Oona A. Hathaway

The Law of Cyber-Attack

Cyber-attacks have become increasingly common in recent years. Capable of shutting down nuclear centrifuges, air defense systems, and electrical grids, cyber-attacks pose a serious threat to national security. As a result, some have suggested that cyber-attacks should be treated as acts of war. Yet the attacks look little like the armed attacks that the law of war has traditionally regulated. This Article examines how existing law may be applied — and adapted and amended — to meet the distinctive challenge posed by cyber-attacks. It begins by clarifying what cyber-attacks are and how they already are regulated by existing bodies of law, including the law of war, international treaties, and domestic criminal law. This review makes clear that existing law effectively addresses only a small fraction of potential cyber-attacks. The law of war, for example, provides a useful framework for only the very small number of cyber-attacks that amount to an armed attack or that take place in the context of an ongoing armed conflict. This Article concludes that a new, comprehensive legal framework at both the domestic and international levels is needed to more effectively address cyber-attacks. The United States could strengthen its domestic law by giving domestic criminal laws addressing cyber-attacks extra-territorial effect and by adopting limited, internationally permissible countermeasures to combat cyber-attacks that do not rise to the level of armed attacks or that do not take place during an ongoing armed conflict. Yet the challenge cannot be met by domestic reforms alone. International cooperation will be essential to a truly effective legal response. New international efforts to regulate cyber-attacks must begin with agreement on the problem — which means agreement on the definition of cyber-attack, cyber-crime, and cyber-warfare. This would form the foundation for greater international cooperation on information sharing, evidence collection, and criminal prosecution of those involved in cyber-attacks — in short, for a new international law of cyber-attack.

Treaties' End: The Past, Present, and Future of International Lawmaking in the United States

Nearly every international agreement that is made through the Treaty Clause should be approved by both houses of Congress as a congressional-executive agreement instead. In making this case, this Article examines U.S. international lawmaking through empirical, comparative, historical, and policy lenses. U.S. international lawmaking is currently haphazardly carved up between two tracks of international lawmaking, with some areas assigned to the Treaty Clause route, others to the congressional-executive agreement route, and many uncomfortably straddling the two. Moreover, the process for making international law that is outlined in the U.S. Constitution is close to unique in cross-national perspective. To explain how the United States came to have such a haphazard and unusual system, this Article traces the history of U.S. international lawmaking back to the Founding. The rules and patterns of practice that now govern were developed in response to specific contingent events that for the most part have little or no continuing significance. The Treaty Clause process is demonstrably inferior to the congressional-executive agreement process as a matter of public policy on nearly all crucial dimensions: ease of use, democratic legitimacy, and strength of the international legal commitments that are created. Thus, this Article concludes by charting a course toward ending the Treaty Clause for all but a handful of international agreements. By gradually replacing most Article II treaties with ex post congressional-executive agreements, policymakers can make Americas domestic engagement with international law more sensible, effective, and democratic.international law more sensible, more effective, and more democratic.