A cyber attack that sabotaged Iran’s uranium enrichment program was an “act of force” and was likely illegal, according to research commissioned by NATO’s cyber warfare center. And really, it was only a matter of time before the international community came out and said this. What is particularly problematic here for the U.S. is that we’ve redefined our own grounds for war to include cyber attacks. In reality, I think the only reason U.N. hasn’t called the U.S. and Israel out for this yet is that Europe and Russia are even more concerned about a nuclear Iran than we are.
But I think there is a larger question here. If a virus is an act of force, if a cyber attack is an act of war, then where are the battle lines? Devastating viruses that have done billions of dollars in damages have been written by ‘lone hackers’. Scores of government agencies in every country have been hacked at one time or another. So who do we hold responsible for these attacks? That may sound like it should be an easy distinction to make, and in many western democracies it would be. But what about China? Western companies in the past couple of years have had persistent problems with Chinese hackers. A couple of these have been tracked back to the Chinese National Army, easy enough. But what about an attack by students at a University? It’s a government body. Who is responsible? What about if an attack was tracked back to a Chinese state-owned company? What if it was tracked back to a company that wasn’t state owned but where the state was a majority shareholder?
There is, of course, and upside and a downside here. The downside is obvious – another legal ground for war. But in the case of stuxnet, who knows what Israel and the U.S. would have done if a cyber attack wasn’t a viable option? I don’t know the answer, but it probably isn’t nothing. If the battle lines are moving online, perhaps the cost of war will be greater in treasure but less in blood. It’s tricky to talk of a ‘better’ war, but this doesn’t seem like it’s worse.
JOIN SSIT