Cyber Attacks and the Legal Justification for an Armed Response - Need to Clarify Definition of Cyberattack, Legal Guidelines, Law of War and Armed Conflict, Severity and Human Casualties

When is an armed response to cyber attacks legally justified? International law does not refer to cyber, cyber attack targets, or the effects of a cyber attack in the same manner that it addresses conventional attacks, target selection, and effects. Cyber attacks are certainly not a new phenomenon and have been a growing threat for more than thirty years, resulting in the current potential for causing catastrophic harm. Existing sources of international law sufficiently provide the legal justification required for armed response despite not directly using cyber terminology. The analysis provided in this monograph addresses the need for clarification of the legal and political justification for armed response to a cyber attack. Political leaders must have the legal justification for armed response but must also mitigate political risk. This monograph proposes policy factors to be used to decide whether armed response that is legally justifiable is warranted. Political leaders need to determine the likelihood of attack, and look at the effects of multiple types of scenarios, not just the worst case. Contents: 1. Introduction 2. The Need for Clarification of the Definition of a Cyber Attack 3. Legal Guidelines 4. Policy and Armed Response 5. Conclusion The focus on whether cyber attacks are "acts of war" is misplaced and creates a perception that the United States will respond to a cyber attack with a declaration of war. A declaration of war is only one, and not the most commonly used, form of armed response. Armed response for cyber attacks is more likely to occur as an Authorization for the Use of Military Force (AUMF) since formal declarations of war have fallen out of favor. Since World War II, the preferred method of armed response from the United States is an AUMF, a form of response that dates back to 1798. Another implication of the bill is that current international law does not provide adequate guidance for armed response to cyber attacks. In fact, the existing legal framework of international law is sufficiently applicable to an armed response to cyber attacks and was purposely written to be broad enough to incorporate new concepts, technology, and terminology. The analysis provided in this monograph addresses the need for clarification of the legal and political justification for armed response to a cyber attack. Understanding when an armed response to cyber attacks is legally justified begins with understanding the various definitions of cyber attack. Simultaneously describing the circumstances of the growing cyber problem demonstrates how the history of cyber attacks has led to demands for the clarification of the permissibility of an armed response. Existing sources of international law provide the legal justification required for armed response despite not directly using cyber terminology. A comparison of how cyber attacks conform to the language used to define conventional attacks further supports the claim that existing law is sufficient. An analysis of current cyber policy demonstrates that the United States considers existing international law sufficient, offering additional support for the sufficiency of current law. This monograph proposes policy factors to be used to decide whether armed response that is legally justifiable is warranted. Finally, hypothetical illustrations provide what-if scenarios that are outside the norms of conventional attacks to which existing international law and the proposed factors for decisions can be applied to determine if an armed response is legally justified and politically advisable.