Embed Size (px)
Citation preview
1
Cybersecurity and International Law: A Hybrid Proposal to Place Partial Cyberspace
Security Responsibility on Private Infrastructure Providers While Extending the Special
Maritime and Territorial Jurisdiction to Cyberspace
“A hacker needs no passport and passes no checkpoints”1
Bruce Villard
University of Maryland Carey School of Law
May 2012
I. Introduction
Recent incidents involving cross-border intrusions into the Estonian and American
computer systems and corporate entities have brought the nexus of international and
cybersecurity law into the focus of many legal scholars and policy-makers.2 Over a three-week
period in 2007, and shortly after Estonia moved a Russian war memorial away from the center of
Tallinn (Estonia’s capital), Estonian government, banking, health, university, and other computer
systems were overwhelmed by a denial of service attack, specifically “increasingly larger waves
of data requests, rendering them inaccessible for long periods of time.”3
Corporations and government agencies in the United States are also, of course, vulnerable
to cyber attacks, notably from China,4 which has developed specially-trained military units to
mount such attacks.5 But, the Chinese government is not the only state to funnel resources into
preparing to mount offensive cyber attacks. Research performed by the United States’
Government Accounting Office indicates that at least 120 countries are developing or have
already developed such capabilities6 and the U.S. itself attempted to make use of such
capabilities during the Kosovo conflict.7
Given the physical infrastructure risks as well as those denial-of-service attacks, a more
thorough means of dissuading such activity through active prosecution needs to be developed.
The U.S. has noted that laws and international collaboration on cybersecurity issues are not
2
keeping up with technology despite treaties such as the Council of Europe’s Convention on
Cybercrime and various actions taken by the United Nations,8 and one way to address this
problem is with a hybrid solution of incorporating the special maritime and territorial jurisdiction
into the Convention on Cybercrime and placing some burden on private entities to maintain
appropriate levels of security against cyber attacks. After reviewing the existing legal structure
to address cyber attacks and its drawbacks, multiple solutions will be reviewed and analyzed,
including the hybrid private entity burden - special maritime jurisdiction solution.
The events described supra9 illustrate how attacks can damage data, and are often
referred to as “Computer Network Attacks” or “CNAs.”10
Persons who initiate CNAs intend not
only to cause disruption and denial of services (as seen in the cyber attack on Estonian computer
systems), but also actually destroy information in computers and networks themselves.11
Cyber
attacks, in some ways are an improvement over bombs and missiles in that cyber attacks can
cause similar harm12
and do it without actually engaging an adversary in the traditional vision of
a physical conflict.13
Specifically, cyber attacks can physically damage to infrastructure
elements such public water and electric utilities by using a discrete cyber attack to remotely open
a dam, cause a nuclear plant meltdown, or rupture an oil pipeline14
– just like a bomb or a
missile.15
The fact that potential damage can occur to critical infrastructure, as well as data, in
the private and public sectors, points to the need that “we must work towards building the rule of
law, to prevent the risks of logging on from outweighing its benefits.”16
If the proposed solution
is implemented in the future, it should further the work toward building this rule of law.
3
II. International Law Review
While international law is generally based upon the agreement of multiple countries,
there is a blurry line between actions that fall under the auspices of international criminal law
and those that fall under the laws of war or the use of force.17
This section will discuss both, and
will place some focus on jurisdiction and customary law as they play the biggest roles in
cyberspace adjudication. In general, however, international law is that which is either a)
accepted as customary law; b) is agreed to by international treaty or convention; or c) is derived
from common legal principles.18
A. The Law Armed Conflict and Its Application to Cyberspace
i. The Law of Armed Conflict
The Law of Armed Conflict (“LOAC”) is derived principally from United Nations
Charter Articles 2(4)19
and 51,20
as well as the seminal cases of Corfu Channel21
and Military
and Paramilitary Activities In and Against Nicaragua.22
With two exceptions, the U.N. Charter
states that members need to refrain from the using force.23
These exceptions, known as the right-
to-war or jus ad bellum, are 1) when the U.N. Security Council authorizes the use of force
pursuant to U.N. Charter Article 42,24
and 2) individual or collective self-defense under U.N.
Charter Article 51.25
Self-defense can only be used when there is an armed attack26
- the definition of which
engenders considerable tension. Traditionally, an “armed attack” meant that a party used
conventional weapons – not cyber – to attack an adversary.27
However, the International Court
of Justice (“I.C.J.”) has found that Articles (2)4 and 51 apply to the use of cyber, chemical,
biological and similar forms of aggression – the I.C.J. found the type of weapon used to be
irrelevant to its determination of what constituted an “armed attack.”28
Put another way, while
4
the original definition of an “armed attack” focused on the use of kinetic weapons, the standard
changed to a results-oriented approach and instead focused on the effects on life and property.29
Especially noteworthy in the context of cybersecurity is that U.N. Charter Article 2(4)
only applies to States and not to non-state actors.30
Terrorist attacks, for example, are prosecuted
under criminal statutes instead of the laws of armed conflict even when a foreign national
attacker stated that they were waging war against the state they attacked.”31
The distinctions between legitimate use of force in a self-defense contact and what
actions cannot be considered self-defense can be seen in the Corfu Channel32
and Military and
Paramilitary Activities In and Against Nicaragua 33
cases. In Corfu Channel, the Albanian
military fired on two British warships, which were passing through the Corfu Channel off the
coast of Albania in May 1946.34
The British warships were ostensibly asserting their right of
free passage and also wanted to test the Albanian response.35
In October 1946, the British Navy
sent four more ships through the channel and two of the ships struck mines.36
The Royal Navy
commenced mine-clearing operations in November 1946.37
The I.C.J. declared that while the
U.K. violated international law by sending armed ships into Albanian waters to remove mines,
the I.C.J. did not expressly state the action to have violated Article 2(4).38
However, the I.C.J.
did find Albania in violation of Article 2(4) by firing on the British ships because the ships had
not attacked Albania.39
Similarly, in Military and Paramilitary Activities, the I.C.J. found that when Nicaragua
assisted Salvadoran rebels by sending troops across the border from Nicaragua into El Salvador,
the action was considered to be just a threat that the conflict might escalate and not an escalation
itself. 40
At most, the action was considered to be meddling in El Salvador’s internal affairs.41
5
Either way, the I.C.J. held that the U.S. violated international law by assisting El Salvador
because Nicaragua’s actions were not sufficient to warrant El Salvador’s self-defense response.42
ii. Application of the Law of Armed Conflict to Cyberspace
There is tension among legal scholars and policy-makers on whether cybercrime and
cybersecurity are synonymous and whether some actions should be treated under the LOAC or
under criminal law.
One school of thought is that actions should be categorized either as being a cybercrime
or as a cyber attack (in the sense of terrorism or warfare). Scholars of this school say that within
cyberspace, cybercrime is distinguished from cyber warfare by the perpetrator’s intent and
effects of their actions and from this, courts can classify the action as a criminal or terrorist act.43
This distinction is significant because scholars who subscribe to this thinking further believe that
criminal acts, are considered a domestic security issue and should be prosecuted under criminal
statutes. 44
Conversely, cyber activity determined to be terrorism (by the perpetrator’s intent and
effects of the act) can trigger a defensive posture by the attacked country.45
This triggering act
then is considered to be a violation of the LOAC – even though the attack was carried out via
cyber means as opposed to a conventional kinetic attack. 46
The intent and focus of a cyber
terrorist is to destabilize a country and get publicity for their actions.47
This is in contrast to the
intent of a cybercriminal, which, again according to scholars of this school of thought, is usually
financial in nature – the theft of money, fraud, and sometimes the theft of information.48
This
distinction remains in place even if the methods used to effect the attack (e.g., denial of service,
virus, worm, etc.) is the same.49
Sometimes, however, distinguishing between cybercrime and cyber terrorism is difficult
because the descriptive words, specifically “security,” and “defense,” are interchangeable;50
6
therefore, the line between the two is difficult to determine.51
This difficulty has led to the
U.N.’s alternative school of thought, which is that cybercrime and cyberterrorism cannot be
bifurcated, that there is a blurry line between crime and war,52
and that cybercrime and cyber
terrorism issues cannot be separated because they are so interconnected.”53
Advocates for this
school of thought have illustrated how indistinctive the line is between criminal actions and those
that can be classified under the LOAC by highlighting how the military and civilians often work
together to mount cyber attacks in environments (e.g., air-conditioned office buildings) that
hardly resemble what one usually thinks of as a combat.54
Further, attackers do not even need to
come physically close to their targets and can pretty much mount an attack from anywhere, even
from a coffee shop, that has Internet access.55
Further blurring the line between what is
considered to be a criminal act versus an act that falls under the LOAC is that the U.N. only
considers attacks to be acts of war if the parties in conflict were sovereign states.56
For example,
the U.N. does not consider the 2007 denial-of-service attack on Estonian government offices to
be an act of war57
because there is no proof that the attack was initiated by a sovereign state –
even though some view the whole incident as the first cyberwar attack.58
B. International Criminal Law
International criminal law as applied to cyberspace is centered around two pieces of law:
the Computer Fraud and Abuse Act (“CFAA”) in the United States, and the Council of Europe’s
Convention on Cybercrime. Jurisdictional issues are often key factor in many international law
disputes, including in the cybersecurity realm, so after this section’s focus on the CFAA and the
Convention on Cybercrime, the following section59
will also draw a connection to the nexus
between international law jurisdictional principals and cybersecurity.
7
i. Computer Fraud and Abuse Act
The U.S. Computer Fraud and Abuse Act (“CFAA”) was enacted in 1984. The CFAA
prohibits persons from “knowingly” accessing “without authorization or exceeding . . .
authorized access.”60
Further, the CFAA characterizes the entities and types of data that are
protected, including financial records, federal agencies or departments, and protected
computers61
– defined as those affecting interstate or foreign commerce.62
ii. Council of Europe’s Convention on Cybercrime
The Council of Europe’s Convention on Cybercrime (“Convention on Cybercrime”)
came into being much later than the CFAA. The Convention on Cybercrime came into effect on
July 1, 2004, is the lone international treaty which addresses Internet crimes.63
Further, despite
its full name and origins in the Council of Europe, any state may join the Convention. 64
Unlike
the CFAA, the Council of Europe’s Convention on Cybercrime is a non-self-executing treaty
meaning that countries which ratify the treaty need to incorporate its terms into their own
statutory schemes. Specifically, the Convention on Cybercrime mandates that signatories
incorporate specific cybercrime offences into their criminal codes.65
These offenses include not
only illegal access to and interference with a computer system, but also include unlawful data
interception, forgery and fraud committed with the aid of a computer, and copyright
infringement.66
The absence of a reference to terrorist-related acts as being covered by the
Convention on Cybercrime is notable, especially in light of the U.N.’s definition of
“cybercrime,” which includes a reference to such acts - specifically, that even when terrorists use
computers to commit crimes, the acts are covered under the Convention on Cybercrime.67
Although European in origin and name, the Convention on Cybercrime is open to any
country in the world which would like to join.68
Notably, the U.S. has ratified the Convention on
8
Cybercrime, and commenting on the ratification, Richard Beaird, a Department of State official
responsible for international communications and information policy said in an April 2008
speech to the American Bar Association that the Convention on Cybercrime “offers the best legal
framework for the international community.”69
Even more significantly, however, is that Mr.
Beaird of the U.S. State Department also stated that nothing in U.S. statutory law (i.e., the
CFAA), needs changing as a result of ratifying the Convention on Cybercrime.70
However, the Convention on Cybercrime suffers from a similar semantics problem as the
LOAC. As interpreters of the LOAC have a difficult time articulating where the line is between
crime and war, or whether there are any differences at all, so too does the Convention on
Cybercrime have a definitional issue. Here, the major issue with the Convention on Cybercrime
is that each member has a high degree of flexibility in determining what exactly constitutes a
violation of the Convention on Cybercrime and further, because the Convention on Cybercrime
is not self-executing, each member can keep the definitions they place into their own statutory
regimes.71
Just in the European Union, for example, there is a wide range of definitions just for
unauthorized access to a computer system. These include: (1) accessing computer systems
where there has been some effort made to not permit open access; (2) requiring that actual
damage to the penetrated system; to (3) showing a movement from a “basic hacking offense” to
more serious offenses.72
C. The Nexus between Jurisdiction and Cybersecurity
Jurisdiction plays a large role in cybersecurity law. A major difference between the
CFAA and the Council of Europe’s Convention on Cybercrime is that the latter “provides for
extraterritorial jurisdiction.”73
Specifically, article 22(4) requires that signatory countries enact
9
laws that provides jurisdiction over acts that violate the Convention on Cybercrime but which
occur “outside the territory of the country but committed by one of its nationals.”74
How this plays out can be seen by comparing the outcome of the seminal case of Ivanov
v. United States75
under the CFAA and what would have likely occurred had the Convention on
Cybercrime existed at the time. From Russia, Aleksey Ivanov accessed a computer system in
Connecticut that contained credit card and other valuable data.76
Ivanov tried to extort money
from the owners in exchange for “security advice.” Some sources indicate that was sent to the
U.S. by Russia per an extradition request,77
but other, more primary sources indicate he was
convinced to come to the U.S. as part of an F.B.I. undercover operation.78
Regardless, Ivanov
was successfully prosecuted and the prosecution was able to show that Congress intended the
CFAA to apply extraterritorially.79
However, if the CFAA had an explicit clause granting
extraterritorial jurisdiction (as occurred later as part of the PATRIOT Act discussed infra)80
or if
the Convention on Cybercrime, with its extradition requirements, had been ratified by the U.S.,
then the prosecution would not have had to rely as heavily on showing legislative intent and
Russian government cooperation.81
i. The Territorial and Nationality Jurisdictional Principles and Cybersecurity
Two related international jurisdictional principles are the territorial and nationality
principles. Territorial jurisdiction is the most common and is true to its name – that is that if the
offense takes place within a state’s territory, then there is a firm foundation for claiming
jurisdiction.82
In turn, jurisdiction outside of a state’s borders – also called “extraterritorial
jurisdiction” – can be achieved via the nationality principle and is used specifically when a
national commits an offense outside of the prosecuting country.83
The seminal example of the
nationality principle is to prosecute American “sex tourists” who travel outside the U.S. to take
10
advantage of weak enforcement of child exploitation laws in other countries.84
Despite the
offenses occurring outside of the U.S., under U.S. law, American prosecutors can still go after
American nationals who commit these acts outside the U.S.85
and Congress can include
extraterritorial enforcement provisions when creating or amending other laws as well.86
Although the CFAA was interpreted to apply extraterritorially in Ivanov v. U.S.,87
the
Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and
Obstruct Terrorism Act of 2001, otherwise known as the PATRIOT Act, explicitly extended the
reach of the CFAA to allow for extraterritorial enforcement88
, and the Council of Europe’s
Convention on Cybercrime also provides for extraterritorial jurisdiction.89
However, semantically, when an action is said to have occurred “extraterritorially,” it
implies that it occurred in a geographic area – just one outside of the prosecuting country.90
But,
cyberspace by its very nature is not confined by geographic boundaries91
and so the problem
with applying territorial or extraterritorial jurisdiction is that “[c]yberspace is nowhere.”92
Significantly, the Internet uses packet switching technology where a piece of communication, for
example an e-mail, is broken up into discreet packets by the sender’s internet service provider
(“ISP”), sent over the Internet, and reassembled by the receiver’s ISP.93
The packets take the
shortest electronic route, which may not be the shortest geographic route, and may cross multiple
national physical borders during transmission, which essentially a space unconstrained by
geographic borders.94
Therefore, trying to artificially overlay the geographical border
implications of extraterritorial jurisdiction over cyberspace would be ineffective.95
ii. The Passive Personality or “Effects-Based” Jurisdictional Principle
On the opposite side of the same coin of the nationality principle is the passive
personality principle. In contrast to the nationality principle, where jurisdiction covers nationals
11
accused of crimes, the passive personality principle covers nationals who are victims of crimes.96
Specifically, the passive personality principle gives jurisdiction to the country on whose citizens
effects were felt. It is often referred to as “effects-based” jurisdiction.97
The S.S. Lotus98
case is
the seminal personality principle or effects-based jurisdiction case where the main controversy
was whether Turkey had to show a rule that granted it permission to arrest a French ship skipper
for alleged crimes, or whether the burden was on France to prove that Turkey was prohibited
from doing so.99
In essence, S.S. Lotus stands for the concept that under international law, actions
that are not specifically prohibited are allowed.100
Applied to cybercrime, the passive personality jurisdictional principle was one of the
critical success factors in the prosecution in the Ivanov case. While the prosecution was able to
show legislative intent that Congress meant for the CFAA to apply extraterritorially, the
prosecution also was able to successfully get jurisdiction through the passive personality
principle by showing that Alexsey Ivanov’s actions had adverse effects on U.S. nationals,101
so
prosecutors do not have to necessarily rely on just one type of jurisdiction to be effective.
iii. The Special Maritime and Territorial Jurisdictional Principle
Significantly, there is a subset of the territorial-nationality jurisdiction called the “special
maritime and territorial jurisdiction.”102
The U.S. has used special maritime and territorial
jurisdiction to extend to other countries’ nationals on ships in other countries’ territorial waters
when the ships have scheduled departures or arrivals in U.S. ports and when the victims were
U.S. nationals.103
iv. Protective Jurisdictional Principle
The protective principle is usually used to establish jurisdiction for espionage, official
document falsification, and immigration and custom conspiracy prosecutions.104
This
12
jurisdictional principle has been interpreted very broadly and does not require a showing of an
adverse affect within the U.S.105
v. Universality Jurisdictional Principle
Universal jurisdiction is closely connected with customary law as it, along with
international agreement, is one of two ways to establish jurisdiction using this principle.106
The
seminal case for customary law is Paquete Habana107
where the court held that fishing vessels
can continue working during wartime and cannot be captured because this it has been the custom
of Navies worldwide for over 600 years to allow fishing vessels to go on with their business
regardless of their nationality.108
Essentially, universal jurisdiction can be used when a law of
“universal concern” or universal agreement is involved. Examples include “piracy, slave trade,
attacks on or hijacking of aircraft,” and so forth.109
For prosecutors to make effective use of universal jurisdiction, they need to ensure that
six factors are met.110
These six factors are: (1) countries uniformly agree that the act is
unlawful; (2) the definition of the act is narrow and universally-accepted; (3) consequences for
the act are consistent across national boundaries; (4) the accused refuses the protection of their
country of citizenship; (5) domestic enforcement of the customary law in the location where the
act occurred is difficult; and, (6) the harm resulting from the act is international in nature and
affects more than one country.111
III. Proposed Solutions
A. Greater Reliance on Customary Law
Customary law is based on parties agreeing that certain acts are unlawful and is
sometimes termed the “Rule of Norms.”112
In the cyberspace arena, a recent White House
13
cyberspace article cited the “Rule of Norms” and noted specifically that common definitions and
understanding could go a long way toward creating the international law that governs
cyberspace.113
In particular, when state actors are involved, some scholars believe that most
countries would agree that state-sponsored cyber attacks are unlawful under customary
international law.114
The unlawfulness of State-sponsored attacks is further highlighted by Corfu
Channel’s key point that States cannot permit actions against other states to originate from their
territory, which although occurring in the early 1900s, can be applied to argue that State-
sponsored cyber attacks are unlawful.115
However, there are two primary drawbacks which preclude the effective application of
customary international law to cybersecurity issues. The first of these is customary law’s
requirement for a common viewpoint and common set of definitions116
and the second is the
focus on state actors and the lack of customary law governance over non-state-actors,117
The need for all parties to have a common viewpoint on what acts are unlawful and have
a common set of definitions is probably the most fatal drawback when trying to apply customary
international law to cybersecurity issues.118
Specifically, a common definition for what exactly
constitutes a cyberspace does not currently exist with sufficient specificity to become part of
customary law.119
Cyberspace has been variously defined as, “an evolving man-made domain
for the organization and transfer of data using various wavelengths of the electromagnetic
spectrum”120
to a place where “exchanges of communications [occur] and content between users
where the content is transported across the infrastructure. . . .”121
The significance of definitional
disagreement in the customary law context is that the arguments of parties relying on customary
law tend to be disregarded.122
Tel-Oren v. Libyan Arab Republic123
is the seminal case where
customer law is shown to be ineffective when there is not a common consensus on key
14
definitions.124
In Tel-Oren, a father charged Libya with responsibility for killing his child on a
civilian bus in Israel as a part of a terrorist act.125
The court dismissed the father’s claim partly
because there was little international agreement as to the definition of terrorism.126
Another drawback of trying to apply customary law to cybersecurity is that customary
law only applies to States or persons acting under the color of states unless the law specifically
covers non-state actors.127
Since non-State or private actors can initiate cyber attacks as well as
states themselves, such a gap in the law is a major drawback to relying on customary law to
prosecute cybercrimes. For example, the FBI believes that Al-Qaeda might attempt to initiate a
cyber attack in the future128
and so the U.S. government might have a difficult time pursuing a
non-state actor such as Al-Qaeda in the courts under traditional customary law.
B. Give the International Criminal Court Exclusive Jurisdiction Over Cybercrimes
This idea has its origins in the Anti-Drug Abuse Act, which while did not provide the
International Criminal Court (“ICC”) in The Hague with jurisdiction of international drug
traffickers directly, did direct the President of the U.S. to begin negotiations on the creation of a
court with this sort of jurisdiction.129
A similar court could be created for the prosecution of
cybercrimes, or jurisdiction could be given to the existing International Criminal Court (“ICC”).
The benefits of this proposal are mostly in the area of concurrent jurisdiction – that is
where two or more States believe they should be able to prosecute a violation – similar to the S.S.
Lotus130
case. Such a court, for example, has been used when the U.K., U.S., and Libya all
wanted jurisdiction over prosecution over Pan Am 103 bomber and the compromise was to have
the case tried in the ICC.131
However, as was the case in with the Pan Am bombing trial, there may be fear that a trial
would not even take place or that the trial would not be effective.132
Additional drawbacks to
15
this solution include that the States to whom the parties of a cybersecurity case might belong
might use the trial for political purposes or that the States might be unwilling to turn over
suspects to the ICC and rather, try to shield them from international adjudication.133
Further,
another major drawback of relying on the ICC is that the United States is not a signatory to the
Rome Statute which established the ICC and therefore decisions from that court are not binding
upon the United States.134
C. Prosecute Cybersecurity Violations under Universal Jurisdiction
While it might be tempting for Convention on Cybercrime members to try and use
universal jurisdiction, given the dispute noted previously on what “unauthorized access”
means,135
the requirement for a uniform definition would be tough to meet in the cybersecurity
context.136
D. Broaden the Definition of “Extraterritorial” to Include “Cyberspace” and
Continue to Prosecute Cybercrimes under Extraterritorial Jurisdiction
Currently, the Convention on Cybercrime as well as the CFAA (via the PATRIOT) Act
explicitly leverage extraterritorial jurisdiction. The principle drawback of relying on this type of
jurisdiction, as discussed supra, is that it implies that an offense occurred within a defined
geographic space,137
but “cyberspace is nowhere,”138
so prosecutions could potentially be
defeated on this ground.
While somewhat simple and perhaps inelegant, one possible solution is to formally define
extraterritorial jurisdiction as including cyberspace, or even more broadly as domains which are
not limited or defined by geographic boundaries so as to possibly account for future
technological developments that use something besides cyberspace.
Advantages of this method include that it might be easier from a procedural standpoint to
amend definitional sections in the U.N. Charter and Title 18 of the U.S. Code (which addresses
16
criminal activity) rather than specific treaties and statutes. This would further have the effect of
applying the expanded definition more broadly to treaties and statues beyond the Convention on
Cybercrime and the CFAA respectively. However, it would have the disadvantage of causing
possible unintended and unknown consequences. This risk could be mitigated by limiting the
expanded definition to just the Convention on Cybercrime and the CFAA.
E. Place Partial Cyberspace Security Burden on Private Infrastructure Providers and
Enforce Administratively
Very recently, General Keith Alexander, the head of Cyberwarfare Command, referred to
unspecified events that warrant the need for private companies that provide critical infrastructure
to bear some of the burden for protecting the U.S. from cyber attacks.139
Gen. Alexander further
discussed how he felt that leaving it to the free market to encourage critical infrastructure
providers to provide this protection themselves probably is not adequate and so implied that the
government needs to legislate enforcement.140
While Gen. Alexander did not refer to a specific
bill, he was likely lending support to the “Homeland Security Cyber and Physical Protection Act
of 2011”141
which, if enacted, will establish a Cybersecurity Compliance Division that in turn
can promulgate regulations requiring critical infrastructure providers to meet certain likely high
standards of cybersecurity protection.142
The advantages of this bill include that it is in line with general administrative law
concepts that detailed rulemaking, especially in technically complex areas, should be left to the
experts.143
Also, if regulations are enacted properly, they would cover domestic, as well as
international cyber threats. The primary disadvantage, of course, is that as Sen. McCain pointed
out, it would increase the regulatory burden on private companies in a struggling economy. This
burden may be mitigated somewhat by section 224(c) of the bill that specifies that regulations
should be made after looking at the risks involved including threats, vulnerabilities, and
17
consequences.144
This implies that rule makers will be tempered somewhat and only make
regulations that truly are needed.
F. Enhance the Convention on Cybercrime with Special Maritime and Territorial
Jurisdiction
Finally, a new proposal is to replace or add to the Council of Europe’s Convention on
Cybercrime’s use of extraterritorial jurisdiction with special maritime and territorial jurisdiction.
The advantage of the latter, is that a prosecuting entity can more easily gain jurisdiction over
persons residing in a country other than the one prosecuting, regardless of who (e.g., a private
person) or entity (e.g., embassy, consulate, or corporation).145
Further, this type of jurisdiction is
generally expressly provided for in a statute leaving less room for dispute on how or should be
applied.
i. Cyber Attacks and Piracy: Parallels and Similarities
The first of two major similarities between cyber attacks and piracy is that, as was seen in
the Estonian case, it can be difficult to trace who exactly perpetrated an intrusion or cyber attack
event.146
Similarly, pirates are difficult to track down because they either do not fly a nation’s
flag (rather the pirates flag), or fly one that is not of their own.147
While this is addressed in the
piracy case by applying universal jurisdiction, extending this thinking to the prosecution of cyber
attack perpetrators is probably not wise given the drawbacks of universal jurisdiction discussed
next.
The second of two major similarities between cybercrime and piracy are that the venues
for these crimes – specifically cyberspace and the high seas respectively – do not belong to or
fall under the territorial jurisdiction of any one country.148
This means that to prosecute these
crimes, forms of jurisdiction not based on territorial boundaries must be explored.149
18
Piracy is covered by universal jurisdiction,150
but applying universal jurisdiction to other
areas of the law is risky and comes with severe drawbacks. The first of these is that it can be
easy for lawmakers to create universal jurisdiction over customary law that truly is not
customary.151
An example are the Terrorism Treaties drawn up in the 1970s and 1980s which
addressed crimes that fall under the heading of “international terrorism” and include airline
hijacking, terrorist bombings, torture, hostage-taking, and crimes that purposely impair maritime
navigation.152
The problem was that there was no foundation for these crimes to be considered a
part of customary law and so really were inappropriately covered under universal jurisdiction in
the treaties153
and given that there are diverging opinions on what constitutes cybercrime and
cyberspace,154
applying universal jurisdiction to here would be unwise.
Another drawback of applying universal jurisdiction to laws beyond piracy is it is easy
for lawmakers to exclude State action. Historically, piracy has always been considered a private
action somewhat purposely to avoid creating conflicts between States.155
Applied to
cybercrimes, it would be very easy to similarly write statutes that fall under universal jurisdiction
but leave out the ability to prosecute States who are often thought to perpetrate cyber attacks.156
ii. Cybercrime and Piracy: Differences
Outside of the U.S., piracy is enforced through the United Nations Convention on the
Law of the Sea.157
However, unlike the Convention on Cybercrime, the United States is not a
signatory of the Law of the Sea convention,158
so by having the Convention in Cybercrime in
place makes actually puts the U.S. in a better position to tackle cybercrime on the international
level because it has the backing of the “best legal framework of the international community” to
help back it up.159
19
iii. Alternative: Special Maritime and Territorial Jurisdiction
Given that Convention of Cybercrime is already in place and at least provides a
foundation for prosecution of cyber attacks on the international level, but that exercise of
universal and extraterritorial jurisdiction have drawbacks, the U.S. could suggest that the
Convention on Cybercrime be modified, or in the alternative, make a reservation to use special
maritime and territorial jurisdiction.
Continuing the analogy to piracy, although U.S. legislation generally provides that
prosecution of piracy falls under universal jurisdiction,160
the U.S. also may prosecute under the
special maritime and territorial jurisdiction.161
The crime of piracy is defined as, “[w]hoever, on
the high seas, commits the crime of piracy as defined by the law of nations . . . ,”162
and the
special maritime and territorial jurisdiction includes the “high seas.”163
And, just as the “high
seas” are not within the territorial jurisdiction of any country164
cyberspace, as discussed
supra,165
the “place” where cybercrime occurs, not being a tangible place,166
also cannot be
governed via traditional territorial jurisdiction.
If the special maritime and territorial jurisdiction were similarly applied to cyber attacks,
it would resolve the problem with extraterritorial jurisdiction being linked to geographic
boundaries. Further, the special maritime jurisdiction does not have the problem of universal
jurisdiction of being tied to customary law and in turn the problem with a range of definitions for
cyber attacks and cyberspace. And, if the special maritime jurisdiction were to be integrated into
the already existing base the U.S. has in being a member of the Convention on Cybercrime,
which has been stated to be a good legal framework, it might be legislatively efficient as making
an amendment is likely less burdensome than creating brand new law.
20
IV. Conclusion: Final Recommendation
Rather than relying on the advantages of one of these single solutions, the best solution is
a hybrid of the latter two – that is placing some burden on private entities that supply critical
infrastructure as well as incorporating the special maritime and territorial jurisdiction into the
Convention on Cybercrime so that their advantages can complement the other while mitigating
the disadvantages of each.
One major advantage is that a hybrid solution contains both the defensive elements of
private infrastructure providers enhancing their security protocols while also providing the
offensive elements of the likely more effective prosecution enabled by incorporating the special
maritime and territorial jurisdiction into the Convention on Cybercrime.
In addition, while Congress may have a difficult time enacting an organic statute that
enables an existing agency to create new regulations as part of the private entity part of the
hybrid solution, by showing that the government is also taking on some burden, specifically
improving how crimes can be prosecuted under the already-existing Convention on Cybercrime,
it will provide regulated businesses with a good faith indication that the government is taking
responsibility as well.
Finally, in addition to the benefits that each solution will provide individually, creating a
public-private hybrid has the possible advantage of leveraging the significant skills of both the
policy- and business- focused skills and resources of government agencies and the private sector,
which could lead to significant efficiencies and creativity in improving existing and developing
new defensive mechanisms as well and continuing to “play offense” effectively when required.
21
ENDNOTES
1 Janet Reno, U.S. Attorney General, Keynote Address on High-Tech and Computer Crime,
Address at the P-8 Senior Experts’ Group on Transnational Organized Crime (Jan. 21, 1995),
available at: http://www.irational.org/APD/CCIPS/agfranc.htm.
2 See Duncan B. Hollis, Why States Need an International Law for Information Operations, 11
LEWIS & CLARK L. REV. 1023,1024 (2007); Katharine C. Hinkle, Countermeasures in the Cyber
Context: One More Thing to Worry About, YALE J. INT’L L.ONLINE 1, 13 (2011). 3 Id. (describing that the cyber attack on Estonia began on April 27, 2007, the day when Estonia
moved a Russian war memorial from the center of Tallinn – Estonia’s capital. Although Estonia
is no longer a part of the now-defunct Soviet Union, the Estonia is still home to a large Russian
population who, along with the Russian government, objected to the move of the war memorial.
Initially, the attack made Estonian government websites, including the Estonian Parliament’s
email system, the President’s and Prime Minister’s offices, as well as the Foreign and Justice
ministries, inaccessible for long periods of time making it a denial of service attack. The attack
lasted three weeks and spread beyond government computers to include those belonging to
financial institutions, Internet service providers, newspapers, television stations, and even
telephone exchanges, which disabled critical “911” fire and rescue numbers. 4 Bradley Graham, Hackers Attack Via Chinese Web Sites, WASH. POST, Aug. 25, 2005, at A1.
5 Adam Levine, Millions spent defending Pentagon computers from attack, CNN (Apr. 7, 2009,
8:43 PM), http://www.cnn.com/2009/POLITICS/04/07/military.computers/index.html
?iref=allsearch.
6 Natasha Solce, The Battlefield of Cyberspace: The Inevitable New Military Branch – The Cyber
Force, 18 ALB. L.J. SCI. & TECH. 293, 297 (2008). 7 Jason Barkham, Information Warfare and International Law on the Use of Force, 34 N.Y.U. J.
INT’L L. & POL. 57, 62 (2001) (citing Elizabeth Becker, Pentagon Sets Up New Center for
Waging Cyberwarfare, N.Y. TIMES, Oct. 8, 1999, at A16) (explaining that General Henry
Shelton, who was chairman of the Joint Chiefs of Staff at the time of the Kosovo conflict,
confirmed that the U.S. attempted to mount a cyber attack on Serbian computer networks.
Further, other U.S. Government officials admitted that U.S. intelligence services mounted cyber
attacks on the President of Yugoslavia’s bank accounts.). 8 Miriam F. Miquelon-Weisman, The Convention on Cybercrime: A Harmonized Implementation
of International Penal Law: What Prospects for Procedural Due Process? 23 J. MARSHALL J.
COMPUTER & INFO. L. 329, 335 (2005) (citing United Nations Crime and Justice Information
Network, International Review of Criminal Policy – United Nations Manual on the Prevention
and Control of Computer Related Crime P 5, available at: http://www.uncjin.org/ Documents/
EighthCongress.html).
9 Supra Section I.
22
10
Davis Brown, 47 HARV. INT’L L. REV. 179, 186 (2006) (citing JOINT CHIEFS OF STAFF, JOINT
PUBL’N NO. 3-13, JOINT DOCTRINE FOR INFORMATION OPERATIONS I-9 TO -10 (Oct. 9, 1998).
11 Id.
12 Hollis, supra note 2, at 1031.
13
SUN TZU, THE ART OF WARFARE 111 (Robert G. Henricks ed., Roger T. Ames trans.,
Ballantine Books 1993). 14
Brown, supra note 10, at 187 (citing Eric Talbot Jensen, Computer Attacks on Critical
National Infrastructure: A use of Force Invoking the Right of Self-Defense, 38 STAN. J. INT’L L.
207, 222 (2002)). 15
See White House, International Strategy for Cyberspace: Prosperity, Security, and Openness in
a Networked World 3 (2011), available at: http://www.whitehouse.gov/sites/default/files/
rss_viewer/international_strategy_for_cyberspace.pdf.
16
See id.
17 See ELLEN S. PODGOR AND ROGER S. CLARK, INTERNATIONAL CRIMINAL LAW 5 (2nd ed.
LexisNexis 2008). 18
RESTATEMENT (THIRD) OF THE FOREIGN RELATIONS LAW OF THE UNITED STATES § 102(1)
(1987).
19
U.N. Charter art. 2, para. 4.
20
U.N. Charter art. 51.
21
Corfu Channel (U.K. v. Alb.), 1949 I.C.J. 4, 22 (Apr. 9).
22
Military and Paramilitary Activities In and Against Nicaragua (Nicar. v. U.S.), 1986 I.C.J. 14,
195 (June 27).
23
U.N. Charter art. 2, para. 4 (“All members shall refrain in their international relations from the
threat or use of force against territorial integrity or political independence . . . .”).
24
U.N. Charter art. 42 (There are two ways in which the United Nations permits war. Article 42
of the U.N. Charter is more commonly thought of as when war is authorized by the U.N.
Security Council). 25
U.N. Charter art. 51; See also Sean M. Condron, Getting It Right: Protecting American
Critical Infrastructure in Cyberspace, 20 HARV. J. LAW & TEC 404, 412–13 (2007) (clarifying
how U.N. Charter art. 51 articulates the right of self-defense).
23
26
Sean M. Condron, Getting It Right: Protecting American Critical Infrastructure in
Cyberspace, 20 HARV. J. LAW & TEC 404, 412–13 (2007).
27
Katharine C. Hinkle, Countermeasures in the Cyber Context: One More Thing to Worry
About, YALE J. INT’L L. ONLINE 1, 1 n.1 (2011).
28
Condron, supra note 26, at 413. 29
Barkham, supra note 7, at 72.
30
Id.
31
Id. 32
Corfu Channel, supra note 21 at 22.
33
Military and Paramilitary Activities In and Against Nicaragua, supra note 22, at 195.
34
Barkham, supra note 7, at 70 (citing Corfu Channel, supra note 21 at 31, 50).
35
Id. (citing Corfu Channel, supra note 21 at 14, 28, 30).
36
Id.
37
Id. (citing Corfu Channel, supra note 21 at 19, 35).
38
Id.
39
Barkham, supra note 7, at 70 (citing Corfu Channel, supra note 21 at 19, 35).
40
Id. at 75 (citing Military and Paramilitary Activities In and Against Nicaragua, supra note 22,
at 123).
41
Id. (citing Military and Paramilitary Activities In and Against Nicaragua, supra note 22, at
123).
42
Id. at 76 (citing Military and Paramilitary Activities In and Against Nicaragua, supra note 22,
at 123).
43
Solce, supra note 6, at 300-1 (citing CARLOS A. RODRIGUEZ, CYBERTERRORISM – A RISING
THREAT IN THE WESTERN HEMISPHERE 7 (2006)).
44
Condron, supra note 26, at 408.
45
Id.
24
46 Brown, supra note 10, at 188.
47 Solce, supra note 6, at 301 (citing Barry C. Collin, Inst. for Sec. and Intelligence, The Future
of CyberTerrorism: Where the Physical and Virtual Worlds Converge, Remarks at the 11th
Annual International Symposium on Criminal Justice Issues, http://afgen.com/terrorism1.html
(last visited Apr. 11, 2008) (discussing the differences between cyber terrorists and cyber
criminals)).
48
Brown, supra note 10, at 188.
49 Id.
50 Condron, supra note 26, at 408 (citing Roget’s II: THE NEW THESAURUS 248 (3d ed.
1995)).
51
Id.
52
See Podgor, supra note 17, at 5. 53
M. Gercke, INTERNATIONAL TELECOMMUNICATIONS UNION, UNDERSTANDING CYBERCRIME: A
GUIDE FOR DEVELOPING COUNTRIES, at 17 (2011), available at: http://www.itu.int/ITU-
D/cyb/cybersecurity/docs/ ITU_Guide_A5_14092011_rev.pdf. 54
Brown, supra note 10, at 183.
55
Solce, supra note 6, at 295.
56
Gerke, supra note 53, at 115.
57
Hollis, supra note 2 Lewis & Clark L. Rev. 1025 (citing Newly Nasty, supra note 5; Robert
Anderson et al., US Warns Cyber-attacks Will Increase, Fin. Times, May 18, 2007, at 12.))
58
Gerke, supra note 53, at 115.
59
Infra Section II.B.i.
60
Computer Fraud and Abuse Act of 1986, 18 U.S.C. § 1030(a)(1) (LexisNexis 2012).
61
18 U.S.C. § 1030(a)(2).
62
18 U.S.C. § 1030(a)(6)(A).
63
KU v. Finland, [2008] ECHR 2872/02 (2 December 2008).
64
Id.
25
65
Id.
66
Id.
67
Miquelon-Weisman, supra note 8, at 332.
68
Council of Europe Convention on Cybercrime, art. 36, para. 1.
69
John R. Crook, ed., Contemporary Practice of the United States Relating to International
Law: U.S. Views on Norms and Structures for Internet Governance, 102 A.J.I.L. 648, 650 (2008)
(citing Richard C. Beaird Sr., Deputy Coordinator for Int'l Communications and Information
Policy, Perspectives on Internet Governance--What Might the Future Hold? (Apr. 11, 2008)).
70
Id.
71
Jennifer J. Rho, Blackbeards of the Twenty-First Century: Holding Cybercriminals Liable
under the Alien Tort Statute, 7 CHI. J. INT’L L. 695, 707–08 (2007).
72 Id.
73 Mike Keyser, The Council of Europe Convention on Cybercrime, 12 J. Transnat'l L. & Pol'y
287, 301 (2003).
74
Council of Europe Convention on Cybercrime art. 22, para. 44.
75
United States v. Ivanov, 175 F. Supp. 2d 367 (D. Conn. 2001).
76
Id. at 369.
77
Keyser, supra note 73, at 301.
78 U.S. Dept. of Justice, “Russian Computer Hacker Convicted by Jury” October 10, 2001,
available at: http://www.justice.gov/criminal/cybercrime/press-
releases/2001/gorshkovconvict.htm (noting that Ivanov, along with two other men, one names
Gorshkov, were convinced to travel to the U.S. by the FBI under the pretense of interviewing
and demonstrating their hacking skills for a fake start-up company called “Invita.” Ivanov and
the other men traveled to Seattle where they successfully demonstrated their hacking skills and
were arrested.).
79 Ivanov, supra note 75, at 370.
80
Infra Section II.C.i.
81
Keyser, supra note 73, at 301.
26
82
Podgor, supra note 17, at 18.
83
Id. at 21.
84
Id.
85
Id.
86
Ellen S. Podgor and Roger S. Clark, Understanding International Criminal Law, 14 (2nd ed.
LexisNexis 2008) (explaining that there are two ways in which U.S. laws can be enforced
extraterritorially. One is when Congress expressly states in a statute that it can be enforced
extraterritorially and the other, is when a court finds that Congress intended for the statute to be
enforced extraterritorially even though it was not explicitly stated in the context of the statute.).
87
Ivanov, supra note 75 at 370. In Ivanov, the federal district court found that extraterritorial
jurisdiction can apply even when not explicitly stated in a statute. Here, the court found that the
Ivanov accessed valuable computer files in Connecticut and so first possessed stolen property
taken from a protected computer (as defined by the plain language definition in the CFAA) in the
U.S. before sending it to Russia. Using this data, the Ivanov was able to control data, credit card
numbers, etc. from Russia and so, in addition to possessing stolen property, the theft of data and
credit card numbers had an adverse effect on U.S. nationals.
88
USA PATRIOT Act (U.S. H.R. 3162, P.L. 107-56), Title VIII § 814. Amended Computer
Fraud and Abuse Act of 1986, 18 U.S.C. § 1030(e).
89
Convention on Cybercrime, supra note 74, at art. 38, para. 2.
90
Rho, supra note 71, at 697.
91 Id.
92 Brown, supra note 10, at 180.
93
Ivanov, supra note 75, at 369 (citing Preston Gralla, How the Internet Works 9 (1999)).
94
Condron, supra note 26, at 409, n.47, n.52, n.53.
95
Id. (citing David R. Johnson and David Post, Law and Borders – The Rise of Law in Cyber
space, 48 STAN. L. REV. 1367, 1370 (1996)).
96
Podgor, supra note 17, at 21.
97
Podgor, supra note 86, at 20–1.
98
See S.S. Lotus (Fr. v. Turk.), 1927 P.C.I.J. (ser. A) No. 10 (Sept. 7).
27
99
See id.
100
See id.
101
Ivanov, supra note 75 at 370.
102
Podgor, supra note 86, at 21–2.
103
Podgor, supra note 17, at 19. Note that the special maritime and territorial jurisdiction is
defined statutorily and notably contains the following sections: 18 U.S.C. § 7(1): “The high seas,
any other waters within the admiralty and maritime jurisdiction of the United States and out of
the jurisdiction of any particular State, and any vessel belonging in whole or in part to the United
States or any citizen thereof, or o any corporation created by or under the laws of the United
Sates, or of any State, Territory, District, or possession thereof, when such vessel is within the
admiralty and maritime jurisdiction of the United States and out of the jurisdiction of any
particular State.” 18 U.S.C. § 7(7): “Any place outside the jurisdiction of any nation with respect
to an offense by or against a national of the United States. 18 U.S.C. § 7(8): “To the extent
permitted by international law, any foreign vessel having a scheduled depart from or arrival in
the United States with respect to an offense committee by or against a national of the United
States.”
104
Id. at 22.
105
Id. at 23.
106
Id.
107
The Paquete Habana, 175 U.S. 677 (1899).
108
Id. at 686.
109
Podgor, supra note 17, at 23.
110 Rho, supra note 71, at 709–10.
111
Id.
112
THE WHITE HOUSE, INTERNATIONAL STRATEGY FOR CYBERSPACE: PROSPERITY, SECURITY,
AND OPENNESS IN A NETWORKED WORLD 9 (May 2011) available at:
http://www.whitehouse.gov/sites/default/files/rss_viewer/international_strategy_for_cyberspace.
pdf.); See also John R. Crook, ed., Contemporary Practice of the United States Relating to
International Law, 105 A.J.I.L. 794, 794 (2011).
113
Id.
28
114
Hinkle, supra note 27, at 16 (citing Press Release, Senator Jim Web, Senate Condemns Cyber
Attack Against Google in China (Feb. 3, 2010), available at: http://webb.senate.gov/
newsroom/pressreleases/2010-01-29-03.cfm).
115
Corfu Channel, supra note 21 at 22. (“States have an obligation ‘not to allow knowingly
[their] territory to be used for acts contrary to the rights of other State.’”)
116
Rho, supra note 71, at 710.
117
Kiobel v. Royal Dutch Petroleum Co., 621 F.3d 111 (2d Cir. 2010) (citing prior history).
118 Rho, supra note 71, at 710.
119
Daniel J. Ryan, et al., International Cyberlaw: A Normative Approach, 42 Geo. J. Int'l L.
1161, 1167 (2011).
120
Id. at 1167, n.28.
121
Id. at 1167-68, n.33.
122
Tel-Oren v. Libyan Arab Republic, 726 F.2d 774, 806 (D.C. Cir. 1984).
123
Id.
124
Id.
125
Id.
126
Id.
127
RESTATEMENT (THIRD) OF THE FOREIGN RELATIONS LAW OF THE UNITED STATES, supra note
18, at § 101.
128
Duncan B. Hollis, An e-SOS for Cyberspace, 52 HARV. INT'L L.J. 373, 390 (2011).
129
M. Cherif Bassiouni and Christopher L. Blakesley, The Need for an International Criminal
Court in the New International World Order, 25 Vand. J. Transnat’l L 151, 156 (1992).
130
See S.S. Lotus (Fr. v. Turk.), 1927 P.C.I.J. (ser. A) No. 10 (Sept. 7).
131
Bassiouni, supra note 129, at 166.
132
Id. at 161.
133
Id.
29
134
Rome Statute of the International Criminal Court, July 17, 1998, U.N. Doc. A/CONF. 183/9;
See alsoAziz v. Alcolac, Inc., 658 F.3d 388, 398 (Md. 2011); See also Madeline H. Morris,
Universal Jurisdiction: Myths, Realities, and Prospects: Universal Jurisdiction in a Divided
World, 35 New Eng. L. Rev. 337, 349–50 (2001).
135
Supra section II.B.ii.
136
Rho, supra note 71, at 709–10.
137
Id. at 697.
138
Brown, supra note 10, at 180.
139
Ellen Nakashima, NSA’s Gen. Alexander: Companies should be required to fortify networks
against cyber attack, Washington Post, Checkpoint Washington Blog, 1:40pm ET, May 4, 2012,
available at: http://www.washingtonpost.com/blogs/checkpoint-washington/post/nsas-gen-
alexander-companies-should-be-required-to-fortify-networks-against-cyber
attack/2012/05/04/gIQA1Snf1T_blog.html (last accessed: May 6, 2012, 1:46pm ET).
140
Id.
141
H.R. 174, 112th Congress (2011).
142
Nakashima, supra note 139.
143
See NLRB v. Hearst Publs., 322 U.S. 111, 130 (1944).
144
H.R. 174 § 224(c), supra note 141.
145
18 USC § 7(9).
146
Supra Section II.a.ii.
147
Hollis, supra note 128, n.270 (citing the United Nations Convention on the Law of the Sea
art. 98, Dec. 10, 1982, 1833 U.N.T.S. 397 which stated that "[e]very State shall require the
master of a ship flying its flag, in so far as he can do so without serious danger to the ship, the
crew or the passengers ... to proceed with all possible speed to the rescue of persons in distress, if
informed of their need of assistance, in so far as such action may reasonably be expected of him .
. . .").
148
Black’s Law Dictionary 1466 (9th ed. 2009) (defining “high seas” as “[t]he seas or ocean
beyond the jurisdiction of any country.”); David S. Weitzel, Where No Lawyer Has Gone
Before? What A Cyberspace Attorney Can Learn from Space Law's Legacy , 10 CommLaw
Conspectus 191, 205 (2002) (citing Black's Law Dictionary 1307 (7th
ed. 1999) (defining “res”
as "an object, interest, or status, as opposed to a person . . . .")).
30
149
Supra Section II.C.
150
Podgor, supra note 86, at 78.
151
Morris, supra note 134, at 339–48.
152
Id. at 347-48.
153
Id. at 348.
154
Supra Section III.A.
155
Morris, supra note 134, at 338.
156
Supra Section I.
157
Law of the Sea Convention, art. 100, 110.
158
157 Cong Rec S 3206 (2011) (Ministerial Arctic Council Meeting where one discussion topic
was that the United States was the only country bordering the Arctic Ocean that was not a
member of the Law of the Sea Convention).
159
Crook, supra note 69, at 650.
160
Podgor, supra note 86, at 78 (citing Alfred P. Rubin, The Law of Piracy (2d ed. 1998)).
161
Id. (citing 18 U.S.C. § 7(1)).
162
18 USC § 1651.
163
18 USC § 7(1).
164
Black’s Law Dictionary, supra note 148, at 1466.
165
Brown, supra note 10, at 180.
166
Weitzel, supra note 148, at 205.
