The Petya ransomware cyberattack hit computers of Russian and Ukrainian companies on 27 June 2017. Photo by Donat Sorokin/TASS/Getty.
6. Processes for Reaching Agreement on the Application of International Law to Cyberspace
160. A number of multilateral, regional and bilateral initiatives have developed in recent years in attempts by states to reach agreement on how international law applies to states’ cyber activities.265 These initiatives have taken various forms including strategic dialogue; political statements; and proposals for the agreement of principles. These state-to-state initiatives, together with a number of multi-stakeholder initiatives, have often been directed at a wide range of aspects of regulating cyberspace, many of which go beyond the issues discussed in this paper. Where the initiatives concerned have addressed the application of international law to state-sponsored cyber intrusions below the use of force, they have not yet gone into much detail as to how international law principles such as sovereignty and non-intervention apply in practice.
UN initiatives
161. In terms of rule-making, the most significant initiative to date has been the UN GGE. As noted above,266 the UN GGE of 2013 and 2015 reached some important conclusions on the law, including that international law and the principles of sovereignty and non-intervention apply to cyberspace. It also reached agreement on 11 voluntary non-binding norms on responsible state behaviour,267 confidence-building measures, and coordinated cybersecurity capacity-building, which have since been endorsed by other states and regional groupings.268 Together, these measures are often referred to as a Framework for Responsible State Behaviour in Cyberspace. But the 2016–17 UN GGE failed to agree a consensus report, amid concerns by some states about the militarization of cyberspace, in particular the application of the rules on use of force and international humanitarian law to states’ activities in cyberspace.
162. In June 2019, a new Open-Ended Working Group (OEWG) of the UN General Assembly started work, as a result of a resolution sponsored by Russia,269 and will report to the General Assembly in September 2020.270 The OEWG has been tasked with studying the existing norms contained in the previous UN GGE reports. The resolution also includes the possibility of ‘introducing changes to the rules, norms and principles of responsible behaviour of States’ agreed in the 2013 and 2015 UN GGE reports.271 It was clear from the OEWG’s first session in September 2019 that most states wish to use the existing recommendations in the 2015 UN GGE report as the starting point for the basis of discussions, but there remains a risk that certain states will push for elements of the existing agreement reached on international law to be undone.
163. The UN General Assembly also agreed to the formation of a new UN GGE, further to a resolution sponsored by the US. The new UN GGE will hold its first meeting in December 2019 and report to the General Assembly in 2021.272 This group of 25 selected UN member states has also been mandated to study how international law applies to state action in cyberspace and to identify ways to promote compliance with existing cyber norms. The results will be submitted in a report to the General Assembly in 2021; the resolution also requests ‘an annex containing national contributions of participating governmental experts on the subject of how international law applies to the use of information and communications’.273 It is hoped that the discussions in both the OEWG and UN GGE will encourage more states to indicate publicly their position on the legal principles and thresholds that they consider to apply in cyberspace. This will promote transparency and predictability, and help to further common understandings.
The new UN GGE has been mandated to study how international law applies to state action in cyberspace and to identify ways to promote compliance with existing cyber norms.
164. The twin-track approach in the UN offers an opportunity for further dialogue among states on these issues. The OEWG, open to all interested UN member states, enables a larger and more diverse number of states to participate. But the overlapping mandates of the two groups reflect the fact that cyber norm-making and enforcement have become a site of geopolitical rivalry, with the risk that the parallel processes will operate in competition or contradiction with one another rather than constructively. There is also a risk that the process and institutionalization of dialogue over ‘norms’ in the cybersecurity area trumps the difficult discussion of how existing international law applies. Given the differences between states in their approaches to how sovereignty applies in cyberspace, including whether it applies as a principle or a legally consequential rule in this area, statements issued by the OEWG and UN GGE with reference to principles will need to be studied carefully. They may not so much clarify the law as paper over important legal differences, each side agreeing with the language but understanding that language to mean something fundamentally different.
Regional state-led initiatives
165. Regional and bilateral initiatives may offer a helpful means of identifying common areas of agreement, as a supplement or complement to the UN processes. During 2019, the UN GGE held consultations with regional groups (the African Union, EU, Organization of American States, OSCE and ASEAN Regional Forum) in advance of the GGE’s first meeting. States have been discussing the application of international law to cyber in a number of other regional forums, including the Shanghai Cooperation Organisation274 and Asian-African Legal Consultative Organization.275
166. Other organizations such as the G7 and G20, OSCE,276 EU,277 OAS and African Union have been debating cyber norms more broadly, including the development of confidence-building measures. Such measures focus on the exchange of information between states; greater transparency in order to deter cyber conflict and reduce the risk of escalation in the event of a cyberattack; capacity-building to strengthen cyber resilience in states; and cybersecurity.
Initiatives involving non-state actors
167. Over the last few years, there has been a proliferation of multi-stakeholder initiatives focused on furthering understanding on what rules should apply to states’ interactions in cyberspace. These initiatives, which involve a range of actors drawn from various sectors including civil society, think-tanks, the tech sector and international institutions, have sought to fill the void left by the silence or ambiguity of most states in this area. They include the work of the Global Commission on the Stability of Cyberspace, a multi-stakeholder body that has proposed principles, norms and recommendations to guide responsible behaviour by all parties in cyberspace;278 the Cybersecurity Tech Accord, which aims to promote collaboration between tech companies on stability and resilience in cyberspace;279 and Digital Peace Now, a campaign to stop cyberwarfare.280 They also include the Tallinn Manual 2.0 and the writings of a number of legal practitioners and academics in this area.
168. Some states have spearheaded multi-stakeholder initiatives, for example President Macron’s ‘Paris Call for Trust and Security in Cyberspace’, which to date has received the backing of 67 states, 139 international and civil society organizations, and 358 private-sector organizations.281 There are also opportunities for non-state actors to contribute to state-led processes, for example at the intercessional meetings of the OEWG and GGE at the UN.282
169. Initiatives by non-state actors benefit from broader understanding of the issues from a range of interested parties without the geopolitics involved in multilateral meetings.283 They also recognize the important role that the private sector can play in detecting or preventing cyber incidents, and the fact that the private sector often owns and manages the critical infrastructure that is frequently the target of state-sponsored cyber operations.
Prospects of reaching agreement in this area
170. In practice, there are a number of obstacles to states reaching agreement on how the principles of non-intervention and sovereignty apply in the cyber context. The first is geopolitics, which is likely to hamper the new OEWG and GGE processes in the UN. In light of this, there is perhaps some value in separate groups of states, academics and civil society coming together to contribute to the processes in a less politically fraught environment. But whatever the modalities of discussion, it has to be recognized that because states’ positions on sovereignty are so different, it is likely to be difficult in practice for states to reach agreement on how sovereignty applies in cyberspace. Apart from the differing position on the law, there is also a practical impediment: because cyber activity is in the toolkit of governments, they will wish to safeguard their ability to use it, rather than setting the bar for unlawful activity too low. There is perhaps likely to be more commonality between states about whether particular state behaviour constitutes an internationally wrongful act, and why, than there is about whether sovereignty is a rule or a principle, and how it relates to intervention.
171. The prospect of states reaching agreement in the form of a treaty on these issues is a long way off, despite calls from many quarters for greater legal certainty.284 Above all the process would take political will, which is currently lacking in this area. It may be easier to reach agreement on specific applications of the law than on abstract principles.285 In the cyber context, the agreements between certain states not to conduct commercial cyber espionage against each other suggest that where there are pressing issues of mutual concern, there may be scope for states to reach agreements on specific issues. In due course, such agreements could potentially pave the way for the development of specific agreements, for example a prohibition on attacking another state’s critical infrastructure.
265 The Carnegie Endowment’s Cyber Norms Index provides a useful overview of multilateral dialogue and initiative on cyber norms, Carnegie Endowment for International Peace (n.d.), ‘Cyber Norms Index’, https://carnegieendowment.org/publications/interactive/cybernorms (accessed 7 Oct. 2019).
266 Paras 15; 18–19.
267 For a commentary on the voluntary, non-binding norms of responsible state behaviour from the 2015 report of the UN GGE on Developments in the Field of Information and Telecommunications in the Context of International Security, see United Nations Office for Disarmament Affairs (2017), Voluntary Non-binding Norms for Responsible State Behaviour in the Use of Information and Communications Technology: A Commentary, https://www.un.org/disarmament/wp-content/uploads/2018/04/Civil-Society-2017.pdf (accessed 7 Oct. 2019).
268 See, for example, Noor, E. (2018), ‘ASEAN Takes a Bold Cybersecurity Step’, The Diplomat, 4 October 2018, https://thediplomat.com/2018/10/asean-takes-a-bold-cybersecurity-step/ (accessed 28 Oct. 2019), which notes that at its third Ministerial Conference on Cybersecurity, the ASEAN conference endorsed in principle the 11 voluntary, non-binding norms recommended by the 2015 UN GGE.
269 UN General Assembly (2018), ‘Developments in the Field of Information and Telecommunications in the context of International Security’, UN Doc A/C.1/73/L.27/rev.1, https://undocs.org/A/C.1/73/L.27/Rev.1 (accessed 28 Oct. 2019).
270 For details of the work and timetable for both UN groups, see Geneva Internet Platform (n.d.), ‘UN GGE and OEWG’, Digital Watch Observatory for Internet Governance and Digital Policy, https://dig.watch/processes/un-gge (accessed 28 Oct. 2019).
271 Ibid., operative para 5.
272 UN General Assembly (2018), ‘Resolution adopted by the UN General Assembly on 22 December 2018 on “Advancing responsible State behaviour in the context of international security”’, UN Doc A/Res/73/266, https://www.un.org/en/ga/search/view_doc.asp?symbol=A/RES/73/266.
273 Ibid., operative para 3.
274 In January 2015, the member states of the Shanghai Cooperation Organisation submitted to the UN General Assembly a revised version of the International Code of Conduct for Information Security, which it had originally submitted to the UN General Assembly in 2011: Letter dated 9 January 2015 from the permanent representatives of China, Kazakhstan, Kyrgyzstan, the Russian Federation, Tajikistan and Uzbekistan to the United Nations addressed to the secretary-general, UNGA A/69/723. The original version was the first international paper dedicated to norms of behaviour in cyberspace, but has not enjoyed support from Western states due to concerns about the lack of reference to international human rights law, in particular in the context of the ‘duty to cooperate in combating terrorism, separatism and extremism’.
275 The Asian-African Legal Consultative Organization, the only inter-governmental international organization of Asia and Africa in the field of international law, currently has a work stream on international law in cyberspace.
276 The OSCE has launched 16 voluntary confidence-building measures, which would allow states to ‘read’ another state’s posturing in cyberspace, with the aim of making cyberspace more predictable; provide opportunities for timely communication and cooperation between states, including to defuse potential tensions; and promote due diligence to address cyber challenges.
277 In June 2017, the EU Council adopted conclusions on a framework for a joint diplomatic response to malicious cyber activities, known as ‘The Cyber Diplomacy Toolbox’.
278 Global Commission on the Stability of Cyberspace (2019), Advancing Cyberstability, Final Report, November 2019, https://cyberstability.org/wp-content/uploads/2019/11/GCSC-Final-Report-November-2019.pdf (accessed 13 Nov. 2019).
279 Cybersecurity Tech Accord (2018), ‘About the Cybersecurity Tech Accord’, https://cybertechaccord.org/about/ (accessed 7 Oct. 2019).
280 Microsoft (2018), ‘Digital Peace Now’, https://digitalpeace.microsoft.com (accessed 16 Oct. 2019).
281 The Ministry for Europe and Foreign Affairs (2018), ‘Paris Call for Trust and Security in Cyberspace’, https://www.diplomatie.gouv.fr/IMG/pdf/paris_call_cyber_cle443433-1.pdf (accessed 7 Oct. 2019).
282 In practice, access for non-state actors may be difficult as some states favour a multilateral as opposed to multi-stakeholder approach. At the OEWG meeting in September 2019, non-governmental organizations without UN Economic and Social Council (ECOSOC) status were unable to obtain accreditation to participate in the meeting.
283 For discussion of the role of non-state actors in the debate on cyber norms see Mačák, K. (2019), ‘On the Shelf, But Close at Hand: The Contribution of Non-State Initiatives to International Cyber Law’, AJIL Unbound, 113: pp. 81–86.
284 See, for example, Robert Hannigan, ex Director of GCHQ, in an interview with Wired, February 2018, Burgess, M. (2018), ‘We need a global cyberwar treaty, says the former head of GCHQ’, Wired UK, https://www.wired.co.uk/article/gchq-uk-robert-hannigan-cyberwar-definition (accessed 7 Oct. 2019); Microsoft has called for a ‘Digital Geneva Convention’, Smith, B. (2017), ‘The Need for a Digital Geneva Convention’, keynote speech, https://1gew6o3qn6vx9kp3s42ge0y1-wpengine.netdna-ssl.com/wp-content/uploads/2017/03/Transcript-of-Brad-Smiths-
Keynote-Address-at-the-RSA-Conference-2017.pdf (accessed 3 Feb. 2019).
285 Just as it was possible for states to reach agreement in 1868 on the St Petersburg Declaration on ‘dum dum’ bullets, long before agreement on general principles of international humanitarian law was possible.