Conscription and cyber conflict: Legal issues

This paper examines legal issues that could arise from utilizing a civilian cyber defense corps to defend a nation-state and its assets from cyber attacks. We use Estonia's Cyber Defense League as an analytical device, and we examine issues that may arise under the CDL as it is currently configured and as it might be configured. Our analysis focuses on ten specific issues. We argue that the nature and inherent ambiguity of cyber war will require a reserve corps of IT specialists who can be conscripted if there is a substantial likelihood that a cyber attack will materially disrupt the public order. We also consider the practical and legal aspects of the criteria to be used to select conscripts and factors that will affect the duration of conscription. Of course, IT specialists do not work in isolation from the intellectual property and other IT assets owned by their private sector employers. The paper analyzes the issues raised by this symbiosis, including the risk that employers and other owners of assets will be treated as combatants by the cyber attacker, the potential legal issues created by the intellectual property rights of licensors, the potential unintended consequences affecting competition as conscripts defend a competitor of their private sector employer, and the privacy rights of third parties in data necessarily disclosed as part of defense activities. Finally, we consider whether the use of IT assets by conscripts entitles the asset-owners to compensation for the government's taking of their property and whether traditional notions of conscientious objection apply to cyber warfare.