Lawfare in Cyberspace

Attorney General Loretta Lynch today announced a federal indictment against seven Iranians believed to be responsible for distributed denial of service (DDOS) attacks against several large American financial institutions. The attacks began in December 2011 but became much more intense in December 2012. The indictment also accuses one of the Iranians of hacking into the control system of Bowman Dam in Rye, New York in August and September of 2013, a more worrisome attack because of its potential to threaten lives.

While the indictment does not specifically accuse the Iranian government of being behind the attacks, it does note that the accused "were employed by two Iran-based computer companies, ITSecTeam (ITSEC) and Mersad Company (MERSAD), that performed work on behalf of the Iranian Government, including the Iranian Revolutionary Guard Corps." At the time of the attacks, computer security experts speculated that Iran was retaliating for a series of sophisticated cyberattacks (beginning with Stuxnet but also including Duqu and Flame) most likely engineered by the U.S. and Israeli governments. Those attacks destroyed centrifuges being used to enrich uranium for Iran's nuclear weapons program.

The indictment was brought some time ago by a grand jury in the Southern District of New York but only unsealed today. It is possible the indictment was sealed in order to avoid complicating the negotiations that resulted in the Joint Comprehensive Plan of Action last July by which Iran agreed to halt efforts to develop nuclear weapons. January 16, 2016, marked "Implementation Day" when, having verified Iran's compliance with the JCPOA, the other parties to the agreement (the United States and other UN Security Council and European Union states) lifted a variety of sanctions against Iran.

Today's announcement suggests that the United States intends to continue to use legal means to address cyberattacks emanating from state or state-sponsored actors. It follows on an indictment announced in May 2014 of five Chinese military officers affiliated with the 61398 hacker group, a unit of China's People's Liberation Army. Similar uses of the law in conflicts are addressed in a recently published book by Orde F. Kittrie entitled Lawfare: Law as a Weapon of War (Oxford University Press, 2016).

For more on the indictment unsealed today, see this story in the New York Times by David Sanger.

What's the Message?

The recent New York Times article on the Islamic State that I discussed in this post is accompanied by a photo that is said to be from "a militant website." Here's the photo:

 

Precisely in the center of the photo is a boy wearing a blue shirt. It appears to be a polo shirt, although it's possible it's a T-shirt over a polo shirt. The real mystery associated with the shirt, however, concerns its message: What's the message and was it intentional?

Here's what can be read on the shirt:

. . . IGHT

AC-130

GUNSHIP

The AC-130 is a modified C-130 flown by the U.S. Air Force to provide air support for ground units. Its side-mounted weapons have been used to devastating effect in Iraq, Afghanistan, Somalia, and Libya, mostly against suspected insurgents and terrorists on foot and in vehicles. Some have called for AC-130s to be used against Islamic State forces in Syria and Iraq, but its vulnerability to anti-aircraft fire (the reason for the flares being deployed in the photo below) and the fact that it is used in conjunction with troops on the ground who direct its operations have militated against deployment against ISIS.

But, getting back to the shirt: Was it printed up and distributed by the Islamic State? Is this why the boy wearing it seems almost to be posed in the center of the photo? Is there another photo where this one came from that displays the full message? And, again, what's the message?

Rethinking the Islamic State

On Tuesday, the New York Times ran a story on the evolution of the Islamic State. While it might be better to characterize what has been happening as an evolution in Western thinking about the Islamic State, a point that the story (if not the headline) attempts to make, there is some useful information to be gleaned from the pastiche of interviews and expert analyses presented in Tim Arango's narrative.

First, individuals living in areas controlled by the Islamic State and experts on the region make the point that the Islamic State, while extremely repressive, has brought a measure of stability to parts of Iraq and Syria that have long been in turmoil. This stability is, at least to some extent, due to the elimination of the corruption that existed under the region's dictators and, all too often, its supposed liberators as well. As a man from Raqqa put it, "You can travel from Raqqa to Mosul, and no one will dare to stop you even if you carry $1 million." Sadly, neither the forces favored by the West in Syria nor the governments that succeeded Saddam Hussein in Iraq or the Taliban in Afghanistan have been convinced that good governance--clean governance--is essential to the state-building enterprise. This seems to be something that the Islamic State, for all of its horrors, understands.

Second, three of the experts quoted in the article--Harvard's Stephen Walt, the Brookings Institution's William McCants, and former CIA deputy director John McLaughlin--find parallels between the violence of the Islamic State and that of revolutionary France, Bolshevik Russia, Maoist China, and some other modern states. If these parallels are meaningful--and I would argue that they are--then Western discourse needs to abandon the rhetoric of fighting terrorism where the Islamic State is concerned, unless those using that rhetoric intend "terrorism" to mean what it did when the term was coined in connection with the Reign of Terror in the French Revolution. A state that conducts beheadings--whether with a guillotine or a sword--should be condemned, but we misconstrue what is happening if we call the beheadings acts of terrorism while using that term in its modern sense.

A few weeks ago, while working on the third edition of Seeking Security in an Insecure World, I wrote the following about the Islamic State for the section of the book that deals with failed states:

At the heart of the Peace of Westphalia was an agreement to eliminate religion as a reason for warfare by establishing a rule of mutual tolerance among (if not within) states. Both the Holy Roman Empire’s bid to subdue Protestant principalities and the effort of Protestant rulers to extend their control to Catholic territories were delegitimized by their joint acceptance of a principle encapsulated in the Latin phrase cuius regio eius religio (the ruler of the territory determines the religion practiced in it). While religious differences have factored into conflicts many times in the Westphalian era, now the basic principle is being threatened. 

The Islamic State--also called the Islamic State in Iraq and ash-Sham (the term for Syria in classical Arabic) or the Islamic State in Iraq and Syria (ISIS)--has capitalized on state failure to inject into the modern world a distinctively pre-modern understanding of the way religion and the state are to interact. On June 29, 2014, the Islamic State publicly proclaimed a caliphate with Abu Bakr al-Baghdadi as the first caliph since the days of the Ottoman Empire. It is a theocratic state that considers itself unbound by the Westphalian principle of sovereignty with its corollaries of non-aggression and non-intervention. In fact, the formation of the caliphate signaled the Islamic State’s intent to pursue a policy of expansion that would, according to prophecies in the Qur’an, lead to the Day of Judgment with its divinely foreordained apocalypse. For Muslims who subscribe to the most literal reading of the Qur’an, the establishment of the caliphate was a pivotal event; thousands began traveling from all over the world to the lands controlled by the Islamic State to lend their support to its efforts, military and political, to impose divine judgment on both Muslim and non-Muslim apostates. 

By the middle of 2015, and in spite of armed opposition on the ground supported by American and British airstrikes, the Islamic State controlled a swath of territory roughly equivalent to the size of the British Isles with a population estimated at six to eight million. Its territory, primarily in the most ineffectively governed regions of Iraq and most war-torn parts of Syria, demonstrates well the hazards posed by failed states and the tendency for conditions in them to threaten other states. To be clear, in the territories it controls the Islamic State exercises many of the functions associated with modern states. It enforces law, collects taxes, maintains both military and police forces, and even seeks to build alliances with like-minded organizations. (In March 2015, Boko Haram offered--and the Islamic State accepted--a pledge of allegiance that, in theory, extends the caliphate to West Africa.) In many respects, the Islamic State exercises more effective control over the territories it occupies than the states it has displaced did. However, the Islamic State does not have, and will likely never obtain, the recognition of other states. It exists as a quasi-state (due to the absence of the critical element of recognition) only because the recognized states whose territory it occupies are themselves quasi-states (due to their inability to exercise effective control). Nation-building, therefore, appears as an essential element of any strategy to defeat ISIS, a point recognized by President Obama in his pledge at the June 2015 G-7 meeting in Germany to accelerate efforts to train the Iraqi army to fight Islamic State units.

In working on a book that deals with contemporary issues, there is a constant concern that the period between writing and publication will witness changes that render even the most careful analyses obsolete. Our powers of prediction in international politics are severely limited. In this instance, however, I suspect the Islamic State will still be around next spring when the new edition of Seeking Security appears. It will likely be looking more and more like a "real" state. And some in the West will probably still be trying to figure out why it doesn't really make sense to call it a terrorist organization.

Syria: Year Four Begins

The horrendous civil war in Syria is entering its fourth year with conditions steadily worsening. The New York Times presents this snapshot of conditions in Syria:

• An estimated 150,000 people have been killed.
• The number of refugees has climbed to 2.5 million.
• Forty-two percent of Syrians have been forced out of their homes. (The majority are IDPs--internally displaced persons.)
• About 700,000 homes have been damaged or destroyed.
• Unemployment is at 50 percent.

The CBC provides another overview of the civil war in Syria here.

The Uncertainties of Cyberwar

The front page of today's New York Times carries a fascinating article by David Sanger (with reporting from Eric Schmitt) on considerations being raised within the Obama administration regarding the possible use of cyber weapons against the Assad regime in Syria. It is not clear whether a cyberattack against Syria "would be seen as a justified humanitarian intervention, less likely to cause civilian casualties than airstrikes, or whether it would only embolden American adversaries who have themselves been debating how to use the new weapons."

There are some very significant--and obvious--differences between cyber weapons and nuclear weapons, but it is entirely possible that certain restraints on their use may operate in much the same way. Consider this passage from Thomas C. Schelling's 1966 classic, Arms and Influence, in which he discusses the possible impact of the first (post-1945) use of nuclear weapons:

This is not an event to be squandered on an unworthy military objective. The first nuclear detonation can convey a message of utmost seriousness; it may be a unique means of communication in a moment of unusual gravity. To degrade the signal in advance, to depreciate the currency, to erode gradually a tradition that might someday be shattered with diplomatic effect, to vulgarize weapons that have acquired a transcendent status, and to demote nuclear weapons to the status of merely efficient artillery, may be to waste an enormous asset of last resort. 

Or, as others noted, it may be best not to let the genie out of the bottle.

Even though cyber weapons have certainly been used before--think Stuxnet and its progeny against Iran (as well as Iranian retaliatory attacks against the U.S.), the Russian denial-of-service attack against Georgia in the 2008 South Ossetia War, Israel's combined cyber/kinetic strike against a Syrian nuclear facility, and more--there may still be some wisdom in thinking of the carefully designed cyber weapon as Schelling suggested, as "an enormous asset of last resort." Or as a genie not to be let out of the bottle. In any event, it seems essential to avoid the temptation to treat cyber weapons as weapons of first resort. While they may provide the United States and other countries an unusually effective and precise means of weakening the military capacities of states such as Syria, retaliation--even with cyber weapons--is likely to be much more indiscriminate.

As we already know, military dominance in any domain commonly produces asymmetric responses that target the weaknesses of the dominant power. At present, America's Achilles' heel in cyberspace is its commercial sector thanks to businesses that, time and again, have demonstrated an unwillingness or an inability to address Internet security problems. 

Stateless

There are 12 million stateless people in the world. Laura Secorun Palet, writing for Ozy, discusses the problem--and some progress in addressing it--here.

Sovereignty and Atrocity

Human Rights Watch is reporting today that eleven children were killed over the weekend when a Syrian MiG-23 dropped cluster bombs on the town of Deir al-'Assafeer. An indiscriminate attack of any kind on noncombatants violates international humanitarian law, but the focus in HRW's account of what happened is on the use of cluster munitions, and for good reasons.

Cluster bombs, first, are used primarily as antipersonnel weapons. When noncombatants die in an attack employing conventional bombs or artillery shells, a plausible claim can sometimes be made that the deaths were unintended collateral damage incidental to an attack on a legitimate target. On the other hand, when civilians--and only civilians--are killed by cluster bombs, there is a strong case to be made that a war crime has been committed.

Second, cluster munitions tend to leave behind a deadly legacy of what are sometimes rather bureaucratically referred to as explosive remnants of war (ERW). Everywhere they have been employed, unexploded submunitions--bomblets--continue to pose a threat to civilians (poor farmers more often than not) long after the conflict ends. Disposing of unexploded submunitions is very hazardous, requiring both resources and political will that post-conflict societies often find to be in short supply. According to HRW, video footage of the attack on Deir al-'Assafeer and its aftermath shows at least fifty unexploded bomblets around the site.

Human Rights Watch maintains that cluster munitions "are subject to a ban under international law due to the harm they cause to civilians," in the words of Mary Wareham, the organization's arms division advocacy director. The ban to which Wareham refers is articulated in the 2008 Convention on Cluster Munitions, which entered into force on August 1, 2010. The Convention today has 111 signatories, 77 of which have ratified the agreement. Syria is not a party to the agreement, however, which means the ban does not apply to it in the absence of a determination that the ban is part of customary international law (a claim that has not, to my knowledge, been pressed by HRW).

There is no question that the use of cluster munitions to deliberately target noncombatants is illegal. The deaths of eleven children in the bombing of Deir al-'Assafeer should be added to the long list of crimes for which the Assad regime ultimately should be held accountable. But it is not clear--in fact, it is almost certainly wrong to say--that international law makes it illegal for Syria to use cluster munitions under any conditions. While I would prefer to side with Wareham and Human Rights Watch on this issue, the fact that Syria is not a party to the Convention on Cluster Munitions is significant. It has opted out of the obligations imposed on states parties by the Convention, as has the United States. The right to do so, however unfortunate in this particular case, is inherent in the notion of sovereignty. Sovereignty shields states--including bad ones like Syria--from the imposition of law, including laws banning cluster munitions, by outsiders. But only up to a point.

Wareham states that "all governments, including Syria’s allies, should condemn Syria’s continued use of cluster bombs," and there is good reason for this, even if Syria is not legally subject to the ban imposed by the Convention on Cluster Munitions. The condemnation of other governments can erode the protection that sovereignty provides for the use of cluster munitions by states that have not ratified the Convention. While sovereignty ensures that states bear primary responsibility for their own laws and their own actions (at least insofar as their actions are confined to their own territories), international law as a means of limiting the freedom of states pushes back against sovereignty where customary international law and, more importantly, peremptory norms (jus cogens) are involved. If cluster munitions are to be "subject to a ban under international law," it will come from universal ratification of the Convention on Cluster Munitions or, more likely, from a sufficiently widespread acceptance of the Convention and broad-based condemnation of holdouts that, in combination, generates a customary international law norm against possession or use of the weapons. Human Rights Watch may have jumped the gun in suggesting that a ban on cluster munitions currently exists, but it is hastening the day when that will be true by publicizing what the Syrian government is doing with these weapons.

Tanks, Rockets, Tweets, and Hacks

As the conflict between Israel and Hamas escalates with rocket attacks aimed at Jerusalem and Tel Aviv on the one hand and air strikes on government offices in Gaza on the other, various cyber dimensions of the conflict are becoming increasingly noteworthy. On the Israeli side, the Israel Defense Forces (IDF), in an effort to control the conflict's narrative, are using Twitter and Facebook with a level of intensity last seen in the Obama campaign. But reviews of the IDF's social media offensive are mixed at best. Michael Koplow's article for Foreign Policy on the IDF Twitter campaign is titled "How Not to Wage War on the Internet." The ability of visitors to an IDF site to earn badges for viewing pages and sharing them on Facebook or other social media sites has prompted some to question whether Israel is "gamifying" war. (Allison Kaplan Sommer helpfully gathers some of the reaction to Israel's social media campaign in a blog post for Haaretz.)

On the other side (in support of, but not initiated by, Hamas), a campaign of cyber attacks against Israeli websites began on Thursday. The loosely organized Internet group Anonymous initiated its effort to deface or take down both government and private websites in Israel in response to the Israeli government's threat to cut off Internet and other telecommunications links between Gaza and the outside world. The Bank of Jerusalem was forced offline for a while and the Ministry of Foreign Affairs website reportedly was compromised. At one point, Anonymous claimed to have taken down over six hundred websites in Israel.

It would be a mistake to try to press these two stories into the same analytical framework just because the Internet and cyberspace are central to both. They bear roughly the same relationship to one another that the use of radio addresses by Roosevelt and Churchill and the development of radar during World War II did. But we can see, nonetheless, that the two stories are important for their own, independent, reasons.

In the case of Israel's efforts to ensure that its narrative about the conflict with Hamas reaches as wide an audience as possible, we can see the application of what media analysts and political campaign strategists have been telling us for years about the movement from old media to new media. Older people--especially males--still sometimes watch network news on TV; if they miss the evening newscasts, they may read about what they missed in the next morning's newspaper (a print edition, of course). Younger people, however, are more likely to get news in small doses throughout the day (and night) via social media and online news outlets. A press conference with reporters and cameras may be the best way to reach the former group while a tweet or a Facebook post (provided it gets retweeted or reposted) will work better for the latter group. (Richard Parker examines some of these differences and breaks down the way the Obama campaign leveraged social media to its benefit here on the New York Times "Campaign Stops" blog.) Thus it seems that perhaps the so-called "CNN effect" was short-lived. Now we get war news (and revolution news and disaster news, etc., etc.) from the people who are involved--not through the lens of a television camera but through the lens of an iPhone or via tweets and Facebook updates. The army (or police force or government ministry) that wants to control the narrative today can't be content with limiting the access of reporters to a conflict zone or a protest site. It must either impose an Internet blackout--and face the wrath of those affected, other governments, and, apparently, a global community of hacktivists--or attempt to keep pace with citizen reporters by offering its own stream of compelling online information. But the information it provides cannot be too compelling. A video of grief-stricken mothers posted by those on the side of the victims looks very different from the same video posted by those who caused the grief in the first place.

Turning to the Anonymous attacks on Israeli websites, these suggest a future in which the strategic calculus involved in going to war (or suppressing protests) must include the possible responses of unseen third parties. After flexing its muscles--successfully, some might suggest--against Scientologists, opponents of Julian Assange and Wikileaks, and now Israel--Anonymous may find it increasingly attractive to weigh in on geopolitical matters. And, given the enormity of cyberspace, there are likely to be other groups developing in other chat rooms around other causes but with the same desire to influence big events in the world. In addition to the loose associations of hacktivists represented by Anonymous, transnational criminal organizations (TCOs) may find ways to use cyber attacks to profit from violent political conflicts while remaining in the shadows. And if states can use cyber attacks to influence the outcome of a rival state's conflict without revealing their involvement, they almost certainly will do so.

If it continues to be more and more difficult for states to control the narrative in conflict and if states continue to face more and more hidden adversaries when they go to war or move to suppress dissent, then the historical advantage that states--and especially the wealthiest and most powerfully armed states--have wielded in the use of force may be eroded to the point where the calculus that leads to armed conflict may be dramatically altered. And that might be a good thing.

Not for Attribution

The story about Iran's Fars News Agency plagiarizing a story from The Onion is too good not to share. Enjoy.

Modern Warfare

C. J. Stivers, a New York Times reporter covering the civil war in Syria, last week posted photos on his blog of a member of the anti-government al-Tawhid Brigade checking text messages while handling the machine gun in the back of a truck racing toward Aleppo at 80 miles per hour. The subject could have been catching up with members of his social network, but under the circumstances his texts more likely contained tactical information--"watch for government forces near the airport," or something like that.  Regardless, the suggestion the photos make is that all fighting forces--military and paramilitary alike--are networked these days.

Flame

On Monday, the Russian computer security firm Kaspersky Lab identified what it said "might be the most sophisticated cyber weapon yet unleashed," a malware product dubbed "Flame."  The malware is known to steal data of all types, including voice and video communications, from infected computers.  It has been found on hundreds of computers in the Middle East with Iran leading the target list.

Kapersky's researchers believe Flame was developed by the same organization that created the Duqu and Stuxnet malware, which also attacked computers in Iran.  (Stuxnet is reported to have caused roughly one-fifth of the centrifuges then being used in Iran's nuclear enrichment program to malfunction.)  Its massive size (20 megabytes) has made it difficult for computer security experts to decipher all of its capabilities.

Symantec researcher Vikram Thakur said, "This is the third such virus we’ve seen in the past three years.  It’s larger than all of them. The question we should be asking now is:  How many more such campaigns are going on that we don’t know about?"

"Too Much Loose Talk of War"

Amid increasing pressure to draw "red lines" that would trigger an American military response to Iran's nuclear program, President Obama yesterday addressed AIPAC (the American Israel Public Affairs Committee).  While affirming the strength of U.S.-Israeli ties and his commitment to preventing Iran from building nuclear weapons, the president pushed back against Republican presidential candidates who have argued for a more aggressive policy toward Iran and against Israeli prime minister Benjamin Netanyahu's efforts to get the United States to promise military action if the Iranians fail to meet certain preconditions.

Here are the key paragraphs from the speech:

Iran’s leaders should understand that I do not have a policy of containment; I have a policy to prevent Iran from obtaining a nuclear weapon.  And as I have made clear time and again during the course of my presidency, I will not hesitate to use force when it is necessary to defend the United States and its interests.

Moving forward, I would ask that we all remember the weightiness of these issues; the stakes involved for Israel, for America, and for the world.  Already, there is too much loose talk of war.  Over the last few weeks, such talk has only benefited the Iranian government, by driving up the price of oil, which they depend on to fund their nuclear program.  For the sake of Israel’s security, America’s security, and the peace and security of the world, now is not the time for bluster.  Now is the time to let our increased pressure sink in, and to sustain the broad international coalition we have built.  Now is the time to heed the timeless advice from Teddy Roosevelt:  Speak softly; carry a big stick.  And as we do, rest assured that the Iranian government will know our resolve, and that our coordination with Israel will continue.

Amir Oren, writing in Haaretz, said this of President Obama:  "No one who knows Washington and its ways could mistake the subtext of his words. A strong commitment to Israel? Assuredly. Capitulation to the dictates of Prime Minister Benjamin Netanyahu?  Not a chance."  For his part, Prime Minister Netanyahu, in Canada to meet with Prime Minister Stephen Harper before continuing to Washington for today's meeting with President Obama, praised the president's statements asserting support for Israel's right to defend itself and opposition to Iran's efforts to build nuclear weapons.

Tom McCarthy of The Guardian describes how American electoral politics complicates the tense relationship between Obama and Netanyahu:

If Netanyahu decides he doesn't need Obama to hit Iran--or that the threat to Israel is too great to wait--then all bets suddenly are off.  What if instead of Mitt Romney the president suddenly faces a reelection fight involving a new war in the Middle East, expensive gas, U.S. casualties and a new economic dive--plus Mitt Romney (or Rick Santorum)?  Netanyahu knows that Obama knows that Netanyahu knows this.