By Mahendra Singh
The involvement of cyber warfare from a theoretical possibility to an imminent threat has put a challenging task to international law experts. The cyber-attack on the servers of Sony Pictures Entertainment and cyber incursions by Pakistani hackers on the Kerala government’s website are a few such incidents. The alleged malicious North Korean operation destroyed data, exposed personal data, and made highly embarrassing emails public. Some experts called the attack on Sony’s servers an ‘act of war’ while others termed it as mere ‘interference’ with the servers. These cyber exploitations have drawn attention to the dilemma of harmful trans-border state and non-state cyber operations against government and private cyber infrastructure.
Academicians and practitioners have tried to analyse cyber operations reaching the threshold of armed attack violating international law. But little attention has been paid to cyber operations which do not rise to the level of an armed attack, and instances where cyber infrastructure located on a state’s territory is used by non-state actors (such as hacker groups, individual hackers, organized armed groups, or terrorists) to mount the operations—and whether the victim state has any remedy under international law, and if yes, what? This question has, for reasons to be explained, become ripe for serious consideration.
The author suggests that the international community has begun to foresee ways to regulate cyber-attacks rising to the level of “cyber warfare” and thus implicate the law of armed conflict; however, this legal regime does not regulate cyber harm that does not reach this threshold, but is nonetheless significantly harmful and may be governed by traditional international law principles. Further, the article discusses the protection measures available and the limitations to those measures under international law.
Law of State Responsibility
The responsibility of states for internationally wrongful acts is governed by the International Law Commission’s articles on state responsibility, which have developed into customary international law. The articles lay down that an internationally wrongful act committed by a state entails responsibility for the same. An internationally wrongful act exists when:
- It is attributable to a state under international law.
- For responsibility to attach to the act of the state, the conduct must constitute a breach of an international legal obligation.
Where the cyber operation is carried out by an organ of state or directed or controlled by the state, then there is no need to prove the responsibility of a state. However, in the case of acts undertaken by non-state actors, a state is responsible if it had directed or controlled it, acknowledged the actions of non-state actors, or failed to prevent the execution of the attack.
Complexity in Establishing State Responsibility
Cyber operations not carried out by state organs are difficult to attribute to a particular state, mitigating the chances of responses by an aggrieved state. Complexity in attribution arises when a cyber-operation is carried out by non-state actors, in determining whether the cyber operation was carried out “under the direction or control” of the aggressor state. The issue of ascertaining who is responsible for a cyber operation is a tricky one. More often than not, there are really no more than suspicions and allegations on who is behind the attack. These suspicions are based on the circumstances under which the attack was carried out and the nature of the attack. The author suggests that when express attribution is not established, however, if the origin country of the cyber operation is known, in that case also, responsibility can be attributed to a state.
Principle of Due Diligence
Express participation is not the exclusive means by which a state may have breached its international obligation. International law recognizes the principle of ‘due diligence.’ Though mainly applied in the international environmental law context, the principle of due diligence is also applicable in the cyber context.
The principle of due diligence was recognized in the Trail Smelter arbitration, which held that “a state owes at all times a duty to protect other states against injurious acts by individuals from within its jurisdiction.” Later, the International Court of Justice addressed the same in the Corfu Channel Case, when it stated, “it is every State’s obligation not to allow knowingly its territory to be used for acts contrary to the rights of other States.”
The Tallinn Manual on the International Law Applicable to Cyber Warfare, which is a rulebook on norms related to cyber warfare, restates the law. The appropriate legal analysis for attributing responsibility for the actions of non-state actors to states rests upon the degree of ‘due diligence’ or ‘negligence’ exhibited by the sovereign. In other words, the state would not be held responsible for the act itself, but would rather be held accountable for failing to fulfil a legal obligation that would have prevented the attendant harm. However, in the absence of any international consensus on the norms for cyberspace, it would be very difficult to determine whether a state had performed adequate ‘due diligence’ or taken appropriate measures to avert harm in cyberspace.
Attack on Non-State Actors and Violation of Territorial Sovereignty
Cyber operations are frequent on the servers of private entities. Some scholars believe that even if any cyber operation is conducted on the servers of a private entity within the territory of another country, it amounts to a violation of the territorial sovereignty of the injured state.
The International Court of Justice in the Island of Palmas Arbitral Award defined ‘sovereignty’ as “sovereignty in the relations between states signifies independence. Independence in regard to a portion of the globe is the right to exercise therein, to the exclusion of any other state, the functions of a state.” Further, the Tallinn Manual on Cyber Warfare states that a cyber-operation directed against cyber infrastructure located in another state may violate the latter’s sovereignty.
Noted Professor Michael Schmitt states that it would seem reasonable to characterize a cyber-operation involving the manipulation of cyber infrastructure in another state’s territory or the emplacement of malware within a system located therein as a violation of territorial sovereignty. Thus, it is clear that even if no physical damage is caused by the cyber operation, it still violates the territorial sovereignty of the victim state.
Countermeasures in International Law
The principle of reciprocity—i.e., returning like behaviour with like—is a central feature of international law, a system with no external enforcement authority other than its own members. Article 51 of the UN Charter enshrines the ‘right of self-defense,’ however this right is strictly circumscribed to cases of an “armed attack.” For harms that do not meet the standard of an ‘armed attack,’ the right of self-defense cannot be exercised. However, a state may resort to countermeasures in response to an attack or harm, which are considered lawful methods to enforce compliance. The law relating to countermeasures can be applied to cyber operations as well.
The ILC Articles place two primary requirements for countermeasures against a wrongful act: ‘Necessity’ and ‘Proportionality.’ Thus, countermeasures adopted against a cyber-operation must satisfy these two primary tests to be termed as lawful.
- Test of Necessity: The measures must be necessary in the circumstances to counter the attack. The plea of necessity can be invoked to protect a wide variety of interests, including safeguarding data and information. The interest must be threatened by a ‘grave and imminent peril’ which is to be objectively established. Moreover, the actions must be the only way available to safeguard the interests. In circumstances where the wrongful act has ceased, general international law does not permit a state to take countermeasures. However, state practice shows that countermeasures can be taken after the wrongful act has ceased. Thus, in order to resort to countermeasures, a state must objectively establish the necessity of its actions. In the case of Sony, the US was legally entitled to take countermeasures to bring North Korea into a state of lawfulness and to cease its actions.
- Test of Proportionality (Magnitude and Form): As per customary international law, countermeasures must be commensurate and proportional to the injury suffered, taking into account the gravity of the internationally wrongful act and the rights in question. A countermeasure which is disproportional to the injury suffered is considered unlawful. While the ascertainment of proportionality is essentially an approximation, it must take into account not only the quantitative elements of the injury but also qualitative aspects like the gravity of the breach committed. Countermeasures which do not have a punitive aim, but are instead taken to induce compliance by the wrongdoing state, are proportionate and lawful in nature. However, a state cannot be allowed to do any act which is more harmful in nature or causes loss beyond what is required in the circumstances.
Conclusion
National cyber defense strategies are unlikely to be effective in regulating cross-border cyber harms due to technological hurdles, political realities, and the very nature of the internet. Absent any regulatory mechanism, cyber operations are likely only to increase in frequency and severity. While most scholars have assumed this behaviour to be outside the ambit of public international law, this article has offered an account of how international law can govern cross-border cyber-attacks.
Significant harm done to a state’s intellectual property should be viewed as “transboundary cyber-harm” and can be analysed under traditional international legal principles, including the due diligence obligation to prevent significant harm to another state’s territorial sovereignty, as translated to modern realities. It is clear that cross-border cyber operations not reaching the threshold of armed attack or use of force may still provide a right to remedial measures. Further, in addition to any national defense strategy or mechanism, private corporations may be allowed to rely on defensive hack-backs to repel cross-border incursions on their networks.