Recent events — namely the WannaCry ransomware attack and the most recent Petya ransomware attack — have again brought a sensitive subject to the forefront: cyberwar.

Many in the U.S. and the U.K. have come out and accused North Korea of being the nation-state that is behind both attacks, though little hard evidence has been provided to the public to support that acquisition for fear it may expose sources and methods.

However, all the media attention, interviews and comments have elevated the conversations on the complicated topic of what constitutes an act of cyberwar. Did WannaCry or Petya rise to the level of an act of cyberwar? If so, is a retaliatory cyberstrike in order or does it justify some use of conventional weapons?

While there are a few countries that have established their own definition of cyberwar, they have fallen short of defining what would be considered an act of cyberwar.

An interesting context for this discussion has come up publicly. Given the attacks that struck health care institutions in May, if a patient or patients died due to malware, would that rise to the level of an act of cyberwar? Based on recent research, a definition of a cyberwar crime does not exist online.

If the ransomware cyberattack was ordered by the leader of a nation-state, how would they be brought to justice? Could the leader of the country behind a cyberattack resulting in death have criminal changes brought against them? If so, would they be tried in the International Criminal Court? This new battlefront poses many questions.

Share:
More In Cyber