Tallinn Manual Research Articles

War crimes in cyberspace: prosecuting disruptive cyber operations under Article 8 of the Rome Statute

This article reviews the existing scholarship concerning the applicability of IHL norms to cyberspace, and in particular the Tallinn Manual, which is considered to be the most authoritative restatement of international law applicable in the cyber context. In doing so, it seeks to answer the question of whether purely disruptive (as opposed to physically destructive) cyber operations could be prosecuted as war crimes at the International Criminal Court under Article 8 of the Rome Statute. The Tallinn Manual, being a restatement of lex lata at the time that it was drafted, places a heavy emphasis on physical effects when applying the jus in bello to cyber warfare. If the ICC were to rely on the Tallinn Manual’s conclusions to inform its interpretation of Article 8 in relation to cyber-based war crimes, this could have the effect of excluding disruptive cyber operations from its jurisdiction. This is a cause for concern in a world where militaries and civilian populations alike are becoming increasingly reliant on computer systems and the internet. Disruptive cyber operations can result in devastating consequences even though they do not cause physical damage, and are likely to become more powerful and sophisticated in future as technology develops.

New wine in old bottles: applicability of the rules on attribution to cyberattacks committed against objects of critical infrastructure

Growing number of cyberattacks committed by states or with their support testifies to the need of legal attribution for the purposeof international responsibility. Tallin Manual that comprises authoritative findings on how the attribution rules should be applied raisesa serious concern about the practical possibility to establish attribution. The main reason for this concern may be found in the nature ofcyberspace that is characterized by anonymity, spoofing and targeting from the territory of other states etc.The rules of Tallinn Manual reiterated the provisions of ARSIWA and do not evidence about the existence of lex specialis forcyberattacks attribution. Pursuant to them, states are responsible for actions of their de facto and de jure organs empowered to exercisethe elements of governmental functions, private actors within their effective control or for the violation of due diligence obligations.This article argues that there is no necessity to change the rules on attribution, but, due to limited human and technical resourcesof most states, a special body for technical attribution should be created. The author analyses the different proposals that foresees amembership of states or fully excludes it. Notwithstanding a model, which may be chosen, there should be a variety of technical exper -tise and limitations of states ability to impact a decision concerning the choice of a case and its outcomes.

New wine in old bottles: applicability of the rules on attribution to cyberattacks committed against objects of critical infrastructure

Growing number of cyberattacks committed by states or with their support testifies to the need of legal attribution for the purposeof international responsibility. Tallin Manual that comprises authoritative findings on how the attribution rules should be applied raisesa serious concern about the practical possibility to establish attribution. The main reason for this concern may be found in the nature ofcyberspace that is characterized by anonymity, spoofing and targeting from the territory of other states etc.The rules of Tallinn Manual reiterated the provisions of ARSIWA and do not evidence about the existence of lex specialis forcyberattacks attribution. Pursuant to them, states are responsible for actions of their de facto and de jure organs empowered to exercisethe elements of governmental functions, private actors within their effective control or for the violation of due diligence obligations.This article argues that there is no necessity to change the rules on attribution, but, due to limited human and technical resourcesof most states, a special body for technical attribution should be created. The author analyses the different proposals that foresees amembership of states or fully excludes it. Notwithstanding a model, which may be chosen, there should be a variety of technical exper -tise and limitations of states ability to impact a decision concerning the choice of a case and its outcomes.

Cyber Law and Espionage Law as Communicating Vessels

Existing legal literature would have us assume that espionage operations and “below-the-threshold” cyber operations are doctrinally distinct. Whereas one is subject to the scant, amorphous, and under-developed legal framework of espionage law, the other is subject to an emerging, ever-evolving body of legal rules, known cumulatively as cyber law. This dichotomy, however, is erroneous and misleading. In practice, espionage and cyber law function as communicating vessels, and so are better conceived as two elements of a complex system, Information Warfare (IW). This paper therefore rst draws attention to the similarities between the practices – the fact that the actors, technologies, and targets are interchangeable, as are the knee-jerk legal reactions of the international community. In light of the convergence between peacetime Low-Intensity Cyber Operations (LICOs) and peacetime Espionage Operations (EOs) the two should be subjected to a single regulatory framework, one which recognizes the role intelligence plays in our public world order and which adopts a contextual and consequential method of inquiry. The paper proceeds in the following order: Part 2 provides a descriptive account of the unique symbiotic relationship between espionage and cyber law, and further explains the reasons for this dynamic. Part 3 places the discussion surrounding this relationship within the broader discourse on IW, making the claim that the convergence between EOs and LICOs, as described in Part 2, could further be explained by an even larger convergence across all the various elements of the informational environment. Parts 2 and 3 then serve as the backdrop for Part 4, which details the attempt of the drafters of the Tallinn Manual 2.0 to compartmentalize espionage law and cyber law, and the deficits of their approach. The paper concludes by proposing an alternative holistic understanding of espionage law, grounded in general principles of law, which is more practically transferable to the cyber realm.

The Law of Armed Conflict in the Era of Cyber Technology: Assessing the Legal Challenges and Response in Tanzania

The development of cyber technology has brought challenges to various aspects of life. Legal regime regulating the means and methods of warfare stands amongst the most affected regimes due to such advancement. The existing puzzle is on whether there is a need to conclude a new Convention on international humanitarian law to address the challenges of cyber technology or not. While discussing issues relating to this puzzle, this article examines the legal regime in Tanzania and its rapport to the rules of international humanitarian law (IHL) including cyber warfare. The article observes out that, the Tanzanian legal framework insufficiently addresses the challenges of cyber warfare. Apart from relying on the ordinary crimes approach in interpreting and prosecuting IHL breaches, this article concludes that necessary legislative measures need to be taken by Tanzania to fill the gaps brought by cyber technology to the rules of IHL. Keywords: Armed Conflict, Cyber Technology, Cyber Warfare, Law of Armed Conflict, Ordinary Crimes Approach, Tallinn Manual.

Cyber Warfare

The Tallinn Manual on the International Law Applicable to Cyber Warfare (2013) sets out ninety-five ‘black-letter rules' governing conflicts and the basis for each in treaty and customary law. An earlier version of this article considered the applicability of national law to cyberspace. Specifically, whether there was sufficient basis at a national law level to establish norms for acceptable behavior at an international level. The proposition being it is time for a new kind of international cooperation in relation to cyber warfare and acceptable norms of behavior in cyberspace. This article provides detail from various national statutes to illustrate how national law applies to cyberspace. Both papers consider the applicability of current national criminal and tort law by using hypothetical scenarios in relation to self-defence, conspiracy and corporate responsibility in the private sector. The intention is to encourage experts to cooperate internationally to recognise national rules equivalent to the Tallinn work.

The Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations, edited by Michael N. Schmitt

The Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations, edited by Michael N. Schmitt

Limited Force and the Return of Reprisals in the Law of Armed Conflict

AbstractArmed reprisals are the limited use of military force in response to unlawful actions perpetrated against states. Historically, reprisals provided a military remedy for states that had been wronged (often violently) by another state without having to resort to all-out war in order to counter or deter such wrongful actions. While reprisals are broadly believed to have been outlawed by the UN Charter, states continue to routinely undertake such self-help measures. As part of the roundtable, “The Ethics of Limited Strikes,” this essay examines the doctrine of armed reprisals in light of recent instances of states using force “short of war” in this manner. We argue that the ban on reprisals has been largely ignored by states, and that recent attempts to apply the laws of armed conflict to the cyber domain (such as the Tallinn Manual) are further weakening this prohibition. We conclude that this is a potentially dangerous development that lowers the bar for resorting to military force, risking escalation and thereby further destabilizing the international system.

Hacking und humanitäres Völkerrecht: die Hackergruppe Anonymus und die Syrische Elektronische Armee

This article discusses the cyberattacks, the status and legal obligations of the Anonymous Group and the Syrian Electronic Army under international humanitarian law (IHL). These hacker collectives have demonstrated a tremendous capacity to become involved in cyber operations, even in armed conflict situations. This article, using some of the most prominent attacks as the lens to read this phenomenon, analyses their role under the provisions of the law of war, examining which is the applicable legal framework (if any). It considers the treaty rules governing IHL but pays also attention to customary IHL and the Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations. It concludes by assessing the applicable legal framework, including whether these collectives can be regarded as organised armed groups belonging to a part of the conflict or considered otherwise, operating outside the framework of the law of war.

The Relevance and Applicability of Cybersecurity Laws with Regard to Data Storage on Board Satellites and on the Ground

Cybersecurity is a growing concern in the space sector, with satellite transmission interference and unauthorized access to data being the most common threats against space systems. This article will focus on the latter and on the cybersecurity laws that, albeit in their infancy, aim at protecting against such risks. In particular, this article will assess whether the existing cybersecurity regulations are pertinent to the protection of data stored onboard satellites in outer space and on ground facilities. It will specifically refer to the context of the EU Directive on Security of Network and Information Systems (EU NIS Directive), the US Internet of Things Cybersecurity Improvement Act (IoT Cybersecurity Act), and the Tallinn Manual on the International Law Applicable to Cyber Operations (Tallinn Manual 2.0), so as to assess their connection to the current methods of data storage. Towards this end, the relevance of the said laws and their competence in ensuring adequate standards of protection against cyber threats and security breaches will be argued. On the one hand, cybersecurity regulations are designed to safeguard the integrity of data systems from external tampering. On the other hand, it has not yet been established whether the scope of these laws extend outside the territorial sovereignty of States or in outer space, all while cyber operations in the framework of space activities may appear in various forms. The purpose of this article is to determine whether the regulatory regime in force is able to address the challenges arising from the increasing connectivity of satellites and satellite systems, which make them vulnerable to cybersecurity risks. In doing so, it will mainly focus on the notions of an information system, service provider, and cyber threat within the structure of space data systems.

The Digital Geneva Convention

Microsoft’s 2017 call for a Digital Geneva Convention is a welcome contribution to the debate on how the global technology sector and the international civil society should respond to increased State-led cyberattacks. However, Microsoft’s portrayal of cyberspace as a space devoid of regulation is inaccurate, especially in light of the rules contained in the Tallinn Manual 2.0. Microsoft’s call for the establishment of an international attribution organization overlooks existing international legal mechanisms. The characterization of global technology firms as ‘first responders’ providing services akin to those provided by the Red Cross societies is imperfect since technology companies are, compared to the Red Cross, non-neutral and profit-making enterprises.

The Caroline as the ‘Joker’ of the Law of Self-Defence – A Ghost Ship’s Message for the 21st Century

The last few years featured several important statements and documents aiming to change the customary international law on ius contra bellum, as enshrined in the UN Charter, that have relied extensively on the Caroline doctrine. As a point of departure of the present analysis, a brief overview of the most eminent appearances of the Caroline in most recent statements on the law of self-defence will follow. Former State Department Legal Advisor Brian Egan, in his speech at the American Society of International Law’s 2016 Annual Conference, invoked ‘the oft-cited Caroline incident’ to justify US military actions on the territory of another state against non-state actors under the right of self-defence. In his speech delivered in January 2017 at the International Institute for Strategic Studies (London) on ‘The Modern Law of Self-Defence’, the UK’s Attorney-General Jeremy Wright QC MP claimed that the principles of the modern law on imminence have their origins in the Caroline incident. The Caroline has been also resurrected also in the Tallinn Manual 2.0 published in February 2017 in Rule 73 regarding the criteria of imminence and immediacy. The above most recent reliance on the Caroline clearly shows that the ship did not, in fact, sink in 1837 but still proves to be a decisive player on the waters of ius contra bellum even in the 21st century. These invocations of the Caroline are all the more remarkable given that the legal relevance of the Caroline ‘precedent’ can be challenged by the fact that the ICJ has never referred to it, by reiterating the ILC’s Articles on the Responsibility of States for Internationally Wrongful Acts Commentary relating to necessity in Article 25, by the lack of state practice relying on the Caroline in the past 180 years, and also by scholarly literature commenting on customary international law. The present article aims at proving first, that having a Janus-faced character, one of the peculiarities of the Caroline precedent is that it is used as a Joker card for both narrowing and broadening the scope of the right to self-defence enshrined in Article 51 UN Charter. Second, that the Caroline concerned a necessity issue and had no connections and thus relevance to the modern right to self-defence. Thirdly, that the Caroline was consequently not invoked and applied for a century, not until Judge Jennings’ famous article in 1938, where the author admitted that the parties did not distinguish between self-defence and self-preservation and also that the literature of that time used them as synonyms. Jennings also pointed out that the diplomats dealing with the Caroline did not intend to introduce a new legal concept. Thus, the Caroline at best serves as an antagonistic element in the modern law of jus contra bellum and is nothing more than a romantic-tragic memory from the past. Finally, the article will argue that although the Caroline has no legal relevance for the modern right to self-defence, it is relevant for legal history as she carries an important moral lesson for all of us in the 21st century.

The Elephant in the Room: Coercion

Dan Efrony and Yuval Shany's article offers some critically important observations on the reception of the Tallinn Manual 2.0 by states, as well as subsequent state practice and opinio juris with regard to the international use of cyber operations. Based on their case studies, Efrony and Shany conclude that states have largely been reluctant to adopt fully the norms, premises, and analogies offered by the Tallinn Manual. The authors argue that there is a “deep uncertainty about the treatment of cyberspace as just another physical space, like land, air, or sea—over which states may exercise sovereignty or control.” The authors further explain that there is an “uneasy fit” between traditional international law regarding internal and external state power, and the regulation of a unterritorial cyberspace. In other words, cyberspace is a sui generis domain, such that analogies to physical-space domains are often ill-suited, and at times doomed to failure.

Cyberwarfare and the Applicability of the Principle of Distinction

After wars being fought on land, air, sea and space, the cyberspace proffers a fifth dimension of conducting modern warfare which is completely different from conventional kinetic warfare. Although International Humanitarian Law (IHL) is applicable to cyberwarfare to a certain extent, as demonstrated by the Tallinn Manual, there remains gaps in the present legal framework that makes it inadequate, insufficient or ill-equipped to address certain crucial principles of IHL. These inadequacies arise because of the sui generis nature of cyber dimension. For example, for IHL to apply to a situation there must be an armed attack under Article 49 of Additional Protocol I to the Geneva Conventions, and considerable amount of literature has been dedicated to determining whether cyberattack constitutes an armed attack. Furthermore, attribution of attack poses another problem because the key characteristic of a cyberattack is its anonymity which makes it extremely difficult, if not impossible, to know who conducted the attack. Similarly, concerns have been raised and debated on time and again on the applicability of key principles of necessity, proportionality and distinction in the cyber domain. The focus of this paper is to present a detailed account of limitations to applicability of the principle of distinction in cyber-space assuming that there is an on-going armed conflict recognised under Article 49 of the Additional Protocol I. Thereafter, this paper establishes that the current law is inadequate to address the issues of distinction that arise in cyberwarfare and puts forth some recommendations that could be adopted by the International Committee of the Red Cross (ICRC) to approach this issue to preserve the aim and function of IHL, that is to protect humanity at all times.

War by other means [cyber war

A DECADE AGO, Russian tanks rolled into South Ossetia, a northern province of Georgia. Even before they started moving, a 'third force' had already embarked on an exercise of hacking into government computer networks and local news agencies. Although the latest edition of the 'Tallinn Manual' on cyber warfare tackles the question of legal retaliation for attacks launched across the internet, a major problem will be identifying who is responsible quickly enough to respond in a useful way. Defence looks to be the only realistic option for countering the wide range of potential attacks that could be staged by a hostile nation.

A Rule Book on the Shelf? Tallinn Manual 2.0 on Cyberoperations and Subsequent State Practice

AbstractThis article evaluates acceptance of the Tallinn Rules by states on the basis of eleven case studies involving cyberoperations, all occurring after the first Tallinn Manual was published in 2013. Our principal findings are that (1) it is unclear whether states are ready to accept the Tallinn Rules; (2) states show uneven interest in promoting legal certainty in cyberspace; and (3) a growing need for coordinated response to cyberattacks may induce states to consider more favorably the Tallinn Rules.

A Rule Book on the Shelf? Tallinn Manual 2.0 on Cyber Operations and Subsequent State Practice

The Tallinn Manuals represent a notable attempt by prominent international lawyers to facilitate the regulation of cyber operations by international law. In this article, we attempt to evaluate the degree to which international law, as reflected inter alia in the Tallinn Manuals, is influencing now and is likely to influence in the near future State conduct. This evaluation is based on mapping the principal reactions to the Tallinn Rules found in the academic and professional legal discourse, and – more significantly – through investigation of a 11 major incidents occurring after the first Tallinn Manual was published, which appeared to invite the application of international jus ad bellum and jus in bello norms. Our principal findings are that there appears to be only limited support in actual State practice and opinio juris for certain key Rules in the Tallinn Manuals. More significantly, several States heavily engaged in cyber operations appear at this point in time to have a limited interest in promoting legal certainty regarding the regulation of cyberspace.

Preventing State-Led Cyberattacks Using the Bright Internet and Internet Peace Principles

The Internet has engendered serious cybersecurity problems due to its anonymity, transnationality, and technical shortcomings. This paper addresses state-led cyberattacks (SLCAs) as a particular source of threats. Recently, the concept of the Bright Internet was proposed as a means of shifting the cybersecurity paradigm from self-defensive protection to the preventive identification of malevolent origins through adopting five cohesive principles. To design a preventive solution against SLCAs, we distinguish the nature of SLCAs from that of private-led cyberattacks (PLCAs). We then analyze what can and cannot be prevented according to the principles of the Bright Internet. For this research, we collected seven typical SLCA cases and selected three illustrative PLCA cases with eleven factors. Our analysis demonstrated that Bright Internet principles alone are insufficient for preventing threats from the cyberterror of noncompliant countries. Thus, we propose a complementary measure referred to here as the Internet Peace Principles, which define that the Internet should be used only for peaceful purposes in accordance with international laws and norms. We derive these principles using an approach that combines the extension of physical conventions to cyberspace, the expansion of international cybersecurity conventions to global member countries, and analogical international norms. Based on this framework, we adopt the Charter of the United Nations, the Responsibility of States for Internationally Wrongful Acts, Recommendations by the United Nations Group of Governmental Experts, the Tallinn Manual, and Treaty of the Non-Proliferation of Nuclear Weapons, and others as reference norms that we use to derive the consistent international order embodied by the Internet Peace Principles.

Seeking Customary International Human Rights Law in the Cyberspace: A Critique of the Tallinn Manual 2.0

The recent Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations is a comprehensive study on the legality of states’ cyber activities under the extant international law. This paper focuses on Chapter 6 of the Tallinn Manual which deals with the legality of states’ cyber activities under international human rights law, and specifically examines the methodology used therein in identifying the customary law basis of states’ human rights obligations applicable to the cyber context. By grounding the methodological issue in the Tallinn Manual in the decades-old scholarly debates about methodologies of customary international law and customary international human rights law (CIHRL), I suggest that the difficulties that the Tallinn Manual has encountered in ascertaining CIHRL cannot be reductively attributed to the novelty of cyber technologies but should be seen as a manifestation of the inherent uncertainties in the process of law-identification. With a detailed analysis of the highly conservative and inductive approach of Chapter 6 of the Tallinn Manual, I point out a number of inconsistencies and ambiguities therein. I argue that these methodological problems have led to its two premises – the advancement of cyber technologies has posed new problems to which the legal solutions are not readily available, and cyber activities do not exist in a legal void – irreconcilable, and a confusion between description and prescription. I further argue that given the feature of the Tallinn Manual, some non-liquet conclusions regarding the legality of certain cyber activities under CIHRL could have been avoided.

Cyberweapons: power and the governance of the invisible

This article explores the non-emergence of a global governance regime for cyberweapons. Cyberweapons are malicious software entities deployed to cause harm to adversaries’ computer networks and systems. They threaten the integrity and functionality of digital systems that enable global circuits of communication and exchange, with significant potential impacts on social, economic and political order. Using a power-analytical approach, this article identifies four areas in which power works to constrain regime formation: the productive power of NATO’s Tallinn Manual Process; the structural power of US involvement in cyberweapons markets; the institutional power of Internet technologies; and diplomatic claims to sovereignty that mask operations of compulsory power. These work together to prevent a unified global approach to the regulation of cyberweapons. The article concludes that there are substantial obstacles to effective cyberweapons governance but that these should not prevent ongoing efforts to tackle this important and ubiquitous security issue.