With "Cyber" Attacks, Effects Matter More Than Means

I enjoyed reading Stuxnet Poses Interesting International Cyber Law Issues by Rick Aldrich in IAnewsletter Vol 14 No 2 (pdf). I've known the author since my days in the USAF and he's very clued-in as a CS grad from USAFA and a lawyer who worked for AFOSI. I'd like to share a few excerpts. Please try to avoid fixation on Stuxnet if that topic bothers you. Stuxnet is not the core of Alrich's argument.

Article 51 of the United Nations (UN) charter states in pertinent part, “Nothing in the present Charter shall impair the inherent right of individual or collective self-defense if an armed attack occurs against a Member of the United Nations.” [8]

So can a cyber attack, such as that evidenced by Stuxnet, constitute an “armed attack?”

Clearly at the time Article 51 was written, in August of 1945, such an attack was never envisioned. Traditionally the term “armed attack” has connoted a kinetic attack – missiles, bombs, bullets and the like – but it has never been definitively defined.

Incidents like the cyber attacks against Estonia in 2007 and against Georgia in 2008 have prompted renewed interest in defining if or when a cyber attack can also constitute an “armed attack.”

International legal scholars are increasingly moving away from the means of attack and instead looking to the effects.

The test would be whether the effects of the attack are similar to those of a kinetic attack.

Cyber attacks that result in physical damage, such as the destroyed centrifuges in the case of Stuxnet, may be pulled under the rubric of an armed attack, though this approach does not rule out attacks resulting in non-physical effects if the harm is substantial.

This is fascinating, because it makes "cyber" less relevant and requires judgement regarding the consequences of an event. Clearly physical harm takes precedence here, but the underlined portion shows that even digital events without physical harm could still be considered attacks, in the eyes of legal experts.

The article raises other interesting points, such as options for Iran, but I wanted to emphasize the points I listed above.

Tweet