nyuuzyou/wikis huggingface dataset:
Chinese PLA Unit 61398 indictments (2014)

Date 	19th May 2014
Suspected actor	The U.S. Government identified five members of the Chinese People's Liberation Army of the Unit 61398 (known to be the cyber-unit of the People's Liberation Army) as the authors of the hacking operation.
Target 	Networks and business data (such as trade secrets, internal communication data and other sensitive business information) of multiple large US companies of the nuclear power, metals and solar products industries, such as Westinghouse Electric Co. (Westinghouse), U.S. subsidiaries of SolarWorld AG (SolarWorld) and United States Steel Corp. (U.S. Steel).
Method 	The individuals hacked into the computer networks of the targeted companies and stole a range of confidential information. 
The group sent spearphishing e-mails to U.S. Steel employees, which led to the installation of malware on U.S. Steel computers. This enabled the group to steal hostnames and descriptions of U.S. Steel computers and to identify and exploit vulnerable servers on that list.
Purpose 	The operation was aimed at accessing the computers of the named companies and to steal confidential business information of the latter which could be useful to competing Chinese companies. The stolen information ranged from only proprietary technical and design specifications for pipes and production line information costs to emails of senior employees containing future business and sensitive innovation strategies. Additionally, the hackers stole privileged attorney-client communications relating to ongoing trade litigation in order to manipulate the outcome of the trade dispute.
Aftermath 	In May 2014 the U.S. authorities publicly indicted five members of the hacking group for computer hacking and economic espionage directed at six U.S. https://www.fbi.gov/news/stories/five-chinese-military-hackers-charged-with-cyber-espionage-against-us companies. More specifically, the indictment alleges that the group conspired to hack into the networks of US companies in order to maintain unauthorized access to their computers and to steal confidential business information which would then grant an advantage to Chinese competitor businesses.
Analysed in 	Scenario 09: Economic cyber espionage
Category:Example
Category:2014
Circumstances precluding wrongfulness

== Definition ==
Circumstances precluding wrongfulness
A specific cyber-relation action or omission will only constitute an internationally wrongful act in the absence of circumstances precluding its wrongfulness.Cf. ILC Articles on State Responsibility, commentary to Part One, chapter V, para 1 (“The existence in a given case of a circumstance precluding wrongfulness ... provides a shield against an otherwise well-founded claim for the breach of an international obligation”).
The wrongfulness of specific conduct is precluded if one of the following conditions is met:
# the State affected by that conduct gives its valid consent to the commission of the relevant act, as long as the act remains within the limits of that consent;ILC Articles on State Responsibility, Art 20.
# the conduct of the acting State qualifies as a lawful measure of self-defence taken in conformity with the UN Charter;ILC Articles on State Responsibility, Art 21.
# the conduct of the acting State constitutes a lawful countermeasure taken against another State;ILC Articles on State Responsibility, Arts 22 and 49–54.
# the conduct of the acting State is justified by the existence of a situation of force majeure;ILC Articles on State Responsibility, Art 23.
# owing to a situation of distress, the acting person has no other reasonable way of saving their own life or the lives of other persons entrusted to their care;ILC Articles on State Responsibility, Art 24.
# the conduct of the acting State is the only way for the State to safeguard an essential interest against a grave and imminent peril (also referred to as acting under the “plea of necessity”).ILC Articles on State Responsibility, Art 25.
Publicly available common and national include:
 (2024),
 (2024).
== Common positions==
===European Union (2024)===
== National positions ==
===Czech Republic (2024)===
== Appendixes ==
=== See also ===
=== Notes and references ===
=== Bibliography and further reading ===
Category:Legal concepts
Conduct of hostilities

==Common positions==
===African Union (2024)===
===European Union (2024)===
==National positions==
===Costa Rica (2023)===
===Czech Republic (2024)===
===France (2019)===
===Israel (2020)===
===Netherlands (2019)===
== Appendixes ==
=== See also ===
=== Notes and references ===
=== Bibliography and further reading ===
Category:Conduct of hostilities
Category:Legal concepts
Cyber incident against a water authority in Pennsylvania (2023)

Date 	November 25, 2023.Whyy (PBS), ‘Cybersecurity at water utilities a national concern after Pa. water authority hacked’ (2 January 2024).
Suspected actor	A hacktivist group known as ‘Cyber Av3ngers’ took credit for the attack.Cyberscoop, ‘Pennsylvania water facility hit by Iran-linked hackers’ (28 November 2023). The group was officially attributed to the Iranian Islamic Revolutionary Guard Corps (IRGC) by the United States.Waterworld, ‘Treasury sanctions Iranian actors behind Aliquippa water authority cyberattack’ (6 February 2024)
Target 	
Target systems 	A programmable logic controller (PLC), responsible for regulating water pressure, was targeted and disabled at one of the authority’s booster pump stations.Securityweek, ‘Hackers Hijack Industrial Control System at US Water Utility’ (27 November 2023).
Method 	The attackers took control of a PLC, a Unitronics Vision system, containing an integrated human-machine interface (HMI) which connected it to the internet. Unitronics Vision products are known to sometimes contain vulnerabilities which allow hackers to insert malicious code,Incibe, ‘Embedded malicious code vulnerability in Unitronics Vision1210’ (6 July 2023) which in this case allowed the attackers to compromise the device.
Purpose 	Supposedly motivated by the ongoing Israel-Hamas conflict, Cyber Av3ngers claimed that the device was specifically targeted due to its manufacturer, Unitronics, being an Israeli company. The screen of the compromised PLC displayed the message: “You have been hacked. Down with Israel. Every equipment[sic] ‘made in Israel’ is a Cyber Av3ngers legal target.”ABC 15 News, ‘Fact Check Team: Iranian cyberattack poses threat to Pennsylvania water utilities’ (5 January 2024). The group has claimed responsibility for several cyber attacks against Israeli infrastructure, though the veracity of their claims has been doubted.
Result 	According to a representative of the water authority, the attack was quickly identified and the PLC was disabled, switching to manual operation. No harm was reported to local residents reliant on the water supply.Waterworld, ‘Aliquippa, Pennsylvania suffers cyberattack on booster station PLC’ (30 Nov 2023).
Aftermath 	In response to the attack, the U.S. Department of the Treasury unveiled sanctions against six officials of the IRGC Cyber Electronic Command.
Analysed in 	Scenario 29: Cyber operations against water and water infrastructure
Collected by: Tom Davies
Category:Example
Category:2023
Cyber incident against a water treatment plant in San Francisco Bay Area (2021)

Date 	January 15, 2021.NBC News, ‘50,000 security disasters waiting to happen: The problem of America's water supplies’ (17 June 2021)
Suspected actor	Unknown attacker.
Target 	Water treatment plant in San Francisco.
Target systems 	N/A
Method 	The attacker had the login details of a plant employee’s TeamViewer account, a program which allows users remotely connect to and control their work computers. Once the attacker gained access, they deleted programs which the plant used to treat drinking water.Security Affairs, ‘Threat actors in January attempted to poison the water at a US facility’ (21 June 2021).
Purpose 	Unknown.
Result 	The attack was discovered the day after the account was compromised. Accordingly, passwords were changed and the deleted programs were reinstalled. No harm was reported to local citizens reliant on the plant’s water.
Aftermath 	Several similar, but unsuccessful, cyber attacks on water treatment plants followed using similar means.Cyble, ‘Water and Wastewater treatment facilities vulnerable to Cyber Attacks’ (4 May 2022). Consequently, the Biden administration in conjunction with the U.S. Environmental Protection Agency announced the ‘Industrial Control Systems Cybersecurity Initiative – Water and Wastewater Sector Action Plan’ in January 2022, an initiative designed to strengthen the cyber-resilience of water treatment plants.U.S. Environmental Protection Agency, ‘EPA Announces Action Plan to Accelerate Cyber-Resilience for the Water Sector’ (27 January 2022).
Analysed in 	Scenario 29: Cyber operations against water and water infrastructure
Collected by: Tom Davies
Category:Example
Category:2021
Cyber interference against vessels in the Persian Gulf and Gulf of Oman (2019)

Date 	Between May and July 2019.“Shipping Industry Faces GPS Disruption in Persian Gulf”, 7 August 2019, Satelles.
Suspected actor	Unknown. According to a warning issued by the US Maritime Administration (MARAD), ‘Iran and its [p]roxies’ were involved in some of these incidents.US Department of Transportation – Maritime Administration, “2019-012-Persian Gulf, Strait of Hormuz, Gulf of Oman, Arabian Sea, Red Sea-Threats to Commercial Vessels by Iran and its Proxies”, July 2019.
Target 	US and UK commercial and Coast Guard ships operating in the Persian Gulf, Strait of Hormuz, and Gulf of Oman.S Westall, “U.S. tells commercial vessels to send Gulf transit plans in advance”, Reuters.
Target systems 	Maritime navigation systems; Automatic Identification Systems (AIS); and bridge-to-bridge communications systems.
Method 	GPS spoofing, i.e., tricking ships’ receivers with counterfeit satellite automatic identification signals generated to gain control of a maritime navigation system;MW Bockmann, “Seized UK tanker likely ‘spoofed’ by Iran”, 16 August 2019, Lloyds List. and spoofing AIS and/or bridge-to-bridge communications in order to falsely claim the identity of another vessel.
Purpose 	The disruption of ships’ navigation systems was allegedly aimed at sending vessels off course into Iranian waters to create an opportunity for Iranian forces to seize the vessels.R Pickrell, “Iran is reportedly jamming ship GPS navigation systems to get them to wander into Iranian waters”, 8 August 2019, Business Insider. The spoofed communications were allegedly used by unknown entities to falsely claim to be US warships or to disguise Iranian military vessels as merchant ships.R Browne and B Starr, “US government warns of Iranian threats to commercial shipping, including GPS interference”, 7 August 2019, CNN.
Result 	GPS interference and AIS spoofing operations sent vessels off their course into Iranian waters, which resulted in the seizure of several vessels by the Iranian forces.
Aftermath 	These incidents occurred in the context of heightened tensions between Iran and the US, which reportedly included cyber attacks carried out by the US against Iranian cyber capabilities.JE Barnes, “U.S. Cyberattack Hurt Iran’s Ability to Target Oil Tankers, Officials Say”, 28 August 2019, The New York Times. Following these incidents, a joint effort was set up by the US and the UK to protect shipping in the area,B Mueller, “U.K. Joins U.S.-Led Effort to Protect Ships in Strait of Hormuz”, 5 August 2019, The New York Times. and US-flagged ships were instructed to notify both the US and the UK when transiting the region.
Analysed in 	Scenario 16: Cyber attacks against ships on the high seas
Collected by: Giulia Carlini
Category:Example
Category:2019
Category:Law of the sea
Ethiopian surveillance of journalists abroad (2017)

Date 	2017
Suspected actor	According to Citizenlab, the attackers' IP addresses indicated that the Ethopian government is behind the espionage.
Target 	The operation was conducted against Ethiopian dissidents living in Canada, United States, Germany, Norway, United Kingdom who were journalists, activists, and critics of Ethopian politics from as well as government officials from Eritrea.
Method 	After the Ethiopian government had acquired the espionage software from the Israeli software company 'Cyberbit', spear- phishing emails were sent to selected individuals containing various links. The links then prompted the downloading of a fake Adobe Flash Player update which led to the installation of the malware/spyware on their computers.
Purpose 	The espionage operation can be seen as part of the Ethiopian governments efforts to keep under surveillance (and to silence) individuals criticizing the regime and speaking up against human rights violations committed in Ethiopia.
Aftermath 	The operation was revealed in a report by Citizenlabhttps://citizenlab.ca/2017/12/champing-cyberbit-ethiopian-dissidents-targeted-commercial-spyware/. The incident triggered a debate regarding the responsibility of software firms like Cyberbit - considering that this was not the first time the Ethiopian government had bought surveillance software - as espionage software can present an important tool for oppressive governments to maintain their power for years.
Analysed in 	Scenario 02: Cyber espionage against government departments
Category:Example
Category:2017
Freedom of navigation

== Definition ==
Freedom of navigation
Article 87(1) UNCLOS provides for the freedom of navigation with respect to ships on the high seas.Law of the Sea Convention, Part VII, Art 87 (1). This freedom is also found in other treatiesFor example, the Geneva Convention on the High Seas (entered into force 30th September 1962) 450 UNTS 11, article 2(1). and in customary international law.“Union of Soviet Socialist Republics-United States: Joint Statement with Attached Uniform Interpretation of Rules of International Law Governing Innocent Passage” (1989) 28 International Legal Materials 1444 (The Jackson Hole Statement). 
In accordance with the freedom of navigation, every State has the right to sail ships flying its flag on the high seasLaw of the Sea Convention, Part VII, Art 90. without being subject to the jurisdiction of other States.M/V “Norstar” judgment, para 216 “Freedom of navigation would be illusory if a ship – a principal means for the exercise of the freedom of navigation – could be subject to the jurisdiction of other States on the high seas”. In essence, this means that the ship has “the right to traverse the high seas with no or minimal interference from any other State”.Albert Hoffman, ‘Freedom of Navigation’ in Rudiger Wolfrum Max Planck Encyclopaedia of Public International Law (OUP 2011) para 22. 
In the Norstar judgment, the International Tribunal for the Law of the Sea (ITLOS) considered that any interference with a ship’s navigation by a foreign State would breach Article 87 UNCLOS,M/V “Norstar” judgment, para 222. including those acts of interference, which are not physical in nature.M/V “Norstar” judgment, para 223. According to the Tribunal, non-physical acts of interference may constitute a breach of the freedom of navigation, even if they do not involve enforcement or if they do not produce a ‘chilling effect’ on the flag State.M/V “Norstar” judgment, para 224, referred to as a “chilling effect”. This suggests that non-enforcement cyber operations by non-flag States also qualify as breaches of the freedom of navigation, provided that they impermissibly interfere with navigation of a foreign vessel on the high seas. 
To be lawful, any interference with a vessel’s freedom of navigation must be provided for in the UNCLOS regime (notably the right of visitLaw of the Sea Convention, Part VII, Art 110. and hot pursuitLaw of the Sea Convention, Part VII, Art 111.), in another international treaty,M/V “Norstar” judgment, para 224 “…save in exceptional cases expressly provided for in the Convention or in other international treaties…”; Y Tanaka, ‘Navigational Rights and Freedoms’ (2015) in Donald Rothwell, Alex Oude Elfernik, Karen Scott and Tim Stephens The Oxford Handbook of the Law of the Sea (OUP 2015) 556; see also Geneva Convention on the High Seas (entered into force 30th September 1962) 450 UNTS 11, Arts 22-23. or in customary international law.
== Appendixes ==
=== See also ===
* Scenario 16: Cyber attacks against ships on the high seas
=== Notes and references ===
=== Bibliography and further reading ===
Category:Law of the sea
Category:Freedom of navigation
Category:Legal concepts
French presidential election leak (2017)

Date 	Discovered on 5 May 2017J Borger, “As France becomes latest target, are election hacks the new normal?” (6 May 2017), The Guardian.
Suspected actor	Hacker group “APT (Advanced Persistent Threat) 28”, also referred to as “Fancy Bear”, linked with the Russian GRU according to US intelligence.M Hosenball, “U.S. increasingly convinced that Russia hacked French election: sources” (10 May 2017), Reuters. The US National Security Agency’s director, M. Rogers, suggested in a hearing at the US Senate’s Armed Forces Committee that at least some of the electoral interference can, by evidence, be blamed on Russia.A Greenberg, “The NSA confirms it: Russia hacked French election ‘infrastructure’” (9 May 2017), Wired.
Victims 	The French En Marche political party and its head, E. MacronA Breeden, S. Chan, N. Perlroth, “Macron Campaign Says It Was Target of ‘Massive’ Hacking Attack” (5 May 2017), NY Times.
Target systems 	ICT systems used by the En Marche political party’s staff members
Method 	Around 9GB of data consisting of emails, accounting documents and contracts were leaked from hacked personal and professional accounts of the En Marche political party’s staff members and published on social media as #MacronLeaks and posted on the document-sharing site Pastebin.K Willsher, J Henley, “Emmanuel Macron’s campaign hacked on eve of French elections” (6 May 2017), The Guardian. It is estimated that the data breach occurred through a series of spear-phishing attacks: i.e. “creating fake login pages targeted at individuals in an attempt to encourage them to enter their usernames and passwords, giving the hackers access to confidential information”.A. Hern, “Macron hackers linked to Russian-affiliated group behind US attack” (8 May 2017), The Guardian.
Purpose 	As false documents were added to genuine stolen documents and leaked, the purpose could have been to influence the outcome of the French presidential election by influencing public opinion and harm the reputation of the En Marche political movement. At the time when the documents were leaked, the En Marche’s presidential candidate, E. Macron, was ahead in the opinion polls with a prognosis that he would win the election with a share of 62-63% of votes.K Willsher, J Henley, “Emmanuel Macron’s campaign hacked on eve of French elections” (6 May 2017), The Guardian.
Result 	Despite the leaks, E. Macron won the French presidential election against M. Le Pen (Front National) by a 66% to a 34% margin.
Aftermath 	The French presidential election hack added salt to the wound of increased interferences by non-state actors and foreign States into national electoral processes.
Analysed in 	Scenario 01: Election interference
Collected by: Mihkel Pikkat
Category:Example
Category:2017
Google shutting down an active counterterrorism operation (2020)

Date 	The first attacks were discovered in February 2020, the second wave of attack is dated October 2020.Project Zero,  In-the-Wild Series: October 2020 0-day discovery , (18 March 2021)
Suspected actor	Western government operativesPatrick Howell O’Neill,  Google’s unusual move to shut down an active counterterrorism operation being conducted by a Western democracy , (March 26, 2021), MIT Technological Review
Target 	Devices using iOS, Android and Windows software. Lewis Page,  Google’s Project Zero shuts down Western counter-terrorist hacker team , (29 May 2021), Verdict
Target systems 	Even though the Project Zero team omitted the information who was being targeted, it can be concluded that in general the systems were targeted through browsers  - Safari, Chrome, Samsung Browser.
Method 	The “threat actor” conducted an attack in which he was luring the users of the browsers in through a never-before-seen “watering hole website” that would attempt to infect some devices using a mixture of three zero-day and other “n-day” (already publicly known) vulnerabilities. The website was pointing to two exploit servers that hosted exploit chains for Android, Windows, and iOS devices.
Purpose 	According to the findings by the MIT Technological Review, the attacks were part of a counter-terrorism operations.
Result 	After nine months of a hacking operation, Google’s security teams exposed it. Moreover, since the “expert” hacking group exploited 11 powerful vulnerabilities, Project Zero consider this operation as a big success. On the other hand, when MIT revealed that the “expert” hacking group were actually Western government operatives actively conducting a counterterrorism operation, it raised the question if the disclosure of such operation is appropriate.Lily Hay Newman,  Security News This Week: Prolific Hackers Hosed by Google Were a Counterterrorism Operation , (27 March 2021), Wired
Aftermath 	The main issue of the operation was the speed and level of the expertise of attacks. Moreover, the fact that so many vulnerabilities were discovered that quickly is still troublesome, as other skilled hackers might have found and exploited them. According to the BGR “the silver lining of these revelations is that Western spies were targeting specific groups of people, which means most Android, iPhone, and Windows users shouldn’t be impacted.”Chris Smith,  A Massive hack that Google thwarted was actually a counterterrorism operation, (28 March 2021), BGR
Analysed in 	Scenario 07: Leak of State-developed hacking tools
Scenario 11: Sale of surveillance tools in defiance of international sanctions
Collected by: Anna Blechová
Category:Example
Category:2020