Just & Unjust War, Uses of Force & Coercion: an Ethical Inquiry With

Just & Unjust War, Uses of Force & Coercion: An Ethical Inquiry with Cyber Illustrations

David P. Fidler Downloaded from http://direct.mit.edu/daed/article-pdf/145/4/37/1830784/daed_a_00410.pdf by guest on 29 September 2021

Abstract: The emergence of cyber means and methods of war, force, and coercion raises ethical questions under just war theory different from those historically generated by the development of ever more destructive instruments of war. Whether in armed conflict or contexts not considered war, cyber technologies create political and ethical incentives for their use. However, this attractiveness poses potential risks and dangers that, at present, are largely speculative but invite more ethical deliberation. Unfortunately, the con- vergence of political and ethical incentives on cyber in a context of increasing geopolitical competition and conflict make the prospects for ethical consensus on just and unjust cyber coercion, force, and war unlikely.

Among new technologies affecting ethical deliberations about war, none is as enigmatic as cyber. Within just war theory, cyber warfare exhibits attractive characteristics. Unlike the development of more violent weaponry, cyber does not endan- ger ethical objectives as directly in the just war tradition. Cyber weapons take a different trajectory within just war theory: away from extremes that threaten to obliterate ethics and toward scenarios DAVID P FIDLER . is the James Lou- in which the ethical compass functions but strug- is Calamaras Professor at the Indi- ana University Maurer School of gles to find true north. Law and an Adjunct Senior Fellow This trajectory also appears in how cyber technol- for Cybersecurity at the Council ogies highlight differences between war and force, on Foreign Relations. His publi- which recalls Michael Walzer’s argument for “a the- cations include The Snowden Reader ory of just and unjust uses of force.”1 Cyber creates (2015), India and Counterinsurgency: possibilities for force “short-of-war”2 and coercion Lessons Learned (2009), Responding short-of-force and thus raises questions about the re- to National Security Letters: A Practical Guide for Legal Counsel (2009), and lationship among force, coercion, and ethical objec- Biosecurity in the Global Age: Biolog- tives of the just war tradition, such as protecting ci- ical Weapons, Public Health, and the vilians. Cyber incidents often require analyzing con- Rule of Law (2008). cepts found in just war theory, such as reprisals and

37 Just & deterrence, in situations not amounting to Perhaps those against applying the law of Unjust War, war, creating complicated ethical contexts. armed conflict bear the burden of justifying Uses of Force & Coercion This essay, first, identifies how cyber this position. However, things get compli- technologies affect just war theory. Cyber cated when we consider other controver- warfare presents different challenges from sies. China and the United States also dis- those that have dominated just war think- agree about Internet governance. China fa- ing and invites ethical deliberations rather vors “Internet sovereignty,” in which states than marginalizing them.3 Cyber is not put- govern the Internet through international ting the Athenians before Melos. Second, law and organizations. The United States concerning uses of cyber technologies that supports “multistakeholder” governance

fall short of war and thus outside just war involving state and nonstate actors, an ap- Downloaded from http://direct.mit.edu/daed/article-pdf/145/4/37/1830784/daed_a_00410.pdf by guest on 29 September 2021 theory, the essay examines Walzer’s ideas proach associated with “Internet freedom.” on just uses of coercion and force and ap- Friction between these positions intensi- plies them to cyber. Thinking through the fied at the 2012 World Conference on Inter- ethics of coercion and force short-of-war national Telecommunications (wcit) or- proves disorienting because arguments go ganized by the International Telecommu- in various directions. But the disorientation nication Union (itu). The Chinese wanted is important because cyber is not rendering international law and institutions to con- ethics inert. trol Internet governance, as done with other communication technologies. The Ameri- After a decade of effort, the un Group cans advocated keeping international law of Governmental Experts on Develop- and the itu at arm’s length–a stance that ments in the Field of Information and the Internet is, and should be considered, Telecommunications in the Context of distinct. International Security (gge) reached a In the gge and wcit, we have claims consensus in 2013 that international law that cyberspace and the Internet are dif- applies to cyberspace, including the pro- ferent and these differences should affect hibition on the use of force.4 Prior gge how we think about them. But we do not failure to reach agreement on this issue have consistency about which states sup- reflected many factors, including whether port cyber exceptionalism or in what con- cyberspace is so different that it requires texts. Instead, these examples illustrate new rules. normative and political complexities lurk- gge delegations for and against applying in cyberspace. How these complex- ing international law made ethical argu- ities affect ethical considerations bears ments, at least rhetorically. China resisted watching in analyses of cyber activities –and continues to resist–including the and armed conflict. law of armed conflict in the consensus because applying this law legitimizes the In 2010, the Stuxnet worm was discov- “militarization” of cyberspace. Under this ered, and analysis revealed it was used to position, cyberspace is, and should be con- attack uranium-enrichment centrifuges in sidered, different. The United States em- Iran. The attack damaged hundreds of cen- braced the law of armed conflict because it trifuges. The worm was so sophisticated provides legal and ethical guidance in cy- that only a state or states could have de- berspace. These opposed positions force veloped it. Evidence suggests that Stux- us to consider whether cyberspace is, or net was a U.S.-Israeli effort, but neither should be considered, distinct from tradi- country has admitted involvement. Stux- tional realms of armed conflict. net is the first known use by a state of a pur-

38 Dædalus, the Journal of the American Academy of Arts & Sciences pose-built cyber weapon designed to dam- Both options take analysis away from jus David P. age property in another state. In jus ad bel- ad bellum. This trajectory resonates with Fidler lum terms, did the attack constitute an act debates about whether Stuxnet violated of war or a crime of aggression? the legal prohibition on the use of force. The incident reopened debates about Even if Stuxnet was an illegal use of force, what “force” and “armed attack” mean. it did not generate controversies typically Whether Stuxnet was an illegal use of force seen when states use force in violation of or armed attack produced disagreement international law. Given the ability to lim- about whether the damage constituted force it and tailor damage, can a cyber weapon or an armed attack in international law.5 provide ethical ways of violating the legal

State reactions to this episode were sub- prohibition on the use of force? Downloaded from http://direct.mit.edu/daed/article-pdf/145/4/37/1830784/daed_a_00410.pdf by guest on 29 September 2021 dued. Had conventional weaponry dam- This analysis assumed that a state was aged hundreds of centrifuges, internation- responsible for Stuxnet. However, Stuxnet al lawyers would not have considered the touches another aspect of cyber technolo- use-of-force and armed-attack questions gies that affects ethical deliberations: the difficult. Diplomats would have been more attribution problem. When a cyber inci- vocal. Did use of a cyber weapon affect per- dent happens, we want to know who did it. spectives on this seminal incident? Cyber technologies provide opportunities This question implies that cyber cre- for instigators to make attribution diffi- ates the potential for a type of aggression cult. In law, attribution is critical because it we might not consider criminal. Stuxnet determines which actor is involved, what did not trigger war. But if war is an act of policy prescriptions and legal rules apply, force, as Clausewitz argued, then Stux- and what evidence is required to hold the net–a weapon designed to damage prop- perpetrator accountable. Attribution is erty in a specific country–was an instru- also important in ethics. We could assert ment of force. Without a justification, it that “a state perpetrated an unjust cyber looks like an act of war that we are not sure attack,” but if we cannot identify the state, how to evaluate. then the statement loses ethical force. Two options to avoid this quandary are In just war theory, having a just cause to apparent. First, we could read Stuxnet as go to war requires identifying the state that not amounting to war or aggression be- committed the initial wrong triggering the cause of the limited damage it caused, par- right to use force. The inability to do so with ticularly the absence of injuries or deaths. a high level of certainty counsels against the It is a type of force outside jus ad bellum victim state waging war. This position per- made possible by the less lethal and de- haps explains why analyses of just war the- structive options cyber technologies cre- ory often do not focus on attribution. With ate. Second, perhaps the perpetrators were perhaps one exception, Walzer’s historical justified in attacking, in which case Stux- illustrations involve known perpetrators. net was not an act of war or aggression. The exception involves General Yamashi- The most plausible justification involves ta, who was, many believe, unjustly execut- preventing Iran from developing a nuclear- ed for crimes committed by soldiers under weapons capability. We are not talking his command. But no one questioned that about preventive war. Stuxnet involved, in Japanese soldiers committed the atrocities. Walzer’s phrase, “preventive use of force- In cyber, attribution is a problem. Al- short-of-war” outside jus ad bellum,6 thus though claims are made that attribution is highlighting the need to extend just war becoming more feasible, accusations based thinking to force short-of-war. on evidence and means of detection that

145 (4) Fall 2016 39 Just & remain secret agitate attribution contro- rorists could or would cause such slaugh- Unjust War, versies. In addition, the law imposes evi- ter and devastation with cyber weapons. Uses of Force & Coercion dentiary requirements that those seeking From the technological perspective, doubt to hold states accountable for violating le- exists that cyber weapons could kill and gal rules must meet. Tracing a cyber attack destroy on the scales of Pearl Harbor or to an Internet address in a specific location 9/11. More realistic scenarios involve less might be technically accurate, but might dramatic consequences, which would raise not meet the evidence thresholds interna- questions, again, about whether uses of cy- tional law requires for assigning state re- ber weapons cross into jus ad bellum. Polit- sponsibility.7 Just war theory creates a simi- ically, scary scenarios do not explain why

lar challenge given its high threshold for at- a state or terrorists would court full-scale Downloaded from http://direct.mit.edu/daed/article-pdf/145/4/37/1830784/daed_a_00410.pdf by guest on 29 September 2021 tributing wrongs capable of starting wars.8 war by launching killer cyber attacks. The attribution problem has stimulated efforts to overcome it, including the argu- In 2008, Russia and Georgia fought a war ment that, rather than perceive the prob- that featured depressingly familiar aspects lem as intractable, “attribution is what of armed conflict, including alleged war states make of it.”9 However, alternative crimes. However, the war stands out be- approaches have to achieve collective ac- cause Georgia experienced distributed de- ceptance given cyber’s global scope. This nial of service (ddos) attacks. Once war is challenge requires surmounting the tri- underway, just war theory analyzes wheth- ple burden in the attribution problem– er “the war is being fought justly or unjust- the technological difficulties, the legal de- ly.”10 Lawyers have analyzed the cyber as- mands, and the ethical strictures–in an in- pects of the Russia-Georgia war under the ternational political context that has not law of armed conflict. The hardest ques- proved receptive to the development of tion involved the attribution problem: new cyber norms. was Russia responsible? Efforts to an- Stuxnet is the only existing example of swer this question did not find sufficient a cyber incident that approaches jus ad bel- evidence that Russia was legally responsi- lum, but states and terrorists could try to ble. Although this outcome does not pre- use cyber weapons to kill and destroy on clude ethical deliberations, facts–or the a massive scale. U.S. policy-makers have lack of them–still matter for determining warned that states could cause a “cyber accountability. Pearl Harbor” or terrorists could launch In addition, attribution does not matter a “cyber 9/11.” However, these scenarios if no wrong is done. In the Russia-Georgia are not difficult in just war terms. If, un- war, did the ddos attacks against govern- provoked, a state attacked with cyber and mental and civilian institutions violate jus caused death and destruction on the scale in bello rules about “fighting well”?11 Under of Pearl Harbor, then it launched an unjust the law of armed conflict, the disruptions war and committed criminal aggression. did not qualify as an “attack”–an act in- The slaughter of thousands and large-scale tended or foreseeably likely to cause death, destruction of property by cyber terrorists injury, destruction, or damage–subject to would trigger the victim state’s right to use legal rules, including those protecting ci- force in self-defense. In both cases, ethi- vilians. With no violation, there is no ac- cal analysis would shift to whether bellig- countability to assign, which makes attri- erents fight in accordance withjus in bello. bution legally irrelevant. With these scenarios, people argue not In just war theory, international law does about ethics, but whether states or ter- not determine the scope of ethical delib-

40 Dædalus, the Journal of the American Academy of Arts & Sciences eration. However, where ethics go when ted to using cyber weapons in armed con- David P. the law of armed conflict is not violated is flict, and the U.S. cyber attacks are a semi- Fidler unclear. Most debates about the actions of nal development in the long-predicted in- soldiers and commanders address whether tegration of offensive cyber capabilities violating established rules–Walzer’s “war into strategies and tactics for waging war. convention”12–are justified. How do we The attractiveness of cyber in the war evaluate acts of force or coercion short- convention does not mean that all cyber of-an-attack during war? When we eval- weapons will be as sophisticated as Stuxnet uate such acts, will we not look favorably or that all cyber attacks during war would on them compared to violent, kinetic at- comply with jus in bello. Belligerents could tacks? Aren’t we going to want, ethically, use cyber weapons in illegal and unethical Downloaded from http://direct.mit.edu/daed/article-pdf/145/4/37/1830784/daed_a_00410.pdf by guest on 29 September 2021 weapons that do not produce the death, in- ways, with “the most serious ethical prob- jury, destruction, and damage that bellig- lem . . . [being] their potential for collateral erents can legally inflict during war? damage to civilians.”16 However, the cyber Let’s return to Stuxnet. Assume Iran threat to the war convention appears, at and the United States were at war, and present, more limited than threats posed the United States deployed Stuxnet. This by kinetic weapons. We are unlikely to weapon was built to cause damage, and it see cyber equivalents of the Dresden fire- caused damage, qualifying as an attack in bombing or the My Lai massacre. Indeed, the law of armed conflict. Under this law, cyber’s less lethal and destructive possi- the United States attacked a military tar- bilities raise the question whether bellig- get, the attack and weapon complied with erents should use them before, or instead the principles of distinction and discrimi- of, kinetic weapons.17 nation, the damage was not disproportion- Cyber weapons might also be prefera- ate, and the methods used to attack were, ble if a belligerent decides that military as far as we know, not perfidious. Stuxnet’s necessity or supreme emergency requires performance, particularly under the dis- breaching the war convention. If a bellig- crimination and proportionality princi- erent believes it must neutralize civilian ples, provided a glimpse of “the possibili- targets, an attack would violate the prin- ty of an age of precise warfare that is truly ciple of civilian immunity, whatever weap- unprecedented.”13 on is used. However, a cyber attack might This hypothetical highlights cyber’s at- cause less death, injury, destruction, or tractiveness under the war convention.14 damage than conventional weaponry, and Underscoring this attractiveness is the thus be an ethically better way to fight un- U.S. government’s acknowledgement in justly. early 2016 that it was launching cyber at- Analyzing cyber warfare has a surreal tacks against the so-called Islamic State’s quality at the moment because there has social media operations and military been no cyber warfare, at least not as just command-and-control capabilities in the war theory describes war. However, as armed conflict being waged against this the U.S. cyber attacks against the Islam- group.15 Given its position on cyber and ic State demonstrate, cyber technologies jus in bello, the United States clearly be- are being integrated with other weapon- lieves that its cyber weapons and attacks ry and tactics in armed conflict, a trend comply with the law of armed conflict and that will continue. The future might also with this law’s ethical functions in the just see more examples of the “hybrid warfare” war tradition. The U.S. acknowledgement Russia has conducted in Eastern Ukraine represents the first time a state has admit- by combining kinetic operations, infor-

145 (4) Fall 2016 41 Just & mation warfare, and covert cyber activi- self qualify as an attack in the law of armed Unjust War, ties,18 or of Russia’s “gray zone combat” conflict and is not subject to rules protect- Uses of Force & Coercion against nato members and partners in- ing civilian objects from attack. volving disruptive cyber attacks, cyber es- Where the attack threshold is set legal- pionage, and online propaganda.19 In such ly makes cyber attractive to coerce an ad- activities, cyber technologies are useful for versary without violating jus in bello. Here, many purposes, most of which do not con- the question is whether cyber coercion di- stitute attacks under the law of armed con- rected at civilians during war is ethical. At flict, but challenge adversaries and compli- first glance, this question seems superficial cate calculations of outside actors. given that the law of armed conflict per-

The Islamic State also integrates kinet- mits belligerents to use kinetic weapons, Downloaded from http://direct.mit.edu/daed/article-pdf/145/4/37/1830784/daed_a_00410.pdf by guest on 29 September 2021 ic operations with cyber activities in its including in ways that produce civilian col- war-fighting. Although its “cyber caliph- lateral damage. However, civilian depen- ate” has claimed responsibility for inci- dence on computer systems makes unre- dents, including one against U.S. Central stricted cyber coercion suspect, especially Command, its signature activity is ex- given the principle of military necessity. Al- ploiting social media to spread propagan- lowing unrestricted cyber coercion under- da and recruit adherents.20 The Islamic neath the attack threshold would privilege State’s use of social media in waging war a new capability to coerce civilians over the is unprecedented, and it has produced not ethical imperative in war not to harm civil- only U.S. cyber attacks against the Islam- ians without compelling reasons. ic State’s social media operations, but also U.S. kinetic attacks against members of Norms guiding the transition from war the cyber caliphate. to peace–jus post bellum–are not promi- Although not works of ethics, the Tallinn nent in just war theory. Advocates for these Manual on the International Law Applicable to norms identify the need to think about how Cyber Warfare and the U.S. Department of wars end in order to inform war’s ends and Defense’s Law of War Manual address how means. What jus post bellum seeks is daunt- jus in bello applies to cyber.21 These manu- ing because a “just peace is one that vindi- als indicate that cyber weapons do not cre- cates the human rights of all parties to the ate the stark ethical dilemmas that the mil- conflict.”22 itarization of other technologies has. Ever In 2011, the un Security Council autho- more destructive weaponry has strained rized the use of force under the respon- ethical strictures in jus in bello, but cyber sibility to protect (r2p) principle to pro- technologies do not follow this pattern. tect Libyan civilians. According to news Cyber raises different issues, particular- reports, the U.S. government considered, ly whether jus in bello should protect civil- but rejected, cyber attacks against Libyan ians from the full range of harms cyber op- air defense systems, which nato disabled erations can inflict on Internet-dependent through bombing. With Security Council services important to civilian well-being. authorization, nato’s operations were le- Should the threshold at which civilian im- gal, and the attacks on the air defense sys- munity is triggered be lowered to regulate tems complied with the law of armed con- less violent and lethal effects cyber oper- flict. The Libyan intervention was hailed ations can cause? Interfering with civil- as a successful application of r2p, until ian cyber systems can be coercive, but, ac- post-conflict Libya descended into chaos. cording to the Tallinn Manual, damaging r2p includes the “responsibility to re- code and data on computers does not by it- build” after military interventions, which

42 Dædalus, the Journal of the American Academy of Arts & Sciences links with jus post bellum. What happened in ed States is not the only country interested David P. Libya supports those seeking more atten- in the coercive possibilities of cyber tech- Fidler tion on the transition from war to peace. nologies. nato forces complied with jus ad bellum The occurrence of offensive cyber acts and jus in bello, but the post-conflict phase demonstrates that cyber technologies make tainted the notion that the intervention coercion and force short-of-war possible was a just war. Even so, how more empha- and attractive. The U.S. government has sis on jus post bellum would have affected started to emphasize cyber threats short- the decision to use military force or choic- of-war more than cyber Pearl Harbor or cy- es nato made in waging war is hard to see. ber 9/11 scenarios. This shift suggests that

The Security Council acted under r2p to cyber force and coercion, not cyber war, are Downloaded from http://direct.mit.edu/daed/article-pdf/145/4/37/1830784/daed_a_00410.pdf by guest on 29 September 2021 prevent atrocities in urgent circumstanc- more pressing challenges. The following ex- es that did not permit much contempla- amples illustrate that forceful and coercive tion about how the conflict might end. The cyber actions, and threats of such actions, U.S. government decided, in part, against have become frequent. cyber attacks because it believed prevent- Cyber Sabotage. In 2015, Reuters reported ing atrocities required immediate action that the United States attempted, but failed, that conventional weapons could accom- to damage North Korea’s nuclear weapons plish. Jus post bellum does not seem relevant program with a Stuxnet-like attack at ap- to that decision. proximately the same time it allegedly used The Libya incident does not nullify the Stuxnet to damage Iran’s centrifuge facili- ethical importance of transitioning from ty. If these reports and allegations are accu- war to peace, but it raises questions about rate, the United States attempted cyber sab- how jus post bellum informs decisions about otage against two countries for reasons re- war’s ends and means. What these ques- lated to threats posed by the proliferation tions mean for use of cyber technologies of nuclear weapons. in war is harder to fathom. Cyber weapons Cyber Vandalism. In 2014, the United might produce less death and destruction, States accused North Korea of “cyber van- which might help post-conflict efforts. But dalism” in hacking Sony Entertainment the more we use the Internet for military and damaging stored data and networks. purposes, the more we might undermine Allegedly, North Korea did so in response cyberspace as a tool for post-conflict de- to Sony’s crude comedy about a fictional velopment. However, these musings seem assassination of North Korea’s leader. The trite because Libya’s post-intervention hacking was a coercive act, but the choice collapse had nothing to do with cyber of vandalism to describe it illustrates the technologies. difficulties of characterizing cyber coercion short-of-force. In contrast with the paucity of cyber war- Cyber Reprisal. In 2012, Iran is believed fare examples, states are using cyber tech- to have launched a cyber attack against nologies in ways that are not acts of war, do Saudi Aramco, damaging approximately not take place during armed conflict, and thirty thousand computers, and ddos at- thus fall outside just war theory. For exam- tacks against U.S. financial institutions. ple, certain disclosures made by Edward Experts argued that these attacks were re- Snowden revealed the U.S. government’s prisals against Saudi Arabia for being a interest in, policies on, and conduct of U.S. ally and the United States for the Stux- offensive cyber operations that can achieve net attack. In 2015, the United States ac- a range of potential effects.23 But the Unit- cused Iran of hacking the Sands Hotel in

145 (4) Fall 2016 43 Just & Las Vegas, an apparent retaliation for re- istration considered offensive cyber oper- Unjust War, marks the hotel’s owner–a supporter of ations against China’s “Great Firewall” to Uses of Force & Coercion Israel–made about Iran. undermine the Chinese government’s con- Cyber Attrition. For years, South Korea trol of the Internet. As in other contexts, de- has experienced cyber incidents it believes terrence in cyber requires credible threats North Korea has perpetrated. One inci- backed by attribution and offensive capa- dent involved the hacking of a company bilities sufficient to identify and hurt an that operates South Korean nuclear energy adversary, and thereby change its behav- facilities. These events form part of the po- ior. Deterrence in cyber appears in other litical and military struggle on the penin- ways as well. Demonstrating offensive ca-

sula, and North Korea uses cyber to threat- pacity and cyber espionage skills sends sig- Downloaded from http://direct.mit.edu/daed/article-pdf/145/4/37/1830784/daed_a_00410.pdf by guest on 29 September 2021 en, weaken, and distract South Korea. nals intended to induce caution in adversar- Cyber Espionage. Traditionally, states have ies, features connected with cyber attacks not considered espionage a coercive act that that temporarily disrupted electrical sup- violates the legal prohibition on interven- plies in Ukraine at the end of 2015.26 tion in the domestic affairs of other states. In short, states have developed interests However, the scale and intensity of cyber and capabilities in using, and threatening espionage have generated claims that it has to use, cyber as a means of force and coer- become coercive, destabilizing, and “a pro- cion short-of-war. The examples reveal a scribed intervention under customary in- spectrum of harm that includes destruc- ternational law.”24 The United States has tive, damaging, degrading, disruptive, and accused China of persistent, large-scale, deterrent effects. This spectrum highlights and harmful cyber espionage against the the complications that cyber technologies U.S. government and U.S. companies. Sig- introduce when attempting to distinguish nificantly, in 2015, the United States accused force short-of-war from coercion short-of- Chinese government hackers of stealing force. The range of effects also creates the information from the Office of Personnel risk that cyber actions short-of-war might Management (opm) on millions of gov- trigger escalation, which raises particular ernment employees. The Obama adminis- questions about automated responses to tration believed this act of spying went be- cyber incidents.27 The spectrum, and its yond normal espionage and justified retalia- dangers, counsels thinking about just and tion. Likewise, China has complained about unjust cyber coercion in addition to cyber intrusive U.S. cyber espionage, complaints force short-of-war. Snowden’s leaks amplified. Cyber Deterrence. In 2015, the U.S. De- For state actions that fall underneath partment of Defense released a new cy- the legal prohibition on the use of force ber strategy that emphasized deterrence, associated with jus ad bellum, internation- which “works by convincing a potential al law contains obligations, including to adversary that it will suffer unacceptable settle disputes peacefully, respect the sov- costs if it conducts an attack on the Unit- ereignty of other states, and refrain from ed States, and by decreasing the likelihood intervening in the domestic affairs of other that a potential adversary’s attack will suc- states.28 Violation of these principles per- ceed.”25 The U.S. government has threat- mits the victim state to respond with pro- ened to retaliate against China to deter it portionate countermeasures not involving from undertaking certain kinds of cyber es- the use of force intended to bring the state pionage. In thinking about how to retali- committing the wrongful act into compli- ate for the opm hack, the Obama admin- ance with international law.

44 Dædalus, the Journal of the American Academy of Arts & Sciences The cyber acts short-of-war described Do we need a rule to determine when co- David P. above suggest that these legal rules do not ercion and force short-of-war trigger the Fidler adequately regulate state behavior. This obligation to shield civilians, as the con- problem connects to precyber controver- cept of “attack” does in the law of armed sies about the nonintervention principle, conflict? What are the peacetime equiva- including the principle’s nonapplication lents of the “military necessity” principle, to espionage or other coercive acts, such or “combatants” that would be legitimate as economic sanctions. These issues cre- targets? Does it even make sense to sub- ate challenges for ethical analysis. To il- ject coercion or force short-of-war to a rule lustrate, the United States proposed to the against targeting civilians when such acts gge in 2015 some voluntary cyber norms do not threaten a civilian’s right to life? Downloaded from http://direct.mit.edu/daed/article-pdf/145/4/37/1830784/daed_a_00410.pdf by guest on 29 September 2021 for peacetime. One norm the gge accept- What rules should guide the responses of ed holds that countries should not conduct states victimized by cyber coercion and cyber operations that intentionally dam- force short-of-war? age critical infrastructure in other states.29 Cyber technologies do not clarify what Such attacks would violate legal duties to just causes should be included in a the- settle disputes peacefully, respect sover- ory of just coercion and force short-of- eignty, and refrain from coercive interfer- war. The scope of just-cause permissive- ence in another country’s domestic affairs. ness would stimulate disagreement, just as It is a sign of how bad things are in cyber- the legitimacy of going to war for reasons space when a nonbinding norm is pro- beyond self-defense and Security Council posed to accomplish what binding inter- authorization is hotly contested. Potential national law prohibits. just causes, such as responding to atroci- Turning to ethics, Walzer posited that ties or preventing proliferation of weapons a theory of just uses of force short-of-war of mass destruction, do not come with po- should reflect just war theory. We can ex- litical or ethical consensus about the pro- tend this proposition to coercion short- priety of using coercion or force short-of- of-force as well. First, coercion and force war for these purposes. Does Stuxnet’s role short-of-war must have a just cause. Wal- in helping the United States persuade Iran zer argued that just causes for force short- to enter into an agreement on its nuclear of-war “will certainly be more permissive program make the operation ethically pal- than the theory of just and unjust war.”30 atable sabotage?32 How much more permissive is not clear, However, cyber’s coercive possibilities which raises the question of whether just might provide incentives for countries to causes for coercion short-of-force are even explore the boundaries of coercion and broader. The need to prevent escalation force short-of-war. Capabilities associated should inform the additional permissive- with cyber could make deliberations about ness, and avoiding escalation requires that just causes for coercion and force short-of- coercion and force be proportionate to the war less exacting, with emphasis shifting just cause and the context be one in which to the proportionality of the means used. If escalation is not likely. so, we would expect frequent but calibrat- Second, Walzer argued that force short- ed cyber incidents undertaken for diverse of-war “should be limited in the same way reasons. The examples described above that the conduct of war is limited, so as to prove this expectation is not far-fetched. shield civilians.”31 In essence, jus in bello Drawing a line between force short-of- –type rules should apply. But this step is war and coercion short-of-force might more complicated than it might appear. avoid this problem by centering ethical de-

145 (4) Fall 2016 45 Just & liberations on actions closer to war. Leav- ing cyber coercively in ways that have not, Unjust War, ing aside the difficulty of reaching con- so far, produced escalation toward war. We Uses of Force & Coercion sensus on where to draw this line, cyber get escalation avoidance through targeted, technologies might stimulate resistance proportional cyber coercion without a the- to establishing clarity between force and ory of just coercion and force short-of-war lesser forms of coercion. The ability to guiding state actions. argue that a coercive cyber operation did not constitute a use of force short-of-war Although cyber technologies and just would be politically useful and would cre- war theory have been my focus, how such ate headwinds for achieving ethical con- technologies support efforts to achieve

sensus. This dynamic could produce the peace–and advance jus ad pacem–is also Downloaded from http://direct.mit.edu/daed/article-pdf/145/4/37/1830784/daed_a_00410.pdf by guest on 29 September 2021 ethics equivalent of controversies about important. For many, the Internet can help the scope, substance, and effectiveness of reduce domestic and international con- the nonintervention principle in interna- flict by facilitating economic interdepen- tional law. dence, political development, and cultural Similarly, arguing that jus in bello–type understanding. Such outlooks link a glob- rules should regulate coercion and force al, accessible, and free Internet with the short-of-war–and responses to such acts purpose of achieving meaningful peace at –might encourage countries to resist clar- home and abroad. ifying what qualifies as coercion short-of- For jus ad pacem, the emphasis on the eth- force and what constitutes force short-of- ics of cyber warfare is worrying. The In- war. The possibilities that cyber technol- ternet’s weaponization could undermine ogies support could feed this resistance what cyber technologies can do for human so that states can maximize offensive and betterment. These technologies prove at- defensive options. Even for activities that tractive in peace and war, and perhaps too would produce coercion or force short-of- much attention is paid to shielding civil- war, states can tailor cyber attacks in ways ians from cyber warfare as opposed to that are discriminating and do not cause protecting the Internet, societies, and in- significant collateral damage, as happened dividuals from power politics. Focusing with Stuxnet. Even with ethically dubious on war, force, and coercion also does not attacks, such as the Sony hack, indiscrimi- touch human rights controversies about nate harm to people or property did not oc- cyber surveillance by states seeking to pre- cur. Further, states hit by acts of cyber co- vent kinetic and cyber threats and attacks ercion or force should also react under the from other countries and terrorists.34 Ap- discrimination and proportionality princi- proaching cyber technologies through jus ples.33 So, just and unjust acts of cyber co- ad pacem highlights the need for demilita- ercion or force–and responses to them– rizing cyberspace rather than delineating can comply with jus in bello–type rules. why and how states can use cyber weap- But with the ability to attack targets ons to fight wars and coerce adversaries. without major collateral damage, exploit- ing cyber to “coerce well” might make In Just and Unjust Wars, Walzer revived the states care even less about the ethics of co- need to think about the ethics of war af- ercion or force short-of-war. Leaving just ter the Vietnam conflict and during a Cold causes aside, cyber attacks that produce War dependent on nuclear terror. The dig- discriminate, proportional consequences ital age is different, and cyber technolo- make escalation less likely. That capability gies affect the ethics of war in ways that has great political utility, and states are us- do not resemble the dilemmas Walzer

46 Dædalus, the Journal of the American Academy of Arts & Sciences tackled. Unlike weapons and combat sit- Anchoring ethical deliberations about co- David P. uations that threaten ethics in war, cyber ercion and force short-of-war in these prin- Fidler can fit withinjus ad bellum and jus in bello, ciples makes theoretical sense, but murki- but the potential for cyber coercion and ness arises in their application. In contexts force short-of-war generates ethical issues involving conventional means of coercion that the just war tradition does not address. and force, controversies in international Under just war theory, cyber proves attrac- law about the prohibitions against the use tive as a means of fighting justly and fight- of force, intervention in another state’s do- ing well, and, outside just war theory, as a mestic affairs, and violating a foreign coun- means of coercion and force short-of-war try’s sovereignty highlight the difficult po- not subject to clear ethical guidance. litical, legal, and ethical terrain of coercion Downloaded from http://direct.mit.edu/daed/article-pdf/145/4/37/1830784/daed_a_00410.pdf by guest on 29 September 2021 My claim is not that cyber technologies and force short-of-war as phenomena in are intrinsically ethical when used in wag- international relations. ing war or coercing states outside armed The great utility cyber technologies offer conflict. As has happened with other tech- means states have few incentives to clar- nologies, states could deploy cyber means ify how ethical principles from just war and methods illegally and unethically in go- theory apply to cyber coercion and force ing to war, fighting armed conflicts, or co- short-of-war. At the same time, the possi- ercing adversaries in peacetime. Further, bilities cyber technologies create for dis- political and technological developments criminating and proportional acts of coer- might produce new forms of cyber warfare cion and force that do not risk escalation and less sanguine conclusions.35 But at the make cyber options ethically attractive, in moment, the possibilities cyber technol- the same way the just war tradition finds ogies create, along with their limitations, ethical potential in cyber weapons. align with just war thinking in ways that do At present, political and ethical inter- not produce “war is hell” outcomes. ests converge in cyber in ways that drain These possibilities also make thinking urgency from revising the just war tradi- prescriptively about cyber coercion and tion and developing a theory of just coer- force short-of-war difficult. Following cion and force short-of-war–an outcome Walzer, ethical reasoning favors applying rarely seen in the history of politics and core concepts of the just war tradition– ethics concerning the emergence of new just cause, necessity, discrimination, and means and methods of coercion, force, proportionality–to coercion and force and war. short-of-war and responses to such acts.

endnotes 1 Michael Walzer, Just and Unjust Wars: A Moral Argument with Historical Illustrations, 4th ed. (New York: Basic Books, 2006), xv. 2 Ibid. 3 Randall R. Dipert, “The Ethics of Cyberwarfare,” Journal of Military Ethics 9 (4) (2010): 384–410. 4 United Nations Group of Governmental Experts, Developments in the Field of Information and Tele- communications in the Context of International Security (a/68/98*), June 24, 2013. 5 Marco Roscini, “Cyber Operations as a Use of Force,” in Research Handbook on International Law and Cyberspace, ed. Nicholas Tsagourias and Russell Buchan (Cheltenham, United Kingdom: Edward Elgar, 2015), 233–254.

145 (4) Fall 2016 47 Just & 6 Walzer, Just and Unjust Wars, xiv. Unjust War, 7 Uses of Force United Nations Group of Governmental Experts, Developments in the Field of Information and Tele- & Coercion communications in the Context of International Security (a/70/174), July 22, 2015, 13. 8 Christopher J. Eberle, “Just War and Cyberwar,” Journal of Military Ethics 12 (1) (2013): 54–67, 56–57. 9 Thomas Rid and Ben Buchanan, “Attributing Cyber Attacks,” Journal of Strategic Studies 38 (1–2) (2014): 4–37, 7. 10 Walzer, Just and Unjust Wars, 21. 11 Ibid., 127. 12

Ibid., 44. Downloaded from http://direct.mit.edu/daed/article-pdf/145/4/37/1830784/daed_a_00410.pdf by guest on 29 September 2021 13 Ryan Jenkins, “Is Stuxnet Physical? Does It Matter?” Journal of Military Ethics 12 (1) (2013): 68–79, 74. 14 John Arquilla, “Twenty Years of Cyberwar,” Journal of Military Ethics 12 (1) (2013): 80–87. 15 David P. Fidler, “Send in the Malware: U.S. Cyber Command Attacks the Islamic State,” Net Politics, March 9, 2016, http://blogs.cfr.org/cyber/2016/03/09/send-in-the-malware-u-s-cyber -command-attacks-the-islamic-state/. 16 Neil C. Rowe, “Distinctive Ethical Challenges of Cyberweapons,” in Research Handbook on International Law and Cyberspace, 307–325, 317. 17 Duncan B. Hollis, “Re-Thinking the Boundaries of Law in Cyberspace: A Duty to Hack?” in Cyberwar: Law and Ethics for Virtual Conflicts, ed. Jens David Ohlin, Kevin Govern, and Clarie Fin- kelstein (Oxford: Oxford University Press, 2015), 129–174. 18 Jarno Limnéll, “The Use of Cyber Power in the War between Russia and Ukraine,” Net Poli- tics, January 11, 2016, http://blogs.cfr.org/cyber/2016/01/11/the-use-of-cyber-power-in-the -war-between-russia-and-ukraine/. 19 David E. Sanger, “As Russian Hackers Probe, nato Has No Clear Cyberwar Strategy,” The New York Times, June 16, 2016, http://www.nytimes.com/2016/06/17/world/europe/nato-russia -cyberwarfare.html?smprod=nytcore-ipad&smid=nytcore-ipad-share&_r=0. 20 David P. Fidler, Countering Islamic State Exploitation of the Internet (New York: Council on Foreign Relations Cyber Brief, June 2015). 21 Michael N. Schmitt, ed., Tallinn Manual on the International Law Applicable to Cyber Warfare (Cam- bridge: Cambridge University Press, 2013); and U.S. Department of Defense, Law of War Manual (Washington, D.C.: United States Department of Defense, 2015). 22 Robert E. Williams, Jr., and Dan Caldwell, “Jus post Bellum: Just War Theory and the Principles of Just Peace,” International Studies Perspective 7 (2006): 309–320, 317. 23 David P. Fidler, ed., The Snowden Reader (Bloomington: Indiana University Press, 2015), 184–198. 24 Russell Buchan, “Cyber Espionage and International Law,” in Research Handbook on International Law and Cyberspace, 168–189, 189. 25 United States Department of Defense, The DOD Cyber Strategy 2015 (Washington, D.C.: United States Department of Defense, April 2015), 11. 26 Kim Zetter, “Inside the Cunning, Unprecedented Hack of Ukraine’s Power Grid,” Wired, March 3, 2016, https://www.wired.com/2016/03/inside-cunning-unprecedented-hack-ukraines-power -grid/. 27 David Danks and Joseph H. Danks, “The Moral Permissibility of Automated Responses during Cyberwarfare,” Journal of Military Ethics 12 (1) (2013): 18–33. 28 Sean Watts, “Low-Intensity Cyber Operations and the Principle of Non-Intervention,” in Cyberwar: Law and Ethics for Virtual Conflicts, 249–270.

48 Dædalus, the Journal of the American Academy of Arts & Sciences 29 The United Nations Group of Governmental Experts, Developments in the Field of Information and David P. Telecommunications (a/70/174), 8. Fidler 30 Walzer, Just and Unjust Wars, xv. 31 Ibid., xvii. 32 David E. Sanger, “Diplomacy and Sanctions, Yes. Left Unspoken on Iran? Sabotage,” The New York Times, January 19, 2016. 33 Tobias Feakin, Developing a Proportionate Response to a Cyber Incident (New York: Council on Foreign Relations Cyber Brief, August 2015). 34 Edward T. Barrett, “Warfare in a New Domain: The Ethics of Military Cyber Operations,” Journal of Military Ethics 12 (1) (2013): 4–17, 13. Downloaded from http://direct.mit.edu/daed/article-pdf/145/4/37/1830784/daed_a_00410.pdf by guest on 29 September 2021 35 Randell R. Dipert, “Other-Than-Internet (oti) Cyberwarfare: Challenges for Ethics, Law, and Policy,” Journal of Military Ethics 12 (1) (2013): 34–53.

145 (4) Fall 2016 49