Woman: This call is now being recorded.
Brandon Dunlap: Did you get a notification?
Spencer Wilcox: Yeah, that this call is now being recorded. I consent.
Brandon: Wonderful. Well, you’d have to consent, because now there’s a log of you actually accepting the call after hearing that it is being recorded even though you initiated it.
Spencer: I guess an interpretation…
Brandon: All right, Spencer. Let’s talk about the differences between cyber warfare and cyber assault. It seems as though there is an awful lot of noise, every time you and I bring up the concept of counter attack, everybody seems to be waving the cyber war flag.
“What happens if it’s a nation state?”
Or, “This is the purview of the State Department and the Department of Defense.”
I think that we’ve firmly established that this is an issue of assault and we don’t care who it is that’s hitting us, right?
Spencer: That’s right. The big concern, I think, has always been that you might accidentally hit back a nation state. Therefore, could a company, for instance, create an act of war or essentially wage war upon a nation state?
The answer is, it depends on what country you live in. It also depends upon how you define cyber war.
If I’m a company in these here United States, which is really all I can speak to, then it’s my responsibility to protect and defend myself from an assault. In this case, I see an attack upon my network as nothing more than an assailant assaulting my company’s property or assaulting me. I liken it to being punched in the face over and over again.
Brandon: Or the analogue we have often invoked, that of the security guard.
Spencer: Right. Basically, if my company is being assaulted, if I am being assaulted, if I am personally being assaulted, it’s my responsibility to stop that assault because there are [inaudible 02:53] to law in the assault itself.
I have to stop it.
It’s not the government’s responsibility to stop it unless it ties to government. I can avail myself if I’m a private citizen or a company, of private security. Someone to witness the assault upon me and to take action against the assailant.
I can be my own private security.
I can secure myself.
I can defend myself.
The way I can defend myself differs. I can start with telling the assailant, “Don’t do that. Leave me alone,” and I can work my way all the way up to deadly force if necessary in self‑defense. What’s different about self‑defense and this concept of cyber war is attribution. Attribution, in cyber war terms, assumes that I have to know who it was in order to declare war upon him or to wage an act of war.
Brandon: Unless that’s the “war on terror”, but let’s pause there for just a second.
I want to touch on this point of attribution real quickly because this is a case of an unknown assailant or perhaps partially known or partially culpable third party assailant.
You are taking a self‑defensive action. This does not touch on any of the UN requirements for preemptive strike, self‑defense, or counter attack, such as in the case of an invasion (or imminent invasion). What we’re describing here is purely an assault, and how we’re treating this under the guise of US law, correct?
Spencer: It’s simple criminal activity. It’s no different from an assault, from a physical assault, upon my person.
Brandon: Or, upon property.
Spencer: Right. A burglary, for instance, or it may be even something as simple as vandalism.
The question is one of severity and immediacy.
The severity of the act or the attack, the assault, let’s say, is what really determines the level of the response or the strenuousness, I don’t know if that’s the right word, of the response.
Brandon: We’re talking about proportionality here, right?
Spencer: Yeah. The proportionality of the response.
If somebody is pounding me in the face with their fist, well, that’s bad. If they’re pounding me in the face with a baseball bat, that’s worse. Depending upon the severity of what they’re doing, I should respond in a way that’s proportional to the attack.
The second thing is, not only do I have to worry about proportionality, but I also have to respond immediately.
It can’t be that I wait until after the attack happens. I have to do something about it now while the attack is occurring. Otherwise it’s retaliation.
Brandon: You’re getting into almost vigilantism at that point as opposed to mitigation.
What you’re saying is stop the attack now, and how do I do that?
It might involve hitting them back. Just like we see in self‑defense courses, I’m in a dark parking lot headed to my car after work. Somebody tries to snatch my laptop bag. I resist. They start beating me up for it. I fight them back, and they run away. That would be an analogue or an equivalent to what we’re talking about.
Spencer: That’s exactly right. Let’s use that example. Somebody tries to steal your lap bag. You resist. You’d fight back after they assault you.
The question that has to be answered later on…because what you’ve done by hitting that person, by harming that person who was assaulting you, is still a crime.
It’s still a criminal offense. You’ve still assaulted them.
If you laid hands on them, you assaulted them. Even though you, in the act of defending yourself, believe you’re fully justified in doing it, the law says that you can’t do that.
What do you do about it?
Well, you’d take the act anyway because it’s necessary in order to defend yourself.
But what will happen is, if you were in fear and there was immediacy in the attack and your response is proportional, if all of those things happened, then generally speaking what will happen is you’ll either be found not guilty or no one will prosecute it. Then they’ll just simply say that the attack occurred that personal self‑defense was necessary. In other words…
Brandon: Hold on. Let me pause here because that’s a very important point: that it might not be prosecuted because it might be deemed self‑defense. Therefore, the prosecution would never take up the case. What you’re saying is if you hit me and I hit you back, technically we both assaulted each other.
Spencer: That’s right.
Brandon: Yet, if you hit me first, it might be possible, because it is immediate and I have responded proportionately, that I may be never prosecuted, and my case of criminal action against you might stand or civil action. But therefore, no civil action would be taken or criminal charges filed against me because no prosecutor would take the case; because I was obviously acting in self‑defense.
Spencer: But it wouldn’t be a civil act in that way. It would have to be criminal for a prosecutor to be involved. Yet, in a civil case, it would be up to the courts as to whether or not they would hear the case. Generally speaking, a court will take just about anything from a civil perspective.
Brandon: Let’s go back to that proportionality for just a moment. If I’m getting beaten up at a parking lot and I reach in my bag and pull out my mace, stun gun, something non‑lethal, and disable or thwart the attack, that is a move up the use‑of‑force continuum. That is, while perhaps not proportionate because I was not attacked with a weapon in kind, it is still deemed OK by necessity or immediacy to thwart the attack?
Spencer: Well, the way that would work is, let’s say that you escalate to use of force. You escalate as a person.
It’s going to depend upon the laws of the location in which you are.
Let’s say, for instance, you’re in a state that has banned certain chemical weapons, like pepper spray. There are a number of states who’ve said that pepper spray shouldn’t be used, or can’t be used, or can only be used in a certain concentration. Let’s say, for just a moment that you’ve decided to use the pepper spray anyway, because the person is punching you, and you don’t feel that you have the capability of defending yourself against them. They’re stronger than you, they’re bigger than you, they’re faster than you, whatever it is.
He’s wearing the black belt that he just earned in karate class, while he’s punching you out. You have made the determination that you’re unable to defend yourself without the assistance of some device, and you decide it’s pepper spray. Well then…
Spencer: Exactly. It’s going to be perfectly OK in most states. Some states may say, “No, no, no. Pepper spray is wrong any time, 100 percent of the time,” or, “You can never have a stun gun.” Does that alter the fact ‑‑ to answer your question with a question ‑‑ that you were acting in self‑defense?
Spencer: Why is that?
Brandon: Because I was still in fear for my life and/or property, and I used, in this case, technology or devices that were available to me, to stop or thwart the attack.
Spencer: Go ahead…
Brandon: The fact that I have carried an illegal weapon, shall we call this, into a jurisdiction where it is prohibited ‑‑ or a legal weapon in one jurisdiction, crossed it into another jurisdiction, it is illegal to own or possess ‑‑ is that in itself a consideration in the self‑defense case, and that could bring separate charges against me that are criminal, completely irrespective of the incident.
Spencer: Which is kind of, this is territory that you and I haven’t discussed before, but it just dawned on me.
What happens if I’m using something that is, in and of itself, illegal?
Brandon: Let’s not get into that rabbit hole just yet. There’s a number of places to go with that. Let’s stick with the fact that I have an assailant who is causing physical battery.
I am responding with augmented defense, we’ll call it. Now, does the scope change on when I bring that out?
Is that different if I have multiple assailants?
If I see three thugs coming after me and I reach for my pepper spray first, and they still attack, the pepper spray wasn’t, therefore, a deterrent. It was perhaps seen or brandished. They still attack, and I use it on them, is that still considered proportionate to the threat?
Spencer: Again, that’s when we get into the question on any kind of self‑defense.
We might have to start talking about things like, stand your ground, or castle doctrine.
The question there really is, were you in fear?
Was the potential assailant apparently capable of carrying out an assault?
Brandon: If I’m outnumbered, I would say immediately, yes.
Spencer: Well then, and the last piece is, in your opinion, was there a risk that that the person or persons were going to attack you?
Did you believe, in your heart of hearts, you were in danger right now?
If you can answer yes to those, then I would argue that certainly there’s a justification for a use of force, but it would be less‑than‑lethal force.
Now, let’s say that the three thugs, if you will, were carrying baseball bats, or tire irons. They’re coming towards you. They clearly have the ability to cause you harm, right?
Brandon: Absolutely, and we can probably infer intent…
Spencer: That’s right. You can state with some degree of certainty that they appear to intend harm to you, because they had tire irons, and there were three of them.
You could certainly state definitively that you were probably afraid for your life or for what they might do to you.
Would you be justified in using force against them? Absolutely.
Would you be justified in using an escalated force against them? Absolutely. Again, depending on the laws and depending on the jurisdiction.
You would probably be able to justify having taken an action, if there were ever some action taken against you. Most of the time, the bad guy doesn’t press charges.
Brandon: True, but let’s look at it from this perspective. If they’re coming at me with baseball bats or tire irons, and they’re threatening, “Give me your laptop bag or I’m going to beat the crap out of you,” is that different than them actually swinging?
Spencer: That is a good question. Again, they have the tire irons, so the ability is there.
Brandon: The ability is there, the proximity and the immediacy are met, but at this point it is merely a threat.
Spencer: I would argue you could certainly be justified in taking an act at that point simply because in some jurisdictions, the threat is, in and of itself, a simple assault.
Brandon: Wait a minute.
Spencer: Go ahead.
Brandon: The threat is imminent assault?
Spencer: Is, in and of itself, a simple assault.
Brandon: Really? The verbalization of, “Give me your bag or I’m going to beat you,” is actually assault, correct?
Spencer: Yeah. In some jurisdictions. Some jurisdictions.
Brandon: Certainly. We know this will vary by state, municipality, country, et cetera.
I know a lot of women, for example, that carry pepper spray on their key chain for when they walk out to their car at night, they’ve got it locked and loaded, so to speak. Now, of course, it’s a non‑lethal weapon, but is that anticipation of a potential threat or assault factored in at all when it comes down to being assaulted?
“I had my pepper spray in my hand, your Honor, and I was approached. I was already in fear by walking through a dark parking lot at night with high valuables in my bag, alone. Therefore, I was already at a heightened alert level, when I was attacked .”
Doesn’t that introduce some degree of premeditation? Or does that constitute just a heightened DEFCON status, so to speak?
Spencer: Again, a good lawyer could argue it either way.
I’m certainly no lawyer, but, fear is a relative thing.
It’s very subjective question.
I could be afraid of an eight‑year‑old child because, and I may believe the eight‑year‑old child has the ability to cause me harm. There was actually a recent case about that, and I can’t recall where exactly this was, but the school security officer arrested a first grader who was hitting him, for assault.
The first grader couldn’t harm him. She wasn’t doing significant damage, but the first grader was hitting him, so he arrested her.
Does that demonstrate good judgment on the officer’s part? That’s arguable. But certainly, all of the criteria were there to constitute that assault. The officer had some reason to fear, the officer was assaulted. In this case, the officer took an action.
You could make the same case for anyone who is afraid of an act that’s imminent. It’s that immediacy, again.
The person seemed to be capable, the potential victim, the person who’s got the pepper spray believes that he or she is in jeopardy.
As a result, they take an action when approached.
It’s justifiable to take that act.
Brandon: In everything we’ve discussed so far, no mention of specific UN articles, Congressional declaration of war, etc. comes into play.
We’re talking purely about assault.
But, it could be applied, to some degree, to international incidents. But this is really a civilian action of self‑defense, and a civilian acting as an individual, as an agent of another organization.
Spencer: Well, let’s use some specific terms here.
It is a private citizen defending his or herself against an assault?
That private citizen, in this case, is any individual who is a citizen of the country. But private citizens also include companies, corporations.
A corporation is a person, it’s an individual.
The law says so.
Why would we treat a corporation defending itself differently than we would an individual defending themselves?
Brandon: Well, to some degree, you’re going to have some degree of liability for the individual who is acting as the agent for his company.
And that company may decide to disavow or argue, perhaps, that individual acted without authorization.
At some point, you have an agency of the organization argument that needs to be made, that they weres acting on behalf of the corporate entity.
Take this back to the individual, I am defending my family, as a responsibility.
Spencer Wilcox: You could go there, or you could simply say, the person who is acting on behalf of the company is a hired guard.
Brandon: In the case of a security guard force.
Spencer: That’s right.
Or of a network defender working on behalf of his company.
But could we save that for our next conversation?
Brandon: No, no. I think that’s fine.
I think we’ve covered a lot of ground already with regards to framing the concept against the analogue between a physical use of force versus a network use of force.
I think we’ve made good progress.
I understand you need to go.
I need to get this recording checked out and see if it actually can be transcribed, otherwise we have to repeat ourselves.
Spencer: I very much enjoyed the conversation, and I’m looking forward to more of them.
Brandon: Well, let’s keep doing this.
Spencer: All right, my friend.
Brandon: I’ll talk to you soon.
Spencer: Take care.
Brandon: See you soon in DC for Suits and Spooks.