Members of International Telecommunications Union and UN Institute for Training and Research confer on cyber security UN (Jean-Marc Ferré) UN (Jean-Marc Stuxnet, Schmitt Analysis, and the Cyber “Use-of-Force” Debate By ANDREW C. FOLTZ All Members shall refrain in ne of the many seemingly advance the specific criteria states will use in intractable legal issues sur- making such determinations. their international relations rounding cyberspace involves As discussed in this article, several ana- from the threat or use of force O whether and when peacetime lytic frameworks have been developed to help against the territorial integ- cyber operations constitute a prohibited use of assess when cyber operations constitute a use force under Article 2(4) of the United Nations of force.3 One conclusion these frameworks rity or political independence (UN) Charter. Notwithstanding a significant share is that cyber operations resulting in of any state, or in any other body of scholarly work on this topic and physical damage or injury will almost always manner inconsistent with extensive real-world examples from which to be regarded as a use of force. When these draw, there is no internationally recognized frameworks were developed, however, there the Purposes of the United definition of a use of force.2 Rather, what has were few, if any, examples of peacetime, state- Nations. emerged is a general consensus that some sponsored cyber coercion. More importantly, cyber operations will constitute a use of force, the prospect of cyber attacks causing physical —Article 2(4), Charter of the but that it may not be possible to identify in damage was largely theoretical.4 Beginning United Nations1 Lieutenant Colonel Andrew C. Foltz, USAF, wrote this essay while a student at the Air War College. It won the Strategic Research Paper category of the 2012 Chairman of the Joint Chiefs of Staff Strategic Essay Competition. 40 JFQ / issue 67, 4 th quarter 2012 ndupress.ndu.edu FOLTZ in 2007, however, a string of cyber opera- difficulty applying it in the cyber context. I governs state behavior.12 If state-sponsored tions—including the 2007 Distributed Denial then review Schmitt’s model and perform cyber activities constitute a use of force, of Service (DDoS) attack on Estonia, the 2008 a Schmitt Analysis of Stuxnet. Finally, I then international law governing the use of DDoS attack on Georgia, and the 2008 discov- examine what the analysis of Stuxnet reveals force (jus ad bellum) and the Law of Armed ery that the U.S. Government’s most sensitive about the framework’s continued utility Conflict (jus in bello) apply. In appropriate networks had been compromised—hinted at and relevance. Overall, I find that Schmitt’s circumstances, this could trigger a state’s right increased use of the cyber domain by states underlying analytical approach remains to self-defense and thereby permit a forceful, and their proxies for peacetime coercion. sound—that is, the best way to characterize perhaps even armed response. In contrast, Then, with the discovery of the Stuxnet worm the lawfulness of peacetime cyber operations non-state-sponsored cyber operations and operations not amounting to a use of force are the need for clarity has taken on greater importance now traditionally governed by more constrained 13 that the United States and many of its allies law enforcement regimes. The need for clarity has taken on greater treat cyberspace as a military operational domain importance now that the United States and many of its allies treat cyberspace as a military in 2010, which damaged uranium enrichment is to predict how states will characterize them. operational domain.14 Accordingly, discerning equipment at a nuclear facility in Iran, theory That said, the Stuxnet analysis reveals several a use-of-force threshold would seem to be nec- became reality. limitations with Schmitt’s framework, while essary for a wide range of peacetime military Although Stuxnet has been described also highlighting opportunities to broaden it. activities, such as defining the spectrum of as a watershed event, there has been little aca- More importantly, I conclude that the time permissible peacetime cyber operations, such demic discussion on whether it constituted a has come to relax the model’s strict adherence as computer network exploitation; develop- use of force.5 Perhaps this is because it caused to the UN Charter because Article 2(4) is just ing peacetime cyber rules of engagement; physical damage and, therefore, clearly consti- one of several factors that states are likely to identifying appropriate approval authorities; tutes a use of force under prevailing analytic consider when characterizing the lawfulness assigning appropriate agency responsibilities frameworks. This appears to be the emerging of cyber operations. and resources; signaling adversaries and allies consensus.6 Although I generally agree with as part of a deterrence strategy; recognizing this conclusion, I also believe that by looking Why the Use-of-Force when treaty obligations have been triggered; beyond the physical damage, Stuxnet provides Threshold Matters and determining whether UN Security a unique opportunity to assess the adequacy Cyberspace represents a strategic Council authorization is required to conduct and continued relevancy of these frameworks. vulnerability for many states because it is certain operations. As a first step toward such an assess- inextricably tied in to their economies, criti- ment, this article tests one of the more cal infrastructures, and even their national The Use of Force in Cyberspace robust frameworks, known as the Schmitt security apparatus. Compounding these Notwithstanding the need for clarity Analysis, by applying it to Stuxnet. Devel- concerns is the fact that a wide range of discussed above, there is no international oped in 1999 by Professor Michael Schmitt, actors have proven adept at exploiting these consensus on what constitutes a use of force in it is one of the most academically rigorous vulnerabilities. Cybercrime, for example, is cyberspace, nor does it appear a mechanical and frequently cited frameworks for char- now estimated to exceed $1 trillion globally rule is likely to emerge any time soon.15 This acterizing cyber operations. The Schmitt per year.7 Even the most secure U.S. defense section describes why ambiguity persists and Analysis consists of seven factors that states networks are not immune.8 The scope of the the various solutions that have been proposed are likely to consider when character- problem has become so great that some claim to resolve it. After summarizing the relevant izing cyber activities: severity, immediacy, the United States is engaged in a cyber war, law governing the use of force in international directness, invasiveness, measurability, and that it is losing.9 The National Security relations, I highlight the technical, legal, and presumptive legitimacy, and responsibility. Strategy of 2010 notes that “cybersecurity political challenges of applying existing norms A key feature of the framework is that it threats represent one of the most serious within cyberspace. remains faithful to Article 2(4) of the UN national security, public safety, and economic Use of Force Under the UN Charter. Charter while at the same time effectively challenges we face as a nation.”10 The White Jus ad bellum16 describes the law governing bridging key elements of competing analytic House’s International Strategy for Cyberspace the transition from peace to armed conflict. frameworks that do not exhibit such fidelity of 2011 goes further by proclaiming: “When Though grounded in customary international to the Charter. By focusing this evaluation warranted, the United States will respond to law, the black letter principles of jus ad bellum on Schmitt’s model, I expect the results will hostile acts in cyberspace as we would to any are now contained in Article 2(4) of the UN have implications for the use-of-force debate other threat to our country,” to include a mili- Charter, which prohibits states from the more generally. tary response.11 “threat or use of force” in their international The article begins with a discussion Against this backdrop, discerning a relations. Several features of this prohibition of why, as a practical matter, discerning a cyber use-of-force threshold becomes impor- are problematic in the cyber context. First, peacetime use-of-force threshold in cyber- tant for a number of reasons. Foremost is that Article 2(4) only pertains to international space is important. Next, I detail the Article characterizing cyber operations is a precon- relations between sovereign states—it does 2(4) prohibition on the use of force and the dition to determining which legal regime not proscribe the conduct of nonstate actors, ndupress.ndu.edu issue 67, 4 th quarter 2012 / JFQ 41 ESSAY WINNERS | Cyber “Use-of-Force” Debate who appear to be the source of most mali- v. United States (hereinafter Nicaragua), “effects-based” approach, which states that cious cyber activity. Also, as noted above, when it concluded that arming and train- the quantum of damage, and not the means the Charter does not define the phrase use of ing guerrillas amounted to a prohibited of attack, is all that matters. The advantage of force. Finally, Article 2(4) does not provide use of force, even though it did not rise to this approach—which is generally favored by any exceptions to the prohibition on the the level of an armed attack.25 Accordingly, U.S. policymakers and military operators—is unilateral use of force, nor does it prescribe the use of force threshold has traditionally that it is fairly simple to apply and it acknowl- remedies for unauthorized uses of force. Such been viewed as lying somewhere between edges that states are principally concerned exceptions and remedies are found in chapter purely economic and political coercion on about consequences.