An Unsatisfactory State of the Law: The Limited Options for a Corporation Dealing with Cyber Hostilities by State Actors

Abstract

The rapidly increasing willingness of state actors to conduct hostile cyber operations against corporations has not gone unnoticed by governments, and, in particular, the United States. Corporations, for their part, overwhelmingly support government involvement in cyber issues. This mutual desire for a corporate-government partnership provides an opportunity to build an effective response to the cyber threat posed by state actors. Yet, corporations also must be cognizant that the present environment is woefully inadequate at providing the necessary cyber defense mechanisms needed to protect their businesses. This short-term need for protection coupled with the interest in a corporate-government partnership raises two questions. First, what can a corporation do to protect itself from state-sponsored cyber hostilities? Second, what are some possible models for a corporate-government partnership to address the threat in the future?

This Article addresses both of these questions by first outlining why it is difficult for a corporation to respond to state-sponsored cyber hostilities. Understanding this difficulty allows for the development of appropriate corporate responses to hostile state actors. An explanation of what the law allows a corporation to do in defense of its business interests will follow. As self-protection for business is only a partial solution, recommendations for enhancing the corporate-government partnership to blunt state actor cyber hostilities will also be offered. The Article concludes by reiterating the criticality of developing a comprehensive and coherent strategy for responding to this ever-growing threat.

Keywords: Cyber Warfare, Law of Armed Conflict, International Humanitarian Law, Law of War, State Responsibility, Corporations, Cyber Hostilities, Domestic Cyber Law, Corporate-Government Partnership, Cyber Space

JEL Classification: K00, K14, K22, K33