Download Hack, Attack Or Whack; the Politics of Imprecision in Cyber Law Book in PDF, ePub and Kindle
NATO has a section of their website with a timeline of the history of cyber-attacks. An intriguing aspect of the list is that many of the events listed are referred to as hacks, without any definitive explanation of why or how they qualify as cyber-attacks. On September 3, 2013, abc NEWS reported that, "U.S. officials confirmed a cyber attack by the Syrian Electronic Army on the Marine Corps recruiting website late Monday in which the pro-Assad collective replaced the normal page with on calling on U.S. servicemen to refuse orders to fight in Syria should they be called." On September 10, 2013, Fox published a story titled, "Hackers Plot 9/11 Cyber Attacks on U.S., Israel." The article explains that "Politically-motivated hackers recently announced a call to arms to Muslim hackers aimed at attacking U.S. and Israeli websites on Wednesday, the 12th anniversary of the September 11 terrorist attacks." The Markey- Waxman report, based on information gathered through a survey containing 15 questions and sent to more than 150 utility companies, found that the electric grid is the target of numerous and daily cyber attacks. "Those events range from phishing emails to malware infections to unfriendly probes." Thus it is all too clear that any cyberintrusion, whether mundane or malicious, from a teenager, a criminal or a nation state, regardless of place of origin, is likely to be described as a cyberattack. However, to a military attorney the term "cyber-attack" actually includes only a small segment of this spectrum of activity. Cyber-attacks must meet certain criteria to justify this designation, i.e., involving damage or destruction to property or injury or death to persons. If we use this definition, arguably, there have only been a handful of actual cyber-attacks that rise to the level of either use of force or armed attack over the past ten years or so. Indeed, some would argue that we have yet to see an actual cyber-attack. I can only think of two examples, that if perpetrated against the United States, would likely be considered either a use of force or armed-attack for cyber purposes: Stuxnet and the Iranian attack on Saudi Aramco. We can arguably use these as baselines for future events - we know it when we see it.
