Catherine A. Theohary wrote this important CRS report (updated: 14 December 2023) CRS Report:'Use of Force in Cyberspace'.
Download CRS_InFocus_Rpt_Use_Force_Cyberspace_14Dec2023
Click on the graphics to enlarge them.
Introduction
There are no internationally accepted criteria yet for determining whether a nation state cyberattack is a use of force equivalent to an armed attack, which could trigger a military response. Likewise, no international, legally binding instruments have yet been drafted explicitly to regulate inter-state relations in cyberspace. Self-defense and countermeasures for armed attacks are permitted in international law when a belligerent violates international law during peacetime, or violates the law of armed conflict during wartime. However, the term “armed attack” has no universally accepted definition and is still not well-settled with respect to cyberattacks. In addition to what constitutes an armed attack in cyberspace, questions remain over which provisions of existing international law govern the conduct of war in cyberspace.
United States Doctrine
In September 2012, the State Department took a public position—still in effect—on whether cyber activities could constitute a use of force under Article 2(4) of the United Nations (U.N.) Charter and customary international law. According to State’s then-legal advisor, Harold Koh, “Cyber activities that proximately result in death, injury, or significant destruction would likely be viewed as a use of force.” Examples offered in Koh’s remarks included triggering a meltdown at a nuclear plant, opening a dam and causing flood damage, and causing airplanes to crash by interfering with air traffic control. By focusing on the ends achieved rather than the means with which they are carried out, this definition of cyber war arguably fits within existing international legal frameworks. If an actor employs a cyber weapon to produce kinetic effects that might replicate fire power under other circumstances, then the use of that cyber weapon rises to the level of the use of force. However, the United States recognizes that cyberattacks without kinetic effects are also an element of armed conflict under certain circumstances. Koh explained that cyberattacks on information networks in the course of an ongoing armed conflict would be governed by the same principles of proportionality that apply to other actions under the law of armed conflict. These principles include retaliation in response to a cyberattack with a proportional use of kinetic force. In addition, “computer network activities that amount to an armed attack or imminent threat thereof” may trigger a nation’s right to self-defense under Article 51 of the U.N. Charter. The 2011 International Strategy for Cyberspace affirmed that “when warranted, the United States will respond to hostile acts in cyberspace as we would to any other threat to our country.” The International Strategy, which has not been updated, goes on to say that the U.S. reserves the right to use all means necessary—diplomatic, informational, military, and economic—as appropriate and consistent with applicable law. One of the defense objectives of the International Strategy is to work internationally “to encourage responsible behavior and oppose those who would seek to disrupt networks and systems, dissuading and deterring malicious actors, and reserving the right to defend national assets.” Chapter XVI of the Department of Defense Law of War Manual notes that the United States strives to work with other states to clarify not whether international law applies to cyberspace, but how.NATO Doctrine
In 2009, the North Atlantic Treaty Organization (NATO) Cooperative Cyber Defense Center convened an international group of independent experts to draft a manual on the law governing cyber conflict. The first Tallinn Manual, as it is known, was published in 2013 and offers 95 “black letter rules” addressing sovereignty, state responsibility, the law of armed conflict, humanitarian law, and the law of neutrality. The Tallinn Manual is an academic text and as such nonbinding. Published in February 2017, Tallinn Manual 2.0 expands upon the first and offers 154 black letter rules governing cyber operations, including in peacetime. In the provisions of Article 5 of the North Atlantic Treaty, an attack on one member is considered an attack on all, affording military assistance in accordance with Article 51 of the U.N. Charter. However, NATO does not presently define cyberattacks as clear military action. The Tallinn Manual equates a use of force to those cyber operations whose “effects ... were analogous to those that would result from an action otherwise qualifying as a kinetic armed attack.” Article 4 of the North Atlantic Treaty applies the principles of collective consultation to any member state whose security and territorial integrity has been threatened; however, it is unclear how this article would apply to the various categories of cyberattacks, some of which may not have kinetic equivalents. Also unclear is the concept of jurisdiction and what constitutes territorial integrity for those member states who view cyberspace as a global domain or commons.International Law
The so-called “Law of War,” also known as the law of armed conflict, embodied in the Geneva and Hague Conventions and the U.N. Charter may, in some circumstances, apply to cyberattacks, but without specific agreement on its applicability, its relevance remains unclear. It is also complicated by difficulties in attribution, the potential use of remote computers, and possible harm to third parties from cyber counterattacks, which may be difficult to contain. In addition, as with NATO doctrine, questions of territorial boundaries and what constitutes an armed attack in cyberspace remain. The law’s application would appear clearest in situations where a cyberattack causes physical damage, such as disruption of an electric grid. As mentioned above, the Tallinn Manual addresses many of these questions. In the absence of a treaty-based definition for what constitutes an armed attack or use of force in cyberspace, Tallinn Manual co-author Michael Schmitt has proposed in his academic publications criteria for analysis under international law.The basic principles encompassed in the Hague Conventions regarding the application of Armed Forces are those of military necessity, proportionality, humanity, and chivalry. A nation whose military is conducting cyber operations according to these principles may be said to be engaging in cyber war.
United Nations Norms
A 2004 U.N. General Assembly resolution called for the convening of and a report from an international group of government experts (GGE) from 15 nations, including the United States, to secure cyberspace by agreeing upon “norms, rules and principles of responsible behaviour by States.” Unlike the work done at Tallinn under the auspices of NATO, this U.S.-led process included both China and Russia. The 2015 GGE report achieved consensus on 11 norms for the use of cyberspace, to include, among others, that nations (1) should not intentionally damage each other’s critical infrastructure with cyberattacks, (2) should not target each other’s cyber emergency responders, and (3) should assist other nations investigating cyberattacks launched from their territories. A fourth norm, stating the United States will not use cyber surveillance to steal information about foreign companies to benefit U.S. firms, was articulated by then-Secretary of State John Kerry and adopted as official U.S. government policy. While also nonbinding, U.N. Resolution 70/237 calls upon Member States to be guided by the norms set forth in the 2015 GGE report. The following 2016/2017 GGE failed to achieve consensus, due in part to objections from some member countries on explicitly applying rules on the use of force under Article 51, which they argued would represent the militarization of cyberspace. Yet the March 2021 report of the sixth and last GGE affirms the applicability of both international law and the U.N. Charter in its entirety. The 2021 GGE report also notes that international humanitarian law applies only in situations of armed conflict.
Enjoy!
"One of the lessons of history is that nothing is often a good thing to do and always a clever thing to say." - Will Durant
Comments