Hacker News Reader

Comment by tptacek | Hacker News Reader

The Geneva Conventions have whatever teeth they have precisely because they don't prohibit war. But these recommendations would more or less prohibit signals-based spycraft. It's reasonable to want governments not to spy on each other. It's not reasonable to expect it, especially since --- probably unlike most violations of the Geneva Convention --- there's a Prisoners Dilemma problem with adhering to these conventions.

View on HN

I don't see how a Geneva-like Convention could even forbid something that the parties are generally trying to obfuscate the existence and/or the source of anyhow. If the armies fighting the forces of Dictator Bob the Third (long may he reign) suddenly die from mustard gas, it's pretty easy to guess where that came from, and for the international community to take action based on that. Sure, it's not 100% confident, but we know how to deal with that in the physical world. But when your signals get intercepted or some hack occurs, figuring out who did it reliably enough to respond can be very difficult. The entire game theory of the original Convention is much harder to apply cleanly here.

I say this not to trash the idea, because it's a beautiful idea, and possibly a very good one. But if anybody wants it to get any traction, a much more sober analysis of the game theory and who gets what is going to have to be done. This is, alas, a wish list, not a practical treaty framework.

It's reasonable to want governments not to spy on each other.

Is it? I think governments spying on each other is sort of a good thing, myself. Insofar as governments have conflicting interests then it makes sense that they would attempt to understand each others' strategies and seek to outmaneuver them.

I know some people argue that the world would be a better place if everyone minded their own business, but that's kinda like kids saying we could solve crime if everyone would stop being bad. It's a form of wishing the world away, reflecting an unwillingness or inability to engage with it. Uncertainty and informational asymmetry are realities of life, hoping to eliminate this entirely seems irrational to me.

I'm just saying there's an argument to be had. I have mostly your perspective on this as well.

Well, that's what "reasonable" means. Not that it's the correct view, but that it's understandable and, well, reasonable. Some people may have that view, and I don't think they're being unreasonable. The opposite view is also reasonable.

Also Geneva Conventions were developed following widespread experience of the horrors of traditional warefare. "Cyber" warefare does not yet have that same affect on policy-makers and the general public.

Worst case senarios such as damage to critical structures such as dams might have high fatalities. The key is to avoid a war before it happens.

Would existing protections in the Geneva Conventions against targeting noncombatants apply to damaging infrastructure that leads to civilian fatalities?

Probably the better question is whether everyone who might want to damage such infrastructure is in fact (a) a state actor who (b) was one of the signatories to the Geneva Conventions.

Dams and nuclear reactors are specifically covered under dangerous forces. But you can target highway bridges, ports, locks which can fail safe, etc.

And bridges and ports are among the priority targets for traditional air attacks to hamper enemy troop movements, supply lines and production capacity. I see no reason to prevent cyber attacks against them.

And few much care that governments spy on each other. Spying is a cornerstone of peaceful assurance and verification. I'm much more worried about my government spying on me. I'd rather be spied on by a forgien government than my own. They will keep quiet. Thet arent going to knock down my door and freeze my bank account if i use the word "syria" in an email to my mom.

> I'd rather be spied on by a forgien government than my own. They will keep quiet.

Not among allies. If you can spy on everyone but your own citizens, you only need 2 nation-states cooperating to spy on everyone. Which is already occurring at a minimum between Britain and the U.S.

There's no easy way to prevent the sharing of the private information of civilians without some kind of exception, and that exception cannot be precise without artificially limiting the intelligence capabilities of a country, which in practice will mean such a limit will be ignored, or, more likely, will have an easily abused exception (i.e. terrorism) to make it more or less toothless.

The "five eyes" are referred to by a common name for a reason. (The US and 4 commonwealth states.)

>They will keep quiet.

No they won't. The problem is countries you wouldn't even expect to will trade data to get around domestic spying restrictions. If, say, the US compiles big databases on German citizens, and the German government does likewise with Americans, German and American spies can trade and thus get their hands on data they would like to have but can't legally collect.

Once your data is out there, it's out there.

> But these recommendations would more or less prohibit signals-based spycraft.

That depends on the definition of "cyberattack", a term that in casual use is used both for insertion of monitoring capacities and more destructive actions (e.g., stuxnet.)

I think there is a good case that prohibition of the kind of indiscriminate harm to civilians widely accepted as prohibited by international law now (whether Protocol I for those who are parties, or customary international law in the US perspective) when achieved by means of physical attack ought to apply equally to harms caused foreseeably by cyberattacks. Mere non-destructive espionage (which isn't purely passive) targeting civilians is probably a different issue.

EXACTLY! This should focus instead on outlawing cyberwar operations that indiscriminately affect civilians (and therefore could be used to justify a conventional or nuclear retaliation to a cyberwar act)!

The list of this to be banned should look more like this (though I'm not a legal expert):

- No targeting of critical infrastructure (being specific: hospitals, water treatment, powerplants, electricity grid, public schools, public universities etc. - not simply "tech companies, private sector") - and by no-targeting I also mean no planting of dormant backdoor-enablers, even if they do nothing - if you have the IMPLANTED CAPABILITY to damage a hydroelectric dam, for example, it already means you have already TARGETED it, therefore violated the convention

- No stockpiling of vulnerabilities for more than X months by government agencies - any gov agency should have BE REQUIRED to publicly disclose any 0-day they get their hands on after at most 12 months or smth. like this (short term stockpiling is OK, you need some level of healthy conflict, but the playing field need to be leveled a bit) - and of course this law would not be enforced, but at least your congress for example would always have a good reason to "fire the head of the NSA for not enforcing the adherence to the 0-day chapter of the Digital Geneva convention", and this would put the balance of power where it should be

- Gov agencies should be required by law to help defend companies that hold private data (the state exists to defend the people, and defending their data is part of it, even if it happens to be on some company's private servers and people signed some semi-legal-EULA-thingy letting the company do whatever with it - form gov's perspective defending that data is still about defending the people that pay the taxes) - and companies should be able to sue the gov if they believe the gov had technical capabilities to defend them, but did help them using this capabilities

- Inciting a lethal-force retaliation against a non-lethal cyberwar operation should be consider equivalent to "starting a war without provocation" - if Wallstreet is hit by a cyberawr attack causing 10blns damage, you are NOT justified to retaliate militarily - just fix you fucking defenses instead of getting innocent peoples killed for your lack of technical competence that got you hacked in the first place - those having most $$$ to lose from cyberwar are also those having most $$$ in general, therefore they would be the least affected by it, and have the least right to retaliate violently.

Just as tptacek said, the point should not be to prevent war (war can be quite healthy sometimes), but to make the game "at least somewhat fair", to level the playing field (as in "let the smartest man win!"), and to prevent "civilian" victims (if you don't want to play the game, it should be ok, and you and your business should be protected by side-fire - this is what gov agencies should do mainly, protect civilians and legitimate businesses from cyber attacks, while letting the game play on!).

(EDIT+ note: I'm not American, and I believe the things above should still hold even if US citizens and businesses would have somewhat of an "unfair advantage" globally because of how much your gov has already invested in cyberwar... if it's an advantage bought by fairly earned $$$ you can call it a fair advantage... if it's not, than that's a different conversation to have :) )

Reply on news.ycombinator.com