There's Cyberwar and Then There's the Big Legal Gray Area

The Russian government-backed hacks of Democratic political organizations that upended the 2016 presidential contest represent the sort of legal gray area U.S. adversaries will continue to exploit if nations don’t create rules of the road in cyberspace, the director of an updated manual on international cyber law said Wednesday.

The breaches at the Democratic National Committee and Hillary Clinton’s campaign might have violated international law by interfering in a coercive manner in the United States’ internal affairs, said Michael Schmitt, director of the 2.0 version of the Tallinn Manual, a guidebook on how international law applies in cyberspace released Wednesday.

Or they might not. It all depends on how you look at it, said Schmitt, an international law scholar and professor at the Naval War College.

“The Russians have selected an area of law … in which it will be hard for states to come to a consensus that they have violated international law,” Schmit said. “We will be squabbling among each other in the interagency process and the international process.”

And that lack of clarity is an invitation for Russia and other aggressors to launch similar operations, Schmitt said.

“If states don’t, frankly, move forward with a little more dispatch and a little more focus, our opponents are going to play in this gray area,” he said. “Frankly, it’s our hope that the [Tallinn] Manual helps states identify those gray areas so they know where to focus their effort.”

Efforts to clarify those gray areas are ongoing, both inside national governments and in international bodies such as the G20 and the United Nations-sponsored Group of Governmental Experts.

Technology and the pace of cyber assaults, however, seems to be outpacing the legal and policy process.

The first version of the Tallinn Manual, released in 2013, dealt with how international law applies to cyberattacks during wartime or attacks that cross a legal threshold to being, effectively, acts of war themselves such as cyberattacks that kill citizens or damage large amounts of property.

The 2017 update deals with lower-level peacetime cyber conflicts that nevertheless might prompt a legitimate national response. The DNC breaches falls into that category, Schmitt said, as does the 2014 North Korean attack against Sony Pictures Entertainment.

The Obama administration responded to both of those attacks by imposing additional sanctions. The Obama team also expelled Russian diplomats in response to the DNC hack and may have taken other covert countermeasures.

The manual was written by 19 international law experts from a variety of nations, including the U.S., Russia and China. It carries no legal force, but is designed to aid government lawyers as they advise national leaders on how to act in cyberspace.

When it comes to the DNC breaches, and the release of stolen information via WikiLeaks and other sources, it seems quite clear Russia intervened in U.S. internal affairs, Schmitt said. The question is whether that intervention was “coercive” and so violates common understandings of international laws and norms. That’s a question scholars can and do disagree about, he said.

The manual’s managing editor, Liis Vihul, for example, believes the action was not coercive, Schmitt said.

“Are you really telling me that providing an electorate in a liberal democracy with truthful material is intervention?” he said, paraphrasing the argument. “It can’t possibly be coercive to provide people information on which they’ll make a better informed decision,” he added.

The counterargument, which Schmitt himself endorsed, is that the breach crossed a line by attempting to manipulate the U.S. political process.

“It was the manipulation of the process of us selecting a leader,” he said.

The theft itself would fall into the category of espionage typically allowed under international law, Schmitt said.