Cyber operations have certain marked features and raise prominent challenges. These have prompted calls for a more flexible interpretation of the conditions for taking countermeasures under customary international law. Nevertheless, existing customary international law rules on the matter continue to apply in cyberspace as they do in other contexts.
States have the right under customary international law to take non-forcible countermeasures when they have been injured by a prior breach of international law committed by another state. This right is subject to a number of substantive and procedural conditions to ensure that countermeasures, though coercive in nature, do not escalate the dispute or jeopardize international peace and security.
The right to take countermeasures also applies in cyberspace. But given certain marked features of cyber operations – including their covertness, high speed and large scale – questions remain about how to apply the conditions for taking countermeasures in the cyber context. Different states and scholars have argued that prominent challenges arising in cyberspace justify a more flexible approach to the interpretation or implementation of certain conditions, such as prior demand and a prior offer to negotiate. There is a clear tension between the need to limit recourse to countermeasures by strict observance of those conditions and certain operational needs and concerns that might arise in cyberspace. In particular, unlawful cyber operations often demand direct, prompt and covert reaction. This does not sit easily with the traditional understanding of countermeasures as formal, public-facing measures, such as breaches of trade obligations.
However, the state practice and opinio juris along with other relevant materials surveyed in this paper suggest that the same conditions applying generally to countermeasures under customary international law must be observed in the cyber context. There is no evidence of cyber-specific state practice and opinio juris that supports changes in the law of countermeasures for cyberspace. Moreover, the general conditions already afford states the necessary flexibility that they need to act in the cyber context. The question is one of applying old law to a new phenomenon.
As Chapter 2 has shown, under customary international law, countermeasures – in cyberspace and beyond – may only be taken in response to a prior internationally wrongful act attributable to a state in order to induce the responsible state to stop and/or repair the wrong. They must be targeted at the responsible state, proportionate to the prior wrong, temporary and reversible as far as possible in their effects. Countermeasures must not refer to or affect certain obligations under international law, such as the prohibition on the use of force and fundamental human rights. They must always be preceded by a prior demand, but this demand need not be formal, and action can follow immediately. Injured states must usually notify the responsible state and offer to negotiate with the latter before taking countermeasures, except in urgent situations or when necessary to preserve their rights and in a way that is not detrimental to international peace and security. Countermeasures may be taken when negotiations are ongoing, or disputes are pending before third-party dispute settlement mechanisms. But they must be suspended if the dispute settlement body has the power to issue binding decisions ordering equivalent measures, and the prior breach has ceased. As soon as the violation has stopped, reparation is made, and/or assurances and guarantees of non-repetition are given, countermeasures must be terminated. States must comply with all those conditions when taking countermeasures of a cyber or non-cyber nature.
Questions about whether indirectly injured states are permitted to take countermeasures in the general interest and whether third states are permitted to take countermeasures or measures of assistance in support of the injured state have also gained particular traction in the cyber context. The legal and policy implications of allowing those various measures are significant and go well beyond cyberspace.
For injured states, especially those that lack cyber or economic capabilities that can be used as leverage against more powerful states, support from third states in the form of countermeasures or measures of aid or assistance could be an effective way to stop unlawful acts – online or offline. Where individuals and other non-state entities are injured by internationally wrongful acts, such as human rights or humanitarian law violations, general interest countermeasures may be one of the few avenues to safeguard the rights at stake. On the flip side, allowing indirectly injured states or third states to take countermeasures in support of the injured state may increase the risk of disproportionate responses to wrongful acts, with potentially destabilizing consequences for international peace and security. Like many areas of state activity, cyberspace is also vulnerable to those threats, given the significant risk of misattribution of conduct and spillover effects on innocent actors.
While these are important policy considerations, existing international law must be the starting point when approaching these difficult questions. As discussed in Chapter 3, there still seems to be insufficient state practice and opinio juris in support of a right of indirectly injured states to take general interest countermeasures under customary international law. But the law is developing rapidly on this matter, as a growing number of states have adopted and expressed support for such measures.
Beyond general interest countermeasures, there is no evidence to support a separate legal entitlement under customary international law for third states to take countermeasures in support of the injured state. The same conclusion applies in cyberspace in the absence of sufficient cyber-specific state practice or opinio juris in support of these types of countermeasures in that context.
At the same time, the existing customary international law rules of state responsibility allow third states to provide aid or assistance to the injured state’s countermeasures under certain conditions. First, the assistance must not itself breach an obligation owed by the third state to the responsible state. Second, if the assistance is significant and the countermeasures involve obligations owed by both the injured and the third state to the responsible state, the third state may provide assistance to an injured state so long as the countermeasures comply with all the substantive and procedural conditions applicable under customary international law. Under these conditions, the provision of cyber or non-cyber aid can still help injured states respond effectively and proportionately to potentially destabilizing acts in cyberspace and beyond.
International law can develop, whether by the adoption of new treaties or the evolution of customary international law. However, states should carefully consider the legal and policy implications of developing the law on this subject, in cyberspace and beyond.
It is true that cyber operations and countermeasures in particular may raise politically sensitive questions that can dissuade states from discussing them openly. Nevertheless, to ensure that their practices and views are properly taken into account in current legal developments and to avoid misunderstandings, states should try to be clearer and more transparent about their stance on countermeasures, including in cyberspace. States that have remained silent on this matter should also consider making their views public, since silence can amount to acquiescence in some circumstances.
One way through which states can share their practices and views on countermeasures and other relevant issues in the cyber context is by addressing the topic in national or common positions on international law in cyberspace. Over 30 states and a regional organization (the African Union) have published such positions so far. Importantly, states should consider anchoring those positions in existing international law. In the case of countermeasures, existing rules are the result of decades of difficult negotiations and compromises. They strike a delicate balance between the rights of the injured state, the responsible state and the international community as a whole. States should also bear in mind that the impact of those positions can go well beyond cyberspace to influence the development of international law more generally. Though cyberspace is generally subject to existing international law, it has become an important testing ground for how fundamental rules, principles and concepts continue to apply to new societal challenges.
At the same time, many states, especially those in the Global South, still lack the necessary knowledge of how countermeasures apply in cyberspace as well as the technical capacity to actually deploy those measures. Without the necessary knowledge and capacity, these states cannot meaningfully contribute to ongoing debates and legal developments on countermeasures and other issues relevant to the application of international law in cyberspace. Moreover, even when states do have the necessary knowledge and capacity, political divisions have hindered constructive dialogue and debate on the topic. Therefore, the international community should think creatively about ways to develop the technical and legal capacity of states most in need and to foster dialogues at the national, regional and multilateral levels.
States can also address the law of countermeasures in discussions currently taking place at the UN ‘Open-Ended Working Group on security of and in the use of information and communications technologies’, particularly in sessions dedicated to issues of international law in cyberspace.
Lastly, future studies on countermeasures generally and in cyberspace should carefully consider the available evidence of state practice and opinio juris, including of developing countries, giving them proper weight. After all, international law is still made by states – in cyberspace and beyond.
