The Domestic Legal Framework for U.S. Military Cyber Operations

Abstract

Conventional wisdom holds that Congress has abandoned its duty regarding the government’s war powers. It is not hard to understand why. Between the agelessness and flexibility of the 2001 and 2002 Authorizations for Use of Military Force (AUMFs) and periodic unilateral uses of military force in Libya, Syria, and Iraq, the executive branch appears to act largely at its own discretion when it comes to conventional military operations. But matters are different in the cyber domain. With little fanfare and less public notice, Congress and the executive branch have cooperated effectively over the past decade to build a legal architecture for military cyber operations. This framework reflects recurring and constructive congressional engagement. The resulting structure is far less familiar to most observers than its cousins — those architectures associated with conventional military operations and intelligence activities — but is no less important. This is particularly true in light of the Pentagon’s commitment to the “defend forward” operational model.

Keywords: cyber, cyber-command, cyber-security, defend forward, persistent engagement, covert action, military cyber operations, computer network operations