Argument: Sanctions can be targeted

The big advantage of sanctions is that they can be as finely targeted as needed. If the sanctioning country only knows which country the cyber attack originated from then they can be broad brush sanctions, but if there is knowledge of which group initiated the attack then the sanctions can be more specific. For example in the case of unit 61398 Of the Chinese People’s Liberation Army that Mandiant showed has been attacking US companies [1] the United States could target sanctions at the People's Liberation Army by tightening weapons bans. Alternatively if the hackers are private then banning the import of certain computer equipment into that country would be appropriate. If individuals are known then the sanctions can be even more targeted, for example by freezing any bank accounts held outside their own country as the US did against North Korea when it sanctioned Banco Delta Asia through which North Korea laundered money from criminal activities. [2]

[1] Mandiant, ‘Exposing One of China’s Cyber Espionage Units’, mandiant.com, February 2013, http://intelreport.mandiant.com/Mandiant_APT1_Report.pdf

[2] Noland, Marcus, ‘Why Sanctions Can Hurt North Korea’, Council on Foreign Relations, 4 August 2010, http://www.cfr.org/north-korea/why-sanctions-can-hurt-north-korea/p22762

Candidate 1: "How can there ever be deterrence when the attacker believes they will not be caught, or that if they are the sanctions swill harm others not themselves? When the problem with preventing cyber-attacks is the difficulty of tracing the source [1] then deterrence becomes more and more difficult to apply. This is not like the Cold War where both superpowers could be certain that if they launched an attack there would be a devastating response. In this instance there is no certainly; the attacker believes they a, won't be caught, b, there will be no response and c, that the response won't affect them, and finally even if they are affected unless they are caught most times they will believe they will get away with it next time round.

[1] Greenemeier, Larry, ‘Seeking Address: Why Cyber Attacks Are So Difficult to Trace Back to Hackers’, Scientific American, 11 June 2011, http://www.scientificamerican.com/article.cfm?id=tracking-cyber-hackers"
Candidate 2: "Sanctions won't work

The problem with sanctions is that they almost never work so all they do is provide punishment and damage relations without ever resolving the issue. Numerous studies have shown that sanctions don’t actually change the policy of the country that is being sanctioned. [1] Robert Pape suggests that sanctions are only effective in achieving policy change about 5% of the time because states can take substantial economic punishment before they give up on anything that might be considered to be a national interest, and because states are good at shifting the burden of the sanctions onto opposition groups, [2] or else use the sanctions to rally domestic support against the outside actor. [3]

Instead there need to be renewed cooperation on cyber security. Fundamentally as with things like drug smuggling, and people trafficking this is an international problem that needs to be tackled by law enforcement authorities. To that end there needs to be more cooperation not more recriminations. [4]

[1] Lindsay, James M., ‘Trade Sanctions As Policy Instruments: A Re-Examination’, International Studies Quarterly, Vol.30, Issue 2, June 1986, pp.153-170, http://www.stanford.edu/class/ips216/Readings/lindsay_86.pdf , p.1 provides a list of some of them

[2] Pape, Robert A., ‘Why Economic Sanctions Do Not Work’, International Security, Vol. 22, Issue 2, Autumn 1997, pp.90-137, http://www.stanford.edu/class/ips216/Readings/pape_97%20(jstor).pdf p.106

[3] Snyder, Jack, Myths of Empire, Cornell University Press, 1991

[4] Dingli, Shen, ‘What Kerry Should Tell China’, Foreign Policy, 11 April 2013, http://www.foreignpolicy.com/articles/2013/04/11/what_kerry_should_tell_china"
Candidate 3: "How do we determine what is proportionate? If some valuable intellectual property, such as part of the designs for the US's latest fighter jet the F35, which were hacked in 2009. [1] Then what can be the response to this? Can it simply be the cost of developing this design? If so then what about the strategic loss the state has suffered, how can that be calculated in? So long as it is excluded state sanctioned cyber-attacks will not be deterred.

[1] Gorman, Siobhan, Cole, August, and Dreazen, Yochi, ‘Computer Spies Breach Fighter-Jen Project’, The Wall Street Journal, 21 April 2009, http://online.wsj.com/article/SB124027491029837401.html.html"
Candidate 4: "An asymmetric response to cyber-attacks in the form of sanctions may prevent escalation, but they could also simply encourage a cyber-attacker to do more knowing that sanctions cannot stop cyber-attacks. Sanctions in the past have rarely changed policy; Sanctions against Cuba did not result in overthrowing Castro, sanctions have not changed North Korea or Iran’s policy towards nuclear weapons, so there is little reason that sanctions would stop cyber-attacks. [1] Instead the country being sanctioned will find a way around and quite possibly escalate themselves much as North Korea has upped the stakes whenever new sanctions are imposed, most recently by cancelling a hotline to the South. [2]

[1] Friedman, Lara, ‘Getting over the sanctions delusion’, Foreign Policy The Middle East Channel, 14 March 2010, http://mideast.foreignpolicy.com/posts/2010/03/15/getting_over_the_sanctions_delusion

[2] Branigan, Tania, ‘Expanded UN sanctions on North Korea prompt rage from Pyongyang’, guardian.co.uk, 8 March 2013, http://www.guardian.co.uk/world/2013/mar/08/north-korea-rages-un-sanctions"
Candidate 5: "Sanctions require international agreement to be effective

When is it legitimate to use sanctions in response to an action? Any individual state (or group of states) can use sanctions against any other state. However for these sanctions to be effective they need to have broad based support. Sanctions by an individual country are unlikely to change the behaviour of an aggressor as they will be able to get around the sanctions. Moreover for any country that is a member of the WTO imposing sanctions may be considered illegal allowing the other country to counter them with similar measures.

The problem then is that there is no international response to hacking and it is unlikely there will be agreement on such a response. When countries like China deny that hacking comes from them are they likely to support the use of sanctions against such actions? Sanctions for much worse actions are often bogged down when they are attempted at the international level such as China and Russia vetoing sanctions against Syria in response to the violence there. [1]

[1] United Nations Security Council, ‘Security Council fails to adopt draft resolution on Syria that would have threatened sanctions, due to negative votes of China, Russian Federation’, un.org, SC/10714, 19 July 2012, https://www.un.org/News/Press/docs/2012/sc10714.doc.htm"
Candidate 6: "Sanctions won't harm the hackers

Sanctions are typically used as a response to the actions of another state, not the actions of a private actor. Much cyber espionage is not carried out by government entities such as the army or intelligence services. It is also not encouraged by government regulation. Rather it is carried out by private actors whether this is criminal organisations or businesses seeking to undermine their rivals and learn their secrets this is usually with a financial motive (75% of data breaches) [1] , or else by individuals motivated by nationalism and patriotism to attack those they see as their nation’s enemies. It is difficult to see how sanctions against the nation as a whole affect these groups and individuals. This is certainly the case in China where many such as the ‘China Eagle Union’ admit to hacking for nationalist reasons rather than being told by the government. [2]

A response such as sanctions are simply likely to breed more resentment that the other power is attempting to bully their nation. The hackers only possible response is then more hacking. For those sponsored by companies if their company is hit by sanctions it simply becomes all the more necessary to find methods of getting ahead to offset any harm by sanctions.

[1] Verizon RISK Team, ‘2013 Data Breach Investigations Report’, Verizon, 23 April 2013, http://www.verizonenterprise.com/DBIR/2013/ p.6

[2] Beech, Hannah, ‘China’s Red Hackers: The Tale of One Patriotic Cyberwarrior’, Time, 21 February 2013, http://world.time.com/2013/02/21/chinas-red-hackers-the-tale-of-one-patriotic-cyberwarrior/"
Candidate 7: "Sanctions are indiscriminate

The problem with sanctions is that they are almost always indiscriminate; Iran’s sanctions today are an example where the international community’s concerns are entirely with the government, over nuclear weapons, not the people yet the result has been a doubling in the price of staple foodstuffs and rapidly rising unemployment. [1]

This will equally be the case here. While sanctioners will try to target the sanctions the fact is there is nothing to target with sanctions that would not affect everyday lives. Hackers are ordinary people so clearly sanctions will affect others like themselves. The most obvious reactions involve the internet but blocking access to internet services, or penalising ISP’s, or cutting off technology transfers, harm everyone else as much as hackers. Often this harm is in the form of simply making the internet less safe for people in that country because they will have to turn to pirated versions of software. IDC and Microsoft estimate the chances of being infected with malware when using pirated software at one in three [2] so it is no surprise that the Chinese government in October 2012 launched a campaign to have government and companies purchase legal software. [3]

[1] The Economist, ‘A red line and a reeling rial’, 6 October 2012, http://www.economist.com/node/21564229

[2] IDC, ‘White Paper: The Dangerous World of Counterfeit and Pirated Software’, Microsoft, March 2013, http://www.microsoft.com/en-us/news/download/presskits/antipiracy/docs/IDC030513.pdf p.3

[3] Xinhua, ‘Chinese gov’t says no to pirated software’, People’s Daily Online, 26 April 2013, http://english.peopledaily.com.cn/90882/8224829.html"
Candidate 8: "Sanctions cannot be very finely targeted and will always hit other groups as well as the cyber attackers. The chances of knowing specific individuals who were responsible are next to zero so those individuals cannot be targeted directly. This is the whole problem with cyber-attacks; they are very difficult to pin down. In the best case then sanctions are applied against the right target and happen to hit others as well; for example hackers are not the only new who want advanced computer equipment. At worst the sanctions will completely miss their target; it would be a major embarrassment for a country to impose sanctions for a cyber-attack only for it to later be discovered that the sanctions are against an innocent party through whom the attack had been routed."

Sanctions cannot be very finely targeted and will always hit other groups as well as the cyber attackers. The chances of knowing specific individuals who were responsible are next to zero so those individuals cannot be targeted directly. This is the whole problem with cyber-attacks; they are very difficult to pin down. In the best case then sanctions are applied against the right target and happen to hit others as well; for example hackers are not the only new who want advanced computer equipment. At worst the sanctions will completely miss their target; it would be a major embarrassment for a country to impose sanctions for a cyber-attack only for it to later be discovered that the sanctions are against an innocent party through whom the attack had been routed.
