United Nations
Convention on the Law of the Sea in 1982 and agreed upon by the majority of its membership in
1982 extends 12 miles from the coast32 The jurisdiction includes crimes where the
consequences extend to the coastal state and disturbs the peace of the country33 A cyber attack
13
AUACSCSinksAY08
conducted within the territorial sea of a nation would be no different from a cyber attack
conducted from within the nationrsquos land borders therefore cyber attacks against a state or even
another state conducted within the territorial seas are subject to current international laws Cyber
attacks originating outside the statersquos sovereign borders but results in affecting a statersquos
resources in their territorial seas would fall under the land and airspace breeches of territorial
sovereignty and would be subject to international law
The high seas on the other hand arenrsquot subject to the sovereignty of any one state The
high seas extend beyond the territorial sea and include the airspace the seabed and the subsoil34
and all states have the right to exercise freedoms on the high seas35 As similarly defined in
space ldquothe high seas shall be reserved for peaceful purposesrdquo as stated by Article 88 of the Law
of the Seas Cooperative36 which is defined as refraining from any threat or use of force (outside
of wartime conflicts)
The very nature of a cyber attack in the high seas lends itself to be a violation of
international law as nations are restricted to conducting peaceful operations in the high seas
The question is whom has jurisdiction of crimes committed in the high seas By applying the
Protective Security Principle of Jurisdiction where an actor threatens a statersquo security and
introducing the United Nationrsquos definition on the Illegal Use of Force extends to the high seas
and for that matter space giving states the right for self-defense as defined by the United Nations
as ldquoan armed attackrdquo The sheer name of cyber attack doesnrsquot immediately lend itself to an
ldquoarmedrdquo cyber attack However the effects generated from a cyber attack can be equivalent to a
traditional conventional attack and the international law would permit a state to take appropriate
countermeasures while notifying the United Nations Security Council37
14
AUACSCSinksAY08
Applying International Law to Cyber Warfare Today we live in an Information Age where communication through cyberspace has forever changed and flattened out worldhellipOur adversaries seek to operate from behind technical legal and international screens as they execute their costly attacks38
~General James E Cartwright Commander United States Strategic Command
Jurisdiction
Understanding the territorial sovereignty principles of a nation is important in applying
cyberspace and cyber warfare to existing international laws While some of these principles and
international laws may not be relevant for the cyberspace domain due to the far-reaching
capability of cyber warfare the jurisdiction of a nation further defines its ability to respond to
aggressive acts by nations in the cyberspace domain There are three jurisdictional principles
that provide nations the right to pursue aggressors that threaten a nationrsquos independence the
Territorial Principle Nationality Principle and the Protective Security Principle
For actions originating within the state the jurisdiction clearly falls within the territorial
principle where a ldquostate has jurisdiction over all crimes committed in its territoryhellipto include
airspace international waters and territorial seasrdquo39 The territorial jurisdiction is subject to
exceptions when dealing with persons from foreign states as in the most popular example of
immunity given to foreign diplomats In this case ldquostates may exercise jurisdiction over its
citizenhellipeven if they are physically outside the statesrsquo territoryrdquo as Doctor Boczek defines as the
Nationality Principle Nations usually agree upon on these concessions states prior to the offense
being committed40
Doctor Boczek defines the Protective Security Principle as a ldquojurisdictional principle
whereby a state my assume jurisdiction over and punish foreign nationals for certain conduct
outside its territory which is directed against its security territorial integrity and political
independencerdquo41 Some states would argue that criticism of a state or government is applicable
15
AUACSCSinksAY08
in applying this principle of jurisdiction However this is too broad of an interpretation and
should be confined to acts that are more tangible in nature like falsification of a statesrsquo official
documents conspiracy to violate immigration of custom laws and illicit drug trafficking42
Would a cyber attack that is deemed to challenge a nationrsquos banking community or bring
down a power source be a direct attack against its security and political independence The
international community easily sees the attack of a power source with kinetic weapons as a
violation of a territorial boundary and a breech of international law The United States viewed
the attack on the Trade Towers as an act of war launching the Global War on Terrorism Would
the United States have viewed the same devastation as if the attack occurred through cyberspace
Would the attack have been less of an act of war if the aggressor remotely controlled domestic
airliners from a foreign country Probably not What happens if the cyber attack caused a fire in
the lower floors of the buildings preventing people from escaping While less dramatic than an
airbus flying into the middle of the towers and maybe more difficult to demonize the crime the
result is the samemdashinnocent people suffering as a result of an adversary trying to threaten a
nationrsquos security
What happens if the suspected cyber attack has violated a nationrsquos territorial boundary in
order to attack a neighboring country or an ally Going from point A to point B in cyberspace is
rarely a direct connection As with the global nature of cyberspace itrsquos conceivable that
adversaries cross several nationsrsquo boundaries to conduct cyber attack operations The question
generated is who has jurisdiction
If the actor committing the crime had used an airplane each nation could claim
jurisdiction as the adversary violated their territorial boundaries and violated international law
More often than not the first state would have acted immediately upon the aggressive act and
16
AUACSCSinksAY08
would have prevented aggressors from completing their task by either forcing the aircraft to land
or turnaround or an even more escalated response of firing upon the aircraft In the air land or
sea the ability for a nationrsquos military forces to respond in a timely manner gives way to the
deterrence factor of not crossing a statersquos boundaries without receiving permission for fear of
reprisal A clear example of this was when Turkey denied the United States the ability deploy
the 4th Infantry Division from its borders at the beginning of Operation Iraqi Freedom Violating
Turkeyrsquos borders without permission would have brought about great repercussions that would
have made Operation Iraqi Freedom even more difficult and could have resulted in an escalation
of the war outside the Iraqi borders43 Another example is when Spain and France denied the
Unites States the use of their airspace when F-111s based in the United Kingdom conducted air
operations in Libya in an effort to eliminate Muammar Khadafy44
However the speeds at which these breeches in territorial boundaries occur make it
difficult for a nation to claim jurisdiction especially when nothing occurred within their
territorial sovereignty The cyber attacks didnrsquot result in any damage to nation as the information
packets passed through their sovereign borders According to territorial boundary description
described by Doctor Boczek the international community doesnrsquot consider the crossing the
border in of itself an act of warmdashserious damage is a driving factor in determining conflict
escalation In addition according to the territorial jurisdiction principle the cyber attack didnrsquot
threaten a nationrsquos security territorial integrity and political independence If the cyber attack or
information originated from within a sovereign territory by a third party then the two nations
would have to work together to resolve the issue and mutual jurisdiction would probably apply
However if the cyber attack didnrsquot physically manifest itself from within their sovereign
territory or the adversary didnrsquot use the nation as a staging area to launch a further attack the
17
AUACSCSinksAY08
international law and the jurisdiction principles would dictate the affected nation would have
jurisdiction
Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security
territorial integrity and political independence Cyberspace utilizes the other domains as a means
of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence
Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of
territorial sovereignty the Protective Security Principle does provide nations the ability to
enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos
sovereignty when it conducts cyber warfare operations However some elites donrsquot consider
cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense
International law specifically article 2 of the United Nations Charters states that a
members shall refrain in their international relations from the threat or use of force against the
territorial integrity or political independence of any state or in any other manner inconsistent
with the purposes of the United Nations which is intended to prohibit all types of force except
those carried out under the aegis of the United Nations or as provided for by the Security
Council45 The only exception to the United Nations Charters as it relates to the Use of Force is
the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed
attack46
International elites have discussed the term ldquouse of forcerdquo in the past because of the
development of chemical and biological weapons and had to move from a kinetic impact based
definition to a results-oriented approach47 Chemical and biological weapons lacked the
characteristic of an explosion or physical force yet these weapons certainly are capable of
destroying life and property Doctor Leigh Armistead a former information warfare instructor at
18
AUACSCSinksAY08
the Joint Forces Staff College cautions that the use of computer network attacks by the military
ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary
that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great
Russia introduced a proposal to the United Nations that banned the use of information
operations Even though the United Nations didnrsquot adopt the law the concern of international
community is fully aware of the impact cyber attacks can have on a nation
The concern over cyber warfare capabilities is that it can generate both non-kinetic and
kinetic effects There has always been the traditional kinetic solution for cyber warfare where a
precision guidance munition destroys a critical information system node Most people assume
computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos
computer system from the safety of onersquos own command and control center but the physical
destruction of a computer system or network by kinetic means also qualifies as cyber warfare
However cyber warfare has also evolved to the point where aggressors can achieve a kinetic
effect without the use of a traditional kinetic weapon A cyber attack on an information system
can shut down a particular node of a power plant causing the system to become inoperative
Even if there wasnrsquot an explosion the attack serves the same purpose
The question raised is do cyber attacks constitute an armed attack Scholars do agree that
some cyber attacks fit comfortably within the United Nations Charter For example a strategic
level cyber attack causing widespread damage and significant casualties would trigger the statersquos
right of self-defense In addition a cyber attack that precluded a conventional attack or a series
of cyber attacks causing significant damage would give a state the right of self-defense49 Few
would dispute that a country has the right under international law to respond with military force
19
AUACSCSinksAY08
if a state destroyed or significantly damaged another nationrsquos economic system for example the
New York or London stock exchanges
However some confusion and state-defined interpretation comes into play when the
frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard
Law School argues that cyber attacks require an expansion of the definition on the ldquouse of
forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot
be prohibited by international law50 International scholars recommend ldquoclearer rules of what
kinds of information warfare actions constitute an armed attackrdquo which drives permissible
responses of self-defense51 For example a state-sponsored cyber attack causes damage to a
victimrsquos factory or power plant however the nation claims the incident is an isolated instance
and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under
the United Nations Charter and the United Nations would consider any response retaliation
which would violate international law52
Another example involves a nation conducting a series of small attacks causing minimal
damage and then ceases Even though the aggressor used force to conduct cyber warfare
operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under
the United Nations Charter This type of attack is analogues to a small band of troops crossing a
border without causing significant damage53 According to the United Nations Charter the
national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders
and respond to the use of force Repelling the small band of troops and reestablishing their
sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration
of war and allies would have to respect the United Nations decision and couldnrsquot intervene The
same is true for the cyber attack A state can employ defensive measure to isolate and defeat the
20
AUACSCSinksAY08
incursion over the electromagnetic spectrum However the United Nations would see further
offensive operations or invasive operations as retaliation Therefore a nation must take the
incident whether it is signs of conventional forces on the ground or traces of cyber warfare
incursions in the electromagnetic spectrum to the United Nations to seek restitution
In both of these situations the international law becomes the target for change not
whether cyber warfare is in violation of international law If the law were to change the
international community would then consider the above situations acts of war even if an
adversary used conventional forces As written today the result of an operation remains the
driving factor in determining if an adversary has violated international law The means by which
an adversary conducts military operations may affect how nations react to the situation but
whether an adversary conducts the operation by means of the air land sea space or cyberspace
doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian
Triggs a public international lawyer and member of the Attorney General International Legal
Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over
offences abroad having an intended and substantial effect within a state may be justifiedrdquo54
Therefore the international community must evaluate the effect of a criminal act rather than the
means in which the act was committed
Others claim that because the Internet takes advantages of legal norms where non-state
actors can ignore Western notions of law55 more international laws are needed for cyberspace
However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using
other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the
Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked
aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts
21
AUACSCSinksAY08
against a staterdquo in the cyberspace domain The anonymity of the Internet and their total
disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and
national laws already exist in most countries that prohibit the use of the Internet for terrorist
activities therefore additional international laws wouldnrsquot prevent or deter terrorist from
committing such acts of aggression
International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed
Conflict includes the Martens Clause which extends established custom and humanitarian
principles to new technologies and addresses the ever-changing nature of warfare The
international community designed The Martens Clause ldquoto prevent future unnecessary andor
disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges
crimes by invoking the laws of humanity and public conscience hence their effects and not its
methods
The basic legal premise behind Law of Armed Conflict is that attacks must be limited to
military objectives and collateral damage must be proportionate to military advantages and
forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary
suffering but military commanders and planners need to be aware of the results a particular
action will invoke Russian leadership believes a computer network attack against their
homeland can be a means for executing a variety of escalating responses to include nuclear
attack58 Therefore it is imperative military commanders understand the impact any weapon
system can have on an adversary not just cyber attacks
Not all scholars agree that international law is insufficient to govern cyber warfare
Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace
and the Use of Force states that computer network attacks constitute an unlawful use of force in
22
AUACSCSinksAY08
cyberspace under traditional international law Sharp declared that an armed attack may occur
ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a
way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive
definition of cyber attacks may never be drafted59 The Congressional Research Service also
concluded that ldquothere is little likelihood that the international community will soon generate a
coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations
on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos
conclusion is that the effects of cyber warfare operations are the same as if an adversary
conducted conventional warfare operations where the effect of the attacks are the driving factors
in determining whether an adversary used force or not
The United States Government agrees with Sharprsquos conclusion The offensive
Information Operation strategy for the United States government as described by Doctor
Armistead ties the tools used to conduct military operations back to the desired effect which is
in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning
effects-based operations and operational art focus the Joint Force Commanderrsquos course of action
towards meeting objectives outlined in guidance provided by the National Command Authority
and senior military leadership62 Whether the tools are dropped pamphlets invasive network
attacks or bombs on targets the goal is to produce a desired effect to achieve the overall
objectives and cyber warfare can produce effects that challenge the national security of a nation
Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63
~General T Michael Moseley USAF
23
AUACSCSinksAY08
The cyberspace domain has been around for quite sometime but as technology continues
to advance businesses as well as governmental organizations are becoming more reliant on the
cyberspace domain With that reliance the protection of this critical domain becomes even more
important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the
electromagnetic spectrum by denying and disrupting information demands Scholars claim that
protection needs to include addressing existing international laws expanding them to incorporate
the ever-advancing capabilities emerging in the cyberspace domain
However territorial sovereignty of a nation and the principles of jurisdiction specifically
the Protective Security Principle give nations the right to exercise jurisdiction when an
aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64
While cyberspace is a domain requiring specific attention it relies on assets in the other domains
of land space sea and air in order to operate and international laws for the linear domains do
exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace
but during cyber warfare operations the principles behind the restrictions of foreign military
entering airspace do apply The strategic nature of cyber warfare operations correspond to the
same strategic impact that airpower can inflict upon a nation threatening their independence
While maybe not as dramatic as kinetic effects the results can be just as devastating
Space is relatively straightforward Since a nation canrsquot claim space and over flights of
foreign satellites over a nation is permissible nations must use space for peaceful purposes
Kinetic attacks against space assets are a violation of international law therefore nations would
consider cyber warfare operations against space assets as other than peaceful purposes and a
violation of international law Cyber attacks traversing space assets relate to current military
operations where the military uses space assets to conduct kinetic operations Since international
24
AUACSCSinksAY08
elites havenrsquot considered these kinetic operations as a breach of international law military
commanders can conduct cyber warfare operations through space without fear of violating
international laws for outer space
Crossing international borders without a nationrsquos permission and threatening their
sovereignty is a violation of international law While nations canrsquot consider all border crossings
as an act of war those acts of aggression that threaten the territorial integrity would elicit a
defensive response by the victim nation Whether incursions involve combat vehicles over a
highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are
threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not
have set foot in the nation but according the Protective Security Principle the victim nation has
jurisdiction
Conducting cyber warfare operations from the territorial sea is no different from
conducting operations from within a nationrsquos land or sea borders However the high seas are
very similar in nature to space in that they are reserved for peaceful purposes Therefore
conducting any means of warfare from within the high seas is a violation of international law
and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-
defense
According to Barkham ldquoinformation warfare attacks are in essence territorial
penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then
subject to the jurisdiction of the victim nation who then has the right for self-defense However
due to the global nature of cyberspace aggressors can cross multiple borders and determining
who has jurisdiction demands cooperation among nations The origin and any deliberate staging
locations of the cyber attack will drive who has jurisdiction The crossing of third party borders
25
AUACSCSinksAY08
by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the
aggressors threaten a nationrsquos independence or territorial integrity
Scholars consider cyber warfare operations that involve strategic and operational impacts
as being a means of using force and fall within the legal regime of existing international law
However scholars argue that because cyber warfare includes kinetic and non-kinetic results the
Use of Force definition needs expanding Yet they conclude that an exhaustive definition of
cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare
operations against existing case studies where the effects are evaluated as opposed to the means
even if the operations originated from outside the nationrsquos territorial jurisdiction There is some
authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to
have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade
non-state actors from conducting cyber warfare operations given their willingness to ignore
Western notions of war and their ability to conduct operations anonymously in cyberspace
International laws are in place to that address the ever-changing nature of warfare The
Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a
framework for addressing all warfare to include cyber warfare operations The international
community will need to measure the effects of an operation rather the means Whether its boots
on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a
nationrsquos response
26
AUACSCSinksAY08
End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)
27
AUACSCSinksAY08
44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
28
AUACSCSinksAY08
Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005
Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department
American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)
Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983
Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988
Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)
Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)
IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)
Joint Publication 3-13 Information Operations 13 February 2006
Joint Publication 5-0 Joint Operations Planning 26 December 2006
Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies
Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc
Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College
Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)
Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press
29
AUACSCSinksAY08
Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI
Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)
Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press
Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company
Detter Delupis I The law of war (2000) New York NY Cambridge University Press
Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)
Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College
Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor
Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)
Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)
Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf
Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)
Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College
Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College
Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)
Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA
30
AUACSCSinksAY08
Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)
Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)
Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College
Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology
Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College
Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)
OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center
OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College
OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications
Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991
Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College
Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center
Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)
31
AUACSCSinksAY08
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press
Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA
Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University
Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor
Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661
Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office
Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis
United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC
United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center
Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College
Wesley David C The Military Commander and the Law 2006
32
AUACSCSinksAY08
The military uses space assets for intelligence surveillance and reconnaissance
knowledge management and command and control Agencies like the National Reconnaissance
Office and National Geospatial-Intelligence Agency obtain high-altitude imagery using a variety
of capabilities to include heat signature resonation Satellites can detect missile launches which
provide vital military information to senior leaders tasked with the security of their nation The
military networks to include decision briefs tasks and emails in Iraq and the Predator feeds in
Afghanistan travel through military and commercial satellites with all the information flowing
through the cyberspace domain With the heavy reliance of cyberspace to operate space assets
and the demands of information flowing through space by businesses it should come as no
surprise that space is a vital component for day-to-day operations of the military
Since cyberspace is an inherent component for space operations it is logical to assume
international law for outer space is applicable to cyberspace as long as an aggressor doesnt
violate the four premises and as long as weapons of mass destruction arenrsquot ldquostationed in outer
spacerdquo 28 Therefore a state would consider a cyber attack against a satellite as other than for
peaceful purposes and according to the fourth premise international law would apply
However what about a cyber attack using satellites as a means of conducting operations
Under todayrsquos current operations international elites havenrsquot considered a cyber attack passing
through space as a violation of international law When a senior leader in Qatar approves a
target set that is executed by a pilot in Nevada by an aircraft in Afghanistan all this information
is transmitted by cyberspace through space The result is that an aircraft renders an air or ground
target inoperable The effect is the same for cyberspace The information flows through space
by way of the cyberspace domain and the result is that an operator has rendered a target
11
AUACSCSinksAY08
inoperable As with airspace the information isnrsquot the cause of the damage but what an operator
does with the information is what constitutes the cyber attack
Land Cyber attacks using resources over land is relatively straightforward International
boundaries are defined as ldquoimaginary lines which separate territorial sovereigntyrdquo 29 which are
mutually agreed upon via international treaties Crossing an international border without
permission from the state is a violation of international law While an illegal immigrant crossing
a border to seek an opportunity to provide for his family is a violation of national law the United
Nation considers a nation-sponsored invasion of another nation that threatens the security and
stability of a nation as a breach in international law and an act of war
However international law doesnrsquot consider all border crossings as an act of war For
example when Nicaraguan troops and arms allegedly crossed the borders of El Salvador the
United Nations determined that incursions didnrsquot threaten El Salvadorrsquos territorial integrity and
stated that neither ldquothese incursions nor the alleged supply of arms may be relied upon as
justifying the exercise of the right of collective self-defenserdquo30 The victim state can repelled the
aggressive act but the United Nations Council wouldnrsquot condone any further military action
taken against the adversary opting for diplomatic or economic solution instead
Does international law apply when an adversary crosses international borders using
cyberspace as the means for conducting warfare operations When an adversarial state crosses a
statersquos boundaries using roads or bridges that connect the two nations the road is the resource
spanning the two nations If the adversary doesnrsquot do anything then returns to their sovereign
borders the aggressor hasnrsquot violated international law However when the adversary uses
weapon systems to affect serious damage the adversary has broken international law and a
12
AUACSCSinksAY08
nation may invoke their right for self-defense and may conduct full-scale operations to neutralize
the threat
A parallel notion is when an adversary uses a copper or fiber optic connection that spans
between two nations The adversary uses the land-based LAN connection as a means for
conducting cyber warfare operations The adversary may cross the borders using cyberspace yet
do nothing The affected state may push the adversary back to its borders but no further actions
are deemed appropriate However once the adversary uses the information transmitted over
cyberspace to cause severe operational or strategic damage the affected state now has the right
of self-defense Cyberspace is the means like the road or bridge for which the adversary
delivered the weapon The affected nation will consider the execution of the adversaryrsquos
information packet or weapon system as an act of aggression and the effect caused by the
weapon is what breeches international law
The difference between these two scenarios is that the adversary using the
electromagnetic spectrum hasnrsquot physically invaded a nationrsquos sovereign borders However
their digital presence crossed sovereign borders and as latter discussed in the paper adversaries
committing an act aggression against a state are now under the jurisdiction of the affected state
Sea ldquoThe territorial sea is a belt of sea adjacent to the (statersquos) coasthellipto include the airspace
aboverdquo as well as the seabed and subsoil31 The territorial sea is subject to the right of innocent
passage by foreign shops giving states the right to transport goods and passengers between ports
All of which is subject to the full sovereignty of the state which according to the United Nations
Convention on the Law of the Sea in 1982 and agreed upon by the majority of its membership in
1982 extends 12 miles from the coast32 The jurisdiction includes crimes where the
consequences extend to the coastal state and disturbs the peace of the country33 A cyber attack
13
AUACSCSinksAY08
conducted within the territorial sea of a nation would be no different from a cyber attack
conducted from within the nationrsquos land borders therefore cyber attacks against a state or even
another state conducted within the territorial seas are subject to current international laws Cyber
attacks originating outside the statersquos sovereign borders but results in affecting a statersquos
resources in their territorial seas would fall under the land and airspace breeches of territorial
sovereignty and would be subject to international law
The high seas on the other hand arenrsquot subject to the sovereignty of any one state The
high seas extend beyond the territorial sea and include the airspace the seabed and the subsoil34
and all states have the right to exercise freedoms on the high seas35 As similarly defined in
space ldquothe high seas shall be reserved for peaceful purposesrdquo as stated by Article 88 of the Law
of the Seas Cooperative36 which is defined as refraining from any threat or use of force (outside
of wartime conflicts)
The very nature of a cyber attack in the high seas lends itself to be a violation of
international law as nations are restricted to conducting peaceful operations in the high seas
The question is whom has jurisdiction of crimes committed in the high seas By applying the
Protective Security Principle of Jurisdiction where an actor threatens a statersquo security and
introducing the United Nationrsquos definition on the Illegal Use of Force extends to the high seas
and for that matter space giving states the right for self-defense as defined by the United Nations
as ldquoan armed attackrdquo The sheer name of cyber attack doesnrsquot immediately lend itself to an
ldquoarmedrdquo cyber attack However the effects generated from a cyber attack can be equivalent to a
traditional conventional attack and the international law would permit a state to take appropriate
countermeasures while notifying the United Nations Security Council37
14
AUACSCSinksAY08
Applying International Law to Cyber Warfare Today we live in an Information Age where communication through cyberspace has forever changed and flattened out worldhellipOur adversaries seek to operate from behind technical legal and international screens as they execute their costly attacks38
~General James E Cartwright Commander United States Strategic Command
Jurisdiction
Understanding the territorial sovereignty principles of a nation is important in applying
cyberspace and cyber warfare to existing international laws While some of these principles and
international laws may not be relevant for the cyberspace domain due to the far-reaching
capability of cyber warfare the jurisdiction of a nation further defines its ability to respond to
aggressive acts by nations in the cyberspace domain There are three jurisdictional principles
that provide nations the right to pursue aggressors that threaten a nationrsquos independence the
Territorial Principle Nationality Principle and the Protective Security Principle
For actions originating within the state the jurisdiction clearly falls within the territorial
principle where a ldquostate has jurisdiction over all crimes committed in its territoryhellipto include
airspace international waters and territorial seasrdquo39 The territorial jurisdiction is subject to
exceptions when dealing with persons from foreign states as in the most popular example of
immunity given to foreign diplomats In this case ldquostates may exercise jurisdiction over its
citizenhellipeven if they are physically outside the statesrsquo territoryrdquo as Doctor Boczek defines as the
Nationality Principle Nations usually agree upon on these concessions states prior to the offense
being committed40
Doctor Boczek defines the Protective Security Principle as a ldquojurisdictional principle
whereby a state my assume jurisdiction over and punish foreign nationals for certain conduct
outside its territory which is directed against its security territorial integrity and political
independencerdquo41 Some states would argue that criticism of a state or government is applicable
15
AUACSCSinksAY08
in applying this principle of jurisdiction However this is too broad of an interpretation and
should be confined to acts that are more tangible in nature like falsification of a statesrsquo official
documents conspiracy to violate immigration of custom laws and illicit drug trafficking42
Would a cyber attack that is deemed to challenge a nationrsquos banking community or bring
down a power source be a direct attack against its security and political independence The
international community easily sees the attack of a power source with kinetic weapons as a
violation of a territorial boundary and a breech of international law The United States viewed
the attack on the Trade Towers as an act of war launching the Global War on Terrorism Would
the United States have viewed the same devastation as if the attack occurred through cyberspace
Would the attack have been less of an act of war if the aggressor remotely controlled domestic
airliners from a foreign country Probably not What happens if the cyber attack caused a fire in
the lower floors of the buildings preventing people from escaping While less dramatic than an
airbus flying into the middle of the towers and maybe more difficult to demonize the crime the
result is the samemdashinnocent people suffering as a result of an adversary trying to threaten a
nationrsquos security
What happens if the suspected cyber attack has violated a nationrsquos territorial boundary in
order to attack a neighboring country or an ally Going from point A to point B in cyberspace is
rarely a direct connection As with the global nature of cyberspace itrsquos conceivable that
adversaries cross several nationsrsquo boundaries to conduct cyber attack operations The question
generated is who has jurisdiction
If the actor committing the crime had used an airplane each nation could claim
jurisdiction as the adversary violated their territorial boundaries and violated international law
More often than not the first state would have acted immediately upon the aggressive act and
16
AUACSCSinksAY08
would have prevented aggressors from completing their task by either forcing the aircraft to land
or turnaround or an even more escalated response of firing upon the aircraft In the air land or
sea the ability for a nationrsquos military forces to respond in a timely manner gives way to the
deterrence factor of not crossing a statersquos boundaries without receiving permission for fear of
reprisal A clear example of this was when Turkey denied the United States the ability deploy
the 4th Infantry Division from its borders at the beginning of Operation Iraqi Freedom Violating
Turkeyrsquos borders without permission would have brought about great repercussions that would
have made Operation Iraqi Freedom even more difficult and could have resulted in an escalation
of the war outside the Iraqi borders43 Another example is when Spain and France denied the
Unites States the use of their airspace when F-111s based in the United Kingdom conducted air
operations in Libya in an effort to eliminate Muammar Khadafy44
However the speeds at which these breeches in territorial boundaries occur make it
difficult for a nation to claim jurisdiction especially when nothing occurred within their
territorial sovereignty The cyber attacks didnrsquot result in any damage to nation as the information
packets passed through their sovereign borders According to territorial boundary description
described by Doctor Boczek the international community doesnrsquot consider the crossing the
border in of itself an act of warmdashserious damage is a driving factor in determining conflict
escalation In addition according to the territorial jurisdiction principle the cyber attack didnrsquot
threaten a nationrsquos security territorial integrity and political independence If the cyber attack or
information originated from within a sovereign territory by a third party then the two nations
would have to work together to resolve the issue and mutual jurisdiction would probably apply
However if the cyber attack didnrsquot physically manifest itself from within their sovereign
territory or the adversary didnrsquot use the nation as a staging area to launch a further attack the
17
AUACSCSinksAY08
international law and the jurisdiction principles would dictate the affected nation would have
jurisdiction
Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security
territorial integrity and political independence Cyberspace utilizes the other domains as a means
of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence
Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of
territorial sovereignty the Protective Security Principle does provide nations the ability to
enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos
sovereignty when it conducts cyber warfare operations However some elites donrsquot consider
cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense
International law specifically article 2 of the United Nations Charters states that a
members shall refrain in their international relations from the threat or use of force against the
territorial integrity or political independence of any state or in any other manner inconsistent
with the purposes of the United Nations which is intended to prohibit all types of force except
those carried out under the aegis of the United Nations or as provided for by the Security
Council45 The only exception to the United Nations Charters as it relates to the Use of Force is
the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed
attack46
International elites have discussed the term ldquouse of forcerdquo in the past because of the
development of chemical and biological weapons and had to move from a kinetic impact based
definition to a results-oriented approach47 Chemical and biological weapons lacked the
characteristic of an explosion or physical force yet these weapons certainly are capable of
destroying life and property Doctor Leigh Armistead a former information warfare instructor at
18
AUACSCSinksAY08
the Joint Forces Staff College cautions that the use of computer network attacks by the military
ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary
that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great
Russia introduced a proposal to the United Nations that banned the use of information
operations Even though the United Nations didnrsquot adopt the law the concern of international
community is fully aware of the impact cyber attacks can have on a nation
The concern over cyber warfare capabilities is that it can generate both non-kinetic and
kinetic effects There has always been the traditional kinetic solution for cyber warfare where a
precision guidance munition destroys a critical information system node Most people assume
computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos
computer system from the safety of onersquos own command and control center but the physical
destruction of a computer system or network by kinetic means also qualifies as cyber warfare
However cyber warfare has also evolved to the point where aggressors can achieve a kinetic
effect without the use of a traditional kinetic weapon A cyber attack on an information system
can shut down a particular node of a power plant causing the system to become inoperative
Even if there wasnrsquot an explosion the attack serves the same purpose
The question raised is do cyber attacks constitute an armed attack Scholars do agree that
some cyber attacks fit comfortably within the United Nations Charter For example a strategic
level cyber attack causing widespread damage and significant casualties would trigger the statersquos
right of self-defense In addition a cyber attack that precluded a conventional attack or a series
of cyber attacks causing significant damage would give a state the right of self-defense49 Few
would dispute that a country has the right under international law to respond with military force
19
AUACSCSinksAY08
if a state destroyed or significantly damaged another nationrsquos economic system for example the
New York or London stock exchanges
However some confusion and state-defined interpretation comes into play when the
frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard
Law School argues that cyber attacks require an expansion of the definition on the ldquouse of
forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot
be prohibited by international law50 International scholars recommend ldquoclearer rules of what
kinds of information warfare actions constitute an armed attackrdquo which drives permissible
responses of self-defense51 For example a state-sponsored cyber attack causes damage to a
victimrsquos factory or power plant however the nation claims the incident is an isolated instance
and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under
the United Nations Charter and the United Nations would consider any response retaliation
which would violate international law52
Another example involves a nation conducting a series of small attacks causing minimal
damage and then ceases Even though the aggressor used force to conduct cyber warfare
operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under
the United Nations Charter This type of attack is analogues to a small band of troops crossing a
border without causing significant damage53 According to the United Nations Charter the
national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders
and respond to the use of force Repelling the small band of troops and reestablishing their
sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration
of war and allies would have to respect the United Nations decision and couldnrsquot intervene The
same is true for the cyber attack A state can employ defensive measure to isolate and defeat the
20
AUACSCSinksAY08
incursion over the electromagnetic spectrum However the United Nations would see further
offensive operations or invasive operations as retaliation Therefore a nation must take the
incident whether it is signs of conventional forces on the ground or traces of cyber warfare
incursions in the electromagnetic spectrum to the United Nations to seek restitution
In both of these situations the international law becomes the target for change not
whether cyber warfare is in violation of international law If the law were to change the
international community would then consider the above situations acts of war even if an
adversary used conventional forces As written today the result of an operation remains the
driving factor in determining if an adversary has violated international law The means by which
an adversary conducts military operations may affect how nations react to the situation but
whether an adversary conducts the operation by means of the air land sea space or cyberspace
doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian
Triggs a public international lawyer and member of the Attorney General International Legal
Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over
offences abroad having an intended and substantial effect within a state may be justifiedrdquo54
Therefore the international community must evaluate the effect of a criminal act rather than the
means in which the act was committed
Others claim that because the Internet takes advantages of legal norms where non-state
actors can ignore Western notions of law55 more international laws are needed for cyberspace
However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using
other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the
Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked
aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts
21
AUACSCSinksAY08
against a staterdquo in the cyberspace domain The anonymity of the Internet and their total
disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and
national laws already exist in most countries that prohibit the use of the Internet for terrorist
activities therefore additional international laws wouldnrsquot prevent or deter terrorist from
committing such acts of aggression
International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed
Conflict includes the Martens Clause which extends established custom and humanitarian
principles to new technologies and addresses the ever-changing nature of warfare The
international community designed The Martens Clause ldquoto prevent future unnecessary andor
disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges
crimes by invoking the laws of humanity and public conscience hence their effects and not its
methods
The basic legal premise behind Law of Armed Conflict is that attacks must be limited to
military objectives and collateral damage must be proportionate to military advantages and
forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary
suffering but military commanders and planners need to be aware of the results a particular
action will invoke Russian leadership believes a computer network attack against their
homeland can be a means for executing a variety of escalating responses to include nuclear
attack58 Therefore it is imperative military commanders understand the impact any weapon
system can have on an adversary not just cyber attacks
Not all scholars agree that international law is insufficient to govern cyber warfare
Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace
and the Use of Force states that computer network attacks constitute an unlawful use of force in
22
AUACSCSinksAY08
cyberspace under traditional international law Sharp declared that an armed attack may occur
ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a
way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive
definition of cyber attacks may never be drafted59 The Congressional Research Service also
concluded that ldquothere is little likelihood that the international community will soon generate a
coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations
on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos
conclusion is that the effects of cyber warfare operations are the same as if an adversary
conducted conventional warfare operations where the effect of the attacks are the driving factors
in determining whether an adversary used force or not
The United States Government agrees with Sharprsquos conclusion The offensive
Information Operation strategy for the United States government as described by Doctor
Armistead ties the tools used to conduct military operations back to the desired effect which is
in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning
effects-based operations and operational art focus the Joint Force Commanderrsquos course of action
towards meeting objectives outlined in guidance provided by the National Command Authority
and senior military leadership62 Whether the tools are dropped pamphlets invasive network
attacks or bombs on targets the goal is to produce a desired effect to achieve the overall
objectives and cyber warfare can produce effects that challenge the national security of a nation
Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63
~General T Michael Moseley USAF
23
AUACSCSinksAY08
The cyberspace domain has been around for quite sometime but as technology continues
to advance businesses as well as governmental organizations are becoming more reliant on the
cyberspace domain With that reliance the protection of this critical domain becomes even more
important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the
electromagnetic spectrum by denying and disrupting information demands Scholars claim that
protection needs to include addressing existing international laws expanding them to incorporate
the ever-advancing capabilities emerging in the cyberspace domain
However territorial sovereignty of a nation and the principles of jurisdiction specifically
the Protective Security Principle give nations the right to exercise jurisdiction when an
aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64
While cyberspace is a domain requiring specific attention it relies on assets in the other domains
of land space sea and air in order to operate and international laws for the linear domains do
exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace
but during cyber warfare operations the principles behind the restrictions of foreign military
entering airspace do apply The strategic nature of cyber warfare operations correspond to the
same strategic impact that airpower can inflict upon a nation threatening their independence
While maybe not as dramatic as kinetic effects the results can be just as devastating
Space is relatively straightforward Since a nation canrsquot claim space and over flights of
foreign satellites over a nation is permissible nations must use space for peaceful purposes
Kinetic attacks against space assets are a violation of international law therefore nations would
consider cyber warfare operations against space assets as other than peaceful purposes and a
violation of international law Cyber attacks traversing space assets relate to current military
operations where the military uses space assets to conduct kinetic operations Since international
24
AUACSCSinksAY08
elites havenrsquot considered these kinetic operations as a breach of international law military
commanders can conduct cyber warfare operations through space without fear of violating
international laws for outer space
Crossing international borders without a nationrsquos permission and threatening their
sovereignty is a violation of international law While nations canrsquot consider all border crossings
as an act of war those acts of aggression that threaten the territorial integrity would elicit a
defensive response by the victim nation Whether incursions involve combat vehicles over a
highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are
threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not
have set foot in the nation but according the Protective Security Principle the victim nation has
jurisdiction
Conducting cyber warfare operations from the territorial sea is no different from
conducting operations from within a nationrsquos land or sea borders However the high seas are
very similar in nature to space in that they are reserved for peaceful purposes Therefore
conducting any means of warfare from within the high seas is a violation of international law
and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-
defense
According to Barkham ldquoinformation warfare attacks are in essence territorial
penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then
subject to the jurisdiction of the victim nation who then has the right for self-defense However
due to the global nature of cyberspace aggressors can cross multiple borders and determining
who has jurisdiction demands cooperation among nations The origin and any deliberate staging
locations of the cyber attack will drive who has jurisdiction The crossing of third party borders
25
AUACSCSinksAY08
by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the
aggressors threaten a nationrsquos independence or territorial integrity
Scholars consider cyber warfare operations that involve strategic and operational impacts
as being a means of using force and fall within the legal regime of existing international law
However scholars argue that because cyber warfare includes kinetic and non-kinetic results the
Use of Force definition needs expanding Yet they conclude that an exhaustive definition of
cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare
operations against existing case studies where the effects are evaluated as opposed to the means
even if the operations originated from outside the nationrsquos territorial jurisdiction There is some
authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to
have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade
non-state actors from conducting cyber warfare operations given their willingness to ignore
Western notions of war and their ability to conduct operations anonymously in cyberspace
International laws are in place to that address the ever-changing nature of warfare The
Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a
framework for addressing all warfare to include cyber warfare operations The international
community will need to measure the effects of an operation rather the means Whether its boots
on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a
nationrsquos response
26
AUACSCSinksAY08
End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)
27
AUACSCSinksAY08
44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
28
AUACSCSinksAY08
Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005
Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department
American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)
Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983
Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988
Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)
Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)
IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)
Joint Publication 3-13 Information Operations 13 February 2006
Joint Publication 5-0 Joint Operations Planning 26 December 2006
Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies
Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc
Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College
Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)
Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press
29
AUACSCSinksAY08
Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI
Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)
Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press
Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company
Detter Delupis I The law of war (2000) New York NY Cambridge University Press
Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)
Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College
Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor
Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)
Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)
Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf
Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)
Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College
Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College
Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)
Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA
30
AUACSCSinksAY08
Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)
Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)
Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College
Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology
Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College
Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)
OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center
OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College
OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications
Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991
Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College
Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center
Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)
31
AUACSCSinksAY08
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press
Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA
Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University
Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor
Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661
Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office
Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis
United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC
United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center
Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College
Wesley David C The Military Commander and the Law 2006
32
AUACSCSinksAY08
inoperable As with airspace the information isnrsquot the cause of the damage but what an operator
does with the information is what constitutes the cyber attack
Land Cyber attacks using resources over land is relatively straightforward International
boundaries are defined as ldquoimaginary lines which separate territorial sovereigntyrdquo 29 which are
mutually agreed upon via international treaties Crossing an international border without
permission from the state is a violation of international law While an illegal immigrant crossing
a border to seek an opportunity to provide for his family is a violation of national law the United
Nation considers a nation-sponsored invasion of another nation that threatens the security and
stability of a nation as a breach in international law and an act of war
However international law doesnrsquot consider all border crossings as an act of war For
example when Nicaraguan troops and arms allegedly crossed the borders of El Salvador the
United Nations determined that incursions didnrsquot threaten El Salvadorrsquos territorial integrity and
stated that neither ldquothese incursions nor the alleged supply of arms may be relied upon as
justifying the exercise of the right of collective self-defenserdquo30 The victim state can repelled the
aggressive act but the United Nations Council wouldnrsquot condone any further military action
taken against the adversary opting for diplomatic or economic solution instead
Does international law apply when an adversary crosses international borders using
cyberspace as the means for conducting warfare operations When an adversarial state crosses a
statersquos boundaries using roads or bridges that connect the two nations the road is the resource
spanning the two nations If the adversary doesnrsquot do anything then returns to their sovereign
borders the aggressor hasnrsquot violated international law However when the adversary uses
weapon systems to affect serious damage the adversary has broken international law and a
12
AUACSCSinksAY08
nation may invoke their right for self-defense and may conduct full-scale operations to neutralize
the threat
A parallel notion is when an adversary uses a copper or fiber optic connection that spans
between two nations The adversary uses the land-based LAN connection as a means for
conducting cyber warfare operations The adversary may cross the borders using cyberspace yet
do nothing The affected state may push the adversary back to its borders but no further actions
are deemed appropriate However once the adversary uses the information transmitted over
cyberspace to cause severe operational or strategic damage the affected state now has the right
of self-defense Cyberspace is the means like the road or bridge for which the adversary
delivered the weapon The affected nation will consider the execution of the adversaryrsquos
information packet or weapon system as an act of aggression and the effect caused by the
weapon is what breeches international law
The difference between these two scenarios is that the adversary using the
electromagnetic spectrum hasnrsquot physically invaded a nationrsquos sovereign borders However
their digital presence crossed sovereign borders and as latter discussed in the paper adversaries
committing an act aggression against a state are now under the jurisdiction of the affected state
Sea ldquoThe territorial sea is a belt of sea adjacent to the (statersquos) coasthellipto include the airspace
aboverdquo as well as the seabed and subsoil31 The territorial sea is subject to the right of innocent
passage by foreign shops giving states the right to transport goods and passengers between ports
All of which is subject to the full sovereignty of the state which according to the United Nations
Convention on the Law of the Sea in 1982 and agreed upon by the majority of its membership in
1982 extends 12 miles from the coast32 The jurisdiction includes crimes where the
consequences extend to the coastal state and disturbs the peace of the country33 A cyber attack
13
AUACSCSinksAY08
conducted within the territorial sea of a nation would be no different from a cyber attack
conducted from within the nationrsquos land borders therefore cyber attacks against a state or even
another state conducted within the territorial seas are subject to current international laws Cyber
attacks originating outside the statersquos sovereign borders but results in affecting a statersquos
resources in their territorial seas would fall under the land and airspace breeches of territorial
sovereignty and would be subject to international law
The high seas on the other hand arenrsquot subject to the sovereignty of any one state The
high seas extend beyond the territorial sea and include the airspace the seabed and the subsoil34
and all states have the right to exercise freedoms on the high seas35 As similarly defined in
space ldquothe high seas shall be reserved for peaceful purposesrdquo as stated by Article 88 of the Law
of the Seas Cooperative36 which is defined as refraining from any threat or use of force (outside
of wartime conflicts)
The very nature of a cyber attack in the high seas lends itself to be a violation of
international law as nations are restricted to conducting peaceful operations in the high seas
The question is whom has jurisdiction of crimes committed in the high seas By applying the
Protective Security Principle of Jurisdiction where an actor threatens a statersquo security and
introducing the United Nationrsquos definition on the Illegal Use of Force extends to the high seas
and for that matter space giving states the right for self-defense as defined by the United Nations
as ldquoan armed attackrdquo The sheer name of cyber attack doesnrsquot immediately lend itself to an
ldquoarmedrdquo cyber attack However the effects generated from a cyber attack can be equivalent to a
traditional conventional attack and the international law would permit a state to take appropriate
countermeasures while notifying the United Nations Security Council37
14
AUACSCSinksAY08
Applying International Law to Cyber Warfare Today we live in an Information Age where communication through cyberspace has forever changed and flattened out worldhellipOur adversaries seek to operate from behind technical legal and international screens as they execute their costly attacks38
~General James E Cartwright Commander United States Strategic Command
Jurisdiction
Understanding the territorial sovereignty principles of a nation is important in applying
cyberspace and cyber warfare to existing international laws While some of these principles and
international laws may not be relevant for the cyberspace domain due to the far-reaching
capability of cyber warfare the jurisdiction of a nation further defines its ability to respond to
aggressive acts by nations in the cyberspace domain There are three jurisdictional principles
that provide nations the right to pursue aggressors that threaten a nationrsquos independence the
Territorial Principle Nationality Principle and the Protective Security Principle
For actions originating within the state the jurisdiction clearly falls within the territorial
principle where a ldquostate has jurisdiction over all crimes committed in its territoryhellipto include
airspace international waters and territorial seasrdquo39 The territorial jurisdiction is subject to
exceptions when dealing with persons from foreign states as in the most popular example of
immunity given to foreign diplomats In this case ldquostates may exercise jurisdiction over its
citizenhellipeven if they are physically outside the statesrsquo territoryrdquo as Doctor Boczek defines as the
Nationality Principle Nations usually agree upon on these concessions states prior to the offense
being committed40
Doctor Boczek defines the Protective Security Principle as a ldquojurisdictional principle
whereby a state my assume jurisdiction over and punish foreign nationals for certain conduct
outside its territory which is directed against its security territorial integrity and political
independencerdquo41 Some states would argue that criticism of a state or government is applicable
15
AUACSCSinksAY08
in applying this principle of jurisdiction However this is too broad of an interpretation and
should be confined to acts that are more tangible in nature like falsification of a statesrsquo official
documents conspiracy to violate immigration of custom laws and illicit drug trafficking42
Would a cyber attack that is deemed to challenge a nationrsquos banking community or bring
down a power source be a direct attack against its security and political independence The
international community easily sees the attack of a power source with kinetic weapons as a
violation of a territorial boundary and a breech of international law The United States viewed
the attack on the Trade Towers as an act of war launching the Global War on Terrorism Would
the United States have viewed the same devastation as if the attack occurred through cyberspace
Would the attack have been less of an act of war if the aggressor remotely controlled domestic
airliners from a foreign country Probably not What happens if the cyber attack caused a fire in
the lower floors of the buildings preventing people from escaping While less dramatic than an
airbus flying into the middle of the towers and maybe more difficult to demonize the crime the
result is the samemdashinnocent people suffering as a result of an adversary trying to threaten a
nationrsquos security
What happens if the suspected cyber attack has violated a nationrsquos territorial boundary in
order to attack a neighboring country or an ally Going from point A to point B in cyberspace is
rarely a direct connection As with the global nature of cyberspace itrsquos conceivable that
adversaries cross several nationsrsquo boundaries to conduct cyber attack operations The question
generated is who has jurisdiction
If the actor committing the crime had used an airplane each nation could claim
jurisdiction as the adversary violated their territorial boundaries and violated international law
More often than not the first state would have acted immediately upon the aggressive act and
16
AUACSCSinksAY08
would have prevented aggressors from completing their task by either forcing the aircraft to land
or turnaround or an even more escalated response of firing upon the aircraft In the air land or
sea the ability for a nationrsquos military forces to respond in a timely manner gives way to the
deterrence factor of not crossing a statersquos boundaries without receiving permission for fear of
reprisal A clear example of this was when Turkey denied the United States the ability deploy
the 4th Infantry Division from its borders at the beginning of Operation Iraqi Freedom Violating
Turkeyrsquos borders without permission would have brought about great repercussions that would
have made Operation Iraqi Freedom even more difficult and could have resulted in an escalation
of the war outside the Iraqi borders43 Another example is when Spain and France denied the
Unites States the use of their airspace when F-111s based in the United Kingdom conducted air
operations in Libya in an effort to eliminate Muammar Khadafy44
However the speeds at which these breeches in territorial boundaries occur make it
difficult for a nation to claim jurisdiction especially when nothing occurred within their
territorial sovereignty The cyber attacks didnrsquot result in any damage to nation as the information
packets passed through their sovereign borders According to territorial boundary description
described by Doctor Boczek the international community doesnrsquot consider the crossing the
border in of itself an act of warmdashserious damage is a driving factor in determining conflict
escalation In addition according to the territorial jurisdiction principle the cyber attack didnrsquot
threaten a nationrsquos security territorial integrity and political independence If the cyber attack or
information originated from within a sovereign territory by a third party then the two nations
would have to work together to resolve the issue and mutual jurisdiction would probably apply
However if the cyber attack didnrsquot physically manifest itself from within their sovereign
territory or the adversary didnrsquot use the nation as a staging area to launch a further attack the
17
AUACSCSinksAY08
international law and the jurisdiction principles would dictate the affected nation would have
jurisdiction
Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security
territorial integrity and political independence Cyberspace utilizes the other domains as a means
of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence
Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of
territorial sovereignty the Protective Security Principle does provide nations the ability to
enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos
sovereignty when it conducts cyber warfare operations However some elites donrsquot consider
cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense
International law specifically article 2 of the United Nations Charters states that a
members shall refrain in their international relations from the threat or use of force against the
territorial integrity or political independence of any state or in any other manner inconsistent
with the purposes of the United Nations which is intended to prohibit all types of force except
those carried out under the aegis of the United Nations or as provided for by the Security
Council45 The only exception to the United Nations Charters as it relates to the Use of Force is
the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed
attack46
International elites have discussed the term ldquouse of forcerdquo in the past because of the
development of chemical and biological weapons and had to move from a kinetic impact based
definition to a results-oriented approach47 Chemical and biological weapons lacked the
characteristic of an explosion or physical force yet these weapons certainly are capable of
destroying life and property Doctor Leigh Armistead a former information warfare instructor at
18
AUACSCSinksAY08
the Joint Forces Staff College cautions that the use of computer network attacks by the military
ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary
that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great
Russia introduced a proposal to the United Nations that banned the use of information
operations Even though the United Nations didnrsquot adopt the law the concern of international
community is fully aware of the impact cyber attacks can have on a nation
The concern over cyber warfare capabilities is that it can generate both non-kinetic and
kinetic effects There has always been the traditional kinetic solution for cyber warfare where a
precision guidance munition destroys a critical information system node Most people assume
computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos
computer system from the safety of onersquos own command and control center but the physical
destruction of a computer system or network by kinetic means also qualifies as cyber warfare
However cyber warfare has also evolved to the point where aggressors can achieve a kinetic
effect without the use of a traditional kinetic weapon A cyber attack on an information system
can shut down a particular node of a power plant causing the system to become inoperative
Even if there wasnrsquot an explosion the attack serves the same purpose
The question raised is do cyber attacks constitute an armed attack Scholars do agree that
some cyber attacks fit comfortably within the United Nations Charter For example a strategic
level cyber attack causing widespread damage and significant casualties would trigger the statersquos
right of self-defense In addition a cyber attack that precluded a conventional attack or a series
of cyber attacks causing significant damage would give a state the right of self-defense49 Few
would dispute that a country has the right under international law to respond with military force
19
AUACSCSinksAY08
if a state destroyed or significantly damaged another nationrsquos economic system for example the
New York or London stock exchanges
However some confusion and state-defined interpretation comes into play when the
frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard
Law School argues that cyber attacks require an expansion of the definition on the ldquouse of
forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot
be prohibited by international law50 International scholars recommend ldquoclearer rules of what
kinds of information warfare actions constitute an armed attackrdquo which drives permissible
responses of self-defense51 For example a state-sponsored cyber attack causes damage to a
victimrsquos factory or power plant however the nation claims the incident is an isolated instance
and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under
the United Nations Charter and the United Nations would consider any response retaliation
which would violate international law52
Another example involves a nation conducting a series of small attacks causing minimal
damage and then ceases Even though the aggressor used force to conduct cyber warfare
operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under
the United Nations Charter This type of attack is analogues to a small band of troops crossing a
border without causing significant damage53 According to the United Nations Charter the
national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders
and respond to the use of force Repelling the small band of troops and reestablishing their
sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration
of war and allies would have to respect the United Nations decision and couldnrsquot intervene The
same is true for the cyber attack A state can employ defensive measure to isolate and defeat the
20
AUACSCSinksAY08
incursion over the electromagnetic spectrum However the United Nations would see further
offensive operations or invasive operations as retaliation Therefore a nation must take the
incident whether it is signs of conventional forces on the ground or traces of cyber warfare
incursions in the electromagnetic spectrum to the United Nations to seek restitution
In both of these situations the international law becomes the target for change not
whether cyber warfare is in violation of international law If the law were to change the
international community would then consider the above situations acts of war even if an
adversary used conventional forces As written today the result of an operation remains the
driving factor in determining if an adversary has violated international law The means by which
an adversary conducts military operations may affect how nations react to the situation but
whether an adversary conducts the operation by means of the air land sea space or cyberspace
doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian
Triggs a public international lawyer and member of the Attorney General International Legal
Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over
offences abroad having an intended and substantial effect within a state may be justifiedrdquo54
Therefore the international community must evaluate the effect of a criminal act rather than the
means in which the act was committed
Others claim that because the Internet takes advantages of legal norms where non-state
actors can ignore Western notions of law55 more international laws are needed for cyberspace
However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using
other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the
Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked
aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts
21
AUACSCSinksAY08
against a staterdquo in the cyberspace domain The anonymity of the Internet and their total
disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and
national laws already exist in most countries that prohibit the use of the Internet for terrorist
activities therefore additional international laws wouldnrsquot prevent or deter terrorist from
committing such acts of aggression
International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed
Conflict includes the Martens Clause which extends established custom and humanitarian
principles to new technologies and addresses the ever-changing nature of warfare The
international community designed The Martens Clause ldquoto prevent future unnecessary andor
disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges
crimes by invoking the laws of humanity and public conscience hence their effects and not its
methods
The basic legal premise behind Law of Armed Conflict is that attacks must be limited to
military objectives and collateral damage must be proportionate to military advantages and
forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary
suffering but military commanders and planners need to be aware of the results a particular
action will invoke Russian leadership believes a computer network attack against their
homeland can be a means for executing a variety of escalating responses to include nuclear
attack58 Therefore it is imperative military commanders understand the impact any weapon
system can have on an adversary not just cyber attacks
Not all scholars agree that international law is insufficient to govern cyber warfare
Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace
and the Use of Force states that computer network attacks constitute an unlawful use of force in
22
AUACSCSinksAY08
cyberspace under traditional international law Sharp declared that an armed attack may occur
ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a
way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive
definition of cyber attacks may never be drafted59 The Congressional Research Service also
concluded that ldquothere is little likelihood that the international community will soon generate a
coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations
on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos
conclusion is that the effects of cyber warfare operations are the same as if an adversary
conducted conventional warfare operations where the effect of the attacks are the driving factors
in determining whether an adversary used force or not
The United States Government agrees with Sharprsquos conclusion The offensive
Information Operation strategy for the United States government as described by Doctor
Armistead ties the tools used to conduct military operations back to the desired effect which is
in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning
effects-based operations and operational art focus the Joint Force Commanderrsquos course of action
towards meeting objectives outlined in guidance provided by the National Command Authority
and senior military leadership62 Whether the tools are dropped pamphlets invasive network
attacks or bombs on targets the goal is to produce a desired effect to achieve the overall
objectives and cyber warfare can produce effects that challenge the national security of a nation
Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63
~General T Michael Moseley USAF
23
AUACSCSinksAY08
The cyberspace domain has been around for quite sometime but as technology continues
to advance businesses as well as governmental organizations are becoming more reliant on the
cyberspace domain With that reliance the protection of this critical domain becomes even more
important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the
electromagnetic spectrum by denying and disrupting information demands Scholars claim that
protection needs to include addressing existing international laws expanding them to incorporate
the ever-advancing capabilities emerging in the cyberspace domain
However territorial sovereignty of a nation and the principles of jurisdiction specifically
the Protective Security Principle give nations the right to exercise jurisdiction when an
aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64
While cyberspace is a domain requiring specific attention it relies on assets in the other domains
of land space sea and air in order to operate and international laws for the linear domains do
exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace
but during cyber warfare operations the principles behind the restrictions of foreign military
entering airspace do apply The strategic nature of cyber warfare operations correspond to the
same strategic impact that airpower can inflict upon a nation threatening their independence
While maybe not as dramatic as kinetic effects the results can be just as devastating
Space is relatively straightforward Since a nation canrsquot claim space and over flights of
foreign satellites over a nation is permissible nations must use space for peaceful purposes
Kinetic attacks against space assets are a violation of international law therefore nations would
consider cyber warfare operations against space assets as other than peaceful purposes and a
violation of international law Cyber attacks traversing space assets relate to current military
operations where the military uses space assets to conduct kinetic operations Since international
24
AUACSCSinksAY08
elites havenrsquot considered these kinetic operations as a breach of international law military
commanders can conduct cyber warfare operations through space without fear of violating
international laws for outer space
Crossing international borders without a nationrsquos permission and threatening their
sovereignty is a violation of international law While nations canrsquot consider all border crossings
as an act of war those acts of aggression that threaten the territorial integrity would elicit a
defensive response by the victim nation Whether incursions involve combat vehicles over a
highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are
threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not
have set foot in the nation but according the Protective Security Principle the victim nation has
jurisdiction
Conducting cyber warfare operations from the territorial sea is no different from
conducting operations from within a nationrsquos land or sea borders However the high seas are
very similar in nature to space in that they are reserved for peaceful purposes Therefore
conducting any means of warfare from within the high seas is a violation of international law
and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-
defense
According to Barkham ldquoinformation warfare attacks are in essence territorial
penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then
subject to the jurisdiction of the victim nation who then has the right for self-defense However
due to the global nature of cyberspace aggressors can cross multiple borders and determining
who has jurisdiction demands cooperation among nations The origin and any deliberate staging
locations of the cyber attack will drive who has jurisdiction The crossing of third party borders
25
AUACSCSinksAY08
by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the
aggressors threaten a nationrsquos independence or territorial integrity
Scholars consider cyber warfare operations that involve strategic and operational impacts
as being a means of using force and fall within the legal regime of existing international law
However scholars argue that because cyber warfare includes kinetic and non-kinetic results the
Use of Force definition needs expanding Yet they conclude that an exhaustive definition of
cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare
operations against existing case studies where the effects are evaluated as opposed to the means
even if the operations originated from outside the nationrsquos territorial jurisdiction There is some
authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to
have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade
non-state actors from conducting cyber warfare operations given their willingness to ignore
Western notions of war and their ability to conduct operations anonymously in cyberspace
International laws are in place to that address the ever-changing nature of warfare The
Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a
framework for addressing all warfare to include cyber warfare operations The international
community will need to measure the effects of an operation rather the means Whether its boots
on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a
nationrsquos response
26
AUACSCSinksAY08
End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)
27
AUACSCSinksAY08
44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
28
AUACSCSinksAY08
Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005
Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department
American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)
Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983
Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988
Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)
Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)
IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)
Joint Publication 3-13 Information Operations 13 February 2006
Joint Publication 5-0 Joint Operations Planning 26 December 2006
Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies
Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc
Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College
Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)
Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press
29
AUACSCSinksAY08
Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI
Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)
Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press
Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company
Detter Delupis I The law of war (2000) New York NY Cambridge University Press
Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)
Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College
Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor
Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)
Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)
Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf
Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)
Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College
Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College
Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)
Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA
30
AUACSCSinksAY08
Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)
Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)
Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College
Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology
Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College
Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)
OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center
OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College
OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications
Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991
Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College
Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center
Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)
31
AUACSCSinksAY08
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press
Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA
Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University
Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor
Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661
Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office
Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis
United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC
United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center
Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College
Wesley David C The Military Commander and the Law 2006
32
AUACSCSinksAY08
nation may invoke their right for self-defense and may conduct full-scale operations to neutralize
the threat
A parallel notion is when an adversary uses a copper or fiber optic connection that spans
between two nations The adversary uses the land-based LAN connection as a means for
conducting cyber warfare operations The adversary may cross the borders using cyberspace yet
do nothing The affected state may push the adversary back to its borders but no further actions
are deemed appropriate However once the adversary uses the information transmitted over
cyberspace to cause severe operational or strategic damage the affected state now has the right
of self-defense Cyberspace is the means like the road or bridge for which the adversary
delivered the weapon The affected nation will consider the execution of the adversaryrsquos
information packet or weapon system as an act of aggression and the effect caused by the
weapon is what breeches international law
The difference between these two scenarios is that the adversary using the
electromagnetic spectrum hasnrsquot physically invaded a nationrsquos sovereign borders However
their digital presence crossed sovereign borders and as latter discussed in the paper adversaries
committing an act aggression against a state are now under the jurisdiction of the affected state
Sea ldquoThe territorial sea is a belt of sea adjacent to the (statersquos) coasthellipto include the airspace
aboverdquo as well as the seabed and subsoil31 The territorial sea is subject to the right of innocent
passage by foreign shops giving states the right to transport goods and passengers between ports
All of which is subject to the full sovereignty of the state which according to the United Nations
Convention on the Law of the Sea in 1982 and agreed upon by the majority of its membership in
1982 extends 12 miles from the coast32 The jurisdiction includes crimes where the
consequences extend to the coastal state and disturbs the peace of the country33 A cyber attack
13
AUACSCSinksAY08
conducted within the territorial sea of a nation would be no different from a cyber attack
conducted from within the nationrsquos land borders therefore cyber attacks against a state or even
another state conducted within the territorial seas are subject to current international laws Cyber
attacks originating outside the statersquos sovereign borders but results in affecting a statersquos
resources in their territorial seas would fall under the land and airspace breeches of territorial
sovereignty and would be subject to international law
The high seas on the other hand arenrsquot subject to the sovereignty of any one state The
high seas extend beyond the territorial sea and include the airspace the seabed and the subsoil34
and all states have the right to exercise freedoms on the high seas35 As similarly defined in
space ldquothe high seas shall be reserved for peaceful purposesrdquo as stated by Article 88 of the Law
of the Seas Cooperative36 which is defined as refraining from any threat or use of force (outside
of wartime conflicts)
The very nature of a cyber attack in the high seas lends itself to be a violation of
international law as nations are restricted to conducting peaceful operations in the high seas
The question is whom has jurisdiction of crimes committed in the high seas By applying the
Protective Security Principle of Jurisdiction where an actor threatens a statersquo security and
introducing the United Nationrsquos definition on the Illegal Use of Force extends to the high seas
and for that matter space giving states the right for self-defense as defined by the United Nations
as ldquoan armed attackrdquo The sheer name of cyber attack doesnrsquot immediately lend itself to an
ldquoarmedrdquo cyber attack However the effects generated from a cyber attack can be equivalent to a
traditional conventional attack and the international law would permit a state to take appropriate
countermeasures while notifying the United Nations Security Council37
14
AUACSCSinksAY08
Applying International Law to Cyber Warfare Today we live in an Information Age where communication through cyberspace has forever changed and flattened out worldhellipOur adversaries seek to operate from behind technical legal and international screens as they execute their costly attacks38
~General James E Cartwright Commander United States Strategic Command
Jurisdiction
Understanding the territorial sovereignty principles of a nation is important in applying
cyberspace and cyber warfare to existing international laws While some of these principles and
international laws may not be relevant for the cyberspace domain due to the far-reaching
capability of cyber warfare the jurisdiction of a nation further defines its ability to respond to
aggressive acts by nations in the cyberspace domain There are three jurisdictional principles
that provide nations the right to pursue aggressors that threaten a nationrsquos independence the
Territorial Principle Nationality Principle and the Protective Security Principle
For actions originating within the state the jurisdiction clearly falls within the territorial
principle where a ldquostate has jurisdiction over all crimes committed in its territoryhellipto include
airspace international waters and territorial seasrdquo39 The territorial jurisdiction is subject to
exceptions when dealing with persons from foreign states as in the most popular example of
immunity given to foreign diplomats In this case ldquostates may exercise jurisdiction over its
citizenhellipeven if they are physically outside the statesrsquo territoryrdquo as Doctor Boczek defines as the
Nationality Principle Nations usually agree upon on these concessions states prior to the offense
being committed40
Doctor Boczek defines the Protective Security Principle as a ldquojurisdictional principle
whereby a state my assume jurisdiction over and punish foreign nationals for certain conduct
outside its territory which is directed against its security territorial integrity and political
independencerdquo41 Some states would argue that criticism of a state or government is applicable
15
AUACSCSinksAY08
in applying this principle of jurisdiction However this is too broad of an interpretation and
should be confined to acts that are more tangible in nature like falsification of a statesrsquo official
documents conspiracy to violate immigration of custom laws and illicit drug trafficking42
Would a cyber attack that is deemed to challenge a nationrsquos banking community or bring
down a power source be a direct attack against its security and political independence The
international community easily sees the attack of a power source with kinetic weapons as a
violation of a territorial boundary and a breech of international law The United States viewed
the attack on the Trade Towers as an act of war launching the Global War on Terrorism Would
the United States have viewed the same devastation as if the attack occurred through cyberspace
Would the attack have been less of an act of war if the aggressor remotely controlled domestic
airliners from a foreign country Probably not What happens if the cyber attack caused a fire in
the lower floors of the buildings preventing people from escaping While less dramatic than an
airbus flying into the middle of the towers and maybe more difficult to demonize the crime the
result is the samemdashinnocent people suffering as a result of an adversary trying to threaten a
nationrsquos security
What happens if the suspected cyber attack has violated a nationrsquos territorial boundary in
order to attack a neighboring country or an ally Going from point A to point B in cyberspace is
rarely a direct connection As with the global nature of cyberspace itrsquos conceivable that
adversaries cross several nationsrsquo boundaries to conduct cyber attack operations The question
generated is who has jurisdiction
If the actor committing the crime had used an airplane each nation could claim
jurisdiction as the adversary violated their territorial boundaries and violated international law
More often than not the first state would have acted immediately upon the aggressive act and
16
AUACSCSinksAY08
would have prevented aggressors from completing their task by either forcing the aircraft to land
or turnaround or an even more escalated response of firing upon the aircraft In the air land or
sea the ability for a nationrsquos military forces to respond in a timely manner gives way to the
deterrence factor of not crossing a statersquos boundaries without receiving permission for fear of
reprisal A clear example of this was when Turkey denied the United States the ability deploy
the 4th Infantry Division from its borders at the beginning of Operation Iraqi Freedom Violating
Turkeyrsquos borders without permission would have brought about great repercussions that would
have made Operation Iraqi Freedom even more difficult and could have resulted in an escalation
of the war outside the Iraqi borders43 Another example is when Spain and France denied the
Unites States the use of their airspace when F-111s based in the United Kingdom conducted air
operations in Libya in an effort to eliminate Muammar Khadafy44
However the speeds at which these breeches in territorial boundaries occur make it
difficult for a nation to claim jurisdiction especially when nothing occurred within their
territorial sovereignty The cyber attacks didnrsquot result in any damage to nation as the information
packets passed through their sovereign borders According to territorial boundary description
described by Doctor Boczek the international community doesnrsquot consider the crossing the
border in of itself an act of warmdashserious damage is a driving factor in determining conflict
escalation In addition according to the territorial jurisdiction principle the cyber attack didnrsquot
threaten a nationrsquos security territorial integrity and political independence If the cyber attack or
information originated from within a sovereign territory by a third party then the two nations
would have to work together to resolve the issue and mutual jurisdiction would probably apply
However if the cyber attack didnrsquot physically manifest itself from within their sovereign
territory or the adversary didnrsquot use the nation as a staging area to launch a further attack the
17
AUACSCSinksAY08
international law and the jurisdiction principles would dictate the affected nation would have
jurisdiction
Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security
territorial integrity and political independence Cyberspace utilizes the other domains as a means
of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence
Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of
territorial sovereignty the Protective Security Principle does provide nations the ability to
enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos
sovereignty when it conducts cyber warfare operations However some elites donrsquot consider
cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense
International law specifically article 2 of the United Nations Charters states that a
members shall refrain in their international relations from the threat or use of force against the
territorial integrity or political independence of any state or in any other manner inconsistent
with the purposes of the United Nations which is intended to prohibit all types of force except
those carried out under the aegis of the United Nations or as provided for by the Security
Council45 The only exception to the United Nations Charters as it relates to the Use of Force is
the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed
attack46
International elites have discussed the term ldquouse of forcerdquo in the past because of the
development of chemical and biological weapons and had to move from a kinetic impact based
definition to a results-oriented approach47 Chemical and biological weapons lacked the
characteristic of an explosion or physical force yet these weapons certainly are capable of
destroying life and property Doctor Leigh Armistead a former information warfare instructor at
18
AUACSCSinksAY08
the Joint Forces Staff College cautions that the use of computer network attacks by the military
ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary
that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great
Russia introduced a proposal to the United Nations that banned the use of information
operations Even though the United Nations didnrsquot adopt the law the concern of international
community is fully aware of the impact cyber attacks can have on a nation
The concern over cyber warfare capabilities is that it can generate both non-kinetic and
kinetic effects There has always been the traditional kinetic solution for cyber warfare where a
precision guidance munition destroys a critical information system node Most people assume
computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos
computer system from the safety of onersquos own command and control center but the physical
destruction of a computer system or network by kinetic means also qualifies as cyber warfare
However cyber warfare has also evolved to the point where aggressors can achieve a kinetic
effect without the use of a traditional kinetic weapon A cyber attack on an information system
can shut down a particular node of a power plant causing the system to become inoperative
Even if there wasnrsquot an explosion the attack serves the same purpose
The question raised is do cyber attacks constitute an armed attack Scholars do agree that
some cyber attacks fit comfortably within the United Nations Charter For example a strategic
level cyber attack causing widespread damage and significant casualties would trigger the statersquos
right of self-defense In addition a cyber attack that precluded a conventional attack or a series
of cyber attacks causing significant damage would give a state the right of self-defense49 Few
would dispute that a country has the right under international law to respond with military force
19
AUACSCSinksAY08
if a state destroyed or significantly damaged another nationrsquos economic system for example the
New York or London stock exchanges
However some confusion and state-defined interpretation comes into play when the
frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard
Law School argues that cyber attacks require an expansion of the definition on the ldquouse of
forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot
be prohibited by international law50 International scholars recommend ldquoclearer rules of what
kinds of information warfare actions constitute an armed attackrdquo which drives permissible
responses of self-defense51 For example a state-sponsored cyber attack causes damage to a
victimrsquos factory or power plant however the nation claims the incident is an isolated instance
and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under
the United Nations Charter and the United Nations would consider any response retaliation
which would violate international law52
Another example involves a nation conducting a series of small attacks causing minimal
damage and then ceases Even though the aggressor used force to conduct cyber warfare
operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under
the United Nations Charter This type of attack is analogues to a small band of troops crossing a
border without causing significant damage53 According to the United Nations Charter the
national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders
and respond to the use of force Repelling the small band of troops and reestablishing their
sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration
of war and allies would have to respect the United Nations decision and couldnrsquot intervene The
same is true for the cyber attack A state can employ defensive measure to isolate and defeat the
20
AUACSCSinksAY08
incursion over the electromagnetic spectrum However the United Nations would see further
offensive operations or invasive operations as retaliation Therefore a nation must take the
incident whether it is signs of conventional forces on the ground or traces of cyber warfare
incursions in the electromagnetic spectrum to the United Nations to seek restitution
In both of these situations the international law becomes the target for change not
whether cyber warfare is in violation of international law If the law were to change the
international community would then consider the above situations acts of war even if an
adversary used conventional forces As written today the result of an operation remains the
driving factor in determining if an adversary has violated international law The means by which
an adversary conducts military operations may affect how nations react to the situation but
whether an adversary conducts the operation by means of the air land sea space or cyberspace
doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian
Triggs a public international lawyer and member of the Attorney General International Legal
Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over
offences abroad having an intended and substantial effect within a state may be justifiedrdquo54
Therefore the international community must evaluate the effect of a criminal act rather than the
means in which the act was committed
Others claim that because the Internet takes advantages of legal norms where non-state
actors can ignore Western notions of law55 more international laws are needed for cyberspace
However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using
other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the
Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked
aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts
21
AUACSCSinksAY08
against a staterdquo in the cyberspace domain The anonymity of the Internet and their total
disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and
national laws already exist in most countries that prohibit the use of the Internet for terrorist
activities therefore additional international laws wouldnrsquot prevent or deter terrorist from
committing such acts of aggression
International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed
Conflict includes the Martens Clause which extends established custom and humanitarian
principles to new technologies and addresses the ever-changing nature of warfare The
international community designed The Martens Clause ldquoto prevent future unnecessary andor
disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges
crimes by invoking the laws of humanity and public conscience hence their effects and not its
methods
The basic legal premise behind Law of Armed Conflict is that attacks must be limited to
military objectives and collateral damage must be proportionate to military advantages and
forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary
suffering but military commanders and planners need to be aware of the results a particular
action will invoke Russian leadership believes a computer network attack against their
homeland can be a means for executing a variety of escalating responses to include nuclear
attack58 Therefore it is imperative military commanders understand the impact any weapon
system can have on an adversary not just cyber attacks
Not all scholars agree that international law is insufficient to govern cyber warfare
Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace
and the Use of Force states that computer network attacks constitute an unlawful use of force in
22
AUACSCSinksAY08
cyberspace under traditional international law Sharp declared that an armed attack may occur
ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a
way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive
definition of cyber attacks may never be drafted59 The Congressional Research Service also
concluded that ldquothere is little likelihood that the international community will soon generate a
coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations
on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos
conclusion is that the effects of cyber warfare operations are the same as if an adversary
conducted conventional warfare operations where the effect of the attacks are the driving factors
in determining whether an adversary used force or not
The United States Government agrees with Sharprsquos conclusion The offensive
Information Operation strategy for the United States government as described by Doctor
Armistead ties the tools used to conduct military operations back to the desired effect which is
in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning
effects-based operations and operational art focus the Joint Force Commanderrsquos course of action
towards meeting objectives outlined in guidance provided by the National Command Authority
and senior military leadership62 Whether the tools are dropped pamphlets invasive network
attacks or bombs on targets the goal is to produce a desired effect to achieve the overall
objectives and cyber warfare can produce effects that challenge the national security of a nation
Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63
~General T Michael Moseley USAF
23
AUACSCSinksAY08
The cyberspace domain has been around for quite sometime but as technology continues
to advance businesses as well as governmental organizations are becoming more reliant on the
cyberspace domain With that reliance the protection of this critical domain becomes even more
important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the
electromagnetic spectrum by denying and disrupting information demands Scholars claim that
protection needs to include addressing existing international laws expanding them to incorporate
the ever-advancing capabilities emerging in the cyberspace domain
However territorial sovereignty of a nation and the principles of jurisdiction specifically
the Protective Security Principle give nations the right to exercise jurisdiction when an
aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64
While cyberspace is a domain requiring specific attention it relies on assets in the other domains
of land space sea and air in order to operate and international laws for the linear domains do
exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace
but during cyber warfare operations the principles behind the restrictions of foreign military
entering airspace do apply The strategic nature of cyber warfare operations correspond to the
same strategic impact that airpower can inflict upon a nation threatening their independence
While maybe not as dramatic as kinetic effects the results can be just as devastating
Space is relatively straightforward Since a nation canrsquot claim space and over flights of
foreign satellites over a nation is permissible nations must use space for peaceful purposes
Kinetic attacks against space assets are a violation of international law therefore nations would
consider cyber warfare operations against space assets as other than peaceful purposes and a
violation of international law Cyber attacks traversing space assets relate to current military
operations where the military uses space assets to conduct kinetic operations Since international
24
AUACSCSinksAY08
elites havenrsquot considered these kinetic operations as a breach of international law military
commanders can conduct cyber warfare operations through space without fear of violating
international laws for outer space
Crossing international borders without a nationrsquos permission and threatening their
sovereignty is a violation of international law While nations canrsquot consider all border crossings
as an act of war those acts of aggression that threaten the territorial integrity would elicit a
defensive response by the victim nation Whether incursions involve combat vehicles over a
highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are
threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not
have set foot in the nation but according the Protective Security Principle the victim nation has
jurisdiction
Conducting cyber warfare operations from the territorial sea is no different from
conducting operations from within a nationrsquos land or sea borders However the high seas are
very similar in nature to space in that they are reserved for peaceful purposes Therefore
conducting any means of warfare from within the high seas is a violation of international law
and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-
defense
According to Barkham ldquoinformation warfare attacks are in essence territorial
penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then
subject to the jurisdiction of the victim nation who then has the right for self-defense However
due to the global nature of cyberspace aggressors can cross multiple borders and determining
who has jurisdiction demands cooperation among nations The origin and any deliberate staging
locations of the cyber attack will drive who has jurisdiction The crossing of third party borders
25
AUACSCSinksAY08
by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the
aggressors threaten a nationrsquos independence or territorial integrity
Scholars consider cyber warfare operations that involve strategic and operational impacts
as being a means of using force and fall within the legal regime of existing international law
However scholars argue that because cyber warfare includes kinetic and non-kinetic results the
Use of Force definition needs expanding Yet they conclude that an exhaustive definition of
cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare
operations against existing case studies where the effects are evaluated as opposed to the means
even if the operations originated from outside the nationrsquos territorial jurisdiction There is some
authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to
have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade
non-state actors from conducting cyber warfare operations given their willingness to ignore
Western notions of war and their ability to conduct operations anonymously in cyberspace
International laws are in place to that address the ever-changing nature of warfare The
Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a
framework for addressing all warfare to include cyber warfare operations The international
community will need to measure the effects of an operation rather the means Whether its boots
on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a
nationrsquos response
26
AUACSCSinksAY08
End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)
27
AUACSCSinksAY08
44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
28
AUACSCSinksAY08
Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005
Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department
American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)
Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983
Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988
Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)
Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)
IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)
Joint Publication 3-13 Information Operations 13 February 2006
Joint Publication 5-0 Joint Operations Planning 26 December 2006
Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies
Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc
Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College
Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)
Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press
29
AUACSCSinksAY08
Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI
Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)
Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press
Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company
Detter Delupis I The law of war (2000) New York NY Cambridge University Press
Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)
Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College
Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor
Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)
Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)
Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf
Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)
Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College
Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College
Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)
Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA
30
AUACSCSinksAY08
Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)
Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)
Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College
Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology
Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College
Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)
OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center
OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College
OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications
Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991
Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College
Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center
Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)
31
AUACSCSinksAY08
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press
Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA
Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University
Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor
Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661
Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office
Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis
United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC
United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center
Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College
Wesley David C The Military Commander and the Law 2006
32
AUACSCSinksAY08
conducted within the territorial sea of a nation would be no different from a cyber attack
conducted from within the nationrsquos land borders therefore cyber attacks against a state or even
another state conducted within the territorial seas are subject to current international laws Cyber
attacks originating outside the statersquos sovereign borders but results in affecting a statersquos
resources in their territorial seas would fall under the land and airspace breeches of territorial
sovereignty and would be subject to international law
The high seas on the other hand arenrsquot subject to the sovereignty of any one state The
high seas extend beyond the territorial sea and include the airspace the seabed and the subsoil34
and all states have the right to exercise freedoms on the high seas35 As similarly defined in
space ldquothe high seas shall be reserved for peaceful purposesrdquo as stated by Article 88 of the Law
of the Seas Cooperative36 which is defined as refraining from any threat or use of force (outside
of wartime conflicts)
The very nature of a cyber attack in the high seas lends itself to be a violation of
international law as nations are restricted to conducting peaceful operations in the high seas
The question is whom has jurisdiction of crimes committed in the high seas By applying the
Protective Security Principle of Jurisdiction where an actor threatens a statersquo security and
introducing the United Nationrsquos definition on the Illegal Use of Force extends to the high seas
and for that matter space giving states the right for self-defense as defined by the United Nations
as ldquoan armed attackrdquo The sheer name of cyber attack doesnrsquot immediately lend itself to an
ldquoarmedrdquo cyber attack However the effects generated from a cyber attack can be equivalent to a
traditional conventional attack and the international law would permit a state to take appropriate
countermeasures while notifying the United Nations Security Council37
14
AUACSCSinksAY08
Applying International Law to Cyber Warfare Today we live in an Information Age where communication through cyberspace has forever changed and flattened out worldhellipOur adversaries seek to operate from behind technical legal and international screens as they execute their costly attacks38
~General James E Cartwright Commander United States Strategic Command
Jurisdiction
Understanding the territorial sovereignty principles of a nation is important in applying
cyberspace and cyber warfare to existing international laws While some of these principles and
international laws may not be relevant for the cyberspace domain due to the far-reaching
capability of cyber warfare the jurisdiction of a nation further defines its ability to respond to
aggressive acts by nations in the cyberspace domain There are three jurisdictional principles
that provide nations the right to pursue aggressors that threaten a nationrsquos independence the
Territorial Principle Nationality Principle and the Protective Security Principle
For actions originating within the state the jurisdiction clearly falls within the territorial
principle where a ldquostate has jurisdiction over all crimes committed in its territoryhellipto include
airspace international waters and territorial seasrdquo39 The territorial jurisdiction is subject to
exceptions when dealing with persons from foreign states as in the most popular example of
immunity given to foreign diplomats In this case ldquostates may exercise jurisdiction over its
citizenhellipeven if they are physically outside the statesrsquo territoryrdquo as Doctor Boczek defines as the
Nationality Principle Nations usually agree upon on these concessions states prior to the offense
being committed40
Doctor Boczek defines the Protective Security Principle as a ldquojurisdictional principle
whereby a state my assume jurisdiction over and punish foreign nationals for certain conduct
outside its territory which is directed against its security territorial integrity and political
independencerdquo41 Some states would argue that criticism of a state or government is applicable
15
AUACSCSinksAY08
in applying this principle of jurisdiction However this is too broad of an interpretation and
should be confined to acts that are more tangible in nature like falsification of a statesrsquo official
documents conspiracy to violate immigration of custom laws and illicit drug trafficking42
Would a cyber attack that is deemed to challenge a nationrsquos banking community or bring
down a power source be a direct attack against its security and political independence The
international community easily sees the attack of a power source with kinetic weapons as a
violation of a territorial boundary and a breech of international law The United States viewed
the attack on the Trade Towers as an act of war launching the Global War on Terrorism Would
the United States have viewed the same devastation as if the attack occurred through cyberspace
Would the attack have been less of an act of war if the aggressor remotely controlled domestic
airliners from a foreign country Probably not What happens if the cyber attack caused a fire in
the lower floors of the buildings preventing people from escaping While less dramatic than an
airbus flying into the middle of the towers and maybe more difficult to demonize the crime the
result is the samemdashinnocent people suffering as a result of an adversary trying to threaten a
nationrsquos security
What happens if the suspected cyber attack has violated a nationrsquos territorial boundary in
order to attack a neighboring country or an ally Going from point A to point B in cyberspace is
rarely a direct connection As with the global nature of cyberspace itrsquos conceivable that
adversaries cross several nationsrsquo boundaries to conduct cyber attack operations The question
generated is who has jurisdiction
If the actor committing the crime had used an airplane each nation could claim
jurisdiction as the adversary violated their territorial boundaries and violated international law
More often than not the first state would have acted immediately upon the aggressive act and
16
AUACSCSinksAY08
would have prevented aggressors from completing their task by either forcing the aircraft to land
or turnaround or an even more escalated response of firing upon the aircraft In the air land or
sea the ability for a nationrsquos military forces to respond in a timely manner gives way to the
deterrence factor of not crossing a statersquos boundaries without receiving permission for fear of
reprisal A clear example of this was when Turkey denied the United States the ability deploy
the 4th Infantry Division from its borders at the beginning of Operation Iraqi Freedom Violating
Turkeyrsquos borders without permission would have brought about great repercussions that would
have made Operation Iraqi Freedom even more difficult and could have resulted in an escalation
of the war outside the Iraqi borders43 Another example is when Spain and France denied the
Unites States the use of their airspace when F-111s based in the United Kingdom conducted air
operations in Libya in an effort to eliminate Muammar Khadafy44
However the speeds at which these breeches in territorial boundaries occur make it
difficult for a nation to claim jurisdiction especially when nothing occurred within their
territorial sovereignty The cyber attacks didnrsquot result in any damage to nation as the information
packets passed through their sovereign borders According to territorial boundary description
described by Doctor Boczek the international community doesnrsquot consider the crossing the
border in of itself an act of warmdashserious damage is a driving factor in determining conflict
escalation In addition according to the territorial jurisdiction principle the cyber attack didnrsquot
threaten a nationrsquos security territorial integrity and political independence If the cyber attack or
information originated from within a sovereign territory by a third party then the two nations
would have to work together to resolve the issue and mutual jurisdiction would probably apply
However if the cyber attack didnrsquot physically manifest itself from within their sovereign
territory or the adversary didnrsquot use the nation as a staging area to launch a further attack the
17
AUACSCSinksAY08
international law and the jurisdiction principles would dictate the affected nation would have
jurisdiction
Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security
territorial integrity and political independence Cyberspace utilizes the other domains as a means
of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence
Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of
territorial sovereignty the Protective Security Principle does provide nations the ability to
enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos
sovereignty when it conducts cyber warfare operations However some elites donrsquot consider
cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense
International law specifically article 2 of the United Nations Charters states that a
members shall refrain in their international relations from the threat or use of force against the
territorial integrity or political independence of any state or in any other manner inconsistent
with the purposes of the United Nations which is intended to prohibit all types of force except
those carried out under the aegis of the United Nations or as provided for by the Security
Council45 The only exception to the United Nations Charters as it relates to the Use of Force is
the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed
attack46
International elites have discussed the term ldquouse of forcerdquo in the past because of the
development of chemical and biological weapons and had to move from a kinetic impact based
definition to a results-oriented approach47 Chemical and biological weapons lacked the
characteristic of an explosion or physical force yet these weapons certainly are capable of
destroying life and property Doctor Leigh Armistead a former information warfare instructor at
18
AUACSCSinksAY08
the Joint Forces Staff College cautions that the use of computer network attacks by the military
ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary
that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great
Russia introduced a proposal to the United Nations that banned the use of information
operations Even though the United Nations didnrsquot adopt the law the concern of international
community is fully aware of the impact cyber attacks can have on a nation
The concern over cyber warfare capabilities is that it can generate both non-kinetic and
kinetic effects There has always been the traditional kinetic solution for cyber warfare where a
precision guidance munition destroys a critical information system node Most people assume
computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos
computer system from the safety of onersquos own command and control center but the physical
destruction of a computer system or network by kinetic means also qualifies as cyber warfare
However cyber warfare has also evolved to the point where aggressors can achieve a kinetic
effect without the use of a traditional kinetic weapon A cyber attack on an information system
can shut down a particular node of a power plant causing the system to become inoperative
Even if there wasnrsquot an explosion the attack serves the same purpose
The question raised is do cyber attacks constitute an armed attack Scholars do agree that
some cyber attacks fit comfortably within the United Nations Charter For example a strategic
level cyber attack causing widespread damage and significant casualties would trigger the statersquos
right of self-defense In addition a cyber attack that precluded a conventional attack or a series
of cyber attacks causing significant damage would give a state the right of self-defense49 Few
would dispute that a country has the right under international law to respond with military force
19
AUACSCSinksAY08
if a state destroyed or significantly damaged another nationrsquos economic system for example the
New York or London stock exchanges
However some confusion and state-defined interpretation comes into play when the
frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard
Law School argues that cyber attacks require an expansion of the definition on the ldquouse of
forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot
be prohibited by international law50 International scholars recommend ldquoclearer rules of what
kinds of information warfare actions constitute an armed attackrdquo which drives permissible
responses of self-defense51 For example a state-sponsored cyber attack causes damage to a
victimrsquos factory or power plant however the nation claims the incident is an isolated instance
and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under
the United Nations Charter and the United Nations would consider any response retaliation
which would violate international law52
Another example involves a nation conducting a series of small attacks causing minimal
damage and then ceases Even though the aggressor used force to conduct cyber warfare
operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under
the United Nations Charter This type of attack is analogues to a small band of troops crossing a
border without causing significant damage53 According to the United Nations Charter the
national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders
and respond to the use of force Repelling the small band of troops and reestablishing their
sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration
of war and allies would have to respect the United Nations decision and couldnrsquot intervene The
same is true for the cyber attack A state can employ defensive measure to isolate and defeat the
20
AUACSCSinksAY08
incursion over the electromagnetic spectrum However the United Nations would see further
offensive operations or invasive operations as retaliation Therefore a nation must take the
incident whether it is signs of conventional forces on the ground or traces of cyber warfare
incursions in the electromagnetic spectrum to the United Nations to seek restitution
In both of these situations the international law becomes the target for change not
whether cyber warfare is in violation of international law If the law were to change the
international community would then consider the above situations acts of war even if an
adversary used conventional forces As written today the result of an operation remains the
driving factor in determining if an adversary has violated international law The means by which
an adversary conducts military operations may affect how nations react to the situation but
whether an adversary conducts the operation by means of the air land sea space or cyberspace
doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian
Triggs a public international lawyer and member of the Attorney General International Legal
Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over
offences abroad having an intended and substantial effect within a state may be justifiedrdquo54
Therefore the international community must evaluate the effect of a criminal act rather than the
means in which the act was committed
Others claim that because the Internet takes advantages of legal norms where non-state
actors can ignore Western notions of law55 more international laws are needed for cyberspace
However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using
other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the
Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked
aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts
21
AUACSCSinksAY08
against a staterdquo in the cyberspace domain The anonymity of the Internet and their total
disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and
national laws already exist in most countries that prohibit the use of the Internet for terrorist
activities therefore additional international laws wouldnrsquot prevent or deter terrorist from
committing such acts of aggression
International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed
Conflict includes the Martens Clause which extends established custom and humanitarian
principles to new technologies and addresses the ever-changing nature of warfare The
international community designed The Martens Clause ldquoto prevent future unnecessary andor
disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges
crimes by invoking the laws of humanity and public conscience hence their effects and not its
methods
The basic legal premise behind Law of Armed Conflict is that attacks must be limited to
military objectives and collateral damage must be proportionate to military advantages and
forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary
suffering but military commanders and planners need to be aware of the results a particular
action will invoke Russian leadership believes a computer network attack against their
homeland can be a means for executing a variety of escalating responses to include nuclear
attack58 Therefore it is imperative military commanders understand the impact any weapon
system can have on an adversary not just cyber attacks
Not all scholars agree that international law is insufficient to govern cyber warfare
Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace
and the Use of Force states that computer network attacks constitute an unlawful use of force in
22
AUACSCSinksAY08
cyberspace under traditional international law Sharp declared that an armed attack may occur
ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a
way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive
definition of cyber attacks may never be drafted59 The Congressional Research Service also
concluded that ldquothere is little likelihood that the international community will soon generate a
coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations
on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos
conclusion is that the effects of cyber warfare operations are the same as if an adversary
conducted conventional warfare operations where the effect of the attacks are the driving factors
in determining whether an adversary used force or not
The United States Government agrees with Sharprsquos conclusion The offensive
Information Operation strategy for the United States government as described by Doctor
Armistead ties the tools used to conduct military operations back to the desired effect which is
in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning
effects-based operations and operational art focus the Joint Force Commanderrsquos course of action
towards meeting objectives outlined in guidance provided by the National Command Authority
and senior military leadership62 Whether the tools are dropped pamphlets invasive network
attacks or bombs on targets the goal is to produce a desired effect to achieve the overall
objectives and cyber warfare can produce effects that challenge the national security of a nation
Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63
~General T Michael Moseley USAF
23
AUACSCSinksAY08
The cyberspace domain has been around for quite sometime but as technology continues
to advance businesses as well as governmental organizations are becoming more reliant on the
cyberspace domain With that reliance the protection of this critical domain becomes even more
important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the
electromagnetic spectrum by denying and disrupting information demands Scholars claim that
protection needs to include addressing existing international laws expanding them to incorporate
the ever-advancing capabilities emerging in the cyberspace domain
However territorial sovereignty of a nation and the principles of jurisdiction specifically
the Protective Security Principle give nations the right to exercise jurisdiction when an
aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64
While cyberspace is a domain requiring specific attention it relies on assets in the other domains
of land space sea and air in order to operate and international laws for the linear domains do
exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace
but during cyber warfare operations the principles behind the restrictions of foreign military
entering airspace do apply The strategic nature of cyber warfare operations correspond to the
same strategic impact that airpower can inflict upon a nation threatening their independence
While maybe not as dramatic as kinetic effects the results can be just as devastating
Space is relatively straightforward Since a nation canrsquot claim space and over flights of
foreign satellites over a nation is permissible nations must use space for peaceful purposes
Kinetic attacks against space assets are a violation of international law therefore nations would
consider cyber warfare operations against space assets as other than peaceful purposes and a
violation of international law Cyber attacks traversing space assets relate to current military
operations where the military uses space assets to conduct kinetic operations Since international
24
AUACSCSinksAY08
elites havenrsquot considered these kinetic operations as a breach of international law military
commanders can conduct cyber warfare operations through space without fear of violating
international laws for outer space
Crossing international borders without a nationrsquos permission and threatening their
sovereignty is a violation of international law While nations canrsquot consider all border crossings
as an act of war those acts of aggression that threaten the territorial integrity would elicit a
defensive response by the victim nation Whether incursions involve combat vehicles over a
highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are
threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not
have set foot in the nation but according the Protective Security Principle the victim nation has
jurisdiction
Conducting cyber warfare operations from the territorial sea is no different from
conducting operations from within a nationrsquos land or sea borders However the high seas are
very similar in nature to space in that they are reserved for peaceful purposes Therefore
conducting any means of warfare from within the high seas is a violation of international law
and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-
defense
According to Barkham ldquoinformation warfare attacks are in essence territorial
penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then
subject to the jurisdiction of the victim nation who then has the right for self-defense However
due to the global nature of cyberspace aggressors can cross multiple borders and determining
who has jurisdiction demands cooperation among nations The origin and any deliberate staging
locations of the cyber attack will drive who has jurisdiction The crossing of third party borders
25
AUACSCSinksAY08
by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the
aggressors threaten a nationrsquos independence or territorial integrity
Scholars consider cyber warfare operations that involve strategic and operational impacts
as being a means of using force and fall within the legal regime of existing international law
However scholars argue that because cyber warfare includes kinetic and non-kinetic results the
Use of Force definition needs expanding Yet they conclude that an exhaustive definition of
cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare
operations against existing case studies where the effects are evaluated as opposed to the means
even if the operations originated from outside the nationrsquos territorial jurisdiction There is some
authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to
have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade
non-state actors from conducting cyber warfare operations given their willingness to ignore
Western notions of war and their ability to conduct operations anonymously in cyberspace
International laws are in place to that address the ever-changing nature of warfare The
Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a
framework for addressing all warfare to include cyber warfare operations The international
community will need to measure the effects of an operation rather the means Whether its boots
on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a
nationrsquos response
26
AUACSCSinksAY08
End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)
27
AUACSCSinksAY08
44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
28
AUACSCSinksAY08
Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005
Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department
American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)
Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983
Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988
Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)
Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)
IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)
Joint Publication 3-13 Information Operations 13 February 2006
Joint Publication 5-0 Joint Operations Planning 26 December 2006
Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies
Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc
Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College
Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)
Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press
29
AUACSCSinksAY08
Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI
Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)
Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press
Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company
Detter Delupis I The law of war (2000) New York NY Cambridge University Press
Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)
Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College
Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor
Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)
Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)
Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf
Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)
Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College
Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College
Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)
Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA
30
AUACSCSinksAY08
Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)
Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)
Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College
Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology
Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College
Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)
OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center
OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College
OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications
Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991
Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College
Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center
Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)
31
AUACSCSinksAY08
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press
Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA
Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University
Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor
Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661
Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office
Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis
United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC
United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center
Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College
Wesley David C The Military Commander and the Law 2006
32
AUACSCSinksAY08
Applying International Law to Cyber Warfare Today we live in an Information Age where communication through cyberspace has forever changed and flattened out worldhellipOur adversaries seek to operate from behind technical legal and international screens as they execute their costly attacks38
~General James E Cartwright Commander United States Strategic Command
Jurisdiction
Understanding the territorial sovereignty principles of a nation is important in applying
cyberspace and cyber warfare to existing international laws While some of these principles and
international laws may not be relevant for the cyberspace domain due to the far-reaching
capability of cyber warfare the jurisdiction of a nation further defines its ability to respond to
aggressive acts by nations in the cyberspace domain There are three jurisdictional principles
that provide nations the right to pursue aggressors that threaten a nationrsquos independence the
Territorial Principle Nationality Principle and the Protective Security Principle
For actions originating within the state the jurisdiction clearly falls within the territorial
principle where a ldquostate has jurisdiction over all crimes committed in its territoryhellipto include
airspace international waters and territorial seasrdquo39 The territorial jurisdiction is subject to
exceptions when dealing with persons from foreign states as in the most popular example of
immunity given to foreign diplomats In this case ldquostates may exercise jurisdiction over its
citizenhellipeven if they are physically outside the statesrsquo territoryrdquo as Doctor Boczek defines as the
Nationality Principle Nations usually agree upon on these concessions states prior to the offense
being committed40
Doctor Boczek defines the Protective Security Principle as a ldquojurisdictional principle
whereby a state my assume jurisdiction over and punish foreign nationals for certain conduct
outside its territory which is directed against its security territorial integrity and political
independencerdquo41 Some states would argue that criticism of a state or government is applicable
15
AUACSCSinksAY08
in applying this principle of jurisdiction However this is too broad of an interpretation and
should be confined to acts that are more tangible in nature like falsification of a statesrsquo official
documents conspiracy to violate immigration of custom laws and illicit drug trafficking42
Would a cyber attack that is deemed to challenge a nationrsquos banking community or bring
down a power source be a direct attack against its security and political independence The
international community easily sees the attack of a power source with kinetic weapons as a
violation of a territorial boundary and a breech of international law The United States viewed
the attack on the Trade Towers as an act of war launching the Global War on Terrorism Would
the United States have viewed the same devastation as if the attack occurred through cyberspace
Would the attack have been less of an act of war if the aggressor remotely controlled domestic
airliners from a foreign country Probably not What happens if the cyber attack caused a fire in
the lower floors of the buildings preventing people from escaping While less dramatic than an
airbus flying into the middle of the towers and maybe more difficult to demonize the crime the
result is the samemdashinnocent people suffering as a result of an adversary trying to threaten a
nationrsquos security
What happens if the suspected cyber attack has violated a nationrsquos territorial boundary in
order to attack a neighboring country or an ally Going from point A to point B in cyberspace is
rarely a direct connection As with the global nature of cyberspace itrsquos conceivable that
adversaries cross several nationsrsquo boundaries to conduct cyber attack operations The question
generated is who has jurisdiction
If the actor committing the crime had used an airplane each nation could claim
jurisdiction as the adversary violated their territorial boundaries and violated international law
More often than not the first state would have acted immediately upon the aggressive act and
16
AUACSCSinksAY08
would have prevented aggressors from completing their task by either forcing the aircraft to land
or turnaround or an even more escalated response of firing upon the aircraft In the air land or
sea the ability for a nationrsquos military forces to respond in a timely manner gives way to the
deterrence factor of not crossing a statersquos boundaries without receiving permission for fear of
reprisal A clear example of this was when Turkey denied the United States the ability deploy
the 4th Infantry Division from its borders at the beginning of Operation Iraqi Freedom Violating
Turkeyrsquos borders without permission would have brought about great repercussions that would
have made Operation Iraqi Freedom even more difficult and could have resulted in an escalation
of the war outside the Iraqi borders43 Another example is when Spain and France denied the
Unites States the use of their airspace when F-111s based in the United Kingdom conducted air
operations in Libya in an effort to eliminate Muammar Khadafy44
However the speeds at which these breeches in territorial boundaries occur make it
difficult for a nation to claim jurisdiction especially when nothing occurred within their
territorial sovereignty The cyber attacks didnrsquot result in any damage to nation as the information
packets passed through their sovereign borders According to territorial boundary description
described by Doctor Boczek the international community doesnrsquot consider the crossing the
border in of itself an act of warmdashserious damage is a driving factor in determining conflict
escalation In addition according to the territorial jurisdiction principle the cyber attack didnrsquot
threaten a nationrsquos security territorial integrity and political independence If the cyber attack or
information originated from within a sovereign territory by a third party then the two nations
would have to work together to resolve the issue and mutual jurisdiction would probably apply
However if the cyber attack didnrsquot physically manifest itself from within their sovereign
territory or the adversary didnrsquot use the nation as a staging area to launch a further attack the
17
AUACSCSinksAY08
international law and the jurisdiction principles would dictate the affected nation would have
jurisdiction
Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security
territorial integrity and political independence Cyberspace utilizes the other domains as a means
of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence
Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of
territorial sovereignty the Protective Security Principle does provide nations the ability to
enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos
sovereignty when it conducts cyber warfare operations However some elites donrsquot consider
cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense
International law specifically article 2 of the United Nations Charters states that a
members shall refrain in their international relations from the threat or use of force against the
territorial integrity or political independence of any state or in any other manner inconsistent
with the purposes of the United Nations which is intended to prohibit all types of force except
those carried out under the aegis of the United Nations or as provided for by the Security
Council45 The only exception to the United Nations Charters as it relates to the Use of Force is
the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed
attack46
International elites have discussed the term ldquouse of forcerdquo in the past because of the
development of chemical and biological weapons and had to move from a kinetic impact based
definition to a results-oriented approach47 Chemical and biological weapons lacked the
characteristic of an explosion or physical force yet these weapons certainly are capable of
destroying life and property Doctor Leigh Armistead a former information warfare instructor at
18
AUACSCSinksAY08
the Joint Forces Staff College cautions that the use of computer network attacks by the military
ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary
that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great
Russia introduced a proposal to the United Nations that banned the use of information
operations Even though the United Nations didnrsquot adopt the law the concern of international
community is fully aware of the impact cyber attacks can have on a nation
The concern over cyber warfare capabilities is that it can generate both non-kinetic and
kinetic effects There has always been the traditional kinetic solution for cyber warfare where a
precision guidance munition destroys a critical information system node Most people assume
computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos
computer system from the safety of onersquos own command and control center but the physical
destruction of a computer system or network by kinetic means also qualifies as cyber warfare
However cyber warfare has also evolved to the point where aggressors can achieve a kinetic
effect without the use of a traditional kinetic weapon A cyber attack on an information system
can shut down a particular node of a power plant causing the system to become inoperative
Even if there wasnrsquot an explosion the attack serves the same purpose
The question raised is do cyber attacks constitute an armed attack Scholars do agree that
some cyber attacks fit comfortably within the United Nations Charter For example a strategic
level cyber attack causing widespread damage and significant casualties would trigger the statersquos
right of self-defense In addition a cyber attack that precluded a conventional attack or a series
of cyber attacks causing significant damage would give a state the right of self-defense49 Few
would dispute that a country has the right under international law to respond with military force
19
AUACSCSinksAY08
if a state destroyed or significantly damaged another nationrsquos economic system for example the
New York or London stock exchanges
However some confusion and state-defined interpretation comes into play when the
frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard
Law School argues that cyber attacks require an expansion of the definition on the ldquouse of
forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot
be prohibited by international law50 International scholars recommend ldquoclearer rules of what
kinds of information warfare actions constitute an armed attackrdquo which drives permissible
responses of self-defense51 For example a state-sponsored cyber attack causes damage to a
victimrsquos factory or power plant however the nation claims the incident is an isolated instance
and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under
the United Nations Charter and the United Nations would consider any response retaliation
which would violate international law52
Another example involves a nation conducting a series of small attacks causing minimal
damage and then ceases Even though the aggressor used force to conduct cyber warfare
operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under
the United Nations Charter This type of attack is analogues to a small band of troops crossing a
border without causing significant damage53 According to the United Nations Charter the
national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders
and respond to the use of force Repelling the small band of troops and reestablishing their
sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration
of war and allies would have to respect the United Nations decision and couldnrsquot intervene The
same is true for the cyber attack A state can employ defensive measure to isolate and defeat the
20
AUACSCSinksAY08
incursion over the electromagnetic spectrum However the United Nations would see further
offensive operations or invasive operations as retaliation Therefore a nation must take the
incident whether it is signs of conventional forces on the ground or traces of cyber warfare
incursions in the electromagnetic spectrum to the United Nations to seek restitution
In both of these situations the international law becomes the target for change not
whether cyber warfare is in violation of international law If the law were to change the
international community would then consider the above situations acts of war even if an
adversary used conventional forces As written today the result of an operation remains the
driving factor in determining if an adversary has violated international law The means by which
an adversary conducts military operations may affect how nations react to the situation but
whether an adversary conducts the operation by means of the air land sea space or cyberspace
doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian
Triggs a public international lawyer and member of the Attorney General International Legal
Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over
offences abroad having an intended and substantial effect within a state may be justifiedrdquo54
Therefore the international community must evaluate the effect of a criminal act rather than the
means in which the act was committed
Others claim that because the Internet takes advantages of legal norms where non-state
actors can ignore Western notions of law55 more international laws are needed for cyberspace
However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using
other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the
Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked
aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts
21
AUACSCSinksAY08
against a staterdquo in the cyberspace domain The anonymity of the Internet and their total
disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and
national laws already exist in most countries that prohibit the use of the Internet for terrorist
activities therefore additional international laws wouldnrsquot prevent or deter terrorist from
committing such acts of aggression
International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed
Conflict includes the Martens Clause which extends established custom and humanitarian
principles to new technologies and addresses the ever-changing nature of warfare The
international community designed The Martens Clause ldquoto prevent future unnecessary andor
disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges
crimes by invoking the laws of humanity and public conscience hence their effects and not its
methods
The basic legal premise behind Law of Armed Conflict is that attacks must be limited to
military objectives and collateral damage must be proportionate to military advantages and
forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary
suffering but military commanders and planners need to be aware of the results a particular
action will invoke Russian leadership believes a computer network attack against their
homeland can be a means for executing a variety of escalating responses to include nuclear
attack58 Therefore it is imperative military commanders understand the impact any weapon
system can have on an adversary not just cyber attacks
Not all scholars agree that international law is insufficient to govern cyber warfare
Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace
and the Use of Force states that computer network attacks constitute an unlawful use of force in
22
AUACSCSinksAY08
cyberspace under traditional international law Sharp declared that an armed attack may occur
ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a
way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive
definition of cyber attacks may never be drafted59 The Congressional Research Service also
concluded that ldquothere is little likelihood that the international community will soon generate a
coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations
on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos
conclusion is that the effects of cyber warfare operations are the same as if an adversary
conducted conventional warfare operations where the effect of the attacks are the driving factors
in determining whether an adversary used force or not
The United States Government agrees with Sharprsquos conclusion The offensive
Information Operation strategy for the United States government as described by Doctor
Armistead ties the tools used to conduct military operations back to the desired effect which is
in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning
effects-based operations and operational art focus the Joint Force Commanderrsquos course of action
towards meeting objectives outlined in guidance provided by the National Command Authority
and senior military leadership62 Whether the tools are dropped pamphlets invasive network
attacks or bombs on targets the goal is to produce a desired effect to achieve the overall
objectives and cyber warfare can produce effects that challenge the national security of a nation
Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63
~General T Michael Moseley USAF
23
AUACSCSinksAY08
The cyberspace domain has been around for quite sometime but as technology continues
to advance businesses as well as governmental organizations are becoming more reliant on the
cyberspace domain With that reliance the protection of this critical domain becomes even more
important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the
electromagnetic spectrum by denying and disrupting information demands Scholars claim that
protection needs to include addressing existing international laws expanding them to incorporate
the ever-advancing capabilities emerging in the cyberspace domain
However territorial sovereignty of a nation and the principles of jurisdiction specifically
the Protective Security Principle give nations the right to exercise jurisdiction when an
aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64
While cyberspace is a domain requiring specific attention it relies on assets in the other domains
of land space sea and air in order to operate and international laws for the linear domains do
exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace
but during cyber warfare operations the principles behind the restrictions of foreign military
entering airspace do apply The strategic nature of cyber warfare operations correspond to the
same strategic impact that airpower can inflict upon a nation threatening their independence
While maybe not as dramatic as kinetic effects the results can be just as devastating
Space is relatively straightforward Since a nation canrsquot claim space and over flights of
foreign satellites over a nation is permissible nations must use space for peaceful purposes
Kinetic attacks against space assets are a violation of international law therefore nations would
consider cyber warfare operations against space assets as other than peaceful purposes and a
violation of international law Cyber attacks traversing space assets relate to current military
operations where the military uses space assets to conduct kinetic operations Since international
24
AUACSCSinksAY08
elites havenrsquot considered these kinetic operations as a breach of international law military
commanders can conduct cyber warfare operations through space without fear of violating
international laws for outer space
Crossing international borders without a nationrsquos permission and threatening their
sovereignty is a violation of international law While nations canrsquot consider all border crossings
as an act of war those acts of aggression that threaten the territorial integrity would elicit a
defensive response by the victim nation Whether incursions involve combat vehicles over a
highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are
threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not
have set foot in the nation but according the Protective Security Principle the victim nation has
jurisdiction
Conducting cyber warfare operations from the territorial sea is no different from
conducting operations from within a nationrsquos land or sea borders However the high seas are
very similar in nature to space in that they are reserved for peaceful purposes Therefore
conducting any means of warfare from within the high seas is a violation of international law
and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-
defense
According to Barkham ldquoinformation warfare attacks are in essence territorial
penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then
subject to the jurisdiction of the victim nation who then has the right for self-defense However
due to the global nature of cyberspace aggressors can cross multiple borders and determining
who has jurisdiction demands cooperation among nations The origin and any deliberate staging
locations of the cyber attack will drive who has jurisdiction The crossing of third party borders
25
AUACSCSinksAY08
by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the
aggressors threaten a nationrsquos independence or territorial integrity
Scholars consider cyber warfare operations that involve strategic and operational impacts
as being a means of using force and fall within the legal regime of existing international law
However scholars argue that because cyber warfare includes kinetic and non-kinetic results the
Use of Force definition needs expanding Yet they conclude that an exhaustive definition of
cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare
operations against existing case studies where the effects are evaluated as opposed to the means
even if the operations originated from outside the nationrsquos territorial jurisdiction There is some
authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to
have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade
non-state actors from conducting cyber warfare operations given their willingness to ignore
Western notions of war and their ability to conduct operations anonymously in cyberspace
International laws are in place to that address the ever-changing nature of warfare The
Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a
framework for addressing all warfare to include cyber warfare operations The international
community will need to measure the effects of an operation rather the means Whether its boots
on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a
nationrsquos response
26
AUACSCSinksAY08
End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)
27
AUACSCSinksAY08
44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
28
AUACSCSinksAY08
Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005
Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department
American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)
Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983
Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988
Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)
Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)
IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)
Joint Publication 3-13 Information Operations 13 February 2006
Joint Publication 5-0 Joint Operations Planning 26 December 2006
Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies
Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc
Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College
Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)
Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press
29
AUACSCSinksAY08
Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI
Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)
Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press
Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company
Detter Delupis I The law of war (2000) New York NY Cambridge University Press
Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)
Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College
Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor
Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)
Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)
Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf
Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)
Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College
Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College
Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)
Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA
30
AUACSCSinksAY08
Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)
Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)
Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College
Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology
Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College
Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)
OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center
OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College
OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications
Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991
Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College
Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center
Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)
31
AUACSCSinksAY08
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press
Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA
Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University
Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor
Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661
Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office
Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis
United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC
United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center
Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College
Wesley David C The Military Commander and the Law 2006
32
AUACSCSinksAY08
in applying this principle of jurisdiction However this is too broad of an interpretation and
should be confined to acts that are more tangible in nature like falsification of a statesrsquo official
documents conspiracy to violate immigration of custom laws and illicit drug trafficking42
Would a cyber attack that is deemed to challenge a nationrsquos banking community or bring
down a power source be a direct attack against its security and political independence The
international community easily sees the attack of a power source with kinetic weapons as a
violation of a territorial boundary and a breech of international law The United States viewed
the attack on the Trade Towers as an act of war launching the Global War on Terrorism Would
the United States have viewed the same devastation as if the attack occurred through cyberspace
Would the attack have been less of an act of war if the aggressor remotely controlled domestic
airliners from a foreign country Probably not What happens if the cyber attack caused a fire in
the lower floors of the buildings preventing people from escaping While less dramatic than an
airbus flying into the middle of the towers and maybe more difficult to demonize the crime the
result is the samemdashinnocent people suffering as a result of an adversary trying to threaten a
nationrsquos security
What happens if the suspected cyber attack has violated a nationrsquos territorial boundary in
order to attack a neighboring country or an ally Going from point A to point B in cyberspace is
rarely a direct connection As with the global nature of cyberspace itrsquos conceivable that
adversaries cross several nationsrsquo boundaries to conduct cyber attack operations The question
generated is who has jurisdiction
If the actor committing the crime had used an airplane each nation could claim
jurisdiction as the adversary violated their territorial boundaries and violated international law
More often than not the first state would have acted immediately upon the aggressive act and
16
AUACSCSinksAY08
would have prevented aggressors from completing their task by either forcing the aircraft to land
or turnaround or an even more escalated response of firing upon the aircraft In the air land or
sea the ability for a nationrsquos military forces to respond in a timely manner gives way to the
deterrence factor of not crossing a statersquos boundaries without receiving permission for fear of
reprisal A clear example of this was when Turkey denied the United States the ability deploy
the 4th Infantry Division from its borders at the beginning of Operation Iraqi Freedom Violating
Turkeyrsquos borders without permission would have brought about great repercussions that would
have made Operation Iraqi Freedom even more difficult and could have resulted in an escalation
of the war outside the Iraqi borders43 Another example is when Spain and France denied the
Unites States the use of their airspace when F-111s based in the United Kingdom conducted air
operations in Libya in an effort to eliminate Muammar Khadafy44
However the speeds at which these breeches in territorial boundaries occur make it
difficult for a nation to claim jurisdiction especially when nothing occurred within their
territorial sovereignty The cyber attacks didnrsquot result in any damage to nation as the information
packets passed through their sovereign borders According to territorial boundary description
described by Doctor Boczek the international community doesnrsquot consider the crossing the
border in of itself an act of warmdashserious damage is a driving factor in determining conflict
escalation In addition according to the territorial jurisdiction principle the cyber attack didnrsquot
threaten a nationrsquos security territorial integrity and political independence If the cyber attack or
information originated from within a sovereign territory by a third party then the two nations
would have to work together to resolve the issue and mutual jurisdiction would probably apply
However if the cyber attack didnrsquot physically manifest itself from within their sovereign
territory or the adversary didnrsquot use the nation as a staging area to launch a further attack the
17
AUACSCSinksAY08
international law and the jurisdiction principles would dictate the affected nation would have
jurisdiction
Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security
territorial integrity and political independence Cyberspace utilizes the other domains as a means
of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence
Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of
territorial sovereignty the Protective Security Principle does provide nations the ability to
enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos
sovereignty when it conducts cyber warfare operations However some elites donrsquot consider
cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense
International law specifically article 2 of the United Nations Charters states that a
members shall refrain in their international relations from the threat or use of force against the
territorial integrity or political independence of any state or in any other manner inconsistent
with the purposes of the United Nations which is intended to prohibit all types of force except
those carried out under the aegis of the United Nations or as provided for by the Security
Council45 The only exception to the United Nations Charters as it relates to the Use of Force is
the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed
attack46
International elites have discussed the term ldquouse of forcerdquo in the past because of the
development of chemical and biological weapons and had to move from a kinetic impact based
definition to a results-oriented approach47 Chemical and biological weapons lacked the
characteristic of an explosion or physical force yet these weapons certainly are capable of
destroying life and property Doctor Leigh Armistead a former information warfare instructor at
18
AUACSCSinksAY08
the Joint Forces Staff College cautions that the use of computer network attacks by the military
ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary
that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great
Russia introduced a proposal to the United Nations that banned the use of information
operations Even though the United Nations didnrsquot adopt the law the concern of international
community is fully aware of the impact cyber attacks can have on a nation
The concern over cyber warfare capabilities is that it can generate both non-kinetic and
kinetic effects There has always been the traditional kinetic solution for cyber warfare where a
precision guidance munition destroys a critical information system node Most people assume
computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos
computer system from the safety of onersquos own command and control center but the physical
destruction of a computer system or network by kinetic means also qualifies as cyber warfare
However cyber warfare has also evolved to the point where aggressors can achieve a kinetic
effect without the use of a traditional kinetic weapon A cyber attack on an information system
can shut down a particular node of a power plant causing the system to become inoperative
Even if there wasnrsquot an explosion the attack serves the same purpose
The question raised is do cyber attacks constitute an armed attack Scholars do agree that
some cyber attacks fit comfortably within the United Nations Charter For example a strategic
level cyber attack causing widespread damage and significant casualties would trigger the statersquos
right of self-defense In addition a cyber attack that precluded a conventional attack or a series
of cyber attacks causing significant damage would give a state the right of self-defense49 Few
would dispute that a country has the right under international law to respond with military force
19
AUACSCSinksAY08
if a state destroyed or significantly damaged another nationrsquos economic system for example the
New York or London stock exchanges
However some confusion and state-defined interpretation comes into play when the
frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard
Law School argues that cyber attacks require an expansion of the definition on the ldquouse of
forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot
be prohibited by international law50 International scholars recommend ldquoclearer rules of what
kinds of information warfare actions constitute an armed attackrdquo which drives permissible
responses of self-defense51 For example a state-sponsored cyber attack causes damage to a
victimrsquos factory or power plant however the nation claims the incident is an isolated instance
and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under
the United Nations Charter and the United Nations would consider any response retaliation
which would violate international law52
Another example involves a nation conducting a series of small attacks causing minimal
damage and then ceases Even though the aggressor used force to conduct cyber warfare
operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under
the United Nations Charter This type of attack is analogues to a small band of troops crossing a
border without causing significant damage53 According to the United Nations Charter the
national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders
and respond to the use of force Repelling the small band of troops and reestablishing their
sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration
of war and allies would have to respect the United Nations decision and couldnrsquot intervene The
same is true for the cyber attack A state can employ defensive measure to isolate and defeat the
20
AUACSCSinksAY08
incursion over the electromagnetic spectrum However the United Nations would see further
offensive operations or invasive operations as retaliation Therefore a nation must take the
incident whether it is signs of conventional forces on the ground or traces of cyber warfare
incursions in the electromagnetic spectrum to the United Nations to seek restitution
In both of these situations the international law becomes the target for change not
whether cyber warfare is in violation of international law If the law were to change the
international community would then consider the above situations acts of war even if an
adversary used conventional forces As written today the result of an operation remains the
driving factor in determining if an adversary has violated international law The means by which
an adversary conducts military operations may affect how nations react to the situation but
whether an adversary conducts the operation by means of the air land sea space or cyberspace
doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian
Triggs a public international lawyer and member of the Attorney General International Legal
Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over
offences abroad having an intended and substantial effect within a state may be justifiedrdquo54
Therefore the international community must evaluate the effect of a criminal act rather than the
means in which the act was committed
Others claim that because the Internet takes advantages of legal norms where non-state
actors can ignore Western notions of law55 more international laws are needed for cyberspace
However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using
other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the
Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked
aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts
21
AUACSCSinksAY08
against a staterdquo in the cyberspace domain The anonymity of the Internet and their total
disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and
national laws already exist in most countries that prohibit the use of the Internet for terrorist
activities therefore additional international laws wouldnrsquot prevent or deter terrorist from
committing such acts of aggression
International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed
Conflict includes the Martens Clause which extends established custom and humanitarian
principles to new technologies and addresses the ever-changing nature of warfare The
international community designed The Martens Clause ldquoto prevent future unnecessary andor
disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges
crimes by invoking the laws of humanity and public conscience hence their effects and not its
methods
The basic legal premise behind Law of Armed Conflict is that attacks must be limited to
military objectives and collateral damage must be proportionate to military advantages and
forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary
suffering but military commanders and planners need to be aware of the results a particular
action will invoke Russian leadership believes a computer network attack against their
homeland can be a means for executing a variety of escalating responses to include nuclear
attack58 Therefore it is imperative military commanders understand the impact any weapon
system can have on an adversary not just cyber attacks
Not all scholars agree that international law is insufficient to govern cyber warfare
Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace
and the Use of Force states that computer network attacks constitute an unlawful use of force in
22
AUACSCSinksAY08
cyberspace under traditional international law Sharp declared that an armed attack may occur
ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a
way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive
definition of cyber attacks may never be drafted59 The Congressional Research Service also
concluded that ldquothere is little likelihood that the international community will soon generate a
coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations
on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos
conclusion is that the effects of cyber warfare operations are the same as if an adversary
conducted conventional warfare operations where the effect of the attacks are the driving factors
in determining whether an adversary used force or not
The United States Government agrees with Sharprsquos conclusion The offensive
Information Operation strategy for the United States government as described by Doctor
Armistead ties the tools used to conduct military operations back to the desired effect which is
in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning
effects-based operations and operational art focus the Joint Force Commanderrsquos course of action
towards meeting objectives outlined in guidance provided by the National Command Authority
and senior military leadership62 Whether the tools are dropped pamphlets invasive network
attacks or bombs on targets the goal is to produce a desired effect to achieve the overall
objectives and cyber warfare can produce effects that challenge the national security of a nation
Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63
~General T Michael Moseley USAF
23
AUACSCSinksAY08
The cyberspace domain has been around for quite sometime but as technology continues
to advance businesses as well as governmental organizations are becoming more reliant on the
cyberspace domain With that reliance the protection of this critical domain becomes even more
important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the
electromagnetic spectrum by denying and disrupting information demands Scholars claim that
protection needs to include addressing existing international laws expanding them to incorporate
the ever-advancing capabilities emerging in the cyberspace domain
However territorial sovereignty of a nation and the principles of jurisdiction specifically
the Protective Security Principle give nations the right to exercise jurisdiction when an
aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64
While cyberspace is a domain requiring specific attention it relies on assets in the other domains
of land space sea and air in order to operate and international laws for the linear domains do
exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace
but during cyber warfare operations the principles behind the restrictions of foreign military
entering airspace do apply The strategic nature of cyber warfare operations correspond to the
same strategic impact that airpower can inflict upon a nation threatening their independence
While maybe not as dramatic as kinetic effects the results can be just as devastating
Space is relatively straightforward Since a nation canrsquot claim space and over flights of
foreign satellites over a nation is permissible nations must use space for peaceful purposes
Kinetic attacks against space assets are a violation of international law therefore nations would
consider cyber warfare operations against space assets as other than peaceful purposes and a
violation of international law Cyber attacks traversing space assets relate to current military
operations where the military uses space assets to conduct kinetic operations Since international
24
AUACSCSinksAY08
elites havenrsquot considered these kinetic operations as a breach of international law military
commanders can conduct cyber warfare operations through space without fear of violating
international laws for outer space
Crossing international borders without a nationrsquos permission and threatening their
sovereignty is a violation of international law While nations canrsquot consider all border crossings
as an act of war those acts of aggression that threaten the territorial integrity would elicit a
defensive response by the victim nation Whether incursions involve combat vehicles over a
highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are
threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not
have set foot in the nation but according the Protective Security Principle the victim nation has
jurisdiction
Conducting cyber warfare operations from the territorial sea is no different from
conducting operations from within a nationrsquos land or sea borders However the high seas are
very similar in nature to space in that they are reserved for peaceful purposes Therefore
conducting any means of warfare from within the high seas is a violation of international law
and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-
defense
According to Barkham ldquoinformation warfare attacks are in essence territorial
penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then
subject to the jurisdiction of the victim nation who then has the right for self-defense However
due to the global nature of cyberspace aggressors can cross multiple borders and determining
who has jurisdiction demands cooperation among nations The origin and any deliberate staging
locations of the cyber attack will drive who has jurisdiction The crossing of third party borders
25
AUACSCSinksAY08
by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the
aggressors threaten a nationrsquos independence or territorial integrity
Scholars consider cyber warfare operations that involve strategic and operational impacts
as being a means of using force and fall within the legal regime of existing international law
However scholars argue that because cyber warfare includes kinetic and non-kinetic results the
Use of Force definition needs expanding Yet they conclude that an exhaustive definition of
cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare
operations against existing case studies where the effects are evaluated as opposed to the means
even if the operations originated from outside the nationrsquos territorial jurisdiction There is some
authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to
have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade
non-state actors from conducting cyber warfare operations given their willingness to ignore
Western notions of war and their ability to conduct operations anonymously in cyberspace
International laws are in place to that address the ever-changing nature of warfare The
Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a
framework for addressing all warfare to include cyber warfare operations The international
community will need to measure the effects of an operation rather the means Whether its boots
on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a
nationrsquos response
26
AUACSCSinksAY08
End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)
27
AUACSCSinksAY08
44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
28
AUACSCSinksAY08
Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005
Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department
American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)
Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983
Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988
Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)
Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)
IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)
Joint Publication 3-13 Information Operations 13 February 2006
Joint Publication 5-0 Joint Operations Planning 26 December 2006
Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies
Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc
Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College
Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)
Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press
29
AUACSCSinksAY08
Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI
Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)
Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press
Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company
Detter Delupis I The law of war (2000) New York NY Cambridge University Press
Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)
Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College
Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor
Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)
Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)
Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf
Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)
Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College
Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College
Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)
Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA
30
AUACSCSinksAY08
Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)
Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)
Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College
Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology
Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College
Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)
OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center
OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College
OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications
Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991
Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College
Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center
Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)
31
AUACSCSinksAY08
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press
Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA
Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University
Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor
Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661
Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office
Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis
United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC
United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center
Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College
Wesley David C The Military Commander and the Law 2006
32
AUACSCSinksAY08
would have prevented aggressors from completing their task by either forcing the aircraft to land
or turnaround or an even more escalated response of firing upon the aircraft In the air land or
sea the ability for a nationrsquos military forces to respond in a timely manner gives way to the
deterrence factor of not crossing a statersquos boundaries without receiving permission for fear of
reprisal A clear example of this was when Turkey denied the United States the ability deploy
the 4th Infantry Division from its borders at the beginning of Operation Iraqi Freedom Violating
Turkeyrsquos borders without permission would have brought about great repercussions that would
have made Operation Iraqi Freedom even more difficult and could have resulted in an escalation
of the war outside the Iraqi borders43 Another example is when Spain and France denied the
Unites States the use of their airspace when F-111s based in the United Kingdom conducted air
operations in Libya in an effort to eliminate Muammar Khadafy44
However the speeds at which these breeches in territorial boundaries occur make it
difficult for a nation to claim jurisdiction especially when nothing occurred within their
territorial sovereignty The cyber attacks didnrsquot result in any damage to nation as the information
packets passed through their sovereign borders According to territorial boundary description
described by Doctor Boczek the international community doesnrsquot consider the crossing the
border in of itself an act of warmdashserious damage is a driving factor in determining conflict
escalation In addition according to the territorial jurisdiction principle the cyber attack didnrsquot
threaten a nationrsquos security territorial integrity and political independence If the cyber attack or
information originated from within a sovereign territory by a third party then the two nations
would have to work together to resolve the issue and mutual jurisdiction would probably apply
However if the cyber attack didnrsquot physically manifest itself from within their sovereign
territory or the adversary didnrsquot use the nation as a staging area to launch a further attack the
17
AUACSCSinksAY08
international law and the jurisdiction principles would dictate the affected nation would have
jurisdiction
Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security
territorial integrity and political independence Cyberspace utilizes the other domains as a means
of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence
Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of
territorial sovereignty the Protective Security Principle does provide nations the ability to
enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos
sovereignty when it conducts cyber warfare operations However some elites donrsquot consider
cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense
International law specifically article 2 of the United Nations Charters states that a
members shall refrain in their international relations from the threat or use of force against the
territorial integrity or political independence of any state or in any other manner inconsistent
with the purposes of the United Nations which is intended to prohibit all types of force except
those carried out under the aegis of the United Nations or as provided for by the Security
Council45 The only exception to the United Nations Charters as it relates to the Use of Force is
the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed
attack46
International elites have discussed the term ldquouse of forcerdquo in the past because of the
development of chemical and biological weapons and had to move from a kinetic impact based
definition to a results-oriented approach47 Chemical and biological weapons lacked the
characteristic of an explosion or physical force yet these weapons certainly are capable of
destroying life and property Doctor Leigh Armistead a former information warfare instructor at
18
AUACSCSinksAY08
the Joint Forces Staff College cautions that the use of computer network attacks by the military
ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary
that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great
Russia introduced a proposal to the United Nations that banned the use of information
operations Even though the United Nations didnrsquot adopt the law the concern of international
community is fully aware of the impact cyber attacks can have on a nation
The concern over cyber warfare capabilities is that it can generate both non-kinetic and
kinetic effects There has always been the traditional kinetic solution for cyber warfare where a
precision guidance munition destroys a critical information system node Most people assume
computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos
computer system from the safety of onersquos own command and control center but the physical
destruction of a computer system or network by kinetic means also qualifies as cyber warfare
However cyber warfare has also evolved to the point where aggressors can achieve a kinetic
effect without the use of a traditional kinetic weapon A cyber attack on an information system
can shut down a particular node of a power plant causing the system to become inoperative
Even if there wasnrsquot an explosion the attack serves the same purpose
The question raised is do cyber attacks constitute an armed attack Scholars do agree that
some cyber attacks fit comfortably within the United Nations Charter For example a strategic
level cyber attack causing widespread damage and significant casualties would trigger the statersquos
right of self-defense In addition a cyber attack that precluded a conventional attack or a series
of cyber attacks causing significant damage would give a state the right of self-defense49 Few
would dispute that a country has the right under international law to respond with military force
19
AUACSCSinksAY08
if a state destroyed or significantly damaged another nationrsquos economic system for example the
New York or London stock exchanges
However some confusion and state-defined interpretation comes into play when the
frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard
Law School argues that cyber attacks require an expansion of the definition on the ldquouse of
forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot
be prohibited by international law50 International scholars recommend ldquoclearer rules of what
kinds of information warfare actions constitute an armed attackrdquo which drives permissible
responses of self-defense51 For example a state-sponsored cyber attack causes damage to a
victimrsquos factory or power plant however the nation claims the incident is an isolated instance
and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under
the United Nations Charter and the United Nations would consider any response retaliation
which would violate international law52
Another example involves a nation conducting a series of small attacks causing minimal
damage and then ceases Even though the aggressor used force to conduct cyber warfare
operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under
the United Nations Charter This type of attack is analogues to a small band of troops crossing a
border without causing significant damage53 According to the United Nations Charter the
national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders
and respond to the use of force Repelling the small band of troops and reestablishing their
sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration
of war and allies would have to respect the United Nations decision and couldnrsquot intervene The
same is true for the cyber attack A state can employ defensive measure to isolate and defeat the
20
AUACSCSinksAY08
incursion over the electromagnetic spectrum However the United Nations would see further
offensive operations or invasive operations as retaliation Therefore a nation must take the
incident whether it is signs of conventional forces on the ground or traces of cyber warfare
incursions in the electromagnetic spectrum to the United Nations to seek restitution
In both of these situations the international law becomes the target for change not
whether cyber warfare is in violation of international law If the law were to change the
international community would then consider the above situations acts of war even if an
adversary used conventional forces As written today the result of an operation remains the
driving factor in determining if an adversary has violated international law The means by which
an adversary conducts military operations may affect how nations react to the situation but
whether an adversary conducts the operation by means of the air land sea space or cyberspace
doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian
Triggs a public international lawyer and member of the Attorney General International Legal
Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over
offences abroad having an intended and substantial effect within a state may be justifiedrdquo54
Therefore the international community must evaluate the effect of a criminal act rather than the
means in which the act was committed
Others claim that because the Internet takes advantages of legal norms where non-state
actors can ignore Western notions of law55 more international laws are needed for cyberspace
However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using
other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the
Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked
aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts
21
AUACSCSinksAY08
against a staterdquo in the cyberspace domain The anonymity of the Internet and their total
disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and
national laws already exist in most countries that prohibit the use of the Internet for terrorist
activities therefore additional international laws wouldnrsquot prevent or deter terrorist from
committing such acts of aggression
International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed
Conflict includes the Martens Clause which extends established custom and humanitarian
principles to new technologies and addresses the ever-changing nature of warfare The
international community designed The Martens Clause ldquoto prevent future unnecessary andor
disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges
crimes by invoking the laws of humanity and public conscience hence their effects and not its
methods
The basic legal premise behind Law of Armed Conflict is that attacks must be limited to
military objectives and collateral damage must be proportionate to military advantages and
forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary
suffering but military commanders and planners need to be aware of the results a particular
action will invoke Russian leadership believes a computer network attack against their
homeland can be a means for executing a variety of escalating responses to include nuclear
attack58 Therefore it is imperative military commanders understand the impact any weapon
system can have on an adversary not just cyber attacks
Not all scholars agree that international law is insufficient to govern cyber warfare
Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace
and the Use of Force states that computer network attacks constitute an unlawful use of force in
22
AUACSCSinksAY08
cyberspace under traditional international law Sharp declared that an armed attack may occur
ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a
way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive
definition of cyber attacks may never be drafted59 The Congressional Research Service also
concluded that ldquothere is little likelihood that the international community will soon generate a
coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations
on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos
conclusion is that the effects of cyber warfare operations are the same as if an adversary
conducted conventional warfare operations where the effect of the attacks are the driving factors
in determining whether an adversary used force or not
The United States Government agrees with Sharprsquos conclusion The offensive
Information Operation strategy for the United States government as described by Doctor
Armistead ties the tools used to conduct military operations back to the desired effect which is
in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning
effects-based operations and operational art focus the Joint Force Commanderrsquos course of action
towards meeting objectives outlined in guidance provided by the National Command Authority
and senior military leadership62 Whether the tools are dropped pamphlets invasive network
attacks or bombs on targets the goal is to produce a desired effect to achieve the overall
objectives and cyber warfare can produce effects that challenge the national security of a nation
Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63
~General T Michael Moseley USAF
23
AUACSCSinksAY08
The cyberspace domain has been around for quite sometime but as technology continues
to advance businesses as well as governmental organizations are becoming more reliant on the
cyberspace domain With that reliance the protection of this critical domain becomes even more
important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the
electromagnetic spectrum by denying and disrupting information demands Scholars claim that
protection needs to include addressing existing international laws expanding them to incorporate
the ever-advancing capabilities emerging in the cyberspace domain
However territorial sovereignty of a nation and the principles of jurisdiction specifically
the Protective Security Principle give nations the right to exercise jurisdiction when an
aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64
While cyberspace is a domain requiring specific attention it relies on assets in the other domains
of land space sea and air in order to operate and international laws for the linear domains do
exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace
but during cyber warfare operations the principles behind the restrictions of foreign military
entering airspace do apply The strategic nature of cyber warfare operations correspond to the
same strategic impact that airpower can inflict upon a nation threatening their independence
While maybe not as dramatic as kinetic effects the results can be just as devastating
Space is relatively straightforward Since a nation canrsquot claim space and over flights of
foreign satellites over a nation is permissible nations must use space for peaceful purposes
Kinetic attacks against space assets are a violation of international law therefore nations would
consider cyber warfare operations against space assets as other than peaceful purposes and a
violation of international law Cyber attacks traversing space assets relate to current military
operations where the military uses space assets to conduct kinetic operations Since international
24
AUACSCSinksAY08
elites havenrsquot considered these kinetic operations as a breach of international law military
commanders can conduct cyber warfare operations through space without fear of violating
international laws for outer space
Crossing international borders without a nationrsquos permission and threatening their
sovereignty is a violation of international law While nations canrsquot consider all border crossings
as an act of war those acts of aggression that threaten the territorial integrity would elicit a
defensive response by the victim nation Whether incursions involve combat vehicles over a
highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are
threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not
have set foot in the nation but according the Protective Security Principle the victim nation has
jurisdiction
Conducting cyber warfare operations from the territorial sea is no different from
conducting operations from within a nationrsquos land or sea borders However the high seas are
very similar in nature to space in that they are reserved for peaceful purposes Therefore
conducting any means of warfare from within the high seas is a violation of international law
and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-
defense
According to Barkham ldquoinformation warfare attacks are in essence territorial
penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then
subject to the jurisdiction of the victim nation who then has the right for self-defense However
due to the global nature of cyberspace aggressors can cross multiple borders and determining
who has jurisdiction demands cooperation among nations The origin and any deliberate staging
locations of the cyber attack will drive who has jurisdiction The crossing of third party borders
25
AUACSCSinksAY08
by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the
aggressors threaten a nationrsquos independence or territorial integrity
Scholars consider cyber warfare operations that involve strategic and operational impacts
as being a means of using force and fall within the legal regime of existing international law
However scholars argue that because cyber warfare includes kinetic and non-kinetic results the
Use of Force definition needs expanding Yet they conclude that an exhaustive definition of
cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare
operations against existing case studies where the effects are evaluated as opposed to the means
even if the operations originated from outside the nationrsquos territorial jurisdiction There is some
authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to
have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade
non-state actors from conducting cyber warfare operations given their willingness to ignore
Western notions of war and their ability to conduct operations anonymously in cyberspace
International laws are in place to that address the ever-changing nature of warfare The
Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a
framework for addressing all warfare to include cyber warfare operations The international
community will need to measure the effects of an operation rather the means Whether its boots
on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a
nationrsquos response
26
AUACSCSinksAY08
End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)
27
AUACSCSinksAY08
44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
28
AUACSCSinksAY08
Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005
Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department
American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)
Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983
Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988
Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)
Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)
IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)
Joint Publication 3-13 Information Operations 13 February 2006
Joint Publication 5-0 Joint Operations Planning 26 December 2006
Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies
Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc
Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College
Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)
Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press
29
AUACSCSinksAY08
Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI
Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)
Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press
Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company
Detter Delupis I The law of war (2000) New York NY Cambridge University Press
Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)
Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College
Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor
Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)
Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)
Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf
Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)
Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College
Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College
Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)
Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA
30
AUACSCSinksAY08
Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)
Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)
Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College
Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology
Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College
Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)
OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center
OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College
OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications
Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991
Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College
Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center
Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)
31
AUACSCSinksAY08
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press
Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA
Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University
Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor
Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661
Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office
Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis
United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC
United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center
Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College
Wesley David C The Military Commander and the Law 2006
32
AUACSCSinksAY08
international law and the jurisdiction principles would dictate the affected nation would have
jurisdiction
Use of Force Violating sovereign borders through the air by land or sea threatens a nationrsquos security
territorial integrity and political independence Cyberspace utilizes the other domains as a means
of transmitting through the electromagnetic spectrum and can threaten a nationrsquos existence
Even if academic elites agree that the cyberspace domain doesnrsquot fall within the conscripts of
territorial sovereignty the Protective Security Principle does provide nations the ability to
enforce international law as it relates to cyber attacks An adversary attacks a nationrsquos
sovereignty when it conducts cyber warfare operations However some elites donrsquot consider
cyber attacks as ldquoarmed attacksrdquo which would give a nation the right to act in self-defense
International law specifically article 2 of the United Nations Charters states that a
members shall refrain in their international relations from the threat or use of force against the
territorial integrity or political independence of any state or in any other manner inconsistent
with the purposes of the United Nations which is intended to prohibit all types of force except
those carried out under the aegis of the United Nations or as provided for by the Security
Council45 The only exception to the United Nations Charters as it relates to the Use of Force is
the right of self-defense Use of Force is justified if a state or an ally is a victim of an armed
attack46
International elites have discussed the term ldquouse of forcerdquo in the past because of the
development of chemical and biological weapons and had to move from a kinetic impact based
definition to a results-oriented approach47 Chemical and biological weapons lacked the
characteristic of an explosion or physical force yet these weapons certainly are capable of
destroying life and property Doctor Leigh Armistead a former information warfare instructor at
18
AUACSCSinksAY08
the Joint Forces Staff College cautions that the use of computer network attacks by the military
ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary
that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great
Russia introduced a proposal to the United Nations that banned the use of information
operations Even though the United Nations didnrsquot adopt the law the concern of international
community is fully aware of the impact cyber attacks can have on a nation
The concern over cyber warfare capabilities is that it can generate both non-kinetic and
kinetic effects There has always been the traditional kinetic solution for cyber warfare where a
precision guidance munition destroys a critical information system node Most people assume
computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos
computer system from the safety of onersquos own command and control center but the physical
destruction of a computer system or network by kinetic means also qualifies as cyber warfare
However cyber warfare has also evolved to the point where aggressors can achieve a kinetic
effect without the use of a traditional kinetic weapon A cyber attack on an information system
can shut down a particular node of a power plant causing the system to become inoperative
Even if there wasnrsquot an explosion the attack serves the same purpose
The question raised is do cyber attacks constitute an armed attack Scholars do agree that
some cyber attacks fit comfortably within the United Nations Charter For example a strategic
level cyber attack causing widespread damage and significant casualties would trigger the statersquos
right of self-defense In addition a cyber attack that precluded a conventional attack or a series
of cyber attacks causing significant damage would give a state the right of self-defense49 Few
would dispute that a country has the right under international law to respond with military force
19
AUACSCSinksAY08
if a state destroyed or significantly damaged another nationrsquos economic system for example the
New York or London stock exchanges
However some confusion and state-defined interpretation comes into play when the
frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard
Law School argues that cyber attacks require an expansion of the definition on the ldquouse of
forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot
be prohibited by international law50 International scholars recommend ldquoclearer rules of what
kinds of information warfare actions constitute an armed attackrdquo which drives permissible
responses of self-defense51 For example a state-sponsored cyber attack causes damage to a
victimrsquos factory or power plant however the nation claims the incident is an isolated instance
and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under
the United Nations Charter and the United Nations would consider any response retaliation
which would violate international law52
Another example involves a nation conducting a series of small attacks causing minimal
damage and then ceases Even though the aggressor used force to conduct cyber warfare
operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under
the United Nations Charter This type of attack is analogues to a small band of troops crossing a
border without causing significant damage53 According to the United Nations Charter the
national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders
and respond to the use of force Repelling the small band of troops and reestablishing their
sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration
of war and allies would have to respect the United Nations decision and couldnrsquot intervene The
same is true for the cyber attack A state can employ defensive measure to isolate and defeat the
20
AUACSCSinksAY08
incursion over the electromagnetic spectrum However the United Nations would see further
offensive operations or invasive operations as retaliation Therefore a nation must take the
incident whether it is signs of conventional forces on the ground or traces of cyber warfare
incursions in the electromagnetic spectrum to the United Nations to seek restitution
In both of these situations the international law becomes the target for change not
whether cyber warfare is in violation of international law If the law were to change the
international community would then consider the above situations acts of war even if an
adversary used conventional forces As written today the result of an operation remains the
driving factor in determining if an adversary has violated international law The means by which
an adversary conducts military operations may affect how nations react to the situation but
whether an adversary conducts the operation by means of the air land sea space or cyberspace
doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian
Triggs a public international lawyer and member of the Attorney General International Legal
Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over
offences abroad having an intended and substantial effect within a state may be justifiedrdquo54
Therefore the international community must evaluate the effect of a criminal act rather than the
means in which the act was committed
Others claim that because the Internet takes advantages of legal norms where non-state
actors can ignore Western notions of law55 more international laws are needed for cyberspace
However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using
other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the
Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked
aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts
21
AUACSCSinksAY08
against a staterdquo in the cyberspace domain The anonymity of the Internet and their total
disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and
national laws already exist in most countries that prohibit the use of the Internet for terrorist
activities therefore additional international laws wouldnrsquot prevent or deter terrorist from
committing such acts of aggression
International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed
Conflict includes the Martens Clause which extends established custom and humanitarian
principles to new technologies and addresses the ever-changing nature of warfare The
international community designed The Martens Clause ldquoto prevent future unnecessary andor
disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges
crimes by invoking the laws of humanity and public conscience hence their effects and not its
methods
The basic legal premise behind Law of Armed Conflict is that attacks must be limited to
military objectives and collateral damage must be proportionate to military advantages and
forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary
suffering but military commanders and planners need to be aware of the results a particular
action will invoke Russian leadership believes a computer network attack against their
homeland can be a means for executing a variety of escalating responses to include nuclear
attack58 Therefore it is imperative military commanders understand the impact any weapon
system can have on an adversary not just cyber attacks
Not all scholars agree that international law is insufficient to govern cyber warfare
Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace
and the Use of Force states that computer network attacks constitute an unlawful use of force in
22
AUACSCSinksAY08
cyberspace under traditional international law Sharp declared that an armed attack may occur
ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a
way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive
definition of cyber attacks may never be drafted59 The Congressional Research Service also
concluded that ldquothere is little likelihood that the international community will soon generate a
coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations
on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos
conclusion is that the effects of cyber warfare operations are the same as if an adversary
conducted conventional warfare operations where the effect of the attacks are the driving factors
in determining whether an adversary used force or not
The United States Government agrees with Sharprsquos conclusion The offensive
Information Operation strategy for the United States government as described by Doctor
Armistead ties the tools used to conduct military operations back to the desired effect which is
in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning
effects-based operations and operational art focus the Joint Force Commanderrsquos course of action
towards meeting objectives outlined in guidance provided by the National Command Authority
and senior military leadership62 Whether the tools are dropped pamphlets invasive network
attacks or bombs on targets the goal is to produce a desired effect to achieve the overall
objectives and cyber warfare can produce effects that challenge the national security of a nation
Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63
~General T Michael Moseley USAF
23
AUACSCSinksAY08
The cyberspace domain has been around for quite sometime but as technology continues
to advance businesses as well as governmental organizations are becoming more reliant on the
cyberspace domain With that reliance the protection of this critical domain becomes even more
important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the
electromagnetic spectrum by denying and disrupting information demands Scholars claim that
protection needs to include addressing existing international laws expanding them to incorporate
the ever-advancing capabilities emerging in the cyberspace domain
However territorial sovereignty of a nation and the principles of jurisdiction specifically
the Protective Security Principle give nations the right to exercise jurisdiction when an
aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64
While cyberspace is a domain requiring specific attention it relies on assets in the other domains
of land space sea and air in order to operate and international laws for the linear domains do
exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace
but during cyber warfare operations the principles behind the restrictions of foreign military
entering airspace do apply The strategic nature of cyber warfare operations correspond to the
same strategic impact that airpower can inflict upon a nation threatening their independence
While maybe not as dramatic as kinetic effects the results can be just as devastating
Space is relatively straightforward Since a nation canrsquot claim space and over flights of
foreign satellites over a nation is permissible nations must use space for peaceful purposes
Kinetic attacks against space assets are a violation of international law therefore nations would
consider cyber warfare operations against space assets as other than peaceful purposes and a
violation of international law Cyber attacks traversing space assets relate to current military
operations where the military uses space assets to conduct kinetic operations Since international
24
AUACSCSinksAY08
elites havenrsquot considered these kinetic operations as a breach of international law military
commanders can conduct cyber warfare operations through space without fear of violating
international laws for outer space
Crossing international borders without a nationrsquos permission and threatening their
sovereignty is a violation of international law While nations canrsquot consider all border crossings
as an act of war those acts of aggression that threaten the territorial integrity would elicit a
defensive response by the victim nation Whether incursions involve combat vehicles over a
highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are
threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not
have set foot in the nation but according the Protective Security Principle the victim nation has
jurisdiction
Conducting cyber warfare operations from the territorial sea is no different from
conducting operations from within a nationrsquos land or sea borders However the high seas are
very similar in nature to space in that they are reserved for peaceful purposes Therefore
conducting any means of warfare from within the high seas is a violation of international law
and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-
defense
According to Barkham ldquoinformation warfare attacks are in essence territorial
penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then
subject to the jurisdiction of the victim nation who then has the right for self-defense However
due to the global nature of cyberspace aggressors can cross multiple borders and determining
who has jurisdiction demands cooperation among nations The origin and any deliberate staging
locations of the cyber attack will drive who has jurisdiction The crossing of third party borders
25
AUACSCSinksAY08
by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the
aggressors threaten a nationrsquos independence or territorial integrity
Scholars consider cyber warfare operations that involve strategic and operational impacts
as being a means of using force and fall within the legal regime of existing international law
However scholars argue that because cyber warfare includes kinetic and non-kinetic results the
Use of Force definition needs expanding Yet they conclude that an exhaustive definition of
cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare
operations against existing case studies where the effects are evaluated as opposed to the means
even if the operations originated from outside the nationrsquos territorial jurisdiction There is some
authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to
have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade
non-state actors from conducting cyber warfare operations given their willingness to ignore
Western notions of war and their ability to conduct operations anonymously in cyberspace
International laws are in place to that address the ever-changing nature of warfare The
Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a
framework for addressing all warfare to include cyber warfare operations The international
community will need to measure the effects of an operation rather the means Whether its boots
on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a
nationrsquos response
26
AUACSCSinksAY08
End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)
27
AUACSCSinksAY08
44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
28
AUACSCSinksAY08
Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005
Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department
American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)
Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983
Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988
Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)
Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)
IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)
Joint Publication 3-13 Information Operations 13 February 2006
Joint Publication 5-0 Joint Operations Planning 26 December 2006
Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies
Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc
Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College
Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)
Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press
29
AUACSCSinksAY08
Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI
Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)
Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press
Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company
Detter Delupis I The law of war (2000) New York NY Cambridge University Press
Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)
Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College
Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor
Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)
Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)
Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf
Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)
Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College
Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College
Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)
Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA
30
AUACSCSinksAY08
Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)
Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)
Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College
Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology
Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College
Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)
OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center
OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College
OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications
Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991
Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College
Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center
Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)
31
AUACSCSinksAY08
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press
Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA
Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University
Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor
Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661
Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office
Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis
United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC
United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center
Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College
Wesley David C The Military Commander and the Law 2006
32
AUACSCSinksAY08
the Joint Forces Staff College cautions that the use of computer network attacks by the military
ldquois similar to the Nuclear Biologic Chemical criterion of not using any weapon on an adversary
that the user is not fully prepared to defend againstrdquo48 The concern of cyber attack is so great
Russia introduced a proposal to the United Nations that banned the use of information
operations Even though the United Nations didnrsquot adopt the law the concern of international
community is fully aware of the impact cyber attacks can have on a nation
The concern over cyber warfare capabilities is that it can generate both non-kinetic and
kinetic effects There has always been the traditional kinetic solution for cyber warfare where a
precision guidance munition destroys a critical information system node Most people assume
computer network attacks as operations conducted over the Internethellipto disable an enemyrsquos
computer system from the safety of onersquos own command and control center but the physical
destruction of a computer system or network by kinetic means also qualifies as cyber warfare
However cyber warfare has also evolved to the point where aggressors can achieve a kinetic
effect without the use of a traditional kinetic weapon A cyber attack on an information system
can shut down a particular node of a power plant causing the system to become inoperative
Even if there wasnrsquot an explosion the attack serves the same purpose
The question raised is do cyber attacks constitute an armed attack Scholars do agree that
some cyber attacks fit comfortably within the United Nations Charter For example a strategic
level cyber attack causing widespread damage and significant casualties would trigger the statersquos
right of self-defense In addition a cyber attack that precluded a conventional attack or a series
of cyber attacks causing significant damage would give a state the right of self-defense49 Few
would dispute that a country has the right under international law to respond with military force
19
AUACSCSinksAY08
if a state destroyed or significantly damaged another nationrsquos economic system for example the
New York or London stock exchanges
However some confusion and state-defined interpretation comes into play when the
frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard
Law School argues that cyber attacks require an expansion of the definition on the ldquouse of
forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot
be prohibited by international law50 International scholars recommend ldquoclearer rules of what
kinds of information warfare actions constitute an armed attackrdquo which drives permissible
responses of self-defense51 For example a state-sponsored cyber attack causes damage to a
victimrsquos factory or power plant however the nation claims the incident is an isolated instance
and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under
the United Nations Charter and the United Nations would consider any response retaliation
which would violate international law52
Another example involves a nation conducting a series of small attacks causing minimal
damage and then ceases Even though the aggressor used force to conduct cyber warfare
operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under
the United Nations Charter This type of attack is analogues to a small band of troops crossing a
border without causing significant damage53 According to the United Nations Charter the
national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders
and respond to the use of force Repelling the small band of troops and reestablishing their
sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration
of war and allies would have to respect the United Nations decision and couldnrsquot intervene The
same is true for the cyber attack A state can employ defensive measure to isolate and defeat the
20
AUACSCSinksAY08
incursion over the electromagnetic spectrum However the United Nations would see further
offensive operations or invasive operations as retaliation Therefore a nation must take the
incident whether it is signs of conventional forces on the ground or traces of cyber warfare
incursions in the electromagnetic spectrum to the United Nations to seek restitution
In both of these situations the international law becomes the target for change not
whether cyber warfare is in violation of international law If the law were to change the
international community would then consider the above situations acts of war even if an
adversary used conventional forces As written today the result of an operation remains the
driving factor in determining if an adversary has violated international law The means by which
an adversary conducts military operations may affect how nations react to the situation but
whether an adversary conducts the operation by means of the air land sea space or cyberspace
doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian
Triggs a public international lawyer and member of the Attorney General International Legal
Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over
offences abroad having an intended and substantial effect within a state may be justifiedrdquo54
Therefore the international community must evaluate the effect of a criminal act rather than the
means in which the act was committed
Others claim that because the Internet takes advantages of legal norms where non-state
actors can ignore Western notions of law55 more international laws are needed for cyberspace
However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using
other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the
Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked
aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts
21
AUACSCSinksAY08
against a staterdquo in the cyberspace domain The anonymity of the Internet and their total
disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and
national laws already exist in most countries that prohibit the use of the Internet for terrorist
activities therefore additional international laws wouldnrsquot prevent or deter terrorist from
committing such acts of aggression
International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed
Conflict includes the Martens Clause which extends established custom and humanitarian
principles to new technologies and addresses the ever-changing nature of warfare The
international community designed The Martens Clause ldquoto prevent future unnecessary andor
disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges
crimes by invoking the laws of humanity and public conscience hence their effects and not its
methods
The basic legal premise behind Law of Armed Conflict is that attacks must be limited to
military objectives and collateral damage must be proportionate to military advantages and
forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary
suffering but military commanders and planners need to be aware of the results a particular
action will invoke Russian leadership believes a computer network attack against their
homeland can be a means for executing a variety of escalating responses to include nuclear
attack58 Therefore it is imperative military commanders understand the impact any weapon
system can have on an adversary not just cyber attacks
Not all scholars agree that international law is insufficient to govern cyber warfare
Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace
and the Use of Force states that computer network attacks constitute an unlawful use of force in
22
AUACSCSinksAY08
cyberspace under traditional international law Sharp declared that an armed attack may occur
ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a
way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive
definition of cyber attacks may never be drafted59 The Congressional Research Service also
concluded that ldquothere is little likelihood that the international community will soon generate a
coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations
on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos
conclusion is that the effects of cyber warfare operations are the same as if an adversary
conducted conventional warfare operations where the effect of the attacks are the driving factors
in determining whether an adversary used force or not
The United States Government agrees with Sharprsquos conclusion The offensive
Information Operation strategy for the United States government as described by Doctor
Armistead ties the tools used to conduct military operations back to the desired effect which is
in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning
effects-based operations and operational art focus the Joint Force Commanderrsquos course of action
towards meeting objectives outlined in guidance provided by the National Command Authority
and senior military leadership62 Whether the tools are dropped pamphlets invasive network
attacks or bombs on targets the goal is to produce a desired effect to achieve the overall
objectives and cyber warfare can produce effects that challenge the national security of a nation
Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63
~General T Michael Moseley USAF
23
AUACSCSinksAY08
The cyberspace domain has been around for quite sometime but as technology continues
to advance businesses as well as governmental organizations are becoming more reliant on the
cyberspace domain With that reliance the protection of this critical domain becomes even more
important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the
electromagnetic spectrum by denying and disrupting information demands Scholars claim that
protection needs to include addressing existing international laws expanding them to incorporate
the ever-advancing capabilities emerging in the cyberspace domain
However territorial sovereignty of a nation and the principles of jurisdiction specifically
the Protective Security Principle give nations the right to exercise jurisdiction when an
aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64
While cyberspace is a domain requiring specific attention it relies on assets in the other domains
of land space sea and air in order to operate and international laws for the linear domains do
exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace
but during cyber warfare operations the principles behind the restrictions of foreign military
entering airspace do apply The strategic nature of cyber warfare operations correspond to the
same strategic impact that airpower can inflict upon a nation threatening their independence
While maybe not as dramatic as kinetic effects the results can be just as devastating
Space is relatively straightforward Since a nation canrsquot claim space and over flights of
foreign satellites over a nation is permissible nations must use space for peaceful purposes
Kinetic attacks against space assets are a violation of international law therefore nations would
consider cyber warfare operations against space assets as other than peaceful purposes and a
violation of international law Cyber attacks traversing space assets relate to current military
operations where the military uses space assets to conduct kinetic operations Since international
24
AUACSCSinksAY08
elites havenrsquot considered these kinetic operations as a breach of international law military
commanders can conduct cyber warfare operations through space without fear of violating
international laws for outer space
Crossing international borders without a nationrsquos permission and threatening their
sovereignty is a violation of international law While nations canrsquot consider all border crossings
as an act of war those acts of aggression that threaten the territorial integrity would elicit a
defensive response by the victim nation Whether incursions involve combat vehicles over a
highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are
threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not
have set foot in the nation but according the Protective Security Principle the victim nation has
jurisdiction
Conducting cyber warfare operations from the territorial sea is no different from
conducting operations from within a nationrsquos land or sea borders However the high seas are
very similar in nature to space in that they are reserved for peaceful purposes Therefore
conducting any means of warfare from within the high seas is a violation of international law
and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-
defense
According to Barkham ldquoinformation warfare attacks are in essence territorial
penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then
subject to the jurisdiction of the victim nation who then has the right for self-defense However
due to the global nature of cyberspace aggressors can cross multiple borders and determining
who has jurisdiction demands cooperation among nations The origin and any deliberate staging
locations of the cyber attack will drive who has jurisdiction The crossing of third party borders
25
AUACSCSinksAY08
by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the
aggressors threaten a nationrsquos independence or territorial integrity
Scholars consider cyber warfare operations that involve strategic and operational impacts
as being a means of using force and fall within the legal regime of existing international law
However scholars argue that because cyber warfare includes kinetic and non-kinetic results the
Use of Force definition needs expanding Yet they conclude that an exhaustive definition of
cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare
operations against existing case studies where the effects are evaluated as opposed to the means
even if the operations originated from outside the nationrsquos territorial jurisdiction There is some
authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to
have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade
non-state actors from conducting cyber warfare operations given their willingness to ignore
Western notions of war and their ability to conduct operations anonymously in cyberspace
International laws are in place to that address the ever-changing nature of warfare The
Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a
framework for addressing all warfare to include cyber warfare operations The international
community will need to measure the effects of an operation rather the means Whether its boots
on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a
nationrsquos response
26
AUACSCSinksAY08
End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)
27
AUACSCSinksAY08
44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
28
AUACSCSinksAY08
Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005
Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department
American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)
Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983
Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988
Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)
Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)
IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)
Joint Publication 3-13 Information Operations 13 February 2006
Joint Publication 5-0 Joint Operations Planning 26 December 2006
Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies
Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc
Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College
Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)
Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press
29
AUACSCSinksAY08
Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI
Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)
Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press
Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company
Detter Delupis I The law of war (2000) New York NY Cambridge University Press
Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)
Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College
Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor
Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)
Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)
Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf
Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)
Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College
Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College
Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)
Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA
30
AUACSCSinksAY08
Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)
Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)
Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College
Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology
Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College
Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)
OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center
OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College
OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications
Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991
Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College
Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center
Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)
31
AUACSCSinksAY08
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press
Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA
Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University
Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor
Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661
Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office
Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis
United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC
United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center
Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College
Wesley David C The Military Commander and the Law 2006
32
AUACSCSinksAY08
if a state destroyed or significantly damaged another nationrsquos economic system for example the
New York or London stock exchanges
However some confusion and state-defined interpretation comes into play when the
frequency and consequences of the strikes are evaluated Jason Barkham attorney from Harvard
Law School argues that cyber attacks require an expansion of the definition on the ldquouse of
forcerdquo and not expanding the definition would mean some information warfare attacks wouldnrsquot
be prohibited by international law50 International scholars recommend ldquoclearer rules of what
kinds of information warfare actions constitute an armed attackrdquo which drives permissible
responses of self-defense51 For example a state-sponsored cyber attack causes damage to a
victimrsquos factory or power plant however the nation claims the incident is an isolated instance
and the attack was a one-time event Then the victim nation couldnrsquot claim self-defense under
the United Nations Charter and the United Nations would consider any response retaliation
which would violate international law52
Another example involves a nation conducting a series of small attacks causing minimal
damage and then ceases Even though the aggressor used force to conduct cyber warfare
operations the extent of damage wouldnrsquot be enough to invoke the right of self-defense under
the United Nations Charter This type of attack is analogues to a small band of troops crossing a
border without causing significant damage53 According to the United Nations Charter the
national sovereignty of the nation isnrsquot in question A nation has the right to protect its borders
and respond to the use of force Repelling the small band of troops and reestablishing their
sovereign territory is certainly applicable but the United Nations wouldnrsquot support a declaration
of war and allies would have to respect the United Nations decision and couldnrsquot intervene The
same is true for the cyber attack A state can employ defensive measure to isolate and defeat the
20
AUACSCSinksAY08
incursion over the electromagnetic spectrum However the United Nations would see further
offensive operations or invasive operations as retaliation Therefore a nation must take the
incident whether it is signs of conventional forces on the ground or traces of cyber warfare
incursions in the electromagnetic spectrum to the United Nations to seek restitution
In both of these situations the international law becomes the target for change not
whether cyber warfare is in violation of international law If the law were to change the
international community would then consider the above situations acts of war even if an
adversary used conventional forces As written today the result of an operation remains the
driving factor in determining if an adversary has violated international law The means by which
an adversary conducts military operations may affect how nations react to the situation but
whether an adversary conducts the operation by means of the air land sea space or cyberspace
doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian
Triggs a public international lawyer and member of the Attorney General International Legal
Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over
offences abroad having an intended and substantial effect within a state may be justifiedrdquo54
Therefore the international community must evaluate the effect of a criminal act rather than the
means in which the act was committed
Others claim that because the Internet takes advantages of legal norms where non-state
actors can ignore Western notions of law55 more international laws are needed for cyberspace
However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using
other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the
Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked
aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts
21
AUACSCSinksAY08
against a staterdquo in the cyberspace domain The anonymity of the Internet and their total
disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and
national laws already exist in most countries that prohibit the use of the Internet for terrorist
activities therefore additional international laws wouldnrsquot prevent or deter terrorist from
committing such acts of aggression
International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed
Conflict includes the Martens Clause which extends established custom and humanitarian
principles to new technologies and addresses the ever-changing nature of warfare The
international community designed The Martens Clause ldquoto prevent future unnecessary andor
disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges
crimes by invoking the laws of humanity and public conscience hence their effects and not its
methods
The basic legal premise behind Law of Armed Conflict is that attacks must be limited to
military objectives and collateral damage must be proportionate to military advantages and
forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary
suffering but military commanders and planners need to be aware of the results a particular
action will invoke Russian leadership believes a computer network attack against their
homeland can be a means for executing a variety of escalating responses to include nuclear
attack58 Therefore it is imperative military commanders understand the impact any weapon
system can have on an adversary not just cyber attacks
Not all scholars agree that international law is insufficient to govern cyber warfare
Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace
and the Use of Force states that computer network attacks constitute an unlawful use of force in
22
AUACSCSinksAY08
cyberspace under traditional international law Sharp declared that an armed attack may occur
ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a
way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive
definition of cyber attacks may never be drafted59 The Congressional Research Service also
concluded that ldquothere is little likelihood that the international community will soon generate a
coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations
on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos
conclusion is that the effects of cyber warfare operations are the same as if an adversary
conducted conventional warfare operations where the effect of the attacks are the driving factors
in determining whether an adversary used force or not
The United States Government agrees with Sharprsquos conclusion The offensive
Information Operation strategy for the United States government as described by Doctor
Armistead ties the tools used to conduct military operations back to the desired effect which is
in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning
effects-based operations and operational art focus the Joint Force Commanderrsquos course of action
towards meeting objectives outlined in guidance provided by the National Command Authority
and senior military leadership62 Whether the tools are dropped pamphlets invasive network
attacks or bombs on targets the goal is to produce a desired effect to achieve the overall
objectives and cyber warfare can produce effects that challenge the national security of a nation
Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63
~General T Michael Moseley USAF
23
AUACSCSinksAY08
The cyberspace domain has been around for quite sometime but as technology continues
to advance businesses as well as governmental organizations are becoming more reliant on the
cyberspace domain With that reliance the protection of this critical domain becomes even more
important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the
electromagnetic spectrum by denying and disrupting information demands Scholars claim that
protection needs to include addressing existing international laws expanding them to incorporate
the ever-advancing capabilities emerging in the cyberspace domain
However territorial sovereignty of a nation and the principles of jurisdiction specifically
the Protective Security Principle give nations the right to exercise jurisdiction when an
aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64
While cyberspace is a domain requiring specific attention it relies on assets in the other domains
of land space sea and air in order to operate and international laws for the linear domains do
exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace
but during cyber warfare operations the principles behind the restrictions of foreign military
entering airspace do apply The strategic nature of cyber warfare operations correspond to the
same strategic impact that airpower can inflict upon a nation threatening their independence
While maybe not as dramatic as kinetic effects the results can be just as devastating
Space is relatively straightforward Since a nation canrsquot claim space and over flights of
foreign satellites over a nation is permissible nations must use space for peaceful purposes
Kinetic attacks against space assets are a violation of international law therefore nations would
consider cyber warfare operations against space assets as other than peaceful purposes and a
violation of international law Cyber attacks traversing space assets relate to current military
operations where the military uses space assets to conduct kinetic operations Since international
24
AUACSCSinksAY08
elites havenrsquot considered these kinetic operations as a breach of international law military
commanders can conduct cyber warfare operations through space without fear of violating
international laws for outer space
Crossing international borders without a nationrsquos permission and threatening their
sovereignty is a violation of international law While nations canrsquot consider all border crossings
as an act of war those acts of aggression that threaten the territorial integrity would elicit a
defensive response by the victim nation Whether incursions involve combat vehicles over a
highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are
threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not
have set foot in the nation but according the Protective Security Principle the victim nation has
jurisdiction
Conducting cyber warfare operations from the territorial sea is no different from
conducting operations from within a nationrsquos land or sea borders However the high seas are
very similar in nature to space in that they are reserved for peaceful purposes Therefore
conducting any means of warfare from within the high seas is a violation of international law
and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-
defense
According to Barkham ldquoinformation warfare attacks are in essence territorial
penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then
subject to the jurisdiction of the victim nation who then has the right for self-defense However
due to the global nature of cyberspace aggressors can cross multiple borders and determining
who has jurisdiction demands cooperation among nations The origin and any deliberate staging
locations of the cyber attack will drive who has jurisdiction The crossing of third party borders
25
AUACSCSinksAY08
by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the
aggressors threaten a nationrsquos independence or territorial integrity
Scholars consider cyber warfare operations that involve strategic and operational impacts
as being a means of using force and fall within the legal regime of existing international law
However scholars argue that because cyber warfare includes kinetic and non-kinetic results the
Use of Force definition needs expanding Yet they conclude that an exhaustive definition of
cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare
operations against existing case studies where the effects are evaluated as opposed to the means
even if the operations originated from outside the nationrsquos territorial jurisdiction There is some
authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to
have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade
non-state actors from conducting cyber warfare operations given their willingness to ignore
Western notions of war and their ability to conduct operations anonymously in cyberspace
International laws are in place to that address the ever-changing nature of warfare The
Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a
framework for addressing all warfare to include cyber warfare operations The international
community will need to measure the effects of an operation rather the means Whether its boots
on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a
nationrsquos response
26
AUACSCSinksAY08
End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)
27
AUACSCSinksAY08
44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
28
AUACSCSinksAY08
Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005
Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department
American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)
Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983
Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988
Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)
Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)
IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)
Joint Publication 3-13 Information Operations 13 February 2006
Joint Publication 5-0 Joint Operations Planning 26 December 2006
Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies
Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc
Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College
Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)
Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press
29
AUACSCSinksAY08
Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI
Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)
Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press
Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company
Detter Delupis I The law of war (2000) New York NY Cambridge University Press
Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)
Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College
Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor
Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)
Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)
Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf
Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)
Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College
Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College
Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)
Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA
30
AUACSCSinksAY08
Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)
Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)
Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College
Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology
Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College
Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)
OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center
OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College
OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications
Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991
Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College
Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center
Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)
31
AUACSCSinksAY08
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press
Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA
Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University
Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor
Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661
Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office
Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis
United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC
United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center
Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College
Wesley David C The Military Commander and the Law 2006
32
AUACSCSinksAY08
incursion over the electromagnetic spectrum However the United Nations would see further
offensive operations or invasive operations as retaliation Therefore a nation must take the
incident whether it is signs of conventional forces on the ground or traces of cyber warfare
incursions in the electromagnetic spectrum to the United Nations to seek restitution
In both of these situations the international law becomes the target for change not
whether cyber warfare is in violation of international law If the law were to change the
international community would then consider the above situations acts of war even if an
adversary used conventional forces As written today the result of an operation remains the
driving factor in determining if an adversary has violated international law The means by which
an adversary conducts military operations may affect how nations react to the situation but
whether an adversary conducts the operation by means of the air land sea space or cyberspace
doesnrsquot have much bearing on whether an adversary met an objective As stated by Gillian
Triggs a public international lawyer and member of the Attorney General International Legal
Services Advisory Council there is a ldquogrowing recognition that an assertion of jurisdiction over
offences abroad having an intended and substantial effect within a state may be justifiedrdquo54
Therefore the international community must evaluate the effect of a criminal act rather than the
means in which the act was committed
Others claim that because the Internet takes advantages of legal norms where non-state
actors can ignore Western notions of law55 more international laws are needed for cyberspace
However Bin Laden demonstrated his willingness to ignore ldquoWestern notion of lawrdquo by using
other asymmetric terrorist attacks when his followers flew aircraft into the Trade Towers and the
Pentagon Therersquos bound to be an international law that states ldquothou shall not fly hijacked
aircraft into buildingsrdquo Besides would international law deter terrorists from committing ldquoacts
21
AUACSCSinksAY08
against a staterdquo in the cyberspace domain The anonymity of the Internet and their total
disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and
national laws already exist in most countries that prohibit the use of the Internet for terrorist
activities therefore additional international laws wouldnrsquot prevent or deter terrorist from
committing such acts of aggression
International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed
Conflict includes the Martens Clause which extends established custom and humanitarian
principles to new technologies and addresses the ever-changing nature of warfare The
international community designed The Martens Clause ldquoto prevent future unnecessary andor
disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges
crimes by invoking the laws of humanity and public conscience hence their effects and not its
methods
The basic legal premise behind Law of Armed Conflict is that attacks must be limited to
military objectives and collateral damage must be proportionate to military advantages and
forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary
suffering but military commanders and planners need to be aware of the results a particular
action will invoke Russian leadership believes a computer network attack against their
homeland can be a means for executing a variety of escalating responses to include nuclear
attack58 Therefore it is imperative military commanders understand the impact any weapon
system can have on an adversary not just cyber attacks
Not all scholars agree that international law is insufficient to govern cyber warfare
Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace
and the Use of Force states that computer network attacks constitute an unlawful use of force in
22
AUACSCSinksAY08
cyberspace under traditional international law Sharp declared that an armed attack may occur
ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a
way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive
definition of cyber attacks may never be drafted59 The Congressional Research Service also
concluded that ldquothere is little likelihood that the international community will soon generate a
coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations
on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos
conclusion is that the effects of cyber warfare operations are the same as if an adversary
conducted conventional warfare operations where the effect of the attacks are the driving factors
in determining whether an adversary used force or not
The United States Government agrees with Sharprsquos conclusion The offensive
Information Operation strategy for the United States government as described by Doctor
Armistead ties the tools used to conduct military operations back to the desired effect which is
in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning
effects-based operations and operational art focus the Joint Force Commanderrsquos course of action
towards meeting objectives outlined in guidance provided by the National Command Authority
and senior military leadership62 Whether the tools are dropped pamphlets invasive network
attacks or bombs on targets the goal is to produce a desired effect to achieve the overall
objectives and cyber warfare can produce effects that challenge the national security of a nation
Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63
~General T Michael Moseley USAF
23
AUACSCSinksAY08
The cyberspace domain has been around for quite sometime but as technology continues
to advance businesses as well as governmental organizations are becoming more reliant on the
cyberspace domain With that reliance the protection of this critical domain becomes even more
important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the
electromagnetic spectrum by denying and disrupting information demands Scholars claim that
protection needs to include addressing existing international laws expanding them to incorporate
the ever-advancing capabilities emerging in the cyberspace domain
However territorial sovereignty of a nation and the principles of jurisdiction specifically
the Protective Security Principle give nations the right to exercise jurisdiction when an
aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64
While cyberspace is a domain requiring specific attention it relies on assets in the other domains
of land space sea and air in order to operate and international laws for the linear domains do
exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace
but during cyber warfare operations the principles behind the restrictions of foreign military
entering airspace do apply The strategic nature of cyber warfare operations correspond to the
same strategic impact that airpower can inflict upon a nation threatening their independence
While maybe not as dramatic as kinetic effects the results can be just as devastating
Space is relatively straightforward Since a nation canrsquot claim space and over flights of
foreign satellites over a nation is permissible nations must use space for peaceful purposes
Kinetic attacks against space assets are a violation of international law therefore nations would
consider cyber warfare operations against space assets as other than peaceful purposes and a
violation of international law Cyber attacks traversing space assets relate to current military
operations where the military uses space assets to conduct kinetic operations Since international
24
AUACSCSinksAY08
elites havenrsquot considered these kinetic operations as a breach of international law military
commanders can conduct cyber warfare operations through space without fear of violating
international laws for outer space
Crossing international borders without a nationrsquos permission and threatening their
sovereignty is a violation of international law While nations canrsquot consider all border crossings
as an act of war those acts of aggression that threaten the territorial integrity would elicit a
defensive response by the victim nation Whether incursions involve combat vehicles over a
highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are
threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not
have set foot in the nation but according the Protective Security Principle the victim nation has
jurisdiction
Conducting cyber warfare operations from the territorial sea is no different from
conducting operations from within a nationrsquos land or sea borders However the high seas are
very similar in nature to space in that they are reserved for peaceful purposes Therefore
conducting any means of warfare from within the high seas is a violation of international law
and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-
defense
According to Barkham ldquoinformation warfare attacks are in essence territorial
penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then
subject to the jurisdiction of the victim nation who then has the right for self-defense However
due to the global nature of cyberspace aggressors can cross multiple borders and determining
who has jurisdiction demands cooperation among nations The origin and any deliberate staging
locations of the cyber attack will drive who has jurisdiction The crossing of third party borders
25
AUACSCSinksAY08
by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the
aggressors threaten a nationrsquos independence or territorial integrity
Scholars consider cyber warfare operations that involve strategic and operational impacts
as being a means of using force and fall within the legal regime of existing international law
However scholars argue that because cyber warfare includes kinetic and non-kinetic results the
Use of Force definition needs expanding Yet they conclude that an exhaustive definition of
cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare
operations against existing case studies where the effects are evaluated as opposed to the means
even if the operations originated from outside the nationrsquos territorial jurisdiction There is some
authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to
have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade
non-state actors from conducting cyber warfare operations given their willingness to ignore
Western notions of war and their ability to conduct operations anonymously in cyberspace
International laws are in place to that address the ever-changing nature of warfare The
Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a
framework for addressing all warfare to include cyber warfare operations The international
community will need to measure the effects of an operation rather the means Whether its boots
on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a
nationrsquos response
26
AUACSCSinksAY08
End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)
27
AUACSCSinksAY08
44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
28
AUACSCSinksAY08
Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005
Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department
American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)
Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983
Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988
Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)
Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)
IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)
Joint Publication 3-13 Information Operations 13 February 2006
Joint Publication 5-0 Joint Operations Planning 26 December 2006
Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies
Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc
Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College
Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)
Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press
29
AUACSCSinksAY08
Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI
Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)
Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press
Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company
Detter Delupis I The law of war (2000) New York NY Cambridge University Press
Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)
Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College
Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor
Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)
Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)
Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf
Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)
Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College
Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College
Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)
Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA
30
AUACSCSinksAY08
Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)
Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)
Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College
Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology
Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College
Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)
OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center
OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College
OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications
Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991
Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College
Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center
Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)
31
AUACSCSinksAY08
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press
Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA
Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University
Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor
Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661
Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office
Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis
United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC
United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center
Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College
Wesley David C The Military Commander and the Law 2006
32
AUACSCSinksAY08
against a staterdquo in the cyberspace domain The anonymity of the Internet and their total
disrespect for the law terrorists have little fear of being found and prosecuted56 Domestic and
national laws already exist in most countries that prohibit the use of the Internet for terrorist
activities therefore additional international laws wouldnrsquot prevent or deter terrorist from
committing such acts of aggression
International Laws The Hague Conventions of 1899 which is the impetus behind the Law of Armed
Conflict includes the Martens Clause which extends established custom and humanitarian
principles to new technologies and addresses the ever-changing nature of warfare The
international community designed The Martens Clause ldquoto prevent future unnecessary andor
disproportionate destruction from weapon systems not yet developedrdquo57 The clause judges
crimes by invoking the laws of humanity and public conscience hence their effects and not its
methods
The basic legal premise behind Law of Armed Conflict is that attacks must be limited to
military objectives and collateral damage must be proportionate to military advantages and
forbids unnecessary suffering Cyber warfare can be destructive and can create unnecessary
suffering but military commanders and planners need to be aware of the results a particular
action will invoke Russian leadership believes a computer network attack against their
homeland can be a means for executing a variety of escalating responses to include nuclear
attack58 Therefore it is imperative military commanders understand the impact any weapon
system can have on an adversary not just cyber attacks
Not all scholars agree that international law is insufficient to govern cyber warfare
Walter Sharp the editor of the highly regarded United Nations Peace Operations in Cyberspace
and the Use of Force states that computer network attacks constitute an unlawful use of force in
22
AUACSCSinksAY08
cyberspace under traditional international law Sharp declared that an armed attack may occur
ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a
way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive
definition of cyber attacks may never be drafted59 The Congressional Research Service also
concluded that ldquothere is little likelihood that the international community will soon generate a
coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations
on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos
conclusion is that the effects of cyber warfare operations are the same as if an adversary
conducted conventional warfare operations where the effect of the attacks are the driving factors
in determining whether an adversary used force or not
The United States Government agrees with Sharprsquos conclusion The offensive
Information Operation strategy for the United States government as described by Doctor
Armistead ties the tools used to conduct military operations back to the desired effect which is
in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning
effects-based operations and operational art focus the Joint Force Commanderrsquos course of action
towards meeting objectives outlined in guidance provided by the National Command Authority
and senior military leadership62 Whether the tools are dropped pamphlets invasive network
attacks or bombs on targets the goal is to produce a desired effect to achieve the overall
objectives and cyber warfare can produce effects that challenge the national security of a nation
Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63
~General T Michael Moseley USAF
23
AUACSCSinksAY08
The cyberspace domain has been around for quite sometime but as technology continues
to advance businesses as well as governmental organizations are becoming more reliant on the
cyberspace domain With that reliance the protection of this critical domain becomes even more
important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the
electromagnetic spectrum by denying and disrupting information demands Scholars claim that
protection needs to include addressing existing international laws expanding them to incorporate
the ever-advancing capabilities emerging in the cyberspace domain
However territorial sovereignty of a nation and the principles of jurisdiction specifically
the Protective Security Principle give nations the right to exercise jurisdiction when an
aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64
While cyberspace is a domain requiring specific attention it relies on assets in the other domains
of land space sea and air in order to operate and international laws for the linear domains do
exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace
but during cyber warfare operations the principles behind the restrictions of foreign military
entering airspace do apply The strategic nature of cyber warfare operations correspond to the
same strategic impact that airpower can inflict upon a nation threatening their independence
While maybe not as dramatic as kinetic effects the results can be just as devastating
Space is relatively straightforward Since a nation canrsquot claim space and over flights of
foreign satellites over a nation is permissible nations must use space for peaceful purposes
Kinetic attacks against space assets are a violation of international law therefore nations would
consider cyber warfare operations against space assets as other than peaceful purposes and a
violation of international law Cyber attacks traversing space assets relate to current military
operations where the military uses space assets to conduct kinetic operations Since international
24
AUACSCSinksAY08
elites havenrsquot considered these kinetic operations as a breach of international law military
commanders can conduct cyber warfare operations through space without fear of violating
international laws for outer space
Crossing international borders without a nationrsquos permission and threatening their
sovereignty is a violation of international law While nations canrsquot consider all border crossings
as an act of war those acts of aggression that threaten the territorial integrity would elicit a
defensive response by the victim nation Whether incursions involve combat vehicles over a
highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are
threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not
have set foot in the nation but according the Protective Security Principle the victim nation has
jurisdiction
Conducting cyber warfare operations from the territorial sea is no different from
conducting operations from within a nationrsquos land or sea borders However the high seas are
very similar in nature to space in that they are reserved for peaceful purposes Therefore
conducting any means of warfare from within the high seas is a violation of international law
and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-
defense
According to Barkham ldquoinformation warfare attacks are in essence territorial
penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then
subject to the jurisdiction of the victim nation who then has the right for self-defense However
due to the global nature of cyberspace aggressors can cross multiple borders and determining
who has jurisdiction demands cooperation among nations The origin and any deliberate staging
locations of the cyber attack will drive who has jurisdiction The crossing of third party borders
25
AUACSCSinksAY08
by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the
aggressors threaten a nationrsquos independence or territorial integrity
Scholars consider cyber warfare operations that involve strategic and operational impacts
as being a means of using force and fall within the legal regime of existing international law
However scholars argue that because cyber warfare includes kinetic and non-kinetic results the
Use of Force definition needs expanding Yet they conclude that an exhaustive definition of
cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare
operations against existing case studies where the effects are evaluated as opposed to the means
even if the operations originated from outside the nationrsquos territorial jurisdiction There is some
authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to
have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade
non-state actors from conducting cyber warfare operations given their willingness to ignore
Western notions of war and their ability to conduct operations anonymously in cyberspace
International laws are in place to that address the ever-changing nature of warfare The
Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a
framework for addressing all warfare to include cyber warfare operations The international
community will need to measure the effects of an operation rather the means Whether its boots
on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a
nationrsquos response
26
AUACSCSinksAY08
End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)
27
AUACSCSinksAY08
44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
28
AUACSCSinksAY08
Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005
Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department
American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)
Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983
Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988
Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)
Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)
IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)
Joint Publication 3-13 Information Operations 13 February 2006
Joint Publication 5-0 Joint Operations Planning 26 December 2006
Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies
Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc
Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College
Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)
Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press
29
AUACSCSinksAY08
Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI
Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)
Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press
Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company
Detter Delupis I The law of war (2000) New York NY Cambridge University Press
Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)
Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College
Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor
Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)
Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)
Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf
Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)
Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College
Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College
Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)
Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA
30
AUACSCSinksAY08
Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)
Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)
Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College
Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology
Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College
Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)
OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center
OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College
OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications
Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991
Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College
Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center
Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)
31
AUACSCSinksAY08
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press
Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA
Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University
Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor
Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661
Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office
Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis
United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC
United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center
Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College
Wesley David C The Military Commander and the Law 2006
32
AUACSCSinksAY08
cyberspace under traditional international law Sharp declared that an armed attack may occur
ldquowhere a use of force or an activity not traditionally considered an armed attack is used in such a
way that becomes tantamount in effect to an armed attackrdquo He concluded that an exhaustive
definition of cyber attacks may never be drafted59 The Congressional Research Service also
concluded that ldquothere is little likelihood that the international community will soon generate a
coherent body of information operations lawrdquo in cyberspace60 Yet adversaries threaten nations
on a daily basis with unlawful intrusions into military and civilian information systems Sharprsquos
conclusion is that the effects of cyber warfare operations are the same as if an adversary
conducted conventional warfare operations where the effect of the attacks are the driving factors
in determining whether an adversary used force or not
The United States Government agrees with Sharprsquos conclusion The offensive
Information Operation strategy for the United States government as described by Doctor
Armistead ties the tools used to conduct military operations back to the desired effect which is
in-turn driven by military strategies and objectives61 In Joint Publication 3-30 Joint Planning
effects-based operations and operational art focus the Joint Force Commanderrsquos course of action
towards meeting objectives outlined in guidance provided by the National Command Authority
and senior military leadership62 Whether the tools are dropped pamphlets invasive network
attacks or bombs on targets the goal is to produce a desired effect to achieve the overall
objectives and cyber warfare can produce effects that challenge the national security of a nation
Conclusion To deliver the full spectrum of effects we will evolve a coherent enterprise with war fighting ethos ready to execute any mission in peace crisis and war We will foster a force of 21st Century warriors capable of delivering the full spectrum of kinetic and non-kinetic lethal and non-lethal effects63
~General T Michael Moseley USAF
23
AUACSCSinksAY08
The cyberspace domain has been around for quite sometime but as technology continues
to advance businesses as well as governmental organizations are becoming more reliant on the
cyberspace domain With that reliance the protection of this critical domain becomes even more
important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the
electromagnetic spectrum by denying and disrupting information demands Scholars claim that
protection needs to include addressing existing international laws expanding them to incorporate
the ever-advancing capabilities emerging in the cyberspace domain
However territorial sovereignty of a nation and the principles of jurisdiction specifically
the Protective Security Principle give nations the right to exercise jurisdiction when an
aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64
While cyberspace is a domain requiring specific attention it relies on assets in the other domains
of land space sea and air in order to operate and international laws for the linear domains do
exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace
but during cyber warfare operations the principles behind the restrictions of foreign military
entering airspace do apply The strategic nature of cyber warfare operations correspond to the
same strategic impact that airpower can inflict upon a nation threatening their independence
While maybe not as dramatic as kinetic effects the results can be just as devastating
Space is relatively straightforward Since a nation canrsquot claim space and over flights of
foreign satellites over a nation is permissible nations must use space for peaceful purposes
Kinetic attacks against space assets are a violation of international law therefore nations would
consider cyber warfare operations against space assets as other than peaceful purposes and a
violation of international law Cyber attacks traversing space assets relate to current military
operations where the military uses space assets to conduct kinetic operations Since international
24
AUACSCSinksAY08
elites havenrsquot considered these kinetic operations as a breach of international law military
commanders can conduct cyber warfare operations through space without fear of violating
international laws for outer space
Crossing international borders without a nationrsquos permission and threatening their
sovereignty is a violation of international law While nations canrsquot consider all border crossings
as an act of war those acts of aggression that threaten the territorial integrity would elicit a
defensive response by the victim nation Whether incursions involve combat vehicles over a
highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are
threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not
have set foot in the nation but according the Protective Security Principle the victim nation has
jurisdiction
Conducting cyber warfare operations from the territorial sea is no different from
conducting operations from within a nationrsquos land or sea borders However the high seas are
very similar in nature to space in that they are reserved for peaceful purposes Therefore
conducting any means of warfare from within the high seas is a violation of international law
and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-
defense
According to Barkham ldquoinformation warfare attacks are in essence territorial
penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then
subject to the jurisdiction of the victim nation who then has the right for self-defense However
due to the global nature of cyberspace aggressors can cross multiple borders and determining
who has jurisdiction demands cooperation among nations The origin and any deliberate staging
locations of the cyber attack will drive who has jurisdiction The crossing of third party borders
25
AUACSCSinksAY08
by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the
aggressors threaten a nationrsquos independence or territorial integrity
Scholars consider cyber warfare operations that involve strategic and operational impacts
as being a means of using force and fall within the legal regime of existing international law
However scholars argue that because cyber warfare includes kinetic and non-kinetic results the
Use of Force definition needs expanding Yet they conclude that an exhaustive definition of
cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare
operations against existing case studies where the effects are evaluated as opposed to the means
even if the operations originated from outside the nationrsquos territorial jurisdiction There is some
authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to
have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade
non-state actors from conducting cyber warfare operations given their willingness to ignore
Western notions of war and their ability to conduct operations anonymously in cyberspace
International laws are in place to that address the ever-changing nature of warfare The
Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a
framework for addressing all warfare to include cyber warfare operations The international
community will need to measure the effects of an operation rather the means Whether its boots
on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a
nationrsquos response
26
AUACSCSinksAY08
End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)
27
AUACSCSinksAY08
44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
28
AUACSCSinksAY08
Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005
Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department
American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)
Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983
Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988
Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)
Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)
IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)
Joint Publication 3-13 Information Operations 13 February 2006
Joint Publication 5-0 Joint Operations Planning 26 December 2006
Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies
Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc
Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College
Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)
Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press
29
AUACSCSinksAY08
Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI
Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)
Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press
Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company
Detter Delupis I The law of war (2000) New York NY Cambridge University Press
Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)
Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College
Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor
Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)
Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)
Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf
Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)
Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College
Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College
Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)
Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA
30
AUACSCSinksAY08
Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)
Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)
Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College
Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology
Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College
Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)
OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center
OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College
OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications
Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991
Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College
Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center
Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)
31
AUACSCSinksAY08
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press
Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA
Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University
Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor
Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661
Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office
Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis
United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC
United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center
Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College
Wesley David C The Military Commander and the Law 2006
32
AUACSCSinksAY08
The cyberspace domain has been around for quite sometime but as technology continues
to advance businesses as well as governmental organizations are becoming more reliant on the
cyberspace domain With that reliance the protection of this critical domain becomes even more
important as state and non-state actors seek to find ways to exploit a nationrsquos reliance in the
electromagnetic spectrum by denying and disrupting information demands Scholars claim that
protection needs to include addressing existing international laws expanding them to incorporate
the ever-advancing capabilities emerging in the cyberspace domain
However territorial sovereignty of a nation and the principles of jurisdiction specifically
the Protective Security Principle give nations the right to exercise jurisdiction when an
aggressive act threatens a nationrsquos ldquosecurity territorial integrity and political independencerdquo64
While cyberspace is a domain requiring specific attention it relies on assets in the other domains
of land space sea and air in order to operate and international laws for the linear domains do
exist The international law for airspace doesnrsquot relate well in the civilian sector for cyberspace
but during cyber warfare operations the principles behind the restrictions of foreign military
entering airspace do apply The strategic nature of cyber warfare operations correspond to the
same strategic impact that airpower can inflict upon a nation threatening their independence
While maybe not as dramatic as kinetic effects the results can be just as devastating
Space is relatively straightforward Since a nation canrsquot claim space and over flights of
foreign satellites over a nation is permissible nations must use space for peaceful purposes
Kinetic attacks against space assets are a violation of international law therefore nations would
consider cyber warfare operations against space assets as other than peaceful purposes and a
violation of international law Cyber attacks traversing space assets relate to current military
operations where the military uses space assets to conduct kinetic operations Since international
24
AUACSCSinksAY08
elites havenrsquot considered these kinetic operations as a breach of international law military
commanders can conduct cyber warfare operations through space without fear of violating
international laws for outer space
Crossing international borders without a nationrsquos permission and threatening their
sovereignty is a violation of international law While nations canrsquot consider all border crossings
as an act of war those acts of aggression that threaten the territorial integrity would elicit a
defensive response by the victim nation Whether incursions involve combat vehicles over a
highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are
threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not
have set foot in the nation but according the Protective Security Principle the victim nation has
jurisdiction
Conducting cyber warfare operations from the territorial sea is no different from
conducting operations from within a nationrsquos land or sea borders However the high seas are
very similar in nature to space in that they are reserved for peaceful purposes Therefore
conducting any means of warfare from within the high seas is a violation of international law
and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-
defense
According to Barkham ldquoinformation warfare attacks are in essence territorial
penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then
subject to the jurisdiction of the victim nation who then has the right for self-defense However
due to the global nature of cyberspace aggressors can cross multiple borders and determining
who has jurisdiction demands cooperation among nations The origin and any deliberate staging
locations of the cyber attack will drive who has jurisdiction The crossing of third party borders
25
AUACSCSinksAY08
by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the
aggressors threaten a nationrsquos independence or territorial integrity
Scholars consider cyber warfare operations that involve strategic and operational impacts
as being a means of using force and fall within the legal regime of existing international law
However scholars argue that because cyber warfare includes kinetic and non-kinetic results the
Use of Force definition needs expanding Yet they conclude that an exhaustive definition of
cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare
operations against existing case studies where the effects are evaluated as opposed to the means
even if the operations originated from outside the nationrsquos territorial jurisdiction There is some
authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to
have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade
non-state actors from conducting cyber warfare operations given their willingness to ignore
Western notions of war and their ability to conduct operations anonymously in cyberspace
International laws are in place to that address the ever-changing nature of warfare The
Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a
framework for addressing all warfare to include cyber warfare operations The international
community will need to measure the effects of an operation rather the means Whether its boots
on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a
nationrsquos response
26
AUACSCSinksAY08
End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)
27
AUACSCSinksAY08
44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
28
AUACSCSinksAY08
Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005
Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department
American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)
Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983
Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988
Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)
Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)
IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)
Joint Publication 3-13 Information Operations 13 February 2006
Joint Publication 5-0 Joint Operations Planning 26 December 2006
Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies
Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc
Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College
Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)
Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press
29
AUACSCSinksAY08
Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI
Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)
Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press
Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company
Detter Delupis I The law of war (2000) New York NY Cambridge University Press
Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)
Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College
Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor
Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)
Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)
Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf
Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)
Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College
Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College
Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)
Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA
30
AUACSCSinksAY08
Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)
Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)
Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College
Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology
Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College
Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)
OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center
OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College
OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications
Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991
Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College
Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center
Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)
31
AUACSCSinksAY08
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press
Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA
Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University
Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor
Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661
Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office
Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis
United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC
United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center
Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College
Wesley David C The Military Commander and the Law 2006
32
AUACSCSinksAY08
elites havenrsquot considered these kinetic operations as a breach of international law military
commanders can conduct cyber warfare operations through space without fear of violating
international laws for outer space
Crossing international borders without a nationrsquos permission and threatening their
sovereignty is a violation of international law While nations canrsquot consider all border crossings
as an act of war those acts of aggression that threaten the territorial integrity would elicit a
defensive response by the victim nation Whether incursions involve combat vehicles over a
highway or the use of warfare capabilities in the electromagnetic spectrum adversaries are
threatening a nationrsquos sovereign borders The only difference is that the cyber warrior may not
have set foot in the nation but according the Protective Security Principle the victim nation has
jurisdiction
Conducting cyber warfare operations from the territorial sea is no different from
conducting operations from within a nationrsquos land or sea borders However the high seas are
very similar in nature to space in that they are reserved for peaceful purposes Therefore
conducting any means of warfare from within the high seas is a violation of international law
and due to the Protective Security Principle of Jurisdiction the victim nation can act in self-
defense
According to Barkham ldquoinformation warfare attacks are in essence territorial
penetrations which violate the victimrsquos sovereigntyrdquo65 These territorial penetrations are then
subject to the jurisdiction of the victim nation who then has the right for self-defense However
due to the global nature of cyberspace aggressors can cross multiple borders and determining
who has jurisdiction demands cooperation among nations The origin and any deliberate staging
locations of the cyber attack will drive who has jurisdiction The crossing of third party borders
25
AUACSCSinksAY08
by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the
aggressors threaten a nationrsquos independence or territorial integrity
Scholars consider cyber warfare operations that involve strategic and operational impacts
as being a means of using force and fall within the legal regime of existing international law
However scholars argue that because cyber warfare includes kinetic and non-kinetic results the
Use of Force definition needs expanding Yet they conclude that an exhaustive definition of
cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare
operations against existing case studies where the effects are evaluated as opposed to the means
even if the operations originated from outside the nationrsquos territorial jurisdiction There is some
authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to
have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade
non-state actors from conducting cyber warfare operations given their willingness to ignore
Western notions of war and their ability to conduct operations anonymously in cyberspace
International laws are in place to that address the ever-changing nature of warfare The
Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a
framework for addressing all warfare to include cyber warfare operations The international
community will need to measure the effects of an operation rather the means Whether its boots
on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a
nationrsquos response
26
AUACSCSinksAY08
End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)
27
AUACSCSinksAY08
44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
28
AUACSCSinksAY08
Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005
Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department
American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)
Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983
Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988
Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)
Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)
IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)
Joint Publication 3-13 Information Operations 13 February 2006
Joint Publication 5-0 Joint Operations Planning 26 December 2006
Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies
Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc
Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College
Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)
Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press
29
AUACSCSinksAY08
Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI
Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)
Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press
Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company
Detter Delupis I The law of war (2000) New York NY Cambridge University Press
Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)
Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College
Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor
Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)
Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)
Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf
Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)
Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College
Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College
Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)
Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA
30
AUACSCSinksAY08
Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)
Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)
Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College
Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology
Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College
Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)
OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center
OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College
OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications
Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991
Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College
Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center
Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)
31
AUACSCSinksAY08
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press
Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA
Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University
Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor
Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661
Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office
Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis
United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC
United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center
Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College
Wesley David C The Military Commander and the Law 2006
32
AUACSCSinksAY08
by happen-stance doesnrsquot give that nation the right to conduct warfare operations unless the
aggressors threaten a nationrsquos independence or territorial integrity
Scholars consider cyber warfare operations that involve strategic and operational impacts
as being a means of using force and fall within the legal regime of existing international law
However scholars argue that because cyber warfare includes kinetic and non-kinetic results the
Use of Force definition needs expanding Yet they conclude that an exhaustive definition of
cyber warfare is unlikely to be drafted Therefore legal experts can measure cyber warfare
operations against existing case studies where the effects are evaluated as opposed to the means
even if the operations originated from outside the nationrsquos territorial jurisdiction There is some
authority validating jurisdiction over conduct outside state territory ldquothat has or is intended to
have substantial effect within its territoryrdquo66 In addition new international laws wonrsquot persuade
non-state actors from conducting cyber warfare operations given their willingness to ignore
Western notions of war and their ability to conduct operations anonymously in cyberspace
International laws are in place to that address the ever-changing nature of warfare The
Hague Conventions the principles of jurisdiction and the territorial sovereignty all provide a
framework for addressing all warfare to include cyber warfare operations The international
community will need to measure the effects of an operation rather the means Whether its boots
on the ground missiles in the air or fingers on a keyboard the outcome of an attack will drive a
nationrsquos response
26
AUACSCSinksAY08
End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)
27
AUACSCSinksAY08
44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
28
AUACSCSinksAY08
Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005
Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department
American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)
Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983
Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988
Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)
Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)
IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)
Joint Publication 3-13 Information Operations 13 February 2006
Joint Publication 5-0 Joint Operations Planning 26 December 2006
Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies
Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc
Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College
Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)
Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press
29
AUACSCSinksAY08
Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI
Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)
Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press
Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company
Detter Delupis I The law of war (2000) New York NY Cambridge University Press
Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)
Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College
Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor
Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)
Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)
Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf
Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)
Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College
Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College
Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)
Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA
30
AUACSCSinksAY08
Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)
Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)
Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College
Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology
Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College
Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)
OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center
OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College
OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications
Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991
Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College
Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center
Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)
31
AUACSCSinksAY08
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press
Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA
Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University
Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor
Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661
Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office
Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis
United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC
United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center
Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College
Wesley David C The Military Commander and the Law 2006
32
AUACSCSinksAY08
End Notes 1 Air Force Doctrine Document 2-5 Information Operations 11 January 2005 19 2 Steven A Hildreth Cyberwarfare (Congressional Research Service 19 June 2001) 11 3 Ibid 12 4 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations (Fort Leavenworth KS Foreign Military Studies Office 2005) 42 5 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 35 6 Carl Von Clausewitz On War (Princeton NJ Princeton University Press 1976) 515 7 IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)8 Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)9 Lt Col David T Fahrenkrug Cyberspace Defined (Maxwell AFB AL Air War College September 2002)httpwwwauafmilauaunewsarchive0209ArticlesCyberspaceDefinedhtml (accessed 12 March 2008) 10 Joint Publication 3-13 Information Operations 13 February 2006 3-13 11 Lt Col David T Fahrenkrug Cyberspace Defined12 Ibid 13 Joint Publication 3-13 I-1 14 Air Force Doctrine Document 2-5 315 Lt Col David T Fahrenkrug Cyberspace Defined16 Ivan Goldberg ldquoGlossary of Information Warfare Termsrdquo Institute for Advanced Study of Information Warfare httpwwwpsycomnetiwar2html (accessed 12 March 2008) 17 Air Force Doctrine Document 2-5 518 Winston S Churchill The Second World War Volume II Their Finest Hour (Boston MA Houghlin MifflinCompany 1986) 17 19 Boleslaw A Boczek International Law A Dictionary (Metuchen NJ Scarecrow Press February 2005) 20220 Ibid 20321 Ibid 21022 Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050(accessed 5 April 2008) 23 Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 198324 Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988 25 Boleslaw A Boczek International Law A Dictionary 238 26 Ibid 23927 Ibid 23928 Ibid 24029 Ibid 20830 ldquoCase Concerning the Military and Paramilitary Activities in and Against Nicaraguardquo International Court ofJustice 27 June 1986 (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008) 31 Boleslaw A Boczek International Law A Dictionary 315 32 Ibid 32033 Ibid 31734 Ibid 28535 Ibid 28236 Ibid 28337 Ibid 41138 General James E Cartwright Strategic Forces Subcommittee Senate Armed Services Committee 28 March 2007 39 Ibid 80 40 Ibid 78 41 Ibid 80 42 Ibid 80 43 Lieutenant General Lawrence P Farrell Jr USAF (Ret) ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association December 2003 (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2December_2003htm accessed 11 Apr 08)
27
AUACSCSinksAY08
44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
28
AUACSCSinksAY08
Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005
Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department
American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)
Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983
Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988
Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)
Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)
IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)
Joint Publication 3-13 Information Operations 13 February 2006
Joint Publication 5-0 Joint Operations Planning 26 December 2006
Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies
Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc
Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College
Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)
Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press
29
AUACSCSinksAY08
Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI
Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)
Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press
Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company
Detter Delupis I The law of war (2000) New York NY Cambridge University Press
Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)
Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College
Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor
Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)
Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)
Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf
Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)
Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College
Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College
Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)
Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA
30
AUACSCSinksAY08
Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)
Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)
Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College
Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology
Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College
Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)
OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center
OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College
OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications
Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991
Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College
Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center
Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)
31
AUACSCSinksAY08
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press
Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA
Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University
Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor
Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661
Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office
Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis
United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC
United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center
Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College
Wesley David C The Military Commander and the Law 2006
32
AUACSCSinksAY08
44 Alan Riding ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991 45 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics 34 (4 April 2002) 6946 Ibid 74 47 Ibid 72 48 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power (Washington DCPotomac Books Inc 2004) 11549 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 80 50 Ibid 58 51 Christopher C Joyner and Catherine Lotrionte ldquoInformation Warfare as International Coercion Elements of aLegal Frameworkrdquo European Journal of International Law 12 no 5 (2001) 864 52 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 81 53 Ibid 81 54 Gillian Triggs International Law Contemporary Principles and Practices (Sydney Australia Butterworths Lexis Nexis 2005) 36755 Timothy L Thomas Cyber Silhouettes Shadows Over Information Operations 4356 Ibid 25 57 Major Darwyn O Banks Information War Crimes Mitnick Meets Milosevic (Maxwell AFB AL Air UniversityPress April 2001) 28 58 Steven A Hildreth Cyberwarfare 1159 Gary Sharp Cyberspace and the Use of Force (Falls Church VA Aegis Research Corp 1999) 234 60 Steven A Hildreth Cyberwarfare 961 Leigh Armistead Information Operations Warfare and the Hard Reality of Soft Power 11462 Joint Publication 5-0 Joint Operations Planning 26 December 2006 III-12 63 General T Michael Moseley ldquoCyber Space Flying and Fightingrdquo Technology News Daily 8 October 200664 Boleslaw A Boczek International Law A Dictionary 80 65 Jason Barkham ldquoInformation Warfare and International Law on the Use of Forcerdquo 111 66 American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
28
AUACSCSinksAY08
Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005
Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department
American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)
Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983
Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988
Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)
Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)
IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)
Joint Publication 3-13 Information Operations 13 February 2006
Joint Publication 5-0 Joint Operations Planning 26 December 2006
Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies
Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc
Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College
Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)
Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press
29
AUACSCSinksAY08
Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI
Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)
Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press
Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company
Detter Delupis I The law of war (2000) New York NY Cambridge University Press
Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)
Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College
Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor
Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)
Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)
Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf
Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)
Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College
Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College
Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)
Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA
30
AUACSCSinksAY08
Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)
Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)
Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College
Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology
Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College
Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)
OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center
OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College
OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications
Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991
Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College
Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center
Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)
31
AUACSCSinksAY08
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press
Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA
Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University
Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor
Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661
Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office
Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis
United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC
United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center
Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College
Wesley David C The Military Commander and the Law 2006
32
AUACSCSinksAY08
Bibliography Air Force Doctrine Document 2-5 Information Operations 11 Jan 2005
Air Force Operations and the Law A Guide for Aerospace Forces (2002) Washington International and Operations Law Division Judge Advocate Generals Department
American Law Institute Restatement of the Law (Third) The Foreign Relations Law of the United States (1987) Section 402
Case Concerning the Military and Paramilitary Activities in and Against Nicaragua International Court of Justice (27 June 1986) (httpwwwsandinoviveorg17bJugmntJune27-86htm accessed 11 April 2008)
Editorial ldquo1983 Korean airliner shot downrdquo BBC News 1 September 1983
Editorial ldquo1988 US warship shoots down Iranian airlinerrdquo BBC News 3 July 1988
Encyclopedia Britannica Online sv ldquoU-2rdquo httpwwwbritannicacomebtopic-612148article-9074050 (accessed 5 April 2008)
Googlecom httpwwwgooglecomsearchhl=enampdefl=enampq=defineCyberspace (accessed 12 March 2008)
IPowerWebcom wwwipowerwebcomhostingdictionary (accessed 12 March 2008)
Joint Publication 3-13 Information Operations 13 February 2006
Joint Publication 5-0 Joint Operations Planning 26 December 2006
Aldrich Richard W The international legal implications of information warfare (1996) Colorado Springs CO USAF Institute for National Security Studies
Armistead Leigh Information Operations Warfare and the Hard Reality of Soft Power (2004) Washington DC Potomac Books Inc
Banks Darwyn O Information war crimes Mitnick meets Milosevic (2001) Maxwell AFB AL Air Command and Staff College
Barkham Jason ldquoInformation Warfare and International Law on the Use of Forcerdquo International Law and Politics Vol 34 (4 April 2002)
Boczek Boleslaw A International Law A Dictionary (Feb 2005) Metuchen NJ Scarecrow Press
29
AUACSCSinksAY08
Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI
Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)
Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press
Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company
Detter Delupis I The law of war (2000) New York NY Cambridge University Press
Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)
Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College
Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor
Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)
Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)
Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf
Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)
Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College
Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College
Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)
Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA
30
AUACSCSinksAY08
Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)
Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)
Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College
Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology
Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College
Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)
OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center
OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College
OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications
Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991
Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College
Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center
Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)
31
AUACSCSinksAY08
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press
Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA
Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University
Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor
Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661
Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office
Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis
United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC
United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center
Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College
Wesley David C The Military Commander and the Law 2006
32
AUACSCSinksAY08
Bond James N Peacetime foreign data manipulation as one aspect of offensive information warfare questions of legality under the United National Charter Article 2 (4) (1996) Newport RI
Cartwright James E Strategic Forces Subcommittee Senate Armed Services Committee (28 March 2007)
Clausewitz Carl Von On War (1976) Princeton NJ Princeton University Press
Churchill Winston S The Second World War Volume II Their Finest Hour (1986) Boston MA Houghlin Mifflin Company
Detter Delupis I The law of war (2000) New York NY Cambridge University Press
Drezner Daniel W The Global Governance of the Internet Bringing the State Back in Political Science Quarterly Vol 1193 (Fall 2004)
Ellis Bryan W The international legal implications and limitations of information warfare what are our options (2001) Carlisle Barracks PA US Army War College
Etzioni Amitai Law and Order and the Wild Wild Web (Jan 22 2004) Christian Science Monitor
Fahrenkrug David T Cyberspace Defined (2002) Maxwell AFB AL Air War College September 2002)
Farrell Jr Lawrence P ldquolsquoAccessrsquo Challenges in Expeditionary Operationsrdquo National Defense Industrial Association (December 2003) (httpwwwndiaorgContentNavigationMenuResources1Presidents_Corner2Decemb er_2003htm accessed 11 Apr 08)
Greenberg Lawrence T Goodman Seymour E et al Information warfare and international law (1997) From httpwwwdodccrporgfilesGreenberg_Lawpdf
Grove Gregory D Cyber-attacks and International Law Survival Vol 42 No 3 (Aug 2000)
Gruendl Lois H The impact of offensive economic warfare on the operational commander (1995) Newport RI Naval War College
Haber Matthew E Computer network attack and the laws of armed conflict searching for moral beacons in twenty-first-century cyberwarfare (31 May 2002) Fort Leavenworth KS US Army Command and General Staff College
Hildreth Steven A Cyberwarfare Congressional Research Service (19 June 2001)
Hollis Duncan B ldquoRules of Cyberwarrdquo (8 Oct 2007) Los Angeles Times Los Angeles CA
30
AUACSCSinksAY08
Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)
Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)
Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College
Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology
Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College
Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)
OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center
OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College
OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications
Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991
Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College
Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center
Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)
31
AUACSCSinksAY08
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press
Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA
Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University
Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor
Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661
Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office
Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis
United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC
United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center
Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College
Wesley David C The Military Commander and the Law 2006
32
AUACSCSinksAY08
Ivan Goldberg Glossary of Information Warfare Terms Institute for Advanced Study of Information Warfare (httpwwwpsycomnetiwar2html accessed 12 March 2008)
Joyner Christopher C and Latrionte Catherine ldquoInformation Warfare as International Coercion Elements of a Legal Frameworkrdquo European Journal of International Law Vol 12 no 5 (2001)
Kaszuba Karl A Military technology has it changed the rules of warfare (Apr 1997) Maxwell AFB AL Air War College
Meader Gerald H Information warfare few challenges for public international law (26 Sep 1997) Wright-Patterson AFB OH Air Force Institute of Technology
Miller Robert D International law how it affects rules of engagement and responses in information warfare a research paper (1997) Maxwell AFB AL Air Command and Staff College
Moseley T Michael ldquoCyber Space Flying and Fightingrdquo Technology News Daily (8 October 2006)
OBrien Gregory J The international legal limitations on information warfare (1998) Ft Belvoir VA Defense Technical Information Center
OBrien Gregory J Information operations and the law of perfidy (18 May 2001) Newport RI Naval War College
OHuallachain D L and Sharpe J Forrest Neo-conned again hypocrisy lawlessness and the rape of Iraq the illegality and the injustice of the Second Gulf War (2005) Vienna VA Light in the Darkness Publications
Riding Alan ldquoWar in the Gulf Europe France Says US Bombers Can Now Use Airspacerdquo New York Times 2 February 1991
Roig William A Creating rules of engagement for information warfare examining the policy implications of international law (13 Jun 1997) Newport RI Naval War College
Romero Jorge H Cyberespionage 2010 is the current status of espionage under international law applicable in cyberspace (30 Apr 2001) Ft Belvoir VA Defense Technical Information Center
Sharp W Gary Cyberspace and the Use of Force (1999) Falls Church VA Aegis Research Corp 1999)
31
AUACSCSinksAY08
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press
Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA
Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University
Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor
Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661
Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office
Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis
United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC
United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center
Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College
Wesley David C The Military Commander and the Law 2006
32
AUACSCSinksAY08
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (May 1999) Maxwell AFB AL School of Advanced Airpower Studies
Shawhan Karl J Vital interests virtual threats reconciling International Law with Information Warfare and United States Security (Mar 2001) Maxwell AFB AL Air University Press
Shea Christopher ldquoSovereignty in Cyberspace Two Legal Scholars Puncture the Myth of the Borderless Lawless Internetrdquo (15 Jan 2006) The Boston Globe Boston MA
Shulman Mark Legal constraints on information warfare (Mar 1999) Maxwell AFB AL Air War College Air University
Staff Warren R Once its on the Web Whose Law Applies (19 Dec 2002) Christian Science Monitor
Thom Moxie C Information warfare arms control risks and costs (Mar 2006) From httppurlaccessgpogovGPOLPS69661
Thomas Timothy L Cyber Silhouettes Shadows Over Information Operations (2005) Fort Leavenworth KS Foreign Military Studies Office
Triggs Gillian International Law Contemporary Principles and Practices (2005) Sydney Australia Butterworths Lexis Nexis
United States Dept of Defense Office of General Counsel (1999) An assessment of international legal issues in information operations Washington DC
United States Office of Naval Intelligence and United States Coast Guard Intelligence Coordination Center (1999) Threats and challenges to maritime security 2020 Washington DC Coast Guard Intelligence Coordination Center National Maritime Intelligence Center
Vadnais Daniel M Law of armed conflict and information warfare--how the rule regarding reprisals apply to an information warfare attack (1997) Maxwell AFB AL Air Command and Staff College
Wesley David C The Military Commander and the Law 2006
32