State-sponsored cyber operations and international law

Abstract

This doctoral dissertation investigates the wide range of conceptualizations and categorizations that are applicable to state-sponsored cyber operations. State-sponsored cyber operations, namely recourse to cyber means by one State against another, are generally labelled 'cyber warfare'. This is neither a legal nor a prescriptive term; it reflects, however, a disproportionate focus on the realm of warfare. Avoiding hasty or overly simplistic characterizations of situations as cyber warfare is important to avoid further deterioration of their relations leading potentially to military escalation. This dissertation defines state-sponsored cyber operations according to international law and demonstrates that the majority of these incidents fall outside of the realm of (cyber) warfare and, therefore, need to be addressed separately and approached differently. Most state-sponsored cyber operations do not actually violate the prohibition of the use of force or the law of armed conflict, but rather they impinge the territorial sovereignty of the targeted States, the principle of nonintervention, or human rights. Cyber warfare is only the tip of the iceberg. An entire world lies submerged: cyber operations below the threshold of cyber warfare. While the emerged part concerning cyber warfare is well-studied and widely known, this thesis endeavours to shed light on the submerged, and arguably bigger, part that has been understudied and is less known. Parts I and II map the circumstances in which state-sponsored cyber operations violate international law. They demonstrate inter alia that most cyber operations remain under the threshold of cyber warfare, while they may constitute a breach of territorial sovereignty, the principle of non-intervention or even human rights law in most cases. Part I also analyzes the duty of diligence of third States. Part III deals with the attribution of cyber operations, analysing the attribution to the machine, to the human perpetrator, and focusing more specifically on the attribution to the sponsoring State. Part IV focuses on the consequences of an internationally wrongful cyber operation, mainly the obligations deriving from the law of State responsibility, and the remedies to address it, notably the recourse to self-defence, retorsion and countermeasures.