EXACTLY! This should focus instead on outlawing cyberwar operations that indiscriminately affect civilians (and therefore could be used to justify a conventiona

EXACTLY! This should focus instead on outlawing cyberwar operations that indiscriminately affect civilians (and therefore could be used to justify a conventional or nuclear retaliation to a cyberwar act)! The list of this to be banned should look more like this (though I'm not a legal expert): - No targeting of critical infrastructure (being specific: hospitals, water treatment, powerplants, electricity grid, public schools, public universities etc. - not simply "tech companies, private sector") - and by no-targeting I also mean no planting of dormant backdoor-enablers, even if they do nothing - if you have the IMPLANTED CAPABILITY to damage a hydroelectric dam, for example, it already means you have already TARGETED it, therefore violated the convention - No stockpiling of vulnerabilities for more than X months by government agencies - any gov agency should have BE REQUIRED to publicly disclose any 0-day they get their hands on after at most 12 months or smth. like this (short term stockpiling is OK, you need some level of healthy conflict, but the playing field need to be leveled a bit) - and of course this law would not be enforced, but at least your congress for example would always have a good reason to "fire the head of the NSA for not enforcing the adherence to the 0-day chapter of the Digital Geneva convention", and this would put the balance of power where it should be - Gov agencies should be required by law to help defend companies that hold private data (the state exists to defend the people, and defending their data is part of it, even if it happens to be on some company's private servers and people signed some semi-legal-EULA-thingy letting the company do whatever with it - form gov's perspective defending that data is still about defending the people that pay the taxes) - and companies should be able to sue the gov if they believe the gov had technical capabilities to defend them, but did help them using this capabilities - Inciting a lethal-force retaliation against a non-lethal cyberwar operation should be consider equivalent to "starting a war without provocation" - if Wallstreet is hit by a cyberawr attack causing 10blns damage, you are NOT justified to retaliate militarily - just fix you fucking defenses instead of getting innocent peoples killed for your lack of technical competence that got you hacked in the first place - those having most $$$ to lose from cyberwar are also those having most $$$ in general, therefore they would be the least affected by it, and have the least right to retaliate violently. Just as tptacek said, the point should not be to prevent war (war can be quite healthy sometimes), but to make the game "at least somewhat fair", to level the playing field (as in "let the smartest man win!"), and to prevent "civilian" victims (if you don't want to play the game, it should be ok, and you and your business should be protected by side-fire - this is what gov agencies should do mainly, protect civilians and legitimate businesses from cyber attacks, while letting the game play on!). (EDIT+ note: I'm not American, and I believe the things above should still hold even if US citizens and businesses would have somewhat of an "unfair advantage" globally because of how much your gov has already invested in cyberwar... if it's an advantage bought by fairly earned $$$ you can call it a fair advantage... if it's not, than that's a different conversation to have :) )