CyCon 2012 | Michael Schmitt: Tallinn Manual Part I

There's been a lot of talk about this manual in the corridors. I thought I would spend some time telling you about what has become known as the Tallinn Manual. About 3 and 1⁄2 years ago, I got a phone call from an Estonian named Anikin Tik asking me to come and speak at one of these conferences. She had been working with a friend of mine named Tom Wingfield. And my answer to her was, I'm not interested in coming to any more of those boring conferences on cyber. We bring a bunch of lawyers together, and they appear to impress the audience by telling the audience how truly hard cyber is. How about if we start answering the questions? Call me again if you're ever ready to begin answering the questions. Well, she's a very entrepreneurial type person, and I got a phone call a couple weeks later. And the phone call basically said, we at the CCD were ready to start answering these questions. We'll give you as much money as you need in order to answer the questions, and you can design your own group. And so what we did is, about three years ago, we set out, under the sponsorship of the Native Cooperative Cyber Defense Center of Excellence, to draft a manual on the law, the international law, applicable to cyber warfare. It's important to understand, as we talk about this, it's the most important point, that this manual is not a CCD COE product. Laurie, the director, is here, and he's just breathed a sigh of relief. Nor is it a NATO product. Nor, because I work for the Department of Defense, is this a Department of Defense product. This is a product that represents the personal views of the participants that were involved in the process, and nothing more. It's 20 or so smart people who got together that were tired of asking questions, and said, let's take a shot at answering some of these questions. So let me tell you about how we did that. This manual was not the first of its kind. You have heard the term San Remo Manual on the Law of Naval Warfare used several times. That was a 1995 project. Professor Dr. Von Heinegg, we'll find someone Heinegg, was instrumental in that. There was a NIAC manual that was put out also by San Remo that I did with Yoram Dinstein of Israel and Charles Garraway of the United States. And then most recently, there was a product that was called the AMW Manual, Air and Missile Warfare Manual, that was done by a group of 40 experts, and then ultimately drafted by myself, and Wolf, Von Heinegg, and Bill Boodby was involved in an outside way, but very instrumental. Jean-Francois Cunier from the ICRC, who's hiding in the back row, was one of the drafters. Arnie Dahl from Norway. We all got together, and we drafted the commentary. So we had a lot of experience in drafting these sort of manuals, and we were committed to the idea that this sort of manual would help. And so we wanted to do a new manual like those previous ones. It is a restatement of the law. It does not make law. There is no effort to progressively develop the law. This was an attempt to say, we now have cyber. How does the law of Bellum and Inbello, how does that body of law apply in the cyber context? We struggled a great deal with what we wanted to cover, and we felt that if we dealt with either domestic or international criminal law, we would be biting off more than we could chew. There are some areas in the manual that do not deal directly with Bellum, which I spoke about yesterday, or Inbello, which most of the speakers have spoken about today. But the main focus is Bellum, Inbello. How do we do this? Well, we had a lot of experience in the group. People like Wolf have been involved in all these projects, and myself. And so the very first thing we did was we gathered a group of five people here in Tallinn, and we said, what would the table of contents of such a manual look like? And we spent three days brainstorming just a table of contents. And then we spent a little time saying, who are the best people in the world that we think would form a cohesive group to attack these problems? Once we have identified what we thought the table of contents would look like, and I'll tell you a secret, the table of contents today does not look like that, because over three years, we've been thinking a lot. Oh, that is an issue. Oh, that's not an issue. But once we identified the initial table of contents, we contacted the experts and said, we'd like you to work with us for three years. We're not gonna pay you anything, but you can come to Tallinn in January, which is a very pleasant place then. The group, and what we did was we divided up the table of contents, and we gave each member of this group of experts that agreed to be in the project a list of topics. And we said, draft a black letter rule, what you think the law is, and then draft a commentary on that. All of the individuals came together into an initial plenary where we looked at the whole manual, and we kind of redesigned the manual based on the input, because we had experts that showed up and said, golly, you gave me this topic, but there's not much about this topic that I could think of. Sometimes we said, okay, it's out of the manual, and sometimes we said, you haven't been thinking hard enough, because I have an idea. So we struggled, and then we sort of refashioned this, and we sent everyone out to draft again. They provided drafts again, and then those drafts, and this was critical, those drafts were provided to a small group composed of members that did not include the person that drafted the stuff, the material, because what I learned in the AMW manual is that if a member drafted a piece of the manual, they felt that was their baby, and you just can't change it, because I got it right the first time. So we took control from the individual who did the draft, and we gave it to three or four other experts, and they worked as a team to either polish it, revise it, supplement it, and so forth. These products were brought back into the plenary, in other words, everyone, and then over a series of eight three and four day meetings, we worked on it. We focused mostly on what's called black letter, I'll show you that in a moment, because we wanted to make absolutely sure we got the law right. We talked about the commentary, which again, I will show you in a moment some sample commentary, but in the commentary, the goal was just to kind of paint the picture for some folks that would develop it later on, but we nailed down what the black letter looks like in plenary. Every black letter rule reflects the opinion of every single member of the group of experts. There's no member of the group of experts that objects to any statement of law that we have in there. After these sessions were met, we then broke into a smaller group called the Drafting Committee. It consisted of a number of people in this audience, Bill Boodby, Air Commodore Bill Boodby from the RAF then, now a private scholar, Professor Von Heinegg, myself, there were some other people that were involved and then moved on, Bruno Demmier, who's currently with the ICRC on the Geneva Conference. He was instrumental early on, Tom Wingfield from the Marshall Center. And then we had some technical experts that were part of the small drafting group because we knew we didn't understand cyber well enough to do it alone. They were instrumental, they were with us every step of the way. I will tell a quick story on myself. I spent the first year, this is horribly embarrassing, I'm the director of the world's major project on cyber law. I spent the first year thinking the cloud was like really up there, okay? I mean, I really did. I didn't think it was a cloud floating away. I didn't wonder when the cloud went by, is that where the cyber is? But I did think that there were like these waves like radios and then you just reach up and you grab them out of the sky. And then about a year into it, finally one of the techies who spoke some language that was incomprehensible to me finally got through to me and I went, oh, and it makes a huge difference, huge difference obviously in law because of the principle of sovereignty. So at any rate, they were with us and they kept us honest throughout. They explained when we were getting off track. That editorial committee review is pretty much finished now. We have sent that out to peer reviewers, select individuals who are experts in a particular area of the law. They have looked at that and provided us feedback. We've altered it and we will have a final plenary this July here in Tolland because it's a Tolland manual obviously and that's where the money is, Laurie. That final plenary is for the purpose of saying now, is everyone absolutely sure we got it right? Because we're going final. After that plenary, we'll make a few changes, mostly Professor Von Heineggen and I because we'll be working at the same place and then we will send it to Cambridge University Press. We will hang the manual on the CCDCOE website and any other website that wants to hang the manual. We're gonna do it at the War College and then it will come out with Cambridge University Press. My guess is in the December, January timeframe if they keep up with the schedule. Just wanted to show you the group of experts where this was critical because we needed to pick people. I've been through a number of these processes and listen, the most important rule is not to get the smartest people in the room but you wanna get people that can play well together because they're gonna be with each other for a long, long, long time. Robin is a member of the group. I mean, Robin and I like each other so when Robin says something to me, even if I think it's crazy, if I respond to Robin, Robin, that's ridiculous, you're a nut. He doesn't take offense and run from the room. He says, that's just Mike, let me rethink and then we have a discussion. So the number one criterion is to get people who were nice but fortunately, there were lots and lots and lots of brilliant, nice people around and so then we picked people who we knew were specialists in the field, who really knew IHL or the usad bellum in a very, very, very deep sense. We also wanted to pick people who had practical experience. We did not want this to be a group of eggheads exploring the mysteries of the International Law Commission's articles on state responsibility. So you will see people like Jen Bernatchos who spoke with you. She is the director of international law for the Canadians, for their military. So we wanted to get people who had been there, done that, have thought through these problems in a practical sense. Now, in addition to the group of experts, we had a group of observers, Jean Francois is in the audience. He was one of them early on. A group of observers because we wanted to have entities represented in the room that could provide realism to how our customers would react. And so the ICRC is a good example. No one knows humanitarian law better than the ICRC. Cyber Command, no one's doing this more than Cyber Command. ACT, sponsor of the CCDCOE. These folks participated in the process throughout. Fully has members of the group of experts except they did not get a vote. So when you see a black letter rule, that was adopted by every member of the group of experts, but not, for example, by U.S. Cyber Com. That is not U.S. Cyber Com's position. They don't have a position on this particular issue with regard to the manual, but they were instrumental throughout. Then we had a group of technical advisors. Rain, you've met many times here at the conference was one of them. Ken Gears is here at the conference who kept saying, listen, Mr. Potato Head, that's not the way the world works in cyber. And they've read the manual. They provided examples to us and so forth. And then after we finished, I mentioned we had peer reviewers. We went out to individuals who we thought had particular expertise, not in the overall subject, but in a particular area. I'll give the example of my friend Charles Garraway from the United Kingdom, who's a real expert in detention. So I said, Charles, can you look at the detention? Tell us, did we get it right? Have we missed anything? And so forth. There is a missing name, and this is more embarrassing than I can even describe, because among the peer reviewers, there was one that stood out because she actually worked with me in London and subsequently here in Tolland to polish parts of the manual, spent days and days doing this. And I forgot to put her name on the slide. And she happens to be sitting not in the audience, but at the table. So I was going, it was Louise, who, God bless her, was among the peer reviewers, clearly the giant. And so I apologize, Louise, for that. What are we looking at? We looked at most of the stuff addressed in the conference. Some issues that are not strictly ad bellum in bello in the beginning. Then we looked at ad bellum. Then we looked at in bello. And in in bello, we include the law of neutrality. So we have chapters on each of these subjects that are of varying length. Content, I've mentioned, it's customary international law. I emphasize that it is not lex lata, or I'm sorry, not lex forenda, it is lex lata. If you ask me what armed attack lex forenda is, you'll get a different answer than what we put in the manual, because we ask, what is the law now? It's good, August was the day we picked. In August 2012, what's the law? Not where is the law going? That's what scholars provide about. It includes international and non-international armed conflict as well as customary international law, because everything is customary. But in supporting our customary conclusions, methodology is often an issue when these manuals come out. What we said was that it is customary law or is applicable in NIAC or IAC. In accordance with us, in other words, we are the authority. We have 20 high-speed people here. Through our years and decades of experience, we are agreeing that this is customary. We are agreeing this is applicable in IAC or applicable in NIAC. However, there were a number of sources that were particularly influential for us. Military manuals were, as they always are, for example, in the customary law study. We used four in particular for various reasons. The one that was most important in a practical sense was the US manual, not because it is the US manual, but because the United States is not a party to Additional Protocol 1. So when you're trying to find customary law and you go to the British manual, you can't really decide, did they do this because it's in Additional Protocol 1 to which they're a party, or did they do this because they believe it's customary? Is that why it's included? The same with the Germans and the same with our Canadian friends. But the Americans, they're not a party to Additional Protocol 1. So if you see it in the manual, that's not decisive, but it's at least some indication that perhaps this is a customary norm beyond being a treaty law norm. And there were certain other sources that were particularly authoritative despite criticism of the ICRC customary law study. Nevertheless, it proved absolutely invaluable. We went back to the study again and again and again, as evidence of custom, and to look at their arguments as to why something was custom. We did not feel bound by the study, but when the study was persuasive, we cited the study. Of course, the Geneva Conventions and Additional Protocol commentaries because it told us what terms meant by the people who did it. The Air and Missile Warfare Manual and the NIAC Manual because those are both restatements of customary law as well. Again, we weren't bound by those, but it was persuasive evidence because of the caliber of the people that were involved in those projects. We come up with two things in the manual. We find two things, black letter law. It's an American term, but it means the law. This is the law. They're usually short. They're usually very, very broad because remember they had to represent consensus among the group. The commentary is where you as professionals, as practitioners, as scholars, is where you will spend most of your time because the commentary is extensive to each rule. In the commentary, we try to identify the source of the rule, where we got the rule from, scope, international or non-international or both, the meaning of the terms. For example, if it says scale and effects in the rule, then there will be commentary on what the word scale and effects means. We explain our logic and most importantly, this is what distinguishes it from most other manuals. Most importantly, we knew we were embarking on a voyage into unknown territory. We understood that. People catch me in the hallway to tell me how stupid it is to write a manual before you've had an actual cyber war, but we think it was important to do that. Most importantly, the commentary reflects every reasonable view that was expressed among the group of experts. So for example, in the last panel, my friend Niels and I, we don't entirely disagree over data. The manual, that's what I'm looking at, the manual as they go through, the manual says there were two views with regard to whether or not data can constitute an object for the purposes of attack or military objective. The first view was this, and it is justified on this basis, the second view. When we could, we identified majority and minority, but sometimes it was not clear. The group was split. And so you as users in the state or ministry or a scholar, this is not a manual that gives you one answer. It is a manual that says here's a broad rule everyone agrees on, but in terms of the interpretation of this rule, you can kind of go through and say, that may have been the minority view among that group of scholars, but we in Israel, we think the minority rule is the accurate reflection of law. So the most valuable aspect of this manual is we did not try to come to consensus on everything. We tried to lay out for the user the various alternatives they had. And we also sometimes simply said, it's unclear. I don't know. We thought about this and golly, it's too hard for this group of 20 people. Here's a sample of a rule that actually was interestingly discussed yesterday, Leveille en masse. Initially, we thought Leveille en masse has nothing to do with cyber. However, when we thought about it, it did in fact. You can see the rule is rather blah. You know, Leveille en masse, the concept applies, but then when you look into the commentary, there's a fairly long commentary on Leveille en masse, but here are just two paragraphs from the commentary. See, it's from article 4A6, that source. We affirmatively say it's customary law and that it does not apply to non-international armed conflict and we explain why it doesn't apply in the manual. And then we do analysis in the cyber context. We said, listen, this is hard in the cyber context because it's about the population spontaneously rising up. Well, that very well might happen, but the whole population, like Mike Schmidt, I'm not capable of spontaneously rising up against any invader. Why? Because I wouldn't know how to fire a virus if it fell down in front of me. So we asked the question of, does it mean the entire population or does it mean the predominant part of the cyber capable population? And then there are many other issues with regard to Leveille en masse that are discussed in other paragraphs. What were our toughest issues? Use of force. I discussed that in an answer to my Israeli friend yesterday. Use of force. We never did come up with a bright line test for what a use of force is. So we came up with criteria that indicate a use of force. Armed attack. I spoke about that yesterday. We came up with pretty much a consensus on what an armed attack is, but we're very sensitive to the fact that we were trying to find the law today, not seven years out. As I told you yesterday, I think that law will be different in seven years, but it's not today. Attack. We had brutal, bloody battles. Thank God we were friends over the issue of what does an attack, my presentation mean today. However, I think in the last couple of literally weeks, the ICRC and those who are on the other side are coming to an accommodation that the international law community will find acceptable. So I think that was gonna be resolved by the manual. Blockade was the hardest. We have the world's blockade expert in the audience. Is this where you get the chocolate? I have 12 more slides. We have the world's blockade expert in Wolf Heinzelmann-Heinig. I mean, literally the number one guy in the world there. Of course, I don't want to put words in his mouth that he was asserting there's such a thing as blockade. We had another guy who said, you're crazy. We never could resolve cyber blockade. So there's a long commentary on it and then say, we're not sure. With regard to the law, the last point before I get my box of chocolate is this. We were only trying to set out to tell folks what we, just this group of 20 people thought was the law applicable in ad bellum and in bello. But I have had any number of friends, most recently the foreign and Commonwealth offices legal advisor come up to me and say, we're freaked out about the manual. Because it gets everyone thinking of cyber stuff in the use of force, armed conflict paradigm. We don't want that to happen. This is a manual that applies only when you have ad bellum issues and in bello issues. Don't have a cyber operation, reach up there and grab the manual and say the Talon manual will answer the question. Because in most cases, issues addressed in the Talon manual are not relevant because you're not approaching either the armed conflict threshold or in the ad bellum sense, the use of force or armed attack threshold. So I don't want to have the problem, if you have a hammer like the Talon manual, every problem cyber operation is a nail. Every situation is not ad bellum in bello, be sensitive to human rights. See Diana, I said that, be sensitive to human rights, be sensitive to international criminal law and the various things that Robin talked about. Okay, now you can give me chocolate. Oh no, okay.