Cyberspace, self-defense, and the law of the sea

[Commentary] If you happened to turn your eyes towards Capitol Hill, you might have witnessed the latest round of senatorial efforts to discover an effective cybersecurity strategy.

In a pair of hearings, Senators and administration officials focused on stricter data breach reporting regulations and expanded liability protection. Sen John McCain (R-AZ) again proposed a separate committee on cybersecurity. Federal Trade Commission Chairwoman Edith Ramirez stressed that the government needs stricter rules for data breach reporting and greater freedom to prosecute offending institutions.

Our congressmen and women would do well to read “Navigating Conflicts in Cyberspace: Lessons from the History of War at Sea” by Professor Jeremy Rabkin of the George Mason School of Law (and Adjunct Scholar here at AEI) and his son, Ariel Rabkin. In their article, published in the Chicago Journal of International Law in the summer of 2013, the Rabkins redirect the reader’s gaze from small-scale modifications to a broader, more ambitious proposal: “ground American policy on cyberattacks in…[the body of law] dealing with armed conflict on the high seas.”

Currently, the law of armed conflict governs American and international cyber conflict. These rules, the Rabkins argue, unduly limit national and private cyber defense options. Cyberattacks, however, do not solely target military facilities, personnel, or capabilities, nor do they solely originate from military facilities or personnel. The law of armed conflict, by designating military objectives as the only acceptable targets of armed responses -- cyber retaliation included -- fails to account for the civilian involvement that is an unavoidable reality of conflicts in cyberspace.

Underlying the Rabkins’ proposal is a basic and natural argument for adopting the laws governing conflict at sea: the right of self-defense. The same should apply to companies operating in cyberspace.

[Cunningham is a Research Assistant at the Center for Internet, Communications, and Technology Policy (AEI)]