[Draft] Repeal Digital Network Defense

[Cresenthia]

Recognizing the good efforts of the World Assembly to secure digital devices,

Further more pleased by the restrictions placed upon governments to keep said devices secure,

But concerned that the term “cyberattack” is to be “any act of unlawful access to or alteration of numerical information stored on digital devices” actions so diverse as editing one’s own digital shopping list, and unauthorized access to a government network.

Further concerned that “cyberattacks” must be considered “acts of violence” and mandates that “individuals committing cyberattacks be prosecuted to the fullest extent of the law,” which may be well out of proportion to the actual offense, and regardless of the actual offense, may vary wildly between member states.

Also faulting the resolution for terms such as “digital security threats” and “unlawful access to or alteration of numerical information” that are not defined, and may be interpreted by member governments in inconsistent and damaging ways.

Perturbed by the proposition that this resolution may hinder or discourage further advances in the field of information technology, for fear for violating the resolution.

Believing that this resolution is misguided, and damaging,

Hereby repeals GA Resolution #378: Digital Network Defense.

[Calladan]

Recognizing the good efforts of the World Assembly to secure digital devices,

Further more pleased by the restrictions placed upon governments to keep said devices secure,

But concerned that the term “cyberattack” is to be “any act of unlawful access to or alteration of numerical information stored on digital devices” actions so diverse as editing one’s own digital shopping list, and unauthorized access to a government network.

Further concerned that “cyberattacks” must be considered “acts of violence” and mandates that “individuals committing cyberattacks be prosecuted to the fullest extent of the law,” which may be well out of proportion to the actual offense, and regardless of the actual offense, may vary wildly between member states.

Also faulting the resolution for terms such as “digital security threats” and “unlawful access to or alteration of numerical information” that are not defined, and may be interpreted by member governments in inconsistent and damaging ways.

Perturbed by the proposition that this resolution may hinder or discourage further advances in the field of information technology, for fear for violating the resolution.

Believing that this resolution is misguided, and damaging,

Hereby repeals GA Resolution #378: Digital Network Defense.

While I accept the general idea, I would point out that - depending what you hack into and change in any given network, you can do a lot of damage, either to one person or to a whole bunch of people.

If you change someone's medical record to remove an allergy to penicillin, for example, then the next time that person gets treated they could EASILY be killed by the doctors through no fault of either the person or the medical staff treating them.

So I don't think that "acts of violence" is too excessive a description in some cases, given that changing even a small bit of information about someone's life can have massive, sometimes fatal consequences.

[Cresenthia]

Recognizing the good efforts of the World Assembly to secure digital devices,

Further more pleased by the restrictions placed upon governments to keep said devices secure,

But concerned that the term “cyberattack” is to be “any act of unlawful access to or alteration of numerical information stored on digital devices” actions so diverse as editing one’s own digital shopping list, and unauthorized access to a government network.

Further concerned that “cyberattacks” must be considered “acts of violence” and mandates that “individuals committing cyberattacks be prosecuted to the fullest extent of the law,” which may be well out of proportion to the actual offense, and regardless of the actual offense, may vary wildly between member states.

Also faulting the resolution for terms such as “digital security threats” and “unlawful access to or alteration of numerical information” that are not defined, and may be interpreted by member governments in inconsistent and damaging ways.

Perturbed by the proposition that this resolution may hinder or discourage further advances in the field of information technology, for fear for violating the resolution.

Believing that this resolution is misguided, and damaging,

Hereby repeals GA Resolution #378: Digital Network Defense.

While I accept the general idea, I would point out that - depending what you hack into and change in any given network, you can do a lot of damage, either to one person or to a whole bunch of people.

If you change someone's medical record to remove an allergy to penicillin, for example, then the next time that person gets treated they could EASILY be killed by the doctors through no fault of either the person or the medical staff treating them.

So I don't think that "acts of violence" is too excessive a description in some cases, given that changing even a small bit of information about someone's life can have massive, sometimes fatal consequences.

I agree that it is certainly possible to do damage by gaining unauthorized access to data. However, stealing someone's credit card would probably not be considered an act of violence, albeit it is criminal. My main point is that all cyberattacks must be considered violent under DND, despite what the cyber attack actually is.

[Calladan]

While I accept the general idea, I would point out that - depending what you hack into and change in any given network, you can do a lot of damage, either to one person or to a whole bunch of people.

If you change someone's medical record to remove an allergy to penicillin, for example, then the next time that person gets treated they could EASILY be killed by the doctors through no fault of either the person or the medical staff treating them.

So I don't think that "acts of violence" is too excessive a description in some cases, given that changing even a small bit of information about someone's life can have massive, sometimes fatal consequences.

I agree that it is certainly possible to do damage by gaining unauthorized access to data. However, stealing someone's credit card would probably not be considered an act of violence, albeit it is criminal. My main point is that all cyberattacks must be considered violent under DND, despite what the cyber attack actually is.

Well - I could post some philosophical nonsense about violence against the soul and emotional violence against each other, but since I am not my mother, I won't.

But do you have a suggestion as to what could replace this? Something that would do more or less what the current one does, even if it does it in a more balanced and logical manner than the current one? (A stiletto rather than a hammer?)

[Separatist Peoples]

But concerned that the term “cyberattack” is to be “any act of unlawful access to or alteration of numerical information stored on digital devices” actions so diverse as editing one’s own digital shopping list, and unauthorized access to a government network.

"If editing one's own digital shopping list is a crime, why shouldn't people be prosecuted for it? It would be a stupid law, but it would, nonetheless, be illegal to engage in. Your example is poor."

Further concerned that “cyberattacks” must be considered “acts of violence” and mandates that “individuals committing cyberattacks be prosecuted to the fullest extent of the law,” which may be well out of proportion to the actual offense, and regardless of the actual offense, may vary wildly between member states.

"While there are plenty of reasons to be upset with placing cyberattacks on par with physical assault, this is the worst of them. Prosecuting somebody to the fullest extend means that the state brings all possible, applicable charges against the perpetrator. It does not mean you slap them in jail for as long as you can get away with, as that would be "sentencing to the fullest extent of the law". You have a fundamental misunderstanding of the phrase."

Also faulting the resolution for terms such as “digital security threats” and “unlawful access to or alteration of numerical information” that are not defined, and may be interpreted by member governments in inconsistent and damaging ways.

"Digital security threats are threats to the security of digital devices. Unlawful access or alteration of numerical information is the alteration of information, which is numerical, that is illegal. These terms do not require definitions any more than "prosecution to the fullest extent of the law" requires a definition."

Perturbed by the proposition that this resolution may hinder or discourage further advances in the field of information technology, for fear for violating the resolution.

"That's...okay, that's a fair argument.

"It isn't a bad proposal, but you have a couple fatal flaws you should address, ambassador."

[Bears Armed]

"Prosecuting somebody to the fullest extend means that the state brings all possible, applicable charges against the perpetrator. It does not mean you slap them in jail for as long as you can get away with, as that would be "sentencing to the fullest extent of the law". You have a fundamental misunderstanding of the phrase."

"Or, maybeso, a temporary confusion between the terms 'prosecuting' and 'persecuting'?"


Artorrios o SouthWoods,
ChairBear, Bears Armed Mission at the World Assembly.

[Cresenthia]

I agree that it is certainly possible to do damage by gaining unauthorized access to data. However, stealing someone's credit card would probably not be considered an act of violence, albeit it is criminal. My main point is that all cyberattacks must be considered violent under DND, despite what the cyber attack actually is.

Well - I could post some philosophical nonsense about violence against the soul and emotional violence against each other, but since I am not my mother, I won't.

But do you have a suggestion as to what could replace this? Something that would do more or less what the current one does, even if it does it in a more balanced and logical manner than the current one? (A stiletto rather than a hammer?)

The number one difference would be in the definition of cyberattack, and it would be changed in all likelihood to simply unauthorized access. The definition of digital device would also be changed, but to just what, I'm not sure of as of now.

But concerned that the term “cyberattack” is to be “any act of unlawful access to or alteration of numerical information stored on digital devices” actions so diverse as editing one’s own digital shopping list, and unauthorized access to a government network.

"If editing one's own digital shopping list is a crime, why shouldn't people be prosecuted for it? It would be a stupid law, but it would, nonetheless, be illegal to engage in. Your example is poor."

Because why would the WA want to be known for helping prosecute people for such frivolous crimes? Do you have a better example?

Also faulting the resolution for terms such as “digital security threats” and “unlawful access to or alteration of numerical information” that are not defined, and may be interpreted by member governments in inconsistent and damaging ways.

"Digital security threats are threats to the security of digital devices. Unlawful access or alteration of numerical information is the alteration of information, which is numerical, that is illegal. These terms do not require definitions any more than "prosecution to the fullest extent of the law" requires a definition."

Here I'm mostly picking an issue with the phrasing of the resolution, as depending on how you read it, it can be mildly ambiguous. Depending on your reading, it could be interpreted as any alteration of numerical information is forbidden, which, I hope, is not what the author of this resolution intended.

[Separatist Peoples]

Because why would the WA want to be known for helping prosecute people for such frivolous crimes? Do you have a better example?

"Upsetting the rule of law should be avoided unless absolutely necessary, because it breeds instability. Occasionally, this is justified. Mostly, it is not, and serves as an unnecessary intrusion. Making it illegal to change one's digital shopping list is undeniably frivolous, but the underlying principal of the law and the relation that the example has to it deals with illegal digital access. The issue is not that the list was changed, it was that, in order to change it, an individual violated a digital security protocol's integrity, and the state - and the WA as it happens - has a vested interest in reducing that activity. Neither should be barred from enforcing standards that improve the security of digital networks as a whole. You might benefit from stating that the strict conditions that this law requires can lead to disproportionate responses, but a violation of the integrity of any digital system, regardless of how minor, is worthy of being discouraged."

Here I'm mostly picking an issue with the phrasing of the resolution, as depending on how you read it, it can be mildly ambiguous. Depending on your reading, it could be interpreted as any alteration of numerical information is forbidden, which, I hope, is not what the author of this resolution intended.

"Such an interpretation would be contrary to any state's goals of being able to actually use a digital system. Unless nations are looking for another excuse to ban the use of computers, an endeavor already totally legal, no state will reasonably rely on that interpretation. You would benefit from changing this argument to suggest that the wording is awkward, but suggesting an absurd interpretation as common among nations is too easy to rebut to justify keeping."

"Prosecuting somebody to the fullest extend means that the state brings all possible, applicable charges against the perpetrator. It does not mean you slap them in jail for as long as you can get away with, as that would be "sentencing to the fullest extent of the law". You have a fundamental misunderstanding of the phrase."

"Or, maybeso, a temporary confusion between the terms 'prosecuting' and 'persecuting'?"


Artorrios o SouthWoods,
ChairBear, Bears Armed Mission at the World Assembly.

"Mayhaps that was the case, but, in contravention of Poe's Law, I'm going to ascribe "malice"* before ignorance, seeing as we're all professionals."

* Where malice more accurately means intention rather than actual malicious inclusion

[Cresenthia]

Here I'm mostly picking an issue with the phrasing of the resolution, as depending on how you read it, it can be mildly ambiguous. Depending on your reading, it could be interpreted as any alteration of numerical information is forbidden, which, I hope, is not what the author of this resolution intended.

"Such an interpretation would be contrary to any state's goals of being able to actually use a digital system. Unless nations are looking for another excuse to ban the use of computers, an endeavor already totally legal, no state will reasonably rely on that interpretation. You would benefit from changing this argument to suggest that the wording is awkward, but suggesting an absurd interpretation as common among nations is too easy to rebut to justify keeping."

Out of curiosity, which resolution permits governments to ban the usage of computers, or is there nothing on that subject?

[Separatist Peoples]

"Such an interpretation would be contrary to any state's goals of being able to actually use a digital system. Unless nations are looking for another excuse to ban the use of computers, an endeavor already totally legal, no state will reasonably rely on that interpretation. You would benefit from changing this argument to suggest that the wording is awkward, but suggesting an absurd interpretation as common among nations is too easy to rebut to justify keeping."

Out of curiosity, which resolution permits governments to ban the usage of computers, or is there nothing on that subject?

"There isn't any explicit law on the subject, and we all know what the mice do when the cat is away."

[Cresenthia]

Out of curiosity, which resolution permits governments to ban the usage of computers, or is there nothing on that subject?

"There isn't any explicit law on the subject, and we all know what the mice do when the cat is away."

"Then perhaps I'll include some language on the matter in a replacement, if I get this repeal passed. Does anyone see any posssible issues with legality?"

[Calladan]

This isn't so much legality as interpretation.

“any act of unlawful access to or alteration of numerical information stored on digital devices”

From the text of the repeal, it would appear that you are only applying the word "unlawful" to the "access" part of the clause, whereas I would have thought it applied to all of it :-

"any act of unlawful access to or unlawful alteration of numerical information stored on digital devices"

If this is the interpretation that applies, then your example of changing your shopping list doesn't hold water any more - it would only be if someone changed it without your permission by hacking in to your phone/tablet/etc to do it.

Of course, the fact that it can be looked at both ways is probably a sign of REALLY badly written clause - one that should almost certainly be looked at again - but I just thought I would mention it, since it does seem to be the foundation of your repeal (to some degree).

Also - to get back to the "acts of violence" thing, the fact that we are required to prosecute to the fullest extent of the law doesn't really stand up as a reason to repeal it.

In Calladan we have various punishments for "acts of violence" depending on the violence in question. If you hit someone, it's considered a very mild act and (this is just an example, not an exact explanation of Calladan's legal system) generally you get a fine. But if you hit someone with an iron bar, you get a more severe punishment (such as going to jail for a little while). And if you hit someone with a car...... well - you get the idea.

As such, we rate "digital violence" on similar scales. Minor acts are treated as minor acts and prosecuted as such - to the full extent of the law, which does not extend very far. But for major acts the law extends a great deal further.

Now the fact that different nations might do this differently is not really a concern of my government. A lot of nations will have the death penalty, while Calladan abolished that at the start of the DE. A lot of nations have severe punishments for not worshipping their deities, while Calladan finds that crazy and insane. And a lot of nations have severe punishments for not going to the pub on a Saturday night, while on Calladan we only put you in jail if you don't go on a Friday night - Saturday night you can do what you want.

Yes - it does mean some nations might execute people for hacking. But - quite honestly - the government of Calladan finds executing people for murder, mass murder and genocide offensive, so the fact people might get put to death for hacking is neither here not there.

(Again - this is not so much legality as presenting my opinion. Because, after reviewing the reasons for repeal, me and my Tri-Arch can not find any compelling reasons to support it. Sorry)

[Separatist Peoples]

This isn't so much legality as interpretation.

“any act of unlawful access to or alteration of numerical information stored on digital devices”

From the text of the repeal, it would appear that you are only applying the word "unlawful" to the "access" part of the clause, whereas I would have thought it applied to all of it :-

"any act of unlawful access to or unlawful alteration of numerical information stored on digital devices"

If this is the interpretation that applies, then your example of changing your shopping list doesn't hold water any more - it would only be if someone changed it without your permission by hacking in to your phone/tablet/etc to do it.

Of course, the fact that it can be looked at both ways is probably a sign of REALLY badly written clause - one that should almost certainly be looked at again - but I just thought I would mention it, since it does seem to be the foundation of your repeal (to some degree).

"I agree, the argument can absolutely be made that the clause is written poorly. I, at least, am neither disputing nor agreeing with that. It's how the argument approaches the issue that gives you problems. At worst, that could signify an Honest Mistake violation, because it assumes an interpretation at odds with the accepted interpretation.

"I grant you that the current application of the Honest Mistake rule generally requires that an interpretation be valid, not necessarily accepted, but this particular interpretation is particularly tenuous. The context clearly supports 'unlawful' modifying the following two actions, because the assumption that lawful alteration is banned is not only unreasonable, it's nonsensical."

[States of Glory WA Office]

"Mayhaps that was the case, but, in contravention of Poe's Law, I'm going to ascribe "malice"* before ignorance, seeing as we're all professionals."

OOC: You're mixing up Poe's Law with Hanlon's razor. Poe's Law is about how difficult it can be to tell genuine extremism from parodies of extremism.

[Separatist Peoples]

"Mayhaps that was the case, but, in contravention of Poe's Law, I'm going to ascribe "malice"* before ignorance, seeing as we're all professionals."

OOC: You're mixing up Poe's Law with Hanlon's razor. Poe's Law is about how difficult it can be to tell genuine extremism from parodies of extremism.

OOC: Bell doesn't spend a ton of time on the internet. That was a deliberate mistake on my part, though accidental on his.

[Kryozerkia]

Just a couple of observations.

(a) Your interpretation of: ""cyberattack" as any act of unlawful access to or alteration of numerical information stored on digital devices. For the purposes of cooperation with other WA legislation, such acts are to be considered acts of violence.". The 'unlawful' element applies to both "access" and "alternation". Your examples could be seen as an honest mistake or deliberate misinterpretation.

(b) You may also want to review the resolution your repeal is targeting. You say it mandates that cyberattacks be treated as "acts of violence" but GAR#378 does mandate that they be considered "criminal offenses". Not all crimes are violent.

[Excidium Planetis]

(b) You may also want to review the resolution your repeal is targeting. You say it mandates that cyberattacks be treated as "acts of violence" but GAR#378 does mandate that they be considered "criminal offenses". Not all crimes are violent.

OOC:
Actually, GA#378 does say that for the purposes of cooperation with other WA resolutions, cyber attacks are to be considered acts of violence. That doesn't necessarily mean that they be punished as acts of violence, however.

(The purpose of this was to allow some kinds of cyberattacks to fall under the definition of terrorism in GA#25, which specifies that use of violence is terrorism.)

[Europe and Oceania]

We support this.

[Kryozerkia]

(b) You may also want to review the resolution your repeal is targeting. You say it mandates that cyberattacks be treated as "acts of violence" but GAR#378 does mandate that they be considered "criminal offenses". Not all crimes are violent.

OOC:
Actually, GA#378 does say that for the purposes of cooperation with other WA resolutions, cyber attacks are to be considered acts of violence. That doesn't necessarily mean that they be punished as acts of violence, however.

(The purpose of this was to allow some kinds of cyberattacks to fall under the definition of terrorism in GA#25, which specifies that use of violence is terrorism.)

Why did my brain shut down on reading that line?