Source: https://www.lawfareblog.com/law-military-cyber-operations-and-new-ndaa
Timestamp: 2019-04-24 07:55:44+00:00

Document:
How will the soon-to-be-enacted NDAA alter the legal framework for military operations in the cyber domain? The House version of the bill would not have impacted this question much, but as I wrote here and here the Senate version had several interesting provisions. Well, those Senate provisions have emerged largely intact from the conference process, and the John McCain National Defense Authorization Act for fiscal 2019 almost certainly will become law soon. Here is the full text and accompanying conference report, what you need to know about how those cyber provisions turned out.
Several existing cyber operation oversight measures are being moved around within the U.S. Code, which is good housekeeping but also annoying for those of us who are accustomed to the original numbering. Ah well.
A 2015 statute directing SecDef to prepare for (and when properly authorized to do so, to conduct) cyber operations in response to hostile foreign cyber operations.
A 2017 statute that requires SecDef to submit a written notice to the Senate Armed Services Committee and House Armed Services Committee within 48 hours of military cyber ops intended to have effect in foreign locations that are not combat zones (thus roughly paralleling the model of Title 50 covert action oversight).
A 2017 statute that requires SecDef to give the Senate Armed Services Committee and House Armed Services Committee quarterly notice of “weapons reviews” for the legality of new cyber capacities, as well as 48-hour notice when such cyber “weapons” actually are used.
Professors, update your syllabi accordingly!
This section attempts to remove some interagency friction that apparently has limited Cyber Command’s capacity conduct cyber operations that would have effect outside of combat zones.
If you are not a Title 10/Title 50 nerd like me, you just need to know that this is not really a new grant of affirmative authority to act but, rather, a statute to defeat arguments to the effect that the Defense Department somehow is precluded from carrying out deniable operations in cyberspace where the effect would occur outside a combat zone.
Section 1632 is designed to put a stop to such objections, thus allowing CYBERCOM to conduct operations involving deniable infrastructure without having to face recurring objections that somehow they can’t count as TMA and thus must instead be treated as full-fledged T50 covert action.
Note, too, that the report expressly encourages the president to alter the interagency review process to speed it up as needed, but Section 1632 does not actually purport to dictate process on this point.
So far, so good. But what does Section 1632 actually say, and which part of U.S. Code will reflect this?
Under new 10 U.S.C. §394(c), “clandestine military activity or operation in cyberspace shall be considered a traditional military activity” (emphasis added) for purposes of the Title 50 exemption to the covert action framework.
Under new 10 U.S.C. §394(d), the secretary of defense shall include such activities during quarterly briefings to the Senate and House Armed Services Committees on Defense Department cyber operations (required by 10 U.S.C. §484, which absolutely should also have been moved to Chapter 19 along with the other stuff in the box above—something to do in the next NDAA!).
While Congress cannot make the president issue orders to take more aggressive actions in response to malicious foreign cyber activities, it can express its wish that he would do so and it can pave the way a bit by granting preauthorization for some such responses. That’s what Section 1642 is all about.
The conference report expresses frustration that the United States has not acted more aggressively in response to foreign hostile cyber activity. This clearly pertains to the current Trump acquiescence to Russia, but it also goes back to frustrations with the Obama administration as well. At any rate, Section 1642 underscores the fundamental concern that still more such activity is invited by failing to impose serious costs for past hostility. Hard to argue with that.
Apart from that, though, what does 1642 do as a legal matter?
1. What triggers this authority?
(2) The responsible party must be Russia, China, North Korea or Iran.
Note that Section 1642 makes the “National Command Authority” the relevant decision maker on those triggers. The NCA is, of course, the president together with the secretary of defense. Very interesting to specify the NCA as opposed to just the president, no?
2. What is then authorized?
Once those determinations are made by the NCA, Section 1642 pre-authorizes CYBERCOM in particular “to take appropriate and proportional action in foreign cyberspace to disrupt, defeat, and deter such attacks” (emphasis added by me). And the statute goes on to emphasize that this will count as “traditional military activity,” thus reinforcing Section 1632’s attempt to put an end to Title 50-related objections to CYBERCOM operations.
3. Is that really an AUMF-level of authority, or is it necessarily below the threshold at which the separation of powers comes into play and one arguably must have ongressional authorization?
As Libya, Syria, Kosovo and other examples attest, the executive branch takes a strikingly narrow view of when it needs congressional authorization for military activity in addition to Article II authority. From that point of view, Section 1642’s approval for proportional cyber actions arguably is superfluous as a legal matter (however significant it might be as a matter of policy and politics).
The War Powers Resolution (WPR) probably does not change that analysis, both because we might not be talking about activities that are likely to trigger the War Powers Resolution “clock” and because the notification requirements mentioned below (especially the one doubling-down on 10 U.S.C. §395) happen to be compatible with WPR notification requirements.
Note: This makes it merely academic to ponder what to make of the language at the end of 1642, stating that 1642 should not be read to “affect” the War Powers Resolution or the 2001 AUMF. That’s a pretty ambiguous phrase, of course. Does it mean that the 1642 authority is capped out at the level that would rise to hostilities? Would any WPR clock objection instead be met fairly with the response that 1642 is adequate authorization, satisfying without “affecting” the WPR?
4. Will we know when this authority is used?
First, Section 1642 specifies in an excess of caution that activities under this authority must be reported under 10 U.S.C. §395 (the old 10 U.S.C. §130j, with the requirement of a written notification from the secretary of defense within 48 hours).
Second, Section 1642 also adds, in another excess of caution, that this requires reporting under the quarterly system of 10 U.S.C. §484.
But of course neither of those systems specifies reporting to the public; outsiders are not often going to have a good sense of what, if any, use 1642 gets.

References: §394
 §394
 §484
 §395
 §395
 §130
 §484