Mixing Metaphors

Last year I did a post in which I talked about how the use of cyberspace challenges the efficacy of the law enforcement model in dealing with crime and terrorism.

In this post, I want to talk about how, and why, cyberspace can blur the distinctions between the three categories of threats nation-states have to deal with if they are to survive and prosper.

The three categories are crime, terrorism and war and the distinctions between each are reasonably well defined and reasonably stable in the physical world. The definitional clarity and empirical stability of the threat categories is a function of the fact that the physical environment is far less malleable and therefore far less ambiguous than the conceptual environment of cyberspace.

Three years ago, I did a post analyzing how our use of cyberspace can erode the distinctions between crime, terrorism and warfare. In this post, I want to address a related issue: how cyberspace erodes the assumption that is responsible for our dividing threats in to the three categories noted above. To do that, I need to briefly review the differences between the three categories. (If you want to read more on that issue, check out my prior post on cyberthreats.)

A crime consists of someone’s violating a law forbidding certain conduct and/or the infliction of certain harm. The crime of murder prohibits one person’s intentionally causing the death of another person; the crime of theft outlaws one person’s taking another person’s property without their permission and with the intention to deprive them of that property. Crimes are committed by people. The purpose of criminal law, as I’ve noted hear and elsewhere, is to maintain the baseline of order within a society that is essential if the members of that society are to be able to carry out the activities (e.g., procure food, clothing and shelter, reproduce the population, etc.) essential to ensure their own survival and that of the society. A society cannot, as I’ve noted elsewhere, survive if its members are free to prey on each other in ways that would undermine the critical level of order needed to fend off chaos.

Societies control crime by using two sets of rules: One is a set of civil rules. So every society has civil rules that deal with status (when people become adults, which adults have which rights, etc.), property (who can own property, how one acquires, maintains and transfers ownership, etc.), familial bonds (kinship, marriage, divorce, custody, etc.) and other critical matters. Some of these civil rules are informal norms; most of us internalize those norms and that keeps our behavior within socially acceptable bounds. Some of these civil rules are laws, the enforcement of which falls to civil courts and civil litigation (suits between individuals).

Societies also use criminal rules to maintain order. As I’ve explained elsewhere, while other biological systems (e.g., ants, termites) can get along with just civil rules, humans cannot because we have the ability to deviate. That is, because of our individual intelligence, humans can simply decide not to follow a civil rule; most of us cannot, or do not, make such a decision, but there is always a subset of people who do. Criminal law is intended to keep them in line by letting the state impose sanctions – punishment – on those who violate criminal laws that are designed to discourage conduct that seriously challenges a society’s ability to maintain order.

So when Jane Doe murders John Doe, the society she belongs to will convict her of murder and impose a sanction which, in the modern world, is usually incarceration (or perhaps execution). The primary purpose of this is to deter Jane from breaking any more criminal rules; a secondary purpose is to deter others from following her example. Criminal trials are a type of theater – a public denunciation of the conduct criminals like Jane engage in. The punishment imposed on Jane underscores the unacceptability of engaging in such conduct and implicitly threatens the imposition of similar consequences on those who follow Jane’s example.

Implicit in all of that is a basic assumption: Individuals commit crimes. That assumption also applies to terrorism, which is essentially the commission of crime(s) for ideological reasons. Criminals commit crimes for financial reasons (e.g., fraud, theft, extortion) and for what I call passion (e.g., anger, sexual/emotional pressures). The motive behind the commission of crimes is personal: I steal to benefit myself, directly or indirectly; I murder out of revenge or jealousy or some psychological need or to eliminate someone who is a threat to me. Terrorists commit crimes (they kill and injure people, damage and destroy property) but for different reasons; terrorists commit their crimes to promote a particular ideology, usually by trying to coerce or intimidate the population of a particular society.

This brings us to the third category: war. War is, and has always been, waged not by discrete individuals but by a society . . . by nation-states in our world. War is a struggle between two collective entities; while it is wages by discrete individuals, the players are the nation-states (or other sovereign entities) who are engaged in a struggle, usually a struggle for the survival. War has historically been a zero-sum affair in which one state or sovereign entity wins and the other loses; the loser has traditionally lost its identity and either been subsumed by the victorious state or eliminated (think Carthage).

War is and has been a struggle between nation-states for at least two reasons: One is that it is transnational. War by definition transcends national boundaries; civil war, of course, occurs within the territory of a nation-state but I don’t include civil war in the concept of war I’m using in this post. Civil wars display many of the characteristics of war (e.g., carnage), but are more properly understood as an internal struggle; civil wars occur when some part of the citizenry of a nation-state rebel against its established government, as happened in the U.S. Civil War. War, as such, is a struggle between two sovereigns; since nation-states are the sovereigns in our world, war in our world consists of a struggle between two nation-states, e.g., between two territorially-based governing entities.

The other reason war is a struggle between two nation-states is that only nation-states have been able to summon the resources needed to wage war. Al Qaeda has for some time considered itself to beat war with the United States, but no group of individuals can truly wage war in the physical world. Al Qaeda’s attacks are terrorism, not war; the 911 attacks were terrible things, but isolated, low-level attacks like those cannot constitute war because they do not pose a serious threat to the survival of the United States as a sovereign entity. When Hitler invaded Poland in 1939, that was clearly the onset of war between two sovereign entities; the invasion required Poland to reciprocate with force that was commensurate with the force used by the invaders and was quite beyond the capability of any individual or group of individuals.

So, to recapitulate, crime and terrorism are committed by individuals and take place inside the territory of a specific nation-state. War, on the other hand, is committed by nation-states and necessarily involves a struggle that transcends national boundaries.

I want to use something that didn’t happen to illustrate how cyberspace erodes the distinctions between crime/terrorism and war. In 2001, Interior Minister Otto Schily said it might be necessary for Germany to use “denial-of-service attacks . . . to shut down some sites based in the United States.” Wired (January 10, 2002). The sites in question were neo-Nazi sites operated by Gary Lauck of Nebraska. They distribute pro-Nazi material; distributing such material is a crime in Germany, so if Lauck were in Germany, he could be prosecuted for violating German law. Since Lauck is in the United States, he and his websites are protected by our First Amendment. Since the First Amendment gives him the right to distribute the material, he has not committed any crimes in the U.S. and therefore cannot be extradited to Germany to stand trial for violating German law. (Extradition requires that the person’s conduct have been a crime in both countries.)

Let’s start with Lauck. He didn’t commit any crimes in the U.S. Did he commit a crime, terrorism or war in Germany? Distributing neo-Nazi material is a crime “in” Germany; if Lauck was handing out neo-Nazi literature in Berlin, he would clearly be committing a crime “in” Germany. Lauck’s use of cyberspace muddies the analysis because it means his conduct simultaneously occurs “in” the U.S. and “in” Germany. If we approach crime as a unitary construct in which all the elements of a crime must occur in a nation-state for the activity to constitute a crime there, Luack would not have committed a crime in Germany. Modern criminal law, though, says you can be prosecuted in a jurisdiction if you cause “harm” there by engaging in activity outside that jurisdiction. Under that theory, Lauck committed a crime “in” Germany (if the Germans can show he intentionally distributed the material in Germany, as opposed to putting it online for anyone to see.)

What about Schily’s proposal (which he later retreated from)? If Germany had launched a DDoS attack on the Nebraska servers hosting Lauck’s websites, would that be war? Crime? Terrorism? It wouldn’t be terrorism, for the simple reason that Germany would not be launching such an attack to coerce the U.S. civilian population into, what?, repealing the First Amendment. That leaves us with crime and war.

Would it be an act of war for Germany to launch such an attack? It would, in a sense, be an invasion . . . a kind of digital analogue of Japan’s attack on Pearl Harbor . . . without, of course, the intention to start an armed conflict between the two countries. It would not be a physical invasion of U.S. territory, but a DDOS attack could certainly be seen as a hostile act by the targeted country. I suspect that if the CIA launched such an attack on a North Korean facility, the North Koreans would consider it an act of war.

It looks more like a crime, though, because Germany would be targeting an individual, not the United States. And in the U.S. federal law and the laws of many states define DDoS attacks as a crime, as do the laws of other countries. But can a country commit a crime? Crimes are committed by individuals; war crimes prosecutions target the acts of specific individuals, not the country of which they were citizens. if we assume a country can commit a crime, how would we handle that? Would the U.S. prosecute Germany (something that, as far as I know, is simply not possible under existing law)? Or would the U.S. ask German authorities to hand over Mr. Schily and the individuals who executed the DDoS attack so we could prosecute them for a crime? Since it looks to me like § 303b of the German Penal Code makes a DDoS attack a crime, they might be subject to extradition under the principle I noted earlier, i.e., DDoS attacks are a crime in the U.S. and in Germany. I suspect, though, that the German authorities would not be inclined to turn them over to us, even if extradition was permissible under the law.

My point simply is that cyberspace makes threats more complex: Individuals can launch attacks (like DDoS attacks on facilities in another country) that have at least some of the characteristics of an act of war (e.g., transnational, ability to launch repeated attacks that shut down essential systems). And countries can engage in activity that looks a lot like crime. And then there’s terrorism . . . .