NATO think tank looks to international law to define cyber war

An NATO cybersecurity think tank says in a study examining how international law applies to cyber conflict that cyber operations rising to the threshold of a "use of force" or undertaken in the context of an armed conflict should of course be governed by it.

The study, released Sept. 3, comes from the NATO Cooperative Cyber Defense Center of Excellence, located in Tallinn, Estonia and was written by a committee of mostly international legal experts headed by Michael Schmitt, chairman of the international law department at the Naval War College.

The mere fact that militaries utilize a computer rather than a more traditional weapon "has no bearing on whether that operation amounts to a 'use of force,'" the study says.

As for what constitutes use of force, the study says cyber operations with consequences involving physical harm to individuals or property "will in and of themselves qualify the act as a use of force."

At an opposite extreme, those operations that generate "mere inconvenience or irritation" never do so. Operations that fall in between those two poles should be judged to multiple other criteria including severity, ("self-evidently the most significant factor"), immediacy, directness and invasiveness, as well as military character and state involvement.

Neither is the study's answer to the question of what rises to a use of force a simple one. Report authors could agree that there must exist a nexus between cyber activity and armed conflict, but say they differed as to the nature of that nexus. One group held that any cyber activity conducted by a party against an opponent during an armed conflict should be governed by the law of armed conflict, while the other held that activity must directly contribute to military efforts in order to fall under international regulation.

Both sides, however, say that 2007 distributed denial of attacks against Estonian government and civilian websites did not rise to the level of a nexus with armed conflict, whereas operations against Georgia in 2008 did, since Russia and Georgia were at war at the time.

For more:
- go to an online copy of the study, "Tallinn Manual on the International Law Applicable to Cyber Warfare"
- go to a NATO Cooperative Cyber Defense Center of Excellence press release on the study

Related Articles:
Fears of cyberwar greatly exaggerated, says paper 
Air Force upping its cyber arsenal 
Congress authorizes offensive cyberspace military operations 
China and U.S. discuss cybersecurity via think tanks