CyCon 2012 | Michael Schmitt: Tallinn Manual Part II

Good morning again. Yesterday I started my presentation by telling you that as lawyers we're particularly upset about the use of the word attack because attack has used in the technical or operational sense is not the same as the term attack has used in the legal sense. Now yesterday I told you that in the legal sense we have problems as well because the word attack appears both in the body of law the body of international law that governs when a state can resort to force and it also appears in the use in bellow or international humanitarian law the law of war the law of armed conflict with regard to the types of operations you can conduct. And so therefore I want to distinguish today use in bellow attack from yesterday's use it's very very important several of the speakers yesterday mentioned the necessity of having an armed conflict before the use in bellow before international humanitarian law applies. So I want to emphasize that this presentation and this use of the word attack only applies during an armed conflict. And just by way of review there are two types there is an international armed conflict that involves hostilities at any level between two states United States and Mexico start shooting at each other we have an international armed conflict. This must be distinguished from what has captured the attention of the conference so far and that's a non-international armed conflict. A non-international armed conflict is a conflict between a state and an organized armed group like a terrorist group or between an organized armed group and another organized armed group. But it's not so easy because an international armed conflict any level of hostilities suffices. But if you're talking about this non-international armed conflict you must have a particular level of intensity of hostilities before the law kicks in because it's not meant to govern civil disturbances and riots and so forth. So we need to be very careful when we're applying this concept you must apply it either in an international armed conflict which is pretty easy to identify or a non-international armed conflict which isn't so easy to identify. Now why do we care about the the word attack in the use in Bello? We care because of the principle of distinction that is set forth in article 48 of the additional protocol the first additional protocol. By the way some countries like my country Israel Turkey a few others are not party to this instrument but virtually all of us recognize this as an accurate restatement of customary law. This is the mother of all IHL principles. This is the jewel in the crown of IHL principles and it's very very simple. It says that if you're going to conduct operations you must distinguish between civilians on the one hand combatants on the other between civilian objects on the one hand and between military objectives on the other. The question is though that we'll play with today is what's the practical effect of article 48? What does that mean in the cyber context? Well fortunately the additional protocol operationalizes this. In other words it makes it practical in a number of provisions. The two most important are set forth at the top of the slide. The first is found in article 51 and article 51 tells us we may not attack civilians. So here we see the term emerging for the first time and then article 52 says we may not attack civilian objects and then if you go through the protocol or if you go through a U.S. military manual we're not party to the protocol as I mentioned you'll see the word attack appear over and over and over and over. No such thing as indiscriminate attacks. The rule of proportionality applies to not military operations but attacks. No attacks on objects indispensable to the civilian population. Precautions in attack that bill will be talking about in just a moment. Precautions against the effects of attacks. So the legal question we have at this point is what do they mean by the term attacks because it's particularly relevant in the cyber context. Well the protocol on this point it's not always so good on defining terms but on this point the protocol actually had because this is so important the protocol actually has a definition of attacks found in article 49. You should commit this to memory if you are an attorney. Acts of violence against the enemy whether in offense or defense. The critical components here are violence and whether in offense or defense. Let me address the second one first because I was asking a couple questions at breaks. It is important to emphasize that it that when we are talking about attacks how's a matter of law? How's the legal term of art? We don't care if you're shooting at the person because you are conducting offensive operations or you're shooting at the person because they're trying to kill you and you're defending yourself. An attack is simply transmitting violence from yourself to civilians, civilian objects, military objectives, combatants. Okay so offense defense for the techies who often worry about defensive cyber stuff. Don't worry about distinction. Has a matter of law. The first point up here is violence and this is very important because we're wanting to know what does attacks really mean in practice and the concept of violence is again repeated over and over and over and it kind of means classic violence. What you think of in lay terms has a dangers, violence, loss, injury, damage, damage, losses. The commentary tells us that it's an operation during which violence is used and then in another very famous but unofficial commentary it tells us it means physical force. So we've moved from operations and operations kind of means attacks generally. Attacks kind of means violence. What's our legal result in the cyber context? The legal result is that we can say with great certainty that an action that is non-violence in character is not governed by the prohibitions on attack. So we're talking espionage and psyops. In a psyop you may direct your operation against the civilian population but that's not prohibited by article 51 the prohibition on attacking civilians. It's not prohibited unless it causes certain effects. Okay so it's not merely directing. You have to have consequences. The problem is is when we think about violence the question that's always asked yeah but does that apply to cyber operations? Because cyber operations are not violent in and of themselves. I mean if I shoot Soyun that's a violent act it's kinetic it immediately causes effects but if I beam electrons at her computer and this causes something that causes harm physical harm to someone that's kind of not the same. So over and over particularly in the early days of cyber the question was does this rule apply to cyber operations? The answer today is absolutely yes. There's absolutely no question whatsoever. Anyone who argues this point doesn't know what they're talking about because there's almost unanimity on this point. You should not worry about the fact that the means are not violent. You have to focus on the consequences of the operation. It's not the nature it's the consequences and this is consistent with our interpretation of this term in other contexts. For example biological warfare isn't really kinetic but no one in this room would suggest that that's not an attack or chemical warfare need not necessarily be kinetic but no one in this room would ever suggest that that's not an attack if you conducted such an operation. So today this question that everyone seemed to be struggling with 10 years ago has been asked and answered and you need not concern yourself with it any further. The question though is what we know it's violence we know its consequences so operation attack violence consequences but which consequences qualify and I believe that the answer here is found by looking at what international humanitarian law seeks to prevent and the best place to look at least in my estimation is at the rule of proportionality because the rule of proportionality is very clear. It says listen you can conduct military operations you can even conduct military operations that harm civilians so long as those military operations that harm civilians do not result in excessive loss of civilian life injury to civilians or damage to civilian objects or a combination of that. So the type of violence remember concept or operations attack violence consequences the type of consequences you're looking for are death or injury to individuals or damage or destruction to property and this can occur either because you strike the target and it's a it's a it's a consequence to the target or you strike the target and the target has no damage but there's a residual effect on the civilian population that would qualify as collateral damage. In either case we are talking about an attack so if I attack her computer she's in the military congratulations United States Marine Corps you're in the Marine Corps I attack your computer it causes no damage here but it harms this civilian over there in some way that is an attack against a civilian. Okay now let's start now we know what it is so let's start applying this concept in particular circumstances. It seems to me that in most international law scholars and practitioners that it includes this concept of attack includes damage that is not directly caused. So when you are looking at one of these situations and you're trying to find the damage that will qualify your operation has an attack such that the law kicks in the prohibition on attacking civilians attacking civilian objects you need to look further than what the immediate direct effect of my operation is. You have to ask does that operation cause consequences third second third fourth order consequences reverberating consequences in the United States doctrine we call them indirect effects does it cause those effects and do any of those effects qualify death damage destruction injury are any of those secondary or tertiary effects qualifying the operation has an attack because if they do then it will be forbidden under article 51 or article 52 if they're civilians or civilian objects okay now the classic example is the one I use up here everyone likes to use it because it's easy to get your head around I attack a dam it causes no damage all it does is cause the flood the flood gates to open water rushes out it rushes downstream clearly clearly those secondary effects on the civilian population downstream has a result of the flood qualify this has an attack it also includes and we talked a little bit about that yesterday it also includes attacks on data if the attacks on the data cause those indirect effects we said yesterday in the context of the usad bellum but it applies to some extent in the use in bellow that data is not property okay it's not an object that is not an object as a matter of law however if you attack that and it has those effects then it will in fact be an attack it would also include illness and serious mental suffering in terms of the cause data transferable to tangible objects was something I thought up in an article a long time ago and the jury's out on whether this is true and the example you use is I take my ATM card I go down I stick it in a machine and a hundred euros pops out my banking data is immediately directly transferable into a tangible object that can be damaged okay so if you attack my banking data you're really depriving me of the ability to access tangible stuff this in this particular case the jury is out 50 say yes 50 say no no data like that even data like that even data that's directly transferable into something I can touch that I can put into my pocket and hand to Katrina even that data is not included so damage to that would not qualify the operation as an attack it includes delayed effects malware this is something the techies brought up to a group of us who are working on the subject they said listen I can put malware in and it goes off later down the line when when the target does something this a delayed effects would be included in the effects that are acceptable how do we know this we know this because when we look at the negotiating history of the additional protocol it tells us that using landmines is an attack even though the effect doesn't happen until well down the line if I go dig a hole out here and put a landmine I've conducted an attack because the kinetic effect is going to occur attacks don't need to be successful just like a regular kinetic attacks you can try and maybe your your malware never gets through the into the enemy system if that happens that's still an attack if I shoot a gun at you and I miss I've still attacked you it's exactly the same way in cyber and so if you're a civilian object then it's going to cause those harms that level of harm that would still be an attack even though I'm completely unsuccessful what about the unwitting intermediary something that those of us who were involved in kinetic warfare never think about but the cyber folks brought it up what if I send an email to katerina and katerina it automatically then forwards it unwittingly she doesn't know what's going on to so you this is an attack by me but it's not an attack by the intermediary okay it doesn't qualify as in fact she has not violated article 51 or 52 and then we come to the most interesting question what if you attack using cyber something and you don't actually break it you know there's no physical damage or the persons aren't injured but it doesn't work anymore you have interfered with the functionality I think we're starting to emerge the point in the IHL community that if you do interfere with the functionality it doesn't work not the data it doesn't work then if it must if that's permanent or if it must be repaired that will qualify has the damage necessary to make that operation an attack so if she's a civilian and I do something to her computer so that her computer doesn't work or she has to take it to bill's repair shop to get it fixed I have attacked a civilian object even though you know there's nothing really broken in a physical sense on her computer and I think slowly but surely the international community is now accepting this premise there are some alternative views in terms of what qualifies has an attack the same scenario I just use I attack her computer but instead of having to take it and get it repaired some physical component replaced for example she has to reload the operating system many people say that is also an attack that qualifies has the damage which is necessary for an operation to qualify has an attack and I have to be frank I'm slowly coming around to this view myself because I'm struggling with the difference between replacing a component and loading an operating system all I know is I don't know how to do either of those so I've got to go to some computer goober and have my computer to them it's the same effect on me so I'm slowly coming myself around to this view there is another view very much like the odd bellum armed attack view there is another view view that says you're too obsessed with the nature of the consequences look at the severity of the consequences it's not whether I break that computer a little bit and she has to go to a repair store the issue is how serious are those consequences and so these people would say we're looking at the wrong thing if I conduct cyber attacks against the end against a an economic structure economic infrastructure of another country even if it doesn't cause damage if the consequences are really severe for the population that is an attack I that may be in my mind that may be lex forenda what the law will be at this point I don't believe it's the law today and then finally there's a group that has been saying for a long time that the issue is not the consequence but instead the status of a target in other words if you shoot cyber at civilians or you shoot cyber at civilian objects then that's a violation of international humanitarian law irrespective of the consequences unless the consequences are truly de minimis I believe that it's fair to say that this viewpoint which was very strong early on 10 years ago this is a very strong viewpoint is slowly fading away because these folks are struggling to answer questions like well but what's the difference with psyops I conduct psyops if if I want to go into an enemy's television broadcast station and put cartoons about their glorious leader is that really an attack has IHL meant an attack so I think this view is fading away but there's still a few dinosaurs out there that hold it there are key related issues I will not talk about them because my friends will talk about the military objectives which Dr. Meltzer will talk about I would emphasize that when he talks about that the U.S. has a position Niels I don't know if you're going to talk about the U.S. position but you probably want to ask him about it if he doesn't talk about it proportionality of attack if you're doing an attack it's not just about if I conducted an attack there are limitations even if I can lawfully attack that military objective I have to apply the rule of proportionality and then my friend there Commodore Boothby will be talking about precautions and attack okay I have eight how German am I I'm down to perfect okay let me tell you what Mike Schmidt thinks the future is going to be I believe that the the threshold for damage necessary to qualify an operation has an attack will drop somewhat because I believe that this argument about severity has legs I mean it makes sense to me my mission is to find what the law is today but when people tell me yeah Mike but cyber op opens up a possibility to create really radical dramatic severe effects I kind of understand my gut tells me the human gut says we ought to be worried about how serious something is not the nature of something so I think we will see this threshold drop over time through state practice that the the prohibition will be a little bit lower there is a danger it could go the other way because uh listen I teach in a war college I know this capabilities always seek targets when a capability is developed war fighters thinkers operators always say I can do this I mean I was one of the the old guys who started dealing with a long time ago and the wire heads would come in and they go hey man you know what we can do because they could do it they want to do it and there's actually still an element I've heard that at this conference look man I can go in and I can turn on the camera you know capabilities seek targets this is a truism of warfare but I'm hoping the first bullet is more accurate I do believe that economies will be seen as a civilian object over over time and I'm absolutely pessimistic about the idea of new law in this area these this change will come not through the revolution of new law but rather through the evolution of contemporary understandings of the of the current international humanitarian law thanks very much thank you