State Sovereignty and Self-Defense in Cyberspace: a Normative Framework for Balancing Legal Rights

Emory International Law Review Volume 26 Issue 2 2012 State Sovereignty and Self-Defense in Cyberspace: A Normative Framework for Balancing Legal Rights Catherine Lotrionte Follow this and additional works at: https://scholarlycommons.law.emory.edu/eilr Recommended Citation Catherine Lotrionte, State Sovereignty and Self-Defense in Cyberspace: A Normative Framework for Balancing Legal Rights, 26 Emory Int'l L. Rev. 825 (2012). Available at: https://scholarlycommons.law.emory.edu/eilr/vol26/iss2/12 This Symposium is brought to you for free and open access by the Journals at Emory Law Scholarly Commons. It has been accepted for inclusion in Emory International Law Review by an authorized editor of Emory Law Scholarly Commons. For more information, please contact [email protected]. LOTRIONTE GALLEYSPROOFS2 5/28/2013 1:28 PM STATE SOVEREIGNTY AND SELF-DEFENSE IN CYBERSPACE: A NORMATIVE FRAMEWORK FOR BALANCING LEGAL RIGHTS ∗ Catherine Lotrionte Today’s threats recognize no national boundaries, are connected, and must be addressed at the global and regional as well as the national levels.1 When warranted, [the United States] will respond to hostile acts in cyberspace as we would to any other threat to our country. All states possess an inherent right to self-defense . [We recognize] that hostile acts conducted through cyberspace could compel actions under the commitments we have with our military treaty partners . .2 America must also face the rapidly growing threat from cyber- attacks. Now, we know hackers steal people’s identities and infiltrate private emails. We know foreign countries and companies swipe our corporate secrets. Now our enemies are also seeking the ability to sabotage our power grid, our financial institutions, and our air traffic control systems. We cannot look back years from now and wonder why we did nothing in the face of real threats to our security and our 3 economy. ∗ Catherine Lotrionte is the Director of the Institute for Law, Science & Global Security and Visiting Assistant Professor of Government at Georgetown University. Dr. Lotrionte has served as Counsel to the President’s Foreign Intelligence Advisory Board at the White House and as Assistant General Counsel at the Central Intelligence Agency. Dr. Lotrionte is the Director and Founder of the Cyber Project at Georgetown University and a Life Member of the Council on Foreign Relations. 1 Secretary-General’s High-level Panel on Threats, Challenges and Change, A More Secure World: Our Shared Responsibility, at 11, U.N. Doc. A/59/565 (Dec. 2, 2004) [hereinafter U.N. Report, A More Secure World]. 2 DEP’T OF DEF., CYBERSPACE POLICY REPORT 2, 7 (2011) [hereinafter CYBERSPACE POLICY REPORT]. 3 Barack Obama, State of the Union Address (Feb. 12, 2013) (discussing the threats the United States faces from adversaries in cyber and noting the Executive Order that President Obama signed earlier in the day, Executive Order on Improving Critical Infrastructure Cybersecurity, designed to strengthen U.S. cyber defenses through information sharing and standards for cyber security); see also Exec. Order No. 13,636, 78 Fed. Reg. 11,739 (Feb. 12, 2013). LOTRIONTE GALLEYSPROOFS2 5/28/2013 1:28 PM 826 EMORY INTERNATIONAL LAW REVIEW [Vol. 26 INTRODUCTION Few issues in international relations are as controversial as the use of force and the legal framework that justifies a state’s use of force in self-defense. Indeed, the very development of the discipline in international law lies in attempts by states, the United Nations, and international courts to wrestle with the question of when force may legitimately be used within the international realm. Over the centuries, states have struggled to define the right to use force as they face new threats from new actors and new weapons entering the arena of conflict. This Article grapples with the contemporary topic of when a state can invoke forcible measures in cyberspace against non-state actors. To address this issue, this Article discusses the current threats to states that exist in cyberspace, identifies the international law on the use of force and discusses recent state practice as well as the pronouncements of international courts on the topic. Difficult questions in the context of cyber operations are posed and challenging conclusions are drawn from the development of the law. Ultimately, this Article provides a framework for state decision-makers to use to determine whether the state can legally use force in self-defense in cyberspace against non-state actors residing in another state’s territory. Overall, it is an indication of the increasing maturity of international law that it is capable of facing up to the complex challenges of these new threats while continuing to search for the path forward that maintains and enhances the rule of law and minimizes conflict within the international community. It is clear that “cyber warfare” is not a technical legal term and it has been argued by some to be even misleading and unhelpful.4 There is a concern by some that the term will glorify those criminals responsible for most malicious action in the cyber domain, exaggerate the threat, and distort the understanding of particular conflicts that take place in cyberspace, just as the use of the term “war on terror” arguably has done. Regardless, the rhetoric of “cyber warfare” has some significance for the law on the use of force because it can be used to justify the use of self-defense against other states and non-state actors accused of carrying out a cyber attack against a state. Today, state officials from around the globe warn that a state’s most critical infrastructure—power plants, gas pipelines, traffic control systems, and water 4 See, e.g., Cyber Security and International Law: Meeting Summary, CHATHAM HOUSE 3 (May 29, 2012) (summary of remarks by Mary Ellen O’Connell). LOTRIONTE GALLEYSPROOFS2 5/28/2013 1:28 PM 2012] SOVEREIGNTY AND SELF-DEFENSE IN CYBER SPACE 827 treatment plants—are at risk of attack by adversaries.5 Military and intelligence officials have repeatedly warned that malicious hackers could disrupt critical infrastructure with the click of a mouse, causing severe economic loss, persistent blackouts or even mass casualties.6 The issue of how to protect the state from such attacks, internationally, has not been resolved, leaving significant differences between states, and between commentators, on this issue. In March 2003, the United States argued that Iraq was developing weapons of mass destruction, and undertook Operation Iraqi Freedom. The invasion of Iraq was bitterly contested internationally. After the invasion, U.N. Secretary- General Kofi Annan spoke of “a fork in the road” and declared that “this may be a moment no less decisive than 1945 itself, when the U.N. was founded.”7 Questions were raised about the effectiveness of the United Nations, and international law more generally, to deal with new threats. Some states, like the United States, seemed to argue that states were no longer obliged to wait until there was agreement in the Security Council before acting unilaterally or in ad hoc coalitions against the terrorist threats.8 This position represented a fundamental change to the principles on which world peace and stability have been based for the last fifty-eight years under the U.N. Charter framework. In response, the Secretary-General set up a High-level Panel on Threats, Challenges and Change, to examine global peace and security issues, identify how collective security may address these threats, and recommend changes that may be needed. In 2004 the group issued its report, A More Secure World.9 In 2005 the Secretary-General issued his own report, In Larger Freedom.10 In all of these instruments there was a recognition that the nature of twenty-first century threats had changed such that even the most powerful states were vulnerable.11 However, the consensus from all of the reports was that no change in the U.N. Charter provisions on the use of force was needed. The long-established prohibition on the use of force in Article 2(4) and the right of 5 Obama, supra note 3. 6 See text accompanying notes 32–57. 7 U.N. GAOR, 58th Sess., 7th plen. mtg. at 3, U.N. Doc. A/58/PV.7 (Sept. 23, 2003). 8 See, e.g., WHITE HOUSE, THE NATIONAL SECURITY STRATEGY OF THE UNITED STATES OF AMERICA 25 (2002). 9 Supra note 1. 10 U.N. Secretary-General, In Larger Freedom: Towards Development, Security, and Human Rights for All, U.N. Doc. A/59/2005 (Mar. 21, 2005) [hereinafter U.N. Secretary-General, In Larger Freedom]. 11 U.N. Report, A More Secure World, supra note 1, at 11. LOTRIONTE GALLEYSPROOFS2 5/28/2013 1:28 PM 828 EMORY INTERNATIONAL LAW REVIEW [Vol. 26 self-defense in Article 51 were adequate to meet the new threats.12 Nevertheless, international law on the use of force, its content, application, and effectiveness in dealing with the cyber threats has been the object of much debate. Indeed, cyber instability poses the same challenge to international peace and security as the threats of terrorism, transnational organized crime, poverty, infectious diseases, environmental degradation, and nuclear, biological chemical, and radiological weapons, as outlined in the U.N. reports.13 If consensus on the rules related to the use of force in cyberspace is not achieved, the result will be a self-help system within the cyber domain, with potential spillover into the kinetic sphere. Within this domain mistrust will dominate, and opportunities for cooperation for long-term stability and mutual gain will be lost. The principles related to the use of force have long helped—although not perfectly—world peace and stability. They stand firmly against aggression,14 facilitate a minimum level of order, and can facilitate a stable basis for exchange, agreement, human creativity, and innovative opportunity in cyberspace.

Load more