1. Introduction
The development of cyber threats constitutes a significant challenge for international peace and stability.
Since the end of the Cold War, after a period of growth and development, international law is increasingly being challenged by states and other actors.Footnote 1 Recent practice in respect of the use of force offers a useful illustration: an increasing number of states are using force outside the cases prescribed by the Charter of the United Nations (UN Charter). Over the last few years, various events have demonstrated the increasing challenges that affect international law, such as the conflicts in Ukraine and Syria, the relative defiance of the US administration towards international law since the election of President Donald Trump,Footnote 2 the actions of China in the South China Sea, as well as growing critique of the International Criminal Court.Footnote 3
In addition to the general challenges to international law, specific norms of international law are also being challenged in their application by new realities and obstacles, such as the development of new technologies. Professors Heike Krieger and Georg Nolte have correctly identified that the development of cyberspace may create new challenges for international law.Footnote 4 This observation, arguably, can be further developed. More specifically, I believe that the relationship between the norms of international law and the development of cyberspace should be analysed under three headings.
First, international law is already being challenged and has even sometimes been contested in recent years. This situation results in a certain level of uncertainty in the way in which the norms of international law are or will be applied.
Thus, and second, the development of cyberspace and cyber operations challenges norms of international law that already face a certain level of uncertainty and contestation in both their content and their application.
Third, this twofold challenge regarding the application of the norms of international law to cyberspace and cyber operations is apparent in the difficulty for states to discuss and agree on the matter. The same difficulty is observed in the academic literature.
The work of the UN Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security (UN GGE)Footnote 5 is particularly illustrative. Most notably, it demonstrates the various positions defended by states on the norm-making process and their preference for non-binding norms, mainly norms relating to behaviour and confidence-building measures. In this complex context, the successive UN GGE have managed to reach agreement and produce reports. The 2013 and 2015 reports were particularly significant because they acknowledged the applicability of international law and the UN Charter to cyberspace.Footnote 6 In June 2017, however, the fifth UN GGE failed to reach a consensus on its final report. Some states dispute the applicability to cyberspace of entire branches of international law, such as the law of armed conflict, self-defence and counter-measures. This situation poses a particular challenge to international law and there is a risk of geographical fragmentation of international law norms applicable to cyberspace.
The objective of this article is twofold. First, by analysing the application of the existing norms of international law to cyber operations, as well as identifying their limits, the article offers an accurate lens through which to study the contestation or process of reinterpretation of some norms of international law. Second, the article aims to offer an overview of the main questions arising when it comes to the application of international law to cyber operations, and to identify which of those have been answered and which are still pending. Despite the growing body of literature addressing these questions,Footnote 7 the same issues relating to the applicability and application of norms of international law are questioned regularly. For these reasons, the article does not focus on a specific issue, but rather it offers an overview of these questions and of the existing responses, as well as identifying specific questions which have not yet been settled or which need further work or practice. In other words, the objective of the article is not to deliver a comprehensive analysis on how the norms of international law apply to cyber operations but rather to provide an overview of the key points and issues linked to the applicability and application of international law as well as elements of contextualisation, notably after the failure of the last UN GGE.
The article comprises three parts. The first part focuses on the applicability of international law to cyber operations (Section 2) – that is to say, the general question of whether international law is applicable to cyber operations. The second part identifies some challenges that affect the applicability and application of international law in general (Section 3). The final part (Section 4) analyses some challenges that affect specific norms of international law, highlights their limits in dealing with cyber threats, and thus identifies directions for potential further work on the application of international law to cyber operations.
2. International Law is Applicable to Cyberspace and Cyber Operations
The first question arising from the development of cyber threats is whether international law is applicable to cyberspace and cyber operations. It is only by answering this first question that we can move to the subsequent and more interesting question of the actual application of specific norms of international law to cyberspace and cyber operations.
In that sense, the humankind creation of cyberspace is comparable with the conquest of the air at the beginning of the twentieth century and of outer space in the middle of the twentieth century. On each occasion when human activities were deployed in a new area, the same questions were asked. Is international law applicable? If so, how does it apply?
This section has three parts. It shows first that, for the purpose of international law, cyberspace does not constitute a new territory, area or domain, unlike land, the air, the seas and outer space. Second, it demonstrates that nothing prevents international law from applying to cyberspace. The first two parts of the section are dedicated to international air law and international space law. The rationale for these analyses is that, while wondering whether we should adopt a new treaty dedicated to cyberspace and cyber operations,Footnote 8 comparisons with the development of the law of the seas, international air and space law are often made. The argument that is often put forward is that we need a cyber-specific treaty similar to the United Nations Convention on the Law of the Sea, the Convention on International Civil Aviation and the Outer Space Treaty. Drawing from this observation, this section introduces the development of international air and international space law before showing why cyberspace is different from air and outer space, and how it affects the applicability of international law and the development of new norms.
2.1. International Air Law
On 21 November 1783 the first manned hot-air balloon flight took place in Paris. The use of hot-air balloons developed continuously during the nineteenth century. The first controlled, sustained flight of a powered, heavier-than-air aircraft was performed by Orville and Wilbur Wright on 17 December 1903. The development and proliferation of aircraft, particularly transborder flights, represented a growing area of concern in the late-nineteenth and early-twentieth centuries, notably during the First World War.
The status of airspace and human activities taking place in airspace in accordance with international law was heavily debated. In an article on the history of international air law, Peter Sand, Jorge de Sousa Freitas and Geoffrey Pratt identify four categories of publicist of international air law: ‘authors in favour of absolute freedom of air navigation, those in favour of absolute State sovereignty in the air, those accepting a vertical limitation (‘zones’) to sovereignty, and those accepting a functional limitation by international law’.Footnote 9 Despite various attempts of multilateral conferences and conventions on the matter, international air law developed mainly through bilateral agreements.Footnote 10
It was only in 1919, with the adoption of the Paris Convention relating to the Regulation of Aerial Navigation,Footnote 11 that the question of the extension of state sovereignty over airspace was resolved. Article 1 reads:
The High Contracting Parties recognise that every Power has complete and exclusive sovereignty over the air space above its territory.
For the purpose of the present Convention, the territory of a State shall be understood as including the national territory, both that of the mother country and of the colonies, and the territorial waters adjacent thereto.
This article codified state practice that existed before the First World War.Footnote 12 This Convention resolved the question of the status of airspace regarding state sovereignty and established various principles that became the basis of international air law. It laid the ground for the international instruments to be adopted in this area in the future and, more generally, for the development of international air law.
2.2. International Space Law
The development of human activities in airspace made clear that it was only a matter of time before humankind conquered the next frontier, outer space. Consequently, decades before the launch on 4 October 1957 of the first man-made object to be sent into outer space, Sputnik 1, state representatives and scholars started to wonder about the legal regime of outer space and of human activities that would take place there. In addition to the question of the status of outer space, there was also a question regarding the status of celestial bodies and whether they may be subject to state appropriation. As highlighted by Peter Jankowitsch:Footnote 13
The most powerful drive towards creating such a new branch of international law finally came from geopolitical considerations, namely the opening, in outer space, of a new field of competition and possibly confrontation of the two superpowers of the day, the United States and the Soviet Union.
This situation led to the adoption of the first resolution of the United Nations General Assembly related to outer space on 13 December 1958: Resolution 1348 (XIII) entitled ‘Question of the Peaceful Use of Outer Space’.Footnote 14 This resolution, inter alia, created the ad hoc Committee on the Peaceful Uses of Outer Space (COPUOS), which became permanent with the adoption of Resolution 1472 (XIV) of 1959.Footnote 15 The 1958 resolution was followed by several subsequent resolutions on questions relating to outer space. Resolution 1962 (XVIII), ‘Declaration of Legal Principles Governing the Activities of States in the Exploration and Uses of Outer Space’,Footnote 16 marked an important milestone in this process in laying the foundation of international space law and marking the starting point of the process that led to the adoption of the first multilateral treaty on outer space in 1967.
The Outer Space Treaty,Footnote 17 which may be seen as the founding text of international space treaty law, was adopted as an annexe to Resolution 2222 (XXI) of 1966.Footnote 18 It was subsequently open for signature simultaneously in London, Moscow and New York in January 1967 and entered into force on 10 October 1967. The Outer Space Treaty, as well as the subsequent Moon Agreement,Footnote 19 established, inter alia, that neither outer space nor celestial bodies may be ‘subject to national appropriation by claim of sovereignty, by means of use or occupation, or by any other means’.Footnote 20
It is today unquestioned that international law applies in both airspace and outer space, as well as to any human activities taking place in these areas. This brief introduction to the development of international air and space law exposes how the applicability of international law to these areas was slowly settled and became widely accepted. The main objective was to identify the main features of the specialised regimes of specific areas that are often considered as potential models for international cyberspace law. The next section will analyse the main features of cyberspace and identify whether it is relevant to refer to these models for the development of international cyberspace law.
2.3. International Cyberspace Law
The applicability of international law to cyberspace and cyber operations has been a matter of controversy. The question was whether cyberspace constitutes a new ‘Far West’ where existing norms of international law, if not international law itself, would not regulate the activities taking place in this ‘space’. This question has been settled in both academic literature as well as in state practice. It is worth recalling that it had been recognised in the consensual reports of the two previous UN GGE in 2013Footnote 21 and 2015,Footnote 22 and that several states confirmed this position in their comments on these reportsFootnote 23 and in their national cyber defence and cyber security strategies.Footnote 24 Consequently, the question became what should be the specific interpretation and application of the norms of international law to cyberspace and cyber operations. The purpose of this section is to analyse why international law applies to state activities.
The question of the applicability of international law to cyberspace was based on the assumption that cyberspace constitutes a new area for human activities similar to land, air, the seas and outer space. This section demonstrates that this question is irrelevant, as cyberspace does not constitute a new legal domain, and nothing prevents international law from applying to cyberspace and cyber operations.
2.3.1. Cyberspace is not a New Legal Domain
Cyberspace is not a technical term created by computer scientists or engineers. It first emerged in science fiction literature.Footnote 25 William Gibson is considered to be one of the first writers to employ and popularise the term ‘cyberspace’.Footnote 26 He used it for the first time in July 1982 in Burning Chrome, a novel published in the magazine Omni.Footnote 27 In his 1984 book, Neuromancer, he popularised the notion according to which:Footnote 28
Cyberspace: A consensual hallucination experienced daily by billions of legitimate operators, in every nation, by children being taught mathematical concepts … A graphical representation of data abstracted from the banks of every computer in the human system. Unthinkable complexity. Lines of light ranged in the non-space of the mind, clusters and constellations of data. Like city lights, receding.
Initially, cyberspace had no clearly defined ‘semantic meaning’.Footnote 29 Slowly and incrementally, however, the term ‘cyberspace’ migrated from the realm of science fiction and became pivotal elsewhere. For instance, a debate emerged, and continues today, on whether cyberspace constitutes the fifth domain of military activities alongside the existing domains of land, sea, air and outer space.Footnote 30 Similarly, it is debated whether it constitutes a ‘global common’,Footnote 31 which is a domain or area that lies outside the sovereignty of any state and should be treated as a common-pool resource for humanity, similar to Antarctica, the high seas or outer space.Footnote 32
Building on these debates, one may query whether cyberspace is the fifth domain of warfare. This claim is questionable,Footnote 33 and I contend that cyberspace does not constitute a fifth domain for several reasons. First, cyberspace is not really an environment, or a domain, into which we can ‘upload’ humans and human activities. Therefore, in contrast to the other four domains – land, sea, air and space – we cannot ‘go’ into cyberspace. Humans and their activities can be deployed in the other four domains and travel between them: even if going undersea or into space without specific preparation or the right equipment can have fatal consequences, it remains possible nonetheless. For example, a submarine located undersea may launch a missile and target objects located on land, in the sea, air, or space. Conversely, it is not possible to launch a missile directly from a submarine to target an objective located in cyberspace. The only interaction possible would be to target the computer on which the cyber object is stored; however, such conduct is unrelated to cyberspace.
Second, cyberspace is not a separate domain but a means by which to affect objects located in the other four domains.Footnote 34 Land, sea, air and space are distinct from each other: the boundaries between them are clearly identifiable, even if the boundary between air and space is not clear-cut, making it virtually impossible to determine where air fades into space. Conversely, cyberspace is not a domain in itself but is deployed in all four domains. Thus, it is a means that can be used to conduct human activities and warfare in land, air, sea and space: a cyber operation launched from a boat located on the high seas will most probably be transmitted via satellite telecommunication and thus transit through space and air, and may target an object located in any of the four domains. For these reasons, cyberspace does not amount to a domain or an environment, and a fortiori should not be considered the fifth domain of warfare. It may be conceded, however, that referring to cyberspace as a new domain may be useful in other contexts, especially for the military, to describe their cyber activities despite its obvious lack of technical accuracy.
Cyberspace is only a notional environment or domain that refers to a theoretical environment made up of the internet together with other computers and telecommunications networks, whether or not connected to the internet.Footnote 35 Cyber operations do not refer only to those activities that take place on the internet, but to any operation that uses a computer network. The internet is only one among many computer networks. The internet, however, is of utmost importance for cyber operations: computer networks enable computers to connect, and the internet is made up of a system of networks allowing those networks, and therefore any computers connected to them, to communicate with one another.Footnote 36 It allows the launching of a cyber operation from a computer connected to a specific network that is connected to the internet against a computer connected to another interconnected network, and thus to act remotely, sometimes from a very distant location.
In conclusion, cyberspace does not constitute a new domain or area of human activity for the purpose of international law. Thus, cyberspace must be distinguished from airspace and outer space. Indeed, cyber activities take place in the four areas of land, sea, air and outer space, and are thus regulated by the norms of international law relating to these areas. Consequently, it appears unnecessary to question the applicability of international law in or to cyberspace as it is only a fictional domain. For these reasons, it is also not particularly helpful to refer to the specialised regimes of specific areas (the law of the sea, airspace law and outer space law) as potential models for the development of international cyberspace law.
2.3.2. Nothing Prevents International Law from Applying to Cyber Activities
Cyberspace does not constitute a new domain or area for the purpose of international law, as demonstrated in the previous section, and thus cyber activities are activities that take place in the four areas of land, sea, air and space, with a digital dimension. Thus, it is unnecessary to question the applicability of international law to or in cyberspace.
There remains, however, the question of the applicability of international law to cyber operations and, more broadly, to cyber activities. I would contend that the question should be reversed, and we should ask instead whether there is anything that prevents international law from applying to cyber activities.
The vast majority of norms of international law, whether of treaty law or customary international law, developed long before the invention of computers. Indeed, most of the legal questions relating to cyber operations depend on norms contained in the UN Charter adopted in 1945, the Geneva Conventions of 1949 and their Additional Protocols and, most importantly, in the customary international law of responsibility of states for internationally wrongful acts codified by the International Law Commission of the United Nations. However, these norms do not apply only to the forms of state activity that existed at the time of their adoption or codification, but to state activities in general. For these reasons, it seems unquestionable that general international law applies to cyber activities.
International law is applicable to cyber activities and this has been confirmed by both academic literature and state practice, as has already been developed in this article.Footnote 37 This conclusion, however, does not mean that the application of the norms of international law is an easy task. On the contrary, important issues arise as to how to interpret and apply several norms.
3. General Challenges to International Law: International Legality and Stability is at Stake
Several challenges affect the application of international law in general. The objective of this section is to analyse the four main challenges to the application of international law in general: (i) the failure of the 2016–17 UN GGE and its consequences on the application of international law; (ii) following from the previous subsection, the failure of the UN GGE discussion implies a risk of blocking the discussion at the universal level with the consequent risk of fragmentation of international law; (iii) there is then the increasing role played by non-state actors in lawmaking processes; and (iv) the predilection of states for soft law rather than hard law, leading to the adoption of norms of behaviour and confidence-building measures.
3.1. The Failure of the Last UN GGE
In June 2017, the fifth UN GGE failed because the participating governmental experts could not agree on a draft of Paragraph 34, which would detail how international law applies to the use of information and communication technologies by states. As a consequence, they did not adopt a report and the UN GGE process appears to be blocked.Footnote 38 The inability of participating experts at the last UN GGE to reach a consensus on the application of specific norms of international law has been portrayed sometimes as a general questioning of the applicability of international law to cyber operations. The next section of this article analyses the rationale for the failure of the UN GGE and its consequences. Following this assessment, I contend that states are not challenging the general applicability of international law to cyber operations, and that this constitutes a clear demonstration of the vigorous academic and international discussions of these issues.
Having failed to reach a consensus at the 2016–17 UN GGE in June 2017, the participating experts did not adopt a consensual report.Footnote 39 The negotiations failed on questions relating to international law, namely counter-measures, self-defence and international humanitarian law. It is worth recalling that the applicability of international law, and of the UN Charter, had already been recognised in the consensual reports of the two previous UN GGE in 2013 and 2015.Footnote 40 For these reasons, it is necessary to analyse the failure of the 2016–17 UN GGE in order to accurately review the applicability of international law to cyber operations.
The 2016–17 UN GGE was chaired by Karsten Geier, who was Head of the International Cyber Policy Coordination Staff with the German Federal Foreign Office.Footnote 41 Despite some reported oral comments from Geier, notably during the Cyber Week Conference in Tel Aviv at the end of June 2017,Footnote 42 neither he nor the German government have yet published any statement exposing their position and the reasons for the failure of the latest UN GGE.
At the last meeting of the UN GGE, on 23 June 2017, the US governmental expert made a statement to explain the position of the United States, which was later published on the website of the US Department of State, stating notably that:Footnote 43
[t]hroughout the 2016–2017 GGE, I have sought clear and direct statements on how certain international law applies to States’ use of [information and communication technologies (ICTs)], including international humanitarian law, international law governing States’ exercise of their inherent right of self-defense, and the law of State responsibility, including countermeasures. I sought such statements in the interests of international peace and security, based on my strong conviction that the framework of international law provides States with binding standards of behavior that can help reduce the risk of conflict by creating stable expectations of how States may and may not respond to cyber incidents they face. The final draft of the report insufficiently addresses these issues. I believe it would be a troubling and potentially destabilizing signal for this GGE to release a report that does not take a clear position on the applicability of these bodies of international law to States’ use of ICTs, much less fulfill the mandate given to this Group by the UN General Assembly to study how international legal rules and principles apply to the use of ICTs.
Despite years of discussion and study, some participants continue to contend that it is premature to make such a determination and, in fact, seem to want to walk back progress made in previous GGE reports. I am coming to the unfortunate conclusion that those who are unwilling to affirm the applicability of these international legal rules and principles believe their States are free to act in or through cyberspace to achieve their political ends with no limits or constraints on their actions. That is a dangerous and unsupportable view, and it is one that I unequivocally reject.
During this GGE, I heard repeated assertions on the part of some participants that a discussion of certain bodies of international law, including the jus ad bellum, international humanitarian law, and the law of State responsibility, would be incompatible with the messages the Group should be sending regarding the peaceful settlement of disputes and conflict prevention. That is a false dichotomy that does not withstand scrutiny. A report that discusses the peaceful settlement of disputes and related concepts but omits a discussion of the lawful options States have to respond to malicious cyber activity they face would not only fail to deter States from potentially destabilizing activity, but also fail to send a stabilizing message to the broader community of States that their responses to such malicious cyber activity are constrained by international law.
Three states were reportedly opposed to paragraph 34, and two of them also expressed publicly their position, namely Cuba and Russia.
A statement by the Cuban governmental expert taking part in the 2016–17 UN GGE explains the position of this state.Footnote 44 The statement first clearly recognises the applicability of international law by stating:
Information and telecommunications should be tools to promote well-being, knowledge and human development, based on strict respect for the UN Charter and International Law. There should be instruments to promote peace, not to promote war, the use of force, interventionism, destabilization, unilateralism or terrorist actions.
The statement then explains the rationale for Cuba's reluctance with regard to self-defence and counter-measures, as well as towards the application of the law of armed conflict:Footnote 45
I must register our serious concern over the pretensions of some, reflected in paragraph 34 of the draft final report, to convert cyberspace into a theater of military operations and to legitimize, in that context, unilateral punitive force actions, including the application of sanctions and even military action by States claiming to be victims of illicit uses of ICTs.
We consider [them] unacceptable formulations contained in the draft, aimed to establish equivalence between the malicious use of ICTs and the concept of ‘armed attack’, as provided for in Article 51 of the Charter, which attempts to justify the alleged applicability in this context of the right to self-defense.
To establish as a precedent this dangerous reinterpretation of the norms of international law and the Charter of the United Nations would be a fatal blow to the collective security and peacekeeping architecture established in the Charter of the United Nations. The ‘Law of the Jungle’ cannot be imposed, in which the interests of the most powerful States would always prevail to the detriment of the most vulnerable.
The final draft also made reference to the supposed applicability in the context of ICT [Information and Communications Technology] of the principles of International Humanitarian Law. We cannot accept such affirmation, since it would legitimize a scenario of war and military actions in the context of ICT.
Similarly, the Ministry of Foreign Affairs of the Russian Federation posted on its website an interview with the Russian governmental expert taking part in the UN GGE,Footnote 46
Russia stands for the maintenance of peace in the information space and the prevention of an information ‘arms race’. We regard the inadmissibility of the use of force both in the virtual and real world as an absolute truth. Under no circumstances should the information space become yet another battlefield.
[…]
The [international information security (IIS)] system should guarantee equal security for all and serve to protect the most vulnerable players, instead of turning them into a target for the stronger ones.
In this regard, during the discussion within the GGE, the Russian side advocated the idea of necessity of conflict prevention in the digital field and its demilitarization as well as the establishment of principles of the non-use of force, respect for state sovereignty, non-interference in internal affairs of other states, respect for human rights and fundamental freedoms. To these ends, we suggested that the Group should prepare and recommend for adoption by the UN General Assembly universal rules of responsible behavior of states in the information space reflecting these principles. In this context, the Russian representative within the GGE, in cooperation with BRICS partners and other states, including developing ones, has repeatedly introduced substantive proposals and contributions to the Group.
Unfortunately, the peace-oriented concept suggested by Russia has come in conflict with the position of certain countries that seek to impose on the whole world their own game rules in the information space, which would only serve their own interests.
Building on their technological advantages, they seek to secure ‘the right of the strongest’ in the information space and provide an international legal basis for their ‘free hand’ behavior. To this end, they have attempted to adopt within the UN format the decisions of the NATO Summit in Warsaw declaring cyberspace a new warzone.
This policy is being followed up with an attempt to ‘tailor’ certain norms of international law, including its humanitarian aspects, in order to make it possible to use force in the digital field. At the same time, the need for a careful consideration of essential issues related to the specific nature of information and communication technologies is being completely ignored. This includes, in particular, attribution of computer attacks.
We believe that this approach, as well as the hasty manner in which it is being advanced, is indicative of the one and only thing: states that support it try to provide a legal ‘cover up’ for every case when they use force.
We are particularly concerned about the fact that the concept of forceful and military countermeasures in the digital field, which, among other things, implies the imposition of sanctions and punishment of ‘undesirable’ countries bypassing the existing mechanisms, including the UN Security Council, is being imposed on the world, and that the idea already agreed upon in previous GGE that any charges against states for carrying out cyberattacks should be proven, is being revised in all possible ways.
We believe that such an approach puts in jeopardy the security interests of other countries and is fundamentally in contradiction with the objective of ensuring peace in the information space.
Besides, in order to rid the discussion on IIS of the ‘inconvenient’ opinion of the developing states, a course has been adopted aimed at discrediting the role of the key and the only universal negotiation platform – the UN – in dealing with IIS issues.
The final draft report submitted for consideration to the GGE by the German Chair reflected these exact approaches unacceptable to Russia, so we did not support it. In unison with us, many other members of the Group – our BRICS and CIS partners, as well as a whole number of other states, including developing ones – spoke against the adoption of that version of the report.
China also reportedly rejected Paragraph 34 of the draft final report, questioning the applicability of self-defence, counter-measures and the law of armed conflict.Footnote 47 Yet, it has not published any official statement on its position.
The impossibility of the last UN GGE to reach a consensus and to adopt a final report has been analysed on the basis that some countries – namely China, Cuba and Russia – had changed their approach and were no longer recognising the applicability of international law to cyberspace and cyber operations. It seems, however, that they have not altered their approach. On the contrary, by questioning the applicability and application of specific norms of international law, they clearly imply that international law is applicable. This is reinforced by the fact that some states, including Russia and Cuba, are calling for the adoption of an internationally binding instrument to address these matters.Footnote 48 Similarly, the BRICSFootnote 49 Leaders Xiamen Declaration, adopted at the 2017 BRICS Summit on 5 September 2017, shows clearly the attachment of the BRICS states, thus including China and Russia, to the applicability of international law to these matters:Footnote 50
We consider the UN has a central role in developing universally accepted norms of responsible state behavior in the use of ICTs to ensure a peaceful, secure, open, cooperative, stable, orderly, accessible and equitable ICT environment. We emphasize the paramount importance of the principles of international law enshrined in the Charter of the United Nations, particularly the state sovereignty, the political independence, territorial integrity and sovereign equality of states, non-interference in internal affairs of other states and respect for human rights and fundamental freedoms. We emphasize the need to enhance international cooperation against terrorist and criminal misuse of ICTs, reaffirm the general approach laid in the eThekwini, Fortaleza, Ufa and Goa declarations in this regard, and recognize the need for a universal regulatory binding instrument on combatting the criminal use of ICTs under the UN auspices as stated in the Ufa Declaration.
In that sense, this situation may be analysed in a similar way to the question of the consequences that violations of norms of international law entail for the existence of these norms. In the Nicaragua case, the International Court of Justice (ICJ) stated:Footnote 51
If a State acts in a way prima facie incompatible with a recognized rule, but defends its conduct by appealing to exceptions or justifications contained within the rule itself, then whether or not the State's conduct is in fact justifiable on that basis, the significance of that attitude is to confirm rather than to weaken the rule.
In the case of the 2016–17 UN GGE, the opposing states are not violating norms of international law but rather are challenging the way in which these norms apply. As in the situation set out by the ICJ, their opposition may be perceived in a similar way as an illustration of the weakening of the rules, as they challenge their applicability. However, from this observation as well as the dictum of the ICJ, despite the American stance on the failure of the 2016–17 UN GGE, I would contend that the opposition of some states to Paragraph 34 should not be interpreted as a weakening of the relevant norms. On the contrary, the opposition of these states, and the statements of the Cuban and Russian participating experts, demonstrate the adhesion of these states to the existence of these norms. Indeed, the position of these states consists mainly of asking for more time to identify how these norms may apply and to identify relevant state practice before going further in enshrining their interpretation regarding cyber activities. These positions, although frustrating in the context of the UN GGE process and its past success, should not be overly interpreted in a negative sense as they demonstrate the vigour of the interpretation process on the application of international law to cyber activities.
The 2016–17 UN GGE did not reach a consensus; yet it cannot be portrayed as a complete failure. On the contrary, it is a clear demonstration of the strength of international debate on these issues. Temporary blockages and failures are part of the normal negotiating process in developing and adopting norms. By framing their discussions and negotiation within this framework, it is also clearly demonstrated that states recognise that international law applies to cyber conduct.
3.2. From Discussions between Like-minded States to Fragmentation of International Law
The failure of the 2016–17 UN GGE shows that states do not share the same approach regarding the application of norms of international law. Despite the fact that only a few states took part in the process and sent governmental experts, as a UN-level forum of discussion the UN GGE was thus a universal forum. Following the failure of the last meeting in June 2017, several states – mainly those that were willing to go further in the negotiation and adoption of norms of behaviour and confidence-building measures – are calling to continue the discussion between like-minded states.Footnote 52
This situation may be challenging for international law and international stability as it bears a clear risk of fragmentation of the international legal order.
The fragmentation of international law relates to various types of fragmentation.Footnote 53 Two major types can be identified: (i) functional fragmentation, resulting from the diversification of norms and the development of specialised legal regimes to accompany the expansion of international law;Footnote 54 and (ii) geographical fragmentation as the scope of application of numerous norms of international law is not universal. In other words, alongside universal norms of international law, there are a growing number of norms that are applicable only regionally or to a few states. These two types of fragmentation concern both the substance and the procedure of international law.
The failure of the 2016–17 UN GGE and the potential continuation of the discussion between like-minded states may lead to geographical fragmentation of the international law applicable to cyber operations. Geographical or regional fragmentation is not negative per se. In the present case, however, the relevant norms (counter-measures, self-defence and jus in bello) are universal norms and are considered to be norms of jus cogens for some of them. Thus, they are normally not subject to geographical fragmentation.
It is important to have regional and bilateral discussions as small groups of states may share more common interests. Like-minded states are already discussing and going further in norm-building processes, mainly at the regional level. Still, it is necessary to maintain a universal forum to discuss this matter,Footnote 55 maybe in a less developed manner, at the international level in order to avoid fragmentation in the interpretation of existing norms and in the development of soft law.Footnote 56 It is crucial that states discuss universally, and mainly among non-concurring states, the interpretation and concrete application of norms of international law. Indeed, if cyber operations between states are now part of the daily life of the international community, large-scale cyber operations that trigger the invocation of specific norms of international law – such as self-defence, counter-measures or those of jus in bello – are more likely to take place between non-concurring states rather than between like-minded states. Indeed, in the case of a cyber confrontation between the United States and Russia, for instance, geographical fragmentation could lead to different interpretations of relevant universal norms, leading to a level of uncertainty which could jeopardise international stability. It is thus necessary to keep the discussion going in order to develop a common interpretation of the application of these norms in relation to cyber conduct.
More recently, the international community moved one step closer to the risk of fragmentation during the 73rd session of the UN General Assembly in 2018. The General Assembly adopted two resolutions following the failure of the 2016–17 UN GGE. The first, ‘Developments in the Field of Information and Telecommunications in the Context of International Security’,Footnote 57 was proposed by 31 states, including China and Russia, and was adopted by a vote of 119 in favour to 46 against, with 14 abstentions. The second resolution, ‘Advancing Responsible State Behaviour in Cyberspace in the Context of International Security’,Footnote 58 was proposed by 36 states, including the United States and European states, and was approved by a vote of 138 in favour to 12 against, with 16 abstentions. The votes show that most of the member states voted for both resolutions.
The two resolutions call for the creation of a process to follow up on the past UN GGE processes. Resolution 73/266 requests the UN Secretary General to establish a new UN GEE, while Resolution 73/27 adopts a novel approach and decides to convene an open-ended working group. Interestingly, both projects are articulated on the results of the previous UN GGE, and both recognise that international law, and in particular the UN Charter, is applicable to cyberspace on the basis of the 2013 and 2015 reports of the UN GGE. Resolution 73/266 does not go further on international law, while Resolution 73/27 adds some developments and details some applicable principles of international law.
Having two parallel processes discussing the application of international law to cyberspace, initiated by two different groups of states with divergent approaches on the application of some norms of international law, will contribute to the risk of geographical fragmentation described above.
3.3. The Increasing Role of Non-State Actors in International Lawmaking and Norm-Building Processes
States are the primary members of the international community and the traditional subjects of international law. The Peace of Westphalia led to the creation of an international legal system in which states are at the same time the law makers and the law takers, as summarised perfectly by Math Noortmann and Cedric Ryngaert:Footnote 59
The difference between those who ‘make’ the law, those who determine and enforce the law and those who ‘take’ the law is generally considered to be a formal distinction, which is exclusively determined by the constitutional characteristics of the legal system in question. As a rule, law-takers outnumber law-makers. The international legal system has been the traditional exception to that rule: states were at the same time the exclusive law-makers and law-takers in an exact ratio of 1:1.
States are, however, no longer the only subjects of international law. Using international law, they decided to create numerous international organisations,Footnote 60 which, being a creation of international law, are also subjects of international law, and are therefore at the same time law makers and law takers.Footnote 61
The international lawmaking process is generally a process of state diplomacy and practice.Footnote 62 Alongside the traditional subjects of international law, numerous non-state actors – such as non-governmental organisations (NGOs), multinational enterprises, national liberation movements and other types of group – are increasingly involved in, and influencing, international relations as well as, to some extent, processes of international law norm-building.Footnote 63 This is also true regarding cyber norms.
On the questions relating to the application of international law to cyberspace and the development of cyber norms, several non-state actors have appeared to be particularly active – notably the Global Commission on the Stability of Cyberspace (GCSC) and the multinational company Microsoft. It is important to point out at this stage that these various norms have not yet been endorsed by states and should not be regarded as soft law. However, they constitute proposals and initiatives that contribute to the dynamism and evolution of the discussions of these issues.
The GCSC was initiated by two think tanks – the Hague Centre for Strategic Studies and the EastWest Institute – and ‘comprises 25 prominent commissioners representing a wide range of geographic regions as well as government, industry, technical and civil society stakeholders with legitimacy to speak on different aspects of cyberspace’.Footnote 64 Its objective is to propose cyber norms and in November 2017 it issued a ‘Call to Protect the Public Core of the Internet’.Footnote 65 The work of the GCSC includes aspects relating to international law, notably regarding the interpretation of specific norms of international law.Footnote 66
Microsoft is probably the most active and influential non-state actor in respect of these matters. In 2015 it proposed a series of norms of behaviour for states,Footnote 67 which were reviewed and completed in a new report published in 2016, which proposed cyber security norms of behaviour for both states and the global information and communications technology industry.Footnote 68 These soft law proposals have little to do with traditional hard law norms of international law. More interestingly, Microsoft, for the last few months, has been developing and promoting two proposals related to international law: (i) a Digital Geneva Convention,Footnote 69 and (ii) the creation of an international mechanism for the attribution of cyber operations.Footnote 70 With regard to the Digital Geneva Convention, Microsoft proposes the adoption of an international treaty aimed at ‘[protecting] civilians from state-sponsored cyber attacks. Given that the main intention of the last Geneva Convention (1949) was to protect civilians and non-combatants during warfare, this call to action—a Geneva 5.0—is both timely and welcome’.Footnote 71
Various formats have been contemplated for an international mechanism for the attribution of cyber operations,Footnote 72 including the creation of an intergovernmental organisation, although the option of an NGO now seems to be favoured. Microsoft has asked the RAND Corporation to assess its proposal for an international mechanism; the results of this research were published in 2017.Footnote 73
We will not elaborate any further on the work and proposals of the GCSC and Microsoft, but this brief introduction reveals the vitality and active role of non-state actors. It must be highlighted, however, that the recent failure of the UN GGE, and thus the current blockage in the interstate multilateral discussions, may leave more space for non-state actors and thus reinforce their participation in, or at least their influence on these issues.
3.4. Soft Law Rather than Hard Law
During the last few decades, states have demonstrated their lack of interest over the development of new legally binding norms of international law as well as, to some extent, their objection to existing norms. They appear particularly reluctant to adopt a multilateral norm-building process, such as the adoption of a new multilateral treaty.Footnote 74
Cyber norm-building processes are taking place in this particular context. International practice has shown that states recognise the applicability of international law to cyberspace and cyber operations, but discussions have become more complicated and problematic when discussing how to interpret and apply specific norms in this new context, as demonstrated by the failure of the 2016–17 UN GGE.
State practice on the regulation of cyber operations also shows that states are more inclined to discuss non-binding norms than those of a legally binding nature. This is true at the UN level, as the successive UN GGE recognised the applicability of international law and the UN Charter, but then focused mainly on adopting norms of behaviour and confidence-building measures. Thus the UN GGE is producing mainly soft law. A few of these non-legally binding norms are the reflection of binding norms, providing an expression on how they should be interpreted. However, most norms are completely new and disconnected from existing binding norms, and thus are disconnected from the question of the application of norms of international law to cyberspace and cyber operations.Footnote 75 The same observation can be made about ongoing processes in other international organisations and other fora, such as the Organization for Security and Co-operation in Europe (OSCE) or the G20. Similarly, the International Code of Conduct for Information Security proposed by the member states of the Shanghai Cooperation Organisation (SCO) in 2011Footnote 76 and 2015Footnote 77 were also non-binding instruments. It is worth noting, however, that these two codes of conduct focused mainly on the interpretation of international lawFootnote 78 rather than on the creation of soft law norms.Footnote 79
The objective of this section was to highlight the fact that states seem to favour the adoption of non-binding norms over those of a binding nature on the regulation of cyber operations. This situation may be somewhat challenging for existing norms of international law as well as for its future development in this field. Indeed, such a situation may lead states to neglect existing norms of international law and thus weaken the scope of application of these norms in the future. This situation and its consequences should be considered within the general evolution and development of soft law, on which extensive literature exists.
3.5. Concluding Remarks on the General Challenges to International Law
The failure of the fifth UN GGE in June 2017 should not be overestimated and may not constitute the end of the road, as expressed by the Russian representative:Footnote 80
However, we are convinced that such an outcome of the Group's work does not mean that this track is no longer effective. The history of the GGE has already seen breaks when a USA representative vetoed one of the draft reports (decisions within the Group are made by consensus). Despite that, three substantive reports in a row were adopted subsequently.
The first UN GGE also failed to adopt a report, yet the process restarted after a few years. In that sense, one may wonder whether the failure of the last UN GGE will follow the same path in the near future. International relations and international lawmaking are not linear processes; the failure and slowing down of procedures are normal events, and thus they should not be overestimated.
Following these observations, I contend that states should consider the opportunity to dissociate the discussions regarding the applicability and application of norms of international law from the political discussions, including those on norms of behaviour and confidence-building measures. The process of building non-binding norms should remain an exercise in interstate diplomacy, while the question of the interpretation of international law could be submitted to an objective international body, such as the ILC of the United Nations. The ILC was created by the UN General Assembly in 1947,Footnote 81 with the aim of promoting ‘the progressive development of international law and its codification’. The ILC does not comprise governmental experts, unlike the UN GGE, but of ‘persons of recognized competence in international law’.Footnote 82 States have already agreed on the applicability of international law in general and we saw earlier in this article why international law applies. Consequently, the current question relates to the analysis of how norms of international law apply; in other words, it is a question of interpretation which could be performed by the ILC.Footnote 83
4. International Law is not a Panacea: Challenges to Specific Norms of International Law Arising from Cyberspace
After having discussed the applicability of international law and the main challenges affecting its application in general, the last section of this article focuses on some challenges that affect specific norms of international law. This section highlights the limits of these norms in the context of cyber threats. Three main challenges are identified and developed in this section: (i) the problem of attribution, notably regarding cyber operations conducted by non-state actors on behalf of states; (ii) the remedies available for the victim state of cyber operations; and (iii) the non-territorial dimension of cyberspace. It is important to note that this section is not exhaustive and the issues developed here are only some of the numerous challenges that may affect the application of norms of international law to cyber activities.
4.1. Attributing the Cyber Conduct of a Non-State Actor Acting on Behalf of a State to the Latter
Attribution refers to the process of attributing an act or conduct to its perpetrator. In other words, it aims to answer the question ‘who did it?’. State-sponsored cyber operations, generally coined as ‘cyber warfare’, constitute a real challenge for international security and international law. One of the main issues is the extreme difficulty and sometimes impossibility, at least to date, of identifying with certainty the perpetrators of cyber operations, either individuals or state agents, and to determine whether their conduct is attributable to states or other subjects of international law.
The majority of cyber operations generally alleged to be state-sponsored have not, in fact, yet been clearly attributed to a state. Notable examples are the DDoS (Distributed Denial of Service) attacks against Estonia, the cyber operations against Georgia in the context of the Russo-Georgian armed conflict, and the malware Stuxnet. In most cases where attribution has been possible, it was because the state in question claimed responsibility for the cyber operation, which was the case when Iran admitted to hacking an American drone (RQ-170) in 2011.Footnote 84 It must be noted, however, that since the hacking of Sony Pictures Entertainment, which was attributed to North Korea by the United States,Footnote 85 there has been an increasing practice by some states to attribute cyber operations to other states publicly – notably to Russia, China and North Korea.
The state is an abstract entity. Thus, it can act only through the medium of one or more persons, who are considered for the purpose of attribution to a state as the means by which the state acts. The attribution of cyber operations to states cannot be studied without addressing questions of the attribution of cyber conduct to computers or individual perpetrators. Indeed, the process of attribution is at the same time legal, factual and technical.Footnote 86 Attribution to a machine from which the cyber operation was prepared, launched or transited, or a person, is based mainly on technical and forensic methods, while attribution to a state is based mainly on international law and factual evidence.Footnote 87 It is clear that international law cannot resolve the technical problem of attribution. Attribution of a cyber operation to a state depends on the available factual evidence, and thus it may depend on the identification of the machine or the responsible individual. It is, however, important to note that each of these three dimensions is distinct and independent, and it is sometimes possible to identify the responsible state even without any knowledge of the machine or individuals involved in the perpetration. This would be the case, for instance, when a state is able to attribute the cyber operation because its intelligence services intercepted communications on the perpetration of the cyber operation from the responsible state.
Cyber operations conducted by state organs, entities empowered to exercise elements of governmental authority or organs placed at the disposal of a state are attributable to the state, even when they are ultra vires.Footnote 88
These situations do not really challenge the law on the attribution of cyber operations, and thus will not be further developed in this article.
Private individuals, acting alone or in groups, are increasingly involved in state activities. The fact that the acts are conducted from the territory of a stateFootnote 89 or conducted by citizens of a state is not sufficient reason to attribute these acts to the state.Footnote 90 In certain circumstances, however, the conduct of individuals is attributable to the state: notably if they act under the instructions, direction or control of the state, if they use public power in the absence or default of the state, and finally if the state subsequently endorses their conduct.Footnote 91
State-sponsored cyber operations are often conducted by non-state actors. This situation triggers the question of attribution and, in particular, how to attribute their conduct to the state. First, it is undisputed that the rules on state responsibility governing attribution apply to cyber conduct in so far as international law applies to the activities of states in cyberspace.Footnote 92
The ICJ, the International Criminal Tribunal for the former Yugoslavia (ICTY), and the ILC have followed different approaches to the attribution of the conduct of non-state actors when operating under the direction, instructions or control of a state. In the Nicaragua case, the ICJ applied two different tests to assess the degree of control of a state over a non-state actor: the ‘strict control’ test and the ‘effective control’ test. The first test determines whether the non-state actor is a de facto organ of the state. The second is a subsidiary test when the agency relationship of the first test cannot be proved.Footnote 93 The ‘effective control’ test is generally considered to be a stricter approach for the purpose of the attribution of acts conducted by non-state actors under the instructions, direction or control of the state. The ICJ has followed the same reasoning in two steps – first, the ‘strict control test’ and, second, the ‘effective control test’ – in its subsequent jurisprudence.Footnote 94
In Tadić, the Appeals Chamber of the ICTY adopted another approach: the ‘overall control’ test.Footnote 95 This approach is generally considered to be looser and more flexible than the ‘effective control’ test developed by the ICJ in the Nicaragua case.Footnote 96
The ILC Articles on State Responsibility also address the attribution of acts to a state for the purpose of state responsibility. Article 8 adopts the three alternative criteria of ‘instructions’, ‘direction’, and ‘control’, which differ from the Nicaragua and Tadić tests.
I argue that, in some cases, the degree of control required by the ICJ, the ICTY and the ILC might amount to an excessively high threshold to be applicable and relevant to the use of new technology.Footnote 97 At the same time, one should also be wary of lowering the threshold too far. Reflection is thus needed in order to define the most appropriate threshold to cater for attribution in cases of cyber operations. The following paragraphs discuss the two principal reasons underlying this situation: the first concerns the use of the internet in general, which is not concerned solely with cyber operations; the second centres on cyber operations.
First, the internet offers the easiest way to coordinate activity with a lesser degree of organisation. The cyber operations conducted in 1998 by various actors in support of the Zapatista Army of National Liberation (ZANL) clearly illustrate this point. The Electronic Disturbance Theater (EDT), a group of cyber activists established in 1997 in the United States, and the Anonymous Digital Coalition (ADC), a group of political activists from Italy, conducted cyber operations against the US and Mexican governments in support of the ZANL. They not only conducted these operations, but they also designed them, made an online tool (FloodNet) available to conduct them, and called on any interested individuals to participate in their online actions. These actions were well coordinated with a low degree of organisation.Footnote 98
This example illustrates how an entity, which can be a state, can easily coordinate cyber operations, and involve non-state actors in these actions, without necessarily having a very high degree of control over them. The state might then have a sufficient degree of control to achieve its goals without the risk of being held legally responsible for these acts, given the very high threshold that is required for attribution.
Secondly, cyber operations offer an easy means to act and to incentivise others to act. For instance, ‘arming and training’ means the physical delivery of weapons and the sending of agents to train individuals on how to use these weapons. In cyberspace, the same objective can be achieved with more ease. Would the posting online of ready-to-use malware or software for the conduct of cyber operations, such as FloodNet, amount to ‘arming’ the final users? This crude comparison between actual arming and training and cyber arming and training might seem far-fetched, but the end result could easily be the same. Indeed, ‘training’ might be carried out through online instruction. This example illustrates how analogous situations in the real world and in cyberspace might end up having divergent legal qualifications and effects.
Finally, lack of cooperation between states is an important challenge for the question of attribution involving any kind of cyber operation, and a fortiori when it concerns alleged state-sponsored operations. In most cases, the information and evidence required to identify the computers and individuals involved, as well as any sponsoring state, might be located in a foreign country. The identification and attribution processes depend on the goodwill and cooperation of the foreign state. In the case of Estonia, for instance, the country made unsuccessful requests in seeking Russia's legal cooperation to assist with the identification of the perpetrators of the 2007 cyber attacks.Footnote 99 No Russian perpetrators were thus identified; the only perpetrator identified was an Estonian, Dmitri Galuškevitš, who acted from Estonian territory and thus the Estonian authorities were able to gather evidence that led to his identification and conviction.Footnote 100 Lack of cooperation constitutes an important challenge for the attribution of cyber operations.
The difficulty, if not the impossibility, in attributing the majority of cyber operations explains why cyber international law constitutes a favourable ground for the principle of due diligence. This principle is an obligation of conduct on states not to knowingly allow the use of their territory for the perpetration of acts contrary to the rights of other states.Footnote 101 The principle applies to cyber activities.Footnote 102 Accordingly, states are under a duty both to prevent the use of cyber infrastructure and to take all feasible and reasonable measures to terminate cyber operations emanating from or transiting through the computer networks located in their territory.
4.2. Remedies
A state that is injured by a cyber operation sponsored by another state may be entitled to invoke the responsibility of the sponsoring state and to seek reparations for the damage caused.Footnote 103
According to the law of state responsibility, the responsible state bears the obligation to cease its wrongful cyber operations and is obliged to make full reparation for damage caused. The injured state should first ask the responsible state to comply with its obligations. The injured state, if the responsible state does not comply, may have recourse to judicial and extrajudicial processes for the implementation of the obligations of the wrongdoing state – namely self-help measures of retorsion, counter-measures and self-defence.Footnote 104 It is worth remembering that cyber and non-cyber measures may be mixed; it is possible to respond to a cyber operation with non-cyber measures and vice versa.
Generally, the literature covering self-help and cyber operations focuses on self-defence. The conclusion that most cyber operations fall short of an armed attack has led some scholars to consider alternatively the possibility of counter-measures as a response to state-sponsored cyber operations.Footnote 105 I contend that the approach should be reversed, and counter-measures should be considered the primary and preferred form of self-help against cyber operations.Footnote 106 This would then mean that self-defence is considered only in exceptional cases. The argument is not that self-defence should be totally discarded, but applying it as a primary form of remedy should be avoided. Only in some limited cases might self-defence constitute the best, if not the only, option available to the victim state of a cyber operation. This argument is based on the assessment that the vast majority of cyber operations remain below the threshold of the use of force; therefore, they do not constitute armed attacks, and thus do not entitle the victim state to invoke self-defence. Consequently, the most cyber operations would constitute is unlawful behaviour but not an armed attack, and thus the victim state would have recourse only to counter-measures and measures of retorsion against the responsible state.
In a large number of cases, however, international law may not be able to offer an appropriate solution to the injured state. This is, first, because of the problem of attribution, as previously analysed, and the fact that most state-sponsored cyber operations conducted by non-state actors may be particularly difficult, if not impossible, to link to the sponsoring state. Second, there is the difficulty of assessing the intensity of a cyber operation, and thus of determining what would constitute a necessary and proportionate response. Third, the immediacy and necessity requirements may be challenged by the speed of cyber operations. All these observations may explain why, in most cases, states have refrained from publicly attributing cyber operations, even if we can observe an evolution on this perspective. More importantly, it may also explain why, to date, no state has ever publicly invoked counter-measures or self-defence in response to state-sponsored cyber operations, preferring publicly announced retorsion measures, such as the enforcement of sanctions and removal of diplomats. For instance, in both the hacking of Sony Pictures Entertainment in 2015 and the hacking of the Democratic National Congress in 2016, the United States attributed these actions to another state – respectively, North Korea and Russia – and affirmed that the actions constituted internationally wrongful acts. Thus, the United States would have been entitled to have recourse to counter-measures against the responsible states. In both cases, the US government affirmed that it will adopt a ‘proportional response’,Footnote 107 but the public responses were only measures of retorsion (removal of diplomats and adoption of new sanctions). However, in both cases, the US is believed to have adopted covert responses that may constitute counter-measures. It is, indeed, undoubtable that in some cases states have adopted responses in the shadows and in what is perceived as a grey area of international legality. This situation proves to be particularly challenging for international law.
Cyber operations offer an effective means to target and harmfully affect a state without crossing the threshold of the prohibition of the use of force, and a fortiori without crossing the threshold of an armed attack. Thus, counter-measures and retorsion would be the only two available forms of self-help measures available. In addition, the various requirements of the law on state responsibility lead to an understanding that cyber counter-measures would be the more effective and the only available form of self-help measure to respond to state-sponsored cyber operations. However, states are far from equal in terms of cyber capabilities, with two important consequences. First, even if the victim state is entitled to take cyber counter-measures, the asymmetry in terms of cyber capacities between itself and the attacking state may leave it helpless. Consequently, and second, unlike self-defence, it is impossible to adopt collective counter-measures; thus a state with limited cyber capacities cannot seek assistance from other states.
These last observations lead to a twofold challenge. First, the victim state may be unable to adopt self-help measures despite being entitled by international law to do so. Second, this may also lead states to favour covert cyber responses, taking place in the shadows and perceived grey area of international legality.
4.3. The Territorial Dimension of Cyber Activities
The development of the internet has led to the interconnection of computer systems located all over the world, regardless of state boundaries. A cyber operation launched from the territory of one state may transit via the territory of various states before reaching the territory of the targeted state.
This specificity appears to be particularly challenging for the interpretation and application of certain norms of international law. This is especially true regarding states’ territorial sovereignty and due diligence. There is no ‘cyber territory’ of states as it is a fictional environment, relying on infrastructure located in various territories. Thus, a state exercises its sovereignty over the infrastructure and people located in its territory or under its effective control. The question of the extent of the territory and sovereignty of the state is therefore irrelevant. Rather, the question is what constitutes a violation of the territorial sovereignty of a state and what constitutes a use of its territory for the purpose of due diligence.
Various approaches exist, in both the academic literature and the approach of states, on whether a cyber operation may constitute a breach of territorial sovereignty. There are three main views on this question. First, any cyber operation that penetrates a foreign system constitutes a violation of sovereignty.Footnote 108 Second, a cyber operation that penetrates a foreign system constitutes a violation of sovereignty only if it meets a threshold of harm. This is, for instance, the approach adopted in the Tallinn Manual 2.0Footnote 109 and by the United States.Footnote 110 Third, territorial sovereignty cannot be breached by a cyber operation unless it constitutes a violation of the principle of non-intervention. This is, for instance, the British approach.Footnote 111
The launch of a cyber operation from the territory of a state would clearly qualify as a use of its territory; in such a situation, therefore, the targeted state would be entitled to invoke the obligation of due diligence of the territorial state. Similarly, the state in the territory of which a cyber operation produces its harmful consequences may be entitled to invoke the violation of its territorial sovereignty. Accordingly, does the mere transit of malware via a computer infrastructure located in the territory of a state constitute a violation of its sovereignty and a use of its territory?
The development of information and communication technologies also offers effective tools for governments in their relations and interactions with their populations as well as the populations of other states. This is particularly true when it comes to surveillance activities. This situation, notably in the context of mass surveillance, questions the applicability and application of human rights and, more precisely, it creates important questions on the ongoing controversy relating to the extraterritorial applicability and application of human rights.
5. Conclusion
The applicability of international law to cyberspace and cyber operations has been settled in both state practice and the academic literature. Consequently, the question has now become ‘what is the specific interpretation and application of the norms of international law in this challenging context?’ This question has been tackled by various initiatives, such as the UN GGE and also the Tallinn Manual process sponsored by the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE), which led to the adoption of the two editions of the Tallinn Manual published in 2013 and 2017.Footnote 112
The present article had a different objective. Indeed, it did not aim to answer this question but rather to provide an overview of the key points relating to the questions of the applicability and application of international law to cyberspace and cyber operations. It consisted of three parts, corresponding to the three stages of the analysis.
The first part analysed the applicability of international law to cyberspace. It demonstrated why this was a non-question as cyberspace does not constitute a new legal domain, and it highlighted the irrelevance of referring to the models of specialised regimes of specific areas such as the law of the sea, air law, or even space law. This first part concluded that the question should be reversed, and thus we should query whether anything prevents international law from applying to cyberspace. To me, the answer is negative, as nothing prevents the applicability of international law.
The second part extended the analysis on the applicability of international law by investigating four important challenges that affect this question. The main challenge is the failure of the last UN GGE and thus the current blockade at the UN level. This article demonstrated, however, that the failure of the UN GGE should not be overly interpreted in a negative sense. It also analysed the risk of geographical fragmentation of the applicable norms, the increasing role of non-state actors in norm building, and finally state preference for soft law over hard law.
The third part discussed the application of specific norms of international law to cyber operations and showed that despite the applicability of international law to cyberspace and cyber operations, it does not constitute a panacea for two reasons: first, because several norms of international law are challenged in their applicability either by the specific features of cyberspace or by state practice; and, second, international law offers only a partial solution to the questions raised by the cyber activities of states and it cannot resolve every dispute arising between states on these matters.
The title of this article queries whether the application of the norms of international law to cyber operations leads to the reinterpretation of, or constitutes a form of contestation of international law. From the observations made in this article, I contend that despite some limited and probably temporary disputes, the development of cyber activities is leading mainly to a phenomenon of the reinterpretation of the norms of international law. This conclusion concerns exclusively the consequences of the development of cyberspace and is without prejudice to the observation of more general phenomena of contestation. As mentioned in the introduction, some norms of international law are facing phenomena of contestation in general, which also affect these norms in their application to cyberspace.
