Originally published on the CGS blog on January 28, 2011.
The threats of cyber-terrorism or cyber-warfare have been discussed in ever widening circles for some time. As modern society and commerce rely increasingly on digital technology, we recognize the growing scale of the damage and disruption that could be caused by malicious attacks on networks and computers. Potential targets often cited include power plants and power grids, banking and financial networks, water and sewage facilities, public transportation systems, and communication networks.
The role that global institutions might play in limiting cyber-attacks is less frequently discussed.
Richard Falkenrath offers an interesting opinion piece this week in the New York Times (1/27/11) entitled “From Bullets to Megabytes.” Dr. Falkenrath discusses the recent reported use of the Stuxnet “worm” to infect the software of the Iranian nuclear program, apparently with the intent and effect of disrupting the operation of the centrifuges used to concentrate radioactive isotopes. He conjures the risks that this poses for the United States and the world and recommends more attention to defensive efforts.
In passing, Dr. Falkenrath observes “An international entity that could legislate or enforce an information warfare armistice does not exist, and is not really conceivable.”
Let us pause to examine this point for a moment. Of course such an international organization is “conceivable.” What the author probably means is that the establishment of such an international organization is wildly impractical. Why is that? There are many reasons: complexity, secrecy, selfishness, and the inherent difficulty of getting differing people with differing perspectives to agree on anything. Is that enough to abandon the idea altogether?
In my experience people despair too quickly of reaching international agreements. This can be because international agreements are difficult to achieve. It can also be because some have philosophical objections to participating in international organizations or believe them to be ineffective. But there is no logical reason that international agreements could not be successful in limiting the use of cyber-warfare.
The Geneva Conventions contain many limitations on the conduct of warfare. We have international conventions prohibiting the use of torture and chemical and biological warfare. There is already some discussion of applying the principles of the Geneva Conventions to cyber-warfare. (See, for example, this summary of the work of Professor Randall R. Dipert at the University at Buffalo.) The limitations that exist, for example, on bombing civilian targets might be applied to cyber-attacks on civilian targets as well.
International agreements will not eliminate all of the risks of cyber-attacks, but cyber-warfare is sure to be a subject of international discussions and agreements increasingly in the future. There is much work to be done in establishing the philosophical and practical foundations of such agreements. This represents another example of a global problem that will require a global solution.
