…are on the internet:
Today’s cyber world is akin to medieval Europe. International law grew out of fear of endless retribution and the need for order. Later in the Cold War, treaties and hot lines emerged from the Berlin and Cuban missile crises. Again, frightful experience led to deterrence and restraint. Current efforts to build sweeping cyber-policy will fail because the sequence is wrong. Leaping to a legal framework is futile without first understanding the realpolitik cyber-rules, definitions, and various red lines. It is simply too early to build a global consensus for the problem.
We do not know because we don’t have sufficient precedents. We don’t strike back. We don’t impose a direct and immediate cost on those we believe are attacking us. Instead, we gnash teeth over possible unintended consequences, collateral damage, escalations, and violations of treaties with dubious and unclear applicability to the cyber-world.
Applying “real world” law by analogy is inherently inadequate.
Is cyber-espionage acceptable or an act of war? Is crashing an electrical grid a “use of force?” Is disabling a firewall trespassing espionage, or an attack? The technical differences are almost indistinguishable.
This is not news in the sense that China has been hitting and hitting us for a very long time. Third world nations have used cyber fraud to enrich their citizens and have provided protection (likely for a cut) to these bandits.
China itself has it’s own vulnerability issues, just next door is a country full of first rate programmers that has no love for China.
I think rules are pretty useless since there is no incentive for China or Russia or Nigeria to respect them. The best move is to frankly is to shore up our own defenses and strike back in kind, there are plenty of non government hackers in the US who wouldn’t mind a challenge. When their systems are being hit in the same way. Then you have an incentive to make and enforce good law.
It’s going to be pretty much a cyber cold war.
