 expense.408 As this example illustrates, one advantage of non-zero-sum cyberwarfare is that it lets an aggressive nation-state engage in a surreptitious sequence of attacks the purpose of which is to incrementally improve its strategic position with regard to another nation-state. The attacks are in effect battles in a virtual war, a war the opponent may not be aware of for some time, if ever. Since non-zero-sum cyberwarfare offers this and other advantages, low-level, ambiguous attacks are likely to be far more common than their more traditional counterparts.
408 A series of attacks in 2007 seem to have had a similar goal. See Sevastopulo, Chinese Military Hacked into Pentagon, supra. In June of 2007, Pentagon computer networks suffered a series of attacks that the Pentagon said came from the Chinese military, from PLA hackers. See id. According to stories about this incident, China routinely probes U.S. military networks, and the Pentagon “is assumed” to do the same for China’ military networks. See id. The June, 2007 attacks, though, raised the U.S. military’s “concerns to a new level because of fears China had shown it could disrupt systems at critical times.” Id. According to a former Pentagon official, the PLA hackers “demonstrated the ability to conduct attacks that disable our system... and the ability in a conflict situation to re-enter and disrupt on a very large scale.” Id. If the reports of these attacks are accurate, they at least arguably represent a type of non-zero-sum cyberwarfare: They seem to have been part of a sequenced campaign to compromise the U.S. military’s defenses against hostile intrusions by (a) establishing a “back door” into Pentagon systems and (b) achieving the ability to disrupt those systems. The presumable purpose is to put the PLA in a position to impair the Pentagon’s ability to respond a cyber- and/or real-world attack. 409 See The North Atlantic Treaty, Article 5 (Washington, D.C., April 4, 1949), http://www.nato. int/docu/basictxt/treaty.htm (“The Parties agree that an armed attack against one... of them... shall be considered an attack against them all and... that... each of them... will assist the Party... attacked by taking forthwith, individually and in concert with the other Parties, such action as it deems necessary, including the use of armed force, to restore and maintain the security of the North Atlantic area”).
410 See, e.g., Anne Applebaum, e-Stonia under Attack, Slate (May 22, 2007), http://www.slate. com/id/2166716/. 411 Estonian Defense Minister Jaak Avikson said, “NATO does not define cyber-attacks as military action” within the Treaty. Russia’s Cyber War with Estonia Rocks NATO, The Inquirer (May 18, 2007), http://www.theinquirer.net/default.aspx?article=39714. In asking NATO to create a policy on the issue, he noted that “[i]f a power station is attacked and destroyed by a rocket, it is deemed a military attack, but if it is attacked over the Internet and the same result is achieved, international legislation cannot deal with it.” Henry Meyer and Ott Ummelas, Estonia Asks NATO to Help Foil “Cyber Attack” Linked to Russia, Bloomberg.com (May 17, 2007), http://www.bloomberg.com/apps/news?pid= 20601085&sid=abGseMma5MjU&refer=Europe. 412 See, e.g., NATO Ponders Cyberwarfare, Homunculus ( June 20, 2007), http://philipball. blogspot.com/2007/06/nato-ponders-cyberwarfare-if-i-were.html. 413 See Bucharest Summit Declaration (April 3, 2008), North Atlantic Treaty Organization, http://www.nato.int/docu/pr/2008/p08-049e.html. 414 See id. 415 Defending against Cyber Attacks, NATO, http://www.nato.int/issues/cyber_defence/ practice.html. 416 NATO Transformation has “the lead” strategic role for “the transformation of NATO’s military structures, forces, capabilities and doctrines” in order to improve NATO’s effectiveness. Supreme Allied Commander NATO, NATO, http://www.nato.int/issues/sact/index.html.
is correct, then a nation-state that correctly determines it is the target of cyberwarfare attacks by a hostile nation-state cannot retaliate with conventional military force; it can, presumably, launch retaliatory cyberattacks.421 This creates the possibility that nation-states with sophisticated cyberwarfare capabilities could attack states that have few if any, cyberwarfare capabilities with essential impunity. Under the current law of war, the attacked state apparently could not respond to such an attack with military force (unless it were accompanied by the use of such force); because it lacks the capacity to retaliate effectively in cyberspace, the victim nation-state might, like the hypothetical victim of the electronic blockade I noted earlier, be forced to surrender to its virtual adversary.
Nation-states In Chapter 3 we saw that war is, and has for centuries been, the exclusive province of nation-states. That proposition reflects empirical reality: Only nation-states can assemble the manpower, equipment, and other resources needed to wage war. War has by default been a contest between nationstates, a contest triggered by one state’s attacking another. I am going to argue that cyberspace will alter that conception of war; in making that argument, I will retain the premise that “war” necessarily involves a hostile attack on a nation-state or its equivalent. Before I proceed with my argument, I should explain why I included “or its equivalent” in that statement and what I mean by this phrase. A number of scholars contend that we will see the decline and disappearance of the nation-state, a process that will begin in the perhaps not-too-distant future.422 Essentially, those who take this view agree with Martin van Creveld that government and state are emphatically not the same. The former is a person or group which makes peace, wages war, enacts laws, exercises 421 See. e.g., Eric Talbot Jensen, Computer Attacks on Critical National Infrastructure: A Use of Force Invoking the Right of Self-Defense, 38 Stanford Journal of International Law 207, 230–231 (2002). 422 See, e.g., Martin van Creveld, The Rise and Decline of the State 415–421 (Cambridge University Press 1999). See also John Robb, Brave New War 184–188 ( John Wiley 2007); Jeffrey K. Walker, Thomas P. Keenan Memorial Lecture: The Demise of the Nation-State, the Dawn of New Paradigm Warfare, and a Future for the Profession of Arms, 51 Air Force Law Review 323 (2001). Some who subscribe to this view of a “post-Westphalian” world order see nation-states as surviving but ceasing to be the dominant global force. See, e.g., Walker, Thomas P. Keenan Memorial Lecture, supra at 325–332.
423 van Creveld, The Rise and Decline of the State, at 415. 424 See id. at 416. 425 See id. 426 See id. 427 See id. at 416–417. 428 See id. at 417–420. 429 See id. 430 See id. 431 See id.
432 See id. 433 See, e.g., “De jure,” Wikipedia, http://en.wikipedia.org/wiki/De_jure (in Latin, de jure “means `based on law’, as contrasted with de facto, which means `in fact’ ”). 434 See id.
Non-nation-state attacks are, essentially by default, defined as threats to internal order—cybercrime or cyberterrorism. That outcome is unsatisfactory because it distorts the true nature of the threat and, in so doing, can impede a victim’s ability to respond. As far as cyberwarfare is concerned, anyway, we need to revise the current definition of warfare so it encompasses non-nation-state attacks on nation-states or their equivalent. To understand why we need to do this, it is perhaps useful to consider a development in the real-world: the dramatic resurgence of mercenary armies or “private military companies.”435 Nation-states with substantial militaries use mercenaries on occasion to supplement their own resources; smaller, more fragile countries rely on them for protection against aggressive neighbors and other enemies.436 So far, private combatants at least ostensibly wage war only on behalf of nation-states,437 but some observers believe they “may be a threat to legitimate governments.”438 Many also believe they signal a resurgence of an old trend, the privatization of warfare,439 which may spread to cyberspace. The cyberworld is certainly a hospitable environment: Developing the capacity to wage real-world warfare takes a great investment of money and other resources, some of which can be difficult to obtain;440 developing the capacity to wage cyberwarfare is, as we have seen, a much less onerous process.441 I suspect that many, if not most, multinational corporations could today launch cyberwarfare attacks on hapless nation-states, if they were so inclined.442 435 See, e.g., Christopher H. Lytton,