Folks like
Joe Slowik,
Grugq and
you (Dave) have tried to articulate the CONOPS for worms since long. In their current forms, worms look like IO packages in full-spectrum missions. Ignoring technical problems like
extreme target dependence for worms, "harm" would always be defined at the policy level, and then technical. There is a reason why Defend Forward assumes that establishing "contact" in forward areas is a precursor to producing signals or effects (and that reason is not technical). That's also why SolarWinds was missed. You could have neatly placed (wormable) SolarWinds on the
axis of Gerasimov Doctrine where "crisis reaction" morphs into "localisation" and "neutralisation" of conflict. A whole genre of Russian or Chinese doctrinal literature on noncontact operations is highly conducive for worms; but then, you can't see things in isolation. You start talking about things like systems-on-systems warfare. It becomes way more than just target discrimination and noncombatants. You enter an informational conflict (la US vs. Nicaragua). You start imbibing the
Russian definition of asymmetricity and Creative Military Thought -- worms would fall under the same category as "inspection satellites." Everything becomes Reflexive Control. That's where the
norms
customary law would come from, such behavioral precedents.