Kristen E. Eichensehr
Total Page：16
File Type：pdf, Size：1020Kb
THE LAW & POLITICS OF CYBERATTACK ATTRIBUTION 67 UCLA L. REV. __ (forthcoming 2020). Kristen E. Eichensehr Attribution of cyberattacks requires identifying those responsible for bad acts, prominently including states, and accurate attribution is a crucial predicate in contexts as diverse as criminal indictments, insurance coverage disputes, and cyberwar. But the difficult technical side of attribution is just the precursor to highly contested legal and policy questions about when and how to accuse governments of responsibility for cyberattacks. Although politics may largely determine whether attributions are made public, this Article argues that when cyberattacks are publicly attributed to states, such attributions should be governed by legal standards. Instead of blocking the development of evidentiary standards for attribution, as the United States, United Kingdom, and France are currently doing, states should establish an international law requirement that public attributions must include sufficient evidence to enable cross-checking or corroboration of the accusations. This functionally defined standard harnesses both governmental and non-governmental attribution capabilities to shed light on states’ actions in cyberspace, and understanding state practice is a necessary precondition to establishing norms and customary international law to govern state behavior. Moreover, setting a clear evidentiary standard for attribution in the cybersecurity context has the potential to clarify currently unsettled general international law on evidentiary rules. The Article also engages debates about institutional design for cyberattack attribution. Companies and think tanks have made several recent proposals for an international entity to handle attribution of state-sponsored cyberattacks. Although these proposals have much to recommend them, the Article argues that such an entity should supplement, not replace, the current decentralized system of attribution. Having a multiplicity of attributors—both governmental and non-governmental—yields a greater likelihood that public attributions will serve the goals that attributors aim to achieve, namely strengthening defenses, deterring further attacks, and improving stability in and avoiding conflict over cyberspace. INTRODUCTION ....................................................................................................................................... 1 I. THE PRACTICE & PURPOSES OF ATTRIBUTION ..................................................................................... 5 A. The Practice of States .................................................................................................................... 7 B. Attributions by Non-Governmental Actors ................................................................................. 21 C. The Purposes of Attribution......................................................................................................... 25 II. THE LAW OF ATTRIBUTION .............................................................................................................. 31 A. International Law on Evidence-Giving & Attribution in General ............................................... 31 B. Legalizing Cyberattack Attribution ............................................................................................. 37 1. Why Legalize? ......................................................................................................................... 37 2. Law for Cyberattack Attribution .............................................................................................. 42 i. The Insufficiency of Domestic Law ....................................................................................... 42 ii. Customary International Law for Evidence-Giving & Attribution ...................................... 45 III. DESIGNING ATTRIBUTION ............................................................................................................... 54 CONCLUSION......................................................................................................................................... 62 Assistant Professor, UCLA School of Law. For helpful comments and conversations, thanks to Asli Bâli, Bill Banks, Ben Boudreaux, Beth Colgan, Stephen Gardbaum, Andy Grotto, Oona Hathaway, Duncan Hollis, Eric Jensen, Chimène Keitner, Máximo Langer, Susan Landau, Jon Michaels, Kal Raustiala, Richard Re, Michael Sulmeyer, David Thaw, and Eugene Volokh and to participants in workshops at the 2019 Privacy Law Scholars Conference, UCLA School of Law, and Yale Law School Information Society Project. Thanks to Ariel Cohen and Kimberly Turner for excellent research assistance. Electronic copy available at: https://ssrn.com/abstract=3453804 The Law & Politics of Cyberattack Attribution 1 INTRODUCTION Figuring out who’s doing what to whom and publicly identifying those responsible for bad acts in cyberspace are key features of increasing efforts to hold those actors more accountable. Cyberattack attribution is the process of assigning responsibility for carrying out a cyberattack.1 Accurate attribution of cyberattacks is a crucial predicate to a wide range of related or responsive actions; in particular, attribution to a state can set in motion different legal consequences. Criminal indictments are one example: in the United States, a criminal charge of economic espionage requires the involvement of a foreign government.2 Another is insurance coverage.3 Invoking an exclusion for cyberwar, insurance companies have denied claims made by companies that suffered hundreds of millions of dollars of damage in a cyberattack called NotPetya, which the United States and its allies have attributed 1 Some use the terms “computer network exploitation” and “computer network attack” to denote intrusions aimed at spying and damaging or disruptive intrusions respectively, but the line between categories blurs in practice. See, e.g., Bruce Schneier, There’s No Real Difference Between Online Espionage and Online Attack, ATLANTIC, Mar. 6, 2014, https://www.theatlantic.com/technology/archive/2014/03/theres-no-real-difference-between-online- espionage-and-online-attack/284233/; Kim Zetter, Hacker Lexicon: What Are CNE and CNA?, WIRED, July 6, 2016, https://www.wired.com/2016/07/hacker-lexicon-cne-cna/. I therefore use “cyberattack” throughout the Article in the colloquial sense as an umbrella term for malicious computer or network intrusions. Unless otherwise noted, the term is not meant to indicate that an intrusion is an “attack” for purposes of the international law governing the use of force. 2 See 18 U.S.C. § 1831 (defining economic espionage to require theft of a trade secret with the perpetrator “intending or knowing that the offense will benefit any foreign government, foreign instrumentality, or foreign agent”). 3 Yet another context where attribution may matter is cases where individuals sue for harm caused by data breaches. Judges have made assumptions about the identity of hackers—specifically that they are criminals intent on committing fraud—in assessing the risk of harm to plaintiffs for purposes of establishing the injury in fact required for standing. See, e.g., Remijas v. Neiman Marcus Group, LLC, 794 F.3d 688, 693 (7th Cir. 2015) (finding a “substantial risk of harm” sufficient for standing because “[p]resumably, the purpose of the hack is, sooner or later, to make fraudulent charges or assume those consumers’ identities”). For data breaches attributed to government actors, however, judges’ views about the likelihood or nature of potential harm might change. This issue recently came before the D.C. Circuit in a case involving the 2015 Office of Personnel Management hack, which a security firm has attributed to China. See infra note 125 and accompanying text. Despite the possible espionage-related motives for the breach, the D.C. Circuit held that the plaintiffs’ risk of identity theft was sufficient for standing. In Re: U.S. Office of Personnel Management Data Security Breach Litig., 928 F.3d 42, 56-58 (D.C. Cir. 2019). In dissent, Judge Stephen Williams disagreed, discounting the likelihood of identity theft and calling the breach more likely “the handiwork of foreign spies looking to harvest information about millions of federal workers for espionage or kindred purposes having nothing to do with identity theft.” Id. at 76 (Williams, J., concurring in part and dissenting in part). The government has sought rehearing en banc. Federal Appellees’ Pet. for Reh’g or Reh’g en Banc, In Re: U.S. Office of Personnel Management Data Security Breach Litig., supra (Nos. 17-5217 & 17-5232), 2019 WL 4200149. Draft Sept. 15, 2019 Electronic copy available at: https://ssrn.com/abstract=3453804 The Law & Politics of Cyberattack Attribution 2 to the Russian military.4 Still other important examples involve cyber-based responses, ranging from taking foreign government-linked cyber infrastructure offline5 to even forcible self-defense in response to an armed attack. Cyberattack attribution has technical, legal, and political aspects.6 The technical side of such attribution—identifying the source of a cyberattack at the machine or internet protocol address level—has improved substantially over the last few years. But attributing cyberattacks to individual perpetrators and especially to states that direct the attacks remains complicated because it involves unsettled legal and political issues. Questions about who should accuse governments of cyberattacks