Journal of Law and Cyber Warfare
Total Page:16
File Type:pdf, Size:1020Kb
JOURNAL OF LAW AND CYBER WARFARE I. Foreword ............................................................1 Daniel Garrie II. No State is an Island in Cyberspace ...................4 Jessica “Zhanna” Malekos Smith III. Measuring Autonomous Weapon Systems against International Humanitarian Law Rules ................................................................66 Dr. Thompson Chengeta IV. Congressional Cybersecurity Oversight: Who’s Who and How It Works .................................147 Lawrence J. Trautman Volume 5 | Summer 2016 | Issue 1 (c) 2012-2016. Journal of Law and Cyber Warfare. All Rights Reserved. Editor-in-Chief Daniel B. Garrie, Partner, Law & Forensics Business Editor Radhika Tiwari Conference Editor Managing Editor Masha Simonova Benjamin Dynkin Staff Irene Byhovsky Jennifer Chan Richard Diorio Dhiraj Duraiswami Barry Dynkin Anthony Ford Geoffrey Kalender Phillip Kim Zachary Levy Brandon Pugh Mary Winningham Editorial Board Prof. Richard Andres Robert Bair Richard Borden National War College Lieutenant Commander, Navy Counsel, Robinson + Cole Prof. Diana Burley Christopher Burgess Uma Chandrashekar George Washington University CEO, Prevendra Info. Sec. Leader, Edwards Roland Cloutier Jack Dever James Dever CSO, ADP Head of AML/Sanctions, Wells General Counsel of Defense Co Fargo Major Reserve, US Army Parham Eftekhari Deborah Housen-Couriel Jane Horvath Co-Founder, ICIT Special Counsel, ZEK Senior Director, Apple Will Hudson Prof. Eric Jensen Jean-Claude Knebeler Senior Advisor, Google Law Professor, BYU Amb. of Luxembourg to Russia Jeremy Kroll David Lawrence Dr. Larry Ponemon CEO, K2 Intelligence Co-Founder, RANE Chairman, Ponemon Institute Dr. James Ransome Dr. JR Reagan Lt. Col. Shane Reeves Sr. Director, McAfee Global CISO, Deloitte West Point Prof. Michael Schmitt General Ami Shafran Prof. Rhea Siers US Naval War College Director, Evigilo John Hopkins University Mitchell Silber William Spernow Dr. Joseph Weiss Senior Managing Director, FTI CISO, Forensic Scan Managing Partner, ACS Jody Westby Amit Yoran Elad Yoran CEO, Global Cyber Risk, LLC President, RSA CEO, Security Growth Partners 1 FOREWORD [2016] FOREWORD By Daniel Garrie* Today our country is faced with the stark and harsh reality that cyber warfare is playing an instrumental role in the domestic and foreign policies of both the United States, and international community at large. One cannot go a week without seeing the front page of the news featuring a cyber incident – a crime, attack, act of terror, or other state sponsored activity. From criminals stealing nearly $100 million from the Bank of Bangladesh,1 to the Ukrainian power grid being knocked out, leaving 230,000 citizens in the dark,2 and even to determining elections, 3 the impact of cyber warfare is here to stay. The ability of cyber warfare to shape world events can be demonstrated no better than * Daniel Garrie is an Arbitrator, Forensic Neutral, technical Special Master, at JAMS, available in Los Angeles, New York, and Seattle; Executive Managing Partner of Law & Forensics LLC, Head of Computer Forensics and Cyber Security Practice Groups, with locations in the United States, India, and Brazil; Partner and Co-Head of Cyber Security at Zeichner, Ellman & Krause; Editor-in-Chief of the Journal of Law and Cyber Warfare; and adjunct Professor of Law at Cardozo School of Law. The author would like to thank Masha Simonova and Benjamin Dynkin as contributors. 1 That Insane, $81M Bangladesh Bank Heist? Here’s What We Know, Kim Zetter, WIRED (May 17, 2016), https://www.wired.com/2016/05/insane-81m-bangladesh-bank-heist- heres-know/. 2 Inside the Cunning, Unprecedented Hack of Ukraine’s Power Grid, Kim Zetter, WIRED (Mar. 3, 2016), https://www.wired.com/2016/03/inside-cunning-unprecedented-hack- ukraines-power-grid/. 3 Bears in the Midst: Intrusion into the Democratic National Committee, Dmitri Alperovitch, CROWDSTRIKE (June 15, 2016), https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic- national-committee/. 2 Journal of Law and Cyber Warfare [2016] the very recent cyber-attack on the Democratic National Convention. Imagine for a moment that instead of headlines like “Russian government hackers penetrated DNC, stole opposition research on Trump”,4 “DNC Hack Prompts Allegations of Russian Involvement”,5 and “Experts: Hard to prove Russians behind DNC hack”6, we read a headline “Foreign criminals break into DNC HQ and steal communications and opposition research”. The latter would likely lead to an unprecedented response by the United States Government, leading to a highly publicized hunt for the criminals, which would lock down all means of egress from our nation until the issue was resolved. Pundits on both sides of aisle would debate the issue, and in likelihood congressional summons would be issued. The truth of the matter is that none of this happened. The story hit the news cycle for 24-48 hours, and over the course of a month nobody paid the issue any attention. That is until we began to see the fallout. When Wikileaks, on July 22, released nearly 20,000 sensitive 4 Russian government hackers penetrated DNC, stole opposition research on Trump, Ellen Nakashima, WASHINGTON POST (June 14, 2016), https://www.washingtonpost.com/world/national- security/russian-government-hackers-penetrated-dnc-stole-opposition- research-on-trump/2016/06/14/cf006cb4-316e-11e6-8ff7- 7b6c1998b7a0_story.html. 5 DNC Hack Prompts Allegations of Russian Involvement, http://www.wsj.com/articles/dnc-hack-fits-pattern-of-past-russian- meddling-1469469535. 6 Experts: Hard to prove Russians behind DNC hack, Elizabeth Weise, USATODAY (July 25, 2016), http://www.usatoday.com/story/tech/news/2016/07/25/experts-hard- prove-russians-behind-dnc-hack/87529230/. 3 FOREWORD [2016] emails,7 the fate of a Presidential election may have been determined. To date, these actors have apparently absconded with zero repercussions, while impacting the election of the leader of the free world, a notion that should seem ludicrous to anyone if it played out in the physical world. The Journal of Law and Cyber Warfare is not a partisan publication. I write this forward as the Editor-in- Chief to highlight the power of an act of cyber war, and the DNC example is only the tip of the spear. The articles in this issue present a range of views and perspectives, both U.S. centric and global, and seek to move the issues surrounding cyber warfare and its implications out of the shadows and into the spotlight. 7 Search the DNC email database, WIKILEAKS, https://wikileaks.org/dnc-emails/. 4 Journal of Law and Cyber Warfare [2016] NO STATE IS AN ISLAND IN CYBERSPACE By Jessica “Zhanna” Malekos Smith* ABSTRACT Economic espionage against one state is an affront to the economic stability of all; for no state is an island in cyberspace. But does a state’s difficulty in attributing a hostile cyber act to its true provenance challenge the enforcement of international law in cyberspace? For if a cyber actor can remain anonymous, or impervious to sanctions, do international accords prohibiting the cyber-enabled theft of intellectual property hold any measurable deterrent effect? Given the distinct cultural norms embedded in distinguishing between permissible and impermissible intelligence collection, a dispute resolution framework that accounts for both cultural disparities and the complexities of attribution, is needed. This Article therefore provides a legal theory – a Cyber Espionage Predominant Purpose Test – for equitably resolving international disputes concerning cyber espionage operations that involve mixed elements of national security espionage and commercial espionage. *With special thanks to Prof. Matthew Bishop, Prof. Anupam Chander, Prof. David Horton, Thomas E. Smith, Colleen Swanson, and the diligent staff of the Journal of Law and Cyber Warfare for their generosity of time and support. 5 NO STATE IS AN ISLAND . [2016] INTRODUCTION “No man is an island, Entire of itself, Every man is a piece of the continent, A part of the main. If a clod be washed away by the sea, Europe is the less. Any man's death diminishes me, Because I am involved in mankind, And therefore never send to know for whom the bell tolls; It tolls for thee.” – John Donne, No Man Is an Island8 In the new frontier of cyberspace, no state is an island. As John A. Serabian Jr. noted during a Joint Economic Committee on Cyber Threats and the U.S. Economy, “cyber threats can come from almost anywhere. They can originate from any location, affect systems anywhere in the world, disguise origins and travel routes, and do it all instantaneously.”9 Adding to the litany of asymmetrical threats10 is the attribution challenge. 8 John Donne, No Man is an Island, POEM HUNTER.COM, http://www.poemhunter.com/poem/no-man-is-an-island/ (last visited Jan. 25, 2016). 9 See Cyber Threats and the US Economy, CIA, (Feb. 23, 2000), https://www.cia.gov/news-information/speeches- testimony/2000/cyberthreats_022300.html (last visited Jan. 26, 2016). 10 See Cyber Threats to National Security, Summary of Symposium One: Countering Challenges to the Global Supply Chain (2010), http://asymmetricthreat.net/docs/asymmetric_threat_4_paper.pdf (stating that “[c]yber threats are asymmetric because attacks may be perpetrated by the few upon the many, with little cost and resources. 6 Journal of Law and Cyber Warfare [2016] Attribution is “the association of data (called a characteristic) with an entity (person, process, file, or other data).”11 The attributive analysis process, as described by University