2.1. Expertise and the politics of international law

The politics of international law today, Martti Koskenniemi wrote some three years ago, is ‘often a politics of re-definition, that is to say, the strategic definition of a situation or a problem by reference to a technical idiom so as to open the door for applying the expertise related to that idiom, together with the attendant structural bias’.Footnote ¹³ The Tallinn Manual on Cyberwarfare provides a good example of Koskenniemi's point. The project was initiated by NATO, chaired by a professor from the US Naval College, and carried out by a group of experts in military affairs and conflict and security law. Not surprisingly, the Manual exclusively deals with cybermatters in terms of applicable jus ad bellum and jus in bello, taking the reader through an endless list of possible topics that could potentially be relevant for the legal assessment of cyberwar, including what look like slightly exotic topics such as the protection of medical and religious personnel, levée en masse (making the reader wonder what that would look like in cyberspace . . .) or the abuse of the UN emblem.Footnote ¹⁴

While the list of topics studied under the rubric of conflict and security law is lengthy indeed, the report is of course also limited in that it focuses on those areas of law that are of specific interest for NATO (thus leaving aside other possibly relevant areas such as human rights, lex digitalis, criminal law, or international economic law). The framing of cyberspace in terms of conflict and security law is partly the result of a longer-term process wherein states and international organizations have focused on (potential) threats that emanate from the world of cyber. At the same time, discussing problems in cyberspace through the lens of conflict and security law reconstitutes the very nature of the topics under consideration. Cyberoperations become ‘uses of force’, ‘self-defence operations’, ‘aggression’, or ‘armed attacks’ while agents are reconstituted as ‘combatants’ and ‘civilians’. The Tallinn Manual is thereby also exemplary of the central topic for this symposium as identified by the editors’ introduction, the co-constitution of legal expertise and their objects. Rather than standing ‘in-between the production and application of knowledge’ as a well-known definition of expertise would have it,Footnote ¹⁵ legal experts are products and co-producers of their object of study and advice.Footnote ¹⁶ As a result, the Tallinn Manual can be read in two ways. First, as the product of a longer trend in which the object of ‘cyber’ is phrased and constituted in terms of ‘uncertain threats’ to which military responses could (or should) be considered (section 2.2 below). In this sense, the socially constructed object of cybersecurity constitutes specific groups of individuals as experts. Second, as an attempt to absorb the uncertainties surrounding cyberwar through legal reasoning and the application of rules (section 2.3), an attempt that, as we will show in section 3, paradoxically solidifies some of the uncertainties surrounding the application of existing law to cyberwar.

2.2. Uncertainties of cyberspace

In order to obtain a sense of the social construction of cyberspace as an area of insecurity and unpredictability,Footnote ¹⁷ it is useful to remember that cybersecurity has a history that goes back at least to the mid-1970s, when distant access for entering programs and data became possible and when cybersecurity already became part of the US national security agenda.Footnote ¹⁸ In its over-35-year history, the debate and dominant images have shifted.Footnote ¹⁹ We do not want to reiterate the history of cybersecurity itself, but rather point to three distinct sources of uncertainty: (i) the blurring of previously believed solid distinctions like public and private; inside and outside; (ii) the (alleged) novelty of cyberthreats, including the difficulties in attributing them to actors; and the (iii) lack of historical experience and reliance on analogies and metaphors.Footnote ²⁰

First, cyberthreats trespass the classic confines of public international law. For example, in the aftermath of the Oklahoma City bombing in 1995, the debate on cybersecurity in the US moved from the hackers and foreign intelligence to critical infrastructure. In the aftermath of the bombing, President Clinton set up the Presidential Commission on Critical Infrastructure Protection that presented its results in 1997 and made clear that modern societies depend on the functioning of critical infrastructures like electricity, telecommunication, or financial services. Its report on ‘Critical Foundations: Protecting America's Infrastructure’Footnote ²¹ opened by making clear that:

Critical infrastructure protection showed that threats do not fit into traditional categories such as the distinction of private/public, as the providers of those infrastructures now find themselves to be part of a security discourse. The classic distinction between public and private actors consequently gets blurred when, for example, energy providers find themselves to be part of a security discourse. In addition, critical infrastructure protection shows that contemporary threats are linked to the very characteristics of the infrastructures over which the state does not have complete control. Apart from the necessary inclusion of other actors in the security discourse, these security threats do not emanate from ‘outside’ one's own territory. This means that the classic distinction between inside and outside upon which classic legal categories are based is called into question.Footnote ²³ As an answer to these uncertainties, the report called for proactive measures, as:

The second source of uncertainty relates to the difficulties of identifying the agents responsible for cyberattacks (or what were sometimes called acts of ‘cyber-terrorism’).Footnote ²⁵ This can be illustrated by the classical examples of Estonia (2007) and Georgia (2008)Footnote ²⁶, Iran (2010), or the Red October virus. In all these cases there was not only doubt as to whether the attacks constituted examples of espionage, intervention, the use of force, or an armed attack in the legal sense; there were also questions whether the attacks could be (legally) attributed to an identifiable agent.Footnote ²⁷

After Estonian officials decided to relocate a memorial of the Soviet liberation from the Nazis, a cyberattack paralysed the entire Estonian infrastructure on 30 April. Additionally, many official Internet sites became temporally unavailable (a distributed denial of service (DDoS) attack). There were strong indications that the attack originated from Russia, but there was no solid proof of the source of the attacks.Footnote ²⁸ Additionally, during the Georgian war in 2008, several DDoS attacks on Georgian websites were reported; again there were indications but no definite proof that a state-sponsored agent was responsible for the attack. The debate shifted considerably with the discovery of Stuxnet in June 2010. Stuxnet was a worm that was initially targeted at Siemens supervisory control and data acquisition systems (STADA) and was employed to sabotage the Iranian nuclear programme. Rumour suggested that US and Israeli intelligence were behind this attack.Footnote ²⁹ Yet rumours and articles in mass media are not considered evidence in the legal sense. Again, it proved hard to trace down the origin of a virus. And even if the originator is found, it could be a private company or a specific individual, with all the problems that arise in terms of attribution and state responsibility under international law.Footnote ³⁰

A third example is the debate surrounding the virus called ‘Red October’.Footnote ³¹ Red October was active for over five years, operational in over 60 countries, and able to extract classified information.Footnote ³² It used computers and mobile phones from embassies, government agencies, multinational corporations, nuclear and military sites, and research centres around the globe.Footnote ³³ The virus traced data that was encrypted with specific codes (like Acid Cryptofiler, which is used by the EU and NATO) and was controlled by a chain of over 60 so-called command-and-control (C&C) servers. This chain makes it, given current knowledge, impossible to trace down the origin of the virus, or to identify its mastermind. It was unclear what the virus tried to do, what the information was for, and who wanted to accomplish what with the virus. If cyberspace allows for new ways to hide or even erase origins, then this makes any simple ‘translation’ into the legal vocabulary of ‘attribution’ virtually impossible.

The third source of uncertainty relates to the lack of historical experience: there is a widespread consensus in the literature that – Stuxnet notwithstanding – there simply has been no incident of a cyberwar that inflicted the widespread devastation and damage usually associated with ‘war’. If we associate war with severe damage and a significant number of dead bodies, then this has simply not yet happened. Of course, the Georgian war was flanked by cyber attacks, but the cyber attacks themselves did not create severe enough damage to legitimize the use of the concept of ‘war’. Footnote ³⁴ Assessing the legality of responses to cyber attacks thus remains to a large extent a matter of speculation and hypothetical reasoning. In this context it is quite telling that imminence and urgency are created through analogies like ‘electronic Pearl Harbor’ and not through historical reconstructions. The Tallinn Manual also attests to this by pointing out that ‘no international cyber incidents have, as of 2012, been unambiguously and publicly characterized by the international community as reaching the threshold of an armed attack’. Yet although a cyberwar appears to be unlikely – given the necessary means and the expected damage it could produce – cybersecurity is meanwhile regarded to be as important as other areas of security. In this context it is important to note that issues of cyberspace are increasingly discussed in terms of a ‘preventive logic’. Footnote ³⁵

2.3. Uncertainty and legalization

With the imaginaries of cyberspace in terms of danger, risk, and uncertainty in place, the framing of the issues relating to cyberspace in the Tallinn Manual did not come as a surprise.Footnote ³⁶ The experts had to apply existing law to an object that had already been imagined in terms of unpredictability and danger for more than a decade. In that sense it was the object that to a large degree determined the applicable law: if analogies can be drawn to Pearl Harbor, it becomes almost a matter of course to assess cyberspace in terms of conflict and security law. In addition, questions regarding the applicability of international law to the phenomenon of cyberspace had been raised repeatedly: was it possible to frame the issue of cyberwar in established terms such as ‘state responsibility’, ‘use of force’, ‘armed attack’, ‘military object’, and ‘combatant’? In this sense the Tallinn Manual can be seen as an attempt to define and constitute the object in terms of the legal expertise involved.

However, there is by definition a tension between framing issues in terms of danger, threats, and insecurity, and attempts to define objects in terms of pre-existing rules and principles. A successful presentation of cyberspace as a realm of insecurity, uncertainty, and threats to critical infrastructure almost naturally comes with resistance to a legalistic ethos that seeks to subject political decision-making to general and pre-given rules.Footnote ³⁷ The logic of uncertainty and prevention that characterizes many security policies on cyberspace sits uncomfortably with the idea that decision-making should be based on pre-existing legal norms and principles.Footnote ³⁸ The logic of legalism, by contrast, is one of recourse to a system of rules ‘out there’ that can be applied to matters at hand.Footnote ³⁹ A legalistic approach attempts to define matters as subject to the normal operation of rules: although sometimes the creativity of legal minds is called for, it is possible to define the world in terms of the pre-given standards, rules, and principles that law provides. The Tallinn Manual operates within this tension, with an object that for over a decade has been defined as potentially dangerous, irregular, and requiring action based on a logic of prevention and risk; and at the same time the ambition to apply pre-given rules of positive conflict and security law. The text takes the reader through all the well-established known categories of the UN Charter and humanitarian law, making admirable efforts to apply the normalcy of law to the irregularity of dangers emanating from cyberspace. Seen in this light, the ambition of the Manual is almost breathtaking. In the words of the chairman of the Tallinn group of experts, Michael Schmitt, the idea behind the Tallinn Manual was not ‘to bring a bunch of lawyers together . . . who appear to impress the audience by telling how truly hard cyber is’.Footnote ⁴⁰ What about, Schmitts wonders, ‘if we start answering the questions?’Footnote ⁴¹ In other words: the idea behind the Manual was answering questions that the newly constituted object of cyberwar produced, in terms of positive international law. Below we will turn to the way in which the group of experts asserted its own authority to tackle the ambitious task of defining cyberwar in terms of existing international law.

3.1. The question of authority and the composition of the expert group

The use of expert knowledge is generally meant to provide a specific form of legitimacy or authority for certain interpretations, decisions, or arguments (or, of course, to undermine their authority). The legitimacy bonus of expert knowledge is derived from two somewhat contradictory elements. On the one hand, expert knowledge consists of an impersonal validity claim; for expert knowledge to work, it should present itself as independent of the personal preferences of the expert in question. If an expert fails to convince an audience that the knowledge she produces is independent of her personal likes or dislikes, her claim to expertise will most likely fail. On the other hand, the power of expert knowledge is rooted in the specific position and reputation of the expert in question.Footnote ⁴² It is not just any person making a validity claim; it is persons who have specific skills, knowledge, and experience who make the claim. In this sense it matters a great deal whether one person or the other is attempting to produce expert knowledge.

The ambiguous basis of expert knowledge is also visible in the Tallinn manual. The Manual takes great pains to set out that it is not meant to represent the position of states or international organizations on the law applicable to cyberwar. Instead, it sets out to explicate existing international definitions, rules, and principles of law as they can be found in established sources of international law. The long and impressive list of legal sources and authorities included in the very beginning of the report attests to this. Although the Manual acknowledges that different interpretations are possible (and openly discusses differences of opinions throughout the report), its claim to validity is thus based on pre-given sources such as treaties and customary law.Footnote ⁴³ The claim of the report, in other words, is that anyone following the proper methods of international law would come to (more or less) the same results. At the same time, the report cannot but acknowledge that it has specific origins as well as a geographical bias. In addition to the international legal sources that allegedly enjoy validity for all states, the report heavily draws on the military manuals of four states (Canada, Germany, the United Kingdom, and the United States), because ‘the international community generally considers these four manuals to be especially useful during legal research and analysis with respect to conflict issues’.Footnote ⁴⁴ The wording is chosen carefully in order to prevent the manuals of four NATO states being put on a par with primary legal sources that bind all states alike: the manuals are considered ‘especially useful’, not a direct source of authority. Yet, the way in which primary legal sources are to be read and applied in context can be inferred from the four manuals, because ‘the international community’ apparently finds them useful in legal research and analysis. In this way, the four manuals are injected with global authority that transcends their geographical, political, and cultural boundaries.

Given the history of the laws of armed conflict international law (and international law in general), it is somewhat remarkable to see that the Manual moves seemingly smoothly from the opinions of a few Western states to the ‘international community’ as a whole. As Megret has noted, international humanitarian law today is still closely tied to nineteenth-century, Western images of legitimate statehood and the corresponding understandings of international law's nature and function. Whereas most international lawyers will see the function of humanitarian law primarily as regulating warfare, ‘the realist, the underdog or the anti-colonialist might well all tell a different story, one in which the role of the laws of war is above all to reinforce the state's unshakeable stranglehold and express the dominant consensus about the state's incontrovertible legitimacy’.Footnote ⁴⁵ Now it would certainly be far-fetched and unfair to label the Tallinn Manual a product of neo-colonialism. However, it is interesting to note that it does encounter problems that are not dissimilar to the ones raised in postcolonial scholarship.Footnote ⁴⁶ The close ties between conceptions of statehood that prevailed in the nineteenth century and international law's understanding of war also make it difficult to make sense of operations taking place in and through cyberspace, operations that are increasingly portrayed as trespassing established legal boundaries.

However, the report does not only ground its validity claims in legal sources. It also invokes the specific position and reputation of the experts involved in order to convince the audience.Footnote ⁴⁷ Take, for example, the way in which the report grounds its conclusions regarding the validity and scope of customary international law: ‘Ultimately, the professional knowledge, experience, and expertise of the Experts form the basis for the Tallinn Manual's conclusions as to the customary status of a Rule or its extension into non-international armed conflict’.Footnote ⁴⁸ The authority of the report is thus grounded not only in sources of international law, but also in the trust we should have in the professional knowledge, expertise, and experience of Experts (with capital E). The report explicitly underlines this by stating that the group of experts is composed of experienced practitioners, ‘world-class expert’ academics, and technical experts: a mix that ‘is crucial to the credibility of the final product’.Footnote ⁴⁹

In this context it is important to underline the way in which the experts were selected. The process started with an invitation of the NATO Cooperative Cyber Defense Center of Excellence to Michael Schmitt, asking him to put together a group of experts that could start answering questions regarding the applicability of international law to matters of cyberwar. As such, the fact that Michael Schmitt was invited to chair the group of experts for the NATO Center is not very surprising. Schmitt had acted as a member of expert committees before,Footnote ⁵⁰ is chair of the international- law department at the US Naval War College, and is the author of some innovative and widely quoted articles on cyberwarfare.Footnote ⁵¹ Schmitt's earlier work on cyberwar – and on international humanitarian law in general – combined two elements that fitted the idea of a manual on the applicability of international law to cyberwar particularly well. First, Schmitt had repeatedly argued that existing international law covers new developments in military technology, although the application of law to new problems may require the craftsmanship and creativity of professional lawyers. According to Schmitt, issues such as drone warfare or cyberwar do not take place in a legal vacuum but in a pre-existing system of rules whose exact meaning can be established through legal interpretation.Footnote ⁵² What is needed, therefore, is not the adoption of new legal instruments (as some have argued) but the (re)interpretation of the international legal framework already in place. Or, as Schmitt has put it in an interview with ABC News: ‘Let's be honest. Everyone has treated the Internet as a sort of Wild West, a lawless zone. But international law has to be just as applicable to online weapons as conventional weapons’.Footnote ⁵³ Second, his work is based on the (widely shared) assumption that international law is ultimately made, applied, and enforced by states.Footnote ⁵⁴ This statement is echoed in the Manual's repeated assurances that the experts by no means create new rules of international law, but only state and clarify what states had already agreed on. More specifically, Schmitt had taken the position that international humanitarian law ‘must remain sensitive to the interest of states in conducting warfare efficiently’; a position that made it more likely that his chairmanship would prevent the adoption of guidelines that were far removed from the will and interests of the NATO states.Footnote ⁵⁵

The invitation to Schmitt came with a blank cheque: he was given as much money as he needed and complete freedom to design his own group of experts.Footnote ⁵⁶ There will be few people doubting that the group that Schmitt eventually composed contained highly competent lawyers, technical experts, and practitioners. At the same time, however, the group reflects a geographical biasFootnote ⁵⁷ and does not include critics of the positions earlier adopted by the chair. The Manual itself also remains silent about the criteria that were used to select the most relevant ‘professionals, technical experts and world class academics’. Given the relatively underdeveloped nature of the international legal discipline in terms of journal ranking and impact assessment, it is probably virtually impossible to set any fixed criteria for who counts as world-class academics and who allegedly operates at a different level. Yet, the selection of experts is very important in light of the statement that the group of experts has sought to ‘capture all reasonable positions for inclusion in the Tallinn Manual's Commentary’.Footnote ⁵⁸ The implicit argument that is made here is that legal positions not mentioned in the Manual are apparently ‘unreasonable’ in the eyes of the experts. Anyone who would like to bring such ‘unreasonable’ arguments to the fore will have to argue against the authority of the assembled experienced practitioners, ‘world-class expert’ academics and technical experts.

The mere fact that an internationally constituted group of experts manages to present consensus on some legal issues is likely to be taken up as a powerful signal in the popular press, in academia, and in political circles. In the case of the Tallinn Manual, its findings were presented in the media as a ‘new doctrine’ with possibly dangerous implications,Footnote ⁵⁹ as an ‘attempt at codification’ and a ‘handbook’,Footnote ⁶⁰ as ‘the likely key reference’ when states would decide to adopt rules for conflict in cyberspace,Footnote ⁶¹ or as ‘in short . . . the new rules of war for a new type of war’.Footnote ⁶² In addition, the Manual was embraced by one of NATO's legal assistants as ‘the most important document in the law of cyber-warfare’.Footnote ⁶³ While it is too early to tell how the Manual will or will not affect the position of states, it is interesting to note that the chair of the expert groups has already made an attempt to portray the findings of the Tallinn Manual as basically reflecting the opinio juris expressed by the United States. According to Schmitt, the opinio juris of the US could be deduced from a public speech on international law and cyberspace by US State Department Legal Advisor Harold Koh.Footnote ⁶⁴ The congruence between the US position and the Tallinn Manual, Schmitt argues, ‘is striking. This confluence of a state's expression of opinio juris with a work constituting “the teachings of the most highly qualified publicists of the various nations” significantly enhances the persuasiveness of common conclusions’.Footnote ⁶⁵

Now, as may be expected, the experts did not reach consensus on all legal issues, and, in particular, not on some foundational questions of jus ad bellum and jus in bello. Given the potential impact of the Manual it is important to study the possible consequences of such a failure among experts to produce consensus on the application and interpretation of rules. As has been observed in relation to scientific expertise, a lack of consensus can eventually be detrimental to the authority claims put forward by experts and expert committees.Footnote ⁶⁶ In this context, it is possible to identify at least two different ways in which experts can fail to produce clear consensus on the scope and interpretation of rules.

In the first place, expert reports can produce ‘officially notified disagreement’ in cases where experts have irreconcilable views on the best way to read particular provisions. When experts disagree on the reading of a rule, this sends a signal to legal and political communities that experienced and knowledgeable experts acknowledge that different and maybe even contradictory interpretations are all reasonable. While this reduces complexity because not all positions are recognized as acceptable, it also officially stamps the existence of uncertainty surrounding international legal rules. Anyone now claiming that (s)he knows with certainty that a rule should be applied in a particular way, can be confronted with the existence of a lack of consensus between reputable experts on the application of the very same rule (‘who are you to claim that you know better than the experts who could not agree?’). In this context, it is interesting to note that the Tallinn Manual also critiques the ICRC expert study on direct participation in hostilities, with some experts arguing that the ICRC interpretation of what constitutes ‘direct’ participation ‘makes little operational sense’.Footnote ⁶⁷ Also within the Manual itself, opposing views are presented, for example, when it comes to fundamental issues such as the applicability of the laws of armed conflict. As the Manual makes clear, experts disagree on the conditions of applicability of the laws of armed conflict and could not reach consensus on the qualification of the Stuxnet attack against Iran in 2010.Footnote ⁶⁸ Similarly, the Manual officially presents disagreement between experts on the definition of an armed conflict,Footnote ⁶⁹ the territorial limitations to the laws of armed conflict,Footnote ⁷⁰ and the distinction between international and non-international armed conflicts.Footnote ⁷¹

Second, experts can reach consensus that a rule is too underdetermined to draw any definite conclusions regarding its concrete application. Such an official presentation of underdeterminacy weakens the position of anyone claiming that the rule should be read and applied in a particular fashion. Below, we will give one more elaborate example of the way in which the Tallinn Manual officially stamps uncertainty regarding international legal rules: the interpretation of the prohibition on the use of force (section 3.2). The prohibition on the use of force is generally considered as one of the cornerstones of the UN framework, and of post-1945 international law in general.Footnote ⁷² At the same time, the precise meaning and scope of Article 2(4) remains unclear and subject to much controversy. The Tallinn experts were thus called to apply an undetermined, yet pivotal, provision of international law to the field of cyberspace.

3.2. Use of force

One of the core questions in relation to cyberattacks is whether – and under what conditions – they can qualify as ‘uses of force’ as prohibited by Article 2(4) of the UN Charter and international customary law. From the outset, the Tallinn Manual makes clear that the capacity to deal with cyberattacks via Article 2(4) is limited, since the prohibition on the use of force is directed to states only. Cyberattacks by non-state groups are therefore beyond the scope of this prohibition, unless they can be attributed to a state.Footnote ⁷³ However, even if it were possible to attribute a cyberoperation to a state, it would still be difficult to determine whether this operation actually qualifies as ‘force’ under Article 2(4). Absent a definition of ‘force’ in international law, those who are bound to interpret and apply the term need to makes use of interpretative strategies such as analogies and teleological and systematic understandings. This is exactly what the Tallinn Manual does when linking the prohibition on the use of force to cyberoperations.

First of all, it applies by analogy the ‘scale and effects’ test that the International Court of Justice used in Nicaragua to determine whether an intervention constitutes an ‘armed attack’ giving rise to self-defence. While the Manual accepts the difference between the terms ‘use of force’ and ‘armed attack’,Footnote ⁷⁴ it regards the ‘scale and effects’ criterion as useful to distinguish ‘acts that qualify as uses of force from those that do not’.Footnote ⁷⁵ This test, however, still leaves much room for interpretation when applied to concrete situations. While the Manual acknowledges this,Footnote ⁷⁶ it also makes an unusual attempt to reduce the uncertainty surrounding the scope of the prohibition on the use of force. The Manual states that ‘the International Group of Experts took notice of an approach that seeks to assess the likelihood that States will characterize a cyberoperation as a use of force’.Footnote ⁷⁷ What follows in the report is a list of factors that states could take into account, factors that are taken from an article by the chairman of the Tallinn group of experts written some 14 years ago.Footnote ⁷⁸

At first sight, it may seem that the inclusion of this list of factors helps to reduce uncertainties regarding the application of the prohibition on the use of force to cyberoperations. In its current formulation, however, it is more likely that the inclusion will produce the opposite effect: it officially stamps the uncertainties surrounding the scope of the prohibition in the context of cyberattacks. This is not just because the factors themselves are unavoidably phrased in language that still leaves room for different interpretations. There are three more fundamental reasons why the report reintroduces uncertainty through its invocation of expertise.

First, the status of the factors themselves remains highly uncertain. They are clearly not presented as reflective of the opinio juris of states and are not derived from the established sources of international law. Instead, they are presented as empirical in nature, as ‘factors that influence States making use of force assessments’.Footnote ⁷⁹ However, the factors are not derived from empirical research either. Instead, they follow from a more intuitive approach spelled out in earlier academic articles by the director of the group of experts, Michael Schmitt. The validity of these criteria, in other words, rests on the intuition, experience, and professionalism of its members, more than on independent sources that provide independent backing. This raises the question why states would follow these intuitions regarding the factual behaviour of states when confronted with normative questions regarding the scope of application of the prohibition on the use of force. States should do so, the Manual argues, because they ‘must be highly sensitive to the international community's probable assessment of whether operations violate the prohibition on the use of force’.Footnote ⁸⁰ This, however, only raises the question regarding the nature of the factors identified. Should states take them into account because they already have normative force, as they reflect opinio juris? Or should states do so out of self-interest, because they will otherwise run the risk of adverse consequences? Or should the factors be regarded as an attempt to seduce states to start developing customary law along the lines suggested by the Manual? And irrespective of the answers to these questions, why would states follow recommendations not based on empirical or normative research, but on the intuition of experts?

Second, the factors themselves are quite radically relativized in the Manual. The Manual argues that the factors are not to be taken as exhaustive and that states ‘depending on the circumstances may look to others, such as the prevailing political environment, whether the operation portends the future use of military force and the identity of the attacker, any record of cyberoperations of the attacker’.Footnote ⁸¹ By bringing in the political environment, risk assessments, and conjectures as to the status of the attacker, the Manual quite explicitly moves legal considerations into the realm of political deliberation and contextual analysis. Rather than providing pre-given criteria against which political actions can be assessed, the Manual makes the scope of the prohibition on the use of force dependent on unspecified circumstances such as the ‘prevailing political environment’. Indeed, this may very well be a correct empirical analysis. However, as parts of an expert group on international law it reads as an official stamping of the radical uncertainties that surround one of the cornerstone provisions of the UN Charter.