4 June 2014

Why we need a cyberwar treaty

We must take the prospect of cyberwar seriously – and that means agreeing new international laws to define it

The Air Force Space Command Network Operations & Security Centre in Colorado Springs. ‘The internet has been intensely interesting to armies from its earliest days.’ Photograph: Rick Wilking/Reuters

The last month has been another extraordinary one for cyberspace. Ebay, that internet stalwart and pioneer of digital commerce, whose 120 million active users have over the past 15 years competed for a Virgin Mary toasted cheese sandwich, William Shatner's kidney stones and Michael Phelps's bong has had the personal details and passwords of its entire user base stolen. Meanwhile, the US government has issued federal grand jury indictments against five Chinese military officers for commercial cyber espionage. China reacted angrily calling the charges "fictitious" and "absurd", and denying that the country had ever been involved in digital theft.

Anyone who feels this response is even faintly plausible would do well to consult the exhaustive report on Unit 61398 of the People's Liberation Army, published last year by cybersecurity firm Mandiant. In its 70-odd pages the report builds a detailed and fascinating picture of this Chinese cyber crack commando unit tasked with stealing secrets from commercial and military targets abroad: its infrastructure, tools, tactics, base, and even some of the individuals involved, one of whom was identified because he used his computer skills to circumvent China's Facebook ban (a political irony that is unlikely to have escaped his superiors).

Far from absurd and fictitious, state-led cyber espionage is perfectly logical and real. By its very nature, cyberspace was always bound to be an irresistible magnet for spies and criminals. The internet is a decentralised data network that generates information on an unimaginable scale, accessible through relatively cheap hardware and easily acquired skills. It is the land of milk and honey for those whose business is acquiring what others want to keep from them. Behind the facade of spies and thieves lurks a deeper, far more frightening threat to the integrity of the world wide web. Originally conceived of as a military network in the 1960s, the internet has been intensely interesting to armies from its earliest days.

It shouldn't be a surprise, therefore, that the weaponisation of cyberspace is not the stuff of science fiction. Militaries have the capacity to attack communications networks, disrupt traffic, degrade or destroy data, all by navigating the electronic spiderweb that has engulfed the globe at breakneck speed. The more pervasive the internet becomes – and the internet of things is about to unleash a whole new level of connectivity – the likelier and scarier is the prospect that one day, when two middle- or upper-income nations enter a state of all-out conflict, the war's cyber-dimension will make Unit 61398's shenanigans look like child's play.

One decisive act of statesmanship could drastically turn this picture around. There is no regulation whatsoever of war in cyberspace – unlike conventional forms of battle, which are subject to an extensive set of international treaty laws signed and respected by the vast majority of the world's states.

The laws of armed conflict regulate when a nation state may legally use military force against another state, and what means it may use to do so. Official military doctrine in many countries is that these laws apply to cyberspace as they do to all other domains of warfare.

But cyberspace is unlike any of these domains. Attacks can take place from someone's desk, thousands of miles removed. The very meaning of the word "attack" is unclear: is any unauthorised digital incursion into another state's networks an offensive attack? Need it bring about destructive consequences to count as one?

An international treaty on cyberwar must clarify the meaning of cyber attack, set out permissible responses, and include an obligation for states to assist one another in the investigation of digital crimes. A nation's failure to cooperate in the aftermath of a cyber incident must imply a degree of culpability. Digital industrial espionage falls under the World Trade Organisation, which ought to take steps to outlaw what is an anti-competitive tactic, and expand the scope of its dispute settlement mechanism to include such behaviour.

Some argue that because attributing acts of cyber hostility is so difficult, a treaty would be a fool's errand. In fact, anonymity on the internet is impossible by definition: all internet traffic consists of electronically fired communication impulses which are traceable (as Mandiant's report shows). Attacks can be analysed using a mixture of digital forensics and traditional investigative methods.

A cyberwar treaty will bring about three profound benefits. First, militaries will no longer have to perpetuate a boundless arms race in a domain that is currently unconstrained by rules and conventions: expectations of military behaviour in cyberspace will be anchored in norms (just as most states do not have to fear attack by nuclear, chemical or biological weapons). Second, setting out response structures to cyber attacks will finally establish a modicum of deterrence in cyberspace. Third, once the military applications of cyberspace become more predictable, states can devote more effort to cross-border law enforcement cooperation in the pursuit of cyber criminals.

A senior US military commander confirmed to me that the recommendations and insights in my report, The Laws of War and Cyberspace, published today are sound – but also made clear that generals won't be leading the charge. It is for governments to make the first move. The world wide web is waiting.

No comments: