Recently a friend asked me what my opinion was as a "computer guy" about the China-Taiwan "cyber warfare." At first it seemed that there wasn't much to say, except maybe to point out that this seems to be a ways away from Schwartau's info-war. One thing has started to bother me a bit, though. How does mainland China distinguish an attack by the Taiwanese state from an attack launched by private Taiwainese citizens? Do they even *care*, since they have such poor relations with Taiwan anyway? What happens if Taiwan's government says it wants to normalize relations with China (and vice versa), but the attacks continue? Will they have to find and punish their own citizens in order for the normalization to move forward? Where do treaty obligations compel a state to prosecute citizens for behavior which it may have tacitly encouraged before? Interestingly enough, an attack where the originator is identified seems to be more of a problem. At least with an anonymous attack, a state can plausibly deny that one of its citizens was involved. In fact, you could see identified attacks on Chinese systems coming to be a form of civil disobedience if Taiwan were to go this route. (I don't think Taiwan will - I'm just interested in this interplay between private action and the state's responsibility.) Suppose Taiwan proves unwilling or unable to stop private citizens from attacking mainland Chinese systems. Now there seems to be a parallel with situations where states are considered either supportive of terrorism or too incompetent to prevent terrorist activity. Israel occupied southern Lebanon because it didn't see any other way to prevent terrorist activity. The alleged use of Libya and Sudan as "training grounds" could be viewed as a kind of jurisdictional arbitrage, and a kind which has been reacted against violently in the past. Fear of an analogous situation online seems to be behind the "world cyber-crime treaty" mentioned here recently. Now bringing it closer to home, does that mean opposition to the world cyber crime treaty could be cast as "support for cyber-terrorism"? -David