Evolvement of cyber warfare from theoretical possibility to an imminent threat has put a challenging task to the international law experts. The cyber-attack on the servers of Sony Pictures Entertainment, cyber incursions by Pakistani hackers on Kerala government’s website are few such incidents. The alleged malicious North Korean operation destroyed data, exposed personal data, and highly embarrassing emails were made public. Some experts called attack on Sony’s servers an ‘act of war’ while other termed it as mere ‘interference’ with the servers. These cyber exploitations have drawn attention to the dilemma of harmful trans-border state and non-state cyber operations against government and private cyber infrastructure. Academicians and practitioners have tried to analyse cyber operations reaching threshold of armed attack violating international law. But little attention has been paid to cyber operations which do not rise to level of armed attack and ones where cyber infrastructure located on its territory is used by non-state actors, such as hacker groups, individual hackers, organized armed groups, or terrorists to mount the operations and whether the victim state has any remedy under international law, and if yes, what? This question has, for reasons to be explained, become ripe for serious consideration. The author suggests that the international community has begun to foresee ways to regulate cyber-attacks rising to level of “cyber warfare” and thus implicate the law of armed conflict; however, this legal regime does not regulate cyber harm that does not reach this threshold, but is nonetheless significantly harmful and may be governed by traditional international law principles. Further, the article discusses the protection measures available, and limitations to the measures under international law.

Law Of State Responsibility The responsibility of states for internationally wrongful acts is governed by the International Law Commission’s articles on state responsibility, which have developed into customary international law. The articles lay down that an internationally wrongful act committed by a state entails responsibility for the same. An internationally wrongful act exists when first, it is attributable to a state under international law, and second, for responsibility to attach to the act of the State, the conduct must constitute a breach  of an international legal obligation.  Where the cyber operation is carried out by organ of state or directed or controlled by the state then there is no need to prove responsibility of a state.  However, in case of acts undertaken by non-state actors, a state is responsible if it had directed or controlled it or acknowledged the actions of non-state actors or it failed to prevent the execution of the attack.

Some experts called attack on Sony’s servers an ‘act of war’ while other termed it as mere ‘interference’ with the servers. These cyber exploitations have drawn attention to the dilemma of harmful trans-border state and non-state cyber operations against government and private cyber infrastructure. Academicians and practitioners have tried to analyse cyber operations reaching threshold of armed attack violating international law

Complexity in Establishing State Responsibility The cyber operation not carried out by state organs are difficult to be attributed to a particular state and mitigating the chances of responses by aggrieved state. Complexity in attribution arises when a cyber-operation is carried out by non-state actors, in determining whether the cyber operation was carried out “under the direction or control” of the aggressor state. The issue of ascertaining who is responsible for cyber operation is a tricky one. More often than not, we see there are really no more than suspicions and allegations on who is behind the attack. These suspicions are based on the circumstances under which the attack was carried out and the nature of the attack. The author suggests that when express attribution is not established, however, origin country of the cyber operation is known, in that case also, responsibility can be attributed to a state.

Principle of Due Diligence Express participation is not the exclusive means by which a state may have breached its international obligation. International law recognizes principle of ‘due diligence’. Principle of due diligence, though mainly applied in international environmental law context, is also applicable in cyber context.  Principle of due diligence was recognized in the case of the Trail Smelter arbitration that ‘a state owes at all times a duty to protect other states against injurious acts by individuals from within their jurisdiction’. Later, the International Court of Justice addressed the same in Corfu Channel Case, when it stated, ‘it is every State’s obligation not to allow knowingly its territory to be used for acts contrary to the rights of other States’. The Tallinn Manual on International Law applicable to cyber warfare, which is a rule book on norms related to cyber warfare, restates the law.  The appropriate legal analysis for attributing responsibility for the actions of non-state actors to states rests upon the degree of ‘due diligence’ or ‘negligence’ exhibited by the sovereign. In other words, the state would not be held responsible for the act itself but would rather be held accountable for failing to fulfil a legal obligation that would have prevented the attendant harm. However, in the absence of any international consensus on the norms for cyberspace, it would be very difficult to determine whether a state had performed adequate ‘due diligence’ or taken the appropriate measures to avert harm in cyberspace.

Attack on Non State Actors and Violation of Territorial Sovereignty Cyber operations are frequent on servers on private entities. Some scholars believe that even if any cyber operation is conducted on servers of a private entity within the territory of another country it amounts to violation of territorial sovereignty of the injured state. The International court of Justice in ‘Island of Palmas Arbitral award’ defined ‘sovereignty’ as “sovereignty in the relations between states signifies independence. Independence in regard to a portion of the globe is the right to exercise therein, to the exclusion of any other state, the functions of a state”. Further, Tallinn Manual on Cyber Warfare states that a cyber-operation directed against the cyber infrastructure located in another state may violate latter’s sovereignty. Noted Professor Michael Schmitt states that it would seem reasonable to characterize a cyber-operation involving manipulation of cyber infrastructure in another state’s territory or the emplacement of malware within the system located therein as violation of territorial sovereignty. Thus, it is clear that even if no physical damage is caused by the cyber operation, it still violates ‘territorial sovereignty’ of the victim state.

The responsibility of states for internationally wrongful acts is governed by the International Law Commission’s articles on state responsibility, which have developed into customary international law

Counter Measures in International Law The principle of reciprocity i.e. returning like behaviour with like is a central feature of international law, a system with no external enforcement authority other than its own members. Article 51 of UN Charter enshrines ‘right of self-defense’, however this right isstrictly circumscribed to cases of an “armed attack.” For the harms that do not meet the standard of ‘armed attack’, right of self-defense cannot be exercised. However, a state may resort to countermeasures in response to an attack or harm which are considered as lawful methods to enforce compliance. The law relating to countermeasures can be applied to cyber operations as well.  The ILC Articles places two primary requirements for countermeasures against a wrongful act. It focuses on two primary limitations before resorting to countermeasures which are ‘Necessity’ and ‘Proportionality’. Thus, countermeasures adopted against a cyber-operation must satisfy these two primary tests to be termed as lawful countermeasures.

Test of Necessity The measures must be necessary in the circumstances to counter the attack. The plea of necessity can be invoked to protect a wide variety of interest including safeguarding the data and information.  The interest must be threatened by a ‘grave and imminent peril’ which is to be objectively established. Moreover, the actions must be the only way available to safeguard the interests. In circumstances where the wrongful act has ceased, general international law does not permit a state to take countermeasures. However, state practice shows that countermeasures can be taken after the wrongful act has ceased. Thus, in order to resort to countermeasures, a state must objectively establish the necessity of its actions. In case of Sony, US was legally entitled to take countermeasures to bring North Korea into a state of lawfulness and to cease its actions.

These cyber exploitations have drawn attention to the dilemma of harmful trans-border state and non-state cyber operations against government and private cyber infrastructure

Test of Proportionality  Magnitude and Form As per customary international law, countermeasures must be commensurate and proportional to the injury suffered, taking into account the gravity of the internationally wrongful act and the rights in question. A countermeasure which is disproportional to the injury suffered is considered unlawful. While the ascertainment of proportionality is essentially an approximation, it must take into account not only the quantitative elements of the injury but also qualitative aspects like the gravity of the breach committed. The countermeasures which do not have punitive aim, instead are taken to induce the wrongdoing state are proportionate and lawful in nature. However, a state cannot be allowed to do any act which is more harmful in nature or causes loss as not required in the circumstances. Thus, it is clear that the measure must be proportionate in quantitative and qualitative manner to the alleged cyber operation.

Conclusion National Cyber defense strategies are unlikely to be effective in regulating crossborder cyber harms due to technological hurdles, political realities, and the very nature of internet. Absent any regulatory mechanism, cyber operations are likely only to increase in frequency and severity. While most scholars have assumed this behaviour to be outside the ambit of public international law, this article has offered an account of how international law can govern cross-border cyberattacks. Significant harm done to a state’s intellectual property should be viewed as “transboundary cyberharm” and can be analysed under traditional international legal principles, including the due diligence obligation to prevent significant harm to another state’s territorial sovereignty, as translated to modern realities. It is clear that cross-border cyber operations, not reaching the threshold of armed attack or use of force, may still provide right to remedial measures. Further, in addition to any national defense strategy or mechanism, private corporations may be allowed to rely on defensive hack-backs to repel cross-border incursions on their networks.

-Mahendra  Singh