Permissible Preventive Cyberwar: Restricting Cyber Conflict to Justified Military Targets

Abstract

Evaluations of cyber war and weapons range from denunciations of their widespread and indiscriminate destructiveness and deliberate targeting of civilian infrastructure, all the way to appraisals of cyber warfare as a morally preferable, less destructive alternative to conventional warfare. This chapter will bring some order to this chaos by distinguishing permissible from impermissible forms of cyber conflict, as well as distinguishing genuine “warfare” from large-scale criminal or terrorist enterprises. The chapter will criticize the lack of discrimination often encountered in the formulation of cyber strategy and development of cyber weapons, and argue in favor of international governance and guidance that (with reference to proportionality, discrimination, and the principle of last resort) restricts the use of cyber weapons to justified military targets, using Stuxnet as a recent case in point. In ethics, we can infer or derive operable constraints on, and guidelines for acceptable practice by examining instances of what all agree is either good or bad practice, just as in international law, we recognize the evolution of customary law through the accepted conduct of otherwise law-abiding states. Hence, I will argue that an act of cyberwarfare is permissible if it aims primarily at harming military (rather than civilian) infrastructure, degrades an adversary’s ability to undertake highly destructive offensive operations, harms no civilians and/or destroys little or no civilian infrastructure in the process, and is undertaken as a “last resort” in the sense that all reasonable alternatives short of attack have been attempted to no avail, and further delay would only make the situation worse.