Who Did It? Attribution of Cyber Intrusions and the Jus in Bello.

Abstract

The central concepts that make up the law of armed conflict (LOAC) have not been easy to adapt to cyber operations. In addition to their kinetic history and orientation, the core LOAC principles do not in most instances anticipate the kind of cyber-specific analysis that should accompany the use of increasingly advanced cyber systems and tools in conflict. Cyber operations rarely cause physical damage, much less injury or death. More often they cause cyber harm—by corrupting, manipulating or stealing data, denying access to a website, or interfering temporarily with the functionality of information systems. Or they indirectly disrupt or damage objects that are not part of the cyber domain.

Measuring the harm from a cyber incident and calculating that harm in ways that the LOAC credits remains challenging, as does defining and distinguishing civilian and military objects, and accounting for the indirect effects of cyber operations. Nor has the LOAC settled on a legal status for critical national security-related components of the cyber domain, including data and dual-use infrastructure.

Keywords: Laws of War, Laws of Armed Conflict, LOAC, Cyberattacks, Cyberwar, Cybersecurity, Jus in Bello, Emerging Technologies

JEL Classification: K10, K33, K30, K39