Government Industry
The Palestinian-Israel: cyberwar
Military Review, March-April, 2003 by Patrick D. Allen, Chris C. Demchak
Some nations have chosen to assign Web security to the government, especially in nations where the Internet is considered a threat to the government's absolute control, such as in China. Most European nations are passing laws that place the government as the central guarantor of Web security. As economies and communications rely more on the Internet, nations will make choices that place them somewhere along the spectrum of security versus privacy. In most cases, laws will ensure the security of the Web at the cost of personal privacy. (41) The United States will need to decide where on this spectrum it will operate and what level of cyber security it will need to provide to support secure transactions and a measure of privacy.
Legal response to rapid horizontal escalation. The higher a cyber conflict's visibility, the more it will attract international hackers, and the sooner hackers will seek out vulnerable sites. What are the legal options of a nation attacked in a conflict in which it is not involved? For a legal response, the identity of the perpetrator must be established. However, cyber attacks are not launched frequently by a nation, but by private citizens. It is difficult to justify a retaliation bombardment against hackers who violate their own nation's neutrality or allegiance with an attacked country. Hacking is an asymmetric threat from nonstate actors that makes justified retaliation difficult.
Little can be done in cyberspace to admitted hackers because they do not present a ready target. Individual hackers or hacker groups do not tend to own infrastructure that can be targeted, even in cyberspace. When such infrastructure exists, getting legal access to it is difficult because of national sovereignty. For example, when the United States performed a sting operation against two Russian hackers, issues of due process arose because of the FBI's long-distance electronic search of the hacker's computers in Russia. (42) Any response must consider the possible collateral damage potentially caused by such retaliation. Since hackers tend to route their attacks through many third-party servers, any cyber retaliation must consider the fact that the counterattack might fall on the servers of innocent bystanders.
Overall, nations need to define their legal authority to exercise sovereignty, prosecute, and impose penalties on hackers convicted of cyber attacks. International agreements not to harbor hijackers contributed to a significant decrease in such events. Similar international agreements regarding cyberspace crime could help reduce the sanctuaries available to hackers.
Legal responsibility. Every nation must face the fact that its citizen hackers can cause international incidents not in its best interest. Israel was dragged into a cyber conflict by its own teenage hackers, not as a government decision. Israel was not prepared to wage a cyberwar and was more vulnerable than its opposition.
Cyber violations of online externally connected networks lie in a gray area of international and domestic security laws. To locate and prosecute hackers, nations must rely on the authorities and laws of the hacker's host nation. Israel estimated that damage caused by the globally distributed "Love" virus, including the disruption of national cellular phone companies, reached $12 million. However, Israel could not file criminal charges against the hacker because his home country (the Philippines) did not make virus writing a criminal offence until after the event. (43)