Is Congressional Approval Necessary for Cyber Attacks?

In light of the North Korean Internet outtage, I was wondering if Congress was notified or given an opportunity to approve or reject the (alleged) US retaliation. Would such an operation require Congressional approval or notification? Has anyone in Congress voiced an opinion on the matter?

It’s barely been 48 hours which is the time the President has to inform Congress if armed troops are sent in. So even if this was a U.S. attack, it’s not at all clear the War Powers Act is relevant nor that it’s been violated if it is.

Furthermore evidence seems to point to it not being an official U.S. attack at all. Apparently the hack group Gator League (no I’ve never heard of them either) warned North Korea it was going to happen before it did so they might have some credibility to their claim they did it.

What on Earth would North Korea have to attack with a cyberattack, anyway? They have a hard enough time with making electricity work-- Just what do you think their computer resources are?

The general population in North Korea may be live in substandard conditions, but the military and the elite are a differenty story. North Korea certainly has a very active cyber warfare unit by most accounts. It’s easy to dismiss NK as a backwards country, but it’s one that also has an active nuclear weapons program and successfully completed at least three nuclear tests.

Snark that just might actually be meaningful:

It may all be word games. Witness all the linguistic weaseling over the torture report: If we tortured, then we broke all sorts of international laws and treaties. Or maybe it wasn’t torture. Maybe it was just enhanced interrogation techniques with creative nutritional maintenance techniques.

Okay, what was this thread about again? Oh yeah… Cyber attacks. Now according to the news, Obama says it’s all just cyber vandalism. (I think he was referring to the attacks on Sony.) Well, now that makes it all different. Not an attack or warfare or anything, just a little commonplace vandalism.

Maybe that makes all the difference. Maybe that means he doesn’t have to check with Congress.

Seriously. They all play games like that.

The National Security Act requires that if the President engages in a covert action, he must produce a written finding which will be notified to certain members of Congress. A covert action is defined as something the U.S. does to influence political, economic, diplomatic, or other factors abroad in a way that the hand of the United States is intended to be concealed. So if the President wanted to do cyber attacks with the intent of nobody ever finding out that we did it, the law requires notification but not permission from Congress.

But if the intent is that cyber attacks are to be undertaken in defense of the country, most likely by the military, but without the intent to conceal the hand of the U.S. (or perhaps delay attribution for a period of time to complete the mission in secrecy) then there really isn’t a constitutional or statutory basis for requiring congressional approval for those types of actions. As said before, the War Powers Resolution limits the use of troops, not of malware. But it would be extremely foolish for the President to do such a thing and not let Congress know before or shortly after that he did indeed order such cyber attacks.

One further note: the OP seems to assume that the U.S. is behind the attacks. That isn’t established at all, and personally I doubt it. But we shall see…

Well, I’ve already helped personally with the Hack them back campaign, and I certainly didn’t get any Congressional approval for that.