CONVENTIONAL MILITARY FORCE AS A RESPONSE TO CYBER CAPABILITIES: ON SENDING PACKETS AND RECEIVING MISSILES

摘要

With the increasing fear that states will begin responding to cyber-only intrusions through traditional military means, concerns abound. These concerns include the indeterminacy and inconsistency that plagues international legal regimes of traditional arms control, to include nuclear and biological weapons, creeping into the new world of regulating mis-labeled "cyber weapons." These concerns also envisage a downward spiral of hostile responses to cyber capabilities that become a disproportionate and dangerous, yet somehow legal, descent into unending and largely un-attributable retributive uses of force. Judge Simma expressed his own opinion about the ambiguities in the use of force legal regime, observing in his separate opinion to the Oil Platforms case, "[w]e currently find ourselves at the outset of an extremely controversial debate on the further viability of the limits on unilateral military force established by the United Nations Charter." His primary concern was a practical one: [O]utside the court-room.. .more and more, legal justification of use of force within the system of the United Nations Charter is discarded even as a fig leaf, while an increasing number of writers appear to prepare for the outright funeral of international legal limitations on the use of force. This concern, while possibly overdramatic, is not unfounded. Former General Counsel to the State Department Abraham Sofaer, retorted that the current majority legal view regarding the Security Council's "monopoly on the lawful use of force grows from a mix of arguments that have thus far won the day in international legal circles, even though they have no credibility among national security professionals." Sofaer further stated, "[t]he ICJ, the learned societies, the bar association, committees, and most scholars assert, as irrefutable doctrine, positions that are neither mandated by the language or history of the Charter, nor supported to any significant degree in the practice of states." These opinions on the future of use of force concepts aside, the combination of law and politics makes it clear that in any likely scenario an authorization by the UN Security Council to use force against a cyber-only capability is dubious at best. There is also little chance that the ICJ would ever make a finding that a cyber intrusion was an "armed attack" based on its excessively-high thresholds for the "use of force" and "armed attack" as coupled with the unwillingness to attribute any hostile action to a State which does not openly declare ownership of said action. What these ever-taller international hurdles for the "use of force" and "armed attack" leave, however, is more room 'below the line' for incidents to be considered as interventions and countermeasures, and a strong realpolitik desire to use this expanding territory. Many would argue that sanctioned violence on a large scale in response to cyber capability is unlikely because of the UN's "monopoly on the lawful use of force," as Sofaer puts it. However, the overwhelmingly-negative outcomes from such a trend may provide just as strong reason to avoid such a scenario. A similar attitude is betrayed in a number of recently-released documents from the mid-1940s which capture an international dialogue between the allied powers debating whether they should attempt a series of strategic assassinations in concert with the D-Day invasion at Normandy. The riveting back-and-forth dialogue consisting of typed memos and handwritten notes covers everything from the most high-value of targets to the potential legal intricacies of assassinating otherwise-lawful targets right before or right after capture as a POW. In the midst of the discussion one official summed up his vote against the plan with a rather un-legalistic analysis in May of 1944: I...dislik[e] this scheme, not out of squeamishness, as there are several people in this world whom I could kill with my own hands and with a feeling of pleasure and without that action in any way spoiling my appetite, but I think that it is the type of bright idea which in the end produces a good deal of trouble and does little good. This sentiment might capture the best reasons that national leaders have avoided launching missiles in response to a traffic light system being hacked, or the threat of a nuclear device in response to damage to SCADA systems. States retain the ability to operate 'below the line,' and thereby engage in limited, targeted military countermeasures as a way to combat (and potentially deter) the most damaging of offensive cyber capabilities. As long as this ability exists, the utility of large-scale military operations in response to a cyber-only scenario will continue to be outweighed by the dangerous precedents set and the likely international legal, economic, and diplomatic backlash that would be felt for decades to come.