'Death by a Thousand Cuts': Cyberespionage and the Problem of Aggregated Small Harms

Abstract

This paper examines the ‘new’ phenomenon of cyberespionage and the problem of aggregated harms. Thomas Rid has argued that most discussions of cyberwar are exaggerated because there is no known act of cyberwar. An important part of his argument is that the most widespread use of state-sponsored cyber capabilities is for the purpose of espionage, which, he argues is neither crime nor war. Thresholds of harm serve as benchmarks in determining what is (and what is not) an act of war. The authors of the Tallinn Manual, for instance, have argued that such thresholds should be specified in terms of the nature and/or extent of the injury, loss of human life and/or physical destruction caused. The idea informing such proposals is that cyber-attacks cannot, in and of themselves, constitute war. But this perspective ignores the problem of aggregated harms, which we are seeing with some emerging cyberespionage programs. Aggregated harms are the small harms that are individually insignificant but that together add up to a large harm. If such behaviour is properly categorised as espionage, how should we respond to theft of sensitive information on a massive scale? And what does it mean for the way we use military capabilities?