Scenario 30: Backdoors and implants

This scenario considers a series of cyber operations by an acting State which maintains backdoors in the responding State’s networks for later use. The responding State counters by establishing a backdoor in the offending State’s networks and using it to thwart the acting State’s operation. This scenario analyses the rules of State responsibility, including the international obligations that may have been breached, the rules of legal review of cyber weapons, and the possibility of justifying the responding State’s response by the law of countermeasures and self-defence.
==Scenario==
===Keywords===
Backdoors, sovereignty, prohibition of intervention, use of force, countermeasures, legal review of cyber weapons.
===Facts===
[F1] State A and State B are two rival States with a history of tensions. There are currently no hostilities between them. However, State A’s military intelligence service maintains backdoors in several targets in State B:
* Incident 1: State A exploits zero-day firmware vulnerabilities to access military drones operated by State B. This allows State A to maintain a backdoor in the drones, which can be used to exfiltrate visual data in real-time, take control of the drones, or crash them.
* Incident 2: Additionally, State A uses zero-day vulnerabilities in the firmware of programmable logic controllers (PLCs) of energy distribution networks in State B to open backdoors, which can be used to implant malware designed to cause large-scale blackouts affecting 20 percent of State B’s population. 
* Incident 3: State A also maintains backdoors in State B’s Ministry of Foreign Affairs servers open to the internet, which it can use to execute a payload for editing and defacing the Ministry’s website.
[F2] In parallel, State B’s military intelligence service has infiltrated the command-and-control infrastructure of State A’s military intelligence service. State B maintains an active backdoor in the infrastructure, closely observing the activities of State A by exfiltrating data (incident 4). State A decides to use the backdoors in State B to achieve the effects described in incidents 1 to 3 (take control of and crash the drones; cause the blackout; deface the Ministry’s website) (incident 5). However, before the operation is executed, State B uses its backdoor in State A to implant malware which encrypts the command and control infrastructure of State A’s military intelligence service (incident 6), thereby thwarting the attempted operation by State A. Complete reinstallation of all data, including operating system, on the command and control infrastructure, is required. 
===Examples===
*Stuxnet (2010)
*Infiltration by the Netherlands intelligence service of the APT 29 (2014-2018)
*Power grid cyberattack in Ukraine (2015)
*Disruption to the Internet Research Agency’s networks (2018)
*SolarWinds (2020)
*Kyivstar (2023)
==Legal analysis==
For a general overview of the structure of analysis in this section, see Note on the structure of articles.
[L1] After a very brief treatment of attribution, the legal analysis focuses on possible breaches of State A’s international obligations (sovereignty, prohibition of intervention, use of force) and the legality and possible justification for State B’s response (countermeasures, self-defence). It also covers the questions of cyber espionage and cyber weapons review with respect to establishing and using backdoors.
===Attribution===
[L2] All of the incidents are clearly attributed by the fact description to State A’s and State B’s military intelligence services. Both State A’s and State B’s military intelligence services are state organs exercising an executive function, irrespective of the legality of their conduct under national or international law.ILC Articles on State Responsibility with commentaries, commentary to Article 4, para 13; and Article 7. Therefore, their conduct is attributable to the States in question.
=== Breach of an international obligation ===
==== Sovereignty ====
[L3] As regards incidents 1 to 4, no individual whose conduct was attributable to State A was physically present in the territory of State B and vice versa. Malware itself cannot be considered as an organ or other agent of a State. The Experts drafting the Tallinn Manual 2.0 agreed that this option only applied to physical incursion of an individual into the territory of another State.Tallinn Manual 2.0, commentary to Rule 4, para 6. Also, no actual physical damage or loss of functionality was caused by incidents 1 to 4, because mere installation of backdoors (and the accompanying exfiltration of data) is below the threshold of loss of functionality.Tallinn Manual 2.0, commentary to Rule 4, para 14. Interference with inherently governmental functions is not applicable to any of the incidents, even though incidents 1 and 4 deserve a closer look: defence is an inherently governmental function, and even though the security of military drones and hence also their military value are interfered with by the mere opening of the backdoor, the operation has no direct effect on their functioning at the moment. Neither do any of the incidents qualify as a usurpation of an inherently governmental function.
[L4] The analysis of incident 5 (specifically, the attempted takeover of the drones and the attempted blackout) is complicated by the fact that the threat did not fully materialize. State A attempted to make use of the maintained backdoors, but the attempt was thwarted by State B. A possible interpretation is that if the effects intended by State A in incident 5 did materialize, then they would clearly amount to a violation of sovereignty (physical damage due to the destruction or capture of drones, possibly the large-scale loss of functionality due to the power outage; and interference with national defence, foreign relations, and energy supply which is heavily regulated both domestically and internationally). However, as the attempt was thwarted, it did not constitute an internationally wrongful act in itself by way of violation of sovereignty.ILC Articles on State Responsibility with commentaries, commentary to Article 14, para 13. The Articles on State Responsibility neither explicitly define an “attempt” nor consider its illegality, but the commentary states that “attempt[s]” have to be considered with reference to the primary rules in question (e.g. sovereignty). Unless the particular primary rule prohibits attempts as such, as is the case with the prohibition of genocide or certain terrorism offences, then attempts do not constitute internationally wrongful acts.
[L5] An alternative view of the attempt in incident 5 would be that an act already “occurs” once the specific action is executed, i.e. when the decision to activate the payload is taken, even if the effects do not materialize. “Preparatory conduct does not itself amount to a breach if it does not 'predetermine the final decision taken'”.ILC Articles on State Responsibility with commentaries, commentary to Article 14, para 13. However, the decision to execute the payload has already been taken, which would lead to the harmful effect. Therefore, on that view, a violation has occurred.
[L6] No physical presence or physical damage is involved in incident 6. Loss of functionality was caused by State B’s actions in incident 6 (encryption of the command-and-control infrastructure of State A’s military intelligence service). This loss of functionality would necessitate the replacement of hardware or at least the reinstallation of the operating system on the targeted devices. Therefore, the action of State B breached the sovereignty of State A. This conclusion is without prejudice to the question whether a justification exists that would preclude the wrongfulness of this action (see paras L16–L23 below).
[L7] Military intelligence is a function of a State which cannot be engaged in by a non-State actor, and hence it is considered as an inherently governmental function.Tallinn Manual 2.0, commentary to Rule 4, para 17. Therefore, the action of State B in incident 6 disabling the capability constitutes an interference with an inherently governmental function. Again, this conclusion is without prejudice to the question whether a justification exists that would preclude the wrongfulness of this action (see paras L16–L23 below).
==== Prohibition of intervention ====
[L8] Incidents 1 through 6 interfere with the target State’s domaine réservé, as they bear on matters in which the target State may decide freely. Incident 1 affects national defence of State B; incident 2 affects national electrical power distribution (generally seen as part of a State’s critical infrastructure)Some authors have expressed the opinion that electrical power distribution is not necessarily part of a State’s domaine réservé, as the distribution companies may be privately owned. However, this opinion has not been supported by any official State position on the applicability of international law to cyberspace. On the contrary, New Zealand, Norway and the United Kingdom have all explicitly stated that a cyber operation disrupting power distribution may qualify as a prohibited intervention, with Estonia and Japan considering critical infrastructure more broadly [link to PoI in the Toolkit]. and, depending on the circumstances, also national defence of State B; incident 3 has a bearing on the conduct of external relations of State B; and incident 4 is targeted against the military intelligence (national defence) of State A. The intended results of incidents 5 and 6 are the realization of the danger posed by the backdoors described in incidents 1 through 4, so they also interfere with the domaine réservé.
[L9] However, their level of coerciveness varies. According to one interpretation, the mere establishment of backdoors in incidents 1 through 4 does not compel the target State to change its behaviour nor deprives it of control over the protected matter, so these activities would not constitute coercion. The alternative interpretation is that the target State would need to take actions to defend its systems from the threats posed by the backdoors once it finds out. This effectively coerces State B to defend its systems or bear even more serious coercive consequences. For the present author, the latter interpretation is more convincing, because the security of certain critical systems is impacted by the mere opening of the backdoor (analogical argument to interference with inherently governmental functions in L3). Of course, this approach would entail the need to identify a threshold below which such incidents would not coerce the target State to prevent the consequences.
[L10] Nevertheless, the attempt at causing the effects in incident 5 (specifically, the control of drones and the power outage) is clearly coercive, as it is meant to deprive State B of control over its military equipment and the power grid. In this case, the fact that it is a mere attempt without actual effects might not prevent its qualification as prohibited intervention – State A effectively coerced State B to defend its systems or bear even more serious coercive consequences. 
[L11] Incident 6 deprives State A of control over its government infrastructure and is intended to stop the operation described in incident 5, so it is clearly coercive by State B. This conclusion is without prejudice to the question whether a justification exists that would preclude the wrongfulness of this action (see paras L16–L23 below).
==== Use of force ====
[L12] Incidents 1 to 4 did not cause and were not reasonably likely to cause physical damage to property, loss of life or injury to persons, including through their direct and indirect consequences. Nor were they significant enough to affect state security by causing effects that would be analogous to a kinetic use of force.Tallinn Manual 2.0, commentary to Rule 69, para 9. They therefore did not amount to a use of force as understood in international law.
[L13] Incident 5 (control of drones) is an attempted use of force, because the takeover of the drones would mean their destruction or capture by the adversary. The second part of incident 5 (attempted power outage), if realized, may constitute use of force if the power outage had the potential to cause physical damage or injury, either directly, or due to cascading effects. The third part of incident 5 (attempted website defacement) is neither a use of force nor a threat of force unless the defacement placed credible and attributable written threats on the website.
[L14] Depending on the potential scale and effects of incident 5 (control of drones and power outage), it might amount to an imminent armed attack to which State B might react in self-defence (see para. L23 below).
[L15] Incident 6 targets the command-and-control infrastructure of the malware; unless the disabling of the infrastructure would cause a spillover effect, it could not cause physical damage to property or be significant enough to affect state security by causing effects that would be analogous to a kinetic use of force.
=== Response of State B ===
==== Countermeasures ====
[L16] State B could argue that the operation described in incident 6 amounts to a lawful countermeasure.
[L17] There is a prior internationally wrongful act of State A (violation of sovereignty in incident 1; and prohibited intervention and a use of force in incident 5).
[L18] State A’s operation in incident 5 is imminent, so it is necessary for State B to act immediately in order to preserve its rights.ILC Articles on State Responsibility, Article 52(2). State B is therefore taking urgent countermeasures and it does not have to notify State A in advance, because this would defeat the purpose of the countermeasures. The obligation of State B to call upon State A to fulfil its obligations remains unaffected,ILC Articles on State Responsibility, Article 52(1)(a) read together with Article 52(2). but it also should not be construed as a prior requirement because this would have a similar effect as a prior notification and hence would also undermine the efficiency of the countermeasures.See also the national positions of Italy (2021) 7–8 (“The victim-State is generally required to call upon the State of origin to discontinue the wrongful act and to notify it of its intention to take countermeasures in response to wrongful cyber operations. However, in conformity with international law, this requirement may not apply if immediate action is needed to enforce the rights of the injured State and to prevent further damage.”); United States (2021) 142 (“Before an injured State can undertake countermeasures in response to a cyber-based internationally wrongful act attributable to a State, it generally must call upon the responsible State to cease its wrongful conduct, unless urgent countermeasures are necessary to preserve the injured State’s rights.”).
[L19] State B can argue that the aim of the countermeasures is to make State A comply with the legal consequences of its internationally wrongful act (cessation, non-repetition, and reparation). Due to State B’s operation, State A was forced to cease its operation and will not be able to repeat it anytime soon. There is no information about any goals of State B’s operation that would be retaliatory or would otherwise go beyond the legal limits of countermeasures. 
[L20] The countermeasures are theoretically reversible; in the case that State A would comply with its international obligations, State B can decrypt the targeted systems, although this is unlikely to be demanded by State A in practice.
[L21] The countermeasures do not violate any peremptory norms or obligations arising from diplomatic or consular inviolability and they do not reach the level of threat or use of force.
[L22] They are commensurate with the potential injury suffered. Disabling the military intelligence systems of State A has a detrimental effect on its national defence, but it is not out of proportion with the effect intended by State A in its attempted operation (takeover of drones and power outage). 
====Self-defence====
[L23] The anticipated effects of incident 5, if materialized, might be serious enough to be considered as a use of force. However, the category of armed attack is reserved for the most grave uses of force, and the only instance of use of force (potential control and destruction of drones) may or may not be grave enough, depending, again, on the anticipated effects. If the anticipated effects were deemed to be serious enough, State B would be entitled to anticipatory self-defence to an imminent armed attack.
====Legal review of cyber weapons====
[L24] The malware used by State A and State B to establish and maintain backdoors, and the payload used by States A and B to cause the effects intended in incidents 5 and 6, would likely be subject to review and other requirements of Article 36 of Additional Protocol I as a weapon or other means or methods of warfare (if they cause physical destruction or loss of functionality or have other effects on the adversary in their normal or expected use). Any internal guidance on the use of the malware in a possible armed conflict could be regarded as a method of warfare and should likewise be subject to review. The fact that State A and State B are not currently in an armed conflict does not invalidate the obligation.
[L25] The malware is meant to target military systems and critical infrastructure, and hence it would be important to ensure its proper targeting and effect. Both State A and State B must consider possible indiscriminate effect of the malware, such as its uncontrollable spreading and side effects on the civilian population and protected objects.David Wallace, ‘Cyber Weapon Reviews under International Humanitarian Law: A Critical Analysis’ (2018) Tallinn Paper No. 11, 20.
==Checklist==
*What was the method of establishing and maintaining the backdoor?
*Did the operation cause a loss of computer, network, or off-network functionality?
*Did the operation target diplomatic or consular correspondence?
*Did the operation affect the domaine réservé of the target State?
*Was the operation coercive?
*Is this an example of an operation which would qualify as a prohibited intervention but not as a violation of sovereignty?
*Was the effect of the operation equivalent to a kinetic use of force?
*Were all the conditions and requirements for launching countermeasures met?
*Was a legal review in accordance with Article 36 AP I required for the use of a cyber capability?
*Did the operation affect an inherently governmental function?
==Appendixes==
===See also===
*Scenario 02: Cyber espionage against government departments
*Scenario 10: Legal review of cyber weapons
*Scenario 13: Cyber operations as a trigger of the law of armed conflict
*Sovereignty
*Prohibition of intervention
*Use of force
*Countermeasures
*Legal review of cyber weapons
===Notes and references===
===Bibliography and further reading===
*Antonio Coco, Talita Dias, Tsvetelina van Benthem, ‘Illegal: The SolarWinds Hack under International Law’ (2022) 33(4) European Journal of International Law 1275
*Marco Roscini, Cyber Operations and the Use of Force in International Law (OUP 2014)
*Michael N. Schmitt et al (eds), Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations (Cambridge University Press 2017)
*David Wallace, ‘Cyber Weapon Reviews under International Humanitarian Law: A Critical Analysis’ (2018) Tallinn Paper No. 11
===Contributions===
*Scenario by: Tomáš Minárik
*Analysis by: Tomáš Minárik
*Reviewed by: Przemysław Roguski, Kurt Sanger
Previous: Scenario 29: Water infrastructure	Next: Scenario 31: Sharing degrading content
Category:Scenario
Category:Sovereignty
Category:Prohibition of intervention
Category:Use of force
Category:Countermeasures
Category:Legal review of cyber weapons