September 2, 2011: Cyber War is confounding lawyers because attacks via the Internet can do enormous damage, and are sometimes carried out by civilians. How do you deal with that? There are rules for hackers in uniform, but not for the irregulars. One suggestion is to identify and seize hackers who have done damage and put them before a tribunal to determine if the hacker has rights as a POW under the Geneva Convention. Thus one has to determine if the hacker wore a military uniform? Was the hacker commanded by officers responsible for his conduct (that’s not what hacking is all about)? Did the hacker conduct his activities in accordance with the recognized rules of war? Definitely not. It used to be that if an armed civilian attacked you under these circumstances, you could kill them, even if they surrendered. But the 1949 Geneva Conventions prohibited this (but did allow your troops to shoot back at armed civilians). Thus if you can catch the hacker working a keyboard, you can open fire. But you can’t take him alive and later execute him. Not right away. If a hacker caused damage that killed people, a murder charge, and even the death penalty, could stick.

So far, few high-level hackers have been arrested, or even identified. But that will eventually change, and when it does, the laws of war will have to adapt.