Russian Cyber Operations. Scott Jasper
practitioners, and researchers, albeit primarily through Western perceptions, who called themselves the International Group of Experts. The aim of the Tallinn Manual 2.0 is to place existing international law, known as lex lata (the law as it exists), pertinent to cyber operations into statutory form.20 Rule 68 of the Tallinn Manual 2.0 decrees that “a cyber operation that constitutes a threat or the use of force . . . is unlawful.”21 The Cyber Act of War Act of 2016 introduced to Congress mirrors the US administration’s evaluation of a cyber operation “in terms of the use of force rather than acts of war.”22 It specifically asks the president to determine when an action in cyberspace constitutes an act of war by considering which effects may be equivalent to “an attack using conventional weapons, including with respect to physical destruction or casualties.”23 Harold Koh, a legal adviser at the Department of State, made this same correlation in 2012 by stating, “In analyzing whether a cyber operation would constitute a use of force, most commentators focus on whether the direct physical injury and property damage resulting from the cyber event looks like that which would be considered a use of force if produced by kinetic weapons.”24
Koh explained that if a cyberattack created the same physical consequences caused by dropping a bomb or firing a missile, that cyberattack should equally be considered a use of force.25 Likewise, the US Department of Defense (DOD) Law of War Manual delineates that cyber operations may constitute a use of force within the meaning of Article 2(4) if they “cause effects that, if caused by traditional physical means, would be regarded as a use of force under jus ad bellum,” the law of war governing the resort to force.26 Such cyber operations include those that “(1) trigger a nuclear plant meltdown; (2) open a dam above a populated area, causing destruction; or (3) disable air traffic control services, resulting in airplane crashes.”27 In addition, cyber operations that “cripple a military’s logistics systems” would qualify as a use of force,28 although “not every use of force rises to the level of an armed attack” according to the International Court of Justice.29
Michael Schmitt, who served as the general editor of the Tallinn Manual 2.0, says that while “it is clear that every an armed attack must at least amount to a use of force,” consistent with the approach of the International Court of Justice, “only the gravest uses of force are armed attacks.”30 Therefore, the qualification of a cyber operation as an armed attack “requires the resulting harm, or the harm that is intended to result, to reach a certain threshold of severity.”31 That threshold is measured in the scale and effects of the cyber operation. The International Group of Experts agreed that “a cyber operation that seriously injures or kills a number of persons or that causes significant damage to, or destruction of, property would satisfy the scale and effects requirement.”32 In contrast, they also concluded that cyber operations for intelligence gathering or theft, as well as cyber operations that “involve brief or periodic interruption of non-essential cyber services, do not qualify as armed attacks,”33 although Schmitt argues that states will treat cyber operations “with very severe consequences, such as the targeting of the state’s economic well-being or its critical infrastructure as armed attacks to which they are entitled to respond in self-defense.”34
Article 51 of the UN Charter demarcates “the inherent right of individual or collective self-defense if an armed attack occurs against a Member of the United Nations.”35 The charter also recognizes the inherent right of states to use force in self-defense—which is a just cause for military action,36 though many constraints on self-defense exist. Rule 72 of the Tallinn Manual 2.0 declares, “A use of force involving cyber operations undertaken by a State in exercise of its right of self-defense must be necessary and proportionate.”37 Necessary implies that a use of force is needed to repel an imminent or ongoing attack. Proportionate limits the “scale, scope, duration and intensity” of the response.38 Once an armed attack is over, the right of self-defense ceases. However, if the victim state concludes that “its attacker intends to conduct further cyber operations at the armed attack level,” it may treat the operations as “an ongoing campaign against which it may take defensive action at any point.”39
Cyber operations that qualify as an armed attack certainly constitute an “internationally wrongful act.” However, numerous cyber operations that fall below the threshold of armed attack in this category of acts are unlawful. Rule 14 of the Tallinn Manual 2.0 defines an internationally wrongful act as “an action or omission that both (1) constitutes a breach of an international legal obligation applicable to that State; and (2) is attributable to the State under international law.”40 The first condition for a breach of an international legal obligation “may consist of a violation of a State’s treaty obligations, customary international law, or general principles of law.”41 Prominent examples of relevant customary norms that constitute internationally wrongful acts “are respect for sovereignty (Rule 4), the prohibition of intervention (Rule 66), and the prohibition of the use of force (Rule 68).”42 Rule 4 delineates that whether sovereignty has been violated by remote cyber operations depends on “two different bases: (1) the degree of infringement upon the target State’s territorial integrity; and (2) whether there has been an interference with or usurpation of inherently governmental functions.”43 Rule 4 explains that the first is based “on the premise that a State controls access to its sovereign territory . . . and the second on the sovereign right of a State to exercise within its territory ‘to the exclusion of any other State, the functions of a State.’”44
In regard to what degree of infringement qualifies as a violation of sovereignty, the majority of the International Group of Experts agreed on “damaging operations, including those that interfere in a relatively permanent way with the functionality of the targeted cyber infrastructure.”45 For cyber operations that do not result in physical damage or the loss of functionality, some experts were willing to characterize violations of sovereignty from cyber operations “causing infrastructure or programs to operate differently; altering or deleting data stored in cyber infrastructure . . . and causing a temporary, but significant, loss of functionality, as in the case of a major DDoS [distributed denial of service] operation.”46 The International Group of Experts could not definitively define the second basis on which a violation of sovereignty occurs “when one State’s cyber operation interferes with or usurps the inherently governmental functions of another State.”47 While some functions are obviously inherently governmental, such as the conduct of elections, diplomacy, and national defense activities, the range of other functions is less clear.48
The second condition required to establish the existence of an internationally wrongful act is equally problematic to determine—namely, that the conduct in question must be “attributable to the State under international law.”49 The element of breach has sometimes been described as “objective” and the element of attribution as “subjective.”50 The standard for breach is irrelevant of state organs or agents, whereas attribution necessitates intention or knowledge of state organs or agents.51 In the clearest case, attribution is “when State organs, such as the military or intelligence agencies, commit the wrongful acts.”52 Cyber operations conducted by a person or group of persons are attributable to a state when “acting on the instructions of, or under the direction or control of, that State in carrying out the conduct.”53
In response to “a breach of an international legal obligation that it is owed by another State,” Rule 20 of the Tallinn Manual 2.0 says, “A State may be entitled to take countermeasures, whether cyber in nature or not.” Countermeasures are “measures which would otherwise be contrary to the international obligations of [an] injured state . . . if they were not taken . . . in order to procure cessation and reparation.”54 In the cyber context, countermeasures “often represent an effective means of self-help by allowing the injured state to take urgent action that would otherwise be unavailable to it, such as ‘hacking back,’ to compel the responsible state to cease its internationally wrongful cyber operations.”55 Examples could include