On this site, we’ve spent a fair bit of time arguing about whether the current military action in Libya was “authorized” (no), whether it therefore becomes unconstitutional (no), and whether it should be unconstitutional (maybe). Here’s a variant on the theme. Can the President order a cyber attack on a foreign power, despite the absence of a declared war, which results in property damage and could result in the loss of life, without consulting Congress? Does it matter if the attack must remain absolutely secret to succeed? And does it matter if, should the attack be traced to the United States, it could result in an all-out shooting war?
Admittedly, this doesn’t fall easily within the traditional definition of a “war.” But neither do targeted missile strikes. Some background first.
Really, you should read the linked article (and other takes on the same). But for your convenience, Stuxnet was an extremely sophisticated computer virus, released late in the last decade, indisputably designed to target centrifuges at Iranian nuclear facilities and to wear them out at an accelerated rate, thereby delaying Iran’s development of a nuclear warhead. The nature of the facilities targeted, and the virus’ method of transmission, mean that the virus must have been introduced by hand into the facility. And, further, it must have been designed based on extremely high-level information. The coders had to know, for example, the software used by the centrifuge control computers, the number of centrifuges, their operating frequency, and more. Suffice it to say, the developers required (and obtained) a level of information that could only have been gathered two means: (1) insider knowledge, or (2) concerted and successful espionage.
On this basis, and some other clues, we suspect (but nobody knows) that either the United States, Israel, or both developed Stuxnet, and deployed it with the goal of dealing an untraceable but severe tactical blow to Iran’s nuclear program. We also don’t know how well the program succeeded. So to get to an interesting hypothetical, we have to make some things up.
For the purposes of the below, let’s make four assumptions. First, assume that the United States deployed Stuxnet. Second, assume that the property damage was severe, even irreparable. Third, assume that, since we are talking about nuclear physics, the potential for loss of life was present, if not severe. Even if Stuxnet clearly doesn’t check that third box, it proves we’re not far from a world where a virus could do just that. Fourth, assume a nontrivial (but still small) risk of Iran tracing the virus back to the United States.
To summarize: on the assumed facts, for this hypothetical Stuxnet represents the targeted, state-sponsored neutralization of physical military assets under the control of a foreign power.
On these facts, I think using the virus to forestall the threat of a nuclear Iran, and the consequences that would entail, is not only a moral act, but an imperative. Even at the risk of explosions and possible death, neutralizing a real threat the national security of America and her allies, posed by an implacable foe, without any initial risk to American lives, is a net good by my conception of statesmanship. Although it risks war, Iran would not (and could not) fight on just this provocation. So, it’s essentially a costless tactical strike.
As I see it, such strikes, even without express or implied Congressional approval, are not just moral, but fall squarely within the President’s commander-in-chief power. Stuxnet’s deployment clearly doesn’t qualify as anything near to a “war,” and the need for both secrecy and immediacy implicates the Federalist concern for the Executive’s “Energy.” Like Libya, no American lives are immediately risked, so the War Powers Act does not plausibly apply. And, this is the type of project we’ve typically relegated to the role of espionage. Bullets have long been traded between American and foreign agents without a declaration of war, and only on the Executive Branch’s say-so. Because Stuxnet is closer to espionage than an actual war, it’s not the type of event that even raises a War Powers Resolution issue.
But why? Notice how outdated the significant criteria listed above start to sound. We’re coming close to the day when a full, all-out “war” could be started and won inside of a day, and all electronically. Presumably a series of Stuxnet-type viruses could, triggered at once, decimate an undeclared enemy nation’s power grid. On my analysis — unless scale or likely result somehow matter to the legal analysis — the President could take that action, which would actually commit us to a war, on his own. Shouldn’t that be problematic?
Notice, too, that the President’s power to deploy a Stuxnet-type weapon feels like an easier case than Libya, and an easier case, even, than deploying Predator drones. Again — why? How different from Libya is a theoretical state-sponsored Stuxnet attack, anyways? Is it the actual death of enemy combatants in Libya that changes the character of the conflict? Or is it that missile launches look more like a traditional “war” than computer attacks? Here, too, these distinctions are decreasingly meaningful in a world where we can theoretically cripple foreign military assets without ground invasion and, now, without ever even firing a shot.
The face of warfare has changed. To a lot of us, Libya feels like a real constitutional problem; but if Stuxnet-type viruses see widespread adoption as weapons of war, the problem is going to get much worse before it gets better. To head off the developing difficulty, we should start to design a model for limiting unilateral warfare based on those values that actually matter to us. For me, at least, that means focusing on two factors: (1) the loss of American lives and, (2) the risk of large-scale geopolitical commitment.
I don’t think we can read values like this into the constitution, unless we acknowledge the the constitutional commitment of the “war” power to the legislature works only so long as “war,” as it’s commonly known, is a perfect proxy for the kind of international conflicts we want to all agree upon before starting. But I don’t think that assumption holds water anymore. What can we do about that?