Skating on Stilts

The Law of Cyberwar: Round 2, and 3, and 4

Here's something for those who liked my earlier article for Foreign Policy about the foolishness of letting lawyers determine our cyberwar strategy, though it's probably even more of a treat for those who hated my article and wished they had equal time. The ABA Journal has posted an extensive, no-holds-barred debate over the views expressed in that article.  Gen. Charles Dunlap, a former deputy judge advocate general of the U.S. Air Force, contradicts my article with passion, after which I offer a rebuttal, and he a surrebuttal. 

Here's a sample of Gen. Dunlap's full-throated assault on my position:

Military commanders have seen the no-legal-limits movie before and they do not like it. In the aftermath of 9/11, civilian lawyers moved in exactly that direction. Former Attorney General Alberto Gonzales, for example, rejected parts of the Geneva Conventions as “quaint.” He then aligned himself with other civilian government lawyers who seemed to believe that the president’s war-making power knew virtually no limits. The most egregious example of this mindset was their endorsement of interrogation techniques now widely labeled as torture.

The results of the no-legal-limits approach were disastrous. The ill-conceived civilian-sourced interrogation, detention and military tribunal policies, implemented over the persistent objections of America’s military lawyers, caused an international uproar that profoundly injured critical relations with indispensable allies. Even more damaging, they put the armed forces on the road to Abu Ghraib, a catastrophic explosion of criminality that produced what military leaders like then-U.S. Commander in Iraq Lt. Gen. Ricardo Sanchez labeled as a “clear defeat.”

Infused with illegalities, Abu Ghraib became the greatest reversal America has suffered since 9/11. In fact, in purely military terms, it continues to hobble counterterrorism efforts. Gen. David Petraeus observed that “Abu Ghraib and other situations like that are nonbiodegradable. They don't go away.” Petraeus told the New York Times, “The enemy continues to beat you with them like a stick.” In short, military commanders want to adhere to the law because they have hard experience with the consequences of failing to do so.

...

In truth, as important as the moral perspective may be, the practical advantages of adherence to the rule of law have a power all their own—as history plainly shows.

Nazi Germany’s and Imperial Japan’s gruesome violations of the law of war, for example, hardly proved advantageous to them. More recently, Saddam Hussein, who embraced war without “limits,” was pulled from a subterranean spider hole—dirty, defeated and soon to be dead. Moammar Gadhafi’s illicit threats to wage war upon his own civilian population in the spring of 2011 brought the military power of the international community down upon him to the point where he ended his days groveling in a sewer pipe.

Military leaders know that adherence to the law is a pragmatic essential to prevailing in 21st century conflicts. It might be attractive to some to capitalize on the unpopularity of lawyers, to demonize them and even the law itself, but military commanders understand that war today has changed. They know that law has permeated war much as it has every other human activity, and they realize the perils of ignoring its power and influence. Whether anyone likes it or not, war has become, as Gen. James Jones, then the commander of NATO forces, observed in 2003, “very legalist and very complex.”

 And here's a taste of my rebuttal:

Gen. Dunlap’s second theme is plainly heartfelt but equally mistaken. To him, taking lawyers out of cyberwar strategy will lead to “lawless war,” and he pulls out all the stops to condemn it, invoking Abu Ghraib, Adolf Hitler, Imperial Japan and, um, Alberto Gonzales.

If you’re wondering how the former attorney general got on that list, I suspect it’s because Gen. Dunlap is still fighting the last war. The last turf war, to be precise. The years after 9/11 saw bitter conflict between military judge advocates general and civilian leaders like Gonzales. They fought over military tribunals, Guantanamo and interrogation.

The military lawyers mostly won. But the cost of that victory was high. It did surprising damage to civilian control of the military (it’s hard, for example, to read Gen. Dunlap’s essay without getting the impression that “civilian lawyer” is some new kind of epithet). And it led military and national security lawyers to draw the wrong lessons from the post-9/11 wars. In the future, they concluded, no war should be planned or fought without a lawyer at every commander’s elbow.

Really? Let’s assume, despite substantial contrary evidence, that when we fight in places like Libya or Iraq or Afghanistan we can deprive our adversaries of propaganda victories so long as our military does nothing without a lawyer’s approval. Even if that’s true, why would we expect the same approach to work for a war in cyberspace?

At its worst, cyberwar could reduce large parts of the United States to the condition of post-Katrina New Orleans, maybe for weeks or months. Responding to propaganda attacks isn’t likely to be high on our to-do list.

The exchange is part of a new book, soon to be published by the ABA, entitled "Patriots Debate." It is a sequel to the earlier volume, Patriot Debates, in which most provisions of the Patriot Act requiring renewal were debated in the same long-form, mostly civil format. The sequel deals with a broader range of legal issues arising from the last ten years of fighting terrorists.

Why we need to fix CISPA, not kill it

Security guru Dan Kaminsky and I joined earlier this year to fight SOPA because it was bad for cybersecurity. Today, for the same reason, we joined in a Politico op-ed to rebut attacks on CISPA, the Cyber Intelligence Sharing and Protection Act:

    We may have thrown some of the first stones, but SOPA was ultimately buried by an avalanche of criticism. Tumblr, Reddit and Wikipedia, among others, even protested by taking their sites down for a day. The effect was not subtle. SOPA is dead.

    They say victory has a hundred fathers. It also has a hundred would-be sons — and “son of SOPA” campaigns have proliferated. In Europe, for example, SOPA’s defeat inspired a surprisingly successful effort to block the Anti-Counterfeiting Trade Agreement.

    Here in the United States, though, the debate has taken an odd turn. After stopping a bill that would have undermined cybersecurity, some Internet activists are now targeting bills that could actually make the Internet safer. They’re charging that bills like the Cyber Intelligence Sharing and Protection Act represent stealth attempts to resurrect SOPA under the guise of promoting cybersecurity....

    There are ways to address this concern, but we must remember the bigger privacy and civil liberties threat: the Internet’s insecurity....

    Without security, no network offers privacy. A hacked database offers no protection.

    Part of the solution is to get better at sharing information. That means sharing attack signatures at light speed so as soon as a new attack vector is identified by one company, it can be blocked by others. Government needs to be part of that system — it has a lot to defend and it’s pretty good at identifying signatures.

    But under current law, once the government shows up to receive information, private-sector participation slows from the speed of light to the speed of lawyers. Current law lets companies share information with the government without a court order only to protect their own networks against malware, but not to protect others....

    In short, we need to fix CISPA, not fight it. We can all agree that if Facebook reports that a link has been used to propagate malware, the government should expend its resources to warn users and foil the attack, not issue notices of potential copyright violations about the link.

Remarkably, the House Intelligence Committee has proposed additional amendments that would accomplish precisely this goal.

TSA automating its ID and boarding pass checks

Ever so slowly, TSA is closing loopholes in the security system that it jury-rigged on top of the old, airline-run system inherited in 2001.  The biggest loophole in recent years was the way risky travelers were identified. In essence, the airline was told to print a special code on a risky traveler’s boarding pass.  Then, the traveler would carry his pass to the checkpoint, where he’d get special scrutiny. 

That was hardly the best system. It depended on risky travelers themselves hand-carrying security messages from airline to checkpoint.  And it was easy to forge boarding passes that didn’t carry the mark of Cain.

Under a new system now being piloted, TSA will still depend on travelers carrying messages, but at least the messages will be hard to forge. Airlines will use private encryption keys to authenticate and protect the information stored on each boarding pass. Once the information is decrypted at the checkpoint, it will be compared to the information on the traveler’s ID. If the two match, TSA can apply its identity-based security measures with some confidence.

In addition to securing the information on boarding passes, the new TSA system will automate ID-checking.  ID readers will scan for security features and compare the written and the encoded information on IDs to make sure they match each other and the data on the boarding pass. This obviously raises the bar for forgery of both boarding passes and IDs.  It likely also spells the end of black-light flashlights and jeweler's loupes in the security line. The new system will roll out first at Dulles airport near Washington.

In an effort to address the privacy objections that dog every new measure it proposes, TSA has announced that, after its machines have carefully checked those IDs and correlated them to boarding pass and flight information, TSA will destroy all the data. That strikes me as a choice that's open to debate.  Enforced amnesia means that all travelers will always look alike to TSA.  I suppose that sounds good if you fear government discrimination, but not if you want a security system that applies different security measures to travelers based on differences in their conduct.  

Mustang Photos

Mustang, the ancient kingdom between Tibet and Nepal, is where Gordon and I took our last trek.  Now it's the subject of a very nice photo spread by Boston.com.