the laws governing cyber warfare

How much is cyber warfare like traditional "kinetic" warfare? What rules should apply? Can cyber attacks be deterred? What is the right response to a cyber attack?  These are tough and important questions.

Fortunately, I see that a lot of serious people, within and outside the Pentagon, have been giving careful thought to these issues. Perhaps the most succinct analysis was done in 2009 by a panel under the auspices of the National Research Council of the National Academies of Science, "Technology, Policy, Law, and Ethics Regarding U.S. Acquisition and Use of Cyberattack Capabilities."  The full report is over 300 pages long, but the 8 page summary is a gem!

The NRC study makes a distinction between destructive cyberattacks and cyberexploitation, the latter being an intelligence-gathering activity. It notes that cyberattack weapons "involve a much larger range of options and possible outcomes" than kinetic weapons, including uncertainties over possible collateral damage. It says that the laws of armed conflict should apply to cyber attacks in terms of their direct and indirect effects.
These are valuable distinctions, albeit hard to apply in every circumstance.

The NRC study made some important judgments with major policy implications. It said that unilateral dominance is not realistic or achievable by the United States. It doubted that a threat of in-kind response would be very effective at deterrence. It concluded that U.S. decision-making apparatus for cyber operations was unclear and inadequate.

These are sound principles. I especially agree that deterrence can't be achieved by some U.S. effort to dominate the cyber domain. I do think, however, that arms control offers some opportunities, despite the existence of non-state actors and difficulties of verification of any agreed limitations. But international discussions could lead to some rules of the road principles and perhaps some institutional mechanisms for information sharing in cases of suspected attacks.

I'm pleased to see that the NRC held a workshop with a raft of papers by leading analysts in this area. More food for thought in this issue area.