Law Commons^™

In Defense Of Pure Sovereignty In Cyberspace, Kevin Jon Heller

International Law Studies

States currently endorse three different positions concerning the international wrongfulness of cyber operations that penetrate computer systems located on the territory of another state but do not rise to the level of a use of force or prohibited intervention. The first position is that such low-intensity cyber operations are never wrongful, because sovereignty is a principle of international law, not a primary rule that can be independently violated. The second is that low-intensity cyber operations are always wrongful, because sovereignty is a primary rule of international law that is violated by any non-consensual penetration of a computer system located on …

The Plea Of Necessity: An Oft Overlooked Response Option To Hostile Cyber Operations, Louise Arimatsu, Michael N. Schmitt

International Law Studies

States are increasingly focused on the measures—cyber or otherwise—that they can take in response to hostile cyber operations. Although cyber operations are usually responded to with acts of “retorsion” (acts that are lawful, although unfriendly), international law recognizes other self-help mechanisms that allow for more robust responses. In the cyber context, most attention has focused on countermeasures and self-defense. Yet, both are subject to various limitations that constrain their availability.

This article examines a further option, the so-called “plea of necessity.” It allows States to respond to a hostile cyber operation when the action taken would otherwise be unlawful but …

Cyber Attribution And State Responsibility, William Banks

International Law Studies

We might expect international law to specifically address cyber attribution requirements due to the significance of attribution in framing the legal responsibility of States and the boundaries of responsive actions by victim States. However, there is little international law of cyber attribution, and what law there is exists largely by implication. Likewise, there is only a murky and highly contested law of State responsibility that theoretically constrains the vast majority of State-sponsored cyberattacks. Because victim States cannot engage in countermeasures unless they attribute a cyberattack to a State, attribution can serve simultaneously to constrain and empower victim States. However, the …

Neutrality And Cyberspace: Bridging The Gap Between Theory And Reality, Noam Neuman

International Law Studies

While there exists a broad consensus among States that international law generally applies to the cyber domain, particular views regarding the applicability of the law of neutrality have rarely been put forward, and presently there seems to be insufficient State practice and domain-specific opinio juris in this regard. Against this backdrop, several attempts have been made throughout the years to apply certain neutrality rules to cyberspace by referring to analogies from other domains. However, this legal regime provides an emblematic example of what the introduction of traditional rules of international law, formulated with the physical domains of warfare in mind, …

Foreign Cyber Interference In Elections, Michael N. Schmitt

International Law Studies

In the 2020 U.S. elections, Russia authorized and conducted influence operations designed to support former President Trump, although it did not attempt to alter any technical aspect of the voting process. Russia was not alone. Iran mounted a multi-pronged covert influence campaign intended to undercut Trump’s reelection prospects, while other foreign actors–like Lebanese Hizballah, Cuba, and Venezuela–also tried to influence the election. Interestingly, China did not conduct operations designed to alter the outcome, although it did consider doing so. The phenomenon of election meddling, however, extends well beyond the United States to such countries as Austria, Estonia, France, Germany, Hungary, …

Protection Of Data In Armed Conflict, Robin Geiss, Henning Lahmann

International Law Studies

This article presents a novel way to conceptualize the protection of data in situations of armed conflict. Although the question of the targeting of data through adversarial military cyber operations and its implications for the qualification of such conduct under International Humanitarian Law has been on scholars’ and states’ radar for the last few years, there remain a number of misunderstandings as to how to think about the notion of “data.” Based on a number of fictional scenarios, the article clarifies the pertinent terminology and makes some expedient distinctions between various types of data. It then analyzes how existing international …

Israel’S Perspective On Key Legal And Practical Issues Concerning The Application Of International Law To Cyber Operations, Roy Schöndorf

International Law Studies

The speech given by the Israeli Deputy Attorney General (International Law) at the Naval War College’s event on “Disruptive Technologies and International Law” sets out, for the first time, Israel’s position on the application of international law to cyber operations. Consistent with the position taken by the vast majority of States thus far, Israel considers that international law applies to such operations. The speech stresses that questions pertaining to the identification and application of relevant legal rules remain, given the profound differences between the cyber domain and traditional domains of warfare—land, sea, and air. Therefore, in Israel’s view, a cautious …

Responding To Hostile Cyber Operations: The “In-Kind” Option, Michael N. Schmitt, Durward E. Johnson

International Law Studies

Facing hostile cyber operations, States are crafting responsive strategies, tactics and rules of engagement. One of the major challenges in doing so is that key aspects of the international law governing cyber responses are vague, unsettled or complex. Not surprisingly, therefore, international law is markedly absent from strategies and operational concepts. Rather, they tend to take on a practical “tit-for-tat” feel as policymakers logically view “in-kind” responses as “fair play.” For them, responding in-kind surely must be lawful notwithstanding any challenges in discerning the precise legal character of the initial hostile cyber operation.

Testing that sense, this article examines the …