During the U.S.-Russia June 2021 Geneva presidential summit, U.S. President Joseph Biden handed Russian President Vladimir Putin a list of critical infrastructure inside the United States he wishes Russian criminal groups and the state of Russia not attack. This is cringe-worthy national security diplomacy.
Any cyberspace attack on any US business, person, or infrastructure — any cyberspace attack anywhere — is already illegal under international law, a violation of sovereignty, and justifies a proportional response under the right of self-defense. President Putin knows this. Ransomware is a cyberspace attack, unequivocally — an act that creates denial effects. It does not matter if Russians attack a neighborhood lemonade stand excel spreadsheet via cyberspace or the Los Angeles Airport’s air traffic system; it is a cyberspace attack. If such attacks create physically destructive denial effects, such as changing the network’s information, permanent function denial, or hard drive destruction, they rise to the legal definition of armed attack. A proportional response and subsequent preemptive acts of self-defense to cyberspace attack are legal and appropriate. No state has any right to attack anything.