4 ms·

This is wrong on so many levels. The worst is that it undermines the actual Geneva Convention by borrowing its name to advocate something totally different. The

by d--b 10y ago

This is wrong on so many levels. The worst is that it undermines the actual Geneva Convention by borrowing its name to advocate something totally different. The Geneva Convention doesn't ask for "no fighting", but rather gives boundaries to keep fighting within "human-ish" levels. I think everyone agrees that hacking is not inhumane...

Teever 10y ago
And when that hacking results in a power plant in a region being taken offline and after several days of emergency power several babies in incubators die is that still humane?
- steverb 10y ago
  And when a power plant in a region is taken offline via conventional means? That isn't covered by the Current Laws of Land Warfare, why should a digital version be any different?
  - zeveb 10y ago
    I think that it is covered by the laws of war: as long as the military benefit of attacking the power plant is sufficient to outweigh the collateral damage, it's legal. If you're wrong, and you lose, then you hang after the war is over.
    - steverb 10y ago
      You are correct. I should have said that it's not prohibited.
  - dragonwriter 10y ago
    > And when a power plant in a region is taken offline via conventional means? That isn't covered by the Current Laws of Land Warfare While details of the context will matter, an attack on such a plant would potentially implicate any or all of Arts. 51-56 (exc. 53) of Protocol I to the 1949 Conventions (the US is not a party to Protocol I but had traditionally viewed it's terms as declarative of and redundant with pre-existing customary international law.)
- 903c4e46dba7 10y ago
  We do have international treaties, prohibited attacks to e.g. nuclear reactors. For these facilities, a Digital Geneva Convention is needed.
  - steverb 10y ago
    Do those treaties apply only to non-digital attacks?
    - dragonwriter 10y ago
      One could probably make a case that, e.g., Additional Protocol I protections apply equally to cyberattacks were one litigating a case; the problem is that laws of warfare are "laws" that rely more on everyone sharing an understanding and treating them as reciprocal moral rules rather than enforcement through litigation. So an explicit recognition is vastly better than an ambiguity that you think a court would resolve in your favor if it had the opportunity, even moreso than in the case of, say, domestic criminal law.
  - PeterisP 10y ago
    Do we have such treaties, can you point me at one of them? IIRC nuclear reactors have been explicitly targeted (https://en.wikipedia.org/wiki/Vulnerability_of_nuclear_plants_to_attack#Military_attacks https://en.wikipedia.org/wiki/Vulnerability_of_nuclear_plant...) and would be so in the future; although common sense states that both parties would want to avoid a Chernobyl-like event in their battlezone. Furthermore, this would be a perfect example where a "digital Geneva convention" would not be needed; you'd want a treaty expressing mutual agreement that everyone understands that destruction of such facilities is not in anyone's best interest, and everyone agrees not to do it in principle - without any reference to specific means of destruction; the same principles should apply for digital attacks as for bombing or insider sabotage. The Geneva convention Protocol I states that facilities like nuclear reactors "may be attacked but only in ways that do not threaten to release the dangerous forces", and that seems a perfectly valid description - there is no blanket prohibition to attack them, you are explicitly allowed to bomb or sabotage the nuclear plant in a way that disables it but not in a way that causes a meltdown; so you'd be also allowed to hack it in a way that disables it but not in a way that causes a meltdown.
- mindslight 10y ago
  That sounds beyond gross negligence (better described as maliciousness, really) by whomever set up that power plant control network. They probably belong in prison.
- PeterisP 10y ago
  Taking down key enemy infrastructure during wartime is generally legitimate, even if it's clear that civilians will die as a side effect. The current treaties prohibit explicitly targeting civilians, but as long as the target has a military use as well, it's valid even if it's mixed with civilians. Bombing the defense ministry (with civilian offices in the next building), armament factories (with civilian workers inside), power plants necessary to run these factories (and everything else, including hospitals), bridges or railways (with civilians on them) - all these targets generally are not prohibited. As it generally wouldn't be a violation to bomb that power plant from a plane or sabotage it via infiltrated spies, sabotage by hacking shouldn't have special treatment. Doing so should be just as [il]legal according to the exact same criteria that determines if it'd be allowed or not by conventional means.
steverb 10y ago
Or taken the other direction, this is equivalent to saying that we need a Geneva Convention for bridges, roads and buildings. I do like the idea of a digital weapons non-proliferation agreement, but I suspect that it would be even less enforceable than the nuclear version.
dragonwriter 10y ago
> The worst is that it undermines the actual Geneva Convention by borrowing its name to advocate something totally different By "the actual Geneva Convention" do you mean one of the four Geneva Conventions of 1949, or do you mean one of three previous Geneva Conventions that were predecessors of the First through Third of the 1949 Conventions? > The Geneva Convention doesn't ask for "no fighting", but rather gives boundaries to keep fighting within "human-ish" levels. As the article indicates, the new convention would parallel the protection of civilians in the Fourth Geneva Convention of 1949 by protecting civilians from being targets of nation-state cyberattacks, not prohibiting cyberattacks generally. Though I think a better model would be the protection of civilians in Additional Protocol I (1977) to the Geneva Conventions of 1949.
- halomru 10y ago
  >As the article indicates, the new convention would parallel the protection of civilians in the Fourth Geneva Convention of 1949 by protecting civilians from being targets of nation-state cyberattacks, not prohibiting cyberattacks generally. Out of their six points four simply make cyber attacks harder or nearly impossible, one exempts civilian targets from attacks, and one guarantees government help in defense and cleanup. I struggle to see much more here than an attempt from tech companies to prevent cyber war, and have them as untargatable combatants if cyber war st still occurs.
- alexandercrohde 10y ago
  I think you lack imagination. Right now computer security may not seem like an essential scenario but consider a few of these cases: 1. Self driving cars getting hacked (and killing passengers?) 2. Stock market being hacked or retirement accounts getting hacked and losing data (we don't know how much money you had) 3. Election fraud We're building a public infrastructure that is highly susceptible to security threats, meanwhile governments around the world only intensify their capacity to do inhumane things to this infrastructure (rather than building up the defenses).
amelius 10y ago
> I think everyone agrees that hacking is not inhumane... People have committed suicide for leaked information.
Theodores 10y ago
> ...but rather gives boundaries to keep fighting within "human-ish" levels. Let's say 'within profitable levels'. Not all weapons are that good for enabling an army to advance, even if lots of people are killed, e.g. poison gas. Civilians get instantly killed by the stuff but armies are tooled up to survive it, or can be. With not much profit in poison gas compared to a cruise missile laced with depleted uranium it makes sense to ban the poison gas that anyone with a degree in chemistry can make in their front room rather than the missile. Instead of cyber war being the threat those conventional and nuclear weapons are the threat, although hard to imagine if living in Kansas. What we need are some jolly clever OSS licenses that have clauses in them 'not for military use'. Microsoft could put that in their license today and go heavy on the enforcement - 'sorry Lockheed Martin you can't be using Excel to design 'echelon 2 as that is in violation of the EULA, here is the cease and desist...'. In this way we can make the military contractors fall out of the loop and be as IT savvy as North Korea. 'Don't be evil' is something we forgot about, however, again, if Google just 404'd on the military due to some EULA then that we wouldn't have so much evil in the world. Seems that 'cyber terror' is the new al-qaeda, i.e. make believe.
- wtbob 10y ago
  > What we need are some jolly clever OSS licenses that have clauses in them 'not for military use'. That may be 'open source,' for some definition of the term, but it wouldn't be free software. Nor would it be right: it is the right of any people to band together in their own self defence, and munitions are part of that. The rights to own a gun, encrypt a file and operate a computer are one and the same.
pettags 10y ago
Agreed.

by d--b 10y ago

Teever 10y ago

And when that hacking results in a power plant in a region being taken offline and after several days of emergency power several babies in incubators die is that still humane?

steverb 10y ago
And when a power plant in a region is taken offline via conventional means? That isn't covered by the Current Laws of Land Warfare, why should a digital version be any different?
- zeveb 10y ago
  I think that it is covered by the laws of war: as long as the military benefit of attacking the power plant is sufficient to outweigh the collateral damage, it's legal. If you're wrong, and you lose, then you hang after the war is over.
  - steverb 10y ago
    You are correct. I should have said that it's not prohibited.
- dragonwriter 10y ago
  > And when a power plant in a region is taken offline via conventional means? That isn't covered by the Current Laws of Land Warfare While details of the context will matter, an attack on such a plant would potentially implicate any or all of Arts. 51-56 (exc. 53) of Protocol I to the 1949 Conventions (the US is not a party to Protocol I but had traditionally viewed it's terms as declarative of and redundant with pre-existing customary international law.)
903c4e46dba7 10y ago
We do have international treaties, prohibited attacks to e.g. nuclear reactors. For these facilities, a Digital Geneva Convention is needed.
- steverb 10y ago
  Do those treaties apply only to non-digital attacks?
  - dragonwriter 10y ago
    One could probably make a case that, e.g., Additional Protocol I protections apply equally to cyberattacks were one litigating a case; the problem is that laws of warfare are "laws" that rely more on everyone sharing an understanding and treating them as reciprocal moral rules rather than enforcement through litigation. So an explicit recognition is vastly better than an ambiguity that you think a court would resolve in your favor if it had the opportunity, even moreso than in the case of, say, domestic criminal law.
- PeterisP 10y ago
  Do we have such treaties, can you point me at one of them? IIRC nuclear reactors have been explicitly targeted (https://en.wikipedia.org/wiki/Vulnerability_of_nuclear_plants_to_attack#Military_attacks https://en.wikipedia.org/wiki/Vulnerability_of_nuclear_plant...) and would be so in the future; although common sense states that both parties would want to avoid a Chernobyl-like event in their battlezone. Furthermore, this would be a perfect example where a "digital Geneva convention" would not be needed; you'd want a treaty expressing mutual agreement that everyone understands that destruction of such facilities is not in anyone's best interest, and everyone agrees not to do it in principle - without any reference to specific means of destruction; the same principles should apply for digital attacks as for bombing or insider sabotage. The Geneva convention Protocol I states that facilities like nuclear reactors "may be attacked but only in ways that do not threaten to release the dangerous forces", and that seems a perfectly valid description - there is no blanket prohibition to attack them, you are explicitly allowed to bomb or sabotage the nuclear plant in a way that disables it but not in a way that causes a meltdown; so you'd be also allowed to hack it in a way that disables it but not in a way that causes a meltdown.
mindslight 10y ago
That sounds beyond gross negligence (better described as maliciousness, really) by whomever set up that power plant control network. They probably belong in prison.
PeterisP 10y ago
Taking down key enemy infrastructure during wartime is generally legitimate, even if it's clear that civilians will die as a side effect. The current treaties prohibit explicitly targeting civilians, but as long as the target has a military use as well, it's valid even if it's mixed with civilians. Bombing the defense ministry (with civilian offices in the next building), armament factories (with civilian workers inside), power plants necessary to run these factories (and everything else, including hospitals), bridges or railways (with civilians on them) - all these targets generally are not prohibited. As it generally wouldn't be a violation to bomb that power plant from a plane or sabotage it via infiltrated spies, sabotage by hacking shouldn't have special treatment. Doing so should be just as [il]legal according to the exact same criteria that determines if it'd be allowed or not by conventional means.

steverb 10y ago

Or taken the other direction, this is equivalent to saying that we need a Geneva Convention for bridges, roads and buildings. I do like the idea of a digital weapons non-proliferation agreement, but I suspect that it would be even less enforceable than the nuclear version.

dragonwriter 10y ago

> The worst is that it undermines the actual Geneva Convention by borrowing its name to advocate something totally different By "the actual Geneva Convention" do you mean one of the four Geneva Conventions of 1949, or do you mean one of three previous Geneva Conventions that were predecessors of the First through Third of the 1949 Conventions? > The Geneva Convention doesn't ask for "no fighting", but rather gives boundaries to keep fighting within "human-ish" levels. As the article indicates, the new convention would parallel the protection of civilians in the Fourth Geneva Convention of 1949 by protecting civilians from being targets of nation-state cyberattacks, not prohibiting cyberattacks generally. Though I think a better model would be the protection of civilians in Additional Protocol I (1977) to the Geneva Conventions of 1949.

halomru 10y ago
>As the article indicates, the new convention would parallel the protection of civilians in the Fourth Geneva Convention of 1949 by protecting civilians from being targets of nation-state cyberattacks, not prohibiting cyberattacks generally. Out of their six points four simply make cyber attacks harder or nearly impossible, one exempts civilian targets from attacks, and one guarantees government help in defense and cleanup. I struggle to see much more here than an attempt from tech companies to prevent cyber war, and have them as untargatable combatants if cyber war st still occurs.
alexandercrohde 10y ago
I think you lack imagination. Right now computer security may not seem like an essential scenario but consider a few of these cases: 1. Self driving cars getting hacked (and killing passengers?) 2. Stock market being hacked or retirement accounts getting hacked and losing data (we don't know how much money you had) 3. Election fraud We're building a public infrastructure that is highly susceptible to security threats, meanwhile governments around the world only intensify their capacity to do inhumane things to this infrastructure (rather than building up the defenses).

amelius 10y ago

> I think everyone agrees that hacking is not inhumane... People have committed suicide for leaked information.

Theodores 10y ago

> ...but rather gives boundaries to keep fighting within "human-ish" levels. Let's say 'within profitable levels'. Not all weapons are that good for enabling an army to advance, even if lots of people are killed, e.g. poison gas. Civilians get instantly killed by the stuff but armies are tooled up to survive it, or can be. With not much profit in poison gas compared to a cruise missile laced with depleted uranium it makes sense to ban the poison gas that anyone with a degree in chemistry can make in their front room rather than the missile. Instead of cyber war being the threat those conventional and nuclear weapons are the threat, although hard to imagine if living in Kansas. What we need are some jolly clever OSS licenses that have clauses in them 'not for military use'. Microsoft could put that in their license today and go heavy on the enforcement - 'sorry Lockheed Martin you can't be using Excel to design 'echelon 2 as that is in violation of the EULA, here is the cease and desist...'. In this way we can make the military contractors fall out of the loop and be as IT savvy as North Korea. 'Don't be evil' is something we forgot about, however, again, if Google just 404'd on the military due to some EULA then that we wouldn't have so much evil in the world. Seems that 'cyber terror' is the new al-qaeda, i.e. make believe.

wtbob 10y ago
> What we need are some jolly clever OSS licenses that have clauses in them 'not for military use'. That may be 'open source,' for some definition of the term, but it wouldn't be free software. Nor would it be right: it is the right of any people to band together in their own self defence, and munitions are part of that. The rights to own a gun, encrypt a file and operate a computer are one and the same.

pettags 10y ago

Agreed.