Schneier on Security

Clive Robinson • June 8, 2012 3:51 PM

@ Jacob,

This is not a technical article but could lead to some interesting discussions…

It could and I’ll give you one thought immediatly, which is sufficiently InfoSec related for this blog,

The argument presented in the article is logicaly flawed due to a basic but incorrect proposition, that what is in fact a crime is an act of war.

I’ll come about this the long way as it makes more sense to do so,

First off is the thorny question of “weapons” and their use. Weapons are plain and simple a “tool” the use of which does not imply any “societal state” such as peace, civil war or war.

As an example take a personal use gun (hand gun, rifle, shotgun), it can be used for, vermin control, game control, hunting for food, hunting for sport, target/clay shooting, defence against crime, crime and warfare.

That is only one of it’s potential uses is in prosecuting an existing war.

Even non personal use weapons such as cannon and mortars do have non war uses (emergancy rescue at sea etc to get rescue lines to people, clearing snow build up to prevent avalanche, and I’m told similar issues in limited geological and engineering activities and more interestingly experimental reasearch on getting objects into space).

So many weapons are tools and as such are agnostic to the societal state. Thus the use of a weapon does not mean your state is “at war” any more than throwing a hammer does. Therefor it’s actual use therefor must have some other legal recognition to be an “act of war”.

Further “cyber-weapons” are compleatly unlike most conventional weapons that people understand. That is they are not “directed energy” weapons, which is a very important difference.

Why is the difference important? because you need to consider how you defend against the use of a weapon.

Conventional weapons require the defender to take some positive action as a defence, cyber-weapons however can easily be defended against by the negative action of not having any computers, or not allowing them to be used in a way that might cause the defender harm (thus the “blue screen of Death” in MS Office is not an act of war no matter how you might feel 😉

So the notion of “cyber-weapon” is itself called into question, infact a little further reasoning shows that what we should actually be talking about is “Sabotage” (derived from the French word for a wooden shoe or clog the sabot,) it litteraly means “to put the boot in”…

That is without a machine to “put the boot in” to, no harm could be caused (outside of a “Bl**dy good kicking”) by a person wielding their clogs.

Thus “sabotage” is normaly considered an action against another persons property which needs a further requirment to become a “criminal act” and there are perfectly good laws to deal with crime in most countries (using them against international crime however is an issue for another conversation).

Now as I’ve indicated what they are calling “cyber-weapons” are actually “tools” for cyber-crime and it’s more restricted areas cyber-sabotage and cyber-espionage. Thus the use of the word “weapon” induces an emotional response that “tool” does not and this sets up a whole faux reasoning.

Importantly neither sabotage or espionage in the societal state of “peace” can be construed as “acts of war” they can only become that after the societal state has changed to “war” and the act or intent can be shown to be more than acts of civil unrest.

However and it is very important to remember this, once the social state has legaly changed from peace to war crimes such as sabotage and espionage change their state under what the article titles “Treacherous Deceit” (ie aiding and abeting the enemy).

Thus the use of terms like “weapon” not “tool” or “crime” falsely colour peoples reasoning to assume “in war” not “at peace” as the initial state of the use of such “tools” for the crimes of sabotage and espionage, and thus argue incorrectly that they are defacto “acts of war” which they are not.

[I could but won’t go on to argue that as the “cyber-world” is not a legal entity such as a “State”, and has no teritory or clear jurisdictional or geographical boundries a “war” cannot by definition be fought there so you can not have “cyber-war” thus “cyber-warfare”.]

As a closing point when a state of war exists those commiting sabotage or espionage are commiting “Treacherous Deceit” and are as such irespective of nationality “enemy agents” for which the lawful punishment of execution (by the “humane acts” of “hanging” or “firing squad”) is allowed. The reason for the execution to be “humane” is to avoid it being used as a method of torture [5].

[1] – The reason Bush and Co had to call the criminal acts of 9/11 “war” [2][3], was to try and paint the US as being a defender (thus “just”) not an aggressor (thus “war criminal”).

[2] – Bush and Co were wrong because legaly 9/11 was not nor could not be considered “an act of war”.

[3] – War can not be legaly declared on non specific people, but only on “States” with military or other “state sponsored” forces [4] who are committing acts of aggression that are considered “acts of war” or of “endangering National Security”, 9/11 did not meet either criteria.

[4] – Whilst you might wish to describe an individual as an “enemy” there are certain formalities before they become either military or state sponsord forces. So there is no “enemy combatant” for good reason, they are civilians and are alowed to defend themselve, their homes, properties and possessions from invading forces who are commiting any act against civilians that are “war crimes”. Even those who come from other countries to help repel the “invaders” are unless sponsored by a state civilians.

[5] – Torture is technicaly a “war crime” irrespective of the social state of peace or war and is illegal providing one or both nations are signatories to various international treaties, hence the Bush and Co term “enhanced interrogation” and the need for “rendition”.