Cyberspace InvadersIs a cyber-attack an act of war?
Updated Friday, Nov. 7, 2008, at 6:49 PM ET
Chinese hackers have breached the White House computer network on numerous occasions, the Financial Times reported Thursday. Officials believe the attacks may be sponsored by the Chinese government. Is a cyber-attack by a foreign government an act of war?
PRINT
DISCUSS
E-MAIL
RSS
RECOMMEND...
Facebook
MySpace
Mixx
Digg
Reddit
del.icio.us
Furl
Ma.gnolia
Sphere
StumbleUponIt depends on the context. An "act of war" is defined in the U.S. Code as any act that occurs during declared war or during armed conflict between two countries (although President Bush did call the Sept. 11 attacks an "act of war"). So, technically, if a cyber-attack occurs during a war, it's an act of war; if not, it's not. Whether or not a cyber-attack is grounds for war depends on the nature of hackers' intentions: to spy, by stealing secrets, or to disrupt national infrastructure. Most governments consider espionage—the collecting of information about another country—a crime but not a casus belli. But sabotage—say, pulling down a power grid that serves hundreds of cities—could be construed as one.
So far, no cyber-attack has ever started a war. That's because the vast majority of attacks qualify as espionage. In 2007, hackers infiltrated the Pentagon's unclassified e-mail system. The World Bank, with its troves of financial information about foreign governments, has been invaded several times. When a U.S. trade official traveled to China in 2007, foreign spyware programs were reportedly discovered on some of his electronic devices. Hackers targeted both the Obama and McCain campaigns with cyber-attacks, presumably to cull strategic information about the future president. Organized crime is active online, too, but usually the goal is profit, not access to classified information.
Another reason governments rarely treat cyber-attacks as acts of war is that they're so hard to trace. The 1999 "Moonlight Maze" incident, in which hackers stole files from the Department of Defense, was traced to computers in Russia. But the Kremlin denied involvement, and the case remains unsolved. There's also a risk that you'll finger the wrong guy. A 1998 investigation called "Solar Sunrise" initially led intelligence officials to suspect Iraq in a series of breaches of Department of Defense computers. It turned out to be the handiwork of two teenagers in Northern California.
Compared with the rules of actual warfare—which are recognized by international treaties—the rules of cyber-warfare are murky. In 2007, the Bush administration announced a National Cyber Security Initiative that would, in part, codify the consequences of cyber-attacks on the United States. But the specifics of the doctrine remain classified. (A Senate committee criticized the initiative for its secrecy, arguing that deterrence works only if the enemy knows what the policy is.)
Other countries have pushed for a more explicit cyber-doctrine. Estonia, which fell victim to a massive foreign cyber-attack in 2007, created a Cyber Defense Center in cooperation with other NATO countries and urged NATO and the U.N. to establish a doctrine that covers cyber-warfare. Meanwhile, China has been blunt about its ambitions. A Pentagon report from 2007 concluded that while China doesn't have an official cyber-doctrine, it has declared its intent to achieve "electromagnetic dominance" over its opponents and has developed viruses to attack enemy computers.
Got a question about today's news? Ask the Explainer.
Explainer thanks James Lewis of the Center for Strategic and International Studies and Sami Saydjari of the Cyber Defense Agency.
Sarah Palin's Brand of Populism Is Dangerous and Deceptive
New York Times Amazed To Find Jews in Montana
All Your Nagging Amanda Knox Questions Answered
No One Writes a Great Letter Anymore
New Evidence That Buying Green Products Can Make You a Worse Person
Could a Tea Party Candidate Actually Win an Election?
Russia blacked out Georgia's communications, but also hacked away their internet during the August war. That may have been the first time hackers used their skills to directly support a ground assault.
No one is going to do anything like that to us anytime soon, but we need to keep our allies in mind, and we need to be better at everyone else at all types of warfare. The first thing to do is raise awareness of this.
First, raise the awareness in our military. For the last decade, control of "cyberwarfare" has bounced around the Pentagon like a football. The airforce made a play for it, but now they've fumbled again.
Basically, we need to get our act together on offensive and defensive technological warfare. Secondly, we need to be a powerful and authoritative voice on this issue internationally. We need to make it clear that countries can't do this to one another, and that we will regard such activity as a form of aggression. This might sound a bit sci-fi, but technology is becoming far too relevant to push out of our minds. The United States has to be the major authority on both civil and military use of the internet, and we can't settle for anything less than that.
--jwschmidt
(To reply, click here.)
How is it any different if an intruder is caught in my home looking around or a hacker is caught in my computer systems looking around? Both are an invasion of privacy and the assumption of privacy is clear in both instances. All the legal crap at the beginning of the article was just the perfect excuse for allowing invasion of national computer systems without severe penalty. I am still wondering what that penalty would be?
Hell, if you or I caught someone in our homes, or gut instinct and our legal right would be to stop them by any force necessary. Keeping them out in the first place is priority one. But should they enter, they are at our mercy. It is all about levels. In my home, your unauthorized entry constitutes a war between me and you. Same applies to governments hacking other governments' computers, including our hacking Russia or China.
Without secrets, there would be no spying.
--iralarry
(To reply, click here.)
(10/28)