CYIL vol. 12 (2021)

CYIL 12 (2021) PREEMPTIVE SELF-DEFENCE IN CYBERSPACE the formulation of a custom? Since the gravest form of the use of force is at stake, its effective occurrence would be hard to be dissimulated. The fact itself would constitute an evidence of a practice. In addition, in line with Art. 51 of the UN Charter measures taken in the exercise of the right of self-defence “shall be immediately reported to the Security Council”. Quatro , does a preemptive self-defence advocated by France, US, UK, and Australia against a cyberattack take a form of a defensive cyberoperation which is equal, in terms of quantity and quality, to a conventional self-defence? What would be its scope, form and objective? If the traditional self-defence operation aims to halt and repel the attack and to re-establish the territorial integrity (without occupying the territory of the aggressor unless it is strictly necessary to stop the continuation of the armed attack by other means) 60 , it is possible to argue that a preemptive self-defence aims to prevent such an immediate threat of cyberattack and the resulting damage via the paralysis of the action of the aggressor. Would such paralysis include the destruction of the means of combat of the aggressor? What type of destructive effects would be necessary and proportionate within the bounds of self-defence? Would it include the violation of the territorial integrity of the aggressor and at what degree? It is, first, important to distinguish preemptive self-defence against an imminent cyberattack which is led by conventional weapons and that using a digital vector. Whilst the first scenario follows, in principle, the standard rules on self-defence, the latter poses a new challenge. In fact, it is important to note that not every cyberoperation interfering with other State’s sovereignty qualifies as use of force, while self-defence constitutes ipso facto a form of a use of force. Cyberoperations of a lower intensity might violate State sovereignty or the prohibition to intervene into internal matters of a State but not the general prohibition to use force anchored in Article 2 (4). The few States having expressly addressed the question of the qualification of a cyberoperation as use of force, such as the UK, US, Australia, Finland, and Iran concur that it entails physical effects and apply the effects-based doctrine. 61 The US for example notes: “In assessing whether a particular cyber operation – conducted by or against the United States – constitutes a use of force, DoD lawyers consider whether the operation causes physical injury or damage that would be considered a use of force if caused solely by traditional means like a missile or a mine.” 62 France, on the contrary, declares that even a “cyberoperation without physical effects may also be characterised as a use of force ” 63 . The determining criteria include “the circumstances prevailing at the time of the operation, such as the origin of the operation and the nature of the instigator (military or not), the extent of intrusion, the actual or intended effects of a cyberoperation violating international law: “Such attribution is a discretionary choice made, inter alia, according to the nature and origin of the operation, the specific circumstances and the international context”, Ministry of the Armed Forces, op. cit . note 7, p. 10; see also UK, Attorney General, op. cit. note 3; and US, Hon. Paul C. Ney, op. cit. note 6. 60 See CASSESE, A., op. cit. note 38, p. 1333. 61 See UK, Attorney General, op. cit . note 3; US, Hon. Paul C. Ney, op. cit. note 6; Australia, Australian paper , op. cit. note 10, pt 1; Finland, International law and cyberspace , op. cit . note 12, p. 6; or Netherlands ( The Netherlands’ position paper , op. cit . note 36, p. 4). Similarly, “material damage to property and/or persons in the widespread and grave manner” as well as cyberoperations that “affect the vital national infrastructures, including defensive infrastructures” constitute the use of force according to Iran, Declaration of General Staff , op. cit . note 14, Art. 4 (1)). 62 Ibid. 63 Ministry of the Armed Forces, op. cit. note 7, p. 7 (emphasis added). Similarly, the Netherlands remarks: “[A]t this time it cannot be ruled out that a cyber operation with a very serious financial or economic impact may qualify as the use of force”, The Netherlands’ position paper , op. cit. note 36, p. 4.

81

Made with FlippingBook - Online catalogs