Use of Force Policies & Procedures Flashcards

Which international body has primary responsibility for maintaining peace and security, including in contexts that may involve state-sponsored cyberattacks rising to the level of armed conflict?

Answer: The UN Security Council

The UN Security Council holds primary responsibility under the UN Charter for international peace and security, including situations where cyberattacks may constitute acts of aggression.

A corporate use-of-force policy includes a 'no first strike' clause. This clause means the organization:

Answer: Will not initiate offensive cyber operations but reserves the right to respond to attacks

A 'no first strike' clause means the organization commits to not initiating offensive cyber actions but retains authority to respond defensively when attacked.

Under most corporate security policies, which scenario would MOST clearly justify invoking emergency use-of-force procedures without waiting for full escalation approval?

Answer: Active ransomware encrypting critical infrastructure systems in real time

Active ransomware causing immediate, ongoing damage to critical systems is a time-sensitive emergency where pre-authorized emergency procedures may be invoked without waiting for full approval chains.

A government agency's use-of-force policy references 'Title 10' and 'Title 50' authorities. These titles most directly relate to:

Answer: US legal authorities governing military operations vs. intelligence activities

In the US, Title 10 governs military operations (Department of Defense), while Title 50 governs intelligence activities, and understanding which authority applies is critical to legally sanctioned cyber operations.

Which cyber operation concept allows defenders to pursue attackers 'through' compromised third-party infrastructure to reach the true source, and is highly controversial under international law?

Answer: Hot pursuit in cyberspace

Hot pursuit in cyberspace—accessing third-party intermediary systems to track an attacker—is legally contested because it involves unauthorized access to systems belonging to uninvolved parties or foreign states.

A security team's use-of-force policy requires a 'Legal Hold' be placed on all evidence before any active response. What is the PRIMARY purpose of this requirement?

Answer: To preserve evidence integrity for potential litigation or law enforcement referral

A legal hold ensures that digital evidence is preserved in an unmodified, admissible state for potential criminal prosecution, civil litigation, or regulatory proceedings.

In the context of cyber operations policy, 'covert action' typically requires what special authorization in the United States?

Answer: A Presidential Finding signed by the President

Under the National Security Act, US covert actions require a Presidential Finding, which authorizes the activity and is reported to congressional intelligence committees.