Counter-C2 on a Neutral Nation's Cloud Tenant
You are the duty cyber operations officer in a combined joint task force. A subordinate unit's network-about 400 endpoints-is beaconing to a virtual private server hosted by a commercial cloud provider in a neutral country. The same VPS is serving three other victim organizations in allied nations. The beacon uses TLS on TCP 443 to a domain registered 11 days ago. The theater commander wants effects within six hours to protect a convoy moving at dawn. The host nation has not consented, and there is no basing or status-of-forces agreement. Your ROE card authorizes 'actions in self-defense' and 'national intelligence collection,' but requires legal review for 'network attack against infrastructure located in a non-consenting state.' You have a validated web-application exploit against the VPS and the ability to sinkhole the domain. The SJA is reachable but may take two hours. Two analysts disagree: one calls sinkholing a defensive measure; the other calls it an attack on foreign infrastructure.
1. Does sinkholing the domain constitute a 'network attack' requiring legal review? Reason through the definition rather than reciting it.
Read the worked answer
Start with effects, not labels. Sinkholing changes where a domain resolves. If the unit redirects its own recursive resolvers or blackholes the domain at its boundary, it is changing its own defensive configuration, not touching the VPS or the registrar. If you compel a neutral registrar to alter records, you are causing effects in a non-consenting state and potentially affecting other users of that domain. The ROE trigger is 'network attack against infrastructure located in a non-consenting state.' A domain name is not the same as a router, but the registrar's systems are infrastructure. The defensible reading: local DNS blackholing is not a network attack; global sinkholing through registrar manipulation is, and requires SJA review. Because the analysts disagree and the effect is hard to reverse from the adversary's perspective, seek review in parallel while taking the local measure. Do not let the label become a way to avoid review; review protects the mission and the coalition.
2. Recommend a course of action. Address authority, deconfliction, and escalation.
Read the worked answer
Recommend: (1) push local DNS blackholing and endpoint blocks to the 400 endpoints; (2) preserve beacon captures and metadata; (3) notify the allied victims through the coalition sharing channel without exposing collection; (4) request SJA review for any VPS exploit; (5) do not exploit the VPS now. Authority: self-defense is strongest if the beaconing supports an imminent threat to the convoy or the force, but the facts show ongoing intrusion, not necessarily an armed attack. National intelligence collection authority may cover observation, not destructive effects. Deconfliction: the VPS is used against three allied organizations, so any action affects them and the coalition must know. Escalation: if the commander directs effects before SJA review, document the imminent-risk determination, limit the action to reversible denial, and notify higher headquarters. The web exploit is not proportional to the need and risks other tenants; keep it as a contingency, not a first move.
3. The VPS also hosts a hospital patient portal. How does that change your recommendation?
Read the worked answer
The hospital changes the collateral estimate, not the legal definition. The VPS is shared infrastructure; a host-level exploit could affect the portal. Under distinction and proportionality, a target that also supports civilian medical care requires a high bar. Local sinkholing still only affects your endpoints and does not touch the hospital. A global sinkhole could affect the hospital only if it uses the same domain, which is unlikely, but a VPS exploit is different. The recommendation shifts: no exploit, no provider-wide action, and no action that could degrade the portal. Use local denial and intelligence collection. If the adversary C2 shares the host with the portal, any host-level action has foreseeable civilian harm. Escalate to the commander and SJA with a written collateral estimate, and consider waiting for host-nation consent or a law-enforcement takedown. The six-hour timeline is a planning driver, not a legal authorization.