Jessica Smith
During a national crisis, executive action to reconfigure U.S. network data flows to the global Internet may be lawful.
Imagine if a U.S. president determined that an insurrection or a threat of war existed. Would President Lincoln’s actions in blockading Confederate ports enable a modern president to suppress insurrection by “blockading” portions of U.S. Internet connections? Assuming the executive determined a denial-of-access necessary for national security purposes — perhaps to prevent domestic adversaries from relaying communications to fellow in-state conspirators or to impede their ability to communicate with an affiliated foreign adversary — is such government action lawful?
Mothering or Smothering Internet Connections?
States that cordon off their citizenry’s access to the Internet, as observed by University of California, Davis law professor Anupam Chander, demonstrate that they “fear the Internet more than they rely upon it.” Within the past decade, the governments of Nepal (2005), Burma(2007), Egypt (2011), Libya (2011) and Syria (2012) imposed Internet service “blackouts” to quell insurrection. In 2015, Russia’s Ministry of Communications and Internet regulator, Roskomnadzor, tested a traffic control system “to find out whether it c[ould] cut the country off from the World Wide Web.”
And while a state-imposed denial-of-access may appear as an objective only of totalitarian regimes, the world, in December 2015, witnessed U.S. Republican presidential candidates debate closing portions of the Internet to counter ISIS. But what about state-imposed restrictions on local Internet connections? This article examines how executive power translates in cyberspace and assesses the president’s ability to reconfigure U.S. network data flows to the global Internet during a national crisis.
Translating Executive Power in Cyberspace
Under emergency conditions, the president can unilaterally respond to and repel sudden attacks on the United States, its territories, possessions, or armed forces. Pursuant to 50 U.S.C. § 1541 the president can “introduce United States Armed Forces into hostilities, or into situations where imminent involvement in hostilities is clearly indicated by the circumstances.” The president can also commit troops into battle or into areas where imminent hostilities are likely for sixty days without obtaining either a congressional declaration of war or mandate; however, the president can only extend this war powers privilege for thirty days for a maximum total of ninety days without congressional approval.
With regard to directing telecommunications, under the 1934 Communications Act, the executive may “suspend or amend the rules and regulations applicable to any or all facilities or stations for wire communication within the jurisdiction of the United States as prescribed by the Commission,” subject to temporal limitations. For wireless communications, Executive Order (EO) 13618 adds the Internet as a telecommunication system subject to the executive’s direction in a crisis. Based on these provisions, if a group of internal, domestic-based aggressors, as opposed to an external foreign non-state actor, launched a cyber attack against the United States’ critical infrastructure, how may the government respond?
Beware the Cyber Enemy Within
If the attack was an insurrection against the U.S. government, then under Article I, section 8 of the U.S. Constitution, Congress has the power “[t]o provide for calling forth the Militia to . . . suppress Insurrections and repel Invasions.” While Congress maintains the expressed power to protect the nation, the executive also wields influence here. Under Article II, section 3, the president “shall take Care that the Laws be faithfully executed.” During the American Civil War, President Abraham Lincoln construed this provision as granting the president the authority to suppress rebellion as chief enforcer of the laws. The U.S. State Department Office of the Historian describes President Lincoln’s blockade of Confederate ports from 1861 to 1865 as follows:
During the Civil War, Union forces established a blockade of Confederate ports designed to prevent the export of cotton and the smuggling of war materiel into the Confederacy. The blockade, although somewhat porous, was an important economic policy that successfully prevented Confederate access to weapons that the industrialized North could produce for itself. The U.S. Government successfully convinced foreign governments to view the blockade as a legitimate tool of war.
With respect to the executive’s authority to respond to domestic threats, the U.S. Supreme Court considered President Lincoln’s interpretation of Article II in the Prize Cases of 1863 and reasoned that “[t]he President was bound to meet [war], . . . without waiting for Congress to baptize it with a name.” The Court determined that the president was “empowered by legislation passed in 1795 and 1807 to put down an insurrection [or invasion] against the government. While . . . the president could not unilaterally initiate conflict against another state, the [sic] court ruled that Lincoln’s actions had not done this.” The Court upheld President Lincoln’s reasoning that it was within his power to suppress an insurrection against the government. The Court also ruled that President Lincoln “had a right, jure belli, to institute a blockade of [Confederate] ports in possession of the States in rebellion . . . .”
But does the Taney Court’s 1863 ruling still extend to the digital age of the twenty-first century? Could President Barack Obama invoke President Lincoln’s argument for instituting a blockade of ports in the Prize Cases by instituting an Internet “blockade” against domestic belligerents engaged in a cyber-led rebellion or insurrection against the government?
Following the ISIS terrorist attacks on Paris in November 2015, imagine if a U.S.-based affiliate of ISIS began an aggressive cyber insurrection against the United States. In fact, FBI Director James Comey acknowledged ISIS’s use of social media as a weapon for domestic recruitment: “ISIS has become adept at recruiting Muslim extremists into their organization, enabling them to obtain operatives that are already based in the countries they intend to target with their terrorism.” According to David von Drehle of TIME, ISIS “recruiters spend hundreds of hours in virtual communication with a single target, steadily tailoring the movement’s message to fit the individual. . . . For the disaffected loner in a European or American suburb, [the message] might be the fellowship of a movement of strong Muslims.”
Thus, to safeguard the homeland from an aggressive cyber insurrection waged by a U.S. affiliate of ISIS, the Prize Cases demonstrate that the President “is authorized to called out the militia and use the military and naval forces of the United States in case of invasion by foreign nations, and to suppress insurrection against the government of a State or of the United States.” While the modern U.S. Supreme Court has not considered this question, the Taney Court’s ruling, albeit decided 152 years ago, facially validates the executive’s ability to suppress a domestic insurrection by blockading (i.e., reconfiguring network data flows) of select American Internet connections to the global Internet.
Furthermore, the 2011 Cyber Policy Report addresses the president’s ability to respond to hostile acts in cyberspace. Hostile acts are “significant cyber attacks directed against the U.S. economy, government or military.” According to the report, the executive fully reserves the right to respond to hostile acts in cyberspace, and the DoD has “implemented rules of engagement for the operation and defense of its networks[]” that are premised on the law of war. Although the 2015 Cyber Strategy Report does not expressly address the War Powers Resolution, it promotes equipping the executive with a variety of options to strategically “shape the conflict environment at all stages.” While the situational facts ultimately guide the Act’s applicability, a reading of section 1541(c) coupled with the DoD reports indicates that the president has the authority to commit the military and its resources into any hostile environment.
Giving Democracy its Due Consideration
Subject to the temporal restrictions of the War Powers Act, the president determines how to respond to hostile cyber acts. While the law of war helps set the parameters for war fighting, in instances where there is no international consensus on what constitutes a “cyber attack,” not to mention the inherent attribution challenges in tracing the attack to its true origin, there are significant challenges to applying the law of war in cyberspace. Regardless of the domain in which a war is fought, the United States’ response will adhere to the Law of Armed Conflict and employ force as a “last resort.”
Thus, if the executive determines that a condition of war exists, a broad reading of the 1934 Communications Act, along with select EOs and the War Powers Act, validate executive action in reconfiguring U.S. network data flows to the global Internet and compelling private ISPs to suspend services. And although such executive action may be lawful under emergency circumstances, the implications of these tradeoffs must undergo serious due consideration for democracy to endure “where the cyber things are.”
Jessica Malekos Smith is a postdoctoral fellow with the Belfer Center's Cyber Security Project at the Harvard Kennedy School.
No comments:
Post a Comment