CyCon 2012 | Michael Schmitt: Tallinn Manual Part III

Well, I'm one of those people that think the legal stuff matters, and it matters a lot. Since I've come to this conference, I think I've heard the term attack about 50 times every single day, and it has caused me a panic, and so therefore I'm delighted that Katharine has asked me to give not one but two presentations on the term attack. When we're using the term attack, lay folks normally think of computer network attack. So if we look at the DoD dictionary, if we look at the NATO glossary, that's where the term applies. It's a term of art that refers to a particular type of operation. But that's not at all the world according to the lawyers, because the term attack in international law is a legal term of art. It has particular significance. And so what I'm going to do today and tomorrow morning is talk to you about that legal significance, because it's creating an awful lot of confusion between the non-lawyer and the lawyer community. Now, in international law, the term attack appears in two different places. The first is in the use ad bellum, and the second is in the use in bello. Let me explain for those who don't deal with conflict studies what the difference is. The use ad bellum is the body of international law, the component of international law, the aspect of international law, that governs when it is that a state may resort to force as an instrument of its national policy. When can a state send forces abroad to conduct hostilities pursuant to a Security Council resolution under Chapter 7 of the UN Charter? When can a state send its armed forces abroad in order to engage in a humanitarian intervention? When can a state order its forces into action to defend itself? These are questions of the use ad bellum. It is a separate, distinct body of law that uses the term that I'll talk about this afternoon, armed attack. Now there's an entirely different body of international law called the use in bello. The use in bello is a Latin phrase referring to the law that governs how I fight. Who can I shoot? Who can I detain? How do I have to detain these people? If I am shooting at something, what precautions do I have to take in order to assure that I'm not harming civilians unnecessarily? This body of law is also known as international humanitarian law. Most of the world, the United States and few others still use the term the law of armed conflict and the older term which you'll still see is the law of war. It's a very different body of law and these two bodies of law are not related in any way. A state may act in strict compliance with the use in bello with humanitarian law, but nevertheless be the aggressor state. Or a state may be the aggressor, but nevertheless its military operations may comply very strictly with international humanitarian law. So when we're playing with the word attack, we need to be very careful. There's a lay meaning to the word. Every time I see the Department of Defense dictionary definition, I break out in hives. There's a lay meaning to the word and then there's a legal meaning and in fact there are two legal meanings and you must not confuse the two legal meanings because they're very, very, very distinct. Now what I'm going to talk about today is the very first one, armed attack. Why do I care about armed attack? I care because of a provision that doesn't contain the term and the provision is article two subparagraph four of the UN charter. It is the prohibition on the use of force. And basically what it says is, listen, if you're a state, you may not, it applies only to states, you may not use force against another state. I know it says political independence, territorial integrity, but it's very simple today. Today most lawyers say, listen, it just means don't use force. But it contains two exceptions. The charter contains two exceptions. They're found in chapter seven. It's when the security council authorizes an action or mandates an action. And then in article 51, that's self-defense. This is a very important provision and it's the question most people should be asking about cyber, not was it an attack. They should be asking, was it a use of force? I attended the media session that the sponsors put on the first day and all the journalists wanted to know was, you know, Stuxnet, was that an armed attack? Doesn't matter if it was an armed attack. What it matters is whether or not it was a use of force, as understood in article two, subparagraph four. Now this is, of course, a treaty-based norm, but nevertheless it's recognized as customary international law, and indeed, not even regular customary law, but super-duper customary law known as use cogons, the kind of stuff you can never, ever, never break. So this is the important prohibition. And this, article two, four, then leads us into the issue of armed attack because of the exceptions. The exception is found in article 51, or one of the two exceptions is found in article 51. And article 51 is actually very simple. It's the law of self-defense. It says, listen, if you're the victim of an armed attack, if you, a state, if you're the victim of an armed attack, well then you can respond with what? With the use of force. Article 51 is a article two, four, get out of jail free card. You can use force if that use of force has risen to the level of an armed attack. And so when we ask, is Stuxnet an armed attack, the only relevance of that question, the only relevance is what can the Iranians do to whoever launched that attack? If the question is not, was the attack lawful or not, that's two, four. Here we're only talking about responses. So that begs the question, okay, then what is an armed attack? Unfortunately, or fortunately for lawyers and law professors, the term is not defined in international law anywhere, in any authoritative place in international law. But we have some clues. First of all, the big question that was asked, the last panelist, the last panel mentioned it, the big question that's asked is, well, does a use of force, I'm sorry, does an armed attack, see I did it, does an armed attack have to be kinetic? Does it have to involve weapons because of the word armed? And therefore, does it exclude cyber stuff? The answer is no. The International Court of Justice has answered this question in the nuclear weapons case, which has been cited. And there they said, it really doesn't matter how you do the armed attack, with what you do the armed attack, it matters what the consequences are. And in fact, state practice supports this, this should be no epiphany. Every state would believe that if you conduct a radiological attack or a chemical attack against another state, and it's not kinetic in nature, every state would agree that this is an armed attack. This is a question asked by scholars that need not be asked. This question has been asked and answered. This is settled law. But then, what is it? How much are we talking about? Now, Dr. Hernandez gave a very good discussion, or provided a very good discussion, of the fact that there's a distinction between the term use of force, as found in Article 2.4, and armed attack, as found in Article 51. In fact, in a very famous case, the Nicaragua case, which has been cited over and over here, also known as the paramilitary activities case, its formal name, there the court, the International Court of Justice said, you need to distinguish between the most grave forms of use of force from the less grave forms. The most grave forms would be an armed attack. The less grave forms would be a use of force. And has an example, and again, Dr. Hernandez mentioned this, has an example, training of guerrillas. Another example, arming guerrillas. These are uses of force that are not armed attacks. And then the court gives us the key phrase. The court tells us when you're trying to figure out what the difference is, look to the scale and look to the effects of a particular operation to determine if it's nothing, if it's a use of force, or if it's an armed attack. Now, we're still pretty fuzzy here, but looking at the use of force and the training of guerrillas and so forth, it's reasonable to draw the conclusion that any operation, any cyber operation that causes death or injury or significant suffering, or which causes damage or destruction, that is a use, I'm sorry, that is an armed attack. Why? Because it's bigger than the use of force. They had to really struggle to say that a use of force is something less than that. So then, by turning that on its head, we now know that this is an acceptable definition of what an armed attack is. So if you're asking, was Stuxnet an armed attack, again, only for the purpose of determining what the response might be, you should ask yourself this question. Did people die? Were they injured? In a significant way? Was there significant damage? And if the answer is yes, then you're at the armed attack threshold, and that means that the victim of the attack can respond with a cyber operation that rises to the level of force without violating the prohibition on the use of force. Now, you note the word significance. The problem is, is the court kind of quibbled a little bit. In the Nicaragua case, the court said, we're not talking about mere frontier incidents. And then in a subsequent case, in oil platforms, both cases involved the United States, in a subsequent case, oil platforms said, well, but we are talking about an attack on a single warship. What the court's telling us here is that don't include de minimis effects. So for the cyber folks in the audience, if Soyun's computer here catches on fire, okay, because the Israelis attacked it, you know what those people are like. They attacked Soyun's computer. That's not an armed attack. Why? Because it's de minimis in terms of state interest and so forth, okay? So we're not talking about little stuff. We're not talking about minor damage. We're not talking about very minor injury. We're talking about the type of injury and the type of damage that a state would be interested in. Now, we also need to be careful because there is a little bit of controversy here. Some scholars, the most famous one being Yoram Dinshteyn, former president of Tel Aviv University, he says, no, no, the court got it wrong, okay? The only kind of damage that would be excluded, the only kind of damage would be absolutely meaningless. Not her computer caught on fire, but it was scratched by operation of another state, okay? But there is a bit of dispute. Now what there is valid dispute about is that this accepted provision of international law has been questioned by a lot of folks because of cyber, because cyber can cause consequences that are not death, injury, damage or destruction or serious suffering that are nevertheless very, very, very severe. The classic example, the overused example, but a great example is bringing down the New York Stock Exchange or doing something that undermines the economy of a state. That would have devastating consequences but have no direct result in terms of death, injury, damage or destruction. Is this an armed attack? According to the conventional understanding, the answer is no. However, a group of scholars have argued that what you should do is dispense with the idea that it has to, the attack has to be of a particular nature, that it has to be destructive or harmful and that the only question you should ask is how severe are the consequences and that would determine what an armed attack is. I will tell you that, I mean, this approach appeals to me but I'm in the business of finding what the law is today, not what the law will be seven years from now and today the predominant opinion among states and among scholars is clearly death, damage, injury or death. This is the agreed upon interpretation. Now there are lots of other issues. Jason asked about the first bullet up here. What about pinprick? Because remember, it has to be a certain scale. Scratching or causing the computer to catch on fire, that's not enough. You have to get to a certain level. Well, what if the cyber attacks are such that no one cyber attack rises to that level but if you group them all together and you look at them, well, that's kind of bad. You know, something's happening in Montana, in Nevada, no one would be an armed attack but if you group them all together, that would be bad. The prevailing opinion is that if they're related, if there's a nexus between them, then that would in fact be an armed attack. What about data? I know that techies jealously guard their data. There's prevailing opinion today that merely attacking data is not enough, that destroying data doesn't count. You have to destroy things, things that under law would constitute property, again, has a matter of law. This again is the prevailing opinion. But if you look at the other view, the view that may be emerging, well, you don't have to look at that because you don't look at nature, you look at consequences. So if the consequence base, the severity view takes hold, again, it's not the law today but if it takes hold, then this might very well change. Everyone agrees it's not espionage, everyone agrees it's not theft, everyone agrees it's not a denial of service attack, unless those actions cause, in a relatively direct way, again, death, injury, damage or destruction. An interesting prospect is that you mount an armed attack and the armed attack has consequences, I'm sorry, you mount an operation, a cyber operation, and the cyber operation has consequences that you did not intend. But those unintended consequences rise to the level of an armed attack where the scale and effects are met. What do you do in this situation? Here the community is split, in my view, which I believe is the prevailing view, I would say that's nevertheless an armed attack. Because if it's not, the state has no way to respond because of what Dr. Hernandez was talking about, use of force, armed attack, there being a gap between these two. So my view is even unintended consequences can enable a state to respond with its own use of force, however you have to remember that states just don't respond, there are lots of requirements, legal requirements for a state to do so, proportionality and so forth. Same question, what about bleed over? State A attacks State B, it's an armed attack in State B, but also it causes effects in State C that rise to the level of an armed attack. Has State A attacked State C? Again the same sort of analysis would apply, I would say yes, because State C has to be able to respond somehow to put an end to this thing against it, and if it needs to use force to do so, it ought to be able to do so, after all it's the innocent party here. However, some folks would say, no, no, there's an intent, a mens rea element to the operation, and therefore it would not apply. And then there's a very interesting question that's just recently come up, Dr., or Professor Dr. Von Heinegg and I were chatting over the weekend, so I added this in. It's a very interesting example of what happens when you have non-state actors conducting the attack, which I'll get to in just a second, and they're attacking other non-state actors, not the state, where criminal gang A conducts bad cyber attacks against criminal gang B in another state. Is this an armed attack against that state? Because those individuals are located there. My view is, no, if the motive is purely non-political, purely private, we're talking about transnational criminal law enforcement, we're not talking about armed attack. But there are other views, and I think Professor Von Heinegg would take the opposite approach, that motive is not relevant as consequence, which would track my approach in the previous two examples. Does it matter who's shooting at you? Yeah, it matters a lot, and you've already heard a little bit about this in the previous panel. First, if the states are conducting the operation that qualifies in terms of scale and effects, it doesn't matter. That's what the rule's about. It's about state v. state. Moreover, as noted by previous speakers, again, Dr. Hernandez, the International Court of Justice addressed this issue in its Nicaragua case. And basically what they said was, listen, if the non-state actors are acting on behalf of another state, then that's as if the other state attacked you. And when you do your defensive reply using force, you may reply not only against the non-state actors, but against their state sponsor. Now I will have to say, there was one issue I disagreed with, with what Dr. Hernandez said. The law of state responsibility and the debate over effective control and overall control has nothing to do with this. This is not a state responsibility issue. This is an issue of the law of self-defense. The issue of state responsibility would be relevant to the use of force question. In other words, whether or not the state could be held responsible for the use of force. But the rest of the audience is bored. This is something too law professors argue about. Okay. Now, here's the tough question. Here's the tough question. What about a non-state actor that's not acting on behalf of the state? Terrorist groups, groups of bad guys, organized armed groups that are attacking a state. Well, there's view one. And view one says that's not the use ad bellum. Doesn't have anything to do with self-defense or armed attack or use of force. That's crime. And the criminal law paradigm governs this. And the International Court of Justice has correctly noted has on not one, but two occasions in the Wall opinion and in the case involving Uganda and Congo has twice kind of said that this is the case. It's a very complicated opinion. They don't come out and say it exactly, but they're pretty much here. A state has to be involved. The state has to be behind the operation. There is a second view. It's the correct view. The correct view is that non-state groups may in fact commit armed attacks. Remember, the issue is not was it unlawful. That's two, four. And two, four has nothing to do with non-state actors. It's about states. The question here is may you resort to measures that are classically defensive in the context of Article 51. And I would say yes, and I would say this has been well demonstrated by state practice in the immediate aftermath of 9-11. Clearly the Security Council saw this as self-defense. The day after the attacks, they pass a resolution which talks about self-defense, 1368. Two weeks later, 1373, they say the same thing on and on and on. They always cite self-defense. There is lots of states in this room offered to the United States the option of collective self-defense will help you in your defense against Al-Qaeda and so forth. There is a problem with that case, though. The cases against the United States and Al-Qaeda, the really bad actors, and they killed a lot of civilians. And there's a saying in law, bad facts make bad law. So even though I would be prepared to say that that was the appropriate state practice, it's not that case that I look at. It's the case of the Israeli operations into Lebanon in 2006 after Hezbollah. There we have a state, Israel, attacking a classic terrorist group, Hezbollah, in another country in Lebanon. And what did the international community say? They all said, pretty much, the reasonable ones, said Israel had a right to self-defense. The legal question was not whether Israel had a right to self-defense. The legal question was, did the Israelis go too far? Did they violate a provision on proportionality? But as to the right of self-defense, even Kofi Annan, who was then the Secretary General, said, yes, Israel has a right of self-defense, thereby, in my mind, confirming the non-state group inclusion in the notion of armed attack. Now, I've already talked about motive, but what about individuals? Individuals, the law is unclear. In my mind, if you have one person doing a crazy cyber thing that causes consequences, even against the state, that causes consequences that rise to the level of an armed attack, that's not an armed attack. That's a really bad crime. But really, the international community is split on this particular case. Does the target matter? Well, that sort of depends, you know, in other words, does it matter if you're shooting at government stuff or you're shooting electrons through cyber at civilian stuff? Does it matter if you're shooting at the Department of Defense or AT&T? If the target is located in the state concern, then it doesn't matter. If you shoot at stuff in America, that's an attack on America, okay, or Estonia. You shoot at stuff in Estonia, that's an attack, armed attack on Estonia, so long as it rises to the appropriate threshold. This isn't a big issue. The bigger issue is, what about when you're shooting at stuff that kind of is affiliated with the state outside that state's territory? So you go after the headquarters of AT&T or a regional headquarters of AT&T in, say, France. Well, there it's much, much more complex. If the thing you're shooting at is government in nature, the answer is that's an armed attack. If you're firing electrons at a U.S. Army facility in Germany and it rises to the appropriate level, armed attack. However, if you're shooting at things which are not affiliated with the government, here the law is unclear. And you have to do a case-by-case analysis looking at status, the target, why the person's doing this, the extent of damage, and so forth. The question now is, okay, now I understand what it is, I understand who can do it, where I can do it, when can I do it? Well, obviously, any time an attack, armed attack, legal term, armed attack is underway, you can respond, obviously. However, the question is, can you respond before or after the attack has been conducted? The before the attack question, there are three schools of thought. There's the old school of thought, and it's called anticipatory self-defense. The old school of thought says, listen, I read the charter, Article 51 says nothing about responding in anticipation of an attack, it says responding to an attack, okay? So you can't respond before it happens. Today, most people think this is something quaint and old and historical. There are two other schools of thought. One school of thought would apply what I think it was Professor Von Heine talked about yesterday, the Karelin Standard, which is temporal. In other words, what you do is you look at your watch, well, maybe if it's been a minute ago, they'll attack in a minute, that's okay, maybe an hour, that's okay, tomorrow, I'm not so sure, next week, no way. It's a temporal standard. However, this standard doesn't work very well in the case of terrorism or in the case of cyber because you don't know exactly when it's going to come, and it comes and it hits instantly, you know, they don't sail to your shores. And so therefore, today, I think the emerging view, and I would almost say the prevailing view is this, that you have to look at three things. Do the bad guys, the non-state actors or the other state, do they have the capability to attack me? Do they intend to attack me at some ill-defined date in the future? And three, and most important, if I don't act now, I won't have the chance to defend myself against the act. If that's the case, you may respond in anticipation of a cyber attack. After the fact is a little bit easier, immediacy, or immediacy, the question is, an attack has occurred, how long after the attack can I respond? The answer here is that it can't be retaliation. You can't retaliate. It's not tit for tat. It isn't I've been attacked so I get to attack you. It's not that. It's that there must be some relationship between your response and the attack itself and probably subsequent attacks that are coming. In other words, I need to respond against you because I don't know what's next. But if it's over, and it's really over, then you do not have a remedy involving the use of force. You don't get your self-defense get-out-of-jail-free card. There are other issues. There are criteria that must be applied when you engage in self-defense, two of them, necessity and proportionality. It's not the subject of this presentation, but necessity is simply means that, listen, you can't use forceful cyber measures if other stuff like diplomacy will work. Don't resort to force until you need to. Proportionality says don't use more force, more cyber force than necessary to defeat the attack. If you're suffering an attack, don't bring down their entire system if you don't need to. And then the final question in the 16, 15, 14 seconds left, the final question is border crossing authority. I won't talk much about that. I'll tell you what my view is. It's the same view I have on drones. If you need to go into another state to defend itself, you cannot do that. Is this where you get the big hook? If you need to go into another state to defend yourself, you cannot do so until that other state is given the opportunity to comply with its duty to make sure its territory is not being used for ill purposes against your interest. Unless the threat's so overwhelming that if you don't act now, it's going to be too late. This does not include transiting other states. The transit of your response is irrelevant as a matter of law. So let me, I was going to talk about countermeasures, but Glider already did that. Where's the future going? I gave you Lex Lotta. The law has it as it is today. Where do I anticipate the future's going? There are two possibilities. The first possibility is that the thresholds is going to drop for armed attack. Why? Because the more wired we get, the more nervous we are about people attacking us, so we want to make it unlawful and we want to be able to respond. The other possibility is that the armed attack threshold will rise or become very firm. You must have death and so forth. Why? Because we're nervous not so much about the attacks, but about other guys going crazy and causing a cycle of escalation. In my mind, the best guess is the bar will lower and the first thing we're going to see is any kind of massive disruption with economic infrastructure in a country. But that's not today. That's seven, eight, nine years from now when state practice begins to crystallize. Is this where you give me the chocolate? It's lunch. Could you give it to me afterwards? Thank you very much for your attention. Thank you.