On Thursday, Senator McCain will hold hearings of the Armed Services Committee on the Russian election hacking. Several aspects of Russia’s election interference raise issues involving the international law of cyber operations. For a quick tutorial, I recommend most highly an earlier Just Security post by Sean Watts, “International Law and Proposed U.S. Responses to the D.N.C. Hack.” I thought to provide readers with a few additional points in light of more recent developments.
1. Were the Russian operations an “act of war,” as Senator McCain recently stated?
Short answer: No, none of the facts alleged by the Obama administration with respect to the Russian operations would amount to an “act of war” in any legal sense of what that term might mean. And, yes there is a fairly settled understanding of what constitutes such actions in cyber.
Longer answer: An “act of war” is, in this context, a misplaced term. Sen. McCain’s statement likely intended to refer to an “armed attack” under modern law on the resort to force including the UN Charter. To cross the threshold of an armed attack, the cyber operations must at the very least involve a “use of force.” In an important speech in 2012, then-State Department Legal Adviser Harold Koh explained the US view of when cyber operations involve the use of force: “Cyber activities that proximately result in death, injury, or significant destruction would likely be viewed as a use of force.” That view is widely accepted by international legal experts (see posts by Mike Schmitt in the context of the Sony Hack and by Sean Watts in the context of the DNC hack, explaining the consensus view.) And as Sean Watts explained in his analysis, “it is enormously difficult to imagine a persuasive characterization of the D.N.C. hacks as either uses of force or armed attacks.”
One caveat: Technically speaking (and international law, to be sure, can be hyper technical), Koh’s remarks do not place a lower limit on what constitutes a use of force in cyber. Or another way of putting that point: his remarks do not state that such effects—“death, injury, or significant destruction”—are a necessary condition for a cyber act to constitute a use of force. Illustrating the point that a use of force need not itself be destructive, in a case between the United States and Nicaragua, the International Court of Justice characterized “arming and training” rebels as “involving the use of force.” (para. 228) That said, for a lookback at historical US resistance to a broader conception of “armed attack,” I recommend Matt Waxman’s “Cyber-Attacks and the Use of Force: Back to the Future of Article 2(4)” in the Yale Journal of International Law in 2011 (especially pages 427-30 & 437-40).
2. Has the Obama administration called the Russian operations a violation of international law?
Short answer: No.
Longer answer: All official statements by the Obama administration appear to include a studied avoidance of whether the Russian actions do or do not violate international law. Note this conspicuous line in the President’s statement on December 29: “These actions … are a necessary and appropriate response to efforts to harm U.S. interests in violation of established international norms of behavior.” Political scientists talk about “international norms of behavior”—for international lawyers, on the other hand, such terms do not connote an international legal obligation. It is safe to assume the specific word choice in the President’s statement is highly deliberate.
The administration had another opportunity recently to label action like the Russian DNC hack a violation of international law, but didn’t. In November, the State Department’s Legal Adviser Brian Egan gave an important speech on cyber and international law. In discussing this area of law, his description of cyber activities that would violate a State’s international obligations would not match the hacking of the DNC. He said:
“For example, a cyber operation by a State that interferes with another country’s ability to hold an election or that manipulates another country’s election results would be a clear violation of the rule of non-intervention.” (emphasis added)
Two caveats: First, as with Koh’s speech, the Egan speech does not set the outer limits of what action would violate the relevant legal rule. It only gives two examples of “clear” violations. Second, one of the two examples—a cyber operation “that manipulates another country’s election results”—might apply to hacking of election facilities (e.g., voting booths), of which Russians have also been accused. I suppose the legal question may boil down to whether an operation intended to cast grave public doubt on the integrity of the results would count, or if the Egan speech is meant instead to refer to altering the actual outcome.
3. Why would the Obama administration not say whether the Russian actions do or do not violate international law?
Short answer: There could be multiple different explanations.
Longer answer: Perhaps the administration lawyers did not reach a consensus view on whether the actions violated international law. Perhaps the administration reached the view that the Russian actions do not amount to such a legal violation, and so did not say otherwise. Perhaps the administration does think the Russian actions amount to a legal violation, but there is no pressing reason to state it. Or perhaps the administration is reluctant to assume the role of a victim, and consequent appearances of weakness or vulnerability, in its international relations with a recently resurgent Russia?
Also, talking about the law would open up questions about when, if ever, U.S. cyber operations violate international law.
4. What is at stake in the question whether the Russian actions violate international law?
There is no short answer.
First, if the Russian actions violated international law, it could expand the scope of actions the United States could take in response. Under the international law on “countermeasures,” the United States would be permitted to engage in self-help measures that would themselves otherwise violate international law. That is, a State is permitted to break international law to stop another State from breaking international law, in some circumstances. (There are conditions placed on the exercise of such measures, which I do not delve into here.)
Notably, the question whether Russia violated international law is not relevant to any of the overt actions against Russia that the Obama administration unveiled last week. None of those actions—from sanctions, to expulsion of diplomats, etc.—are predicated on the claim that Russia violated international law. They are all considered “retorsions” under international law: actions that a State has the prerogative to adopt as a self-help measure that do not violate any of its international law obligations.
That said, the question of whether Russia’s election interference violated international law might be relevant to whatever responses President Obama might have in store for Russia in covert operations. Obama’s statement alluded to such actions being in the works (and see this Washington Post story). If Russia violated international law, the universe of options that the United States can take in retaliation are more expansive.
Let me end, however, with a counterintuitive and arguably all-important point. Several commentators have discussed what US responses would be “proportionate” to the Russian actions in ways that suggest they think such a constraint of proportionality is imposed by international law. However, international law does not require a proportionate response in the realm of retorsions. What is more, unlike other self-help measures, States are entitled to adopt retorsions against another government for purely punitive purposes—to exact punishment. So, let’s assume that misappropriation of information with the purpose of undermining another nation’s election processes and institutions or its office holders is not a violation of international law. Well then, the United States would be free to take such kinds of actions against Russia regardless of scale—as far as international law is concerned.
Image: Air and Army National Guardsmen take part in exercise Cyber Shield 2016 at Camp Atterbury, Ind., April 20, 2016. Army photo by Sgt. Stephanie A. Hargett.