Published by The Lawfare Institute
in Cooperation With
Many experts have said the launch of Stuxnet — the world’s first physically destructive cyberattack — opened Pandora’s box. “If you are in the glass house, you should not be the one initiating throwing rocks at each other,” Gregory Rattray, chief executive officer of Delta Risk, a security company, said at a recent conference. “We will have rocks come back at us.”I'm a bit of a skeptic when it comes to such arguments, both as to computer network operations and drones. Both state and non-state actors have ample reason to develop or acquire these technologies, and if they are otherwise motivated to use them I do not think that it will prove dispositive whether the US government first blazed the trail. The real impact of US trailblazing instead has to do with the possibility that (i) we are motivating specific actors to accelerate their R&D efforts in these areas; (ii) the actual deployment of our drones and code might provide technological shortcuts for adversaries who get their hands on them; and (iii) we might lose the ability to denounce other actors on legal or policy groundsd for using arguably comparable methods. Risk (ii) is a genuinely significant one. Risk (i) is potentially significant, but ultimately might be too hard to measure with real rigor. Risk (iii) is a staple of the drone strike debate, and a point that should always be kept in mind.