Anticipatory Self-Defense in the Cyber Context

• Author: Terry D. Gill - Paul A. L. Ducheine
• Position: Professor of Military Law, University of Amsterdam and Netherlands Defence Academy - Associate Professor of Cyber Operations, Netherlands Defence Academy, and Senior Guest Lecturer and Research Associate, University of Amsterdam
• Pages: 438-471

International Law Studies 2013

438

T

Anticipatory Self-Defense in the

Cyber Context

Terry D. Gill and Paul A. L. Ducheine*

I. INTRODUCTION

his article will examine the question of whether the right of self-defense

under contemporary international law permits a State to react to an immi-

nent or potential armed attack carried out by digital means in two circum-

stances. First, as an attack occurring in conjunction with, or as an adjunct

to, a conventional kinetic armed attack intended to neutralize the target

State’s defensive and command and control systems. Second, as an at-

tack—independent of any use of kinetic force—intended to cause signifi-

cant human casualties, physical damage or large-scale disruption in the tar-

get State. While the former scenario is probably considerably more likely

than the latter scenario, both will receive attention. The applicable law is

the same in either scenario, although there are some potentially significant

differences in the modalities of its application, primarily in the identifica-

tion of the attacking party and in gauging the level of the response if an

attack was conducted wholly in the digital domain.

* Terry D. Gill is Professor of Military Law, University of Amsterdam and Nethe r-

lands Defence Academy. Paul A. L. Duche ine is Associate Professor of Cyber Operations,

Netherlands Defence Academy, and Senior Guest Lecturer and Re search Associate, Uni-

versity of Amsterdam. © 2013 by Terry D. Gill and Paul A. L. Ducheine.

Anticipatory Self-Defense in the Cyber Context

439

A. Starting Points

This article assumes a number of issues are “givens” for the purposes of

this discussion.

First, that any use of force at the international level is, as a matter of

law, governed by the international law on the use of force, irrespective of

the manner in which the force is conducted and carried out.

1

Second, while the use of force in the cyber context poses certain chal-

lenges in how and when the existing legal framework regulating the use of

force can be applied, it is capable, in principle, of being applied to any type

of force that can be qualified as such. Consequently, that it can be applied

to computer-based attacks just as it can be applied to other forms of both

kinetic and non-kinetic force, such as bacteriological, radiological and

chemical weapons, whether used in conventional warfare or in terrorist as-

saults.

2

While the specific characteristics of cyber attack differ in some im-

portant respects from conventional kinetic attack and most forms of what

is loosely referred to as “cyber attack” do not qualify as either a use of

force or armed attack, those that do cause—or are intended to cause—

significant loss of life, physical destruction or long-term disruption of a

State’s vital infrastructure could constitute an armed attack. Hence, the

contemporary legal framework is applicable as a matter of law and poten-

tially relevant in the cyber context. There are neither legal nor practical rea-

sons to assume that the existing international legal framework governing

the use of force in the cyber realm is irrelevant, inadequate or incapable of

being applied without clear and convincing evidence so indicating.

Third, there are no separate rules and legal principles for the use of

force in the cyber context. Therefore, notions such as “use of force,”

“armed attack,” “necessity,” “immediacy” and “proportionality” are no dif-

ferent in the cyber context than in the physical world, although the modali-

ties of their application might well differ to some extent. Likewise, the rules

relating to attribution of an attack to a particular State or non-State entity

1

. Legality of the Threat or Use of Nuclear Weapo ns, Advisory Opinion, 1996 I.C.J.

226, ¶ 39 (July 8).

2

. Paul Ducheine, Joop Voetelink, Jan Stinissen & Terry Gill, Towards a Legal Frame-

work for Military Cyber Operations, in CYBER WARFARE: CRITICAL PERSPECTIVES 101 (Paul

Ducheine, Frans Osinga & Joseph Soeters eds., 2012).

International Law Studies 2013

440

do not cease to be applicable when the attack is carried out by cyber

means.

3

Fourth, self-defense of States at the international level is relevant only

to unlawful uses of force originating outside a State’s territory that rise to

the level of an armed attack. This means that any other type of activity,

whether it involves a degree of force below this threshold or constitutes

criminal conduct or a violation of other national or international legal rules

not related to the use of force, falls outside the scope of those actions to

which States may respond in self-defense. Therefore, cyber criminal activi-

ty, cyber (corporate) espionage and various other forms of unauthorized

penetration, theft of data and sabotage of computer systems, whether pub-

lic or private, that do not fit within the definition of armed attack are not

subject to the law relating to self-defense and will not be addressed in this

article. Such activities may well constitute unlawful intervention or other

violations of international and national law, but the violations do not give

rise to the right of self-defense when carried out in the physical world.

There are no compelling reasons why this should be different in the cyber

domain.

B. Structure

Section II will set out the essential nature and purpose of the right of self-

defense, and examine its scope and the legal conditions governing its exer-

cise under both the UN Charter and customary international law. Since the

law regulating the use of force and the exercise of the right of self-defense

are taken to be applicable, relevant and based upon the same rules, condi-

tions and principles in the cyber context as in the physical domain, it is es-

sential to set out this legal framework as clearly and succinctly as possible

in order to determine the conditions and modalities of the exercise of self-

defense. In particular the legality of anticipatory self-defense under con-

temporary international law is reviewed. To the extent that anticipatory

self-defense is permitted or, alternatively, seen as lacking a legal basis with-

in the right of self-defense in general, this will be relevant to its possible

application in responding to an imminent cyber armed attack.

3

. This is t he approach taken by the Internatio nal Court of Justice (ICJ) in its N uclear

Weapons advisory opinion, supra note 1, ¶¶ 37–50, 244–47, and unanimously by the Group

of Experts responsible for the TALLINN MANUAL ON THE INTERNATIONAL LAW APPLI-

CABLE TO CYBER WARFARE (Michael N. Schmitt ed., 2013).