Cyber-Attacks and the Exploitable Imperfections of International Law Cyber-Attacks and the Exploitable Imperfections of International Law By Yaroslav Radziwill LEIDEN | BOSTON Library of Congress Cataloging-in-Publication Data Radziwill, Yaroslav, author. Cyber-attacks and the exploitable imperfection of international law / by Yaroslav Radziwill. pages cm Based on author’s thesis (doctoral — University of Warwick, 2014) issued under title: Cyber-attacks and international law : imperfections of a stagnant legal regime. Includes bibliographical references and index. ISBN 978-90-04-29833-0 (hardback : alk. paper) — ISBN 978-90-04-29830-9 (e-book) 1. Information warfare (International law) 2. Cyberspace operations (Military science) I. Title. KZ6718.R33 2015 341.6’3—dc23 2015023019 This publication has been typeset in the multilingual “Brill” typeface. With over 5,100 characters covering Latin, ipa, Greek, and Cyrillic, this typeface is especially suitable for use in the humanities. For more information, please see brill.com/brill-typeface. isbn 978-90-04-29833-0 (hardback) isbn 978-90-04-29830-9 (e-book) Copyright 2015 by Koninklijke Brill nv, Leiden, The Netherlands. Koninklijke Brill NV incorporates the imprints Brill, Brill Hes & De Graaf, Brill Nijhoff, Brill Rodopi and Hotei Publishing. All rights reserved. No part of this publication may be reproduced, translated, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording or otherwise, without prior written permission from the publisher. Authorization to photocopy items for internal or personal use is granted by Koninklijke Brill nv provided that the appropriate fees are paid directly to The Copyright Clearance Center, 222 Rosewood Drive, Suite 910, Danvers, ma 01923, usa. Fees are subject to change. This book is printed on acid-free paper. This book is dedicated to my wonderful, lovely wife Maarja. ∵ Contents Preface ix Abbreviations x Glossary xiv 1 Introduction 1 1.1 Introduction 1 1.2 Objectives and Research Questions 4 1.3 Structure of the Book 9 1.4 Choice of Terminology 11 1.5 Conclusion 14 2 Theoretical Framework 15 2.1 Introduction 15 2.2 Legal Framework 15 2.3 Political Component 28 2.4 Conclusion 39 3 Cyber-Threat 40 3.1 Introduction 40 3.2 The Hypothetical Threat 40 3.3 Reported Cyber-Incidents 57 3.4 Conclusion 83 4 Cyber-Space 85 4.1 Introduction 85 4.2 Territoriality of Cyber-Space 86 4.3 Sovereignty over the Virtual Realm 95 4.4 Jurisdiction in Cyber-Space 109 4.5 Conclusion 123 5 Cyber-Strikes and Jus ad Bellum 125 5.1 Introduction 125 5.2 Cyber-Attacks and the Use of Force 126 5.3 Cyber-Attacks and Self-Defense 142 5.4 Cyber-Attacks and Aggression 160 5.5 Conclusion 171 viii contents 6 Humanitarian Law Perspective 173 6.1 Introduction 173 6.2 General Applicability of International Humanitarian Law 174 6.3 Principle of Humanity 181 6.4 Necessity and Proportionality in Jus in Bello 195 6.5 Principle of Distinction 201 6.6 Deception 214 6.7 Principle of Neutrality 218 6.8 Conclusion 223 7 Cyber-Terrorism 225 7.1 Introduction 225 7.2 Terrorism and Cyber-Terrorism as Legal Concepts 226 7.3 Conventional Cyber-Terrorism 243 7.4 Escalated Conventional Cyber-Terrorism: Jus ad Bellum 247 7.5 Archaic Cyber-Terrorism: Jus in Bello 257 7.6 Conclusion 265 8 Role of International Organizations 266 8.1 Introduction 266 8.2 United Nations as Part of the Problem 267 8.3 United Nations as Part of the Solution 277 8.4 Role of Other International Organizations 301 8.5 Conclusion 310 9 Conclusion 312 9.1 Introduction 312 9.2 Validity of the Idea 312 9.3 A Way Forward 321 Appendix 1—Toolkit of a Modern-Day Cracker 323 Appendix 2—Normative Model for Command Authorities (Jus ad Bellum) 330 Appendix 3—Direct Participation in Hostilities: A List of Academic Examples 332 Bibliography 337 Index 400 Preface In April 2007, Estonia’s attention was focused, for the most part, on the vio- lent riot resulting from the relocation of the Bronze Soldier and on the police brutality pertaining to the suppression of that riot. During this period, Estonia became a target for a number of cyber-attacks. As an Estonian national from Tallinn and an undergraduate student at the University of Tartu at the time, I witnessed these cyber-strikes and had the experience of seeing their consequences firsthand. Moreover, as an Estonian Russian, I understood the broader context of the issue and could follow the reactions to the cyber-offensive in both major ethnic communities. In my experience, the 2007 cyber-attacks were barely noticeable. I could access the Internet as usual and no extraordinary interference was encoun- tered. While the inability to enter my bank (Hansapank) online at one point may or may not have been due to the ongoing cyber-offensive, such problems were not uncommon anyway. Neither ethnic group generally (Estonians nor Estonian Russians) seemed to care particularly about the few cyber-attacks that were visible. Website defacements were viewed as ordinary hooliganism, no more damaging than the physical defacement of Anton H. Tammsaare’s statue with a concise, untranslatable Russian insult to Estonia’s prime minister. Considering my personal experience, it is still surprising to see scholarly descriptions of the 2007 cyber-attacks as severe, devastating and crippling, causing fear and mental anguish among the population. The exaggerated dan- ger of something so minor seems to undermine the seriousness of the threat that severe cyber-attacks could have. In fact, the discrepancy between how the 2007 cyber-strikes felt and how they were perceived abroad is one of the fac- tors that inspired me to write a book on this topic. As work progressed, I came to realize that academic views ranged from those skeptically denying the possibility of cyber-attacks causing any damage whatsoever to those that promise “cyber-apocalypse”. The same range of atti- tudes vis-à-vis cyber-security were encountered in the practical realm, be it the Council of Europe’s Committee of Experts on Terrorism, the NATO Cooperative Cyber-Defense Center of Excellence or the United Nations Counter-Terrorism Implementation Task Force. Thus, while the present book focuses on how international law applies to cyber-warfare, it aims to ensure that cyber-threats are presented in a realistic light, without overemphasizing the danger, but also without giving them too little weight. Abbreviations 3D Three-Dimensional 9/11 11 September 2001 ACHR African Court on Human and Peoples’ Rights AmJIL American Journal of International Law ANZUS Security Treaty between the United States, Australia, and New Zealand AP Additional Protocol to the Geneva Conventions AU African Union CCDCOE NATO Cooperative Cyber Defense Center of Excellence CERT Computer Emergency Response Team CETS CoE Treaty Series CIA US Central Intelligence Agency CIS Commonwealth of Independent States CODEXTER CoE Committee of Experts on Terrorism CoE Council of Europe CTITF UN Counter-Terrorism Implementation Task Force CTS Consolidated Treaty Series CUP Cambridge University Press DDoS Distributed Denial of Service DISEC Disarmament and International Security Committee DoD US Department of Defense DoS Denial of Service DNS Domain Name System DPKO UN Department for Peacekeeping Operations DPRK Democratic People’s Republic of Korea DRC Democratic Republic of Congo ECHR European Convention on Human Rights ECOWAS Economic Community of West African States ECtHR European Court of Human Rights EICAR European Institute for Computer Antivirus Research EJIL European Journal of International Law ENDC Estonian National Defense College ENISA European Network and Information Security Agency ESIL European Society of International Law ETA Basque Homeland and Freedom (Euskadi Ta Askatasuna) EU European Union EUR Euro abbreviations xi FARC Revolutionary Armed Forces of Colombia—People’s Army (Fuerzas Armadas Revolucionarias de Colombia—Ejército del Pueblo) FBI US Federal Bureau of Investigation G20 Group of Twenty GBP British Pound Sterling GC Geneva Convention (1–4)1 GPS Global Positioning System HC Hague Convention (1–4; 1–14)2 HCA Annex to a Hague Convention IACHR Inter-American Commission on Human Rights IAEA International Atomic Energy Agency ICAO International Civil Aviation Organization ICC International Criminal Court ICISS International Commission on Intervention and State Sovereignty ICJ International Court of Justice ICLQ International & Comparative Law Quarterly ICRC International Committee of the Red Cross ICTR International Criminal Tribunal for Rwanda ICTY International Criminal Tribunal for the former Yugoslavia IDF Israel Defense Forces IEEE Institute of Electrical and Electronics Engineers ILC International Law Commission ILJ International Law Journal ILM International Legal Materials IMO International Maritime Organization IMEI International Mobile Equipment Identifier IMSI International Mobile Subscriber Identity Interpol International Criminal Police 1 Convention (I) for the Amelioration of the Condition of the Wounded and Sick in Armed Forces in the Field (adopted 12 August 1949, entered into force 21 October 1950) 75 UNTS 31; Convention (II) for the Amelioration of the Condition of Wounded, Sick and Shipwrecked Members of Armed Forces at Sea (adopted 12 August 1949, entered into force 21 October 1950) 75 UNTS 85; Convention (III) Relative to the Treatment of Prisoners of War (adopted 12 August 1949, entered into force 21 October 1950) 75 UNTS 135; Convention (IV) Relative to the Protection of Civilian Persons