In terms of a new North Atlantic Treaty Organisation (Nato) handbook, cyber war is no longer just the subject of science fiction but reality. It also sets out a legal framework for the frightful prospect of a response, or even a pre-emptive strike, with conventional weapons. Most, if not all, nations are woefully unprepared for this.
This handbook, called the Tallinn Manual after the Estoniancapital where it was compiled under the leadership of US military lawyer, Michael Schmitt, says a cyber attack can be defined as one that is “reasonably expected to cause injury or death to persons or damage or destruction to objects”.
Ironically, the implication of this definition is that the alleged US cyber attack on Iran's uranium enrichment programme in 2010, with the Stuxnet computer worm, could be regarded as an illegal "act of force". Under international law, it would give Iran the right to retaliate.
The implications take on further ominous dimensions against a background of a US military declaration,two years ago, “that anyone who attempted to shut down the electric grid in the world's most powerful nation with a computer worm, could expect to see a missile in response.”
In September last year the Washington Post reported that the US State Department's legal adviser said "... cyber attacks can amount to armed attacks triggering the right of self-defence and are subject to international laws of war.
"Spelling out the US government's position on the rules governing cyber warfare, Harold Koh ... said a cyber-operation that results in death, injury or significant destruction would probably be seen as a use of force in violation of international law.
"In the US view, any illegal use of force potentially triggers the right of national self -defence.”
Warning against this line of reasoning, also in the Tallinn Manual, Claus Kress, an international law expert and director of the Institute for International Peace and Security Law at the University of Cologne, sees it as "setting the course" ahead with "consequences for the entire law of the use of force".
Important legal thresholds, which in the past were intended to protect the world against the military escalation of political conflicts or acts of terror, are becoming "subject to renegotiation," he said.
The most critical issue is the "recognition of a national right of self-defence against certain cyber attacks." This corresponds to a state of defence, as defined under Article 51 of the Charter of the United Nations, which grants any nation that becomes the victim of an "armed attack" the right to defend itself by force of arms.
This article gained new importance after September 11, 2001, when the US declared the invasion of Afghanistan an act of self-defence against al-Qaida and Nato proclaimed the application of its mutual defence clause to come to the aid of the superpower, he warned.
How dangerously hazardous this new war battlefield can become was clearly illustrated by events leading up to the present North Korean crisis. Just about coinciding with the US intelligence community telling the Senate Select Committee on Intelligence in its annual Worldwide Threat Assessment, that the possibility of cyber attacks has become one of the biggest threats to US national security, big networks in South Korea went down.
Reports of a coordinated cyber attack on South Korean banks and national broadcasters, causing an unexplained halt to their computer networks, immediately raised suspicions that the attack originated in North Korea.
The United Kingdom’s Daily Telegraph saw it as “yet more evidence that nation state attacks are increasing in their prevalence”.
The paper also reported that a recent study by the Korea Internet Security Centre warned that North Korea was in the process of training a team of hackers, armed with highly advanced and targeted malware, to undertake a devastating attack on the South’s critical infrastructure.
There is a possibility that the attack was part of North Korea’s flexing of muscles, as we reported last week (please link to last week’s article) to strengthen its bargaining position vis a vis the US and South Korea. But it soon emerged that there is no certainty about the origin of the attack and investigations are ongoing.
At one stage, according to some reports authorities (in South Korea) wrongly reported “a possible North Korean malware attack, supposedly originating in China, (while it) actually came from within South Korea itself”.
Other suspected origins quoted in reports included Europe and the US, leading to a number of conspiracy theories that the South and/or the US, launched a 'false flag' operation to create a pretext for an attack on North Korea.
These theories might well be over the top but it is clear that at this point there is plenty of room for dangerous misunderstandings and/or mistakes.
While it appears that first and second world countries are beginning to wake up to the realities of the evolving cyber space threat landscape and the wave of nation state attacks, a globally recognised code of conduct in cyber space has not yet been established. There are not even clear definitions of cyber espionage and cyber warfare in place.
As Der Spiegel puts it, “The volume of cyber attacks is only likely to grow. Military leaders in the US and its European Nato partners are outfitting new battalions for the impending data war. Meanwhile, international law experts worldwide are arguing with politicians over the nature of the new threat. Is this already war? Or are the attacks acts of sabotage and terrorism? And if a new type of war is indeed brewing, can military means be used to respond to cyber attacks?”
In the case of the South Korean incident, some analysts, on the basis of relatively simple malware used, suspect it came from politically motivated private individuals in North Korea.
The question arises just who South Korea should target with a counterattack. Against this background, Kress remarked that lawyers might soon have a "new unsolved problem" to argue where there is "war on the basis of suspicion".
Except for the possibility that such a scenario could potentially trigger a deadly global war, also involving conventional weapons, it might have been regarded as a somewhat comical situation.