Skip to main content
Author(s):
Nori Katagiri
Journal
Informa UK Limited
Abstract

I explore reasons why existing defense has failed to prevent cyber attacks on critical infrastructure. I study one of the least studied notions of cyberspace behavior known as target distinction. Drawn from customary international law, the principle posits that states should tell their wartime targets between combatants and noncombatants and use force only toward military objects. States should not target critical infrastructure, like gas pipelines, because to do so harms civilian populations who use it. I investigate four issues that keeps the principle from preventing attacks on critical infrastructure. The first is its inability to capture the networked nature of critical infrastructure beyond the simple dual-use (military and cyber) purposes. The second defect is the interpretive confusion that the principle generates over the rules of engagement. The third problem is the omission from its coverage of actors other than nation states. By design, the principle condones cyber attacks by nonstate actors on infrastructure, or by those whose linkage to state sponsors cannot be legally established. Finally, the principle is prone to fail when hackers lack proper understanding of what it does and does not allow. © 2023 Informa UK Limited, trading as Taylor & Francis Group.

Concluding remarks
The analysis showed that cyber attacks on critical infrastructure are a multi-causal phenomenon. In so doing, it treated four ‘enablers’ of such attacks as if they were exogenous to the principle of target distinction – that is, as though they were independent of the interactions between them. In reality, they are interactive. As such, solutions to the problem of distinction would require a systemic reform of the enterprise across the whole sectors of critical infrastructure. The increasing number of breaches into the infrastructure indicates that past efforts to reform the system have proven largely ineffective. As important as the need for legal definitions of key languages, the international community seems to have given up on making real efforts to generate a set of concrete languages in international law for the reasons stated above. In the meantime, existing principles of cyberspace behavior remain stripped of binding power, and knowledge of how one can avoid wrong targets spreads among hackers only slowly, if at all. The problem exacerbates one in which there is little motive for private hackers to make such distinctions, reinforcing the fact that actors will only make such distinctions if they believe the targets will when choosing how to respond. This means that not just the principle itself must be reframed but that the ‘regime’ of target distinction needs to be reinvigorated in its entirety. With the policy stalemate at the international level, what individual states have done is to turn to national policies to make their defense robust on their own while trying to appear in line with other countries internationally to respect the international rules. As a result, the national responses have been uncoordinated outside the international norm discourse. Worse, the national responses have been inadequate in many cases to deal with the fundamentally international nature of digital attacks. On top of this pessimistic note, the problems get harder to solve over time due to its snowball effect. Years of successful hacks on critical infrastructure have made hackers accustomed to violating all kinds of norms. Some hackers keep on attacking critical infrastructure because they make light of whether their actions would break the norms and whether they would be held accountable. Victims have grown numb to repeated offenses. ‘Compounding the problem, shareholders easily forgive and forget corporate cybersecurity negligence.’ (DefenseOne 2021) More hacking groups have joined the bandwagon, reducing the marginal costs of their transgressions. Ultimately, a vicious cycle emerges in which the number of hackers increases, the harder it becomes for victims to track them, making it even easier for more hackers to do so. The act of hitting critical infrastructure has become too common to sustain media attention after each breach, spreading the sense of hopelessness across the society.

Reference details

DOI
10.1080/13600869.2022.2164462
Resource type
Journal Article
Year of Publication
2023
ISSN Number
1360-0869
Publication Area
Cybersecurity and defense
Date Published
2023-01-10

How to cite this reference:

Katagiri, N. (2023). Hackers of critical infrastructure: expectations and limits of the principle of target distinction. Informa UK Limited. https://doi.org/10.1080/13600869.2022.2164462 (Original work published)