[DRAFT] Cyber Weapons Security Act

[Araraukar]

OOC: This will be edited soon to be complementary rather than competing with the other proposal on the subject. We decided to specialize on different aspects of the issue rather than trying to merge two very different approaches.

Cyber Weapons Security Act

Category: International Security
Strength: Mild

The World Assembly,

Reaffirming the right of member states to own and use cyber weapons in times of war,

Concerned that member nations that heavily rely on computer systems in their everyday existence could be crippled by a mistargeted cyberattack on civilian computer systems,

Fearing that improperly secured cyberweapons may end up in the hands of terrorists, or that improperly handled cyberweapons may end up damaging unintended targets,

Hereby,

1. Defines a "cyber attack", for the purposes of this resolution, as any abusive action executed with a computer program, by either design or by accident against a computer system, without the approval of the owner of that system.

2. Defines a "cyber weapon" as a non-sapient computer program specifically designed to be used for a cyber attack,

3. Requires that member nations in possession of cyber weapons must

1. To the best of their ability secure the location where cyber weapons are stored when not in use, whether it is a physical location, computer network or other storage system,
2. Have a proper training program for safe handling of cyber weapons,
3. Refuse entrance of any person known to be a terrorist or known to having strong ties to any terrorist group, to the training program,
4. Restrict access to the cyber weapons to staff who have successfully completed the training program,

4. Recommends that member nations keep records of the cyber weapons in their possession, those who have access to them, and of any attempts, whether authorized or not, of erasing or activating a cyber weapon,

5. Permits treating a cyber attack against a military target as an act of war,

6. Forbids cyber attacks against civilian targets, such as hospitals or schools, that are protected from physical attacks by the rules of warfare or international agreements, even during a war,

7. Requires criminalization of cyber attacks.

Some Q&A to begin with...

1. Q: Didn't you try this before, only it was written by someone else?

A: You have a good memory! I wanted to resurrect the draft, given that someone had raised the topic again, but The Derpy Democratic Republic Of Herp didn't want to partake the drafting anymore, and gave me the permission to continue with it on my own. I have further changed the draft from what we had back then.

2. Q: What's with the "approval of the owner of that system"? Who would want their computer systems crashed?

A: Systems' defenses are often tested by the system's owner hiring someone to do their best to breach the defenses, so that if a breach occurs, it can be fixed, rather than the system turning out to be vulnerable only when the attacker is malicious.

3. Q: So what's with all those regulations? Do you really think that any nation with such weapons would let them spread indiscriminately?

A: I take it you haven't heard of Stuxnet? I don't think that 1.56% of Iranian nuclear weapons program was conducted in the USA...

4. Q: Why do you only permit treating a cyber attack against a military target as an act of war? Why not require it?

A: Aside from not wanting to dictate how people roleplay their war scenarios, if it was treated as an act of war in Real Life, USA, China and Russia would be engaged in a continuous war, with random smaller wars sparked all over the world as fallout from it.

5. Q: If the "don't attack hospitals or schools" thing is based on rules of warfare, why does it say "even during a war"?

A: Because it forbids them during peacetime as well. They just tend to be called terrorist attacks when it's not an act of war.

6. Q: So why only criminalize them? Why not declare them crimes against humanity, or war crimes?

A: Because there's no international court recognized by the WA, for handling such crimes, and because the definition of a cyber attack is fairly wide on purpose, criminalization is strong enough a requirement.

[Araraukar]

Reserved for drafts and changelog.

[Pan-Asiatic States]

"The Sixth Administration heartily supports this motion.", yawps Asian Representative Yahui-Molotov.

"We believe that the motion could even go further, to cite the use of cyberattacks as immoral and unfair as a convention of war. Data and information are casualties that trump even lives. Should a cyberattack on a massive, coordinated scale be conducted, a nation's technological and cultural artifacts could be obliterated."

[Araraukar]

"We believe that the motion could even go further, to cite the use of cyberattacks as immoral and unfair as a convention of war."

"The problem with that approach, ambassador, is that the current definition includes hacking into a web server to post naughty pictures on someone's personal website, and I hardly think such a thing should count as an act of war," Johan explained. "If you have suggestions on how to improve the definition, I'd like to hear them."

[Kenmoria]

“I’m not quite sure why ‘to the training program,’ appears at the end of clause 3c. Is it intended to mean that terrorists should be reprimanded in a cyberweapons training program? That would probably be a bad idea. Aside from that, we support.”

[Araraukar]

“I’m not quite sure why ‘to the training program,’ appears at the end of clause 3c.”

"Because it is a sentence, "Refuse entrance of any person known to be a terrorist or known to having strong ties to any terrorist group, to the training program", that is part of the list of things that cyber weapons possessing nations must do. If there is something grammatically wrong with it, I'd be happy if you pointed it out; the translators don't always get all the nuances right."

OOC: Is it the comma before the words? I remember how we weren't sure if it should be there or not.

[Kenmoria]

“I’m not quite sure why ‘to the training program,’ appears at the end of clause 3c.”

"Because it is a sentence, "Refuse entrance of any person known to be a terrorist or known to having strong ties to any terrorist group, to the training program", that is part of the list of things that cyber weapons possessing nations must do. If there is something grammatically wrong with it, I'd be happy if you pointed it out; the translators don't always get all the nuances right."

OOC: Is it the comma before the words? I remember how we weren't sure if it should be there or not.

(OOC: I may just be having a temporary brain malfunction, but I still can’t make sense of the clause. Taking it in isolation: “Requires that member nations in possession of cyber weapons must refuse entrance of any person known to be a terrorist or known to having strong ties to any terrorist group, to the training program,“ I can’t see where the last four words go or what is being referred to by it. What is going to the training program?)

[Bears Armed]

"Because it is a sentence, "Refuse entrance of any person known to be a terrorist or known to having strong ties to any terrorist group, to the training program", that is part of the list of things that cyber weapons possessing nations must do. If there is something grammatically wrong with it, I'd be happy if you pointed it out; the translators don't always get all the nuances right."

OOC: Is it the comma before the words? I remember how we weren't sure if it should be there or not.

(OOC: I may just be having a temporary brain malfunction, but I still can’t make sense of the clause. Taking it in isolation: “Requires that member nations in possession of cyber weapons must refuse entrance of any person known to be a terrorist or known to having strong ties to any terrorist group, to the training program,“ I can’t see where the last four words go or what is being referred to by it. What is going to the training program?)

OOC: I think that there should be a comma after the first "terrorist".
(Also, the "having" should be "have"...)

[Orion Posthuman Republic]

"As a nation with millions of synthetic citizens - myself included - cyberweapons are essentially on par to biological weapons as far as the Orion Posthuman Republic is concerned," Interim Ambassador Cato-5 Aldrin chimed in. "We absolutely support any efforts to ensure that this sort of armament is kept out of the hands of those who would use it for evil."

[Greater Cesnica]

Ambassador Slick McCooley takes the podium, sighing before speaking. "I do have several questions, but the following shall be of the greatest prominence- will this proposed draft interfere or otherwise render null the proposal 'Cyberweapons Control Act', drafted nearly a week prior, or can these proposals act in harmony with each other?"

OOC: viewtopic.php?f=9&t=450153

Also: https://www.nationstates.net/page=WA_pa ... /start=377 I believe this already drafted resolution somewhat covers the intentions of this proposal. I do like the record-keeping clauses entailed in your proposal.

[Sierra Lyricalia]

OOC: You can restructure the sentence for clarity:

Refuse admission to said training program to any person known to be a terrorist or to have strong ties to any terrorist group,

Ambassador Slick McCooley takes the podium, sighing before speaking. "I do have several questions, but the following shall be of the greatest prominence- will this proposed draft interfere or otherwise render null the proposal 'Cyberweapons Control Act', drafted nearly a week prior, or can these proposals act in harmony with each other?"...

OOC: It's considered poor taste to pimp your own draft in someone else's thread. If you'd like to take it to TGs with the author of this proposal, nothing is stopping you.

Also: https://www.nationstates.net/page=WA_pa ... /start=377 I believe this already drafted resolution somewhat covers the intentions of this proposal. I do like the record-keeping clauses entailed in your proposal.

OOC: I don't see any duplication worth mentioning between this draft and the passed resolution. I would like to see this draft's clause 7 modified to exempt cyberattacks conducted by states against other states during wartime (which the earlier resolution explicitly permits) - that would remove the only whiff of contradiction I perceive here.

[Araraukar]

OOC: You can restructure the sentence for clarity:

Refuse admission to said training program to any person known to be a terrorist or to have strong ties to any terrorist group,

OOC: I'll change that for draft #2.

drafted nearly a week prior

This was originally drafted nearly two years ago, so... But yeah, like I said before, TG me if you want to cooperate.

OOC: I would like to see this draft's clause 7 modified to exempt cyberattacks conducted by states against other states during wartime (which the earlier resolution explicitly permits) - that would remove the only whiff of contradiction I perceive here.

Do you think it would still be okay to prevent targeting of civilian targets (like the hospitals and schools mentioned)? They're forbidden to be targeted by physical weapons in most cases, even during a war.

[Sierra Lyricalia]

Do you think it would still be okay to prevent targeting of civilian targets (like the hospitals and schools mentioned)? They're forbidden to be targeted by physical weapons in most cases, even during a war.

OOC: Yes, that seems fine.

[Greater Cesnica]

Araraukar, sure, I'll telegram you

[Wallenburg]

Reaffirming the right of member states to own and use cyber weapons in times of war,

7. Requires criminalization of cyber attacks.

Which one is it going to be? Because you can't have both.

[Araraukar]

Reaffirming the right of member states to own and use cyber weapons in times of war,

7. Requires criminalization of cyber attacks.

Which one is it going to be? Because you can't have both.

OOC: It was meant to say that using them during peacetime on civilian targets should be a crime, just like if you lobbed a more conventional artillery shell at the target. I see that at some point I got my wires crossed...

---

OOC: I'm currently talking with Greater Cesnica behind the scenes about the possibility of combining our drafts into one proposal, so haven't yet made the 2nd draft. All feedback on any errors/problems not yet mentioned is still happily welcomed.

[Visionary Union]

WA Ambassador Tassy: "Pardon me Ambassador, but wouldn't clause 7# be better worded as 'Requires criminalization of cyber weapons during peace time?'. Also, assuming one is planning a pre-emptive offensive against a foriegn threatening power, would this resolution forbid them from using said cyber weapons"?

[Faltasia]

What if a cyber-weapon is simultaneously usable for defense against cyber-attacks? Would my nation still even required to store it away?

[Araraukar]

What if a cyber-weapon is simultaneously usable for defense against cyber-attacks? Would my nation still even required to store it away?

OOC: Replying OOCly because that doesn't look like an IC question. I'm not entirely certain how you'd use a cyberweapon as defined in this proposal for defence. And RP-wise I'm intrigued in how you could use one for defence under whatever common sense definition of a "cyberweapon". Do note that we're talking about basically more or less advanced computer viruses, not human-grade (or smarter) AIs.