The Best Defense Is a Good Offense: Conducting Offensive Cyberoperations and the Law of Armed Conflict

The National Defense Authorization Act for Fiscal Year 2012 gave the Department of Defense the statutory authority to conduct offensive cyberoperations, subject to the Law ofArmed Conflict. Four major types of offensive cyberoperations include destroying data on a network or a system connected to a network, being an active member of a network and generating bogus traffic, clandestinely altering data in a database stored on a network and degrading or denying service on a network. Conducting these operations, as opposed to cyber exploitation, will require military planners to analyze potential actions through the lens ofthe Law of Armed Conflicts constraint elements of military necessity, proportionality, perfidy,distinction and neutrality. The use of a recognized analytical framework lends legitimacy to actions undertaken by the United States, and shows a continued commitment to recognized rules of international law. Utilizing the present parameters of the existing LOAC framework, parallellegal and historical analogies and reasonable interpretations and applications of those analogies, the United States should legitimately be able to conduct the four types of offensive cyber operations.