Russia and China today vetoed a proposed UNSC Resolution (stories here and here) that would have condemned the abuses in Syria, demanded their cessation, required Syria to give free rein to League of Arab States’ institutions and Arab and international media, and called for an “an inclusive Syrian-led political process conducted in an environment free from violence, fear, intimidation and extremism, and aimed at effectively addressing the legitimate aspirations and concerns of Syria’s people.”  The Resolution also would have called on the Syrian authorities “to cooperate fully with the League of Arab States’ observer mission,” and it “stresse[d] the need for all to provide all necessary assistance to the mission in accordance with the League of Arab States’ Protocol of 19 December 2011 and its decision of 22 January 2012.”

The main reason that Russia gave for its veto is that it felted duped by the expansive interpretations given to the March 2011 UNSCR Resolution on Libya.  That resolution authorized “all necessary measures . . . to protect civilians and civilian populated areas under threat of attack in the Libyan Arab Jamahiriya, including Benghazi, while excluding a foreign occupation force of any form on any part of Libyan territory.”  NATO countries read this language very broadly to authorize aggressive military actions against Gadaffi’s forces everywhere in Libya and, in the end, to authorize regime change.  Once bitten, twice shy for the Russians, according to The Christian Science Monitor:

Continue reading Jack Goldsmith…

The WSJ reports that Google is returning to China after its confrontation with the Chinese over Chinese censorship and alleged Chinese hacks into its computer systems led it to shut down its Chinese site, Google.cn, and direct visitors to its Hong Kong site, Google.com.hk.  The firm never left China altogether: “While Google, which opened its first China office in 2005, shut down many functions there following its decision to stop censoring search results, it says it never abandoned the country.  It still has more than 500 employees there, including more than 300 engineers.”  But it is now ramping up its presence even though, as the story reports, China-based hackers are still targeting Google and China is still censoring.  The market opportunities are just too great, and Google aims “to capitalize on its fast-growing Android operating system for mobile devices, online-advertising and product-search services.”

Continue reading Google Returns to China…

Adam Segal at CFR, the person from whom I learn most about China and cybersecurity (here is a sampling of his posts), has a post that links to a China Defense Daily article on why Chinese experts think the U.S. military will have difficulty achieving its cybersecurity deterrence aims.  As Segal reports (based, I think, on his translation):

The article [in China Defense Daily] sees the U.S. as being unable to secure its networks. The announcement of the Defense Department’s Strategy for Operating in Cyberspace, in the Chinese view, encouraged other countries to develop their own offensive capabilities.  Attribution is hard, and providing proof of who is behind an attack that would convince others is still extremely difficult.  Detection and monitoring capabilities in cyberspace are underdeveloped so it is a real question whether the U.S. military can detect, provide warning of, and deter an attack before it happens. Finally, if the United States decides to retaliate through offensive cyberattacks, it can have no certainty about the outcomes.  The impacts on networks are often limited and can be quickly recovered from.

The most interesting point here, I think, is that even if U.S. officials are (as they increasingly say) better able to attribute cyber-operations, the credibility of their public responses to the operations depends in part on being able to convince various audiences in the United States and abroad that the attribution is accurate.

Continue reading Jack Goldsmith…

A recent Defense Department report to Congress warned that foreign nations run a “grave risk” if they threaten or launch a large-scale cyberattack on the United States, and it announced for the first time that the Pentagon possesses cyberweapons the president can deploy in the face of such an attack. The report aims to bolster U.S. deterrence against cyberthreats but, in fact, highlights weaknesses in our deterrence policy.

The Pentagon’s threat applies to “significant” cyberattacks. It does not purport to deter small-scale ones. Nor does it address “cyber exploitations” that — in contrast to cyberattacks,which damage or disrupt a computer system — copy or steal information on a computer system. Cyber exploitations of valuable government and business secrets are vastly more pervasive than cyberattacks and, at present, are a more serious national security threat. They are also significant because they often cannot be distinguished from cyberattacks, at least until an attack begins. Passivity in the face of cyber exploitations thus encourages cyberattacks.

Continue reading Jack Goldsmith…

In an interview with Reuters, General James Cartwright, who retired a few months ago as the vice chairman of the Joint Chiefs of Staff, maintains that the United States needs to disclose its offensive cyber capabilities in order to enhance the deterrent effect of these capabilities.  “We’ve got to step up the game; we’ve got to talk about our offensive capabilities and train to them; to make them credible so that people know there’s a penalty to this,” he said.  “You can’t have something that’s a secret be a deterrent.  Because if you don’t know it’s there, it doesn’t scare you.”  Cartwright added that the United States needed to send a signal that it would exercise its “right to self-defense” in response to cyber attacks.   ”We’ve got to get that done, because otherwise everything is a free shot at us and there’s no penalty for it.”

One cannot read too much into snippets of an interview, but of course matters are more complex than this.  First, talking about offensive cyber-capabilities is a tricky business.  Merely talking about the weapons in general terms, without revealing and perhaps demonstrating their capabilities, cannot advance deterrence very much.  But on the other hand, too much detail about what the weapons can do make it easier, and potentially very easy, for adversaries to defend against these weapons by (among other things) closing the vulnerabilities that the weapons exploit.  Moreover, openly demonstrating or even discussing cyber capabilities would further enflame the cyber arms race in ways that might be self-defeating.

Second, revealing the circumstances in which these weapons will be used might invite infiltrations just short of those circumstances.  “As soon as you declare a red line, you’re essentially telling people that everything up to that line is OK,” noted former Pentagon official Eric Sterner in the Reuters story.

In an interview with Reuters, General James Cartwright, who retired a few months ago as the vice chairman of the Joint Chiefs of Staff, maintains that the United States needs to disclose its offensive cyber capabilities in order to enhance the deterrent effect of these capabilities.  “We’ve got to step up the game; we’ve got to talk about our offensive capabilities and train to them; to make them credible so that people know there’s a penalty to this,” he said.  “You can’t have something that’s a secret be a deterrent.  Because if you don’t know it’s there, it doesn’t scare you.”  Cartwright added that the United States needed to send a signal that it would exercise its “right to self-defense” in response to cyber attacks.   ”We’ve got to get that done, because otherwise everything is a free shot at us and there’s no penalty for it.”

One cannot read too much into snippets of an interview, but of course matters are more complex than this.  First, talking about offensive cyber-capabilities is a tricky business.  Merely talking about the weapons in general terms, without revealing and perhaps demonstrating their capabilities, cannot advance deterrence very much.  But on the other hand, too much detail about what the weapons can do make it easier, and potentially very easy, for adversaries to defend against these weapons by (among other things) closing the vulnerabilities that the weapons exploit.  Moreover, openly demonstrating or even discussing cyber capabilities would further enflame the cyber arms race in ways that might be self-defeating.

Second, revealing the circumstances in which these weapons will be used might invite infiltrations just short of those circumstances.  “As soon as you declare a red line, you’re essentially telling people that everything up to that line is OK,” noted former Pentagon official Eric Sterner in the Reuters story.

Continue reading Jack Goldsmith…

As Bobby notes, Charlie Savage reports that the Obama administration disregarded a congressional statute that banned (through a spending condition) certain activities of the Office of Science and Technology Policy (“OSTP”) involving certain Chinese officials and organizations.  The Office of Legal Counsel concluded that the restrictions violated “the President’s constitutional authority to conduct the foreign relations of the United States,” and in particular that “[m]ost, if not all, of the [prohibited activities] fall within the President’s exclusive power to conduct diplomacy.”  The executive branch thus maintains that OSTP officials designated by the President to conduct diplomacy could lawfully engage in the activities that Congress had purported to ban.

The end of Savage’s story quotes Shannen Coffin, a Bush administration lawyer, urging courts to stay out of matters like this, but the bulk of the story suggests that there something untoward about the executive branch disregarding a federal statute without a court having ruled on the matter.   “Although the Supreme Court has never struck down such a law, the Justice Department pronounced it unconstitutional,” Savage says (emphasis added).  OLC’s reliance on a string of executive branch precedents in this case “illustrate[s] how one president’s assertion of executive power — sometimes in memorandums that are secret at the time — establishes a ‘precedent’ for his successors to develop by applying it to new circumstances,” he adds.  “Each repetition cements and expands the claim without a court ever weighing in” (emphasis added).  Savage then quotes Bruce Ackerman:

This is a bipartisan project of executive aggrandizement.  Law is a disciplined conversation between lawyers and judges. But without any judges, law is a conversation between lawyers and other lawyers — and they’re all on the same side, building upon one another.

Continue reading Jack Goldsmith…

Eric Schmitt and Thom Shanker of the NYT report that the Obama administration considered using offensive cyber-weapons in the war in Libya, but in the end did not use them.  Schmitt and Shanker give several reasons why the USG declined to use the weapons, some of which make more sense to me than others.

A cyberattack would have implicated the War Powers Resolution.  The story suggests that the government considered using cyber weapons to disable Libyan air-defense missiles and radars, but then switched to kinetic attacks to achieve the same ends because it worried that the cyberweapons would have amounted to “hostilities” that triggered the WPR.  But if the kinetic and cyber attacks would have achieved the same effect on Libyan air defenses (which is what the story suggests), it is hard to see why the cyber attack and not the kinetic attack would have constituted “hostilities” under the WPR.  Indeed, on the administration’s narrow theory of “hostilities” under the WPR, the likelihood of an attack being deemed “hostilities” rises with the likelihood that a U.S. soldier will receive hostile fire or injury.  But as the story noted, the likelihood of risk to U.S. soldiers was higher with the kinetic than with the cyber attack, so it is not clear why a cyber attack would raise heightened concerns under the WPR.  The description of the legal concerns is unclear in other respects as well.  The story suggests that the government worried about whether a “purely cyber-based attack” would have implicated the WPR; this might suggest that the legal issue was presented at a time when the choice was between a cyber attack or no attack at all, and not as a choice between a cyber and a kinetic attack.  The story also notes that government lawyers were “unable to resolve whether the president had the power to proceed with such [a cyber] attack without informing Congress.” But of course the administration did inform Congress about the kinetic attacks, so it is not clear what the concern is here.  Perhaps the administration did not want to reveal publicly that it used cyber weapons, though of course the administration has, and could once again, file a classified annex to a WPR report.  All in all, the discussion of the legal issues in the story is very unclear.