Time to rewrite the rules on cyberattacks

[Commentary] How do the recent Iranian assaults differ from Stuxnet? That was the computer worm deployed by the United States and Israel to wreck centrifuges in Iran making enriched uranium that could be used in a nuclear bomb. The attack methods were similar; Stuxnet also targeted industrial control mechanisms. But Stuxnet was aimed only at Iran’s illicit weapons-making ability, not at harming civilians. The distinction is important — just like the difference between military and civilian targets matters in other forms of war. So far, the world’s major powers have managed to coalesce only around some informal and voluntary norms of behavior for cyberconflict. Perhaps it is time to set them down more concretely and firmly rule out floods and blackouts as tools of cyberattack.