Cyberwar on North Korea could be illegal

“The majority reading of international law is that, because the Sony hack had no ‘kinetic’ effect, it wouldn’t constitute a use of force or armed attack, and so a kinetic military response would be inappropriate,” said Gary Brown, a retired Air Force colonel and former legal adviser to U.S. Cyber Command. 

So when, and how, can a country respond to an aggressive action by another state in cyberspace? There are no hard and fast rules, and legal experts warned that any response Obama ordered would wade into legal terrain that is hotly contested within the United States and around the world. Even the authors of an exhausive document that’s widely regarded as the most definitive legal analysis of how international law applies in cyberspace, known as the Tallinn Manual, couldn’t reach a strict, legal definition of what consitutes a use of force online. The best they could come up with was an agreement that countries would decide on a case-by-case basis how to respond to aggressive cyberoperations against them.

But just because the United States is constrained doesn’t mean it’s without options. Indeed, some experts said that a massive denial-of-service attack that knocked a country offline—possibly what happened in North Korea on Monday—would be “proportional” because it would be an attack only on computer systems. If the operation caused no physical damage, it would be in bounds.