The twenty-first century is the era of the Internet and, in terms of criminal activity, the era of cybercrime. Cyberspace is expanding and developing quickly. Cyberwar is riskier and considerably less expensive to carry out. It’s a complex area of law without any particular international law (IL) rules or regulatory guidelines. The Laws of armed conflict (LOAC), which primarily apply to conventional warfare, is what is still being put to use in the cyber arena. But this is extremely troublesome, considering the undefined, abstract and ambiguous nature of cyberspace. This article attempts to look into the problems of applying LOAC in cyber-warfare, focusing specifically on the extent of its application in the right of self – defence.
Introduction
Every member state of the United Nations that has ratified international humanitarian laws (IHL) is bound to follow them. The law of armed conflict (LOAC) or the law of war is a part of international law that is looked into when two or more states are engaging in war or even an undeclared conflict that involves the usage of arms. It ensures that just and humanitarian principles are observed in the conduct of war.
LOAC constitutes two principal parts – Jus ad Bellum and Jus in Bello. Jus ad Bellum translates to “right to war”, which explains when two states can engage in war when they can resort to the use of force, and to what extent. Jus in Bello means “justice in war” which establishes laws and rules to be followed when a state is engaging in war. It provides regulating guidelines relating to the conduct of hostilities, and the protection of combatants, non – combatants, civilians, prisoners of war, etc. regardless of whether it’s international or non-international in nature.
One important principle to be noted is that of “lex specialis derogat legi generali”. Often there would be more than one law that regulates actions in armed conflicts. This legal maxim expounds that when there is a general law and a special law provision for a certain action or conduct, then the special law, “lex specialis”, will prevail over the general law. And in this case, the LOAC in IHL is the special law that is to be considered over the other regulating laws. This shows the predominance of LOAC in regulating the conduct of war.
Do you have the Right of Self-Defence in International Law?
Self-defence as the word implies, is the right to protect oneself from impending harm or attack. In the current context, the right to self-defence can be exercised only when an armed attack takes place. Article 2(4) of the United Nations charter expounds that no state shall use or threaten to use force against the territorial or political integrity of another state. But there are exceptions to this – if the use of force is a collective decision taken and authorized by the United Nations Security Council or if force is used in response to an armed attack, for the sake of one’s defence, then in these cases, it’s not considered to be a violation of the said article.
Article 51 of the UN Charter, enlightens on the right to self-defence in armed conflicts. The article presents that the right of self-defence is available to an individual or to a collective group of individuals that are part of an armed conflict that is taking place against member states of the UN.
It is however necessary to understand what falls into the definition of an “armed attack”. The definition of “armed attack” is nowhere mentioned in the UN Charters, so, some cases of international armed disputes decided by the ICJ are referred to for this matter. In the case of Nicaragua v. USA, the Nicaragua government had accused the US of supplying weapons and financially funding a rebel group to attack Nicaragua’s Government. The US argued that they were acting in collective self-defence to favour Nicaragua’s neighbouring countries.
The ICJ decided that there has been no armed attack as the US had only acted as a 3rd party state providing logistical support to the rebel state and so, there was no direct use of arms by the US that could count as an armed attack. In another case of dispute between Iran and the US, the US military naval attacked and destroyed Iranian oil mining and refining platforms in the gulf region as a response to the Iranian military ship’s single attack on a US vessel. The ICJ was to look into the question of whether a single attack or a series of collective minor attacks has the necessary gravity to expect a counter self–defence attack or not. The ICJ pronounced in its decision that even a single attack is enough for the other state party to exercise its inherent right of self – defence.
So, there are two things that are considered before rightfully exercising the self–defence – the use of force by the offending state and the gravity of the damage caused. The doctrine of Caroline has an established set of principles that guides the application of the right of self-defence. The three principles are – necessity, proportionality and immediacy. The principle of necessity propounds that a state can use force to avert an overwhelming attack, provided that, all other remedies are exhausted. Proportionality determines whether the force used in self – defence is reasonable and proportional to the harm that’s caused by the offender state. Lastly, the principle of immediacy states that the affected state can attack only if there’s an imminent and persistent attack.
With the scientific and technological advancement of mankind, the idea of what “weapons” in war could be, expanded. With the advent of nuclear and chemical weapons during the world wars and advancements in biological weapons, many advocated for the incorporation of these unconventional weapons of mass destruction into the ambit of the application of LOAC. A renowned British barrister, Sir Brownlie, argued that the use of chemical and biological weapons falls into the subject of the use of force in general armed attacks as they, like conventional weapons, cause destruction to life and property.
Speaking of unconventional methods of warfare, the invention of the internet in the 21st century has opened up an entirely new dimension of cyberspace and of course a new mode of conduct of war within cyberspace or cyberwar which has rendered the application of LOAC, tricky.
Application of Law of Armed Conflicts in CyberWar
Cyberspace is an abstract idea of a virtual space, devoid of a specific territory, where every device that’s enabled by the internet is said to be interconnected. All the attacks that take place within this cyberspace are called cyber-attacks. Cyber–attacks between two or more states would amount to cyberwar. The Britannica dictionary defines cyberwar or cyber warfare as, “war conducted in and from computers and the networks connecting them, waged by states or their proxies against other states. It is usually waged against government and military networks in order to disrupt, destroy, or deny their use”.
Looking at the definition we can see that there are a couple of challenges in the application of LOAC in cyberwar, like, the absence of a defined territory or border. Cyberspace is one, therefore the problem of jurisdiction remains. It connects both the military and civilians, and this brings many complexities. Since the military and civilians are interconnected, all in one cyberspace, setting a specific target would be difficult. Civilians would be at a greater risk of getting affected even if the attack was targeted toward the military. Most hackers are civilians, which would mean that if they carry those cyber attacks that do not come under the ambit of LOAC then they’ll be protected by IHL and can only be tried under criminal proceedings and if they take part in state hostilities then they lose the protection of IHL even if they’d come under the definition of a civilian.
There are two schools of thought that give contrasting answers to the question of the validity of applying LOAC in cyberwar. One school of thought argues that the absence of a specific treaty pertaining to cyberwar should be interpreted that LOAC wouldn’t apply to cyberspace and hence states should be left on their own to follow their laws and take their own decisions matter regarding the same.
This argument was also once put forth by the ICJ but was later rejected. The second school of thought sweeps the lacunae under the rug but gives more of a balanced view and has a stronger interpretation with the support of the “Marten’s Clause” which is referred to, to ascertain the limits of freedom of action when there is an absence of concrete norms in a specific legal area. It affirms that even if there is no explicit mention of cyber attacks made in modern treaties and conventions, LOAC can be used to regulate and impose certain necessary restrictions.
Right of Self Defence in CyberWar
For a state to invoke self-defence for use of force against the assailant state, an armed attack should have taken place, or there should have been a reasonable apprehension of it. Moreover, all the actions the state that exercises force in order to defend itself must comply with jus in Bello.
The first thing to observe is whether cyber attacks qualify as armed attacks as interpreted in the charters. An armed attack is explicitly interpreted as one that causes physical destruction, injury, grave harm, or damage to property and other consequences with a similar degree of damage. Not all forms of cyber attacks are harmful to such an extent, many are just espionage, non–state actors involved in hacking activities like data stealing, and other non – destructive activities that don’t fall into the ambit of armed conflicts.
So it can be safely said that only those cyber-attacks that are carried out by or on behalf of one state targeting another and the consequence of conducting a destructive cyber activity that leads to loss of life, injury or other physical destruction could be considered equivalent to an armed attack under Article 2(4), eventually attracting the right of self-defence under Article 51. Now, looking back at the Caroline doctrine, we can say the application of its framework in cyber attacks is quite unambiguous.
Cyberspace is a mesh of interconnected networks and it is quite improbable to measure the proportionality of damage caused. It can often be difficult to detect the assailant in cyberspace and any attack that’s done in cyberspace leaves behind a “ripple – effect” and it becomes more difficult to trace the impact. In addition to this principle of immediacy cannot be simply checked in with as often the harmful effect of cyber attacks becomes visible days or months after the actual intrusion had taken place and there is absolutely no way to determine the attack before it takes place.
Conclusion
In conclusion, it can be seen that the absence of a codified treaty for crimes in cyberspace has left the states with no choice but to fit it in the LOAC’s outdated charters and principles. Currently, it’s the use of Marten’s clause that is providing a balance, to facilitate the application of laws in cyberwar, but this has left huge legal gaps, the loopholes of which are at a greater risk now than ever of being exploited, especially with the continuous development and advancement of technologies in the cyber arena. What is needed is a concrete piece of legislation in IL focusing specifically on cyber-attacks that could keep a strong check and regulate cyber-crimes efficiently, reducing the lacunae.