6th European Conference - Academic Conferences

Cyber Strategy and the Law of Armed Conflict
Ulf Haeussler
National Defense University, Washington, USA
ulf.haeussler@ndu.edu
Abstract: At the time of writing, the author was Assistant Legal Advisor Operational Law, Headquarters,
Supreme Allied Commander Transformation (NATO HQ SACT). The views expressed herein are the author's
own and to not necessarily reflect the official position or policy of NATO and/or HQ SACT. Abstract: At its Lisbon
Summit (November 2010), NATO has adopted its Strategic Concept. The U.S. may soon adopt its Cyberstrategy
3.0 (originally expected for December 2010). Both strategy documents will contribute to a growing policy
consensus regarding cyber security and defence as well as provide better policy insights regarding cyber offence.
In doing so, they will contribute to a better understanding of how NATO and the U.S. want to prepare for, and
conduct cyber warfare in a manner congruent with the law of armed conflict. In addition, they will determine to
what extent this branch of the law needs to be better understood, developed, or reformed. Accordingly, this paper
indicates how the existing legal and policy frameworks intersect with practical aspects of cyber warfare and
associated intelligence activities, analyses how the new strategy documents develop and change the existing
policy framework, and what repercussions this may have for the interpretation and application of the law of armed
conflict. It also demonstrates how the new strategy documents inform the policy and legal discourse and hence
help confirm that NATO and U.S. as well as other NATO Nations' cyber activities are, and will continue to be,
lawful and legitimate.
Keywords: NATO Strategic Concept 2010, U.S. Cyberstrategy 3.0, Law of Armed Conflict, collective security,
collective defence
1. Introduction
Cyberspace is increasingly referred to as one of the global commons and as the fifth domain in which
warfare may occur (Lynn 2010, 101). Activities in cyberspace as well as involving the use of cyber
capabilities to create, or contribute to the creation of, effects in any one of the other commons, or
domains, have attracted significant discussion and analysis among technical experts, policymakers,
and legal scholars. The ensuing efforts to develop frameworks for cyberspace and the use of
associated capabilities (hereinafter collectively referred to as 'cyberspace') bring various perspectives
to bear. Cyberspace is multifunctional; it equally attracts private activities (with a strong business
component) and governments' official conduct as well as associated competing, if not conflicting,
interests. Not surprisingly, cyberspace has its unarguable dark side – on both its non-governmental
and its governmental end. The range of challenges and threats associated with the dark side of
cyberspace comprises, but is not limited to, privacy intrusions, financial loss, damage and destruction
in the physical domains, the potential of injury or even death, and (other) adverse effects on the
effectiveness of government. These challenges and threats reflects the large extent to which
computers and other information and communication technology devices can be leveraged as
weapons by non-governmental actors. Further challenges may arise out of policy positions adopted
by some non-governmental actors. For instance, the so-called 'internet pirates' endorse the notion of
a cyberspace beyond any government control whatsoever – a desire which, were it to come true,
might exacerbate all other challenges and threats referred to above.
Attempts to characterise cyber challenges and threats have usually used references to challenges
and threats in the physical domains, to which the word 'cyber' is added as a qualifier, enabling the
creation of catchwords such as cyber crime, cyber terrorism, and cyber attack. The terminology
developed using this method is attractive because it triggers analogies with known phenomena.
However, it is also prone to carrying misleading connotations since such analogies may easily fuel
misconceptions. For instance, the terms 'cyber crime' and 'cyber terrorism' do not capture the whole
range of non-governmental actors' malicious activities; moreover, they do not even attempt to address
possible links between non-governmental actors and their potential governmental sponsors. By
contrast, the term 'cyber attack' is too broad. Thus, information gathering activities may be referred to
as cyber attacks, though they might not necessarily or directly cause tangible damage. The
undifferentiated use of the notion of 'attack' may foster arguments by which a nation's inherent right of
self-defence is considered relevant to cyber activities or actions which neither has nor causes
potential or actual adverse effects. These examples may be indicative of a gap between technological
realities and the terminology used in policymaking as well as legal interpretation.
99