## 3 State-Level Cyber Conflict
Of course, just because a cyber-weapon employs bits rather than bombs does not mean that it cannot cause serious damage, including deadly explosions. In determining whether a particular cyber-weapon offers a moral advantage over a kinetic one, all effects must be considered. Although reports of state-level cyber-attacks have been few and far between, states are frequently accused of penetrating each other's networks in order to steal government and commercial secrets. State-level espionage has always been considered fair game, even during peacetime, and cyberspace has proven to be an easy and effective means for collecting information. China alone has been blamed for numerous instances of snooping against US and international targets since 2003, including incidents dubbed Titan Rain, Byzantine Hades, GhostNet, Shadows, Aurora, Night Dragon, Shady RAT, and Nitro. According to US intelligence agencies, most of the spying from China traces back to groups associated with China's People's Liberation Army [19]. Even earlier, Russia reportedly stole information from US Department of Defense networks beginning in the late 1990s in an incident named Moonlight Maze. Although cyber-espionage is not the same as cyber-attack, their technologies are not all that different, as both require mechanisms to penetrate systems, access information, control operations, and conceal activity and effects. Thus, any country with a cyber-espionage capability is likely to also have a cyber-attack capability. According to Admiral [PERSON], former Director of National Intelligence, most industrialized countries in the world today have these capabilities, at least to some degree. Other intelligence officials have suggested that the number of militaries with a \"respectable cyber war capability\" is around twenty to thirty. Besides those I have already mentioned in this article, namely the US, Israel, China, and Russia, the list includes Taiwan, Iran, Australia, South Korea, India, Pakistan, and several NATO states, to include France [17, p. 64]. Whether Stuxnet has affected these cyber-warfare capabilities is hard to say. Governments had been developing them independent of Stuxnet. Still, Stuxnet represented an advanced cyber-attack against the ICS of another state. Given its exposure, it may influence the types of cyber-weapons that states develop and accelerate a state-level cyber-arms race. It is not surprising that Iran was reportedly investing $1 billion to boost its offensive and defensive cyber-warfare capabilities after it had been hit by Stuxnet [20]. Stuxnet is frequently mentioned in academic and policy discussions about cyber-warfare and security, at both domestic and international levels. It that regard, it may have helped bring cyber-warfare from \"the shadows of the clandestine world into the limelight,\" as [PERSON] opined [1]. Although cyber-warfare had been the subject of discussion well-before the Stuxnet attack, Stuxnet provided an actual incident, allowing the discussions to move beyond the hypothetical scenarios normally employed to a concrete example that had been experienced and documented. In so doing, it could help advance our understanding of how the law of armed conflict (LOAC) applies to cyberspace. While some might argue that Stuxnet represents a \"use of force\" in violation of Article 2(4) of the United Nations Charter, others might view Stuxnet as something less than force or as a reasonable use of force against the threat posed by Iran's nuclear program under Article 51. For those in the latter camp,Stuxnet becomes not only permissible under LOAC, but morally preferred over a kinetic strike, at least if its collateral effects are ignored. By providing a specific cyber-weapon and context for its deployment, Stuxnet lets us not only examine the application of LOAC, but also see how a cyber-attack can potentially offer a kinder and gentler means of achieving a just objective than through the application of traditional force.