International Law and Transnational Cyber Operations: Sovereignty, State Responsibility, Attribution and Use of Force

Abstract

Cross-border cyber operations raise a number of challenging legal questions, including sovereignty, non-intervention, the prohibition on the use of force, self-defence, attribution and State responsibility. The basic argument of this article is that existing international law does apply to State conduct in cyberspace, although there is still significant disagreement on how particular rules and thresholds should operate in practice. The present study uses a doctrinal and comparative approach, examining the UN Charter, the law of State responsibility, relevant decisions of the International Court of Justice, UN cyber-process documents, the Tallinn Manuals and the publicly stated positions of the United Kingdom, Australia, Canada, India and Pakistan. The principal problem, therefore, is not the absence of law in cyberspace. And that it is hard to apply existing rules to technically complicated and sometimes deliberately concealed operations. The article distinguishes between three levels of analysis: the primary rules that determine the legality of an operation, the secondary rules that govern attribution and legal consequences, and voluntary norms and confidence-building measures that promote responsible behaviour without being binding law in themselves. It suggests that significant adverse effects and interferences with inherently governmental functions provide a better basis for a sovereignty analysis than either treating every remote intrusion as unlawful or saying that sovereignty has no independent relevance. Coercion remains important for non-intervention, whilst thresholds for use of force and armed attack should be carefully assessed looking at scale and effects. The article also supports a cautious approach to attribution based on evidence and does not consider due diligence as a general stand-alone cyber rule without adequate support in State practice and opinio juris. The comparison indicates that States generally agree that existing international law applies to cyberspace, but continue to differ on a number of important details. Instead of assuming that a new comprehensive cyber treaty is immediately needed, the article therefore concentrates on clearer national legal positions, better attribution procedures and practical implementation of existing rules.