Rewriting the Laws of War for Cyberspace (Full Interview)

even if you read the Tallinn manuals, you will find that you have a wide range of different opinions within the manuals,

Correct.

even on questions as significant as what is considered an attack. You do have agreement that cyber you can't have cyber attacks. You can have cyber operations that rise to the level of an attack.

What is that level? What is that threshold that you have to cross?

When does a cyber operation cross the line into an act of war? Anna Beck walks us through the gray zones and what it would take to rewrite the laws of war for cyberspace.

Welcome to the security cocktail hour. I'm Joe Patti

I'm Adam Roth.

Adam, today we are talking about one of your favorite subjects. Cyber warfare. Don't look so so surprised.

Hey, this is cyber warfare we're talking about well let's leave it to Anna to discuss. Yes. Yes.

Well related. Well, why don't we let our guest explain? Our

guest today is Anna Beck. Anna, welcome to the show.

Thank you very much for having me, gentlemen.

it's great to have you on. Okay, so let's r resolve this of what of what we're talking about today. we're talking of something related to cyber warfare, which is NGOs, security for them, cyber defense for them, non-governmental organizations, charities. And we're actually going to talk about them in a particular context, because as I'm sure all aware, here in the US there has been a lot of talk and controversy lately about

NGOs and what they do. but we're really not talking about that stuff. We're talking about in a little different context, talking more about well, something that's I want to say isn't as bad, but it's about warfare, which is horrible too. But and I wanted you explain a a little bit to us about your your work and the aspects of NGOs that you work with.

Sure thing. Thank you very much. I have been researching humanitarian organizations, which is a certain subset of human of NGOs. NGO stands for non-governmental organizations, and that doesn't merely include those with a humanitarian focus, but it also includes a whole lot of other organizations. Humanitarian organizations have a specific

set of principles that they try to adhere to. They are neutral in conflict zones. They don't prefer one side or another. They are independent from bias. They have a humanitarian focus. So providing help whether that be medical or relief in in conflict zones.

And so all of these principles, they don't necessarily have to apply to every NGO. an NGO is a certain overhead and then a humanitarian organization is almost like a subset of of an NGO.

And my research deals with how humanitarian organizations are affected by cyber warfare. you guys have talked a lot about on your podcast about how cyber warfare has become integrated into warfare in general and how it's now become an integral part of any armed conflict that we have. And humanitarian organizations are present in basically every armed conflict on the face of the earth.

in some way, shape, or form. They also basically all of them today use computers, use databases, use servers to communicate, and so you do have them operating in a higher risk area, but also using higher risk tools. And because of the certain characteristics of cyberspace,

And the fact that we don't necessarily always have everything figured out in the legal sense, they face certain challenges and I think are facing danger that a lot of people don't realize that they are.

So th this is what so s a little bit of a background, you and I met in Tallinn, Estonia at CyCon and I I just jumped in there and I said, let me go to CyCon because I'm doing a dissertation on ethical cyber warfare and I was just surprised about the amount of information and data th that that's out there.

But what I

What I will add to it is my dissertation talks about cyber ethical warfare and we don't really have these treaties and these boundaries like we have with biological warfare, radiological, chemical, and everything that you said to me, my eyes got lit up and I'm like, Wow, this is one of the aspects of something that I really didn't understand and you brought light to it, which is why it's important because

What I think you're looking to do is put up this flag that says, Hey, we're an NGO, we're a humanitarian organization. Don't attack us. We're here to help people. So if those doctors are hundreds of miles away looking at somebody that got hurt or shot or, in a conflict zone, you want to maintain that that that connectivity without being disrupted by the adversary.

or the other side, 'cause both are adversaries depending on how look at it. And that's what we were talking about, right?

Exactly. And not only are we talking about doctors, but for example, the Red Cross, the either the International Committee of the Red Cross or then the National Red Cross Societies, they provide not only medical support, which you talked about, but also a whole list of other services, like for example, reuniting families and searching for missing persons or

support to prisoners of war. And a lot of these things include a lot of sensitive data that is stored in databases. And because of humanitarian or organizations collecting these vast amounts of data, whether it be information, personal information, locations of certain people, often biometric data.

For distributing relief, whether that be food or drink, we we see a lot of organizations using, for example, retina scans or or fingerprints, just so that they don't give out the same thing to the same person multiple times. and so you have this vast amount of data that is collected and siloed into one one place or one organization, and that makes a very

lucrative target, right?

Yeah, Anna, that's really interesting. I I've never really thought about that because you talk about the the Red Cross, a lot of people know what the Red Cross do. They are involved in stuff with, warfare helping people, but also any kind of natural disasters and things helping people. And it's interesting that you say they collect so much data about people and biometrics, and we worry a lot about privacy.

But I've got a feeling when someone's in a very dire situation, they're not so worried about their their privacy. we've we've talked about it before with amb ambulances. if someone's coming because you're because you're having a heart attack, you you're you're not gonna ask the the EMTs about their HIPAA certifications or anything. but I did not realize that that when people get will get aid that

You will be collecting biometric data and personal data, a lot of a lot of stuff. I suppose even the case of natural disasters, besides the general, scams and all that stuff, can it make people the target of looting, theft, those sorts of things too?

I don't know about that specifically. I haven't really looked into that. I also will say that not every humanitarian organization uses biometric data to r distribute relief, and it's not in every place. So for example, you have say Doctors Without Borders and the Red Cross and UNICEF. All of these provide relief in some sort of way in conflict zones.

And the way they distribute that aid will be different. So some of them might you use biometric data, some of them might not. It might be location specific. So it really depends on what case you're s talking about specifically.

So I I think also what we're getting at is this Joe, right? some military or organization took prisoners. the International Red Cross goes to visit those prisoners to check on them. They're they're still in cap in in in captivity. Now that data that GPS, those coordinates, that data collected, now if somebody the the other side starts traversing into that network

trying to hack that network, gets that information, now they know where their opponent is l literally there. So I I think there's a there's a a certain amount of boundaries that they say, look, we're looking to help people, but don't use that to get us involved in this conflict. Leave us alone and let us do our job to provide aid, to provide comfort, to to to ensure that the people are being treated, that are in

They in their captivity. That's what it sounds like also, right Anna? Is or am I paraphrasing too much?

Exactly. A lot of this data that is collected has or can have a strategic impact on the conflict, which is what makes it so lucrative, right?

Okay, so then I suppose we're talking about a couple different things. me, I'm a civilian. I always think about privacy, so there's the personal privacy of people that they might not be worried about. I suppose there's the cyber protection of the organization itself. They don't want their networks to go down. But also I guess that you're right, there's a lot of information there that could be of use to in the conflict. And

I'm going to guess or hope that whether it's cyber or any other way, that getting that information through a humanitarian organization is a no no. I think it's a bit of I know it's a legit thing that there are s rules of war and and, laws regarding

Actually

war, but it seems like that would be a no no to me. It's not. Okay.

But there's but there's not, Joe. So so

so there is the underlying treaties in s Article four and Article five, but how they apply today has been debated over and over again as it relates to humanitarian organizations. Keep me honest here, Anna.

Well, I will amend that statement a little bit. We do have laws of war. So we have the Geneva Conventions, for example,

Yes.

which dictate how warfare should be conducted, if not ethically, then at least to harm as few innocent people. Yes.

Well less barbarically put it that way. Okay.

there is a quote from Henri Dunan's Memory of Solferino. he

And I'm going to paraphrase here. He says, since new and terrible methods of destruction are invented daily, and mind you, he wrote this in 1862. So he said, Since new and terrible methods of destruction are invented daily, would it not be possible in a time of peace and quiet to develop humanitarian organizations or relief societies for the sole purpose of having help given to the wounded? And that is that is the

purpose, that is the thought behind the Geneva Conventions. That is why we have humanitarian organizations. It is because of those new methods of war. And so when you had the Geneva Conventions written, you had to think about, okay, this can't just apply to what we have now.

which is, World War II technology, we have to think about how this will apply to future generations of

Yes.

warfare and of weapons. And the reason why it's so difficult to apply those rules or why there's so much debate over how these rules apply is because you have a lot of principles in cyberspace that just aren't a thing in physical space.

For example, in in a physical realm, you can usually see the combatant. you can you can see who they are, you can see if they're marked, for example. You can you can mark something as as humanitarian. So for example, an ambulance can have the red cross on it in a visible way. But for example, if you have a database, you can't just put a red cross logo.

or a red cross emblem on the computer and assume that it's protected or that that protection

Right.

is visible because it doesn't have to be in cyberspace.

Yeah, that makes me think of something I heard of I think it was a long time ago, it was maybe the first Gulf War, even, where was a friendly fire incident where a pilot had been had been downed by friendly fire by the coalition. And they said that what happened was mistakenly

that his aircraft and the whole system of tracking got labeled as hostile and they said from there he was finished and wow, imagine if someone I guess there's concern that people would I guess from the warfare standborne hack the system, but also I suppose people could in a system start assigning, this is the Red Cross, this is a humanitarian facility to things incorrectly. I guess that could be a

a method of warfare too, I suppose.

I was gonna say so go ahead.

I I'm not sure

about that, but but I guess it's possible. what what is Yes. Yeah,

Okay. So we we think hackers, bad guys. That's part of our job, so

that that's probably possible. it's not as much as what what I've seen as

Mm-hmm.

what I've seen happen is either countries or hacking groups. It doesn't necessarily have to be tied to a country. It

Proxies here.

Can be, and in order for it to be addressed by international law, it usually does have to be tied to a country just because it's very hard to go after individuals, and individuals fall under national law. So you have multiple levels of complexity in this equation. You have multiple different types of law, and then that depends on who is the parties interested. But if it is a say intelligence agency or

A part of the military, because every military today has a cyber unit, right? That is attacking humanitarian organizations. They are either doing so with malicious intent because the humanitarian organizations have strategic data, or they do it accidentally, where we didn't realize what what was happening, and either that is actually true

or they're trying to use that as an excuse.

Yeah. That's exactly

what I was thinking, yeah.

So to a to add to that, the the way the way it's happening today is is that, a lot of people that are doing research, including myself, but I'm not at that level, they propose things like the Toleran Manual, but Talum manual is non binding, it's non enforceable, but it it is more up to date. And then there then the other thing that we spoke about, Anna, not you know not you and I specifically, but overall at Scicom is that AI has been an enablement.

to collect so much large amounts of data and sometimes without

Just w just collecting data. you don't i it doesn't know what data is collecting, is it collects data and that data is utilized. And then if you also look at what's happening, I don't want to talk about specific conflicts, but even some militaries, they repaint their trucks in such a way that if they're picked up on cameras, on drones, on radar, the way it's painted confuses the AI. So now you don't know if you're looking at something that is hostile, civilian.

humanitarian and this these are the things the tricks that are that that militaries are doing today in order to either avoid being c avoid being collected or they're being collected inadvertently.

Yes, I'll speak to the first part and then the second part. So we have binding treaties in international law. The enforcement of international law is always a bit iffy because you don't have an international police force that goes in and tells countries you shouldn't do that, please stop. and then can actually do something about it if they don't. So the enforcement of international law is a topic onto itself. But

The fact that we have international law and that we do have binding treaties that countries have agreed to is a fact. And in a lot of cases, especially with the humanitarian treaties like the Geneva Conventions, it's a double-edged sword if you attack it because you're getting a lot of benefits out of adhering to it as well. Because your soldiers get help, your civilians get help, your

POWs use your prisoners of wars get support. So there is a lot of incentive to adhere to the treaties. And then because of cyberspace being such a confusing place and legally being very vague, we don't yet have a binding treaty. It's fairly new. the first papers about cyber warfare and how international law

applies to cyber warfare started coming out in the early 2000s. So you think about that, and it's only about 25 years old.

And and and that's so th th the the the beginning of my research again and everyone comes out comes out with a different lens, a different view. the challenge is is that a lot of the overall treaties that we have allude mo and I know they can be also interpreted to cyber, but more about kinetic. And then that this is where I think the challenges always are. Had had we even in the UN had we have

some co a part of the the UN with ill as it relates to NATO itself, at least for the NATO countries, if there was something that was more developed towards cyber specific to that, that would help. But you're right, right? In five months, in six months, in one year, everything's different again 'cause the technology has evolved again. So it's hard to keep up with the technology and the and the in in

the thing. However, we will say you're right, right? You're you're an expert at this. I'm not. Humanitarian law is international and you have to look at it in such a way that you have to apply it with multiple lenses, whether it's cyber, whether it's drones, whether it's armed conflict, whether it's kinetic, you still have whether it's space. We have so many domains now we should we need to understand as a as a world,

that we really need to apply it to all domains, not just say, well, when it was written, it was written with armed conflict in mind.

Exactly. And so it was written with, the writers probably having no clue that cyber warfare would become a thing. and so the rules just were not developed f to fit it perfectly. it definitely doesn't fit well. And so you have to interpret it in the spirit of the law, not the letter of the law. which causes a lot of dispute because even if two well-meaning sides get together and just see the world differently.

Or see the spirit of the law, how the authors intended the intended meaning differently, then they're gonna come to different conclusions over what is and is not legal in cyberspace, which then affects, what they do. My question regarding a new treaty is how effective would it be? First of all, international treaties are they take ridiculously long to be negotiated because

The more parties you get together, the more perspectives you're gonna have. there's a saying, and I'm not sure if it's an English saying, that

Five lawyer five lawyers will have six opinions. And

Yeah, I I I say the same thing.

you ask ten people their opinion, you get twenty different answers, stuff like that, yeah.

Exactly. Exactly. And so that's a problem when you try to get a hundred and ninety-three to ninety-five ish countries to agree on a set of rules. Either you're it's gonna be so vague that nothing is actually gonna be solved, or you're never gonna gonna agree on something. Even within NATO, countries that are allies can't agree on what is the correct course of action and what is

A hundred percent.

and is not legal. And so how are

wow.

we gonna get countries that

Aren't even allies and don't have the same interest in mind.

To agree on frankly anything.

And and and actually with NATO, even when Article five is invoked and they're and they're discussing it and they and these countries get in the room to discuss it, there's no physical th or is no numbered threshold. It's purposely vague so that other countries or even the other NATO countries don't know where that threshold is. So they can't go, we did it at sixty nine percent, not seventy That's and then they get in the room and discuss, do you think this was an attack?

was the sovereignty Article four invoked where the that that nation in NATO had their security challenged. So it's purposely vague so people can discuss each and every incident independently.

Exactly. And I think that's a big strength of international law because it's not so rigid. the reason why I started writing and started talking about how it affects humanitarian organizations specifically is because a lot of times we will say something and it'll make a lot of sense in the military context, or it'll make a lot of sense in the civilian context, but we forget about how that might affect

for example humanitarian organizations operating in conflict zones. So for example, a

An attack is only considered an attack in cyberspace if the effects of it reach the level of a kinetic attack.

really? Now now

And yes.

you say that attack specifically in terms of direct consequences, somebody tricked a system into shooting a missile, or

D dies or

could it be gathering information to do a kinetic attack?

Or a

cyber attack causes I don't know, the centrifuges to spin out of control and blow up a facility.

Hm.

Never heard that before.

Yeah, we don't know anything about that. No. Yes.

Never heard it. purely hypothetical scenario,

now the problem is

But is but is

that considered an attack then? Or is it still fuzzy?

It depends who you ask, yeah.

okay. Depends who you ask. Wow, okay.

That's exactly the point, Joe. That's

exactly the point because i you're right, and I I you're a hundred percent right, I agree with you, right? You can't write you you can't write processes and policies for every single part because things new things come up. But what people are always challenging, some scholarly, some not, they're saying none of this was written in the time for for cyber. Don't get me wrong, there are countries, there are

couple countries that have binding treaties as it relates to cyber warfare. There are countries that entered into their own treaties. one here, one there, but there's no widespread one. And we probably will never get a widespread one 'cause it behooves these countries to not enter into a treaty 'cause they want to do whatever they want, especially the bigger powers.

Yeah, but isn't that true

Exactly.

of all the treaties? Not just cyber related?

But we have biological, we have

radiological, we have chemical for the most part, Joe. We have kinetic.

So we should be able to do cyber. Right?

But again, it

I don't know, get I need

took

to get it done.

but but it took years to get there. think about

You're right.

Mm-hmm.

how long we had chemical weapons before we had a treaty about chemical weapons.

Alright.

And think about

I actually don't know how how

long did did we? I I'm actually not aware of that.

I believe it was over fifty years.

Really? Fifty year gosh.

So we're only halfway there and really terrible stuff will likely have to happen for countries to agree on something.

Yeah.

wow. okay.

That's unfortunately the way that that it's been so far. I I hope that it isn't. But so be it. but then you have non-kinetic attacks, which for example, a DDoS attack that

prevents humanitarian organizations from logging into their databases, from distributing aid, from communicating, whatever it be, would not be considered an attack. Now

Unless

the aid is given is not given and a person dies from hunger.

but that's secondary. That

Yep, you're right.

that isn't considered a direct attack or direct that is not considered a direct result of an attack. That is a secondary or tertiary effect.

Okay, but wait a minute. and I'm not very knowledgeable about these things, but I know that things like and I don't know how it's considered in warfare, but even putting cyber aside, I know that doing things like denying aid to a population, can be a military tactic. In fact a fact a very old one, I I I think. So does I know, does that not

I i is that or is that I guess that isn't considered an an attack?

It is not considered an attack in the sense that it would have the consequences of an attack. It is considered infringing in the and now I don't have the exact legal word the legal terminology,

so I'm blanking. but it is

It's okay. We don't use legal terminology here. That's fine.

it is infringing on the responsibilities and actions of, for example, the Red Cross. The Red Cross

Mm-hmm.

has a unique

unique position among humanitarian organizations because it is specifically mentioned in the Geneva Conventions and they have certain rights and responsibilities based off of that. And so you're not supposed to, I won't say allowed to, because countries do whatever they want because of the lack of enforcement. But

Mm-hmm.

you're not supposed to infringe upon their responsibilities. And one of their responsibilities is to provide aid to

to populations affected by armed conflict. The problem arises when

Okay, I I'll I'll say two things parallel. One of the things is that the Geneva Conventions are written in such a way that those responsibilities of states to not infringe upon the responsibilities of the Red Cross are worded in such a way that they do apply to cyberspace. And so most of the times in the

Backroom negotiations. the Red Cross will convince the states that what they're doing is probably not the best idea and they figure it out. The second thing is that we have a list of war crimes that the ICC deals with. And those are listed out in the Rome Statute of the International Criminal Court. One of those war crimes is

deliberately attacking humanitarian organizations or relief societies. And so if the if the operation doesn't rise to a level of an attack, it is not considered a war crime.

that's interesting.

Which is just

And we're back to what's an attack? is it

Exactly.

is it something kinetic? Is it something as simple as some hacker, gee, the Red Crosses are a an organization. Their bank account, they're locked out of their bank account and can't buy stuff. wow, that's interesting.

But keep in mind a lot of this has already been written. Everything that we're talking about, but it's non binding, 'cause those who have written these manuals, those who have written these documents, even though they do define all of this, they have not been adopted as binding legal documents. They're recommended. Sorry.

Well and even if you sorry,

even if you read the Tallinn manuals, you will find that you have a wide range of different opinions within the manuals,

Correct.

even on questions as significant as what is considered an attack. You do have agreement that cyber you can't have cyber attacks. You can have cyber operations that rise to the level of an attack.

What is that level? What is that threshold that you have to cross? And there is so much disagreement, even within the Tallinn manual, on

Yes.

what this is. And this is the most comprehensive set of opinions that we have at this point. And like you said, it's non-binding. It's a academic study on the it interpretation of international humanitarian law, which includes the Geneva Conventions, which includes customary humanitarian law, which includes a whole plethora of other rules that

you can apply, but there's disagreement. And so because there's disagreement on the interpretation, which reflects the dis disagreement in or difference in in interpretation on the state level and then in practice, you you don't really have a good start starting point.

And as I say w some European nations agree and then other European nations don't agree and then the the West sees things totally different. It's a i it's really amazing that the varying opinions and feelings and thoughts because culturally it's what these countries feel. Whereas some of the countr like some of the Russian states, they say

This says this is not even an attack. this is normal everyday operations. Another country says, absolutely this is an attack.

only that, it's we're not just dealing with the Western world, we're dealing with the entire world. So we're

Yes.

dealing with countries like Zimbabwe or Thailand or Japan or China or Iran. And so even when you look at

It's called the Open-ended Working Group on Information and Communication Technologies within the UN. They publish every or countries publish statements on different parts of what they consider legal and illegal in cyberspace. And it's a fascinating thing to just scroll through and read some of these things, especially if you filter out one specific topic, be that.

neutrality or accountability or humanitarian organizations in cyberspace and see how different countries have differing perspectives, all based off of the same wording of the con Geneva Conventions.

Wow. So let me see if I've got this straight then with all of this. So we have these agreements that I thought were treaties, but let's call them agreements that are non-binding. But exactly So besides that, that's the first level. The next level is nobody completely agrees on just what the agreement is.

And now we're taking that into cyberspace where it wasn't really designed for it and where things are even more uncertain and fluid. I hate to sound pessimistic, but is that where we are with this stuff?

not completely true, because the Geneva Conventions

Okay. Good, it's terrible.

the Geneva Conventions are binding. there

they are. Okay.

are the country signed them. The the enforcement mechanism so in national law, if you go and you rob a store, you will have the police come after you. Very likely.

If a country breaks international law, who's the police force that's supposed to go after

Yeah.

them? So we don't really have the police force, but we do have self regulation. So there are several ways that, for example, the Geneva Conventions are enforced. The first kind of line or defense line is through national.

enforcement agency law enforcement agencies, whether that be police or militaries.

Alright, we're back. We actually had to record this episode in two parts and the second part we're doing a few days later.

Well we were talking about some international type stuff last time. And we we were actually talking about the Geneva Convention. And you corrected me, which is probably pretty easy because I don't know much about these things, and saying that the Geneva Convention is something that is actually binding on the signatories, but what about enforcement? That's what we were what we were taking on.

Correct. Enforcement is always the tricky part of international law.

Yeah, Joe, w w how do how does enforcement work? Do you go to war with the country? Do you well I'm gonna tell you typically

Well, that's what I mean. It's like, yeah, so what do you do? Go to war when you're at war?

typically if it's egregious enough it I guess you can go to war, but I think s the way the way it's enforced these days is through sanctions. So if if a country does something and another country can sanction it or tariff it

Or however it is, that's usually the way of doing it without having a kinetic attack.

so there are many different types of enforcement, sanctions being one of them, full scale arm armed conflict being another one. But imagine it like it's kids in a classroom trying to enforce the rules that they agreed upon, but they don't have a teacher there. And so they

can't decide if they want to enforce it or if they can get a group big enough to enforce a law on that one kid who keeps on acting out of turn. And that's what we have, what we're dealing with in the international system, where you do have the rules and most if not all of the countries, in the case of the Geneva Conventions, over a hundred and ninety signatories agreed upon something.

But what happens when when they break their commitments?

Anna, is there a specific instance of a situation related directly to the Geneva Convention where there was some kind of enforcement? And if so, if you can recall, what was it?

Well, you have for example the international tribunals, where it started with the tribunals in Nuremberg and Tokyo, but then you had international tribunals for Rwanda or for the conflict in former Yugoslavia, as well as s for example, specific special courts for Sierra Leone. these are the international communities stepping in after

egregious breaking of international law to set up order, to set up consequences. you also have the International Criminal Court, you have the the criminal court that tries people and then you have the International Court of Justice which settles disputes between individual countries. And so these two institutions are set up

Again, not everybody who is a signatory to the Geneva Conventions is a signatory to these institutions. So the enforcement is somewhat iffy and questionable in a lot of cases. But you do have certain enforcement mechanisms and you do have like I said before, national law that does implement the international humanitarian law from the international sphere.

into the national militaries policies, and et cetera. so you do have multiple levels of enforcement. It just sometimes doesn't work exactly like you would

expect it to.

So

I was having this conversation actually earlier today, and I like to fly a drone. in New York City, technically, this the the city the NYPD does not allow drone flying. But they have really no control over that enforcement because it's really federal for us, the FAA. But I was having a conversation with somebody and they said

What they do is they create this law that says you can't land or take off. They can't control what's in the air, but they said you can't land or control 'cause we enforce the land. And then the person said to me, Who's gonna enforce that? Same reason why there's some quality of life things that that people do in New York City or they jaywalk, they walk across the street when the light has changed. You can break laws all the time, but there's no enforcement, there's no teeth.

Then people are gonna still continue to do that. And that's why some countries continue to to to take actions. They know there's no consequence of those actions. And I think that's what we're kinda alluding to, right?

Adam, you you're killing me. You you just compared a war crimes trial to getting a jaywalking ticket in New York. come on.

No, but but but but

Joe, I wasn't looking to to not appreciate the level of of violating the Geneva Convention, but what I'm saying to you you is that if there's no enforcement, there's no teeth, then nothing's gonna happen and people are gonna keep on or countries are gonna keep on committing the same crimes over and over again. And to what I was saying was

In regards to the Geneva Convention, there are violations of the Geneva Convention, right, Anna? And it keeps on happening and there's no enforcement. That's safe to say, right?

There are violations of the Geneva Conventions, but also you do have a lot of countries actually in a lot of ways the Geneva Conventions are upheld more often than they are broken, than the rules are broken. Because you have, you can just consider it the sheer breadth of volume. You have four Geneva Conventions plus then

International humanitarian law is not only the Geneva Conventions, it is, for example, also the Hague Conventions on the protection

Hog yeah.

of World Heritage sites and special cultural sites, but you also have customary inner humanitarian law, which is for example, you don't poison wells because that will help no one. If you want to use the well then after the fact that you've already poisoned it, you can't really. And so for a lot of

These things it is not

There's not a lot of incentive to to break these laws. Obviously, countries can still do it, and countries do still break certain parts of the Geneva Conventions. they do break certain rules of customary humanitarian law, they do break certain rules of humanitarian law, and yet we're still in a better position than we were before without having them, and we're also in a better position,

than we were say even during World War Two, where we had n little to no enforcement mechanism ex post facto, for example, through international tribunals or or special courts or national law or whatever it is. So at least we have some agreement and even if the enforcement at this point still needs work, which it does, we have something, we have a place to start.

Okay, Geneva Conventions more or less work, not perfect, but they've been successful. Now with regards to cyber, I'm not an expert in international law as I keep saying, but a lot of the things you talk about seems like they're it's not too hard to figure out, I don't think, what is disallowed. It's acts of savagery and inhumanity and stuff like that. But how does

cyber fit into that? And has any kind of cyber attack yet, been cited or been brought up as something as yeah, that violates the Ch Geneva Convention or another treaty, or, is it a case of it hasn't happened because or has it happened and if it hasn't, 'cause we're just not there yet, or because nothing's ri risen to that level? where where do we stand?

So that's exactly the the point that I've been bringing up where for kinetic warfare we have a starting place. We know at least what is and isn't allowed, and then the enforcement can lag behind. But with with cyberspace, we don't even have that s baseline. We don't even have this is wrong, this is right, this is okay, this is not so okay, and should be dealt with. and so

When we are dealing with this in uncertainty where even allied countries within, for example, NATO or ASEAN or any alliance, any similar minded countries can't agree on what constitutes a cyber attack, that's a problem. Right now where we stand is we have a it's called the Tallinn Manual. it's a study of multiple academics and legal advisors and

People who have put a lot of work and study into this topic, it is not a legal document, it's not binding, it's not states don't sign on to it. And even within the Talent Manual itself, you have, for example, varying definitions of a cyber attack. So if you read it, it reads like an academic study and it says, This group of experts has

agreed that a cyber attack is something that causes kinetic harm. But there is a part of the international group of experts that does not agree with this. So this is what they think. And then there is another subset that actually disagrees with both of these. So this is what they think. And we see this mirrored also in the UN open-ended working group on information and communication technologies.

Where countries submit their opinions and stances on certain topics relating to information and communication technologies, including international humanitarian law in cyberspace. So, for example, you have stances on what constitutes a cyber attack? Does the law of neutrality apply in cyberspace? Does you know how does it apply in cyberspace? How do these individual

requirements apply in cyberspace. And so you

Yeah.

s look at that and you can scroll through it. It's an a completely open source tool. You'll see very quickly that a lot of these countries don't agree with each other and a lot of these countries don't don't have the same definitions, don't have the same perspective. And that makes it very difficult to then enforce anything because you you don't know what you're enforcing.

more or less were agreed that international and humanitarian law does apply to cyberspace. There's no dispute about that. We we know that you know the basic laws of distinction and neutrality and attribution and all of this apply in cyberspace, but we just don't know how or the principles of how it could be applied.

very based off of the definition. And then you have humanitarian organizations, which in a lot of ways operate in a gray zone in kinetic armed conflict, but even more so in cyberspace, where they fall into the gaps between the varying definitions. And the fact that there is this

Gross ambiguity and not just ambiguity, which is crucial to international law, because you need a lot of that discussion between states on what certain things mean, and is this legal, is this not legal? That's that's good because you don't want just one state to dictate this is how it's going to be and it's my way or the highway. So you do need a certain level of ambiguity, but in cyberspace with

regard to the law of armed conflict or international humanitarian law, we have so little certainty, so little definition and so much disagreement that humanitarian organizations don't really have a certainty of how they're operating. Yeah, what what basis they're operating on.

I have a couple of re

So I have a couple of responses to that. Number one, I believe Gorav was telling us he sits on the technology committee for the UN. number two, I will disagree with you. There are definitions. However, like you said earlier, there are varying definitions of the same exact word. Three

I tried to impress you. I sent you some stuff from my dissertation on humanitarian law. I know you were moving, but I know you probably deleted, which is fine too. And part of my dissertation is exactly what you're talking about. Creating the terminology, the definitions, so that if somebody reads this, there's no ambiguity to my definition. They know what I'm thinking or how I found it, and then I s show a scholarly source an APA seven.

reference to where I found that and how I accepted that. So that's the problem but all these different countries. And the the other word that's interchangeable that shouldn't be is cyber operations versus cyber warfare. I don't know that we've ever been in a cyber war per se, because a cyber war assumes that two countries enter into a war and it was just cyber.

But cyber operations is the use of hybrid. The y at least my definition is that you're using cyber operations to achieve a goal that ultimately has some kinetic output to it as well. So that's my thoughts.

I would love to add something to that, but I've actually never heard this distinction. And you're right, they are used quite often and oftentimes interchangeably. And I've never really thought about the differences, so that's that that could make an interesting interesting study.

I'll let you know when I'm published.

I'll send you a copy, bound, and signed,

Thank you.

autographed. I'm kidding.

Well, I don't

I don't think there has been a pure cyber war. not that we know of, but y all the cyber warfare we've seen has really been the on the operation cyber operations supporting a kinetic war like Adam said, or supporting an economic stuff. But what I'm wondering is when you talk about neutrality, I think a lot of attribution and attribution in cyber is really hard.

So where does it stand or what are the thoughts on say, we use a lot of third parties, we use a lot of clouds and things, a lot of multinational

Claxy, yeah.

stuff. Yeah. if one country attacks another country using, a cloud service from a third country, can they remain neutral? Are they pulled into it whether they want to be or not?

This is a major area of discussion and it

How does that work? is it really? Yeah.

it there's a lot of discussion, a lot of people writing articles on it, a lot of people having conferences and talks and I'm I'm waiting for the day when there's a TED talk on neutrality in cyberspace. I I believe that day is not

Thought.

far away. But I will also say that I'm not the most qualified person to speak to this because

It hasn't been the area that I did a deep dive on. so maybe another podcast episode with someone else.

Or maybe you and I could write that paper for the

no.

next sidekon. But

Maybe.

so it's funny they say that, right?

Yeah, we're giving you some homework

out it. Come back in a month and we'll and we'll get your results.

Country A

attacks country B, but Country A puts Cobalt on an offshi an offshore oil well that's now a data center. It's in the middle of nowhere, but they use that for command and control to attack country B. Where's the attribution?

I don't

know, you're creating scenarios

Yes, that's the question.

that I genuinely have not thought about or studied.

Yeah, I've I have a warped mind, what can I tell you?

Well, that like I said earlier, we're we're cyber guys, we're devious. We try to think of how things will break and what evil people will do with them. So

But but but there

there are there are there are data centers that are sitting on offshore purposely so they're in international waters. The only thing that can happen to those data centers is that they get attacked by a country's military special forces to shut them down.

don't know how it works with because data centers I would assume are operated under some sort of corporation or

You're right.

L L or something like that. And so I don't know how it is when those are then tied to a specific country, even though it's in international waters. Because for example, ships also operate in international waters. And obviously it's a different example. Ships have a a long

Maritime.

history of how they operate and what their position is in international law and what laws apply on board a ship. But I would assume that there's

some sort of jurisdiction.

Well there's a international maritime

law. Yeah, there's international maritime law. Exactly why if one country is in waters and they have their own communications and another country is in waters and they can't communicate to each other, they use maritime channel sixteen through radio. That's why there's international maritime law, 'cause they allows communication. It talks about how you should c how you should how you should move your ships

Do you move a certain way depending on the lights that are indicated on the ship themselves? So there is international law for maritime. But y I get what you're saying. From a from a legal standpoint, if you're incorporated in Geneva, but you're in the middle of international law, what what law governs you, right?

And usually there is some sort of jurisdiction that extends either to the people or to to the specific mass. I just wouldn't know what exactly you would apply to that.

No me either. I'm not an attorney, so I don't cla

I don't claim to know.

Okay, so so here's another here's another quiz question. Got another scenario for you. I know, or I'm pretty sure, that things like factories that produce weapons are fair game, right? They're legitimate targets. What about the data centers that support them? What about the data centers that say support the design work and stuff?

That's what she's talking about, medical emblems.

digital emblems. Sorry.

Well the thing the thing with

any target is does it serve a military a tangible military advantage? which is what every general and every team of lawyers on with every attack needs to deal with. does it serve a specific military advantage? And sometimes blowing up a civilian bridge

will serve a concrete military advantage because then the opposing side won't be able to move troops across said bridge. With data centers that support a defense company, you could make that case that it serves a s distinct military advantage. The problem arises when, for example, you can't tell which server is

supporting a defense contractor versus which server is supporting a humanitarian or relief organization in a conflict zone. And

Yeah. Yeah, what if they're

in the same facility, especially in a smaller country,

Exactly.

right?

Well

And so that's where

ch joke yeah.

where one of the major projects of the Red Cross comes in. The Red Cross is developing a digital emblem. It's called the Digital Emblem Project. And it's for this very specific reason where you have certain cyber tools that humanitarian organizations use, be that servers, be that databases, communication channels, whatever it is.

And you want to be able to tell it apart from other communication channel servers and etc. But you don't really have a way to do that now. And so that's why they're developing it's it's a cryptographically authenticated digital emblem. it the whole process is quite long. There's a legal process, there's a technical process, you have to get countries to agree upon it again.

as you can imagine, we just described how long it takes for a treaty to get to get accepted and to gain

Verified. Yeah.

widespread usage. And now all of a sudden we're trying to do that with a digital emblem that cyber hasn't been around for that long and it definitely hasn't been included in warfare for a very long time in the grand scheme of things. So

When you think about it, we're dealing with very niche and very novel ideas. And so how do you how do you get that not just technically correct but legally correct when you don't have

hundreds of h years of warfare to lean upon. And so that's what a lot of the team in the Red Cross Digital Emblem Project is working on right now, trying to sort out not only the technical side, if it were just the technical side, we'd have a digital emblem probably two years ago, but also the legal side and the practical of how is this going to be used? Who can approve

If it can be used on this database or not.

So, Joe, I c I would argue that I I could be wrong, unless they've done it in countries and d I I've not seen it. I don't think typically data centers are blown up, but the issue really is D D DOS, right? So they DDoS those they they

true, yeah, D DAS, yeah.

DDoS, they do a deni distributed denial of service, which goes back to the attribution, which goes back to where is that where are those zombies or those

IoT devices that were taking over or servers or whatever w where they're coming from. They're coming from fifty different countries.

Yeah. And they'll Yeah,

and they'll subcontract it out to a proxy. You're right.

We got to

a proxy. So so I guess my point I'm making is, even if we look at upstream, right? We look at I'm for those who are gonna rip me apart and send me messages, Adam, that's not a public IP. Make believe that the network is ten dot zero dot zero dot zero slash eight, right? It's a big network. But under that 10 network, that public ten network, I know it's not public, but under that ten network, there's ten dot ten dot zero dot zero, and that's all defense contractors.

And ten dot twenty dot zero dot zero, that's th the red cross. How do you attack from DDoS? I I know you can specifically target a subset of IPs, but eventually that bandwidth gets consumed and other things happen. So that's the point I think we're all making, right? We're worried about, there there there's there's side effects to attacking defense.

defense countries because other other other organizations get caught caught in that crossfire. So while we might have a digital emblem and I hope it happened and I hope it works, that digital emblem might identify it, but might not prevent that DDoS attack from happening to the whole entire data center itself.

Yeah, that's really interesting, Adam, because we could have a case where it's not only if they're in the same data center, but say, they're served by the same carrier and a carrier gets taken out. Or, they're in the same region or something. I I assume that, in a lot of the places where warfare happens, there's not a tremendous amount of not always a lot of telecommunications. They could have a few major, I don't know, lines, whatever it is. And if they get

Dust that affects everyone. I guess that gets into the civilians too, in your research too, right?

I I I I hate to I hate to bring this up, but if you look out what happened on nine eleven and with the with the World Trade Center and the buildings getting hit by a plane

Let's just call that a terrorist action because that's what it is. So many organizations from a data side were were were were were were destroyed. Our financial system wasn't brought up for certain banks and financial institutions for weeks after, if not months. So the point I'm making is there there's collateral damage to other organizations when something's attacked. You can't it's very hard to target.

Let's just get that one defence contractor or that one military and make them stop. Is always collateral damage in in my opinion.

That is accounted for in international law. You do have a certain ratio of collateral damage because you said, it's very difficult to attack only one thing. I will say with nine eleven it's a slightly different thing because

Yes, I know.

you weren't in you you weren't operating under the law of armed conflict or under international humanitarian law because you were not in armed conflict. as for the Red Cross emblem, I think there's a

fundamental misunderstanding of what the Red Cross emblem is and what purpose it serves. Because a lot of people say it won't prevent this from happening. My answer to that would be it was never intended to prevent anything. It's

Derification.

its function is to identify an object that is already protected and to signify and signal to other

combatants to other parties involved that this is in fact a protected object, person, etc. So when you have an ambulance, it's not the Red Cross emblem on the the field hospital or on the Red Cross worker on their armband or it's not the Red Cross emblem on the the medical transport in a battlefield.

That provides the protection. It's not some sort of spell that's cast over that particular part of geography. It's this it's a signifier that says, this is a protected object, please don't shoot. This is a protected person, please don't hurt them.

Correct, yeah.

And it works in some places because there is a mutual respect. In certain war zones,

They stopped putting it on ambulance on ambulances. They stopped putting the Red Cross logo logo on field hospitals. medical personnel wearing the Red Cross logo simply for the reason that it served more as a target. It served as this is where the vulnerable people are, so that's who we're going to shoot, versus being that signifier of protection. And so they just removed it. That doesn't mean that those objects are not protected all of a sudden.

It just means you don't have that visible logo on it saying this is protected. And I think that same principle needs to be applied to cyberspace. The the digital emblem is not there to prevent any DDoS operation from happening. It's not there as a firewall, it's not there as a VPN or whatever other kind of protection.

we want to we want to add it's simply there as a signifier, no this is a protected object, look twice.

Yeah, and I think that's a great point to take us out. I think that it is all about things being these decencies, these ideas being respected. but from what I am hearing, I think cyber is going to be a very big challenge because that the identification is hard, even if something doesn't have a symbol on it, things appear to be an a ambulance.

it obviously doesn't have a gun on top. hospital kinda looks like a hospital in a lot of cases or they know where it is. but yeah, in cyberspace everything's mixed up. Everything is is is all together. actually that's frightening.

I'm gonna throw a bomb in there too, 'cause I know we're gonna we're we're pretty much at the end, but if you think about cyberspace and you worry about going across countries and across international alliance, think about how cyberspace also happens and works through satellites in space where it's also in a different geographical location. And we've spoken before about how satellites and how other countries have moved into other locations and have destroyed

So cyberspace, especially l with with Elon Musk and what's it called? The his internet. A lot of countries and a lot of people are using his satellite, his internet, and it's coming from space too. So that really complicates it even more. International waters, outer space, cyber, throw them all together.

space law is going to be the next big it, I think. I think the next cyber conference is the equivalent is going to be s space conference, space con. but

awesome. We love space.

I I'm fascinated by it. And

No.

I think that the more people we we get to talk about these things, the more people we get involved, the more people from

like you said, y you guys are cyber guys, but the more people from the actual practice we get involved, from militaries, from political, from legal, from the humanitarian organizations, from academia, the more people that get involved and are interested in this area, the better likelihood we have of actually figuring out something and coming to an agreement. And I think that's that's a hopeful place to be because you guys are raising

you're raising awareness. and I hope that somewhere out there some young kid is, listening to this podcast and and is being inspired to to go into be it being a a a cyber operator or or going into politics and changing it from from that end or going into into law and and

Figuring out how to c get all these countries to come come to an agreement on what a cyber attack is.

We we had the former CIO one of the former CIOs of NASA and we had a conversation about what people don't understand is that so much is governed by space and cyber. The GPS is like sh we we actually made this cut because of her, I believe. And if you if you spoof, if you destroy GPS, you destroy everything. And whether it's crops and being able to water things or it's being able to find locations and maritime and

So that's you're right. We're gonna have to have you come back on and talk about cyberspace, have you come on and talk about some other things. We'll we'll figure it out.

Yeah, Adam, I I think you're very right. It takes a a lot of different types of people, not just technical people like Adam and me, to secure cyberspace and deal with a lot of these things. And that's why we try to have different sorts of people like yourself on. And you're doing great work. Sounds it sounds like it's very important. Adam, yours is okay too. I know, yours is important too.

I'm all right, I'm all right. But look, I'm

smart enough to find people like Anna.

That's right. That's right, you did. But Anna, thank you so much for joining. I know it took a lot of effort. We we appreciate it.

Thank you very much for having

Yeah, thank you very much, Anna.

me on, gentlemen. It was a pleasure.

Thank you.

Okay, and thanks everyone for listening. And Adam, I'll see you next time.

See you later.

Alright, thanks everyone.