Atlantic Council

Jason Healey, director of the Council's Cyber Statecraft Initiative, authored a paper (PDF) on how neutrality applies to cyber conflict.

In cyber conflict, there are vexing questions on which traditional international norms still apply, whether they apply but with modifications, or whether entirely new norms must be invented. One of the most important norms has been for states to be able to remain neutral in response to international conflict, with rights and responsibilities guaranteed by the Hague Convention. Because of the nature of cyber conflict, such legal norms may be less useful. The Internet protocols themselves route cyber attacks through any number of neutral countries, cyber conflicts are usually not so destructive to obviously trigger international law, and the identity or nationality of the belligerents may not be obvious.

Fortunately, a norm of political neutrality may be able to stand in. Nations might (and probably should) accordingly come under political pressure to take reasonable steps to stop cyber attacks, regardless of whether or not it is a formal treaty obligation. The paper explores this issue and ways a nation may be less than neutral, tying this to a ten-point spectrum of state responsibility to help determine just how responsible a nation might be in a cyber conflict. Nations are likely to face strong pressure to stop attacks sourced or transiting though their systems when the attack is particularly severe, obvious, stoppable and long-duration.

Moreover, as the private sector are the ones that actually own most of the global cyber infrastructure, it is not states but companies that would actually cease to route attacks during a cyber conflict. Accordingly, the paper proposes that commercial neutrality may be, in future, a far more important norm.

You can follow Jason's views on cyber cooperation and conflict on the New Atlanticist blog and on Twitter (@Jason_Healey).