Draft 1
The Stuxnet Virus and The Classification of Cyber-Warfare
The 21st century has experienced rapid innovations in terms of technology as evidence by the globalizations of the internet. The total sum of human knowledge is doubling every year whereas written law to address these changes are comparatively sluggish, generating serious complications. Consequently, the widespread accessibility to the internet and growing human intelligence both sparked the onset of a new manifestation of international warfare regarded as cyber-warfare. Disputes have emerged regarding the proper interpretation of the term “cyber-warfare”; do cyber-attacks warrant aggressive warfare? Some scholars argue that cyber-warfare is only applicable when there is an evident level of force being implemented upon a territory. Others, however, argue that the complexity, damage, and intentions of the cyber-attacks can clearly be classified as direct war-type behaviors. The Stuxnet virus represented one of the first deliberate international cyber-attacks between nations. As a result of the implications that the Stuxnet virus left on its target, many arguments emerged questioning the classification of cyber-attacks like the Stuxnet virus as an act of force, aggression, and war. International cyber-attacks such as Stuxnet should be considered an act of war because such activities are performed to intentionally deteriorate a target for a particular advantage, similar in the agenda and characteristics of traditional warfare.
What is the Stuxnet Virus?
While the exact details regarding Stuxnet have been contested for many years, the accurate story has finally been established. Stuxnet refers to human created technological virus with the intent of disrupting industrial machinery, particularly those of Iranian nuclear facilities. Despite the clear Iranian target, 60,000 instances of the Stuxnet virus was identified numerous countries including: India, Indonesia, China, South Korea, Malaysia, the United States, the UK, Australia, Finland, and Germany.
Design and Capacity
Many design features pertaining to Stuxnet strike individuals as rather peculiar (James P. Farwell & Rafal Rohozinski). Stuxnet operated on an “air gapped” system, meaning that it could only be transported through direct inputs such as USB drives rather than the internet. Thus, infecting a software platform with the device could logically not be accidental. Once the Stuxnet infused external state drive reaches its target, it is able to conquer the device by inserting the default passwords into the Windows Operating System. In the event that the malfunctions to the machinery are inspected, the encoding in the Stuxnet virus was designed to conceal its origins.
The Stuxnet virus primarily influenced the operation of centrifuges that were heavily involved in the nuclear water reactors. This goal was accomplished by targeting Frequency Converter Drives such as Fararo Paya (Iranian) and Vacon (Finland). Upon infecting these drives, the centrifuges gradually began slowing down, representing an industrial malfunction in the equipment. As a result, the separation of Uranium-235 isotope, a vital step in the nuclear process, could not commence properly. The virus was designed to work in short intervals in order to avoid haste detection by those whom work with the equipment. In addition, the Stuxnet virus can infect both known centrifuges and unknown centrifuges, proving to be advantageous for someone wishing to demolish machinery related to the nuclear program. While the virus typically infected only light water nuclear reactors, the coding possessed the ability to captivate even the intense and sturdy machinery. Finally, the virus was constructed with built in antidotes and expiration dates to undo the damage inflicted onto the machinery if initiated. The overall design and features of the virus was interpreted as peculiar by academics analyzing it leading to major critique.
Reactions to the Virus
The media revered the Stuxnet virus as a credible piece of viral code but credible software engineers have debunked these claims (James P. Farwell & Rafal Rohozinski). First, the code is based on DNS techniques which were at the time, highly ineffective in comparison to alternative options. The “jump air gap” technique has already been implemented in previous cybercrimes as well, proving that the Stuxnet virus derived much of its code from existing sources. In fact, hackers used the technology during the theft of the confidential documents of US Centcom. The code also resembles that of the typical cybercriminal rather than an organized effort at producing clean code. Hence, the major components of the Stuxnet virus was regarded as nothing more than coding tradecraft. Collectively, these abnormal decisions for the schematics of the virus made the Iranian investigation for the source of the outbreak perplexing(James P. Farwell & Rafal Rohozinski).
Many investigative teams, including the Iranian team, questioned why a more refined virus wasn’t used to attack Iran’s nuclear program. Due to the lack of coding sophistication, the Iranians promptly were able to eradicate the Stuxnet virus from their systems; questions emerged as to why the creators of the virus didn’t take precautions to amplify the virus’s defenses. The context in which the virus was implemented within the systems provides more insight onto the situation.
Timeframe and Context
At the time of the Stuxnet invasion, rumors suggested that the United States and Israel were jointly planning direct airstrikes on Iranian nuclear facilities. WikiLeaks, an organization striving to expand transparency, leaked documents that revealed interactions between the United States and other Arabian countries that preyed upon Iran. The Saudi Arabian King Abdullah bin Abdulaziz stated he wanted to “cut off the head of the snake” in reference to Iran. Similar sentiment was viewed from the Egyptian King when he regarded Iranian leaders as “big fat liars.” Even the UAE chief of defense compared the Iranian King to Adolf Hitler. Collectively the documents displayed consensual animosity towards Iran and in some instances revealed potential war tactics against Iran. At this same time, Iranian sovereignty or control over their own political affairs, was increasing rapidly as well. Because of the context of the situation, many of these middle eastern countries experiencing angst aspired to launch nuclear airstrikes on Iranian as inspired by the successful 2007 Israeli bombings on Iran. The desired result of this potentially devastating event would be the hopeful conclusion of the tense nuclear arms race plaguing the area. After evaluation of the situation by political scientists, the negatives dominated the consequences (increasing oil prices, possible failure, creation of war) of direct strikes on Iranian Nuclear facilities, thus explaining the need of an indirect stealth attack with the assistance of the Stuxnet virus.
Reality vs. Claims
The extent to which the Stuxnet virus accomplished its alleged intentions was disputed primarily by actual statistics and the Iranian regime (James P. Farwell & Rafal Rohozinski). The facts show that reported centrifuge malfunctions increased by 23% around the introduction of the virus. In addition, a week long unexplained hiatus in facility productions occurred during the action of the Stuxnet virus. However, despite these factual numbers, the Iranian regime regarded the Stuxnet virus as leaving only minor setbacks on production rather than permanent damage to operations. Iran claimed that only a “limited number of centrifuges” were affected during the cyber-attack. In sum Iran dismissed that attack as ineffective and a failure. Thus the facts somewhat clashed with the Iranian assertions in regards to the Stuxnet virus (James P. Farwell & Rafal Rohozinski).
Definition of War Related Aggression
It became unclear by definition whether the Stuxnet virus could be classified as an act of “war”. The UN Charter describes an act of war as aggression through the use of weaponry on a state’s territory. The first discrepancy in regarding the Stuxnet virus as an act of war aggression is whether industrial facilities are considered territory of the state. In addition, whether the Stuxnet virus could be considered a weapon was also contested. Most define a weapon as an entity which leaves irreversible damage on a person or their belongings. In other words, a weapon is defined as an entity which introduces “force” upon its target. An example of technological force would be hacking an air traffic control center resulting in the crash of an aircraft. It was concluded that the Stuxnet virus could not be officially defined as an act of wartime aggression because it did not meet these warrants.
Culprit and Responsibility of the Stuxnet Virus
Rapid speculation, analysis, and investigation commenced to identify the culprit behind the Stuxnet virus. Dissection of the code and consideration of the context surrounding the time period resulted in firm claims that the Stuxnet virus was a joint creation between the United States and Israel. After months of alleged claims without firm evidence, whistleblower Edward Snowden confirmed these claims. Thus, it was eventually proven, that the United States and Israel jointly cooperated to conjure the Stuxnet virus to sabotage the worrisome Natanz nuclear facility in Iran. The Stuxnet virus expanded well beyond the individual target which Snowden claimed was not intended to happen. The virus accidently ventured beyond the Natanz facility resulting in being spread publically once the virus got access to the internet. The location of Stuxnet was widespread at its climax. Even American automotive company Chevrolet admitted the existence of Stuxnet within its facility. The severity of the situation was not intended by American developmental teams The development of the covert operation was introduced during the Bush administration and later accelerated during the Obama administration. In an attempt to recover themselves from the responsibility of the Stuxnet virus, the United States announced that the excessive diffusion of the virus was purely accidental. In order to counter allegations of illegal force according to United Nation’s international law, The White House justified the project as promoting self-defense due to the threat of the nuclear abilities of Iran.
The Argument
The Stuxnet virus ushered in a new manifestation of modern international warfare, cyber-warfare. With society growing in its dependence on technology, safety is often within the hands of technology. The average family depends upon alarm systems, traffic lights, and other manifestations of technology in order to ensure their safety. Due to this dependence on technology for human welfare, cyber-attacks must be taken as serious as physical acts of wartime aggression. As of now, what constitutes as an act of war in regards to cyber-attacks has “not been defined according to the acting Assistant Secretary of Defense for Homeland Defense and Global Security, Thomas Atkin (USAFEATURESMEDIA). While the exact purpose of Stuxnet and similar cyber-attacks do not classify as an act of war aggression under the United Nation’s definition, it should be regarded as an act of war and hence handled as such because of the repercussions on human safety and welfare.
An act of force is nearly synonymous with an act of war oriented aggression. According to Tallin Manual, expert on international law, force is described as follows, “acts that kill or injure persons or destroy or damage objects are unambiguously uses of force” (Global Research). Now, according to the United Nations Charter on international relationships, force is forbidden unless when executed under the justification of self-defense (Global Research). In the case of Stuxnet and similar cyber-attack related incidents, objects are damaged; in the event of Stuxnet, centrifuges belonging to Iranian research coalitions were marred. It would be stretch for the United States and Israel to claim that the usage of Stuxnet was in self-defense because an imminent attack or threat wasn’t tangible. Manual’s definition of force encompasses many of the international cyber-attacks commencing such as the Stuxnet virus, but disagreement in classifying cyber-attacks as an act of war still exists when it shouldn’t.
Following the Stuxnet incident, scholars have been deliberating methods on applying cyber-space to modern day aggression. A NATO (North Atlantic Treaty Organization) coalition of experts on international law was assigned the task of analyzing the Stuxnet incident to determine whether the activities should be labeled forceful. A three-hundred-page manuscript was conjured to examine the issue. The coalition of experts concluded that the Stuxnet virus was considered an act of force, and thus an act of war under the United Nations charter which prohibits international force. In the event that the Stuxnet virus would be labeled an “armed attack,” Iran would have been entitled to commence counterforce in self-defense; the Geneva Convention’s laws of war are considered applicable in this scenario. Theoretically, cyber-attacks are launched in order to hinder another in some manifestation whether it be to gather intelligence, obstruct communication, or disrupt economic activities. Collectively, these examples and other manifestations ultimately destroy tangible and intangible aspects of another country. What makes a cyber-attack different then a physical attack if in the end, the destructive results are exactly the same?
The purpose of a cyber-attack is nearly identical to that of a weapon, to wage conflict and inflict damage. In the case of Stuxnet, whether an airstrike or cyber-attack was used to impair the nuclear facilities, the same conclusion would have been reached. Ultimately, in the scenario of Stuxnet, the cyber-attack utilized computing technology as a damage inflicting weapon. If a traditional kinetic weapon is considered a forceful entity that yields war, a cyber-attack should share that same characteristic since they both produce an identical result. David Fidler, expert at Indiana University, even goes to the extent to refer to the Stuxnet virus as a cyber-weapon (Filder). Extensive research in terms of code analysis and reverse engineering is commencing to define these “cyber weapons” (Wilson). The Tallinin Manual on International Law associates a cyber weapon with a “cyber means of warfare.” Wilson interpreted the Tallinin Manual to mean that cyber weapons are characterized by being able to inflict “international injury” and disturb “computer functionality.” Nearly every malicious cyber-attack meets these two general intentions and are hence considered cyber-weapons by a variety of experts who contributed to the Tallinin Manual on International Law (Wilson). This is evidence that existing scholars are already going to the extent of grouping cyber-attacks with actual weaponry. This commonality further proves that cyber-attacks pass the threshold of being considered an act of force and hence should be considered an act of war aggression.
The produced sentiment of anger from a cyber-attacks nearly mimics the produced sentiment of actual physical attacks. In light of the new prominence of the cyber realm, The Pentagon announced its measures to respond to cyber-attacks. The White House claimed that it was willing to use physical military force to retaliate severe cyber-attacks (US Pentagon to Treat Cyber-Attacks as ‘Acts of War’). “We reserve the right to use all necessary means – diplomatic, informational, military, and economic – as appropriate and consistent with applicable international law, in order to defend our nation, our allies, our partners and our interests,” illustrates the striking similarities between responses to kinetic attacks and cyber-attacks (US Pentagon to Treat Cyber-Attacks as ‘Acts of War’). James Lewis attributes the lack of cyber-attacks being used frequently because of the “risk of a violent reaction as too high” (Lewis). This shared commonality between the responses of physical threats and cyber-threats is also demonstrated by the White House’s remarks of “respond to hostile acts in cyberspace as we would to any other threat to our country”(US Pentagon to Treat Cyber-Attacks as ‘Acts of War’). In sum, cyber-attacks trigger the same reaction that a direct physical attack would, thus it is unjustifiable to neglect cyber-attacks from being classified as an aggressive act of war.
It is imperative that cyber-attacks be included in the general existing definition of force and warfare because it is growing in convenience for military operatives. James Lewis argues that it is essential that existing international law catches up to the progressing prominence of cyber-attacks(Lewis). James Lewis suggests that over forty states have attained the capability of launching detrimental cyber-attacks (Lewis). James Lewis even references the Stuxnet virus as “the most advanced ‘weapon’” of its kind (Lewis). Lewis asserts that cyber-attacks extend the options that militaries have in waving warfare (Lewis). Society is already witnessing the increased implementation of cyber-attacks as an alternative to physical attacks; Stuxnet and Operation ISIS (an operation by Anonymous to tackle the jihadist group) all demonstrate militarized operatives. Military doctrines are already being modified to incorporate the alternative options presented by cyber-weaponry. In fact, Stuxnet was an alternative to speculated warfare. In the context referenced earlier, the United States, Israel, and other Arabian nations were already discussing how to handle the Iranian nuclear problem. “Sabotage teams, air strikes, missile strikes, or even occupation of the territory by conventional forces,” were all discarded in favor of the Stuxnet virus (Lewis). Hence an alternative to clear acts of force that accomplishes the same intent logically should also be considered an act of force. Lewis makes the same conclusion, “nations may reject massively horrific weapons, but everything else will be used. Cyber-attack is no different. States will behave as they have always behaved, and simply take advantage of new technologies to achieve their purposes” (Lewis). Furthermore, cyber-warfare is already functioning as a military alternative and in some cases a military advancement thus it is unjust to neglect cyber-attacks as instances of war related aggression.
Conclusion
Furthermore, society is accelerating quickly due to advancements in society but international law is not updating as quickly as it needs to in order to safely adapt to this evolution. Statistically, the sum of human knowledge is now doubling every year, while written law can be stagnated for years. The United Nations Charter on war was conjured nearly decades ago, before the internet even existed. Technology is evolving and its only appropriate that existing law evolves at the same rare. It is time to update the international law playing field in regards to war, aggression, and force in order to address the growing presence of cyber-warfare. Stuxnet demonstrated that cyber-warfare is imminent, if not already commencing. Stuxnet and similar cyber-weapons emulate the characteristics, intentions, and yield the same responses that actual acts of war such as raids and airstrikes do. To ensure a safe and fair playing ground in terms of war, it is time for cyber-attacks to be taken as serious as kinetic, physical, tangible attacks. For now, cyber-attacks are interpreted in terms of fatalities, economic damage, and territorial damage, but clear rules as to the classification of cyber-attacks are needed.
Works Cited
Fidler, David P. “Was Stuxnet an Act of War? Decoding a Cyberattack.” IEEE Security &Amp; Privacy Magazine, vol. 9, no. 4, 2011, pp. 56–59. doi:10.1109/msp.2011.96.
James P. Farwell & Rafal Rohozinski (2011) Stuxnet and the Future of Cyber War, Survival, 53:1, 23-40, DOI: 10.1080/00396338.2011.555586
Global Research. “US-Israel Stuxnet Cyber-Attacks against Iran: ‘Act of War.’” GlobalResearch, 28 June 2013, http://www.globalresearch.ca/us-israeli-stuxnet-cyber-attacks-against-iran-act-of-war/5328514.
Lewis, James A. “Military and Strategic Affairs.” Military and Strategic Affairs, vol. 4, no. 3, Dec. 2012, http://www.inss.org.il/uploadimages/systemfiles/masa4-3_lewis.pdf.
USAFEATURESMEDIA. “When Do We Call a Cyber Attack an Act of War? No One Knows at the Moment.” Glitch News, Glitch, 29 June 2016, http://www.glitch.news/2016-06-29-when-do-we-call-a-cyber-attack-an-act-of-war-no-one-knows-at-the-moment.html.
“US Pentagon to Treat Cyber-Attacks as ‘Acts of War’.” BBC News, BBC News Services, 1 June 2011, http://www.bbc.com/news/world-us-canada-13614125.
Wilson, Clay. “Cyber Weapons: 4 Defining Characteristics.” GCN, 1105 Media, 4 June 2015, https://gcn.com/articles/2015/06/04/cyber-weapon.aspx.
Revision Plan
I am currently satisfied with how my narrative was composed but I will make some changes to elaborate upon the captivating parts of the narrative. I will attempt to accomplish this through the use of subheadings and strategic placement of key details. The lesson in class today along with the peer review process gave me ideas as to what changes I should make. Other than that, I am ready to begin writing the thesis component of the paper.
Draft 2
The Stuxnet Virus and The Classification of Cyber-Warfare
What is Stuxnet?
While the exact details regarding Stuxnet have been contested for many years, the accurate story has finally been established. Stuxnet was the name dedicated to the human created technological virus with the intent of disrupting industrial machinery, particularly those of Iranian nuclear facilities. Despite the clear Iranian target, 60,000 instances of the Stuxnet virus was identified in numerous countries including but not limited to: India, Indonesia, China, South Korea, Malaysia, the United States, the UK, Australia, Finland, and Germany. The Stuxnet virus was introduced into Iranian industrial facilities with the specific agenda of disrupting centrifuges involved in the nuclear process, a practice going on throughout Iran which worried many leading and neighboring countries. The initial idea behind the construction of the virus was to disrupt the machinery involved in the nuclear process secretly, making Iranians believe that the malfunctions were common faulty machine errors rather than an outside cyber-attack.
Design and Capacity
The Stuxnet virus utilized numerous popular software techniques in order to infiltrate a foreign computer system in an undetected manner. If exposed to internet connection, the Stuxnet virus could expand unintentionally to computer systems not originally in its target. Thus, an “air-gapped” system was used as an alternative. This “air-gapped” system requires a USB drive or similar external device to be directly plugged into the system intended for viral infiltration. Hence, for an industrial facility to be infected, it could not be an accident; someone or some group would have intentionally organized a way of introducing the infected USB drive into the facility. Additionally, the strategic coding behind Stuxnet allowed the origin of the virus to be concealed in the event that the virus was detected by Iranians. The virus also executed its abilities in short intervals in order to avoid detection by suspicious laborers within the targeted nuclear facilities. Stuxnet’s ability to diffuse between internal systems allowed it to infect both known and registered nuclear centrifuges in addition to unknown and illegally unregistered nuclear centrifuges. The intentions for the virus were clear and non-accidental, leading to its classification as a cyber-attack against Iranian nuclear facilities. The design, structure, and abilities of the Stuxnet virus all facilitates the notion that the Stuxnet virus was designed to deliberately target and destroy Iran’s nuclear progress in a covert but war-like fashion.
Reactions to the Virus
The media revered the Stuxnet virus as a credible piece of viral code. However, James P. Farwell and Rafal Rohozinski collected opinions regarding the coding behind the virus and found that most software engineers regarded the virus design as mediocre at best. (James P. Farwell & Rafal Rohozinski). First off, the code is based on DNS techniques which was at the time, highly ineffective in comparison to alternative options. The “air-gap” technique has already been implemented in previous cybercrimes as well, proving that the Stuxnet virus derived much of its code from existing sources. In fact, hackers used the technology during the theft of the confidential documents of US Centcom. The code also resembles that of the typical cybercriminal rather than an organized effort at producing clean code. Hence, the major components of the Stuxnet virus was regarded as nothing more than coding tradecraft. Collectively, these abnormal decisions for the schematics of the virus made the Iranian investigation rather difficult, implying that some manifestation of covert warfare was commencing.
Many investigative teams, including the Iranian team, questioned why a more refined virus wasn’t used to attack Iran’s nuclear program. Due to the lack of coding sophistication, the Iranians promptly were able to eradicate the Stuxnet virus from their systems; questions emerged as to why the creators of the virus’s creators didn’t take precautions to amplify the virus’s defenses. Analysts and Iranian investigators were quick to point fingers at a joint alliance between the United States and Israel as being the culprits behind the creation of the Stuxnet. Both militaries immediately denied involvement in formulating the Stuxnet virus. Their denial over their responsibility was not convincing and for many years, Iranian investigative teams attributed the Stuxnet virus with this alleged joint US-Israel effort. The context in which the virus was implemented within the systems provides more insight onto the situation.
Timeframe and Context
At the time of the Stuxnet invasion, rumors suggested that the United States and Israel were jointly planning direct airstrikes on Iranian nuclear facilities. WikiLeaks, an organization striving to expand transparency, leaked documents that revealed interactions between the United States and other Arabian countries that preyed upon Iran. The Saudi Arabian King Abdullah bin Abdulaziz stated he wanted to “cut off the head of the snake” in reference to Iran. Similar sentiment was viewed from the Egyptian King when he regarded Iranian leaders as “big fat liars.” Even the UAE chief of defense compared the Iranian King to Adolf Hitler. Collectively the documents displayed consensual animosity towards Iran and in some instances revealed potential war tactics against Iran. At this same time, Iranian sovereignty or control over their own political affairs, was increasing rapidly as well. Because of the context of the situation, many of these middle eastern countries experiencing angst aspired to launch nuclear airstrikes on Iran as inspired by the successful 2007 Israeli bombings on Iran. The desired result of this potentially devastating event would be the hopeful conclusion of the tense nuclear arms race plaguing the area. After evaluation of the situation by political scientists, the negatives dominated the consequences (increasing oil prices, possible failure, creation of war) of direct strikes on Iranian Nuclear facilities, thus explaining the need of an indirect stealth attack with the assistance of the Stuxnet virus.
The Resulting Repercussions
As a result of the introduction of the Stuxnet weapon, Iranian nuclear facilities did endure damages to their equipment and setbacks to their operation. Existing logs show that centrifuge malfunctions spiked 23% around the time of the Stuxnet virus infiltration. Around the same time, a week long hiatus in production was declared across multiple facilities, implying disturbances in the facilities ability to continue their operations. After the virus was discovered within the systems, it was quickly eradicated and an investigation as to identifying the hearth of the Stuxnet virus was initiated. In addition, Stuxnet accidently spread to industrial facilities in other countries. Collectively, the consequences of the Stuxnet virus led to global speculation and attention in regards to defining a new form of war regarded as cyber-warfare.
Definition of War Related Aggression
It became unclear by definition whether the Stuxnet virus could be classified as an act of “war”. The UN Charter describes an act of war as aggression through the use of weaponry on a state’s territory. The first discrepancy in regarding the Stuxnet virus as an act of war aggression is whether industrial facilities are considered territory of the state. In addition, whether the Stuxnet virus could be considered a weapon was also contested. Most define a weapon as an entity which leaves irreversible damage on a person or their belongings. In other words, a weapon is defined as an entity which introduces “force” upon its target. An example of technological force would be hacking an air traffic control center resulting in the crash of an aircraft. Whether the Stuxnet virus would be considered an act of wartime aggression became a highly contested point during the time period of the virus and even today.
Culprit and Responsibility of the Stuxnet Virus
Rapid speculation, analysis, and investigation commenced to identify the culprit behind the Stuxnet virus. Dissection of the code and consideration of the context surrounding the time period resulted in firm claims that the Stuxnet virus was a joint creation between the United States and Israel. After months of alleged claims without firm evidence, whistleblower Edward Snowden confirmed these claims. Thus, it was eventually proven, that the United States and Israel jointly cooperated to conjure the Stuxnet virus to sabotage the worrisome Natanz nuclear facility in Iran. The Stuxnet virus expanded well beyond the individual target which Snowden claimed was not intended to happen. The virus accidently ventured beyond the Natanz facility resulting in being spread publically once the virus got access to the internet. The location of Stuxnet was widespread at its climax. Even American automotive company Chevrolet admitted the existence of Stuxnet within its facility. The severity of the situation was not intended by American developmental teams The development of the covert operation was introduced during the Bush administration and later accelerated during the Obama administration. In an attempt to recover themselves from the responsibility of the Stuxnet virus, the United States announced that the excessive diffusion of the virus was purely accidental. In order to counter allegations of illegal force according to United Nation’s international law, The White House justified the project as promoting self-defense due to the threat of the nuclear abilities of Iran. Due to the limited experience in addressing instances of cyber-intrusion Iran steered away from responding in a defensive war related manner and instead vocally denounced the culprit behind the virus.
The Argument
The Stuxnet virus ushered in a new manifestation of modern international warfare, cyber-warfare. With society growing in its dependence on technology, safety is often within the hands of technology. The average family depends upon alarm systems, traffic lights, and other manifestations of technology in order to ensure their safety. Due to this dependence on technology for human welfare, cyber-attacks must be taken as serious as physical acts of wartime aggression. As of now, what constitutes as an act of war in regards to cyber-attacks has “not been defined” according to the acting Assistant Secretary of Defense for Homeland Defense and Global Security, Thomas Atkin (USAFEATURESMEDIA). While the exact purpose of Stuxnet and similar cyber-attacks do not classify as an act of war aggression under the United Nation’s definition, it should be regarded as an act of war and hence handled as such because of the repercussions on human safety and welfare. Furthermore, it is imperative that existing international law is updated in order to adapt to the quickly evolving nature of the technological based society.
An act of force is nearly synonymous with an act of war oriented aggression. Now if force is required in order to justify a military response, then it is only logical that acts of force in the form of cyber-attacks receive that same privilege. According to Tallin Manual, expert on international law, force is described as follows, “acts that kill or injure persons or destroy or damage objects are unambiguously uses of force” (Global Research). Now, according to the United Nations Charter on international relationships, force is forbidden unless when executed under the justification of self-defense (Global Research). In the case of Stuxnet and similar cyber-attack related incidents, objects are damaged; in the event of Stuxnet, centrifuges belonging to Iranian research coalitions were marred. Whether the nuclear facilities were disrupted through airstrikes, ground invasions, or cyber infiltration, these three manifestations of destruction share the commonality of classifying as force. Following the Stuxnet incident, a team of experienced scholars under a NATO (North Atlantic Treaty Organization) coalition has been deliberating methods on applying cyber-space to modern day aggression (Global Research). The NATO coalition of experts on international law was assigned the task of analyzing the Stuxnet incident to determine whether the activities should be labeled forceful. A three-hundred-page manuscript was conjured to examine the issue. The coalition of experts concluded that the Stuxnet virus was considered an act of force, and thus an act of war under the United Nations charter which prohibits international force (Global Research). In the event that the Stuxnet virus would be labeled an “armed attack,” Iran would have been entitled to commence counterforce in self-defense; the Geneva Convention’s laws of war are considered applicable in this scenario. Theoretically, cyber-attacks are launched in order to hinder another country in some manifestation whether it be to gather intelligence, obstruct communication, or disrupt economic activities. Collectively, these examples and other manifestations ultimately destroy tangible and intangible aspects of another country. What makes a cyber-attack different then a physical attack if in the end, the destructive results are exactly the same? Manual’s definition of force encompasses many of the international cyber-attacks commencing such as the Stuxnet virus, but disagreement in classifying cyber-attacks as an act of war still exists when it shouldn’t.
The purpose of a cyber-attack is nearly identical to that of a weapon, to wage conflict and inflict damage. In the case of Stuxnet, whether an airstrike or cyber-attack was used to impair the nuclear facilities, the same conclusion would have been reached. Ultimately, in the scenario of Stuxnet, the cyber-attack utilized computing technology as a damage inflicting weapon. If a traditional kinetic weapon is considered a forceful entity that yields war, a cyber-attack should share that same characteristic since they both produce an identical result. David Fidler, expert at Indiana University, even goes to the extent to refer to the Stuxnet virus as a cyber-weapon (Filder). Extensive research in terms of code analysis and reverse engineering is commencing to define these “cyber weapons” (Wilson). The Tallinin Manual on International Law associates a cyber weapon with a “cyber means of warfare.” Wilson interpreted the Tallinin Manual to mean that cyber weapons are characterized by being able to inflict “international injury” and disturb “computer functionality.” Nearly every malicious cyber-attack meets these two general intentions and are hence considered cyber-weapons by a variety of experts who contributed to the Tallinin Manual on International Law (Wilson). This is evidence that existing scholars are already going to the extent of grouping cyber-attacks with actual weaponry. This commonality further proves that cyber-attacks pass the threshold of being considered an act of force and hence should be considered an act of war aggression.
The produced sentiment of anger from cyber-attacks nearly mimics the produced sentiment of actual physical attacks. Leading nations are already responding to cyber-attacks in a similar manner than they would any physical attack. Thus, if leading nations are already beginning to address these cyber-attacks as acts of war, existing international law should be updated to adapt to this ongoing transition anyway. For example, in light of the new prominence of the cyber realm, The Pentagon announced its measures to respond to cyber-attacks. The White House claimed that it was willing to use physical military force to retaliate severe cyber-attacks (US Pentagon to Treat Cyber-Attacks as ‘Acts of War’). “We reserve the right to use all necessary means – diplomatic, informational, military, and economic – as appropriate and consistent with applicable international law, in order to defend our nation, our allies, our partners and our interests,” illustrates the striking similarities between responses to kinetic attacks and cyber-attacks (US Pentagon to Treat Cyber-Attacks as ‘Acts of War’). Even 2016 presidential nominee Hilary Clinton states “As President, I will make it clear that the United States will treat cyber attacks just like any other attack. We will be ready with serious political, economic, and military responses” (Read). Both the Pentagon and Hilary Clinton represent two experienced political entities responding to cyber-attacks as they would a physical attack. Even James Lewis notes the serious responses to cyber-attacks; he attributes the lack of cyber-attacks being used frequently because of the “risk of a violent reaction as too high” (Lewis). This shared commonality between the responses of physical threats and cyber-threats is also demonstrated by the White House’s remarks of “respond to hostile acts in cyberspace as we would to any other threat to our country” (US Pentagon to Treat Cyber-Attacks as ‘Acts of War’). Hilary Clinton, the Pentagon, and the White House collectively assert that cyber-attacks will be regarded in the exact same way a physical attack would. In sum, cyber-attacks trigger the same reaction that a direct physical attack would, thus it is unjustifiable to neglect cyber-attacks from being classified as an aggressive act of war.
It is imperative that cyber-attacks be included in the general existing definition of force and warfare because it is growing in convenience for military operatives. James Lewis argues that it is essential that existing international law catches up to the progressing prominence of cyber-attacks(Lewis). James Lewis suggests that over forty states have attained the capability of launching detrimental cyber-attacks (Lewis). James Lewis even references the Stuxnet virus as “the most advanced ‘weapon’” of its kind (Lewis). Lewis asserts that cyber-attacks extend the options that militaries have in waving warfare (Lewis). Society is already witnessing the increased implementation of cyber-attacks as an alternative to physical attacks; Stuxnet and Operation ISIS (an operation by Anonymous to tackle the jihadist group) all demonstrate militarized operatives. Military doctrines are already being modified to incorporate the alternative options presented by cyber-weaponry. In fact, Stuxnet was an alternative to speculated warfare. In the context referenced earlier, the United States, Israel, and other Arabian nations were already discussing how to handle the Iranian nuclear problem. “Sabotage teams, air strikes, missile strikes, or even occupation of the territory by conventional forces,” were all discarded in favor of the Stuxnet virus (Lewis). Hence an alternative to clear acts of force that accomplishes the same intent logically should also be considered an act of force. Lewis makes the same conclusion, “nations may reject massively horrific weapons, but everything else will be used. Cyber-attack is no different. States will behave as they have always behaved, and simply take advantage of new technologies to achieve their purposes” (Lewis). Furthermore, cyber-warfare is already functioning as a military alternative and in some cases a military advancement thus it is unjust to neglect cyber-attacks as instances of war related aggression.
Conclusion
Furthermore, society is accelerating quickly due to advancements in society but international law is not updating as quickly as it needs to in order to safely adapt to this evolution. Statistically, the sum of human knowledge is now doubling every year, while written law can be stagnated for years. The United Nations Charter on war was conjured nearly decades ago, before the internet even existed. Technology is evolving and its only appropriate that existing law evolves at the same rare. It is time to update the international law playing field in regards to war, aggression, and force in order to address the growing presence of cyber-warfare. Stuxnet demonstrated that cyber-warfare is imminent, if not already commencing. Stuxnet and similar cyber-weapons emulate the characteristics, intentions, and yield the same responses that actual acts of war such as raids and airstrikes do. To ensure a safe and fair playing ground in terms of war, it is time for cyber-attacks to be taken as serious as kinetic, physical, tangible attacks. For now, cyber-attacks are interpreted in terms of fatalities, economic damage, and territorial damage, but clear rules as to the classification of cyber-attacks are needed.
Works Cited
Fidler, David P. “Was Stuxnet an Act of War? Decoding a Cyberattack.” IEEE Security &Amp; Privacy Magazine, vol. 9, no. 4, 2011, pp. 56–59. doi:10.1109/msp.2011.96.
James P. Farwell & Rafal Rohozinski (2011) Stuxnet and the Future of Cyber War, Survival, 53:1, 23-40, DOI: 10.1080/00396338.2011.555586
Global Research. “US-Israel Stuxnet Cyber-Attacks against Iran: ‘Act of War.’” GlobalResearch, 28 June 2013, http://www.globalresearch.ca/us-israeli-stuxnet-cyber-attacks-against-iran-act-of-war/5328514.
Lewis, James A. “Military and Strategic Affairs.” Military and Strategic Affairs, vol. 4, no. 3, Dec. 2012, http://www.inss.org.il/uploadimages/systemfiles/masa4-3_lewis.pdf.
Read, Russ. “Clinton Advocates Response To DNC Hack That Would Likely Bring On WWIII.” The Daily Caller. N.p., 1 Sept. 2016. Web. 19 Oct. 2016.
USAFEATURESMEDIA. “When Do We Call a Cyber Attack an Act of War? No One Knows at the Moment.” Glitch News, Glitch, 29 June 2016, http://www.glitch.news/2016-06-29-when-do-we-call-a-cyber-attack-an-act-of-war-no-one-knows-at-the-moment.html.
“US Pentagon to Treat Cyber-Attacks as ‘Acts of War’.” BBC News, BBC News Services, 1 June 2011, http://www.bbc.com/news/world-us-canada-13614125.
Wilson, Clay. “Cyber Weapons: 4 Defining Characteristics.” GCN, 1105 Media, 4 June 2015, https://gcn.com/articles/2015/06/04/cyber-weapon.aspx.
Instructor Comments
“This is a solid paragraph; it’s well-sourced and clearly connected to your thesis. Other paragraphs in this section, though, lack both of those things.”
“This paragraph mentions both scholars and experts but doesn’t actually cite any sources. That’s problematic.”
“Okay. Again: why does this matter to your thesis. Further, you’ve used this source at least 4 other times, and you don’t ever introduce them. That reduces the effectiveness of this source.”
“This seems to be the more widely compelling part of your narrative. Could you begin here and reduce some of the more technical discussion above?”
Final Draft
The Stuxnet Virus and The Classification of Cyber-Warfare
What is Stuxnet?
While the exact details regarding Stuxnet have been contested for many years, the accurate story has finally been established. Stuxnet was the name dedicated to the human created technological virus with the intent of disrupting industrial machinery, particularly those of Iranian nuclear facilities. Despite the clear Iranian target, 60,000 instances of the Stuxnet virus were identified in numerous countries including but not limited to: India, Indonesia, China, South Korea, Malaysia, the United States, the UK, Australia, Finland, and Germany. The Stuxnet virus was introduced into Iranian industrial facilities with the specific agenda of disrupting centrifuges involved in the nuclear process, a practice going on throughout Iran which worried many leading and neighboring countries. The initial idea behind the construction of the virus was to disrupt the machinery involved in the nuclear process secretly, making Iranians believe that the malfunctions were common faulty machine errors rather than an outside cyber-attack.
Design and Capacity
The Stuxnet virus utilized numerous popular software techniques in order to infiltrate a foreign computer system in an undetected manner. If exposed to internet connection, the Stuxnet virus could expand unintentionally to computer systems not originally in its target. Thus, an “air-gapped” system was used as an alternative. This “air-gapped” system requires a USB drive or similar external device to be directly plugged into the system intended for viral infiltration. Hence, for an industrial facility to be infected, it could not be an accident; someone or some group would have intentionally organized a way of introducing the infected USB drive into the facility. Additionally, the strategic coding behind Stuxnet allowed the origin of the virus to be concealed in the event that the virus was detected by Iranians. The virus also executed its abilities in short intervals in order to avoid detection by suspicious laborers within the targeted nuclear facilities. Stuxnet’s ability to diffuse between internal systems allowed it to infect both known and registered nuclear centrifuges in addition to unknown and illegally unregistered nuclear centrifuges. The intentions for the virus were clear and non-accidental, leading to its classification as a cyber-attack against Iranian nuclear facilities. The design, structure, and abilities of the Stuxnet virus all facilitates the notion that the Stuxnet virus was designed to deliberately target and destroy Iran’s nuclear progress in a covert but war-like fashion.
Reactions to the Virus
The media revered the Stuxnet virus as a credible piece of viral code. However, analysts James P. Farwell and Rafal Rohozinski collected opinions regarding the coding behind the virus and found that most software engineers regarded the virus design as mediocre at best. (James P. Farwell & Rafal Rohozinski). First off, the code is based on DNS techniques which was at the time, highly ineffective in comparison to alternative options. The “air-gap” technique has already been implemented in previous cybercrimes as well, proving that the Stuxnet virus derived much of its code from preexisting sources. In fact, hackers used the technology during the theft of the confidential documents of US Centcom. The code also resembles that of the typical cybercriminal rather than an organized effort at producing clean code. Hence, the major components of the Stuxnet virus was regarded as nothing more than coding tradecraft. Collectively, these abnormal decisions for the schematics of the virus made the Iranian investigation rather difficult, implying that some manifestation of covert warfare was commencing.
Many investigative teams, including the Iranian team, questioned why a more refined virus wasn’t used to attack Iran’s nuclear program. Due to the lack of coding sophistication, the Iranians promptly were able to eradicate the Stuxnet virus from their systems; questions emerged as to why the creators of the virus’s creators didn’t take precautions to amplify the virus’s defenses. Analysts and Iranian investigators were quick to point fingers at a joint alliance between the United States and Israel as being the culprits behind the creation of the Stuxnet. Both militaries immediately denied involvement in formulating the Stuxnet virus. Their denial over their responsibility was not convincing and for many years, Iranian investigative teams attributed the Stuxnet virus with this alleged joint US-Israel effort. The context in which the virus was implemented within the systems provides more insight onto the blame asserted by the Iranians.
Timeframe and Context
At the time of the Stuxnet invasion, rumors suggested that the United States and Israel were jointly planning direct airstrikes on Iranian nuclear facilities. WikiLeaks, an organization striving to expand transparency, leaked documents that revealed interactions between the United States and other Arabian countries that preyed upon Iran. The Saudi Arabian King Abdullah bin Abdulaziz stated he wanted to “cut off the head of the snake” in reference to Iran. Similar sentiment was viewed from the Egyptian King when he regarded Iranian leaders as “big fat liars.” Even the UAE chief of defense compared the Iranian King to Adolf Hitler. Collectively the documents displayed consensual animosity towards Iran and in some instances revealed potential war tactics against Iran. At this same time, Iranian sovereignty or control over their own political affairs, was increasing rapidly as well. Because of the context of the situation, many of these middle eastern countries experiencing angst aspired to launch nuclear airstrikes on Iran as inspired by the successful 2007 Israeli bombings on Iran. The desired result of this potentially devastating event would be the hopeful conclusion of the tense nuclear arms race plaguing the area. After evaluation of the situation by political scientists, the negatives dominated the consequences (increasing oil prices, possible failure, creation of war) of direct strikes on Iranian Nuclear facilities, thus explaining the need of an indirect stealth attack with the assistance of the Stuxnet virus.
The Resulting Repercussions
As a result of the introduction of the Stuxnet weapon, Iranian nuclear facilities did endure damages to their equipment and setbacks to their operation. Existing logs show that centrifuge malfunctions spiked twenty-three percent around the time of the Stuxnet virus infiltration. Around the same time, a week long hiatus in production was declared across multiple facilities, implying disturbances in the facilities ability to continue their operations. After the virus was discovered within the systems, it was quickly eradicated and an investigation as to identifying the hearth of the Stuxnet virus was initiated. In addition, Stuxnet accidently spread to industrial facilities in other countries. Collectively, the consequences of the Stuxnet virus led to global speculation and attention in regards to defining a new form of war regarded as cyber-warfare.
Definition of War Related Aggression
It became unclear by definition whether the Stuxnet virus could be classified as an act of “war”. The UN Charter describes an act of war as aggression through the use of weaponry on a state’s territory. The first discrepancy in regarding the Stuxnet virus as an act of war aggression is whether industrial facilities are considered territory of the state. In addition, whether the Stuxnet virus could be considered a weapon was also contested. Most define a weapon as an entity which leaves irreversible damage on a person or their belongings. In other words, a weapon is defined as an entity which introduces “force” upon its target. An example of technological force would be hacking an air traffic control center resulting in the crash of an aircraft. Whether the Stuxnet virus would be considered an act of wartime aggression became a highly contested point during the time period of the virus and even today.
Culprit and Responsibility of the Stuxnet Virus
Rapid speculation, analysis, and investigation commenced to identify the culprit behind the Stuxnet virus. Dissection of the code and consideration of the context surrounding the time period resulted in firm claims that the Stuxnet virus was a joint creation between the United States and Israel. After months of alleged claims without firm evidence, whistleblower Edward Snowden confirmed these claims. Thus, it was eventually proven, that the United States and Israel jointly cooperated to conjure the Stuxnet virus to sabotage the worrisome Natanz nuclear facility in Iran. The Stuxnet virus expanded well beyond the individual target which Snowden claimed was not intended to happen. The virus accidently ventured beyond the Natanz facility resulting in being spread publically once the virus got access to the internet. The location of Stuxnet was widespread at its climax. Even American automotive company Chevrolet admitted the existence of Stuxnet within its facility. The severity of the situation was not intended by American developmental teams. The development of the covert operation was introduced during the Bush administration and later accelerated during the Obama administration. In an attempt to recover themselves from the responsibility of the Stuxnet virus, the United States announced that the excessive diffusion of the virus was purely accidental. In order to counter allegations of illegal force according to United Nation’s international law, The White House justified the project as promoting self-defense due to the threat of the nuclear abilities of Iran. Due to the limited experience in addressing instances of cyber-intrusion Iran steered away from responding in a defensive war related manner and instead vocally denounced the culprit behind the virus.
The Argument
The Stuxnet virus ushered in a new manifestation of modern international warfare, cyber-warfare. With society growing in its dependence on technology, safety is often within the hands of technology. The average family depends upon alarm systems, traffic lights, and other manifestations of technology in order to ensure their safety. Due to this dependence on technology for human welfare, cyber-attacks must be taken as serious as physical acts of wartime aggression. As of now, what constitutes as an act of war in regards to cyber-attacks has “not been defined” according to the acting Assistant Secretary of Defense for Homeland Defense and Global Security, Thomas Atkin (USAFEATURESMEDIA). While the exact purpose of Stuxnet and similar cyber-attacks do not classify as an act of war aggression under the United Nation’s definition, it should be regarded as an act of war and hence handled as such because of the repercussions on human safety and welfare. Furthermore, it is imperative that existing international law is updated in order to adapt to the quickly evolving nature of the technological based society.
An act of force is nearly synonymous with an act of war oriented aggression. Now if force is required in order to justify a military response, then it is only logical that acts of force in the form of cyber-attacks receive that same privilege. According to Tallin Manual, expert on international law, force is described as follows, “acts that kill or injure persons or destroy or damage objects are unambiguously uses of force” (Global Research). Now, according to the United Nations Charter on international relationships, force is forbidden unless when executed under the justification of self-defense (Global Research). In the case of Stuxnet and similar cyber-attack related incidents, objects are damaged; in the event of Stuxnet, centrifuges belonging to Iranian research coalitions were marred. Whether the nuclear facilities were disrupted through airstrikes, ground invasions, or cyber infiltration, these three manifestations of destruction share the commonality of classifying as force. Following the Stuxnet incident, a team of experienced scholars under a NATO (North Atlantic Treaty Organization) coalition has been deliberating methods on applying cyber-space to modern day aggression (Global Research). The NATO coalition of experts on international law was assigned the task of analyzing the Stuxnet incident to determine whether the activities should be labeled forceful. A three-hundred-page manuscript was conjured to examine the issue. The coalition of experts concluded that the Stuxnet virus was considered an act of force, and thus an act of war under the United Nations charter which prohibits international force (Global Research). In the event that the Stuxnet virus would be labeled an “armed attack,” Iran would have been entitled to commence counterforce in self-defense; the Geneva Convention’s laws of war are considered applicable in this scenario. Theoretically, cyber-attacks are launched in order to hinder another country in some manifestation whether it be to gather intelligence, obstruct communication, or disrupt economic activities. Collectively, these examples and other manifestations ultimately destroy tangible and intangible aspects of another country. What makes a cyber-attack different then a physical attack if in the end, the destructive results are exactly the same? Manual’s definition of force encompasses many of the international cyber-attacks commencing such as the Stuxnet virus, but disagreement in classifying cyber-attacks as an act of war still exists when it shouldn’t.
The purpose of a cyber-attack is nearly identical to that of a weapon, to wage conflict and inflict damage. In the case of Stuxnet, whether an airstrike or cyber-attack was used to impair the nuclear facilities, the same conclusion would have been reached. Ultimately, in the scenario of Stuxnet, the cyber-attack utilized computing technology as a damage inflicting weapon. If a traditional kinetic weapon is considered a forceful entity that yields war, a cyber-attack should share that same characteristic since they both produce an identical result. David Fidler, expert at Indiana University, even goes to the extent to refer to the Stuxnet virus as a cyber-weapon (Filder). Extensive research in terms of code analysis and reverse engineering is commencing to define these “cyber weapons” (Wilson). The Tallinin Manual on International Law associates a cyber weapon with a “cyber means of warfare.” Wilson interpreted the Tallinin Manual to mean that cyber weapons are characterized by being able to inflict “international injury” and disturb “computer functionality.” Nearly every malicious cyber-attack meets these two general intentions and are hence considered cyber-weapons by a variety of experts who contributed to the Tallinin Manual on International Law (Wilson). This is evidence that existing scholars are already going to the extent of grouping cyber-attacks with actual weaponry. This commonality further proves that cyber-attacks pass the threshold of being considered an act of force and hence should be considered an act of war aggression.
The produced sentiment of anger from cyber-attacks nearly mimics the produced sentiment of actual physical attacks. Leading nations are already responding to cyber-attacks in a similar manner than they would any physical attack. Thus, if leading nations are already beginning to address these cyber-attacks as acts of war, existing international law should be updated to adapt to this ongoing transition anyway. For example, in light of the new prominence of the cyber realm, The Pentagon announced its measures to respond to cyber-attacks. The White House claimed that it was willing to use physical military force to retaliate severe cyber-attacks (US Pentagon to Treat Cyber-Attacks as ‘Acts of War’). “We reserve the right to use all necessary means – diplomatic, informational, military, and economic – as appropriate and consistent with applicable international law, in order to defend our nation, our allies, our partners and our interests,” illustrates the striking similarities between responses to kinetic attacks and cyber-attacks (US Pentagon to Treat Cyber-Attacks as ‘Acts of War’). Even 2016 presidential nominee Hilary Clinton states “As President, I will make it clear that the United States will treat cyber attacks just like any other attack. We will be ready with serious political, economic, and military responses” (Read). Both the Pentagon and Hilary Clinton represent two experienced political entities responding to cyber-attacks as they would a physical attack. Even James Lewis notes the serious responses to cyber-attacks; he attributes the lack of cyber-attacks being used frequently because of the “risk of a violent reaction as too high” (Lewis). This shared commonality between the responses of physical threats and cyber-threats is also demonstrated by the White House’s remarks of “respond to hostile acts in cyberspace as we would to any other threat to our country” (US Pentagon to Treat Cyber-Attacks as ‘Acts of War’). Hilary Clinton, the Pentagon, and the White House collectively assert that cyber-attacks will be regarded in the exact same way a physical attack would. In sum, cyber-attacks trigger the same reaction that a direct physical attack would, thus it is unjustifiable to neglect cyber-attacks from being classified as an aggressive act of war.
It is imperative that cyber-attacks be included in the general existing definition of force and warfare because it is growing in convenience for military operatives. James Lewis argues that it is essential that existing international law catches up to the progressing prominence of cyber-attacks(Lewis). James Lewis suggests that over forty states have attained the capability of launching detrimental cyber-attacks (Lewis). James Lewis even references the Stuxnet virus as “the most advanced ‘weapon’” of its kind (Lewis). Lewis asserts that cyber-attacks extend the options that militaries have in waving warfare (Lewis). Society is already witnessing the increased implementation of cyber-attacks as an alternative to physical attacks; Stuxnet and Operation ISIS (an operation by Anonymous to tackle the jihadist group) all demonstrate militarized operatives. Military doctrines are already being modified to incorporate the alternative options presented by cyber-weaponry. In fact, Stuxnet was an alternative to speculated warfare. In the context referenced earlier, the United States, Israel, and other Arabian nations were already discussing how to handle the Iranian nuclear problem. “Sabotage teams, air strikes, missile strikes, or even occupation of the territory by conventional forces,” were all discarded in favor of the Stuxnet virus (Lewis). Hence an alternative to clear acts of force that accomplishes the same intent logically should also be considered an act of force. Lewis makes the same conclusion, “nations may reject massively horrific weapons, but everything else will be used. Cyber-attack is no different. States will behave as they have always behaved, and simply take advantage of new technologies to achieve their purposes” (Lewis). Furthermore, cyber-warfare is already functioning as a military alternative and in some cases a military advancement thus it is unjust to neglect cyber-attacks as instances of war related aggression.
Conclusion
Furthermore, society is accelerating quickly due to advancements in society but international law is not updating as quickly as it needs to in order to safely adapt to this evolution. Statistically, the sum of human knowledge is now doubling every year, while written law can be stagnated for years. The United Nations Charter on war was conjured nearly decades ago, before the internet even existed. Technology is evolving and its only appropriate that existing law evolves at the same rare. It is time to update the international law playing field in regards to war, aggression, and force in order to address the growing presence of cyber-warfare. Stuxnet demonstrated that cyber-warfare is imminent, if not already commencing. Stuxnet and similar cyber-weapons emulate the characteristics, intentions, and yield the same responses that actual acts of war such as raids and airstrikes do. To ensure a safe and fair playing ground in terms of war, it is time for cyber-attacks to be taken as serious as kinetic, physical, tangible attacks. For now, cyber-attacks are interpreted in terms of fatalities, economic damage, and territorial damage, but clear rules as to the classification of cyber-attacks are needed.
Works Cited
Fidler, David P. “Was Stuxnet an Act of War? Decoding a Cyberattack.” IEEE Security &Amp; Privacy Magazine, vol. 9, no. 4, 2011, pp. 56–59. doi:10.1109/msp.2011.96.
James P. Farwell & Rafal Rohozinski (2011) Stuxnet and the Future of Cyber War, Survival, 53:1, 23-40, DOI: 10.1080/00396338.2011.555586
Global Research. “US-Israel Stuxnet Cyber-Attacks against Iran: ‘Act of War.’” GlobalResearch, 28 June 2013, http://www.globalresearch.ca/us-israeli-stuxnet-cyber-attacks-against-iran-act-of-war/5328514.
Lewis, James A. “Military and Strategic Affairs.” Military and Strategic Affairs, vol. 4, no. 3, Dec. 2012, http://www.inss.org.il/uploadimages/systemfiles/masa4-3_lewis.pdf.
Read, Russ. “Clinton Advocates Response To DNC Hack That Would Likely Bring On WWIII.” The Daily Caller. N.p., 1 Sept. 2016. Web. 19 Oct. 2016.
USAFEATURESMEDIA. “When Do We Call a Cyber Attack an Act of War? No One Knows at the Moment.” Glitch News, Glitch, 29 June 2016, http://www.glitch.news/2016-06-29-when-do-we-call-a-cyber-attack-an-act-of-war-no-one-knows-at-the-moment.html.
“US Pentagon to Treat Cyber-Attacks as ‘Acts of War’.” BBC News, BBC News Services, 1 June 2011, http://www.bbc.com/news/world-us-canada-13614125.
Wilson, Clay. “Cyber Weapons: 4 Defining Characteristics.” GCN, 1105 Media, 4 June 2015, https://gcn.com/articles/2015/06/04/cyber-weapon.aspx.