The Metastasis of Transnational Cyber Attacks and International Law: A Catch 22 Situation

I. Introduction

Not long ago, John Perry Barlow in his “Declaration of the Independence of Cyberspace”,³ painted a rosy picture of the Internet as a space beyond national borders and free from the tyrannies of all governments. If only he’d known, this ‘so called space’ would lay the foundation for potential cyberattacks in the future. That is to say that the society is moving towards “informationization”,⁴ not only in matters of life but also in terms of war.

The term “cyberattack” denotes an attack performed in the cyberspace through cyber means and methods. Here, the term ‘cyberspace’ implies a globally interconnected network of digital information and communications infrastructures including Internet, telecommunications networks, computer systems and the information contained in them. For instance, while the infection of an aggressive adversary’s computer network with a malicious virus would amount to an act of cyberattack, the aerial bombardment of a military cybercommand would evidently not. Intriguingly, despite the fact cyberattack is conducted in cyberspace, it does not affect its ability to produce kinetic or non-electronic effects outside the cyber domain which may particularly be the intention of the perpetrator. Since, cyberspace knows no boundaries, attacks in cyberspace could target a computer server in a different country. Such cross-country cyberattacks can be termed as “Transnational Cyberattacks”.

In 2006, the U.S. Air Force announced a new mission statement wherein it made a pledge to “fight in Air, Space and Cyberspace.”⁵ As per the US intelligence chiefs, although shrouded in secrecy, over 30 countries are in the process of developing offensive cyberattack capabilities.⁶ US intelligence briefings constantly state Russia, China, Iran, and North Korea as some of the major cyber threat actors having the potential to commit serious cyberattacks.⁷ This leads to concerns that a secret cyber arms race might already have begun.

The International Court of Justice in its Nuclear Weapons Advisory Opinion specified that for a use of force to be an armed attack, consideration of the effects of act is enough and it is regardless to consider the weapons employed.⁸ Therefore, ICJ has left the term weapons open-ended, in order for weapons to take within itself, the technological advancements for weaponry in near future. Cyber Weapons is just the new technological advancement of weaponry and cyberattacks are its result.

II. Transnational cyberattacks: a rising global issue

The number of states developing military cyber capabilities is accelerating whilst the history witnesses numerous cyberattacks having the capability to both directly and indirectly harm civilian population. That is to say, besides causing substantial economic loss, cyber operations have shown to have adversely impacted civilian infrastructure.⁹ A Cyberattack in Ukraine led to a Power Blackout for hours,¹⁰ which the experts anticipated could have been lot worse had the hackers destroyed the ‘substation’ equipment.¹¹ Due to the ubiquitous nature of technology these attacks can also extend to various other sectors including the healthcare sector, industries, transport, governmental and financial systems as they become more digitalized by the day. It is astounding to grasp that the UK and US stock exchanges have both been targets of global cyberattacks. Ranging from cyberattacks on various governments including the Whitehall in the UK to cyberattacks directed at International organizations including NATO and EU, the history is evident of our inability to cope with such attacks.

Nevertheless, attacks in the cyber domain may be authorized by states or be conducted by non – state actors who, unlike in the physical domain, have the advantage of anonymity in cyberspace which enables them to hide their location, making it difficult to attribute cyberattacks to a specific actor.¹² Here, non-state actors can also include giant social media companies such as Facebook, Google, Twitter etc. Moreover, since cyberattacks spread virally, their impact can be felt even in areas far from the target hit.¹³ Any activity in the cyberspace could hence be subject to the laws of multiple jurisdictions,¹⁴ which may overlap or conflict.

The challenge thus becomes not just how to respond but who has the jurisdiction to do so and whether they can hold the perpetrators accountable.

III. Does domestic law offer any solution?

Under the domestic law, to bring charges against criminal acts initiated outside its territorial limits, a state must have extraterritorial jurisdiction. This can be extremely problematic in matters of enforcement if the foreign governments fail to cooperate in the process of investigation, for instance by refusing to provide necessary evidence.¹⁵ Furthermore, the entire prosecution may come to a standstill if the country harboring the offender refuses to extradite him. This has always been true in case of Russia in its constant refusal for extraditing Russian Hackers.¹⁶ Due to the above stated reasons, domestic criminal law is often not an effective tool in cases where the perpetrator is not physically located in the concerned state. Thus, the solutions lie beyond domestic criminal law.

IV. Need for convention on transnational cyberattacks under international law

History is suggestive of the fact that arms races are best curbed through formal treaties and agreements that are prudently drafted to reduce ambiguity and increase transparency. Every brutal war on this planet has led to appeals to restructure the new horrors faced by humanity. The human catastrophe witnessed following the World War II led to the drafting and ratifying of conventions on outlawing biological warfare, chemical warfare, and anti-personnel mines. Besides this, development of nuclear warfare revolutionized strategic war planning leading to decades of nuclear arms racing which was ultimately controlled through rigorous international diplomacy and arms control agreements.

According to a survey by Wall Street Journal, while 29 governments presently have military or intelligence units exclusively dedicated to offensive cyber operations, more than 60 countries are developing cyberweapons.¹⁷ Today, the leading international agreements administering cyber conduct are the Convention on Cybercrime, 2001 (also its Additional Protocol, 2006) and the Shanghai Cooperation Organization’s International Information Security Agreement, 2009. Both these agreements are severely limited in terms of their scope and membership.

It was only in 2008 that the first step was taken to resolve this catch-22 situation when NATO had established the Cooperative Cyber Defence Centre of Excellence. Further in 2009, the center hosted a conference in Tallinn, Estonia, with 20 international experts from NATO countries to seek out ways to apply existing international law essentially jus ad bellum, international humanitarian law (IHL) and laws of state responsibility to cyber warfare, thus resulting in the “Tallinn Manual”¹⁸. The Tallinn Manual however, has failed to effectively address the mounting issue of transnational cyberattack due to the below mentioned reasons. Firstly, it has failed to gain support from non-NATO members. Secondly, instead of promulgating new rules on the subject, it has merely interpreted the existing international rules pertaining to cyberwarfare which are fairly vague and limited in their scope. Accordingly, the interpretation of jus ad bellum and jus in bello treaty provisions remains highly unsettled. Thirdly, even if states agree to apply jus ad bellum and jus in bello provisions to cyberwarfare, such agreement is unlikely to stand the test of time as most treaties and conventions currently governing the production, stockpiling, sale and transfer are proof that the international prohibition on the use of force and IHL are by themselves inadequate to prevent or restrain international armed conflict.

Other problems associated with current regime of cyber-attack is that it makes nearly impossible to identify the perpetrator. This concern was acknowledged by the ICJ in the Nicaragua Case, which is evident from the following statement that ‘the problem is not the legal process of imputing the act to a particular State but the prior process of tracing material proof of the identity of the perpetrator’.¹⁹ In the case of a cyberattack this will be combined by the speed of the attack, its anonymity, the possibility of ‘spoofing’, as well as the point that it may have travelled through many different jurisdictions in which case collecting evidence may not be physically possible, or it may also have to counter many legal as well as political hurdles.²⁰

The above stated reasons therefore highlight the need for a novel and unambiguous convention on transnational cyberattack. A specific and precise convention on the subject would serve to slow down the cyber arms race and also strengthen the deterrent and defensive faculties of state parties.

V. Forum for transnational cyberconflict resolution: a vision

For the efficient redressal of Transnational cyberconflicts, there is a demand for a specialized forum empowered and having the necessary expertise to deal with such matters. Without an international court or tribunal for Cyberconflicts, innumerable cyberattacks having serious global consequences are likely to go unpunished.

It is therefore suggested that such disputes could be resolved either before the International Criminal Court (ICC) or before a ‘sui generis’ International Tribunal for Transnational Cyberconflicts.

At present, the Rome Statute establishes the jurisdiction of the ICC over four crimes, namely, the crime of genocide, crimes against humanity, war crimes, and crimes of aggression. Although the jurisdiction of the ICC doesn’t extend to cybercrimes at the moment, it may extend to ‘certain’ instances of cyberwarfare. That is to say, assuming the Court’s jurisdiction is activated for crimes of aggression, it will be limited to persons being in a position to exercise control over the political or military actions of a State.²¹ However, cyberattacks rarely occur in the context of a strict chain of command and are mostly carried out by collective individuals not authorized by the state.²² This clause, therefore, makes several perpetrators beyond the reach of the court, excluding them from its jurisdiction. Furthermore, it isn’t clear if an act of cybercrime could amount to an act of aggression. A solution in this regard, to establish jurisdiction, might be for the ICC to treat transnational cybercrimes as war crimes or crimes of aggression. For this to be done, the Rome Statute must be amended to expand the jurisdiction of the ICC to include within its ambit acts of transnational cybercrime.

At the same time, a more obvious solution to the problem would be the establishment of an independent International Tribunal for Transnational Cyberconflicts having competency in Information technology.²³ Such a Tribunal could, unlike the ICC, also have jurisdiction over civil transnational cyberconflict matters. It is significant to understand that in various instances, an action in the cyberspace could create civil liability, say for instance negligently failing to secure critical infrastructure or failure to conform with cyber hygiene obligations, thereby permitting their devices to become part of botnets. Stein Schjolberg, a former Norwegian judge and an international expert on cybercrime also published a Draft UN Treaty on an International Criminal Court or Tribunal for Cyberspace²⁴ which can be referred for assistance in the matter.

VI. Conclusion

Transnational Cyberattack is as much a reality as climate change. Astonishingly, both the truths have been denied by countries to favor their stance. Accelerating technological development, has made governments increasingly dependent on computer systems ranging from financial services to military services. This may even enable attackers to bypass a state’s traditional defenses through cyberattacks. More so, we are presently witnessing a worldwide pandemic, relying heavily on our countries’ healthcare systems. Imagine what could happen if these healthcare systems are targeted by cybercriminals in such circumstances. It’s not merely infrastructure that is at the risk of being injured but also the lives of people. Modern problems thus need modern solutions. The circumstances therefore demand the establishment of a transnational cyberattack convention and a forum for resolution of cyberconflicts to ensure justice and transparency. Such a convention must embody provisions relating to jurisdiction and non-state actors. These law and policy changes will go a long way in mitigating the instances of transnational cyberconflicts.

*****