Armed Attacks in Cyberspace: The Unseen Threat to Peace and Security that Redefines the Law of State Responsibility

As our dependence on computer networks grows, so does our vulnerability. As early as 2013, United States Director of National Intelligence James Clapper told the Senate Intelligence Committee “that cyber attacks and cyber espionage [had] supplanted terrorism as the top security threat facing the country.” On April 1, 2015 President Obama issued an ambitious executive order in which he declared malicious cyber-enabled activities “an unusual and extraordinary threat to the national security, foreign policy, and economy of the United States”, and “a national emergency”. The international community shares the same concern. The United Nations General Assembly has adopted several resolutions expressing the need to collectively address the impact of information and communication technology on international security since 1998. In 2013, the North Atlantic Treaty Organization’s Cooperative Cyber Defense Center of Excellence convened a group of international experts to discuss the applicability of international law to cyber warfare. Their final work, known as the Tallinn Manual, provides a series of draft rules that are a strong indication of how international law will be applied to cyber conflict in the future. Even though these rules are non-binding as such, the International Court of Justice, whose function is to settle disputes in accordance with international law, recognizes academic work as a subsidiary source of the law. Continuing the discussion initiated by the Tallinn Manual is therefore of paramount importance.As the international and academic communities address the rising legal issues of cyber conflict, the temptation to reconsider previously agreed upon interpretations of the rules governing self-defense is greater than ever before. While the new threats and actors arising in cyberspace do require a certain clarification of the law, they do not render existing norms obsolete. The development of specific norms for State conduct in cyberspace should therefore be carefully considered. Consequences of cyber operations are far more difficult to predict and assess, not to mention that cyberspace is an equalizing factor that empowers States and non-State actors to cause heavier damage than they would in conventional war fighting domains, at considerably lower costs. The complex nature of cyberspace means we can no longer afford imprecision in the law, especially when it comes to the right of self-defense, which allows States to use force in response to an armed attack without having to seek prior approval from the United Nations Security Council. Self-defense in cyberspace not only comes with its own set of challenges (the question of whether there is such a thing as an armed attack causing no physical damage); but it also reinforces more obvious questions such as the legality of pre-emptive self-defense, and that of self-defense against non-State actors. This Article explores the legal consequences of cyber armed attacks, and reaffirms the necessarily State-sponsored nature of armed attacks in general. In cases of minimal state involvement, it argues that the threshold for attribution of acts performed by non-State actors should be lowered in order to deter States from resorting to proxies, a practice which appears to be common in cyberspace. Finally, it offers alternative courses of action against non-State actors operating from within a State that is either unable or unwilling to address the threat posed to other States.