Matthew C. Waxman is the Liviu Librescu Professor of Law at Columbia Law School, where he chairs the National Security Law Program. He is also adjunct senior fellow at the Council on Foreign Relations and a faculty affiliate of Columbia University’s Data Science Institute Cybersecurity Center. He has served in senior roles at the US State Department, Defense Department, and National Security Council.
Contrary to popular view, cyberattacks alone are rarely exercises of constitutional war powers—and they might never be. They are often instead best understood as exercises of other powers pertaining to nonwar military, foreign affairs, intelligence, and foreign commerce, for example. Although this more fine-grained, fact-specific conception of cyberattacks leaves room for broad executive leeway in some contexts, it also contains a strong constitutional basis for legislative regulation of cyber operations.