Even as South Korea was picking up the pieces after an electronic attack which affected 32,000 computers,the term cyber warfare finally gained legitimacy this week. A newly published NATO manual recognised it as a formal mode of hostility and sought to place it in the legal framework that conditions international conflict. The Tallinn Manual: International Law Applicable to Cyber Warfare is not an official document. It reflects the opinions of 20 researchers and practitioners in international law,but it was commissioned by NATO through its Cooperative Cyber Defence Centre of Excellence in Estonia. It is the beginning of a deliberative process which should eventually produce an electronic version of the Geneva Conventions.
Publishing the manual from Estonia is extremely appropriate,since it has been the target of massive electronic attacks. In the spring of 2007,a controversy had broken out with Moscow over a World War II commemorative statue called the Bronze Soldier of Tallinn. Moscow saw itself as the liberator of the city. The city did not readily recall the alleged liberation and the issue boiled over into a riot called Bronze Night,which gained international attention. In retaliation,Russia launched cyber attacks crippling Estonian media,banks,the government and the legislature. It was the most significant state-sponsored weaponisation of the internet after Titan Rain,the allegedly Chinese attack on US networks that began in 2003.
For a form of aggression that is so widely used,however,cyber warfare has lacked definition. It is reported in breathless newspaper articles that glamorise it as an electronic Wild West rodeo. It isnt. It is deadly serious business mandated by governments and executed by trained workers within the government and the military and by the contractors who sell services to commercial spammers. Without definition,it could not be retrofitted into the rubric of war between nations.
The Tallinn Manual breaks new ground by focusing on effect rather than agency. It does not matter if an enemy drops a bomb on a dam a strategy used by the UK to cripple the industries of the Ruhr in World War II or hacks into its control systems to open the sluice gates. If civilians are swept away in the resulting flood in the river valley,it is a crime either way.
But the manual has only started a conversation. At the most,it can be presumed to have laid down the ground-rules for NATO to engage in cyber warfare. And high time,since NATO appears to have gone beyond cyber defence. The Stuxnet worm,which slowed down Irans fuel enrichment programme by damaging centrifuges,was quite obviously of Western provenance.
Many issues will remain unresolved. For instance,there will be differences over where to draw the line when does an intrusion become an act of war? Is it when bodily harm is caused to citizens? Or,in a crowded world where nations fight desperately for resources and markets,is the possibility of economic harm sufficient provocation? In that case,is snooping on economically sensitive information sufficient provocation for forceful retaliation? Which offers more credible provocation,passive snooping or active intervention,such as putting down a banking network,an event that South Korea has seen this week?
While Tallinn has tried to bring cyber attacks within the format of conventional warfare,certain elements resemble irregular conflict. The distinction between combatant and civilian is problematic,since the same person may be both. Almost all the people who develop and rent out software and botnets for intrusion and attacks are civilians and may be resident in third countries. Are they legitimate military targets?
Answers to these questions have been overdue for a decade. Now,the publication of the Tallinn Manual marks the beginning of a process of definition. It has applied the basic principles of the law of war to electronic warfare jus ad bellum and jus in bello,which define when nations may resort to war and how they should conduct themselves. But the 215-page booklet is only NATOs view on the matter. The other side remains to be heard.
pratik.kanjilal@expressindia.com
