Cyberwar and Customary International Law: The Potential of a "Bottom-up" Approach to an International Law of Information Operations

I. INTRODUCTION After Estonia relocated a Soviet World War II memorial in late April 2007, the country fell prey to a series of distributed attacks which suddenly jammed and disabled various websites by overcrowding the bandwidths for the servers running the sites.1 Among the servers targeted were those hosting the websites of the Estonian president, major Estonian news agencies, government ministries, and two of the country's largest banks.2 Attempts to trace some early attacks revealed that at least some of the attacks had Russian origins and were alleged to have emanated from Russian state institutions.3 The attacks seemed to pour in from around the globe, however, making Estonian assertions of culpability hard to prove.4 "Cyberwarfare," as these attacks were described, represents the emerging use of the internet to disrupt national security as cyberspace has become better developed and increasingly accessible to all parts of the world. The breadth of the attacks against Estonia, however, highlights the scope of modern technological vulnerability: attacked websites included a broad range of important networks affecting government, civil information, and financial markets, all institutions which underpin modern life. The global community's increasing reliance on information technologies has highlighted the need for governing laws for these new and evolving technologies that are being adopted at an increasingly rapid pace. Such law, however, has come in fits and starts, limited by a lack of universal accord governing these technologies, a disparity in national regulations, and questions of national sovereignty. At the same time, commentators have called into question the longstanding traditional view that customary international law is formed exclusively by states' acts and beliefs.5 The challenge to this traditional understanding, which includes an attack on the consensualist conception of international law,6 suggests a potential alternative framework by which to structure an international law governing cyberwar. This Development undertakes an analysis of this realist perspective on customary international law formation and highlights the advantages and disadvantages that relate to its application to the issue of an international law governing cyberwarfare. Section II of this Development explores the various definitions of cyberwar, information operations, information warfare, and cybercrime. This exploration attempts to create a stable ground that accounts for widening dependence on network technologies, the challenges in separating their military and nonmilitary uses, and the threats and opportunities which result from their use. Section III examines how current law governs the use of these technologies and identifies the areas in which existing law struggles to meet the challenges of the emerging technologies and their users. section IV analyzes the realist perspective of customary international law and its reflections in developing international law and considers the possibility that a nonstate-based governing law of cyberwar could emerge. II. INFORMATION OPERATIONS, INFORMATION WARFARE, AND CYBERCRIME Analyzing cyberwar requires defining the relevant terminology. Broadly defined, information operations ("IO") includes offensive and defensive actions that attack or protect information systems.7 Information systems here include the infrastructure, components, organizations, and personnel that deal with information.8 The inclusion of infrastructure and personnel makes the IO definition overly broad when developing an international law for actions solely within the networked world. Attacks against or damage to the infrastructure and its personnel can largely be addressed by existing laws, as those laws already prevent actors from committing crimes against property.9 A new law only needs to address a narrower portion of information operations. The US Air Force definition of information warfare ("IW"), concentrated on the denial, exploitation, corruption, and destruction of information within information systems (or on preventing such an event), helps limit the scope of the inquiry. …