Confronting Cyberespionage Under International Law

Oğuz Kaan Pehlivan, Oğuz Pehlivan

• Publisher: Routledge
• Year: 2018
• Print ISBN: 9780367606824
• eBook ISBN: 9781351105996
• Topic: Law
• Subtopic: Criminal Law
• Index: Law

We have witnessed a digital revolution that affects the dynamics of existing traditional social, economic, political and legal systems. This revolution has transformed espionage and its features, such as its purpose and targets, methods and means, and actors and incidents, which paves the way for the emergence of the term cyberespionage. This book seeks to address domestic and international legal tools appropriate to adopt in cases of cyberespionage incidents. Cyberespionage operations of state or non-state actors are a kind of cyber attack, which violates certain principles of international law but also constitute wrongful acquisition and misappropriation of the data. Therefore, from the use of force to state responsibility, international law offers a wide array of solutions; likewise, domestic regulations through either specialized laws or general principles stipulate civil and criminal remedies against cyberespionage.

Confronting Cyberespionage Under International Law examines how espionage and its applications have transformed since World War II and how domestic and international legal mechanisms can provide effective legal solutions to this change, hindering the economic development and well-being of individuals, companies and states to the detriment of others. It shows the latest state of knowledge on the topic and will be of interest to researchers, academics, legal practitioners, legal advisors and students in the fields of international law, information technology law and intellectual property law.

1Cyberspace, espionage and cyberespionage

What are the social and private interest that the law should recognize and protect? Here technological change set new problems and gave new urgency to old ones. The law had to alter many definitions of what was private and what was the public interest. The law has almost always been acted upon by, or has responded to, technological change, rather than controlled it.¹

“What was the most significant advancement that affected social, politi- cal, economic and legal systems fundamentally in the early 21st century?” This will be the question asked by 22nd-century historians. They will try to answer that question by looking at various developments that affect society, politics, economics, and legal systems, but also their meaning, function, and nature. They will possibly acknowledge the revolution in information technologies, which is defined as the use of systems for storing, retrieving, and sending information. This revolution is two-fold: first, the cost of storing information sharply decreases, and second, connection speed, and cost decrease dramatically.

Expanded access to information and the widespread usage of social media tools and the Internet has fundamentally altered the interaction between people and their environment. This accelerated and freed the dissemination of information, accurate or not, about any issue or fact. On the other hand, the protection of valuable information became more challenging due to the lack of security inherent to information technologies, as they are not intended to provide security, but to create alternative communication challenges, which provide impregnable access.²

In this context, defining cyberspace and its components is significant in regards to providing regulation while protecting fundamental rights and freedoms, and to tackle criminals and threats effectively. This freedom-security balance is the key to regulate cyberspace. Governments would like to regulate cyberspace heavily to increase their control by asserting security concerns; individuals or oppositions will challenge and protest such regulations as they are suggested to the detriment of freedom of expression or right to receive information.

When it comes to regulating espionage, there is no hesitation and objection raised from either side. However, espionage activities have undergone a fundamental transformation along with the above-mentioned revolution.³ Therefore, this chapter will analyze and evaluate the transformation in purposes, means, targets, and actors of espionage. This quest will constitute a basis to analyze cyberespionage, to define its legal characteristics and how to respond legally. This chapter will first offer a definition of cyberspace and further elaborate on its regulation. Second, it will comparatively analyze positive and negative views on regulating peacetime espionage activities in order to provide a legal basis regarding international legal responses to peacetime cyberespionage activities.

Regulating cyberspace and espionage

Challenges inherent to regulating cyberspace

Defining cyberspace

“Relating to or characteristic of the culture of computers, information technology, and virtual reality,” is the definition of “cyber” according to Oxford Dictionary.⁴ Cyberspace has become a widely used notion; however, the terminology to describe it is still developing. William Gibson, a science fiction writer, was the first to use the term “cyberspace” within his science fiction novel written in 1984.⁵

A review of government and scholarly literature reveals the difficulty of providing a conclusive and comprehensive definition of cyberspace that covers all of its functionality. In academia, Norbert Wiener first used the term cybernetics in 1948,⁶ and in 1999, Lance Strate gave an early definition of cyberspace as a collective concept of “the diverse experiences of space associated with computing and related technologies.”⁷ Ottis and Lorents defined cyberspace as a “time-dependent set of interconnected information systems and the human users that interact where users, nodes, and connections can appear and disappear and the information is transformed over time.”⁸ A comprehensive definition was offered by Kuehl, according to which cyberspace is “a global domain within the information environment whose distinctive and unique character is framed by the use of electronics and the electromagnetic spectrum to create, store, modify, exchange, and exploit information via interdependent and interconnected networks using information communication technologies.”⁹

Cyberspace is defined by the United States Department of Defense (US DoD) as a global domain within the information environment consisting of the interdependent networks of information technology infrastructures and resident data, including the Internet, telecommunications networks, computer systems, and embedded processors and controllers.¹⁰ It is also described in terms of three layers: 1) a physical network, 2) a logical network, and 3) a cyber-persona layer:

•The physical network is composed of the geographic and physical network components.

•The logical network consists of related elements abstracted from the physical network.

•The cyber-persona layer uses the rules of the logical network layer to develop a digital representation of an individual or entity identity.

As for the National Institute of Standards and Technology (NIST), cyberspace is “a global domain within the information environment consisting of the interdependent network of information systems’ infrastructures including the Internet, telecommunications networks, computer systems, and embedded processors and controllers.”¹¹ According to Turkey’s National Cyber Security Strategy and 2013–2014 Action Plan, cyberspace is “the environment which consists of information systems that span across the world including the networks that interconnect these systems.”¹² According to the UK Cyber Security Strategy, cyberspace is “an interactive domain made up of digital networks that are used to store, modify and communicate information. It includes the Internet, but also the other information systems that support our businesses, infrastructure and services.”¹³ According to the L’agence Nationale de la Sécurité des Systèmes d’Information (ANSSI) cyberspace is “espace de communication constitué par l’interconnexion mondiale d’équipements de traitement automatisé de données numériques.”¹⁴ In other words, cyberspace is the communication space created by the worldwide interconnection of automated digital data processing equipment. Therefore, key components of cyberspace can be defined and categorized as technology, complexity, and human components along with its global nature.

In this regard, we simply prefer the definition of cyberspace as the “realm of computer networks (and the users behind them) in which information is stored, shared and communicated online.”¹⁵ Although all of the above definitions except that given by US DoD explain cyberspace as a virtual world, it is more than virtual and has a physical dimension. All human activity, this includes actions in cyberspace, happens in the physical world. People log into computers and online services with regard to their geographical location; computers are addressed through domain names (such as www.abc.com) which give no indication of physical location, but the knowledge containing that domain name is physically located in a server elsewhere.¹⁶ Paying attention to the physical dimension element is significant, because the espionage operations intent is to try to steal the information stored within physical entities.

Regulating cyberspace

Ideas on regulating cyberspace have been changing since the 1990s, due to increased risks and threats. Early scholars proposed the idea of cyber exceptionalism or cyber libertarianism, which defined cyberspace as transnational, far from regulations and a place where existing “legal concepts of property, expression, identity, movement, and context do not apply to.”¹⁷ Other scholars opposed this idea; for example, Reed points out that there is fallacy behind cyber exceptionalism because “all the actors involved in an Internet transaction have a real-world existence and are located in one or more legal jurisdictions. It’s inconceivable that a real-world jurisdiction would deny that its laws potentially applied to the transaction.”¹⁸ If traditional law enforcement bodies have faced the challenge of cross-border trade or harm, the ordinary rules of private international law, jurisdiction and choice of law have proven effective in identifying the correct forum and legal rules to apply.¹⁹

Even earlier, Goldsmith pointed out that cyber skeptics made three basic mistakes, which are an overstatement of cyberspace transactions, disregarding “the distinction between default laws and mandatory laws,” and underestimation of the capability of existing legal tools and techniques.²⁰ Besides Brown’s argument that “cyberspace is nowhere,”²¹ according to Dinniss (and our view), “there does not exist some ‘matrix-like’ realm of cyberspace which bears no connection to the ‘real world.’ Actors still act in physical space; hardware and networks (even wireless and virtua...

Table of contents

• Cover
• Half Title
• Series Information
• Title Page
• Copyright Page
• Dedication
• Contents
• Preface
• Acknowledgements
• Cases
• Abbreviations
• Introduction
• 1 Cyberspace, espionage and cyberespionage
• 2 Legal responses to economic and industrial cyberespionage
• Bibliography
• Index