Chairman of the Joint Chiefs of Staff Strategy Essay Competition
Essays 2000

Moral and Ethical Considerations for Computer Network Attack as a Means of National Power in Time of War

William J. Bayles

Those who really deserve praise are the people who, while human enough to enjoy power, nonetheless pay more attention to justice than they are compelled to do by the situation.

---Thucydides, Speech of the Athenians, History of the Peloponnesian War ¹

I have the power, the capability, sitting in my home with my computer and my modem--if I only understood how to do it--[to] wage war. That is a very different environment than anything that we have experienced in the past.

---James Adams, "Information Warfare: Challenge and Opportunity"²

Today, we are on the verge of technological advances that will redefine how we wage war and, in many cases, blur the line between economic competition and warfare. The technology area which holds the most promise as well as the most unknown danger is the world of computer networks--cyberspace.

With the proliferation of computers and ever-increasing computing power available to nearly every private citizen in developed countries, microprocessors have changed the lives of countless millions of people. The ubiquity of computing within business, finance, education, and the military has raised concerns about the security of both the data and tools upon which we have become increasingly dependent.³ Many authors have expressed increasing concerns with our computer security over the past several years. Some have speculated that an attack against the United States could disrupt electricity supplies and telephone service, interfere with air traffic control, cause leaks or explosions at chemical plants or refineries, and cause economic damage ranging into billions of dollars.⁴ Likewise, other nations and transnational groups may have similar vulnerabilities the United States could exploit. Therefore, some people reason the United States should develop its own capabilities in the realm of computer network attack.

In many articles and books, authors highlight the supposed elegance of bringing an enemy to his knees without firing a shot--instead rendering him defenseless and harmless by defeating his information infrastructure via surgical attacks.⁵ The weapons of computer network attack include "chipping"⁶ (inserting malevolent code into hardware during manufacturing), programming "back doors" to allow external control of the computer, and infecting with computer viruses. On the surface, these weapons appear to be nonlethal in nature, but may have disruptive or deadly higher order effects.

The United States and other nations are contemplating the addition of computer attack to their arsenals. During the Kosovo intervention, the United States attempted limited electronic attacks on Serbian computers containing banking records of Serbian leaders.⁷ The United States is not alone in this respect. In 1995, the National Security Agency and Department of Energy estimated that over 120 nations had some sort of computer attack capability.⁸ The People's Republic of China is studying numerous types of "dirty war"--"asymmetric attack" in today's military parlance--which include using computer viruses to pitch China's technologically advanced enemies into "political and economic crisis."⁹

The potential for such a crisis makes the application of computer network attack (CNA) a very different sort of combat power than the kinetic weapons it may someday supplement or replace. Like kinetic weapons, network attack can destroy both military and civil targets. Unlike most kinetic weapons, however, it can reach across the world at the speed of light passing over many international borders en route to its target. Like chemical and biological weapons, cyber weapons can target large masses of people in both military and civilian communities. Unlike biological and chemical weapons, they do not directly affect humans. Thus, the cyber weapons share some similarities with weapons of yesterday, yet they occupy a completely new niche by their very nature. Their uniqueness requires well-considered policy for their use.

To utilize these weapons ethically and legally, commanders and staffs must weigh their use against classes of targets and, in some cases, against individual targets using clearly enunciated interpretations of the doctrines of discrimination and proportionality. The dilemma was stated by a newspaper reporter, "For now, many sticky questions must be considered: When is a cyber attack justified, what if it affects civilians and is a cyber attack an act of war?"¹⁰

Defining Information Operations and
Computer Network Attack

The current joint military doctrine weaves computer network attack into a larger tapestry of several more traditional military disciplines, calling this assemblage information operations (IO). Defined as "actions taken to affect adversary information and information systems while defending one's own information and information systems," IO encompasses operations security (OPSEC), psychological operations (PSYOP), military deception, electronic warfare (EW), physical attack, and computer network attack (CNA).¹¹ Most of these disciplines are as old as warfare itself.

Of the disciplines of IO, computer network attack is the newest. While primarily a technical means, successful CNA depends upon clear intelligence, well-defined intent, and clear understanding of the primary and secondary effects of an attack operation. Thus, while highly technical, CNA relies heavily upon the artistic mind of its practitioner. For a skillful practitioner, CNA becomes an enabler for deception and psychological operations.

There are several technical means of executing a computer network attack. The most straightforward is to physically destroy the computers or critical network nodes. An example would be to attack the structure that houses the computer with precision munitions to disrupt the computer's function or destroy it altogether. There are electronically intrusive means as well. First, the friendly force can steal an adversary's data, enabling better decisions for friendly force employment, or corrupt his databases, "helping" the enemy to reach poor decisions. Another means of attack is to deny access to networks or force them to a halt using viruses.¹² This forces the enemy to use less efficient communications and processing means, slowing his logistics and decision cycles. Finally, attackers may surreptitiously reprogram enemy computers to disrupt the processes they control. An example is denying electricity to an area by reprogramming the computers controlling distribution within the power grid.

The far-reaching potential of CNA requires thinking about its moral and ethical consequences. There has long been debate about the nature of nuclear, chemical, and biological weapons--whether they differ in kind from kinetic weapons or whether they merely differ in the magnitude of their effects. Similarly, if CNA varies only in degree, existing rules are sufficient to examine the morality of its use. Otherwise, mankind should derive new rules or must renounce its use.¹³ At first examination, its use against military targets to disrupt clearly military activities appears legal and ethical. However, the legal and ethical issues become more complex as it targets civil infrastructure or uses attack means that replicate themselves beyond the targeted computer or network.

The Nature of Computer Network Attack

At first glance, the concept of computer network attack (CNA) appears to be a dream come true for a technologically advanced nation. CNA presents an opportunity for the government to exercise many of the elements of national power without endangering its forces and, if it can do so anonymously, without jeopardizing its honor. Many would not even consider CNA to be a weapon at all. Those who do, consider it nonlethal, thus unlikely to produce pictures of dead or maimed people in the media. Similarly, first order effects of an electronic attack will not produce physical destruction, except perhaps to the computer itself. Again, CNA users would anticipate fewer lucrative media pictures or stories. Thus, considering first order effects only, CNA appears to be an ideal means of exercising national power.

Considering only first order effects, the nature of CNA places it in a unique niche in a nation's arsenal. The effects may be of long or short duration--mere harassment or society-wrecking infrastructure shutdown. Attacks may affect either very limited or nearly unlimited populations, including whole classes of noncombatants.¹⁴ The attacker can be very difficult to trace, since an attack may pass through many different computers en route to the target. This feature means that attackers may navigate numerous "third party" nations which may or may not approve of the attack or the means used. Even if the target nation locates the source of the attack, it will have difficulty distinguishing whether it has been attacked by a sophisticated private hacker, a corporate entity, or another nation. Finally, the worldwide reach of a network attack means that no computer or network is in a sanctuary unless it is completely isolated from outside networks and the telephone system.

The unique nature of CNA has several implications for practitioners and policymakers. First, the potentially anonymous nature may result in aggressor nations using CNA widely to accomplish a number of goals in the political and economic arenas. Such use will raise the question of which sorts of policy should govern the use of CNA--wartime rules of engagement or civil law. As a political or economic tool, CNA may aim to stress the populace, who in turn affect policymakers of the attacked states. In this way, CNA could take on the nature of economic sanctions, which potentially cause widespread suffering of innocents as a means to achieve political influence.¹⁵ Absent legal precedents to govern the use of technologies such as CNA, we must turn to the just war tradition to examine the ethics of its use.

The Concept of Jus in Bello

Mankind has attempted to regulate the conduct of warfare since earliest history. For example, Sun Tzu, the 5^th century B.C. Chinese military philosopher, wrote, "treat the captives well, and care for them....Generally in war the best policy is to take a state intact; to ruin it is inferior to this."¹⁶ About a century later, Hindu writings espouse humanitarian rules including certain prohibitions on poisoned weapons and describe noncombatant status.¹⁷ The point of these examples is twofold. First, throughout the history of organized warfare, rules existed to lessen its cruelty by imposing constraints on its execution. Secondly, the cultural and technological contexts determine much about those constraints. Thus, the synthesis of over two thousand years of experience provides the basis for today's just war theory.

The concept of jus in bello (just war) encompasses two principles: discrimination and proportionality. As noted above, through most of recorded history, the concept of discriminating between the noncombatant and the warrior was central to the proper exercise of force. Likewise, the ancients sought to decrease the suffering inflicted upon the enemy by encouraging battle with proportional means. Therefore, defining these principles for the sake of analyzing CNA is in order.

Discrimination is simply the principle recognizing the difference in treatment accorded the warrior and the innocent bystander. Combatants are legal targets for the application of force and assume the risk of their avocation since they are present upon the battlefield by their own will. Combatants make themselves recognizable by wearing a uniform or carrying arms openly. As combatants, they legally and properly use force to subdue their enemy. Noncombatants, on the other hand, are not proper targets for the application of military force and may not take part in battle unless they assume the role of combatants by taking up arms. Though many notable exceptions exist, armies have generally attempted to discriminate between these two classes of individuals.

For the purposes of this analysis, discrimination is the recognition of noncombatant immunity from deliberate and direct attack against person or possessions. Simply put, attacking those carrying arms, wearing uniforms, or engaging in the war activities normally associated with combatants is a proper (legal) attack. Discrimination applies both to the aim of the weapon--whether the intended target is a proper one--and to the inherent characteristics of the weapon itself--whether it is likely to hit the target. Obviously, a rifle bullet discriminates more than a nuclear weapon.

Sometimes legitimate military operations affect noncombatants by accident. Traditional thought recognizes this possibility. If there is a danger of noncombatant harm, the attacker may prosecute the attack only if the "good" to be achieved outweighs the foreseeable harm that may result. Thus, a commander is not bound to forego a particularly valuable target because there is a remote chance of noncombatant injury or death. Rather, he is bound to consider the value of the target, the likelihood of collateral damage, the extent of the damage or injury, and whether such damage or injury is reversible. This concept, referred to by the theorists as the concept of double effect, leads to discussion of the concept of proportionality.

Proportionality refers to the level and extent of force used by combatants in the discharge of their duties. It is important to note that proportionality applies to the effects of the weapons on both noncombatants and combatants alike. In the case of the noncombatant, we return to the concept of double effect. Combatants may not directly attack the noncombatant's life and property, although legal and moral attacks directed against proper targets may affect them. The commander making the attack is bound to use the least amount of force and the most discriminating weapons to achieve the needed target effect. This subjects the noncombatants and their property to the least chance and least amount of destruction commensurate with the attacker's mission. Applying proportionality to the case of the combatant, the attacker is bound to use only weapons that do not unnecessarily prolong suffering after a combatant is injured. The attacker is likewise bound to use the least force that achieves the mission. In practice, this concept makes an expanding bullet an improper weapon, because of its tendency to cause great internal injuries and higher death rates than jacketed bullets. Further, sustained and violent attacks upon a place to a degree beyond all possibility of survival for the defenders would be disproportionate violence.

For the purposes of this analysis, proportionality is the concept which commanders use to temper the violence used in their attacks. Proportionality weighs the military goal and the strength of enemy force against the likelihood of collateral damage, injuries, and suffering of enemy combatants. The result of the balance determines the weapons choices, duration, and, finally, moral character of the attack.

Method of Analysis

This paper examines computer network attack in terms of discrimination and proportionality. It attempts a holistic approach, considering not only effects of the "munitions" themselves, but also higher order effects of the attack. Three target cases will be examined: 1) a military command and control network, 2) a banking system, and 3) an electrical utility system. In each case, discrimination and proportionality determine the character and propriety of the attack.

These targeting scenarios are germane to the question of computer network attack for three reasons. First, these are plausible and likely scenarios examined in a number of articles and books. Second, these represent three of the four principal categories of national power--military, political, and economic.¹⁸ Finally, these examine the effect and character of attack on three distinct centers of gravity of an adversary: the military, the will of the people (as reached through disruption of their access to electrical power), and the adversary's economy.

Attack on Military Computer Networks (C2W)

Attack on a military computer network presents unique challenges as well as unique benefits for the attacker. Attacks in this realm fall under the category of command and control warfare (C2W), a category formalized in service and joint doctrine. Joint doctrine defines C2W as measures taken to "prevent effective command and control of adversary forces by denying information, influencing, degrading, or destroying adversary C2 systems."¹⁹ Thus, C2W is not a new idea. For example, ground forces have made it a point to locate and destroy command centers with conventional fires since the advent of radio direction finding equipment. Military forces have long practiced radio frequency jamming and imitative deception in adversary radio networks as an accepted means in war. Such measures increase the uncertainty of war for the adversary and slow his decision cycle. In the near future, weapons such as high energy radio frequency (HERF) generators may join viruses and other software means as weapons for CNA.

Against command and control systems, the majority of attacks will be proper or moral. Such targets at the tactical level will be single use (i.e., military only) systems with connections to neither civilian networks nor civilian functions. Because of this relative isolation, the attacker foresees no effects off the battlefield. Therefore, attacking such a system meets the requirement of discrimination. Because no physical destruction is involved (except perhaps to the computer network hardware itself), proportionality is not an issue vis-à-vis first order effects. Foreseeable higher order effects center on the ability of the attacked to control his forces--exactly the effects desired. These may include loss of critical coordination capability and early defeat of the adversary with less loss of life. There is one caveat to the apparently moral targeting in C2W, however. It may be possible through imitative deception to commit perfidious acts. An example would be to broadcast an "all-clear" just prior to a missile barrage in hopes of catching more people in the open and increasing casualties. Acts such as this increase the casualties and suffering of enemy soldiers and would be improper according to the tenets of jus in bello. In summary, C2W appears to be a ripe area for computer network attack due largely to the discrete and isolated nature of the potential targets.

Attack on Financial Targets

Like military command and control computers, computer networks that run a nation's economy present tempting targets for a well-developed cyber attack. The Clinton administration recognized the debilitating possibilities of disrupting a stock exchange or central bank in Presidential Decision Directive 63. This document directed study of methods and policies to protect "critical infrastructure" including economic targets. Finance in general is very sensitive to perception and, hence, to misinformation. For example, the prices on a stock exchange and the values of the underlying currency fluctuate with confidence in the currency and banking system. This sensitivity makes a financial system an ideal target for attacks that undermine that confidence. Draining a nation's banks or rendering its currency unstable produces second and third order effects through all segments of the targeted society. A loss in confidence in the national bank or the currency itself reduces the value of the currency on the international exchange, making imported goods more expensive for the nation's consumers (or military). Rampant inflation and high unemployment may result, bringing disruption and at least minor suffering to innocent and combatant alike. Thus, few would consider an attack on a national finance system discriminating. However, could such an attack have sufficient military worth to be considered a proper attack?

The World War II attempts to disrupt the German economy through strategic bombing provide an example to consider whether targeting financial operations is justified. From 1943 onward, the Allied strategy attempted to isolate essential industries to bring the German economy to a halt and force capitulation. Planning for a campaign of economic paralysis had begun in Great Britain as early as 1937. The plan called for attacks centered on manufacturing resources, the aircraft industry, and communications networks.²⁰ During the period after the attacks commenced, analysts found that the production of aircraft actually increased and the psyche of the German people, far from crumbling, allowed continued operation of the critical industries.²¹ Those not driven from their homes or killed suffered from the eventual collapse of the normal economy. Meanwhile combat operations continued. This evidence indicates that a population will endure great suffering under a government at war allowing that government's war effort to continue and even tolerate diversion of assets from civilian relief to that war effort. Disruption of the economy failed to disrupt the military potential of the economy as much as the complete physical destruction did in the last months of the war. The conclusion is that economic attacks cause widespread civilian suffering long before any noticeable effect occurs on the military potential of a warring nation. Thus, such attacks, far from having a proportional effect on military operations have quite the opposite (disproportional) effect.

Attack on National Electric Power Grids

Since the advent of strategic attacks, the United States has shown much interest in the possibility of denying electricity as a means of disrupting war industry, impeding military operations, and undermining the will of the people. Recognizing this, Nazi Germany housed some generating facilities in buildings that looked like churches.²² During the Gulf War of 1991, the United States-led coalition devastated Iraq's public power grid.²³ "Proponents [of attacking electrical utilities] assert that attacking electricity results in particularly damaging 'second order' impacts on civilian morale, political leadership, military forces and materiel production."²⁴

Power systems components fall into four categories:

*  Generation equipment, which is centralized, capital intensive and difficult to repair

*  Control systems that are less centralized, but which are computerized and thus theoretically vulnerable to a computer network attack

*  Transmission systems which are distributed and present obvious, but linear, sparse targets

*  Distribution systems serving localities or specific industrial plants, which are highly distributed. In general, targeting only the control system disables the entire system.²⁵

Since a control system is the portion of the electrical grid most vulnerable to CNA and since it disrupts the transmission and distribution systems serving all consumers, such an attack is indiscriminate except in one isolated case. Were it possible to disrupt only the electricity to those targets which are proper for iron bombs (e.g., military facilities and defense industry targets making only war materiel), then, and only then is such an attack discriminate. Until such a capability exists, one must assume that an attack on electrical power facilities is an attack on noncombatants, as well as facilities such as hospitals, specifically excluded from attack by numerous treaties.

The widespread effects of electrical grid attacks are so devastating to a modern society that they are neither humane nor proportional to the military effect achieved. Iraq's experience after the Gulf War is an example. Neither water treatment plants nor sewage treatment plants were operational due to the long-term electricity outages. These combined to produce a major health crisis. During the year after the Gulf War, some estimates linked as many as 70,000 to 90,000 Iraqi deaths to the higher order effects of life without electricity.²⁶ In Iraq, the outages were long term because the large, obvious, generator halls were the favorite target of allied airmen, and these are more time-consuming and expensive to repair than distribution yards.²⁷ The efficacy of these attacks has been called into question because many, if not most, military targets have backup power from dedicated generators, making them independent from the public power utilities. Thus, evidence from past wars suggests that air attack of electricity produces only very limited effects on the outcome of the conflict.²⁸ In such a scenario the military advantage would hardly outweigh the human impacts such as reduced hospital capacity, diminished agricultural capacity, and reduced medical refrigeration capability. Indeed, "customary law" protects foodstuffs, crops, and medicines during time of war.²⁹ Attacking the political stability of an enemy via electrical utilities clearly comes at the expense of the civilian populations and thus bears no resemblance to discriminate attacks.

What if the attacker is sophisticated enough to temporarily interrupt power, or can turn it off randomly throughout the day? In these cases, too, the military advantage must outweigh civilian suffering. In some societies, power disruptions are a way of life. When the lights go out, life continues. Even in southern California, sources say temporary interruptions, though disruptive, are not damaging. Citing widespread power outages in 1996, the Los Angeles Times concluded, "people are more adaptable than anyone thought. Critical power users had backup power supplies to get them through short-term outages while maintaining essential emergency services."³⁰ The military may be even more resilient than the civilian population because of the backup generation capability previously noted. Careful consideration of inflicting temporary outages on a case-by-case basis is clearly in order.

Ethical Implications of Computer Network Attack

Central to the argument is whether CNA is use of force at all. From the foregoing, one may argue that it is not, since there is little or no direct physical damage or suffering. As one writer points out, it is to the advantage of the United States if CNA is not considered force, because there results much more latitude in its use.³¹ Others argue that its widespread collateral effects suggest it borders on being a weapon of mass destruction (WMD), like chemical or biological weapons.³² To attempt a rational adjudication of these widely divergent opinions, let us start by defining a weapon. A weapon is a tool that has utility in causing bodily harm or death to a human being or in damaging or destroying property. A rifle is a weapon, but so is a seemingly benign item such as broomstick, particularly when wielded as a club. Similarly, a computer used to cause damage or bodily harm is a weapon. To use these analogies further, force is the use of weapons to cause bodily harm, death, or destruction of property. Thus, if a soldier uses a computer to create harm or damage, or to do things that result in harm or damage as a foreseeable consequence, then a computer is both a weapon and an instrument of force. It is important to note that the harmful consequences in question are those which are foreseeable, not merely those which stem directly from the use of force.

The only conclusion, then, is that a computer used in a manner that may cause foreseeable injury or destruction is a weapon, and such use constitutes force. As with any other weapon, the effects determine both whether a computer is a weapon and whether it is a legitimate weapon. Some weapons, such as barbed spears and expanding bullets, are outlawed by treaty because they had features that increased the suffering of warriors without increasing military effectiveness. Today, the United States limits its use of nonguided gravity bombs to those locations where collateral damage is unlikely. Thus, restrictions on weapons stem from the amount of suffering produced as well as their accuracy.

The direct result of discriminate CNA on combatants is not to inflict more suffering. Destruction of command and control of forces may increase adversary casualties locally, but should also yield an overall military advantage leading to quicker defeat of the adversary and fewer casualties in the end. Except in the case of feigned surrender, the case of directly targeting computers affecting the care of wounded, or other acts of perfidy noted earlier, the incidence of combatant suffering will not increase. That said, can CNA really be considered discriminate?

Whether CNA is discriminate depends in large measure on the target, its connectivity, and the method of attack. From the above analysis, attacks on civilian electric infrastructures are indiscriminate due to the foreseeable suffering of the affected populations. The target's external connections affect discrimination, because the greater the connectivity (defined as both amount of external communications as well as number of potential or habitual connections the machine uses), the more likely the attack will reach unintended targets. Finally, the method of attack affects the discrimination of the attack. A simple denial of service attack on an e-mail server is likely temporary and only inconvenient to those affected. A pernicious virus implanted to replicate swiftly through both civilian and military networks is indiscriminate, indeed. In sum, like the gravity bomb, CNA is not inherently indiscriminate, but it may be used indiscriminately.

Implications of Nonlethality

Though regulated in a number of treaties, nonlethal weapons are not by nature either illegal or immoral. Returning momentarily to the analysis of the computer as a weapon, we see that the effects of a weapon determine its nature, not the weapon itself. Nonlethal weapons are legal with respect to jus in bello if the effects of the weapon are not long term, debilitating, or irreversible. Conversely, attacks with permanent collateral effects are illegal.³³ Nevertheless, the above argument showed that even nonlethal weapons may cause unintended, nevertheless foreseeable lethal effects. Even absent from these higher order effects, there are several implications that govern the consideration to employ nonlethal weapons in general and CNA in particular.

The first of these considerations deals with the potential for increased use of nonlethal weapons. If the political cost of an attack is less with a nonlethal (or easily denied) attack, policymakers may use such means more frequently, and sometimes without considering the ethical consequences. Preemptive strikes might become more politically palatable, thus increasing the chances for intervention without thorough debate of the consequences.³⁴ Employing CNA may blur the distinction between peace and war, as some in the media have suggested.³⁵ Accordingly, lacking the "protective" rubric of the just war convention, CNA, like other interventions, boils down to simple criminal intrusions or acts of terrorism.

Conclusions

Examining CNA leads to four major conclusions. These suggest a "way ahead" for those concerned with its employment and its policy. These are:

*  CNA is an act of force.

*  CNA is not, by itself, morally wrong. Its moral implications derive from its context, particularly the target and the method of attack.

*  While parallels exist with both conventional weapons and WMD, CNA occupies a unique niche as an electronic means of mass disruption (EMMD).

*  There is a need for new conventions of international law to deal with EMMD.

First, CNA is clearly an act of force. The examples of attacks on the relatively isolated military command system and the attack on the electrical power grid illustrate this assertion. In both cases, physical destruction and bodily harm are foreseeable results. Whether employing CNA at the operational or strategic levels, combatants must consider their actions as carefully as if they were employing a cruise missile.

Second, the context of the computer attack determines its moral or ethical quality. The weapon itself is morally neutral. The three-step test used by U.S. Navy Judge Advocates in evaluating the legality (morality) of nonlethal weapons demonstrates this. These are: "1) Would the weapon cause suffering that is needless, superfluous or disproportionate to military advantage? 2) Can it be controlled to strike only a lawful target and be discriminate? 3) Do rules or laws exist that prohibit its use?"³⁶ When applied to computer network attacks, clearly the context rather than the weapon determine the answers to these questions. Importantly, depending upon that context, the answer to all three questions may be "no." Accordingly, CNA is morally neutral.

Third, the effects of CNA are potentially so varied with respect to bodily harm, permanence, and extent that there are no parallels in conventional weapons or WMD. They are "nonlethal," yet their higher order effects may potentially cause widespread suffering and even deaths. The duration of their effects may be transient and have only nuisance value. Conversely, they are potentially as permanent as that expected from explosive weapons. If a WMD is defined as a weapon that has widespread effects from a relatively small weapon, then a self-replicating computer virus is a WMD. However, if those effects must include bodily harm, then an entirely new debate must ensue, depending upon the targets and the effects of the virus. Because they defy categorization, CNA must be considered an electronic means of mass disruption (EMMD)

Finally, following from this conclusion, nations must undertake continued dialogue to regulate both computer crime and computer warfare, and to differentiate between the two. Such dialogue should advance on two fronts: First, what target effects should be outlawed because they represent suffering of noncombatants? (Attack on electric power grids comes immediately to mind.) Second, what targets should be outlawed because the effects of their destruction are unknown or unpredictable, but foreseeably would result in suffering? Perhaps, as some have suggested, mankind must redefine its definition of "hostile act,"³⁷ and even attempt a redefinition of war itself.

Proposed Policies

The main points of a national computer network attack policy must both serve the national interests of the United States and meet ethical standards. The mainstays of such a policy are deterrence and the right of first use. For use by the military, considerations of jus in bello are required in operational concepts and joint doctrine.

To promote deterrence, national policy must be flexible enough to allow the United States to respond to computer attacks by criminals working for monetary gain, terrorists striving for political gain, and nation-states conducting information warfare. This policy must be backed by technology overmatch sufficient to determine the source of attacks and intelligence collection capabilities robust enough to determine the actors. Like many terrorist or criminal acts today, attacks will be difficult to trace, and perpetrators will be difficult to bring to justice, unless international cooperation improves with increasing concern about computer attack. In the case of nation-states, the United States must clearly state its position concerning retaliation. In practice, retaliation may be actions in kind or conventional retaliation marked by a consideration of consequences proportional to the original attack. Only by clearly stating these policies can the United States justify its retaliation. Thus, a clearly stated policy is key to deterrence.

The United States should also enunciate a policy preserving the right of first use of computer network attack. In addition to stating that this weapon is part of the U.S. arsenal in wartime, the policy should include the considerations for its use, and these considerations must rest firmly on jus in bello. Outside use in wartime, such a policy would require a presidential finding and congressional approval for CNA use in covert and clandestine national security operations.³⁸ Clearly stating such a policy may quell debate following first use. More importantly, it may convince other nations that any collateral damages are unintended side effects, rather than brutish, illegal violence. A convincing argument backed by a policy stated a priori will limit escalation of a crisis. Finally, such a policy will open debate with the Russian Government, whose representatives have branded CNA as a form of WMD, which they promise to answer with unspecified WMD countermeasures.³⁹

Like national policy, the concepts of employment must clearly rest upon the principles of just war theory. Current technology, while sophisticated, must not constrain these concepts; rather the concepts must drive research and development to meet conceptual needs. Such research must be directed toward improving intelligence collection capabilities and, importantly, making CNA weapons ever more precise and discriminate. While CNA may someday be suitable for stand-alone employment, that may be well in the future. Therefore, operational concepts using CNA as an adjunct or supporting capability are in order. The laws of warfare still apply, however. Even in the context of supporting a psychological operation, a larger information campaign, or a conventional strike, use of CNA in a treacherous or perfidious manner is morally wrong. Joint doctrine must make the considerations of jus in bello clear to planners and commanders who will use these potentially powerful weapons.

Summary

Just as increasing dependence upon sea trade brought pirates and navies to the oceans, increasing reliance on the microchip and communications networks will attract criminals, terrorists, and nations seeking advantage. As Royal Navy control of the seas drove the prosperity and expansion of Great Britain in earlier centuries, control of the computer dimension holds great promise for the United States. The United States must craft its policies relating to this new dimension carefully. Such policies will determine whether the information highway becomes a lawless, crime-ridden place where no one is safe, or an orderly and productive tool of economic expansion. These policies will drive our development of capabilities to police this dimension, as well as our ability to defend national interests there. The success of our policies will rest to a large measure on the extent to which they incorporate considerations of jus in bello.

Notes

1.  Thucydides, History of the Peloponnesian War, trans. Rex Warner (Harmondsworth, U.K.: Penguin Books, 1972), 80. [Back]

2.  James Adams, "Information Warfare: Challenge and Opportunity," USIA Foreign Policy Agenda, November 1998; available from <http://www.usia.gov/journal/itps/1198/ijpe/jp48adam.htm>; Internet. Accessed October 4, 1999. [Back]

3.  This has been expressed in Presidential Decision Directive (PDD) 63, forming a Critical Information Assurance Organization within the Federal government. See William J. Clinton, White Paper: Presidential Decision Directive 63, Critical Infrastructure Protection (Washington, D.C.: The White House, May 1998). Also available from <http://www.fas.org/irp/offdocs/pdd-63.htm>; Internet. Accessed October 10, 1999. [Back]

4.  John Arquilla, "The Great Cyberwar of 2002," Wired, February 1998, 160. See also Robert T. Marsh et al., Critical Foundations: Protecting America's Infrastructures (Washington, D.C.: The President's Commission on Critical Infrastructure Protection, October 1997), 8. [Back]

5.  James Adams, The Next World War (New York: Simon and Schuster, 1998), 1. The entire of chapter one is a fictional account of an "elegant" information campaign against a peer competitor in the year 2010. [Back]

6.  Doug Richardson, "Hacker Warfare: Threat of the Future?" Armada International, August-September 1997, 64. [Back]

7.  Elizabeth Becker, "Pentagon Sets Up New Center For Waging Cyberwarfare," The New York Times, October 8, 1999, A16. See also John Markoff, "Military Breaks the Rules of Military Engagement," The New York Times, October 17, 1999, L5. [Back]

8.  Richardson, 72. [Back]

9.  David Harrison and Damien McElroy, "China's Military Plots 'Dirty War' Against the West," London Sunday Telegraph, October 17, 1999, 1. [Back]

10.  John Diedrich, "Star Wars in Cyberspace," Colorado Springs Gazette, 15 January 2000, available from <http://ebird.dtic.mil/Jan2000/s20000124cyberspace.htm>; Internet. Accessed January 24, 2000. [Back]

11.  Joint Pub 3-13, Joint Doctrine for Information Operations (Washington, D.C.: Department of Defense, October 9, 1998), I-9. [Back]

12.  RAND Corporation, "Information War and the Air Force: Wave of the Future? Current Fad?" March 1996; available from <http://www.rand.org/publications/IP/IP149/>; Internet. Accessed September 28, 1999. [Back]

13.  Paul Christopher, The Ethics of War and Peace: An Introduction to Legal and Moral Issues (Englewood Cliffs, N.J.: Prentice Hall, 1994), 201. [Back]

14.  Bruce Bigelow, "CYBERWARRIORS: Pentagon's New Priority: Train troops to cripple computers--and enemy forces they control," The San Diego Union-Tribune, August 13, 1995, A-1. [Back]

15.  Joy Gordon, "A Peaceful, Silent, Deadly Remedy: The Ethics of Economic Sanctions," Ethics and International Affairs 13 (1999): 124-5. [Back]

16.  Samuel B. Griffith, Sun Tzu: The Art of War (London: Oxford University Press, 1963), 76. [Back]

17.  Christopher, 9. [Back]

18.  Charles L. Cornwall, ed. The Joint Staff Officer's Guide, Armed Forces Staff College Publication 1 (Norfolk, VA: Armed Forces Staff College, 1997), 6-15. [Back]

19.  Joint Pub 3-13.1, Joint Doctrine for Command and Control Warfare (C2W) (Washington, D.C.: Department of Defense, February 1996), I-4. [Back]

20.  Christina J. M. Goulter, "The Ministry of Economic Warfare and Royal Air Force Strategy During the Second World War" (Carlisle, PA: U.S. Army War College, 1991), 7. [Back]

21.  United States Army Air Corps, Summary Report: The United States Strategic Bombing Survey (European War) (Reprint) (Maxwell Air Force Base, AL: Air University Press, 1987), 19. [Back]

22.  One such structure is located on the north end of Würzburg on the Main River. [Back]

23.  Thomas A. Keaney and Eliot A. Cohen, Gulf War Air Power Survey (Washington, D.C.: Department of the Air Force, 1993), 297-298 and 302. [Back]

24.  J. W. Crawford III, "The Law of Noncombatant Immunity and the Targeting of National Electric Power Systems," Fletcher Forum of World Affairs (Summer-Fall 1997): 101. [Back]

25.  Ibid., 103. [Back]

26.  "Tactical Bombing of Iraqi Forces Outstripped Values of Strategic Hits, Analyst Contends," Aviation Week and Space Technology, January 17, 1992, 62-63. [Back]

27.  Ibid. [Back]

28.  Crawford, 105. [Back]

29.  Ibid., 110. [Back]

30.  Hector Tobar and Miles Corwin, "Outage Shows Technology's Fragile Links," Los Angeles Times, August 13, 1996, A1. [Back]

31.  Roger W. Barnett, "Information Operations, Deterrence, and the Use of Force," Naval War College Review 51 (Spring 1998): 17. [Back]

32.  Byard Q. Clemmons and Gary D. Brown, "Cyberwarfare: Ways, Warriors and Weapons of Mass Destruction," Military Review (September-October 1999): 42. [Back]

33.  Margaret-Anne Coppernoll, "The Nonlethal Weapons Debate," Naval War College Review 52 (Spring 1999): 123. [Back]

34.  Douglas C. Lovelace, Jr., and Steven Metz, "Nonlethality and American Land Power: Strategic Context and Operational Concepts" (Carlisle, PA: Strategic Studies Institute, 1998), 12. [Back]

35.  John Markoff, "Cyberwarfare Breaks the Rules of Military Engagement," The New York Times, October 17, 1999, L5. [Back]

36.  Coppernoll, 118. [Back]

37.  Frederick W. Kagan, "Star Wars in Real Life: Political Limitations on Space Warfare," Parameters 28 (Autumn 1998): 116. [Back]

38.  Barnett, 16. Also, Clemmons and Brown, 44. [Back]

39.  Clemmons and Brown, 40. [Back]