Going Viral: Cyber Warfare and the Ethic of Cooperation

Despite comprehensive efforts to pre-emptively determine how the law of armed conflict (LOAC) should apply to cyber warfare, such as the Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations (2017), attempts to regulate cyber warfare or to keep cyber attacks from escalating into traditional war will be ineffective without shared understanding between enemies about a fundamental question: Is “cyber warfare” just a catchy slogan — like the “war on poverty” or “war on Christmas” — or is it actually warfare?

Human history is, in some ways, the story of trying concurrently to wage and tame war, and cooperation between enemies even as they are trying to kill each other is as common as it is surprising. The history of technological development in warfighting, in turn, is the history of trying to put distance between oneself and one’s opponents, and cyber warfare is only its latest manifestation. 

Cyber attacks with non-physical purposes are difficult to classify. Sabotaging power grids in a civilian area to cause chaos and fear will foreseeably also kill many when, for example, essential equipment in hospitals and nursing homes loses power. This could be considered a terroristic wartime act under the narrower definition of war.

What if the same cyber act — sabotaging utility supply — is targeted in a way that damages only the economy by disrupting transportation and associated logistics, which then costs billions of dollars in immediate and associated losses in industrial and commercial activity as well as insurance claims? What about even more abstract cyber sabotage, such as manipulating stock-market transactions? Should these attacks be treated as acts of war?

The less physical the sabotage or denial-of-service and its effects, the harder it is to classify it as “war” in the narrow sense. Yet, these actions undeniably strike at a country’s ability to project power. Should the concept of warfare be stretched to include contemporary cyber conflict? It is critical to examine how cyber activity should be classified because warfare is governed by a special set of international laws and norms, including but not limited to the LOAC.

The ethic of cooperation between enemies in warfare

Adversaries at war often cooperate with one another — and not just by allying with “the enemy of my enemy” for the moment. Rather, adversaries will cooperate even as they are trying to kill one another, including in ways that make it harder for them to win.

Cooperation can be ad hoc, regulated by informal practices or formal laws and treaties within and between states, or built into the structure of warfare via international law and institutions, such as non-combatant immunity, equal medical treatment, and requirements for prisoner-of-war (POW) treatment.

Sometimes, enemies at war cooperate in order to better kill each other, for example, only in ways mutually deemed “fair” such as by restricting the use of chemical and biological weapons. Sometimes, they cooperate on upholding principles of civilian and medical immunity to avoid killing the wrong people while trying to kill each other. Cooperation arises from various motivations, including reciprocity, self-preservation, and efficiency, but also warrior honor, humanitarianism, and human rights.

The benefits of cooperation come at a cost, however. “Fair fight” practices are not extended to everyone, and warfighters will exclude categories of people they deem unworthy. Half-god Achilles mutilates Hector’s body after killing him because he does not consider Hector his peer. Every civilization has treated “barbarians” according to different standards, and more recently, the US government classified terrorists as “illegal enemy combatants” to deny them POW protections. Well meaning motivations for cooperation can also have tragic unintended consequences, such as when “humanitarian pauses” inadvertently prolong a conflict by giving combatants time to rearm.

Battlefield boundaries

Cooperative norms and laws also govern the boundaries of warfare including not only the question of who qualifies as a legitimate warfighter but also which political entities are legitimate and where the battlefield is. Dominant conceptions, however, are constantly contested — by non-state actors or targeted killings, for example — and will be further challenged by cyber warfare’s non-physical nature.

Sustainable equilibria will not exist without agreement on the nature of the activity — even wars need norms so that everyone at least knows what determines who won and what is won. This has been especially important since the 18th-Century European jus victoriae (law of victory), which states that the outcome of pitched battle determines who and what is won, is no longer readily accepted, as questions of right have returned to the fore and war is now expected to rectify injustices. Pitched battle remains influential because it confers the imprimatur of decisiveness. Even Mao Zedong, who advocated continuous guerrilla warfare, propaganda and political work, argued that ultimate victory required the “concentration of troops” in pitched battle. 

While winning a battle is still considered necessary, it is however no longer sufficient for coercing the loser’s acceptance. Yet, war can only determine effective right; it cannot resolve questions of justice and morality. The resulting disequilibrium about the meaning of war will only be exacerbated by cyber warfare. 

Is “cyber warfare” actually war?

Ambiguity about any particular cyber attack’s motive or meaning could lead to only one party thinking it is at war, while the other does not. What difference would that make? “War” and “not-war” are regulated by different laws and norms on a breadth of issues, including who the legitimate participants are, who may be legitimately targeted, how prisoners should be treated, what constitutes a proportional and reasonable response, and what is required to win.

For example, if a particular cyber attack is an act of war, then its perpetrators are warfighters, covered by the Geneva Conventions. If not-war, then perpetrators are criminals, and subject to domestic law, bilateral treaties, and limited international law.

If it is war, ironically, the scope of legitimate targets is more restricted, to fellow warfighters, and civilians cannot be intentionally targeted. If not-war, then it is merely a crime and can target anyone.

If it is war, then the attack can be met with a physical response – and a disproportionate one – which will quickly descend into “kinetic” war. If not-war, states would be expected to respond with in-kind or proportional responses to avoid escalation into warfare. If a state were confident of winning a physical war, however, it might repeatedly walk right up to the line of “war” and hope that the enemy (intentionally or accidentally) crosses it first.

Cyber attacks can also be used to wage a limited conflict to avoid the costs of physical war while harming the enemy. Without mutual understanding of whether a cyber conflict is war or merely geopolitical “competition”, however, it can quickly escalate into physical war.

Establishing relatively stable equilibria of categories, norms, and regulations on responsibilities, restraint, and reasonable responses will be necessary to keep cyber conflict from escalating into physical war when that is the intent of both parties. Furthermore, to terminate wars successfully, there must be mutual understanding and cooperation between enemies on the form, processes, and meaning of cyber war, and the implications of “battlefield” victory. Only when opponents share a conception of the nature of the activity and its parameters can there be stable endings to wars. Otherwise, losers will not accept their loss as legitimate, and the conflict will be repeatedly revisited and, sooner than later, contested again.

Fighting to a sustainable equilibrium

Some top-down imposition of categories, ethical norms, and legal restrictions is possible, but successfully aspirational norms and laws, including the Geneva Conventions, also draw from existing practices that people have bought into over time. War is a constructivist activity and some portion of its principles can only be hammered out – collectively, cumulatively, and largely unintentionally – by fighting over it. Ironically, only through fighting will we gather enough information about the phenomena, consequences and secondary effects of cyber attacks to categorize its varieties adequately.

As with air warfare that does not entail much direct contact between opponents, it will be difficult – although not impossible – to develop stable norms from a distance. At the very least, cyber warfare will generate the same charges of “unfairness” that plague targeted drone killings. When targeted properly, “smart” weapons can reduce risk to one’s own forces and collateral damage to civilians – they can be more precise than sending in ground troops for street sweeps, for example. Nonetheless, better targeting is controversial. As targeting capacity improves, expectations of fewer civilian casualties rise. Even if proportionally fewer civilians are killed, the modern scale of war kills more civilians in absolute terms, and the glaring gap between expectations and targeting’s actual capability makes it appear as if things have gotten worse.

At the same time, many people view advanced targeted weaponry with ambivalence and suspicion, in part because it runs afoul of the notion of a “fair fight”.  Historical hatred of snipers (including by their fellow servicemen) stems from their relatively safe position: Snipers do not run the same risks as others when they kill, and their targets have no opportunity to fight back against this particular attack. How both soldiers and civilians die makes a difference in how people perceive those deaths. Great disparity between the technological capabilities of opponents only heightens the sense of unfairness, such as when drone pilots are safely ensconced 7,000 miles away from the battlefield or with the absence of a physical component in cyber attacks.

Cyber activity raises the same questions as targeted killings with drones: What is a battlefield? When is one in a zone of combat? Should war be confined to the battlefield, and when can one legitimately kill off it? Who is a legitimate target, and under what circumstances?

Cyber activity also raises its own distinct questions: Can non-physical conflict alone count as war? Can one really win a war without using force? The ideal of war in the Seven Military Classics – winning without fighting – is improbable. No society completely collapses without some fighting. Even the careful detonation of a building to collapse inward will throw off some flyrock, and even states and empires that crumble in decay fight on the way down. The same human nature that counterintuitively makes possible cooperating with the enemy while trying to kill him will also not accept defeat in war without at least putting up a physical fight in the end.