Recently, a number of US newspapers announced that their security had been compromised by Chinese hackers. Though Beijing has categorically denounced such actions as illegal, many sources point to a notable lack of effort to crack down on such efforts. Moreover, in an editorial in the Wall Street Journal, one U.S. lawmaker with experience in the field of cyber-security was quoted as saying that there are only two kinds of American companies nowadays: those who have been hacked and those who don’t know that they have.
Cyber-warfare, especially cyber-terrorism, is not a new phenomenon. Notorious hacker group Anonymous is infamous for its DDoS attacks on sites that attract its ire. However, never before have such a high concentration of attacks come from outside our borders. Because this is such a new foreign policy area, many details of U.S. strategy in the event of such attacks do not yet exist. What is an appropriate retaliatory response? If the attack comes from an individual or group thereof, is it to be considered an act of war? Can such individuals be forced to stand trial in U.S. courts, or would the home country have jurisdiction?
These questions have yet to be substantively answered, but they deserve more attention than they are currently getting. The companies most recently targeted companies were newspapers, but it is not a great stretch to imagine what other highly sensitive information could be acquired in this manner. It could be as simple as the real formula for Coca-Cola, or as sensitive as the specifications for U.S. military materiel. As tensions between the West and the Far East build, I’m given to wonder: will hacking be the precursor to or the cause of the next war among the great powers?
I think it should be interesting to see where the jurisdiction will lie considering the attacks are over cyberspace and not in a discrete location. I do not see the Chinese government allowing the US to try individuals inside of China who are cyber hacking US companies. Unless the hackers were ordered by the Chinese government and highly sensitive government information was taken would it be considered an act of war.
How to police when location is hard to prove … and jurisdictions amorphous, all are interesting issues. I suspect someone at the Law School could help. How can “hacking” be defined in a way to distinguish criminal behavior from searching through web pages that are only lightly protected?
Is spying an “act of war”? I don’t think so.