Law, Policy, and Rules of Engagement for Cyberspace Operations
Authorities stack
- Title 10 covers military operations, including most OCO and DCO; Title 50 covers covert action, which requires a presidential finding. NSPM-13 delegates approval of certain OCO to the Secretary of Defense.
- Posse Comitatus restricts military involvement in domestic law enforcement; the Computer Fraud and Abuse Act (18 U.S.C. 1030) governs unauthorized access domestically.
- Standing Rules of Engagement and command ROE govern the use of force; cyber ROE sit inside them and add deconfliction and effects limits.
International law
The UN Charter's prohibition on the use of force (Article 2(4)) and the right of self-defense (Article 51) apply in cyberspace. The Tallinn Manual 2.0 records the expert consensus that existing international law governs cyber operations, including sovereignty, due diligence, and state responsibility. Law of armed conflict principles apply in armed conflict: military necessity, distinction, proportionality, and humanity. Whether a cyber operation crosses the use-of-force threshold is assessed by effects - severity, immediacy, directness, invasiveness, and measurability - not by the tool used.
Worked example
An intrusion is traced to infrastructure in an allied state that is itself a victim of a compromised server. Reasoning: the state's infrastructure being used does not make it the responsible actor. Assess attribution to the actual perpetrator, consider the ally's due-diligence obligations, and treat any response as a countermeasure that requires a prior wrongful act attributable to a state. A retaliatory intrusion against the ally would be unlawful; a request for the ally to clean its systems is not.
Traps that cost marks
Treating cyberspace as lawless; assuming 'hack back' by a private party is lawful; confusing retorsion with a countermeasure; ignoring proportionality for shared infrastructure; and treating Title 10 authority as sufficient for covert action.