IEEE Technology and Society Magazine - June 2019 - 76

The case for government intervention
and prohibition of cyber arms faces
significant constitutional limitations.
Prohibition of Zero-Day Exploits
A zero-day exploit is a vulnerability that is unknown to
anyone except its discoverer [15]. The IT industry, the
computer security community, and the defense establishment are unaware of the vulnerability. After the zeroday exploit is found, a tool could be designed to take
full advantage of the exploit.
This zero-day exploit tool could be "dangerous and
unusual," but still is permissible to own based on the
fact that the exploit the tool is targeting is unknown to
the government.
In any country that has submitted to the rule of law
and democratic foundations, the government cannot ban
and criminalize what it doesn't know or create all-encompassing penal codes for such scenarios. If a government
is unaware of a zero-day exploit and until the utilization of
the zero-day exploit, not only the exploit is unknown, but
also the extent of the effects and damage created by its
exploitation, the zero-day exploit is permissible to own. A
tool that exploits zero-day exploits could only be prohibited after execution. Under the rule of law, and through the
Anglo common law tradition, the government cannot preemptively ban speech that is not protected by the First
Amendment until it has happened. The authorities cannot prosecute a person who intends to deliver a criminalized hate speech, because the factual illegality is
unknown. Even if the intent from the creator of the zeroday exploit is to create mayhem and digital destruction, it
is still permissible to own the undisclosed zero-day
exploitation tool because the burden of proof is on the
government and the government is unable to formulate a
case against the unknown zero-day exploitation tool.

The Castle Doctrine
The scope of this paper is cyber arms in the light of the
Second Amendment. In the public discourse, the Second Amendment and the Castle Doctrine tend to part of
the same discussion. The Castle Doctrine has also been
used as an argument to support legalization of corporate hack back (cyber counterstrikes) [16].
The Castle Doctrine is a common-law doctrine [17]
that supports the individual's option, without prosecution or penalty, to use force in defending his residence
and family. If attacked, there traditionally has been an
obligation to retreat to avoid bodily harm and risk to

human life. The Castle Doctrine supersedes the obligation to retreat if the attack occurs in the personal
realm that the doctrine covers based on state-level precedence. In some states, the doctrine extends to an
individual's vehicles and workplace. The Castle Doctrine's lineage extends to older English common law,
under which a citizen was considered to have a right to
peace and safety in his own home. The Second
Amendment and the Castle Doctrine are separate;
where the Second Amendment is the federal right to
bear arms, the Castle Doctrine is state-level legislation
to define the boundaries between excessive force, the
obligation to retreat, and the use of lethal force to
defend one's life and property. The Second Amendment right to own and bear arms does not provide a
right to protect life and property using deadly or significant force. Therefore, any citizen's utilization of military grade cyber weapons owned and procured under
the rights given by the Second Amendment to protect
himself from physically harmful cyber attacks is contingent not only on federal legislation as exemplified by
the Computer Fraud and Abuse Act (CFAA) [18], but
also by state legislation. As our society merges human
ability and physiology with digital mechanisms and initiates a broader use of digital-human enhancement,
creating a personal attack surface for digital arms, the
question of a cyber Castle Doctrine is a useful analogy
from the non-digital reality.

Visible Legal Doctrine
Currently, there is no cyber Second Amendment as a first
court tested case, referred to a case of the first impression, on the docket. Such a case would trigger a legal
development and clarification, but already a distinct
legal doctrine is visible. According to the inquiry, the citizenry has the right to own and operate cyber arms
under identical conditions as firearms. The current U.S.
legal doctrine states that "unusual and dangerous" arms
can be prohibited. The majority of the hacking, network
discovery, and information systems probing and exploiting tools are of military utility and value as enablers of
cyber capacity even if in civilian hands [19]. Therefore,
these tools cannot be considered unusual in the light of
the Second Amendment.
The question then becomes whether these cyber arms
are dangerous. The legal doctrine has developed an allowance for prohibiting dangerous weapons that would
harm the public beyond an intended military use or that
lack safeguards such as intent by arming and using the
weapon. The labeling of a weapon as "dangerous" would
require that a cyber weapon autonomously initiate attacks
without any human interaction, as intent is not required
when the weapon is assessed on its own merits, and this
is not applicable to the vast majority of cyber weapons.

IEEE TECHNOLOGY AND SOCIETY MAGAZINE

∕

JUNE 2019

IEEE Technology and Society Magazine - June 2019

Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - June 2019