When does a Cyber Attack become an Act of War?

When does a Cyber Attack become an Act of War?

Pearl Harbor was one of the most tragic moments in American history. Japanese bombers unleashed a devastating surprise attack on a U.S. naval base in Hawaii on that seventh day of December in 1941, killing twenty-four hundred Americans and wounding another thirteen hundred. President Franklin D. Roosevelt called it a date that will live in infamy during his speech asking Congress for a declaration of war.

Sixty years later, another surprise attack killed almost three thousand people when Muslim terrorists flew two airplanes into New York’s World Trade Center towers and the Pentagon.

Today, the United States is in another pre-9/11 moment, with critical computer systems vulnerable to assault.

America is vulnerable to a cyber Pearl Harbor.

An act of war by military means is apparent. Pearl Harbor and 9/11 are two of the most egregious attacks in U.S. history. Our nation’s leaders need to raise a sense of urgency about the threat we face in the cyber domain.

But when does a cyber attack give rise to an act of war?

Japan’s attack on Pearl Harbor was a direct assault on a U.S. military installation—clearly, an act of war. But much of the nation’s critical infrastructure networks belong to the private sector. Companies that provide transportation, water, telecommunications, and energy could become targets for adversaries determined to put America in the dark. Would this be an act of war?

In my best selling book, CYBER WARFARE, from the Prepping for Tomorrow series, I wrote:

By way of example, if a significant cyber attack is initiated, such as a virus knocking out air traffic control and wreaking havoc on the airline system, what would be the appropriate response of our government? It is likely the President and the National Security Council would focus first on what type of reply would be proportionate, justified, and necessary and in the U.S. interest. It might be a military response. It might be retaliation in cyber space. It might be the exposure of the attacker before the United Nations, demanding the imposition of sanctions. With the problems of attribution, it might be no response at all.

What about the alleged recent hacking of our political process by the Russians? Is this administration’s threats of retaliation justified? Could this escalate into a military conflict?

I consider this to be one of the most important issues facing our national security. The Boston Brahmin series was written around the concept of Cyber Warfare. In fact, Chapter Two of my #1 best selling book, THE LOYAL NINE , provides us a glimpse into Sarge’s mind as he lectures his class at the Harvard Kennedy School of Government.

Please enjoy this excerpt from The Loyal Nine which was written in February 2015.

Chapter 2
December 15, 2015
Harvard Kennedy School of Government
Cambridge, Massachusetts

His students shuffled into their seats and unpacked the tools of their trade—computer tablets, voice recorders, various and sundry electronic gadgets—all designed to let them pay attention to their professor without fear of distraction or falling behind on the lecture.

“So we find ourselves at the end. Last class of the semester,” said the professor to a chorus of uplifting murmurs. “And finals will be on Tuesday.” His patented kill shot transformed the positive mood as students throated their distaste for the reminder.

“Oh, I see how it is. Happy to see the last of me, but the thought of finals is the end of the world as we know it.”

Laughter filled the classroom as the moods lifted. Professor Henry Winthrop Sargent IV, affectionately known as Sarge, once again wondered if the students’ collective response meant they truly enjoyed his lectures—or the pleasure of his academic company paled in comparison to the terror of his final exam. He’d probably never know for sure, he thought, as the title of his final lecture appeared on the screen.



The words had a sobering effect on the muffled conversations in the room. While they absorbed the question of the day, Sarge looked at the faces and placards containing their names. Some of these people would be rich and powerful someday. The Harvard Kennedy School—John F. Kennedy School of Government—deserved the respect that its prestigious name implied. The school’s history dated back to the late 1930s, but its rise to prominence came in 1966 when it was renamed for the late president John F. Kennedy.

The school’s alumni list was a who’s who collection of government leaders, journalism headliners and business aristocracy. Names like Ban Ki-moon, United Nations Secretary General; Paul Volcker, former chairman of the Federal Reserve; and outspoken talk show host Bill O’Reilly of Fox News fame. Even the president of Harvard, Lawrence Summers, a former professor at the Kennedy School, had been an economic advisor to the World Bank and United States presidents.

When Sarge was offered an academic position at the school, he had big shoes to fill—not exactly a problem for a direct descendant of Daniel Sargent, a wealthy merchant during the time of the Revolutionary War and a notable member of the infamous Sons of Liberty. This historical and financial lineage provided Sarge the necessary status to be considered for Harvard, where he received a bachelor of arts, combined with master’s and doctorate degrees in public policy and government. It also didn’t hurt that Sarge had important “friends,” most of whom he had never met. From an early age, Sarge understood that he had been groomed for his position as professor, on top of “other duties.”

“The world has come a long way since the Minutemen fired the first shots at the Battles of Lexington and Concord in 1775. Today, cyber warfare is used by the military to attack less traditional battlefield prizes—command and control technology, critical national infrastructure systems and air defense networks, each of which require computer automation to operate,” said Sarge.

“Prior to the Russian invasion of Ukraine,” said Sarge with a facetious cough, eliciting some quiet laughter from the class. “I mean the separatist uprising, Russia followed a template that worked successfully during its invasion of Georgia in 2008. Ukraine experienced the same cyber chaos that wreaked havoc in Georgia before Russia rolled in with its tanks. The writing on the wall was literally written in the malicious computer code propagated throughout Ukraine.

“Before Crimea seceded to Russian control in early 2014, Kyiv was overwhelmed by a series of sophisticated and coordinated cyber attacks, crippling communications networks and shutting down government websites with denial-of-service attacks,” Sarge continued, with the room’s rapt attention.
“By the way, if you think that couldn’t happen in the U.S., think again. Early this year in northern Arizona, ‘vandals’ cut a critically sensitive fiber-optic cable, disrupting police and state government databases, banks, hospitals and businesses for several hours. No ATMs. No credit card transactions,” he said, pausing. “And no Internet—heaven forbid.”

The class laughed at this lighthearted jab at their generation.

“What I found interesting about all of these reports was that investigators used the terms vandals or vandalism repeatedly, implying a bunch of bored high school kids might be responsible; plausible? I don’t think so. The fiber-optic cable was encased in a two-inch-thick steel pipe. Breaching this pipe would have required more than a simple hacksaw as reported. Even a battery-powered reciprocating saw might not do the trick. And yes, I did some research. These hands don’t see the use of hacksaws very often,” said Sarge, drawing more laughter.

“The question has to be asked: Was the Arizona event a trial run for something bigger? Is there a rogue nation or terrorist group contemplating an attack on the United States using the Russian template so successful in Georgia and Ukraine? Probably not, unless this starts happening more frequently. Time will tell. Fortunately for you, the new face of warfare might be a little clearer.”

Sarge looked out into the classroom. When teaching, Sarge enjoyed having instructive dialogue with his students. He employed the Socratic Method, named for the Greek philosopher Socrates.

Universally feared by law students, he employed a more productive version of Socrates’ contribution to academia, asking question after question until the entire class came to a collective conclusion—no small feat when so many cultures and political points of view were represented in one room.

“Mr. Feltzer,” said Sarge, bringing the young man to attention in his seat, “are you familiar with the cyberattack on Sony Pictures in 2014, which cost them nearly a billion dollars?”

“Yes, sir,” replied Feltzer.

“Was this an act of war?” asked Sarge.

“No, sir,” replied Feltzer.

“Well, I agree, although I believe if Sony Pictures had real cannons, they would have found somebody to shoot,” said Sarge, to a room of laughter. “In fact, the President made a point in a CNN interview to call the attack cyber-vandalism.”

“Ahhh,” said Sarge, “there’s that word again—vandalism. An attack upon the private sector that results in economic loss does not give rise to an act of war. Would everyone agree with that statement as our first premise?” Sarge observed heads nodding all around.

“Thank you, Mr. Feltzer. Miss Crepeau, you’re up,” said Sarge.

The young woman who sat in the front row was eager to jump into the discussion, as always, thought Sarge. Sarge recognized from day one he had to be careful with that one.

“Let’s continue with the Russian Template, as we’ll call it. I have a hypothetical for you, Miss Crepeau. We have already discussed the ‘vandals’ who cut the fiber-optic cable in Arizona. What if these vandals simultaneously, via a cyberattack, took down Tucson Electric and the Salt River Project that services Phoenix? Now do we have an act of war?” asked Sarge.

“Not yet,” she replied. “Although these acts are coordinated by these vandals, there has not been sufficient corresponding death and destruction to warrant military action.”

“How many deaths?” asked Sarge.

“Excuse me?” she replied.

“For all of you,” said Sarge, addressing the entire class, “how many deaths from this type of coordinated attack would warrant a military response?” As Sarge looked around the class, he heard responses of hundreds, thousands and just one is enough.

“Thank you, Miss Crepeau. Therein lies the rub,” said Sarge, quoting Hamlet.

“I heard answers ranging from one to several thousand. The challenge for any government is to identify a standard—a breaking point—that requires a nation to go to war,” said Sarge.

“For most governments, the standard is vague and leaves a lot of wiggle room. By the way, that is a global governance term of art—wiggle room,” said Sarge to a few stifled laughs.

“Officially, both the White House and the Pentagon consider a cyberattack emanating from a foreign country an act of war. But they do not spell out when a cyberattack is serious enough to constitute an act of war. As Miss Crepeau suggests, I suspect a cyberattack that produces death, damage and destruction similar to a traditional military attack might merit retaliation through the use of force,” concluded Sarge.

Sarge had set them up, just as Socrates would have in the fifth century B.C. The class now seemed to agree death and destruction was a prerequisite to military retribution. Let’s twist them around a little, starting with the law student.

“Mr. Robbins, let me begin with you,” said Sarge. “Did you agree with the consensus of the class that the cyberattack on Sony Pictures was not an act of war?”

“Yes, sir, I did,” responded Robbins authoritatively.

“Mr. Robbins, do you believe that a coordinated cyberattack could devastate the U.S. economy?” asked Sarge.

“It would depend on the severity and what systems were affected. Professor, would you consider it an act of war if the Sony Pictures attack was made in conjunction with a shutdown of the stock market?” asked Robbins, Socratically.

Well done, lawyer-to-be. You answered a question with it depends and threw it back at me with another question of clarification.

“Let’s look at a real-world example, shall we?” asked Sarge.

“In 2007, once again, our friends the Russians,” said Sarge with his voice trailing off. “After today, I’m sure to have my travel privileges to Russia suspended.

“In 2007, the tiny country of Estonia mistakenly poked the Russian bear by moving a controversial Soviet-era memorial from the town square in Tallin to a remote location. The large Russian minority in Estonia protested, as did the Russian government. For weeks thereafter, Estonia businesses and utilities suffered a barrage of cyber attacks that brought the private sector to a screeching halt.

“While the Estonia attacks were not the largest on record, they were sufficient to bring a country considered to be especially wired to its knees. The resulting recession was considered a direct result of the cyberattacks,” said Sarge.

“The Gross Domestic Product of the United States economy is eighty percent services. In economic terms, a service is an intangible commodity. Any event that disrupts the ability of those services to be rendered will necessarily result in a downturn of the economy. For example, according to a Department of Commerce report, the economic losses caused by Superstorm Sandy, a storm event lasting twenty-four hours, totaled one hundred billion dollars.”

“Mr. Robbins, if a rogue nation, via a cyber attack, caused economic losses in this country totaling one hundred billion dollars, would that be an act of war?” asked Sarge.

“No, sir. If I were president, and one day I will be, only significant loss of life warrants a war response,” said Robbins.

“Mr. President-to-be, I will submit there have been many wars fought over a lesser economic impact than the hypothetical we have described, and I suspect we will see this scenario play out in our lifetimes,” said Sarge.

“I’m going to conclude this semester with a teaser for the companion course that will start in January,” said Sarge, changing the screen.




“For years, U.S. officials have dismissed the need for international negotiations and cooperation on cyberspace, but now appears to be in the process of collaborating with our allies to develop rules for the virtual world. The trend appears to be headed toward the creation of cyber policy, including establishing a threshold where a cyber attack constitutes an act of war. This trend reflects the growing sentiment that our domestic efforts to secure cyberspace are inadequate. We will study whether the impact on the U.S. economy is driving this change in the government’s approach,” said Sarge, bringing up the final slide for the day.



The collective grumbles in the background were lost on Sarge as he gathered his notes from the lectern. Sarge replaced the cap on his Mont Blanc pen and tucked it away in his shirt. An uneasy feeling of dread and foreboding hit him, casting his mind adrift.


Leave a Reply

Your email address will not be published. Required fields are marked *