Cyber warfare: some questions of shared responsibility

 Posted by: Plakokefalos Ilias

During the past weeks several reports have emerged revealing details on one of the gravest cyber-attacks that have taken place, the Flame malware. It has been suggested that Flame has been co-sponsored by the same State or States that had launched Stuxnet, even though the head of the International Telecommunications Union (ITU) of the UN has stated that this is mere speculation, Stuxnet being the virus that had targeted the Iranian nuclear programme. Flame has been used to attack computers and network systems across the Middle East. The malware exploited a flaw in the Windows operating system in order to map and monitor the targeted computers. The situation provoked a reaction by the ITU, which stressed the need for co-operation among states in addressing the problems arising out of the growing use of networks to infiltrate and cause damage to systems across the world.

The suggestion that Flame was launched by more than one State raises a number of questions concerning the apportionment of responsibility among the actors that have participated in the cyber-attack. Matters become even more complicated if one takes into account that in some instances non-state actors are also involved in the cyber-attacks.

First of all, it must be noted that identifying the source of a cyber-attack is notoriously problematic. The structure of the Internet poses hurdles both as to the accuracy and as to the immediacy of the identification of the source. It is only evident that it would be even more difficult to point to the source in the case of multiple responsible actors.

A second problem is that the conceptualization, in terms of international law, of the nature of cyber warfare is also fraught with difficulties. The analogies employed usually, and naturally, point to the direction of the law of armed conflict. This approach is, for the time being, problematic. A direct analogy does not sit comfortably with the way the traditional means of using force or conducting an armed attack are conceived predominantly because they are of a remarkably different nature.

Nevertheless, for the purposes of this post we can assume that the analogy is accurate. The literature, by and large, accepts a model according to which cyber-attacks may be seen in the same way as classic cases of use of force or armed attack. The cyber-attack will therefore fall into one of the categories already developed under the international law of armed conflict such as use of force or armed attack, using as a criterion its consequences. The categorization is extremely important because it will carry with it consequences for both the wrongdoing State and the victim State. For example, if a cyber-attack is categorized as use of force then the victim State may take countermeasures. On the other hand if a cyber-attack falls indeed under the category of armed attack, the victim state will be in a position where it can respond invoking self-defence.

The question that has not received enough attention is what happens in the case where the consequences of an attack do not fall neatly within any of the pre-existing categories envisaged in the law of armed conflict. In other words, what happens when the consequences of the cyber-attack are not grave enough so as to warrant a categorization as use of force, armed attack or aggression?

A possible ground for establishing wrongfulness in this scenario is that in this case the State from whose territory the attack is launched is under an obligation not to allow its territory knowingly to be used in such a way so as to cause harm to another state. The application of this standard, established by the International Court of Justice in Corfu Channel, is not without problems. First, it is not clear which is the primary rule breached in this case. An extension of the ‘no harm’ rule established in international environmental law could be a solution, yet the main difference is that in international environmental law there are specific obligations that bind states (notification, exchange of information, procedures of licensing potentially harmful activities) and cumulate to the ‘no harm’ rule. Unless something similar can be established in the sphere of controlling the cyberspace there is little use even for this analogy. Another possible ground would be the principle of non-intervention. Second, there is no presumption of knowledge. When non-state actors are involved in launching the attack, establishing knowledge on the part of the source State might be equally hard, given the difficulty in obtaining accurate evidence, as it is to establish that a State exercised effective or overall control over the cyber-attack. In other words, the theoretical advantage of having to establish ‘knowledge’ instead of ‘control’ (variations of which may be employed if the cyber attack is classified as armed attack etc.) might not translate into a practical advantage.

If multiple actors are involved in launching the attack a number of further problems arise. The most important is that the victim State will not be able to direct its response — be it countermeasures or self defence — accurately: it has already been made clear that the identification of the source of the attack is a difficult endeavour. Also, when the multiplicity of actors is understood as including both state and non-state actors, the tests of attributing the conduct of the latter to the former (effective, overall control etc.) will be even more difficult to apply in the cyber warfare context.

In any case, it is true that the fact that a number of States (such as the Flame case seems to be) or States and non-state actors are involved in launching cyber-attacks does complicate the issues that have to be dealt with in the law of responsibility as well.

First, the victim State(s) will not be in a position to accurately point to the role of each responsible party. As it has already been stated above, this will be problematic since the victim State will have to be in a position to show – at least – knowledge of the operation and to be able to distinguish between the components of the operation that were stemming from each State. More difficult issues of attributing responsibility among multiple states might arise if the consequences are so grave that it will have to establish which source State had control over which entities that launched the attack. The connection between the entities actually designing and launching the cyber-attack with the State from which they operate will not be easy to establish because of the difficulties in presenting tangible evidence.

Second, according to the Article 47 of the ILC Articles on State Responsibility the criterion for attributing responsibility to multiple actors is that they breach the same obligation. In the case of cyber-attacks it may well be that each state has contributed through different means towards the realization of the attack and might easily have breached a different obligation. Therefore a more appropriate criterion could be to establish the responsibility of multiple actors on the occurrence of a single harmful outcome.

Third, the causal link connecting the same harmful outcome or damage caused with each actor will be difficult to establish. This is a problem that will be faced even in a single wrongdoing actor situation but the existence of multiple actors will effectively exacerbate the difficulties. A way out of this situation would be to apply a principle of joint and several liability, allowing thus the victim State the option against whom it might bring a claim. Accordingly, the victim State could bring a claim against the actor that is easier to tie to the specific attack, both in terms of attribution and in terms of causation and then claim full reparation. It would be then up to the respondent State to turn against other responsible States in order to recover. Nevertheless it is not clear whether the principle of joint and several liability, despite its obvious appeal in this type of situations, is part of general international law and the criteria under which it would be applied are not established (See: C. Ahlborn, ‘A Comment on Bruno Simma’s SHARES Lecture’, SHARES blog, 13 June 2012).

In conclusion it must be noted that the state of international law in relation to cyber-attacks has not reached a point where it can address all the issues that arise adequately. Especially when there are multiple actors involved, the problems do become more complex and difficult to address. Therefore it is clear that in order to have a more comprehensive picture of the legal aspects of cyber-attacks two things must happen: first, the practical difficulties that arise in relation to issues like the production of concrete evidence and the accurate determination of the facts must be overcome and second, the legal conceptualization of the issues must become more rigorous.

‘Joint Responsibility in International Law: Revisiting the Oil Platforms Case’, A Comment on Bruno Simma’s SHARES Lecture

 Posted by: Ahlborn Christiane

While the ICJ’s practice of individual opinions has been criticized in the past for sending signs of divided of authority, it is generally acknowledged that these opinions offer Judges a forum to voice views that could not be accommodated in the Court’s decision for different reasons. As such, many individual opinions have made invaluable contributions to the Court’s jurisprudence, especially when expressing a more progressive stance towards the state of the law in question. A particularly illustrative example in this regard is Judge Simma’s separate opinion (pdf) in the Oil Platforms case, which he revisited in a SHARES Lecture on 24 May 2012 at the University of Amsterdam.

The Facts of the Case

The Oil Platforms case was brought by Iran against the United States and concerned the destruction of three offshore oil platforms in the Persian Gulf in 1987 and 1988. The main question in the case was whether or not the attacks by the US Navy had breached Article X, paragraph 1 of the 1955 Treaty of Amity, Economic Relations and Consular Rights between Iran and the United States (hereinafter: the 1955 Treaty), whose Article XXI, paragraph 2, served as the basis for the jurisdiction of the Court. Article X, paragraph 1 reads as follows: “Between the territories of the two High Contracting Parties there shall be freedom of commerce and navigation.” However, before examining whether the acts of the US had breached Article X, paragraph 1 of the 1955 Treaty, the Court ventured into an analysis of whether or not these acts could be justified by self-defense in light of Article XX (d) of the 1955 Treaty. The Court’s approach led to the somewhat paradoxical finding that the US acts could not be justified before the initial breach was investigated. Notwithstanding the underlying policy considerations of the ICJ’s approach, this finding was arguably unnecessary from the viewpoint of procedural efficiency because the Court subsequently rejected Iran’s main claim that the attacks of the US were wrongful in the first place.

The Generic Counter-Claim by the United States

While the Court’s statements on the use of force have received a lot scholarly attention, the importance of Judge Simma’s separate opinion extends to a rather neglected part of the judgment: the generic counter-claim brought by the US and the question of shared responsibility between the Iraq and Iran. In this counter-claim, the US had submitted that Iran equally breached Article X, paragraph 1, of the 1955 Treaty by attacking vessels in the Gulf with mines and missiles and otherwise engaging in military actions against Iraq. In view of the Court’s rejection of the US counter-claim, Judge Simma used his separate opinion to argue that the counter-claim should have been maintained. With reference to the Court’s earlier findings in the Nicaragua case (para. 57), he clarified that the examination of the generic counter-claim would not have necessitated an investigation of specific incidents but rather the general deterioration of the trade climate created by the armed conflict between Iraq and Iran. He therefore submitted that Iran should have been found in violation of its obligations under the 1955 Treaty.

According to Judge Simma, the principal challenge of that counter-claim was the attribution of responsibility for mine-laying activities to either Iraq or Iran, which could have both been potentially responsible for the resulting damage. As Judge Simma stated in his separate opinion: “It is more difficult – if not impossible – to measure with any exactitude the negative impact of individual Iraqi or Iranian actions on the economic conditions of commerce, let alone on American commerce specifically. The damage caused by these actions, i.e. the impediment to the freedom of commerce and navigation protection by the 1955 Treaty is indivisible and as such cannot be apportioned between Iran and Iraq.” (para. 64)

The Principle of Joint and Several Responsibility

In order to establish whether Iraq’s involvement would have any impact on the determination of responsibility of Iran, Judge Simma engaged in comparative legal research regarding rules and principles on multiple wrongdoers in different common and civil law jurisdictions. On the basis of his comparative tort law study of the United States, Canada, France, Switzerland and Germany, he came to the conclusion that these jurisdictions know a principle of joint and several responsibility in one form or another, which allows the plaintiff to seek redress from any of the multiple wrongdoers for the whole damage caused. Explaining that the principle of joint and several responsibility qualifies as a “general principle of law” within the meaning of Article 38, paragraph 1 (c) of the ICJ Statute, he submitted that the principle should have been applied in the Oil Platforms case to hold Iran responsible, irrespective of Iraq’s contribution to the situation. Finally, Judge Simma dismissed the potential objection that Iraq would be an indispensable third party in the proceedings. Relying on the Court’s findings in the Nauru case, he argued that Iraq’s role in impeding the freedom of commerce and navigation between the US and Iran did not constitute the subject-matter of the dispute.

Methodological Issues

During his SHARES lecture, Judge Simma re-affirmed the views expressed in his separate opinion, which continues to be one of the few instances regarding issues of shared responsibility in the jurisprudence of the ICJ. Nonetheless, his SHARES lecture and the discussion that followed also exposed open questions and challenges for future research on shared responsibility. As Judge Simma pointed out, international case law and legal scholarship do not provide any immediate answers to questions of shared responsibility, which is the reason why he resorted to a comparative tort law study. In retrospect, he emphasized that this study could obviously not live up to the methodological standards of comparative legal research, in particular with regard to the selection of legal systems. And yet, in light of the scarce international law resources, reliance on domestic law as a source of inspiration seems to be inevitable. As Judge Simma’s separate opinion illustrates, such reliance would necessitate an adequate research methodology (in this regard see the recent EJIL: Talk! debate on international law and comparative law methodology here).

How to Interpret Article 47 of the Articles on State Responsibility

As one of the few existing international sources of authority, Judge Simma equally referred to the ILC’s work on State responsibility. Nonetheless, his separate opinion shows that the pertinent Article 47 of the Articles on State Responsibility does not sit well with corresponding domestic law provisions.  It is unclear, for instance, whether Article 47 only envisages concerted action by two or more States or also independent acts leading cumulatively to the “same internationally wrongful act”. According to Judge Simma, Article 47 merely applies to the former situation, which made it inapplicable in Oil Platforms since Iran and Iraq did not act in concert when deteriorating the economic situation in the Persian Gulf. In contrast to Article 47, most domestic law provisions reviewed by Judge Simma do not make a distinction between concerted and cumulative action. Unlike Article 47, however, these provisions do not rely on the concept of the “same internationally wrongful act” but are based on the idea of an “indivisible damage”, which is indeed reconcilable with concerted and cumulative wrongful acts.

In his opinion, Judge Simma oscillates between these concepts of “indivisible act” and “indivisible damage”, which is understandable in light of the ambiguity of Article 47. As Judge Simma rightly acknowledged in his lecture, it is far from clear how the idea of an “indivisible” (same) act relates – or can even be equated with – the concept of “indivisible damage”. And yet, this distinction seems crucial for shared responsibility, and also the law of international responsibility more generally. For the role of “damage” or “injury” goes to the very core of the nature of international responsibility, which the ILC mainly grounds in the internationally wrongful act with its two elements, the attribution of conduct and the breach of an international obligation.

Iraq as an Indispensable Third Party

Considering the ILC’s conception of international responsibility, it is questionable whether the indispensable third party rule would have prevented the ICJ from pronouncing itself on the responsibility of Iran, but for different reasons than stated by Judge Simma (see above). While the Monetary Gold case did not concern issues of shared responsibility, the resulting indispensable third party rule has subsequently been invoked in cases allegedly involving multiple wrongdoing states, most notably in the East Timor case and in the Nauru case. However, the legal situation in the Oil Platforms case was different from that in East Timor or Nauru. Although the other States in question were also not parties to the dispute, they were bound by the obligations breached by the respective defendant state (the right to self-determination and the UN Trusteeship Agreement for Nauru, respectively). In Oil Platforms, Iraq was not a party to the 1955 Treaty and could not have breached Article X of the 1955 Treaty by its acts or omissions. As a result, Iraq could not have contributed to the same internationally wrongful act. In this sense, it may be doubted that Iraq would have qualified as an indispensable third party in the proceedings in which only the independent determination of Iran’s responsibility was at stake.

A similar conclusion must be reached if shared responsibility is conceptualized in relation to the concept of indivisible damage. Although Judge Simma did not discuss any question relating to (the apportionment of) reparation in his separate opinion, he suggested that the problem of factually indivisible wrongful acts could have been overcome by means of the principle of joint and several responsibility for indivisible damage (para. 359). Indeed, Iraq most likely contributed to the damage done to the trade and commerce in the Persian Gulf in factual terms. However, this factual damage is to be distinguished from “damage” characterized in legal terms.  A duty to repair the damage, be it caused by one or multiple wrongful acts, only arises as a result of a prior breach of an international obligation. Accordingly, the damage done to trade and commerce in the Persian Gulf was not indivisible because Iraq did not have any obligations under the 1955 Treaty. It could thus be argued that Iraq’s presence in the proceedings was not indispensable to establish Iran’s duty of reparation.

It may nonetheless be interesting to apply the principle of joint and several responsibility to a hypothetical scenario in which Iraq is bound by an international obligation vis-à-vis the United States (be it the 1955 Treaty or customary international law). Such a scenario may illustrate that there is no need to apply the indispensable third parties rule in cases of shared responsibility. For it is precisely one of the main purposes of the principle of joint and several responsibility to allow an injured party to bring a claim against only one of the potential wrongdoers, i.e. in the absence of other potential wrongdoers. Consequently, a claim against Iran alone could have been maintained, even though Iraq may have also been responsible for the wrongful acts that formed part of the subject-matter of the case. The crucial question is rather which cause of action Iran could subsequently invoke against Iraq to seek contribution to the reparation paid to the United States in the initial proceedings. Until this question is resolved, the interests of the injured and the responsible parties are not balanced and the principle of joint and several responsibility cannot not find proper application in international law.