Controlling Cyberwarfare International Laws of Armed Conflict and Human Rights in the Cyber Realm by William James Jordan A thesis presented to the University of Waterloo in fulfillment of the thesis requirement for the degree of Doctor of Philosophy in Philosophy Waterloo, Ontario, Canada, 2021 © William James Jordan 2021 Examining Committee Membership The following served on the Examining Committee for this thesis. Thedeci­ sion of the Examining Committee is by majority vote. External Examiner: Col. David Barnes Professor, Department of English and Philosophy United States Military Academy Supervisor: W. Mathieu Doucet Associate Professor, Department of Philosophy University of Waterloo Internal Member: Brian D. Orend Professor, Department of Philosophy University of Waterloo Internal Member: Patricia A. Marino Professor, Department of Philosophy University of Waterloo Internal­External Member: Veronica M. Kitchen Associate Professor, Department of Political Science University of Waterloo ii Author’s Declaration I hereby declare that I am the sole author of this thesis. This is a true copy of the thesis, including any required final revisions, as accepted by my ex­ aminers. I understand that my thesis may be made electronically available to the pub­ lic. iii Abstract Cyberwarfare, military activities in cyberspace conducted by a state against another state and intended to disrupt or destroy computing or communica­ tion systems or data, is a recent addition to the warfaring arsenal. The in­ ternational laws of armed conflict set out an obligation for states at warto protect civilians from the effects of the conflict. As societies continue toex­ pand their activities in the cyber realm, the risk of cyberwarfare negatively affecting the civilian population increases. The international community, recognizing this risk, is engaged in a political dance trying to identify the constraints that international law already places on cyberwarfare while stak­ ing out ground to preserve its effectiveness as a means of influencing other states’ policies. This dissertation project addresses some of the problems posed by the use of computing and network technology as weapons and tar­ gets in the context of international armed conflict. It brings together mate­ rial drawn from computing technology, military handbooks, policy research, international standards for records preservation, non­government organiza­ tions, international humanitarian law, international human rights law, the international laws of armed conflict, and real­world examples to reveal the complexity and nuances of using operations in cyberspace to produce ef­ fects in meatspace, the physical world of humans, buildings, equipment, and artefacts. First, I argue that since there is no significant difference between using cyber means of war and conventional means of war, it is appropriate to treat developments in cyberwarfare under the existing international laws of armed conflict. Then I introduce the Tallinn Manual, a handbook on the in­ ternational law applicable to cyber operations, and the events that led to its development. I examine how well the Tallinn Manual documents the pro­ tections, prohibitions, and permissions extended under the laws of armed conflict, concluding that it is a faithful interpretation of international law. The application of international law to warfare is always messy andim­ precise. Its application to cyberwarfare is no different. This does not mean that the constraints of international law are without value or purpose. On the assumption that no state wants to start an international armed conflict, but is prepared to respond to uses of force, I apply some of the principles expressed in the Tallinn Manual to establish qualitative assessments of the severity of initial aggressive cyberoperations against a state, classifying them v as moderate or flagrant attacks depending on the harm they produced. This helps the target state determine whether there is just cause for a use of force, either cyber or conventional, in response, and the constraints that apply to any response that may be permissible under international law. International law also affords protections for human rights, both in peace­ time and during times of conflict. I argue that cyberwarfare exposes more civilian objects, including objects of cultural significance and records needed to safeguard human rights, to harm through both conventional and cyber at­ tacks. If human rights are to be protected, the records (digital or otherwise) that serve as evidence in support of rights claims must be protected as well. I conclude that international law already sets out the obligation for these protections, but the interpretation of international law must make explicit the expectation that all parties in an armed conflict will make efforts to iden­ tify and preserve these objects for the well­being of persons in a post­conflict society. Finally, I demonstrate the breadth and applicability of further work in this area. I point out some other problems that branch off from this partic­ ular project: the separation of information content from its representation in different media, human rights in the cyber domain, the use ofcomput­ ing and communication technology to produce social or economic disrup­ tion, the status of privately­owned satellites under the multiple international treaties and conventions during times of armed conflict, and the assignment of peacetime responsibility for safeguarding data essential for the protection and provision of human rights. vi Acknowledgements The journey from burned­out software designer to doctoral candidate in philosophy has been a long one. Along the way I have benefitted from the encouragement (and only rarely the kind from a metaphoric boot), support, and advocacy of more people than I can mention here. I am grateful to Shelly Jordan, my wife and friend. Shelly introduced me to philosophy while she was a graduate student at the University of Calgary. Richard Zach and Elaine Landry (now at University of California, Davis) showed me that I, too, could learn to do philosophy, and the conversations I had with them and Marc Ereshefsky led me to consider doing graduate studies. Elaine specifically pointed me to Waterloo as the place to explore my philosophical interests. Jeremy Clark (University of Canterbury) encour­ aged me to start this journey sooner rather than later. I had no idea what I was in for, but I am glad that I did this. The department at Waterloo has been wonderful. Tim Kenyon (currently at Brock University) and Dave DeVidi took a chance on admitting this late­ comer to philosophy. They also advocated for me during a time ofdeep personal struggle. Dave supervised my research area in logic and, with Matt Doucet, coached me through the research area in cyberwar. Brian Orend’s lunchtime talk on cyberwarfare, coming on the heels of the Stuxnet and Flame attacks, inspired the research area and this dissertation. Patricia Marino, Shannon Dea (now at the University of Regina), Doreen Fraser, Carla Fehr, Richard Holmes, and Joe Novak have all helped me stay afloat during times of potential disaster. For these I thank them, and I hope I have not disappointed them too badly. I acknowledge the generosity of the donors to the University of Water­ loo and the Department of Philosophy for the conference travel awards and dissertation completion award. The conversations and friendships with graduate student colleagues An­ dria Bianchi, Tracy Finn, Nathan Haydon, Eric Hochstein (University of Victoria), Kurt Holukoff, Ashley Keefner, Catherine Klausen, Ian MacDon­ ald, Kirsten MacDonald, Dylon McChesney, Micheal McEwen, Andrew Mor­ gan, Corey Mulvihill, Ben Nelson, and Angella Yamamoto will not quickly fade. Thank you for the laughter and encouragement. Greg Andres has been a great friend and mentor in pedagogy. I am not sure that I am forgiven for convincing him to lead a textbook project. It was vii one crazy ride, and the process of writing a textbook unlocked the flow of words needed to write this dissertation. Thank you for that opportunity. Bill Abbott, Vanessa Correia, Sandie DeVries, Dylon McChesney, Jamie Sewell, Andy Stumpf, Chris Wass, and Sara Weaver were fellow collaborators, and I am thankful for their work and inspiration to keep writing stuff. Greg, let’s do this again soon. This dissertation grew out of a research area in the applicability ofin­ ternational law to cyberwarfare. That research area produced two confer­ ence presentations. I appreciate the responses and feedback from attendees and commentators, who helped assure me of the value of further develop­ ing the project. The members of my internal dissertation committee have all provided invaluable guidance. Matt Doucet, my supervisor, helped me keep intermediate goals in view rather than getting lost in the shadows lurk­ ing just beyond where I was working. Patricia Marino’s initial support of the project and her ongoing affirmation that it was on a good philosophi­ cal track helped me keep going. Brian Orend, in addition to sparking the project, has been more than generous in his comments on earlier versions of the dissertation. I expected Brian to be the toughest critic of this work. He did not disappoint, but I was amazed by the encouraging manner in which he provided that criticism. Brian’s commentary was on­point and inspiring. He corrected some misunderstandings, gave helpful suggestions for further development of ideas, identified ways to sharpen the focus of the disserta­ tion, and provided reason to expand my book collection. The dissertation is much improved because of his feedback. I hope to have the opportunity to pay this debt forward. Debbie Dietrich, Trish van Berkel, Angela Christelis, and Tawnessa Carter, the department’s graduate administrators during my time at Waterloo, have all been key in navigating the University’s processes and the glitches that always seem to arise. I thank Mikhael Evstafiev for permission to include his photograph of Vedran Smailović in this dissertation. The academy is not the only source of support I have had. Ithankmy circles of friends, and in particular those whom I have met in Waterloo, for practical help and encouragement.