cyber

ww.sciencedirect.com

c o m p u t e r l a w & s e c u r i t y r e v i e w 3 1 ( 2 0 1 5 ) 3 9 0 e4 0 0

Available online at w

ScienceDirect

www.compseconline.com/publications/prodclaw.htm

Cyber-attack as inevitable kinetic war

Gary Lilienthal a,*, Nehaluddin Ahmad b

a School of Law, UUM COLGIS, Universiti Utara, Malaysia b School of Law, (UNISSA) Sultan Sharif Ali Islamic University, Brunei

Keywords:

Cyber-attack

Kinetic war

Stuxnet

Maneuver warfare

Necessity

* Corresponding author. School of Law, Coll Sintok, Kedah Darul Aman, Malaysia.

E-mail address: [email protected] (G. Lil http://dx.doi.org/10.1016/j.clsr.2015.03.002 0267-3649/© 2015 Gary Lilienthal and Nehalu

a b s t r a c t

This paper poses the question as to whether a “cyber-attack” by a state against another

state might breach of Article 2(4) of the United Nations Charter. Although this question is

not new, and the answers to it are either by no means consistent or far too clear for the

uncertainty of a military field, this paper expresses significant concerns that some of the

basic military issues may have been overlooked in contextualizing cyber-attack in United

Nations Charter jurisprudence. Its methodology is delimited to discussing the nature of

cyber-attack, but only on a basis between one sovereign state and another sovereign state.

The paper is further delimited by reference to Article 2(4) of the UN Charter, and how that

article might be considered breached. Interwoven throughout the paper is a proposition

that cyber-attack is intended to be a military action in the nature of maneuver warfare as

an instance of Aristotelian ethical deliberation and action, and further, it is always

intended to have military consequences. The inference from this is that a cyber-attack is

intended to have kinetic effects in the same way as fraud and deception infer physical

effects, and therefore, is intended to have effects similar to those of conventional warfare.

The paper begins with an examination of kinetic precepts underlying cyber warfare. Then,

the paper looks at how attacks on information might represent a kind of warfare. With an

abiding concern to include practical military thought, to represent the uncertainty of war,

the paper discusses the nature of maneuver warfare, based on Lind's practical military

discussion of the term. The next phase of the paper surveys the relevant international law

and international law precepts, followed by a brief look at relevant case law. The paper

concludes with a suggestion that the information operations inherent in cyber-attacks are

essentially and necessarily a priori to a kinetic consequence.

© 2015 Gary Lilienthal and Nehaluddin Ahmad. Published by Elsevier Ltd. All rights

reserved.

1. Introduction

This paper asks whether a “cyber-attack” by one state against

another might be a breach of Article 2(4) of the UN Charter.

This question is not new, and the answers to it are either by no

ege of Law, Government

ienthal).

ddin Ahmad. Published

means consistent or far too clear for the uncertainty of a

military field. However, this paper expresses concerns that

some of the basic military issues may have been overlooked in

contextualizing the law of cyber-attack in United Nations

Charter jurisprudence. The effects of a breach of article 2(4)

through cyber attacks carry significant risk for public safety,

and International Studies Universiti Utara Malaysia UUM, 06010

by Elsevier Ltd. All rights reserved.

c o m p u t e r l a w & s e c u r i t y r e v i e w 3 1 ( 2 0 1 5 ) 3 9 0 e4 0 0 391

nations' security and the stability of the links among the global international community. This suggests an increased

likelihood of national armed response as self help.1

Its methodology is delimited to discussing the nature of

cyber-attack but only on the basis between one sovereign

state and another sovereign state. The paper has a further

delimitation by reference to Article 2(4) of the UN Charter, and

how that article might be considered breached. Interwoven

throughout the paper is a proposition that cyber-attack is

intended to be a military action in the nature of maneuver

warfare, and further, it is always intended to have military

consequences. The inference from this is that cyber-attack is

intended to have kinetic effects, or effects due to some kind of

physical motion, in the same way as deception infers physical

effects and, therefore, is intended to have effects similar to

those of conventional warfare.

The paper begins with an examination of kinetic precepts

underlying cyber warfare, because international actors

designed the laws of war in the context of kinetic technologies.2

Then, the paper looks at how attacks on information might

represent a kind of warfare. With an abiding concern to include

practical military thought, to represent the uncertainty of war,

the paper discusses the nature of maneuver warfare, based on

Lind's practical military discussion of the term. The next phase of the paper is to survey the relevant international law and

international law precepts, followed by a brief look at relevant

case law. Finally, the paper draws relevant conclusions.

The paper is likely to conclude with a suggestion that the

information operations inherent in cyber-attacks are essen-

tially and necessarily a priori to a kinetic consequence. The

Estonian cyber-attacks of 2007 will illustrate this. In that attack,

moving the statue of the Bronzed Russian Soldier could have

been construed as a perceived attack on sovereignty, naturally

precipitating violence. Also, the chain of argument will infer

that even when a cyber-attack does not breach Article 2(4) of

the UN Charter, application to the United Nations Security

Council for remedial action might produce action. That action

would be as if the cyber-attack were indeed a breach.

2. Cyber warfare

Parks and Duggan differed from other scholars in that they

regarded cyber-attacks as only likely to be kinetic in nature.

They examined the theory of kinetic precepts underlying

cyber warfare; the word kinetic meaning the kind of force,

including the movement of a weapon, which would have

physically damaging effects on an enemy recipient.3 Referring

to the ancient text of Sun Tsu on The Art of War,4 they

1 Report of the Group of Governmental Experts on De- velopments in the Field of Information & Telecommunications in the Context of International Security, 65th Session, ¶1, UN Doc A/ 65/201, July 30, 2010.

2 Michael Gervais, Cyber Attacks and the Laws of War, (2102), 30(2) Berkeley Journal of International Law, 526.

3 Raymond C. Parks and David P. Duggan, 'Principles of Cyber- warfare', (2001) Proceedings of the 2001 IEEE Workshop on Infor- mation Assurance and Security, United States Military Academy, West Point 122, 122e125.

4 Sun Tsu, The Art of War (Dover, 2002).

examined what they said were well-understood ancient mil-

itary principles. These were objective, mass, surprise, offen-

sive, maneuver, economy of force, unity of command,

simplicity and security. They conducted their examination

with a view to assessing to what extent, if any, these princi-

ples applied to cyber warfare. Arguably, an outcome of this

exercise would serve to characterise the extent to which cyber

warfare was indeed kinetic warfare.

They suggested the kinetic precept of mass was effectively

irrelevant to cyber-warfare, unless in the case of denial of

service attacks, simulating kinetic warfare. They argued that

the kinetic precept of objective was applicable in cyber-

warfare since the precept of objective formed part of all

types of warfare. They argued that the kinetic precept of

offensive was not very relevant to cyber-warfare, in which

stealth and surprise were far more important. They noted

that, at the Cyber Strategy Workshop in October of 1999, del-

egates made analogies between cyber-warfare and submarine

warfare, and also, analogies between cyber-warfare and spe-

cial operations. They observed that both analogies were good.5

Thus, a submarine could conduct both overt and covert

operations, acting in peacetime as a deterrent by performing

surveillance operations and information gathering. In times of

war, a submarine could carry out surveillance and informa-

tion gathering, communication of data, landing of special

operations forces, attack of land targets, protection of task

forces and merchant shipping. It could deny to an enemy

certain areas of the seas. Submarines required no vulnerable

logistics chain, nor depended for survivability on any mutual

defence from other sources.6

In the editors' general introduction to Special Operations in US Strategy, they cited Tugwell and Charters’ proposed

description of special operations.7 As a legal definition, it is

arguably unusable:

Small-scale, clandestine, covert or overt operations of an unor-

thodox or frequently high-risk nature could be undertaken to

achieve significant political or military objectives in support of

foreign policy. Special operations are characterized by either

simplicity or complexity, by subtlety and imagination, by the

discriminate use of violence, and by oversight at the highest level.

Military and non-military resources, including intelligence as-

sets, may be used in concert.8

Isenberg suggested that special operations were a way to

maintain low intensity conflict,9 not inconsistent with the

apparent goal of cyber-attack. Putting these views together,

special operations appeared to be small-scale risky ventures,

of a subtle nature, and probably meaning highly deceptive,

5 Raymond C. Parks and David P. Duggan, 'Principles of Cyber- warfare', (2001) Proceedings of the 2001 IEEE Workshop on Infor- mation Assurance and Security, United States Military Academy, West Point 122, 123.

6 Dan van der Vat, The Atlantic Campaign, Harper & Row, 1988. 7 F. Barnett, B. Tovar, R. Shultz (eds.), Special Operations in US

Strategy, National Defence University Press, New York, 1988, at p. 9.

8 Ibid. 9 David Isenberg, ‘Special Forces: Shock Troops for the New

Order’, 177 Middle East Report, (1992), pp. 24e27, at p. 24.

c o m p u t e r l a w & s e c u r i t y r e v i e w 3 1 ( 2 0 1 5 ) 3 9 0 e4 0 0392

directly and violently executing foreign policy using the

sources of intelligence available to the top levels of govern-

ment. There seems to be here an analogy to cyber-attack.

Also, Isenberg observed that the cyber terrorist model

closely matched an assassin's profile.10 Schmitt suggested that an assassination could be understood, from the classic

law of war prohibition on treacherously killing the enemy.11

He clarified by observing that treacherous acts violated a tar-

get's belief that those around him or her posed no threat,12

which sounded like a vernacular description of deception.

Thus, offering a bounty or reward for the death of an enemy,

was also regarded as treacherous.13 The Lieber Code of 1863

discussed assassination,14 in the following terms:

The law of war does not allow proclaiming either an individual

belonging to the hostile army, or a citizen, or a subject of the

hostile government an outlaw, who may be slain without trial by

any captor, any more than the modern law of peace allows such

international outlawry; on the contrary, it abhors such outrage.

The sternest retaliation should follow the murder committed in

consequence of such proclamation, made by whatever authority.

Civilized nations look with horror upon offers or rewards for the

assassination of enemies as relapses into barbarism.15

Even although the offeror of the reward did no killing, the

monetary inducement made it more inevitable. It appeared

that a reward foran assassination would be similar to cyber-

attack if the natural consequences of the attack were ki-

netic. According to Parks and Duggan, in neither of these

cases, of submarines or assassins, was the offensive as crucial

as it was in a conventional war. The kinetic precept of surprise

did apply to cyber-warfare, just as cyber-warfare was a

deployment of the kinetic precept of economy in force. The

kinetic precept of maneuver was also applicable in cyber-

warfare, because, in this mode, the attacker was only mov-

ing the point of attack. The kinetic precept of unity of com-

mand also was applicable in cyber-warfare. The kinetic

precept of security applied to cyber-warfare, as did the kinetic

precept of simplicity.16

Parks and Duggan argued that cyber-warfare had to have

kinetic world effects, this kind of warfare being meaningless

unless affecting something in the real world. Cyber-warfare

could move a real object, such as opening a dam spill-gate,

or shutting down an electrical substation. This was similar

10 The United States Department of the Army Memorandum of Law on Assassination, by W. Hays Parks, discussed Executive Order 12333 and stated that assassination was unlawful. The Memorandum of Law suggested that assassination is murder by sudden or secret attack. 11 Michael N. Schmitt, Essays on Law and War at the Fault Lines

(Asser Press, The Hague, 2012), at p. 285. 12 Ibid, at p. 312. 13 Ibid, at p. 308. 14 The Lieber Code of 1863. War Department, Adjutant General's

Office, Washington, 1863. 15 The Lieber Code of 1863. War Department, Adjutant General's

Office, Washington, 1863, section IX. 16 Raymond C. Parks and David P. Duggan, 'Principles of Cyber-

warfare', (2001) Proceedings of the 2001 IEEE Workshop on Infor- mation Assurance and Security, United States Military Academy, West Point 122, 122e125.

in causal consequence to kinetic warfare. It could affect de-

cision-makers’ minds in the real world. It was more by way of

information warfare, where given information caused incor-

rect decisions by tactical and strategic decision-makers.

Tactical decision-makers could be deceived about the size

and location of the enemy forces. Strategic decision-makers

might be deceived by their attributing enemy actions to the

wrong countries.17

However, suggesting a genus problem with their method-

ology for analysis, Parks and Duggan concluded that cyber-

warfare was still different from kinetic war. Both cyber-

warfare and the more general information warfare depended

on human weaknesses. Kinetic warfare was in the real world.

Cyber-warfare was in an artificial world, inherently chaotic and

more imperfect than the physical world. While cyber-warfare

might use some precepts of kinetic warfare, others had little

significance in cyberspace. For these reasons, the precepts of

cyber-warfare were not the same as those in kinetic warfare.18

However, they found that submarine war and special opera-

tions, as well as the operational profile of the assassin, were

essentially the same as cyber warfare. This view was at odds

with those of other scholars, such as Roscini,19who preferred to

regard cyber-attacks as entirely non-kinetic.

Roscini was of an oblique view to that of Parks and Duggan,

applying a genus in the nature of fraud to the discussion. He

stated that cyber-attacks fell within the more general category

of information operations, and apparently excluded them

from being defined as including the use of kinetic force. He

defined information operations, somewhat unhelpfully, as

employing the central know-how of electronic warfare. This

know-how included computer networking, psychological

tactics, traditional military deceit, essentially to make war on

the adversary's decision-making while protecting that of the cyber attacker.20

Although often they were publicly labeled as cyber-attacks,

information operations might focus solely on intelligence

collection and observation. They could be for propaganda

purposes, (as also could assassinations), or for breaching the

confidentiality of sensitive information on computer sys-

tems.21 This kind of practice suggested a less kinetic use but

ignored the arguably more in-depth technical analysis of

Parks and Duggan, as above.

These information operations were attacks aimed at

destroying the value of information in the target computer, to

incapacitate the enemy's command system. This kind of attack could also result in damage outside to the target com-

puters, in some chain of causation. This outcome could be by

viruses, or by the corruption of computer hardware or soft-

ware, or flooding it with so many data that it collapsed - a

denial of service attack. A virus was a software tool that might

attach itself to a normal program to modify it and other con-

nected computers.22

17 Ibid. 18 Ibid, 125. 19 Marco Roscini, ‘World Wide Warfare - Jus ad Bellum and the

Use of Cyber Force’, in A. von Bogdandy and R. Wolfrum (eds), Max Planck Yearbook of United Nations Law, Volume 14, 2010, 85, 91. 20 Ibid. 21 Ibid, 92. 22 Ibid, 93.

27 Ibid. 28 [1903] 1 Ch 728, 732e733. 29 Ibid. 30 P. Naraynam Law of Trade Marks and Passing Off (Eastern Law

House, 6th Ed, 2007), p. 698. 31 Ibid, 699.

c o m p u t e r l a w & s e c u r i t y r e v i e w 3 1 ( 2 0 1 5 ) 3 9 0 e4 0 0 393

Despite the fact that cyber-attacks were assumed to be

ostensibly non-kinetic attacks, if the recipient state could

identify the state source of the cyber-attack and ascribe the

belligerent conduct to that state, there would be several rem-

edies available to the aggrieved state party. It could refer the

state of affairs to the United Nations Security Council under

Article 35 paragraph 1 of the UN Charter. The Security Council

could act, under Article 36 paragraph 1, to recommend appro-

priate methodologies for settling the dispute. If the Security

Council established additionally that this reported state of af-

fairs was a threat to peace, a breach of the peace, or an act of

international aggression, it might additionally use its powers,

under Chapter VII. Roscini argued that even when observers

judged cyber-attacks as breaches of international peace, or acts

of international aggression, they still might amount to a threat

to the international peace. It appears that the United Nations

Charter drafters’ intentions were to limit the concept of

breaches of international peace or acts of international

aggression, to an international use of orthodox armed force.

However, Roscini observed that the scope had been expanded

over the years. The result was, according to Roscini, that almost

anything could be characterised as a threat to the international

peace in Security Council deliberations.23 Roscini suggests that

the Security Council could impose a cyber-blockade on the

responsible state to avert continuation of the cyber-attacks.24

Thus, it could be argued that a cyber-attack, while not being a

breach of Article 2(4) of the UN Charter, might still be treated as

if it were the equivalent.

Roscini observed that the main questions were whether a

cyber-attack amounted to an act over the minimum required

for the use of force, if it was an actual use of force, or whether

it amounted to armed attack. In the absence of specific jus ad

bellum rules, there were only the provisions contained in the

UN Charter and the customary international law. These rules

were flexible enough to extend to new kinds of warfare.

Thus, Roscini concluded that cyber-force could be charac-

terised as armed force, per Article 2 paragraph 4 of the UN

Charter.25

Although Parks and Duggan apparently concluded that

cyber warfare was somewhat different from kinetic warfare,

their interlocutory argument agreed with the propositions

that submarine war and special operations, as well as the

operational profile of the assassin, were essentially the same

as cyber warfare. Arguably, these styles of warfare might well

involve, or be, kinetic warfare. Thus, Roscini's conclusions arguably suffered a similar irony. It could be stated this way:

since the effect of cyber-attacks was like attacks on the mind,

there was no kinetic warfare. The discussion requires a better

understanding of deceit and kinetic outcomes, and how it

might apply to cyber-attack.

Thus, the law has for many centuries recognised a likely

relationship between deceit and some physical or kinetic

outcome. The following old statute,26 illustrated this rela-

tionship, as follows:

23 Ibid, 109. 24 Ibid, 110. 25 Ibid, 130. 26 13 Ric II Stat 1 c 11 at 2 Statutes of the Realm 1377e1504, 64.

… to the great deceit, loss, and damage of the people, in so much

that the merchants that buy the same cloths, and carry them out

of the realm to sell to strangers, be many times in danger to be

slain, and sometime imprisoned, and put to fine and ransom by

the same estrangers, and their said cloths burnt or forfeit,

because of the great deceit and falsehood that is found in the same

cloths when they be untacked and opened, to the great slander of

the cloths of the Realm of England.27

This statutory provision suggested that the legislators

knew that the deceiving of purchasers had precipitated the

strong possibility of killing, because of the secret defects and

later realisation of misrepresentation. Relating fraud to deceit,

in the 1903 case of In re London and Globe Finance Corpn,

Limited,28 Buckley Jdefined fraud and deceit as follows:

To deceive is, to induce a man to believe that a thing is true which

is false, and which the person practicing the deceit knows or

believes to be false. To defraud is to deprive by deceit; it is by

deceit to induce a man to act to his injury. More tersely it may be

put, that to deceive is by falsehood to induce a state of mind; to

defraud is by deceit to induce a course of action.29

Narayanan proposed that fraud could take various forms.30

He called them “badges” of common law fraud. He proposed

that badges of fraud were not species of fraud, but were indicia

of fraud, or put another way; they were indicative of fraud.31

These are how the recipient of the cyber-attack might sense

the attack.

The 1601 Twyne's Case32 dealt with badges of fraud. Smith recorded that the circumstances in the Star Chamber hearing

of Twyne's Case33 were as follows.34 There was a Bill of Infor- mation filed in the Star Chamber by the Queen's Attorney- General Coke against Twyne of Hampshire for the making

and publishing of a fraudulent gift of goods. Pierce was

indebted to Twyne in the amount of £400 and was also

indebted to C in the amount of £200. C brought an action in

debt against Pierce who, being in possession of the goods to

the value of £300, executed a secret deed of gift of all of his

goods and chattels real and personal to Twyne, pending the

resolution of the writ. This deed was to be in satisfaction of his

debt, even though he remained in possession of the trans-

ferred goods. Sir Thomas Egerton, Lord Keeper of the Great

Seal, Chief Justice Popham, Anderson J and the whole Court of

Star Chamber resolved that this gift was fraudulent.35

The Court stated the following six points.36 The first was

that the gift had the signs and marks of fraud because the gift

32 (1601) 3 Co Rep 80b; 76 ER 809. 33 Ibid. 34 Digested in John William Smith A Selection of Leading Cases

on Various Branches of the Law with Notes, Vol I (A. Maxwell, 2nd ed, 1841), 1e14. 35 3 Co Rep 80a, 80b, 81a. 36 3 Co Rep 80a, 81a.

c o m p u t e r l a w & s e c u r i t y r e v i e w 3 1 ( 2 0 1 5 ) 3 9 0 e4 0 0394

was general and did not exclude his clothes or anything else of

personal necessity. It was said commonly that quod dolosus

versatur in genrealibus.37 The second was the donor continued

in possession, used them as his own property, traded them,

and therefore defrauded and deceived those with whom he

traded. The third was the gift was made in secret, and et dona

clandestine sunt semper suspiciosa.38 The fourth was that it was

made pending the writ. The fifth was there was a trust be-

tween the parties because the donor possessed all the prop-

erty, and fraud is always clad in trust and trust is a cover for

fraud. The sixth was there was a clause in the deed that the

gift was made honestly, truly and bona fide.39

Along with the maneuvers of any submarines, special op-

erations or assassins, arguably comes the deceptive art of

generalities, secrecy and false trust. Each of these may be

present in a cyber-attack. These arts may induce a state of

mind, followed in the enemy recipient by an ill-advised course

of action or omission. Such action or omission could precipitate

kinetic outcomes. It remains to consider the causal relationship

between the actions or omission and the kinetic outcomes, first

by looking at the practicalities of maneuver warfare.

3. Maneuver warfare

Maneuver warfare aims at defeating the enemy by disrupting

its ability to react. This proposition could include disrupting

its ability to decide how to act, or decide whether or not to act.

Thus, in the maneuver warfare paradigm, conflict can be

seen as timeecompetitive cycles of observation–orientation–

decision–action.40 Each party to a conflict begins by observing.

He observes himself, his physical surroundings and his

enemy. On the basis of his observation, he makes mental

images of his situation. On the basis of this orientation, he

makes a decision. He puts the decision into effect, in the form

of action. Then, because he assumes his action has changed

the situation, he observes again and starts the process anew.

His actions follow this cycle, sometimes called the “Boyd

Cycle” or OODA Loop”.41

This Boyd Cycle suggests Aristotle's deliberation and ac- tion, as necessary components of the ethical deliberative

process. Aristotle stated that the genus of choice belonged to

that of voluntary action,42 by conscious separation of virtues

from vices. The field of deliberation was to discern actions

that were within one's power to perform, in respect of means

37 3 Co Rep 80a. dolosus versatur generalibus. A deceiver deals in generalities. James Morwood (ed), The Oxford Latin Mini Dictionary (Oxford University Press, 1995). 38 3 Co Rep 80a. Clandestine gifts are always to be regarded with

suspicion. 39 Digested in John William Smith A Selection of Leading Cases on

Various Branches of the Law with Notes, Vol I (A. Maxwell, 2nd ed, 1841), 2. 40 On this description, the process looks similar in structure to

the Action Research cycle developed by Kurt Lewin. See Kurt Lewin, ‘The Research Center for Group Dynamics at Massachu- setts Institute of Technology’, 8(2) Sociometry (1945), pp. 126e136. 41 W. S. Lind, Maneuver Warfare Handbook Westview, Boulder,

1985, p. 5. 42 Aristotle, The Nichomachean Ethics (H. Rackham trans.) Harvard

University Press, Cambridge, 1999, p. 133.

rather than of ends. Thus, the object of choice and delibera-

tion were the same, only such that the object of choice was a

thing within our power which after due deliberation we

desire. This object must be distinguished from wishes, which

are only for ends.43 Finally, Aristotle described this delibera-

tive principle as manifesting itself, as a necessary conse-

quence, in any one or more of the actions of admonishment,

rebuke and exhortation.44 On the Nichomachean Ethics

model, all maneuver decisions are ethical actions as neces-

sary outcomes of separating virtues from vices, within the

process of deliberation.

According to Lind, if one side in a conflict can consistently

go through the Boyd Cycle faster than the other, it gains a

substantial advantage. By the time the slower side acts, the

faster side is doing something different from what he

observed, and his action becomes inappropriate in the new

context. With each cycle, the slower party's action is inap- propriate by a larger time margin. Even though he desperately

strives to do something that will work, each action is less

useful than its predecessor; he falls further behind. Ulti-

mately, he ceases to be effective.45

Maneuver warfare requires commanders who can sense

more than they can see, who understand both the opponent's and their own strengths and weaknesses. It requires those

who can find the enemy's critical weaknesses in a specific situation. They must be able to create multiple threats and

keep the enemy uncertain as to which threat is real, arguably

the technique explained in the assassin's treachery. They must be able to visualise their options in the situation,

constantly generate new options, and shift rapidly among

those options as the situation develops.46

Maneuver warfare tactics combine two basic elements:

techniques and education. Techniques may be by formula.

They include how to aim a rifle, set up a machine gun, give an

order, establish communications, call in fire support, gun

crew drills, unit battle drills and so on.47

Mission-type orders are key to the decentralization of

command necessary for a rapid Boyd Cycle. A mission-type

order tells the subordinate commander what his superior

wants to have accomplished. That is the mission. It leaves the

methodology for accomplishing it largely up to a subordinate.

This subordinate needs to understand the commander's intent two levels up. Commander's intent is a superset of the mission. A maneuver warfare military believes that it is better to have

high levels of initiative among subordinate officers, generating

a resultant rapid Boyd Cycle, even if the price is occasional

mistakes. Indeed, control is replaced with guidance.48

A very important tool in maneuver warfare is the counter-

attack. A counter-attack is an attack on the enemy's attack. Also, it is an action taken after the enemy has committed itself

irrevocably. In the defence, as in the offence, the practitioner

wants to shatter the cohesion of the enemy's units, not just

43 Ibid, p. 141. 44 Ibid, p. 67. 45 W. S. Lind, Maneuver Warfare Handbook Westview, Boulder,

1985, p. 6. 46 Ibid, p. 7. 47 Ibid, p. 12. 48 Ibid, pp. 13, 14.

c o m p u t e r l a w & s e c u r i t y r e v i e w 3 1 ( 2 0 1 5 ) 3 9 0 e4 0 0 395

kill his troops and destroy his equipment. A common tool for

achieving this is the counter-attack. In general, the counter-

attack must have three characteristics to be successful. First,

it must be strong. Second, the counterattack must achieve

surprise by striking the advancing enemy at a weak point

created by his own forward momentum. Most critical, the

success of a counterattack depends upon timing. The com-

mander must be able to sense that point in time when the

enemy, exposed and tiring, is incapable of rapid response to

an unexpected threat.49 This description is not inconsistent

with a cyber-attack.

Lind advised that attack by infiltration was often used in

maneuver warfare. The most common assault technique uses

a three-element force: (a) a large suppression element; (b) a

small penetrating element; and, (c) a large exploitation

element. The suppression element makes the enemy keep his

head down at the point of the assault. The penetrating

element makes a small breach in the enemy's position. The exploitation element goes through the breach, fans out the

enemy's rear, and collapses his position from the rear. Some of the exploitation element immediately drives deeper into the

enemy's rear, looking for surfaces and gaps, so the assault can immediately turn into an advance.50 This description also is

not inconsistent with a cyber-attack.

Gaps are found by delegating authority down to the lowest

level so that small unit commanders can find gaps and

immediately start exploiting them. The term flank itself needs

some elaboration. John Boyd defined a flank as “that aspect

towards which a force is not devoting its primary attention.”51

On this basis, maneuver warfare might be described as the

fast manufacture and infiltration of new enemy flanks. Cyber-

attack may arguably be written expressly for this dual pur-

pose, and when added to deceit and fraud theory might pro-

duce a necessary kinetic result.

53 U.S. Department of Defense, Dictionary of Military and Associated Terms, Joint Publication 1e02, Nov. 8, 2010, as amended through Feb. 15, 2012, available at http://www.dtic.mil/ doctrine/dod_dictionary/. 54 Michael N. Schmitt, ‘“Attack” as a Term of Art in International

Law: The Cyber Operations Context’, 2012 4th International Conference on Cyber Conflict, pp. 283e293, at p. 291. 55 G Tunkin, Law and Force in the International System (Progress

Publishers, 1985).

4. International law

Discussion has now set out parallels between, on the one

hand, submarine war, special operations, and assassinations,

and having examined how an information operation, in the

nature of maneuver warfare affecting the mind, might have a

kinetic outcome. This section will try to contextualise a breach

of Article 2(4) of the UN Charter within three well-known

cyber-attacks: the Iran centrifuge attack; the 2007 Estonian

attacks; and, the U2 shooting down over the former Union of

Soviet Socialist Republics.

Hathaway et al. adopted a wide definition of cyber-attack.

They said it was “any action taken to undermine the func-

tions of a computer network for a political or national security

purpose”.52 Leaving aside for now the “political or national

security purpose” facet of their definition, they appeared to

agree that a cyber-attack was similar in process to a maneuver

warfare attack.

49 Ibid, pp. 22, 22. 50 Ibid, p. 45. 51 Ibid, p. 76. 52 Oona A. Hathaway, Rebecca Crootof, Philip Levitz, ‘The Law of

Cyber-Attack’, 100(4) California Law Review (2012), pp. 817e885, at p. 826.

The U.S. Department of Defense's Dictionary of Military Terms defined “computer network attack” (CNA) as “[a]ctions

taken through the use of computer networks to disrupt, deny,

degrade, or destroy information resident in computers and

computer networks, or the computers and networks them-

selves.”53 From this description, there is less doubt that ma-

neuver warfare and cyber warfare have much in common.

Schmitt derived a general principle for the legal precept of

attack, relevant to the cyber context. He stated that attacks

could be redefined as operations resulting in, or if unsuc-

cessful were originally projected to result in, death or injury of

individual people, or destruction to, or damage of objects.54 In

essence, and considering the entropic effects of the Boyd cy-

cles in maneuver warfare, a cyber-attack might well be con-

structed to be within the parameters of maneuver warfare.

Buchan noted that, since early in the life of Article 2(4) of

the UN Charter, scholars55 had wondered whether this article

covered only armed force or whether it covered the use of

more general political and economic coercion.56

The rules for treaty interpretation are in the Vienna

Convention on the Law of Treaties 1969 (VCLT), which pro-

vides that Article 2(4) must be interpreted using these rules.

Article 31 of the VCLT provides that treaty terms must be their

ordinary meaning, in the context of the treaty's purpose and objects. Buchan noted that this article reflected customary

international law.57 Giving the word ‘force’ its ordinary

meaning suggests Article 2(4) covers all uses of force. Signifi-

cantly, other loci in the UN Charter use the term ‘armed force’.

Thus also, the UN Charter preamble explains that armed force

must not be used, unless it is used in the common interest.

Also, Articles 41e46 allow the Security Council to use mea-

sures without armed force, or, if inadequate, armed force may

be used. The use of the term ‘force’ without being noted as

armed, in Article 2(4), infers that it is more general than armed

force. This interpretation arguably could include both eco-

nomic force and political force. However, this proposed

meaning has to be verified against the text of the treaty.

This outcome, vis-a-vis the meaning of the term ‘force’ is

arguably an opening of the door for a non-kinetic kind of force,

although not yet litigated. Arguably, when looking at the

deceived cloth buyer's analogy, discussed above, their moving to slay the deceiving cloth seller suggested some force moving

their actions. Thus, there is a suggestion that some inchoate

force might operate, a priori to a kinetic style of force.

56 Russell Buchan, ‘Cyber Attacks: Unlawful Uses of Force or Prohibited Interventions?’ (2012) 17(2) Journal of Conflict and Security Law, 212, 215. 57 Arbitral Award of 31 July 1989 [‘ … [a]rticles 31 and 32 of the

Vienna Convention on the Law of Treaties… may in many re- spects be considered as a codification of existing customary in- ternational law… ’ [1991] ICJ Rep 69 70, para 48.

c o m p u t e r l a w & s e c u r i t y r e v i e w 3 1 ( 2 0 1 5 ) 3 9 0 e4 0 0396

Aust stated that a treaty term could not have its ordinary

meaning if it defeated the Treaty's stated purposes and ob- jectives.58 Buchan interpreted the UN Charter as stating that

the over-arching purpose of the UN was to preserve interna-

tional peace and security, by preventing armed force by

member states, and removing it to a collective military sys-

tem.59 However, the meaning of the term “armed force” must

be examined. First, the term “armed”inferred the subsistence

of a weapon. Black's Law Dictionary describes “armed” as equipped with a weapon, or involving the use of a weapon,60

without providing enough to explain how this weapon could

violate Article 2(4).61 Further, the question arises as to the

character of a weapon, and why a weapon should not be either

tangible or inchoate. For example, a weapon could be a gun. Or

in the alternative, a weapon could be a deceptive or inflam-

matory statement so extreme as to move someone to kinetic

action. In this event, it could be argued that the kinetic actor

was under the attacker's control, and, therefore, acting as the attacker's agent. With this view, I argue that information op- erations provoking a physical attack by way of response could

be considered either kinetic, per se, or a necessary precondi-

tion to the kinetic response.

Bond argued that armed force implied a weapon producing

moving, or kinetic, force. This term was a generalisation

applied to weapons with an explosive effect, accompanied by

shockwaves and increased heat.62 Brownlie criticized this

view, because it would exclude chemical, nuclear and bio-

logical weapons.63 On Brownlie's critique, a biological weapon affecting an enemy's decision-making or psychological abili- ties would be indistinguishable in character from a cyber-

attack producing the same physical consequence.

Brownlie argued that a better test for whether an unlawful

use of force took place was whether the weapon destroyed life

and property.64 Arguably, Brownlie did not follow through to

the natural ends of his argument. However, Buchan called this

approach an effects-based approach, and regarded it as more

workable in the context of cyber war. Thus, the National

Research Council described death or personal injury, and

destruction of tangible property, as elements for defining the

use of force, without suggesting this was an exhaustive list of

elements.65 The reader might reflect that if tangible property

were not exhaustive of property, then property might include

58 A. Aust, Modern Treaty Law and Practice (CUP, 2007), 235. 59 Russell Buchan, ‘Cyber Attacks: Unlawful Uses of Force or

Prohibited Interventions?’ (2012) 17(2) Journal of Conflict and Security Law 212, 215. 60 B. Garner (ed), Black's Law Dictionary (West, 2009), 123. 61 Russell Buchan, ‘Cyber Attacks: Unlawful Uses of Force or

Prohibited Interventions?’ (2012) 17(2) Journal of Conflict and Security Law 212, 216. 62 J. Bond, ‘Peacetime Foreign Data Manipulation as One Aspect

of Offensive Information Warfare: Questions of Legality under the United Nations Charter Article’ 2(4) (1996) US Dept of Commerce, National Technical Information Service, 78. 63 I. Brownlie, International Law and the Use of Force by States

(Clarendon, 1963), 362. 64 Ibid. 65 ‘Committee on Offensive Information Warfare and others,

Technology, Policy Law and Ethics Regarding US Acquisition and Use of Cyberattack Capabilities Report’ (2009) National Research Council, 253.

intangible property as well. Also, Dinstein expanded on the

debate by claiming that cyber-attacks should cause physical

damage, to be unlawful use of force.66 However, Sharp argued

that any cyber-attack by a state, intentionally causing

destruction inside another state, would be an unlawful

deployment of force.67 There is no indication of what Sharp

meant by destruction, but arguably, destruction of informa-

tion or intelligence were also destruction.

I will now contextualise this discussion with the Iran

cyber-attacks of 2010. Buchen suggested these principles were

sufficient to assess the 2010 Iran cyber-attacks, to examine

further those kinds of cyber-attack breaching Article 2(4).68 He

observed that in July 2010, the Iranian government found a

computer virus installed in its computers, now known as

Stuxnet. The apparent target was at Iran's Natanz nuclear facility, a uranium enrichment factory. The methodology for

uranium enrichment was by putting it in many centrifuges,

spun at a designated speed, with controlled pressure and

temperature. Stuxnet was designed to change the centrifuges' rotor speed covertly, greatly increasing and then rapidly

decreasing the speed.69

The Institute for Science and International Security had

explained that by increasing and decreasing the speed of

rotation in this way, the effect of the Stuxnet virus was to

induce excessive vibrations in the centrifuges, enough to

destroy the centrifuges.70 Mechanical engineers would un-

doubtedly view this as a natural consequence of the effects of

the software, and therefore regard the attacking software as

directly causative of physical damage. Buchan reported evi-

dence implying that Iran replaced about 1000 centrifuges at

Natanz, and that Stuxnet was a reasonable cause. However,

the exact causal chain from the Stuxnet virus cannot be

ascertained. If the Stuxnet virus did destroy centrifuges at

Natanz, this would be arguably sufficient physical damage to

establish a breach of Article 2(4).71

To the contrary, and by way of further contextualisation,

were the 2007 cyber-attacks against Estonia. In 2007, the

Government of Estonia announced it would move its statue of

the Bronze Russian Solider to the outer parts of Tallinn.

Buchan observed that this triggered violent rioting and looting

in Estonia's capital city, Tallinn, apparently by ethnic Russian residents of Tallinn. These demonstrations coincided with

cyber-attacks against Estonian businesses. Some large busi-

nesses, such as banks, were attacked. As well, the attacks

were targeted against Estonian government instrumentalities.

They were, in the main, distributed denial of service attacks.

66 Y. Dinstein, War, Aggression and Self-Defence (CUP, 2010), 88. 67 W. G. Sharp Sr., CyberSpace and the Use of Force (Ageis

Research Corp, 1999), 133. 68 Russell Buchan, ‘Cyber Attacks: Unlawful Uses of Force or

Prohibited Interventions?’ (2012) 17(2) Journal of Conflict and Security Law, 212, 217. 69 Ibid, 219. 70 D. Albright, P Brannan and C Walrond, ‘Did Stuxnet Take Out

1000 Centrifuges at the Natanz Enrichment Plant? Institute for Science and International Security’ (2010) Institute for Science and International Security. 71 Russell Buchan, ‘Cyber Attacks: Unlawful Uses of Force or

Prohibited Interventions?’ (2012) 17(2) Journal of Conflict and Security Law 212, 221.

c o m p u t e r l a w & s e c u r i t y r e v i e w 3 1 ( 2 0 1 5 ) 3 9 0 e4 0 0 397

Later in the attacks, the denial of service process used large

networks of compromised computers, to be used without the

owners' knowledge. There were about 85,000 highjacked computers bombarding Estonian web sites with information

requests. These cyber-attacks went on for about three weeks

and brought down many internet-based systems. The Russian

government denied they were responsible in any way for

these cyber-attacks. Their involvement has never been

proven. However, despite this, Estonia argued that Russia was

the entity responsible for the cyber-attacks.72

Buchan observed that, unlike what might have taken place

in a nuclear attack, the Estonian cyber-attacks apparently did

not cause any physical damage.73 Although, arguably, no

investigation could have been completed that might reason-

ably have followed all causal chains to their logical ends. Were

this type of exhaustive investigation to have taken place, it

could be argued that at least some consequent physical

damage could have been identified.

A breach of Article 2(4) would take place only where a

weapon was used, producing physical damage. Buchan

concluded that since there was no physical damage, the

Estonian cyber-attacks could not be characterised as any un-

lawful use of force, per Article 2(4).74 Hinkle adjudged the

situation similarly. He reasoned that since no human lives

had been lost, no military were deployed across any interna-

tional borders, and neither was there any explosive weapons

used, the Estonian Cyber-attack did not cause any physical

damage.75 However, both Buchan and Hinkle appeared to

have ignored the fact that the Estonian moving of the statue of

the Bronzed Russian Soldier could be seen as interference to

perceived sovereignty. Naturally, it would precipitate some

kind of violence. Also, arguably, neither Buchan nor Hinkle

took UN top-level objectives into account.

Schaap argued that international peace was the main

rationale for the United Nations. He stated that the UN

Charter, as well as the general international law, prohibited-

states using force, unless for legitimate self-defense, per

Article 51 of the UN Charter. Article 2(3) of the UN Charter

states that all member states should settle international dis-

putes peacefully, so as not to endanger international peace

and security. Article 2(4) of the UN Charter states that all

memberstatesshouldforebear, in international relationships,

from threatening or using force against the territory or inde-

pendence of another state. The key term in this wordage, for

the purposes of this paper's argument, is the use of the word “threatening”. After all, might not a cyber-attack be regarded

as a threat of force? Article 51 of the UN Charter, which is the

only exception to individual members using force without

Security Council approval, states that nothing in the UN

Charter should prejudice the innate right of self-defence in

the event of an armed attack against a member of the United

Nations. This article appears to be limited by the Security

72 Ibid, 218. 73 Ibid. 74 Ibid, 219. 75 K. Hinkle, ‘Countermeasures in the Cyber Context: One More

Thing to Worry About’ (2011) 37 Yale Journal of International Law Online 11, at pp. 13e14.

Council taking necessary measures for international security

and peace, but supports the agency theory, argued above.

In Nicaragua v United States,76discussed further below, the

International Court of Justice stated that thisUN Charter pro-

hibition on using force was merely restating a principle of the

customary international law. However, the UN Charter

defined neither the use of force nor the meaning of an armed

attack. Later, the paper will examine why characterisation as

customary international law is so important to a view that

information operations are essentially a priorito a kinetic

consequence.

Schaap suggested that the General Assembly's resolution defining aggression77 would be a good starting point for

examining the problem at hand.78 Article 1 of the stated Res-

olution appears similar to Article 2(4) of the UN Charter. The

resolution states that aggression is constituted by the state's use of armed force against the sovereignty, territory or inde-

pendence of a second state. Article 3 of the resolution lists

seven kinds of aggressive acts, and Article 4 adds that this list

is not exhaustive.

According to Island of Palmas (The Netherlands v United

States),79 the court held that sovereignty was an attribute of

statehood, implying freedom from any external interference

to the conduct of the state's affairs. Interestingly, the Resolu- tion allows for a state use of force against sovereignty, one

element of which must be a state's capability for conducting international relations. Thus, were the reader to imagine the

deployment of deception against a state's interlocutors, where this deception was a priori due to a kinetic consequence, such

as destruction of files, failure to attend meetings, changes of

policy as to airline corridors, or more, then Schaap's view might suggest cyber-attacks were substantive kinetic attacks.

This deception would be despite the apparent direction at the

middle phases in Schaap's stated chain of argument. Cyber warfare operations' violation of the territorial

integrity of another state may be studied in the 1960 U2

aircraft incident. This incident involved the shooting down of

a US reconnaissance aircraft by a missile inside the former

Soviet Union. The former Soviet Union claimed that U2 flights

over their territory were aggressive acts. This claim of

aggression was despite the fact the plane was unarmed. No

doubt, Soviet military experts reacted intelligently to what

they perceived could be the possibilities. The situation was,

arguably, similar to an information operation. The UN Secu-

rity Council concluded that the U2 violated the Soviet Union's airspace, without constituting an unlawful application of

force, in respect of Article 2(4) of the UN Charter. However, this

was a Security Council conclusion, which might have been

quite political, and ought to be interpreted as quite different

from a likely International Court of Justice determination.

Finally, late in his chain of argument, Schaap wondered

about interfering with supervisory control and data acquisi-

tion systems, which control the power grid, air traffic control,

76 1986 ICJ 14, T 188. 77 Definition of Aggression, G.A. Res. 3314 (XXIX), art. 1, U.N.

Doc. A/3314, (Dec. 14, 1974). 78 Arie J. Schaap, ‘Cyber Warfare Operations: Development And

Use Under International Law’, (2009) 64 AFL Rev 121, 142. 79 (1928) II RIAA 829.

c o m p u t e r l a w & s e c u r i t y r e v i e w 3 1 ( 2 0 1 5 ) 3 9 0 e4 0 0398

and nuclear plant systems.80 He opined correctly that super-

visory control and data acquisition systems attacks could also

cause death by shutting down a hospital or Air Traffic

Control.81

Thus, while there was nothing confirming a cyber-attack as

equal to unlawful use of force under international law, a

cyber-attack that might cause, or did cause, physical harm

would be an unlawful use of force, or an armed attack.

Arguably, this standard would prohibit cyber warfare opera-

tions against supervisory control and data acquisition

systems.82

Having made a strong case that a cyber-attack might be

either directly or indirectly kinetic, or necessarily and causally a

priori to a kinetic outcome, it remains to discuss the import of

Article 2(4) in the context of customary international law. This

additional examination is made necessary by the inherent

tendency in breaches of customary law to more quickly resort

to violence, on the basis that people expect their customs to be

respected, as they are based on relationships of kinship.

Further, Pulling had stated that, despite his views being pub-

lished before the time of the United Nations Charter, customary

laws were not subject to desuetude. Thus, when the king's force to the contrary was removed, the ancient prescriptions auto-

matically returned to operation.83 This aspect of customary law

would be strongly relevant because custom inferred ancient

and therefore strictly prescriptive usage.

In this respect, Pollock had stated that strict liability

appeared ancient and was, therefore, prescriptive. His

reasoning ran as follows. The policy was reflected in the

convenient form of a maxim as maxims facilitated long-term

transmission of a rule. The Romans put it in the form of the

maxim imperitia culpae adnumeratur, or, ‘the situation is

governed by its own class’. This policy was expressed in the

following hypothetical narrative, which illustrated the

inevitable effect on a community of the commission of a civil

wrong: ‘He went about to do harm, and having begun an act

of wrongful mischief, he cannot stop the risk at his pleasure,

nor confine it to the precise objects he laid out, but must

abide it fully and to the end.’ The principle inhering within

this narrative was illustrated within the following maxim: “a

man is presumed to intend the natural consequences of his

acts”, combined with the observation that the law naturally

inferred intention and mostly the inference was correct.84

This strict liability would suggest a greater closeness of

violence of the response, and arguably, so would a breach of

custom.

This suggests strongly that when one went about to do

harm, he could be taken to have intended any natural con-

sequences of his actions, meaning the final outcomes were

necessary outcomes. Suggesting that cyber-attack had no ki-

netic outcome might be a failure to look at the entire chain of

80 Arie J. Schaap, ‘Cyber Warfare Operations: Development And Use Under International Law’, (2009) 64 AFL Rev 121, 146. 81 Ibid, 147. 82 Ibid, 148. 83 Alexander Pulling, The Laws, Customs, Usages and Regulations of

the City and Port of London (William Henry Bond and Wildy and Sons, 2nd ed, 1854), at p. 13. 84 F Pollock, The Law of Torts (Banks and Brothers, 1895), at p. 23.

causation. The facet of necessity in final outcomes can be

inferred from the case law as follows.

5. Necessity in the case law

Having discussed breach of customary international law, we

now discuss the seminal case examples. In Nicaragua v

United States,85 the Court found that both the United States

and Nicaraguaagreed that the United Nations Charter's principles governing the use of force essentially corre-

sponded to those subsisting in customary international law.

The consequence of this finding was that the parties both

accepted an obligation based in treaty law to forebear from

threatening or using force in any way inconsistent with the

Charter of the United Nations, Article 2(4).86 The question

arises as to what treaty law might have been breached when

in 1970 the Estonian Government moved the statue of the

Bronzed Russian Soldier out of sight, precipitating violence.

Would this have been a mere information operation, yet

precipitating physical consequences? Arguably, it was the

operation of necessity.

In the Lotus Case (France v Turkey),87 and in the North Sea

Continental Shelf Cases (Federal Republic of Germany v Denmark;

Federal Republic of Germany v The Netherlands),88 an opinio juris

sive necessitatis, also known simply as an opinio juris, was held

to be an opinion deriving from either law, or from necessity.

Arguably, necessity can be seen as operating similarly to the

force of custom. Thus, it was the state's firm conviction that a specific conduct was required in international law. Therefore,

the state's customary law practice should be understood as mandatory conduct, and not merely conduct of convenience

or habit.

Thus, the Court satisfied itself that there was an opinio juris in

customary law setting up the binding character of this finding.

The court's view was that this opinio juris could be deduced from the parties' attitudestoresolution 2625 (XXV) of the General As- sembly, called “Declaration on Principles of International Law

concerning Friendly Relations and Co-operation among States

in Accordance with the Charter of the United Nations”.89 The

Court held that consent to General Assembly resolutions was a

legitimate form of expressing an opinio juris in respect of the

precept against using force. Since Article 2, paragraph 4 of the

Charter of the United Nations subsisted in customary interna-

tional law, regardless of the UN Charter provisions, the strict

treaty-based law applied to the parties.90

The court held the principle of non-intervention as being

the right of a sovereign State to carry on its affairs without

interference from outside. It held that states'opinio jurison this principle were numerous.91 Thus, a breach of the Char-

ter of the United Nations, Article 2(4) was essentially the

same as a breach of customary international law. As

85 1986 ICJ 14, T 188. 86 Ibid, paras 187 to 201. 87 1927 PCIJ ser A No 10. 88 1969 ICJ 3. 89 Resolution 2625 (XXV) of the General Assembly. 90 1986 ICJ 14, T 188, paras 187e201. 91 Ibid, paras 202e209.

c o m p u t e r l a w & s e c u r i t y r e v i e w 3 1 ( 2 0 1 5 ) 3 9 0 e4 0 0 399

discussed above, this suggested a very high likelihood of ki-

netic outcome, regardless of whether the a priori impulse for

action was the non-kinetic information operations.

6. Conclusion

Submarine war and special operations, as well as the oper-

ational profile of the treacherous assassin, have been found

to be essentially the same as cyber warfare. However, the

scholarship suggested that cyber-warfare was more in the

nature of information operations. However, this could be

construed as indistinguishable from the ancient mechanism

of fraud and deception. Argument suggested that it was

likely that, if an information operation might provoke an

armed defence, a kinetic outcome would be the end link in a

chain of causation. The argument suggested that, per the

Estonian cyber-attacks case, investigations were unlikely to

follow the chains of causation all the way down to their final

levels, at which consequential physical damage might be

found.

On Brownlie's critique, a biological weapon affecting an enemy's decision-making or psychological abilities would be indistinguishable in character from a cyber-attack producing

the same physical consequence. Buchen deduced that if the

Stuxnet virus did destroy centrifuges at Natanz, this would be

sufficient physical damage to establish a breach of Article 2(4).

Strict liability within customary international law would

suggest a greater likelihood of violence of response, and

arguably, so would a direct breach of custom, such as inter-

fering with sovereignty. Interfering with sovereignty could be

seen to produce spontaneous violent acts, such as for

example, in the Estonian removal of the statue of the Bronzed

Russian Soldier.

In the light of the presented evidence, the suggestion

arises that information operations inherent in cyber-attacks,

just as in maneuver warfare, are essentially and necessarily a

priori to a kinetic consequence. This suggestion would mean

that there would be a preponderance of circumstances in

which a cyber-attack by one state against another would be a

breach of Article 2(4) of the UN Charter. Also, even when a

cyber-attack did not breach Article 2(4) of the UN Charter,

application to the United Nations Security Council for

remedial action might produce action as if the cyber-attack

were indeed a breach. The information operations inherent

in cyber-attacks are essentially and necessarily a priori to a

kinetic consequence.

Gary Lilienthal, LL.B. (Sydney University, Australia) M. Psych.

(Deakin University, Australia) Ph.D. (Curtin University,

Australia) is Senior Lecturer, School of Law, UUM COLGIS,

Universiti Utara, Malaysia. Email address: [email protected]

Nehaluddin Ahmad, MA, LL.B., LL.M. (Lucknow University,

India) LL.M. (Strathclyde University, UK), LL.D. (Meerut Univ.,

India) is Professor Dr at Sultan Sharif Ali Islamic University

(UNISSA), Gadong, Brunei, Darussalam. Email address:

[email protected], [email protected]

r e f e r e n c e s

c a s e s

Arbitral Award of 31 July 1989 [1991] ICJ Rep 69. Island of Palmas (The Netherlands v United States) (1928) II RIAA 829. Lotus Case (France v Turkey) 1927 PCIJ ser A No 10. Nicaragua v United States 1986 ICJ 14, T 188. North Sea Continental Shelf Cases (Federal Republic of Germany v

Denmark; Federal Republic of Germany v The Netherlands) 1969 ICJ 3.

s t a t u t e s a n d i n t e r n a t i o n a l i n s t r u m e n t s

The Charter of the United Nations Charter, 1945. 13 Ric II Stat 1 c 11 at 2 Statutes of the Realm 1377e1504, 64. Vienna Convention on the Law of Treaties 1969.

s e c o n d a r y s o u r c e s

Committee on Offensive Information Warfare and others. Technology, policy law and ethics regarding US acquisition and use of cyberattack capabilities report. National Research Council; 2009.

Albright D, Brannan P, Walrond C. Did stuxnet take out 1,000 centrifuges at the Natanz enrichment plant? Institute for Science and International Security. Institute for Science and International Security; 2010.

Aristotle, The Nichomachean ethics (H. Rackham trans.) Harvard University Press, Cambridge, 1999.

Aust, A. Modern Treaty Law and Practice (CUP, 2007). Barnett F, Tovar B, Shultz R, editors. Special operations in US

strategy. New York: National Defence University Press; 1988. Bond J. Peacetime foreign data manipulation as one aspect of

offensive information warfare: questions of legality under the United Nations Charter Article 2(4). US Dept of Commerce, National Technical Information Service; 1996.

Brownlie, I. International Law and the Use of Force by States (Clarendon, 1963).

Buchan Russell. Cyber attacks: unlawful uses of force or prohibited interventions? J Confl Secur Law 2012;17(2):212.

Dinstein, Y. War, Aggression and Self-Defence (CUP, 2010). Garner, B., (ed), Black's law dictionary (West, 2009). Gervais Michael. Cyber attacks and the laws of war. Berkeley J Int

Law 2012;30(2):525e79. Hathaway Oona A, Crootof Rebecca, Levitz Philip. The law of

cyber-attack. Calif Law Rev 2012;100(4):817e85. Hinkle K. Countermeasures in the cyber context: one more thing

to worry about. Yale J Int Law Online 2011;37:11. Isenberg David. Special forces: shock troops for the new order.

177 Middle East Rep. 1992. p. 24e7. Lewin Kurt. The research Center for group dynamics at

Massachusetts Institute of technology. Sociometry 1945;8(2):126e36.

Lind WS. Maneuver warfare handbook. Boulder: Westview; 1985. Parks Raymond C, Duggan David P. 'Principles of Cyber-warfare'.

In: Proceedings of the 2001 IEEE Workshop on Information Assurance and Security, United States Military Academy, West Point 122; 2001.

Pollock, F. The Law of Torts (Banks & Brothers, 1895). Pulling Alexander. The laws, customs, usages and regulations of

the city and port of London. 2nd ed. William Henry Bond and Wildy and Sons; 1854.

Report of the Group of Governmental Experts on Developments in the Field of Information & Telecommunications in the Context

c o m p u t e r l a w & s e c u r i t y r e v i e w 3 1 ( 2 0 1 5 ) 3 9 0 e4 0 0400

of International Security, 65th Session, ¶1, UN Doc A/65/201, July 30, 2010.

Roscini Marco. World wide warfare - jus ad bellum and the use of cyber force. In: von Bogdandy A, Wolfrum R, editors. Max Planck Yearbook of United Nations Lawvol. 14; 2010. p. 85.

Schaap Arie J. Cyber warfare operations: development and use under International Law. AFL Rev 2009;64:121.

Schmitt Michael N. “Attack” as a term of art in International Law: the cyber operations context. In: 4th International Conference on Cyber Conflict; 2012. p. 283e93.

Schmitt Michael N. Essays on Law and War at the Fault Lines. The Haugue: Asser Press; 2012.

Sharp, W. G. CyberSpace and the Use of Force (Ageis Research Corp, 1999).

Sun Tsu, The Art of War (Dover, 2002). The Lieber Code of 1863. War department. Washington: Adjutant

General’s Office; 1863. Tunkin G. Law and Force in the International System. Progress

Publishers; 1985. U.S. Department of Defense, Dictionary of Military and

Associated Terms, Joint Publication 1-02, Nov. 8, 2010, as amended through Feb. 15, 2012, available at http://www.dtic. mil/doctrine/dod_dictionary/.

United States, Department of the Army, Memorandum of Law on Assassination.

van der Vat Dan. The Atlantic campaign. Harper & Row; 1988.