Catherine Lotrionte, State Sovereignty and Self-defense in Cyberspace: a Normative Framework for Balancing Legal Rights

• Jurisdiction: United States,Federal
• Citation: Vol. 26 No. 2
• Publication year: 2010

STATE SOVEREIGNTY AND SELF-DEFENSE IN CYBERSPACE: A NORMATIVE FRAMEWORK FOR BALANCING LEGAL RIGHTS

Catherine Lotrionte*

Today’s threats recognize no national boundaries, are connected, and must be addressed at the global and regional as well as the national levels.1

When warranted, [the United States] will respond to hostile acts in cyberspace as we would to any other threat to our country. All states possess an inherent right to self-defense . . . . [We recognize] that hostile acts conducted through cyberspace could compel actions under the commitments we have with our military treaty

partners 2

America must also face the rapidly growing threat from cyber- attacks. Now, we know hackers steal people’s identities and infiltrate private emails. We know foreign countries and companies swipe our corporate secrets. Now our enemies are also seeking the ability to sabotage our power grid, our financial institutions, and our air traffic control systems. We cannot look back years from now and wonder why we did nothing in the face of real threats to our security and our

economy.3

* Catherine Lotrionte is the Director of the Institute for Law, Science & Global Security and Visiting Assistant Professor of Government at Georgetown University. Dr. Lotrionte has served as Counsel to the President’s Foreign Intelligence Advisory Board at the White House and as Assistant General Counsel at the Central Intelligence Agency. Dr. Lotrionte is the Director and Founder of the Cyber Project at Georgetown University and a Life Member of the Council on Foreign Relations.

1. Secretary-General’s High-level Panel on Threats, Challenges and Change, A More Secure World: Our

   Shared Responsibility, at 11, U.N. Doc. A/59/565 (Dec. 2, 2004) [hereinafter U.N. Report, A More Secure World].

2. DEP’T OF DEF., CYBERSPACE POLICY REPORT 2, 7 (2011) [hereinafter CYBERSPACE POLICY REPORT].

3. Barack Obama, State of the Union Address (Feb. 12, 2013) (discussing the threats the United States faces from adversaries in cyber and noting the Executive Order that President Obama signed earlier in the day,

   Executive Order on Improving Critical Infrastructure Cybersecurity, designed to strengthen U.S. cyber defenses through information sharing and standards for cyber security); see also Exec. Order No. 13,636, 78 Fed. Reg. 11,739 (Feb. 12, 2013).

   INTRODUCTION

   
   

   Few issues in international relations are as controversial as the use of force and the legal framework that justifies a state’s use of force in self-defense. Indeed, the very development of the discipline in international law lies in attempts by states, the United Nations, and international courts to wrestle with the question of when force may legitimately be used within the international realm. Over the centuries, states have struggled to define the right to use force as they face new threats from new actors and new weapons entering the arena of conflict.

   
   

   This Article grapples with the contemporary topic of when a state can invoke forcible measures in cyberspace against non-state actors. To address this issue, this Article discusses the current threats to states that exist in cyberspace, identifies the international law on the use of force and discusses recent state practice as well as the pronouncements of international courts on the topic. Difficult questions in the context of cyber operations are posed and challenging conclusions are drawn from the development of the law. Ultimately, this Article provides a framework for state decision-makers to use to determine whether the state can legally use force in self-defense in cyberspace against non-state actors residing in another state’s territory. Overall, it is an indication of the increasing maturity of international law that it is capable of facing up to the complex challenges of these new threats while continuing to search for the path forward that maintains and enhances the rule of law and minimizes conflict within the international community.

   
   

   It is clear that “cyber warfare” is not a technical legal term and it has been argued by some to be even misleading and unhelpful.4 There is a concern by some that the term will glorify those criminals responsible for most malicious action in the cyber domain, exaggerate the threat, and distort the understanding of particular conflicts that take place in cyberspace, just as the use of the term

   “war on terror” arguably has done. Regardless, the rhetoric of “cyber warfare” has some significance for the law on the use of force because it can be used to justify the use of self-defense against other states and non-state actors accused of carrying out a cyber attack against a state.

   
   

   Today, state officials from around the globe warn that a state’s most critical infrastructure—power plants, gas pipelines, traffic control systems, and water

   
   

4. See, e.g., Cyber Security and International Law: Meeting Summary, CHATHAM HOUSE 3 (May 29, 2012) (summary of remarks by Mary Ellen O’Connell).

   
   

   treatment plants—are at risk of attack by adversaries.5 Military and intelligence officials have repeatedly warned that malicious hackers could disrupt critical infrastructure with the click of a mouse, causing severe economic loss, persistent blackouts or even mass casualties.6 The issue of how to protect the

   state from such attacks, internationally, has not been resolved, leaving significant differences between states, and between commentators, on this issue.

   
   

   In March 2003, the United States argued that Iraq was developing weapons of mass destruction, and undertook Operation Iraqi Freedom. The invasion of Iraq was bitterly contested internationally. After the invasion, U.N. Secretary- General Kofi Annan spoke of “a fork in the road” and declared that “this may

   be a moment no less decisive than 1945 itself, when the U.N. was founded.”7

   Questions were raised about the effectiveness of the United Nations, and international law more generally, to deal with new threats. Some states, like the United States, seemed to argue that states were no longer obliged to wait until there was agreement in the Security Council before acting unilaterally or in ad

   hoc coalitions against the terrorist threats.8 This position represented a

   fundamental change to the principles on which world peace and stability have been based for the last fifty-eight years under the U.N. Charter framework.

   
   

   In response, the Secretary-General set up a High-level Panel on Threats, Challenges and Change, to examine global peace and security issues, identify how collective security may address these threats, and recommend changes that may be needed. In 2004 the group issued its report, A More Secure World.9 In 2005 the Secretary-General issued his own report, In Larger Freedom.10 In all of these instruments there was a recognition that the nature of twenty-first century threats had changed such that even the most powerful states were vulnerable.11 However, the consensus from all of the reports was that no change in the U.N. Charter provisions on the use of force was needed. The long-established prohibition on the use of force in Article 2(4) and the right of

   
   

5. Obama, supra note 3.

6. See text accompanying notes 32–57.

7. U.N. GAOR, 58th Sess., 7th plen. mtg. at 3, U.N. Doc. A/58/PV.7 (Sept. 23, 2003).

8. See, e.g., WHITE HOUSE, THE NATIONAL SECURITY STRATEGY OF THE UNITED STATES OF AMERICA 25 (2002).

9. Supra note 1.

10. U.N. Secretary-General, In Larger Freedom: Towards Development, Security, and Human Rights for All, U.N. Doc. A/59/2005 (Mar. 21, 2005) [hereinafter U.N. Secretary-General, In Larger Freedom].

11. U.N. Report, A More Secure World, supra note 1, at 11.

    self-defense in Article 51 were adequate to meet the new threats.12 Nevertheless, international law on the use of force, its content, application, and effectiveness in dealing with the cyber threats has been the object of much debate.

    
    

    Indeed, cyber instability poses the same challenge to international peace and security as the threats of terrorism, transnational organized crime, poverty, infectious diseases, environmental degradation, and nuclear, biological chemical, and radiological weapons, as outlined in the U.N. reports.13 If consensus on the rules related to the use of force in cyberspace is not achieved,

    the result will be a self-help system within the cyber domain, with potential spillover into the kinetic sphere. Within this domain mistrust will dominate, and opportunities for cooperation for long-term stability and mutual gain will be lost.

    
    

    The principles related to the use of force have long helped—although not perfectly—world peace and stability. They stand firmly against aggression,14 facilitate a minimum level of order, and can facilitate a stable basis for exchange, agreement, human creativity, and innovative opportunity in

    cyberspace. This Article argues that, given the central importance of stability for all states in the cyber domain, the international community must work to preserve the normative principles of jus ad bellum and find opportunities to apply these principles in the cyber context. States must work towards a harmonization of what each state understands to be a use of force in cyberspace. Agreement over the contours of sovereignty and self-defense in cyberspace will allow states to develop common terminology, improve predictability, and manage potential crises in the cyber domain.

    
    

    1. THE CHALLENGES: PRINCIPLES OF SOVEREIGNTY AND

       SELF-DEFENSE COLLIDE

       
       

       The challenge in reaching such a new security consensus among states in the cyber domain is multifaceted. First, states may disagree about the nature of the threat in the cyber realm. How one defines the threat will dictate the mechanisms adopted to address the threats. A state may view the cyber threats

       
       

12. U.N. Secretary-General, supra note 10, at 39; U.N. Report, A More Secure World, supra note 1, at 55.

13. U.N. Report, A More Secure World, supra note 1, at 38–40 (discussing the threats of weapons of mass destruction, terrorism, and transnational organized crime).

14. Michael N. Schmitt, Responding to Transnational Terrorism Under...