Intervention in Syria and International Law: Inside or Out?

 Posted by: Nollkaemper André

Cross posted on Opinio Juris

States that have decided to potentially engage in military strikes against Syria, or to support such strikes, face a difficult choice between two options: do they operate outside the international legal framework when they act, or do they use the strikes as part of an attempt to reconstruct the law on the use of force?

There is no doubt that in the present situation, military strikes against Syria would be in violation of international law as it has been understood since 1945. In situations as we face now, in the absence of a Security Council mandate, international law allows no unilateral use of force. Building a coalition outside the United Nations does not help. Qualifying strikes as punishment does not help either. International law does not provide a right of states to respond with force to serious violations of international law – even when that law prohibits the use of chemical weapons. Other than what was suggested in the UK legal position, reliance on the doctrine of humanitarian intervention does not change this. The positions of states on humanitarian intervention simply are too diverse. This was made quite clear in the UN debates on R2P, which did not recognize any right to use force outside the existing Charter system.

In this situation, states that move forward with strikes have two options: to act outside the system or to stay inside, but present the strikes as part of a process to change the system.

The first option is simply to ignore the international legal framework – and just bombard, without attempt to justify the bombardment in legal terms. An alternative way to frame this, which boils down to the same approach, would be to deny that international law as it is prohibits unilateral strikes. At the time of writing, this first option appears to be the US approach. The line then would be that in extreme cases, strong military responses are required to protect interests of states or of the international community – no matter what international law has to say on the matter. Politically, and/or morally, stakes are too high to be limited by the law. The law may have to pass in situations as this.

The second option is to present the strikes as part of a process of reconstruction of the law on the use of force, and more in particular as a revival of the right to humanitarian intervention. The argument would be that the Charter (and for that matter the R2P doctrine) gives the Security Council the responsibility to act when states use chemical weapons, and that if they fail to do so, individual states should be able to act to protect civilians. Present international law may prohibit it, but international law is not static and can change by being breached. The unlawful act may contain the seeds of a new rule allowing for humanitarian intervention.

On the assumption that strikes deter and influence future behavior, both options may help to protect civilians. Moreover, both options may put the Security Council and its member states on notice that the next time, they should better take their responsibility more seriously, otherwise they will be left behind again.

It may be said that the difference between the two categories is thin or even artificial, since also an act that ignores the law may later be invoked as a precedent for the process that leads to change. Nonetheless the positions can be distinguished. There is a difference in terms of the opinio juris that is relevant for the formation of customary law. Another difference is that states in the former category can continue to rely on the system as it is, to critique future uses of force that rely on an alleged humanitarian exception if they consider these uses politically undesirable, whereas the second group will have a little more to explain.

For those supporting air strikes, the choice between the options is not easy. The benefit of the first option is that the Charter system stays in place. The states embarking on this route will hope that such incidental transgressions do not affect the system as a whole. Next time a similar situation arises, they can simply rely again on the traditional law. This hope is not entirely baseless. Somehow the many transgressions of article 2(4) of the UN Charter in the past decade have not changed anything in the fact that states and legal scholars generally continue to use article 2(4) as a first baseline for justifying or critiquing action or inaction.

A drawback of the first option is that it does not offer anything to make the international legal system more capable of responding to violations of its most fundamental norms. As long as the Security Council does not take its responsibilities more seriously, the system will have to pass when it really matters. There is no ambition of development towards a system that can protect the persons for whose purpose international law in the final analysis exists.

The second option is from this angle more attractive. It could allow participating states to ride the moral high ground, and to seek protection of civilians from within the international legal order. At the end of the tunnel it projects a body of international law that allows for decisive action when needed to protect fundamental values when the Council once more fails to act.

The difficulty of the second option is that it is rather uncertain where this process will lead. Some states (e.g., the UK, the Netherlands) have articulated conditions for humanitarian intervention, such as the requirement that negotiations have been exhausted, that there is a likelihood that the strikes will achieve the aim of protection of civilians, and that there is support of other states – notably states in the region.

However, it is very uncertain whether these conditions will be acceptable to the majority of other states. It also is likely that opinions on the interpretation and application of such conditions in specific cases will differ. If so, a serious risk exists that engaging in this process will lead us to a situation where the old system is abandoned and no longer provides protection, yet no new agreed new rule will be established. States then may justify the use of force on different criteria. They may use the pretext of humanitarian intervention to justify, for example, a strike on Israel because there too the Security Council fails to effectively respond to the illegal occupation, and there too humanitarian costs are high. Engaging in air strikes as part of an attempt to reconstruct the law on the use of force in a humanitarian direction then may come back like a boomerang. The agony is that article 2(4) then will have lost some of its power to protect us.

The failure of the Security Council to take its responsibilities and to act therefore is for more than one reason deplorable. Not only does it leave the people in Syria without protection, but it also induces unilateral action that, whichever it proceeds inside or out, leaves the international legal system worse off.

Cyber warfare: some questions of shared responsibility

 Posted by: Plakokefalos Ilias

During the past weeks several reports have emerged revealing details on one of the gravest cyber-attacks that have taken place, the Flame malware. It has been suggested that Flame has been co-sponsored by the same State or States that had launched Stuxnet, even though the head of the International Telecommunications Union (ITU) of the UN has stated that this is mere speculation, Stuxnet being the virus that had targeted the Iranian nuclear programme. Flame has been used to attack computers and network systems across the Middle East. The malware exploited a flaw in the Windows operating system in order to map and monitor the targeted computers. The situation provoked a reaction by the ITU, which stressed the need for co-operation among states in addressing the problems arising out of the growing use of networks to infiltrate and cause damage to systems across the world.

The suggestion that Flame was launched by more than one State raises a number of questions concerning the apportionment of responsibility among the actors that have participated in the cyber-attack. Matters become even more complicated if one takes into account that in some instances non-state actors are also involved in the cyber-attacks.

First of all, it must be noted that identifying the source of a cyber-attack is notoriously problematic. The structure of the Internet poses hurdles both as to the accuracy and as to the immediacy of the identification of the source. It is only evident that it would be even more difficult to point to the source in the case of multiple responsible actors.

A second problem is that the conceptualization, in terms of international law, of the nature of cyber warfare is also fraught with difficulties. The analogies employed usually, and naturally, point to the direction of the law of armed conflict. This approach is, for the time being, problematic. A direct analogy does not sit comfortably with the way the traditional means of using force or conducting an armed attack are conceived predominantly because they are of a remarkably different nature.

Nevertheless, for the purposes of this post we can assume that the analogy is accurate. The literature, by and large, accepts a model according to which cyber-attacks may be seen in the same way as classic cases of use of force or armed attack. The cyber-attack will therefore fall into one of the categories already developed under the international law of armed conflict such as use of force or armed attack, using as a criterion its consequences. The categorization is extremely important because it will carry with it consequences for both the wrongdoing State and the victim State. For example, if a cyber-attack is categorized as use of force then the victim State may take countermeasures. On the other hand if a cyber-attack falls indeed under the category of armed attack, the victim state will be in a position where it can respond invoking self-defence.

The question that has not received enough attention is what happens in the case where the consequences of an attack do not fall neatly within any of the pre-existing categories envisaged in the law of armed conflict. In other words, what happens when the consequences of the cyber-attack are not grave enough so as to warrant a categorization as use of force, armed attack or aggression?

A possible ground for establishing wrongfulness in this scenario is that in this case the State from whose territory the attack is launched is under an obligation not to allow its territory knowingly to be used in such a way so as to cause harm to another state. The application of this standard, established by the International Court of Justice in Corfu Channel, is not without problems. First, it is not clear which is the primary rule breached in this case. An extension of the ‘no harm’ rule established in international environmental law could be a solution, yet the main difference is that in international environmental law there are specific obligations that bind states (notification, exchange of information, procedures of licensing potentially harmful activities) and cumulate to the ‘no harm’ rule. Unless something similar can be established in the sphere of controlling the cyberspace there is little use even for this analogy. Another possible ground would be the principle of non-intervention. Second, there is no presumption of knowledge. When non-state actors are involved in launching the attack, establishing knowledge on the part of the source State might be equally hard, given the difficulty in obtaining accurate evidence, as it is to establish that a State exercised effective or overall control over the cyber-attack. In other words, the theoretical advantage of having to establish ‘knowledge’ instead of ‘control’ (variations of which may be employed if the cyber attack is classified as armed attack etc.) might not translate into a practical advantage.

If multiple actors are involved in launching the attack a number of further problems arise. The most important is that the victim State will not be able to direct its response — be it countermeasures or self defence — accurately: it has already been made clear that the identification of the source of the attack is a difficult endeavour. Also, when the multiplicity of actors is understood as including both state and non-state actors, the tests of attributing the conduct of the latter to the former (effective, overall control etc.) will be even more difficult to apply in the cyber warfare context.

In any case, it is true that the fact that a number of States (such as the Flame case seems to be) or States and non-state actors are involved in launching cyber-attacks does complicate the issues that have to be dealt with in the law of responsibility as well.

First, the victim State(s) will not be in a position to accurately point to the role of each responsible party. As it has already been stated above, this will be problematic since the victim State will have to be in a position to show – at least – knowledge of the operation and to be able to distinguish between the components of the operation that were stemming from each State. More difficult issues of attributing responsibility among multiple states might arise if the consequences are so grave that it will have to establish which source State had control over which entities that launched the attack. The connection between the entities actually designing and launching the cyber-attack with the State from which they operate will not be easy to establish because of the difficulties in presenting tangible evidence.

Second, according to the Article 47 of the ILC Articles on State Responsibility the criterion for attributing responsibility to multiple actors is that they breach the same obligation. In the case of cyber-attacks it may well be that each state has contributed through different means towards the realization of the attack and might easily have breached a different obligation. Therefore a more appropriate criterion could be to establish the responsibility of multiple actors on the occurrence of a single harmful outcome.

Third, the causal link connecting the same harmful outcome or damage caused with each actor will be difficult to establish. This is a problem that will be faced even in a single wrongdoing actor situation but the existence of multiple actors will effectively exacerbate the difficulties. A way out of this situation would be to apply a principle of joint and several liability, allowing thus the victim State the option against whom it might bring a claim. Accordingly, the victim State could bring a claim against the actor that is easier to tie to the specific attack, both in terms of attribution and in terms of causation and then claim full reparation. It would be then up to the respondent State to turn against other responsible States in order to recover. Nevertheless it is not clear whether the principle of joint and several liability, despite its obvious appeal in this type of situations, is part of general international law and the criteria under which it would be applied are not established (See: C. Ahlborn, ‘A Comment on Bruno Simma’s SHARES Lecture’, SHARES blog, 13 June 2012).

In conclusion it must be noted that the state of international law in relation to cyber-attacks has not reached a point where it can address all the issues that arise adequately. Especially when there are multiple actors involved, the problems do become more complex and difficult to address. Therefore it is clear that in order to have a more comprehensive picture of the legal aspects of cyber-attacks two things must happen: first, the practical difficulties that arise in relation to issues like the production of concrete evidence and the accurate determination of the facts must be overcome and second, the legal conceptualization of the issues must become more rigorous.