[Paper Review] Internet Attacks: A Policy Framework for Rules of Engagement

William Yurcik, D. Doss|ArXiv.org|Sep 24, 2001

Network Security and Intrusion Detection4 references3 citations

TL;DR

This paper proposes a policy framework for rules of engagement in response to cyberattacks, analyzing legal, strategic, and operational challenges in the context of international law and national security. It outlines four key recommendations: defining 'force' and 'armed attack' in cyberspace, enabling international cooperation in investigating and prosecuting attacks, balancing offensive and defensive cyber capabilities, and developing pre-planned strategic responses to avoid reactive decision-making during crises.

ABSTRACT

Information technology is redefining national security and the use of force by state and nonstate actors. The use of force over the Internet warrants analysis given recent terrorist attacks. At the same time that information technology empowers states and their commercial enterprises, information technology makes infrastructures supported by computer systems increasingly accessible, interdependent, and more vulnerable to malicious attack. The Computer Security Institute and the FBI jointly estimate that financial losses attributed to malicious attack amounted to $378 million in 2000. International Law clearly permits a state to respond in self-defense when attacked by another state through the Internet, however, such attacks may not always rise to the scope, duration, and intensity threshold of an armed attack that may justify a use of force in self-defense. This paper presents a policy framework to analyze the rules of engagement for Internet attacks. We describe the state of Internet security, incentives for asymmetric warfare, and the development of international law for conflict management and armed conflict. We focus on options for future rules of engagement specific to Information Warfare. We conclude with four policy recommendations for Internet attack rules of engagement: (1) the U.S. should pursue international definitions of "force" and "armed attack" in the Information Warfare context; (2) the U.S. should pursue international cooperation for the joint investigation and prosecution of Internet attacks; (3) the U.S. must balance offensive opportunities against defensive vulnerabilities; and (4) the U.S. should prepare strategic plans now rather than making policy decisions in real-time during an Internet attack.

Motivation & Objective

• To address the growing threat of cyberattacks on critical national infrastructures and commercial systems.
• To analyze the applicability of international law, particularly the use of force and self-defense, to cyber operations.
• To develop a structured policy framework for rules of engagement in information warfare.
• To guide U.S. strategic decision-making in cyber conflict by recommending proactive policy development.
• To balance offensive cyber capabilities with defensive vulnerabilities in national security planning.

Proposed method

• The framework is built on analysis of existing international law, particularly the UN Charter and the concept of 'armed attack' as a threshold for self-defense.
• It evaluates the state of Internet security and the incentives for asymmetric cyber warfare by non-state and state actors.
• The approach integrates insights from computer security, national security policy, and international relations theory.
• It applies a policy analysis model to assess options for rules of engagement specific to cyber conflict.
• The method includes identifying key policy gaps and proposing actionable recommendations based on strategic and legal considerations.
• It emphasizes the need for pre-emptive strategic planning rather than real-time crisis decision-making.

Experimental results

Research questions

• RQ1 What constitutes an 'armed attack' in cyberspace under international law?
• RQ2 How can international law be adapted to govern state and non-state cyber operations?
• RQ3 What are the strategic and operational implications of offensive versus defensive cyber capabilities?
• RQ4 How can states cooperate in the investigation and prosecution of cross-border cyberattacks?
• RQ5 What policy frameworks can enable timely and lawful responses to cyber incidents without escalating conflict?

Key findings

• Financial losses from malicious cyberattacks were estimated at $378 million in 2000, highlighting the growing economic threat.
• Not all cyberattacks meet the threshold of an 'armed attack' under international law, limiting the justification for self-defense.
• The U.S. should pursue international definitions of 'force' and 'armed attack' in the context of cyber operations.
• International cooperation in joint investigation and prosecution of cyberattacks is essential for accountability and deterrence.
• The U.S. must balance offensive cyber capabilities with the risk of exposing critical infrastructure to retaliation.
• Strategic planning for cyber conflict should be developed in advance, not during an active attack.