Technology, Policy, Law, and Ethics Regarding U.S. Acquisition and Use of Cyberattack Capabilities (2009) / Chapter Skim
Currently Skimming:
10 Alternative Futures
10 Alternative Futures
Pages 318-334
The Chapter Skim interface presents what we've algorithmically identified as the most significant single chunk of text within every page in the chapter.
Select key terms on the right to highlight them within pages of the chapter.
From page 318... ...
This chapter explores some of the issues that arise in considering such proposals, but does not take a stand one way or another on their inherent desirability. 10.1 Regulatory Regimes -- Basic Principles The laws of armed conflict acknowledge an inevitability to conflict and seek to put restraints on what might otherwise be unrestrained behavior.
|
From page 319... ...
For example: • The United States and the Soviet Union maintained a "hot line" to facilitate direct contact between the respective national leaders during times of crisis on the theory that direct contact would be valuable in reducing misunderstanding about national activities that were ongoing or imminent. • The United States and the Soviet Union signed an agreement in 1989 that bound each side to take steps to prevent interference with command and control networks in a manner that could cause harm to personnel or damage to equipment of the armed forces of the other side.
|
From page 320... ...
• The United States and Russia have agreed to various measures to reduce the likelihood of an incident at sea between the naval forces of the two countries, and to reduce the likelihood of escalation in the event that one occurred. Such measures include steps to avoid ship collisions, avoiding maneuvers in areas of heavy sea traffic, requiring surveillance ships to maintain a safe distance from the object of investigation, refraining from simulating attacks at the other party's ships, and so on.
|
From page 321... ...
Confidence-building measures -- arrangements in which signatory parties agree to refrain from or to notify other signatories prior to conducting certain activities that might be viewed as hostile or escalatory or to communicate directly with each other during times of tension or crisis -- are explicitly intended to reduce the likelihood of conflict due to accident or misunderstanding. In addition, agreements to eschew the use of cyberattack may have some value in reducing the likelihood of kinetic conflict in those cases in which cyberattack is a necessary prelude to a kinetic attack. • Reducing the destructiveness of any conflict that does occur.
|
From page 322... ...
, a regulatory regime for cyberattack might also reduce the likelihood of economic warfare using this military tool. As an example of an international agreement involving the use of cyberattack, Davis Brown, a former deputy staff judge advocate of the U.S.
|
From page 323... ...
SOURCE: Adapted from Davis Brown, "A Proposal for an International Convention to Regu late the Use of Information Systems in Armed Conflict," Harvard International Law Journal 47(1) :179-221, Winter 2006.
|
From page 324... ...
But such agreements do create international norms regarding the acceptability of such behavior, and they do something to inhibit training Davis Brown, "A Proposal for an International Convention to Regulate the Use of Information Systems in Armed Conflict," Harvard International Law Journal 47(1) :179-221, Winter 2006.
|
From page 325... ...
A nation's military forces may refrain from targeting the power grids of an adversary, but patriotic hackers or terrorist groups on that nation's soil might do so without explicit government approval. Thus, compliance with such an agreement might entail a somewhat bizarre scenario in which two nations are in conflict, perhaps kinetic conflict, but each is simultaneously conducting actions (perhaps involving law enforcement)
|
From page 326... ...
Then technology and doctrine advance rapidly, and before it is widely realized, it has become too late to enter into an agreement because the potential signatories to such an agreement have so much at stake in using the weapons that would be controlled by the putative agreement. 10.2.2 Indirect Approaches Based on Regulation of Non-military Domains The United States has been a party to many international agreements that are not arms control agreements.
|
From page 327... ...
These commitments have not uniformly been kept, but security has been enhanced in these areas of international commerce because of the virtually universal support given to protecting these activities from identified threats. Sofaer and Goodman proposed a draft multilateral treaty that would have initiated a similar process to help improve cybersecurity internationally, even though it would have initially excluded any direct application of rules and standards developed to the national security activities of member states. The proposed treaty would have included: • Agreed principles on the use and protection of cyberspace; • Maximum emphasis on protecting the system, rather than on preventing its use for socially unacceptable objectives such as pornography; • Agreement of all parties to cooperate in preventing, prosecuting, and cooperating against improper conduct by any non-government group; • Maximum coverage, so as to limit use of "rogue" territories as bases for attacks; • A program to develop cyber capacities of developing states; and • Substantial involvement and authority given to the private sector in developing and approving standards.
|
From page 328... ...
These resolutions have variously called on member states to further promote the multilateral consideration of existing and potential threats in the information security field, as well as possible measures to limit emerging threats, consistent with the need to preserve the free flow of information. In addition, they have invited all member states to inform the secretary-general of their views on several topics, including a "general appreciation of the issues of information security"; "definition of basic notions related to information security that would include unauthorized interference with or misuse of information and telecommunications systems and information resources"; and "relevant international concepts aimed at strengthening the security of global information and telecommunications systems."15 Although several member states have indeed submitted views on this topic, the efforts of the General Assembly have been spearheaded by the 13 See letter from Ivanov to Annan, September 30, 1998, available at http://www.
|
From page 329... ...
. Russia retains the right to use nuclear weapons first against the means and forces of information warfare, and then against the aggressor state itself.16 In stating its views on the subject of information security to the United Nations, Russia defined information war as "confrontation between States in the information area for the purpose of damaging information systems, processes and resources and vital structures, undermining political, economic and social systems as well as the massive psychological manipulation of a population in order to destabilize society and the State." Information weapons were regarded as the "ways and means used for the purpose of damaging the information resources, processes and systems of a State, exerting an adverse influence, through information, on the defence, administrative, political, social, economic and other vital systems of a State, as well as the massive psychological manipulation of a population in order to destabilize society and the State." The Russian Federation has set forth to the United Nations a document articulating what it describes as "Principles of International Information Security."17 (Selected principles are listed in Box 10.2.)
|
From page 330... ...
Encouraging the activities of international terrorist, extremist or criminal associations, organizations, groups or individual law breakers that pose a threat to the information resources and vital structures of States; (h) Formulating and adopting plans or doctrines envisaging the possibility of waging information wars and capable of instigating an arms race as well as caus ing tension in relations between States and specifically giving rise to information wars; (i)
|
From page 331... ...
Recognize the danger of using information weapons against vital struc tures as being comparable to the threat of use of weapons of mass destruction; (g) Create conditions for the equitable and safe international exchange of information based on the generally recognized rules and principles of international law; (h)
|
From page 332... ...
China apparently sees great value in acquiring information warfare capabilities and developing facility in their use, and indeed sees information warfare as an equalizer in potential military conflicts with a technologically superior adversary such as the United States.19 For example, Mulvenon argues that the Chinese see information warfare against the information systems of the U.S. military as a way to degrade and delay the mobilization of U.S.
|
From page 333... ...
Indeed, according to Thomas, the information warfare mission is an ideal one for the reserve military forces of China, which can enlist many individuals who are not qualified or eligible to be frontline soldiers. The Chinese perspective suggests that the Chinese are likely to view any attempt to restrict the use of cyberattack as a way to undermine one of China's few advantages in competing militarily with an adversary such as the United States.
|
Key Terms
This material may be derived from roughly machine-read images, and so is provided only to facilitate research.
More
information on Chapter Skim is available.