Not Illegal: The SolarWinds Incident and International Law

Abstract

Abstract In 2021, the USA and other governments formally blamed Russia for a wide-ranging hacking campaign that breached the update process for SolarWinds Orion network monitoring software and used that access to compromise numerous government agencies, companies and other entities. Despite denouncing Russia’s cyber espionage and imposing sanctions, the USA did not call Russia’s actions illegal as a matter of international law – and for good reason. Based on the publicly available facts, this article argues that the SolarWinds incident likely did not run afoul of international law as it currently stands. The article considers the prohibitions on the use of force and intervention, emerging rules with respect to violations of sovereignty and due diligence, and international human rights law, and it concludes with some reflections on the role of states and scholars in decisions about whether to close gaps in international law.