Drone Strikes on Hackers?

If you’re the bad guy from “Skyfall” during a war, then yes, NATO commanders could very well destroy you.

<a href="http://www.shutterstock.com/pic-128551973/stock-vector-detailed-illustration-of-a-isometric-white-drone-airplane-with-bombs.html">aurin</a>/Shutterstock (drone); <a href="http://www.shutterstock.com/cat.mhtml?lang=en&search_source=search_form&search_tracking_id=BC2ECAF0-9733-11E2-85E9-D85F1472E43D&version=llv1&anyorall=all&safesearch=1&searchterm=hacker&vectors=on&search_group=&orient=&search_cat=&searchtermx=&photographer_name=&people_gender=&people_age=&people_ethnicity=&people_number=&commercial_ok=&color=&show_color_wheel=1#id=113976463&src=C6678732-9733-11E2-8C35-4BD4ACE6966E-1-13">Malchev</a>/Shutterstock (hacker)

Fight disinformation: Sign up for the free Mother Jones Daily newsletter and follow the news that matters.


If you’re a hacker living in your mom’s basement causing trouble for a world power, can NATO call in an air strike to put a stop to your cybermischief?

That was one question raised this month with the release of the Tallinn Manual on the International Law Applicable to Cyber Warfare, a NATO-commissioned handbook that could be the first step toward codifying the rules under which NATO members will wage cyberwarfare in future conflicts. The project had the input of the International Committee of the Red Cross and US Cyber Command.

The Tallinn Manual is not NATO doctrine; it is the result of a three-year project funded by the NATO Cooperative Cyber Defence Centre of Excellence and conducted by 20 legal experts working in a private capacity. The document could very well influence future rules of engagement for NATO and governments around the world. But for now, it’s a scholarly endeavor; a follow-up three-year project, which digs even deeper into questions pertaining to cyberoperations and state responses, is in the works.

The manual addresses a whole host of potential wartime issues, but the part that got the most attention starts on page 104. Here’s a screenshot:

Tallinn Manual civilian targets

ccdcoe.org

When details of the manual were first reported in the Guardian last week, the rule was widely interpreted as NATO declaring war on hackers and civilian hacktivists. But in terms of wartime precedent, there’s nothing unique about NATO’s “Rule 29”; civilians who directly participate in hostilities have long been deemed legitimate battlefield targets. So of course the same principle would apply to a hacker in an armed conflict, if the hacker’s actions rose to the level of violence. “If someone is causing planes to crash [in a war] using a computer, it’s not really all that different if they’re using a computer rather than some other tool,” Julian Sanchez, a Cato Institute research fellow specializing in technology and civil liberties issues, says. “So, sure; go after Alan Cumming,” referring to the actor’s character Boris Grishenko, a backstabbing and chauvinist computer programmer targeted by James Bond and the CIA in Goldeneye.

Despite the fairly mundane nature of the rule, Michael Schmitt, chairman of the international law department at the US Naval War College and director of the project that produced the Tallinn Manual, has been flooded with questions about whether NATO is now allowed to send drones to take out Anonymous hackers who they find annoying. “Frankly, I was surprised that part even caught anyone’s attention,” Schmitt tells me. “It’s been generating a lot of blowback. But I can assure you NATO is not going to launch jets to hunt down Anonymous members tomorrow. An unexceptional statement has been taken out of context in rather dramatic ways.”

Many of these rules would come in handy in a wartime scenario in which Live Free or Die Hard is happening in real life.

The main reason your average hacker doesn’t need to worry about getting blown up by NATO anytime soon is because the Tallinn Manual (which, again, is not official NATO doctrine) is relevant only to (a) an armed conflict or declared war between two states or (b) a civil war within a state. Rule 29 from the 282-page manual (which you can read here for free) addresses a scenario in which a civilian hacker starts working with one side of a conflict to, for instance, execute operations via cyberspace that would hack into enemy intelligence networks, disable command and control electronics, hinder combat capabilities, or harm or kill civilians. This establishes a high bar for what a hacker has to do to trigger an armed response from NATO commanders. And despite much recent hype about cyberwarfare from state actors (China, North Korea, Iran, Israel, etc.) and the growing costs of cybercrime, much of this NATO-commissioned handbook focuses on the abstract, simply because the realm of modern cyberwarfare is relatively new and has yet to be deeply explored. Many of these rules would come in handy in a wartime scenario in which Live Free or Die Hard is happening in real life.

“Cyberwarfare in the future will become a prominent part of the battlefield when prominent countries come to blows,” says Martin Libicki, an expert in cyberwar and senior management scientist at the RAND Corporation. “But for now, at least, you don’t just automatically send your drone in after hackers. That’s not the way it works. The worst people like Anonymous are doing nowadays is weapons of mass annoyance.”

There’s a real-world test case for this. In the summer of 2011, individuals identifying themselves as Anonymous claimed to have hacked NATO’s website, perhaps as indirect reprisal for the FBI’s arrest of over a dozen alleged hackers. Under current NATO structure, as well as recommendations made in the Tallinn Manual, such a breach would absolutely not warrant violent retribution. “Can you imagine Luxembourg, Estonia, the United States, France, and Spain, getting together and agreeing through the process that NATO demands, and going to the North Atlantic Council, and deciding to drop a bomb on some ordinary hacker?” Schmitt says, with a hint of irritation. “Are you kidding me?”

However, this is where the hypotheticals get a bit muddled. Suppose a civilian hacker who has taken sides in an armed conflict is waging cyberwar remotely from a neutral country. Suppose a terrorist used his or her MacBook Pro to sabotage a major city’s traffic lights in a time of peace, resulting in mass carnage? When discussing such hypotheticals, experts often point to analogous situations such as the bin Laden raid or modern drone warfare. But this is still all uncharted territory. “The real problem here is not whether the basic rules of war should apply when cyberspace is involved; the real problem here is that the rules of war have, for the most part, a long traditional of being defined through kinetic warfare and physical conflict,” Sanchez says. “But we’ve found that in some cases when we’ve tried to apply the laws and rules of war to cyberspace, that translation is not always so obvious.”

But as for the conspiracy theories sprouting up regarding the recently published Tallinn Manual, the situation isn’t murky. “If somebody defaces my or NATO’s desktop, that’s hardly direct participation in armed conflict, and NATO would not be allowed to resort to armed force,” Schmitt says. “It would make great TV, though—pure Hollywood.”

NATO did not respond to requests for comment, which I can only assume indicates they have already sent a drone to vaporize my laptop.

WE'LL BE BLUNT

It is astonishingly hard keeping a newsroom afloat these days, and we need to raise $253,000 in online donations quickly, by October 7.

The short of it: Last year, we had to cut $1 million from our budget so we could have any chance of breaking even by the time our fiscal year ended in June. And despite a huge rally from so many of you leading up to the deadline, we still came up a bit short on the whole. We can’t let that happen again. We have no wiggle room to begin with, and now we have a hole to dig out of.

Readers also told us to just give it to you straight when we need to ask for your support, and seeing how matter-of-factly explaining our inner workings, our challenges and finances, can bring more of you in has been a real silver lining. So our online membership lead, Brian, lays it all out for you in his personal, insider account (that literally puts his skin in the game!) of how urgent things are right now.

The upshot: Being able to rally $253,000 in donations over these next few weeks is vitally important simply because it is the number that keeps us right on track, helping make sure we don't end up with a bigger gap than can be filled again, helping us avoid any significant (and knowable) cash-flow crunches for now. We used to be more nonchalant about coming up short this time of year, thinking we can make it by the time June rolls around. Not anymore.

Because the in-depth journalism on underreported beats and unique perspectives on the daily news you turn to Mother Jones for is only possible because readers fund us. Corporations and powerful people with deep pockets will never sustain the type of journalism we exist to do. The only investors who won’t let independent, investigative journalism down are the people who actually care about its future—you.

And we need readers to show up for us big time—again.

Getting just 10 percent of the people who care enough about our work to be reading this blurb to part with a few bucks would be utterly transformative for us, and that's very much what we need to keep charging hard in this financially uncertain, high-stakes year.

If you can right now, please support the journalism you get from Mother Jones with a donation at whatever amount works for you. And please do it now, before you move on to whatever you're about to do next and think maybe you'll get to it later, because every gift matters and we really need to see a strong response if we're going to raise the $253,000 we need in less than three weeks.

payment methods

WE'LL BE BLUNT

It is astonishingly hard keeping a newsroom afloat these days, and we need to raise $253,000 in online donations quickly, by October 7.

The short of it: Last year, we had to cut $1 million from our budget so we could have any chance of breaking even by the time our fiscal year ended in June. And despite a huge rally from so many of you leading up to the deadline, we still came up a bit short on the whole. We can’t let that happen again. We have no wiggle room to begin with, and now we have a hole to dig out of.

Readers also told us to just give it to you straight when we need to ask for your support, and seeing how matter-of-factly explaining our inner workings, our challenges and finances, can bring more of you in has been a real silver lining. So our online membership lead, Brian, lays it all out for you in his personal, insider account (that literally puts his skin in the game!) of how urgent things are right now.

The upshot: Being able to rally $253,000 in donations over these next few weeks is vitally important simply because it is the number that keeps us right on track, helping make sure we don't end up with a bigger gap than can be filled again, helping us avoid any significant (and knowable) cash-flow crunches for now. We used to be more nonchalant about coming up short this time of year, thinking we can make it by the time June rolls around. Not anymore.

Because the in-depth journalism on underreported beats and unique perspectives on the daily news you turn to Mother Jones for is only possible because readers fund us. Corporations and powerful people with deep pockets will never sustain the type of journalism we exist to do. The only investors who won’t let independent, investigative journalism down are the people who actually care about its future—you.

And we need readers to show up for us big time—again.

Getting just 10 percent of the people who care enough about our work to be reading this blurb to part with a few bucks would be utterly transformative for us, and that's very much what we need to keep charging hard in this financially uncertain, high-stakes year.

If you can right now, please support the journalism you get from Mother Jones with a donation at whatever amount works for you. And please do it now, before you move on to whatever you're about to do next and think maybe you'll get to it later, because every gift matters and we really need to see a strong response if we're going to raise the $253,000 we need in less than three weeks.

payment methods

We Recommend

Latest

Sign up for our free newsletter

Subscribe to the Mother Jones Daily to have our top stories delivered directly to your inbox.

Get our award-winning magazine

Save big on a full year of investigations, ideas, and insights.

Subscribe

Support our journalism

Help Mother Jones' reporters dig deep with a tax-deductible donation.

Donate