DOUGLAS C. LOVELACE, JR.
Director
Strategic Studies Institute and U.S. Army War College Press
While conflict in cyberspace is not a new phenomenon, the legality of hostile cyber activity at a state level remains imperfectly defined. While there is broad agreement among the United States and its allies that cyber warfare would be governed by existing law of armed conflict, with no need for additional treaties or conventions to regulate hostilities online, this view is not shared by many nations that the United States could potentially face as adversaries.
A range of foreign states use definitions for cyber conflict that are entirely different from our own, ex- tending to different concepts of what constitutes online hostilities and even a state of war. This leads to a potentially dangerous situation where an adversary could be operating according to an entirely different understanding of international law to that followed by the United States.
In this Letort Paper, Mr. Keir Giles uses Russian-language sources and interviews to illustrate the very distinct set of views on the nature of conflict in cyberspace that pertains to Russia. He provides an important window into Russian thinking and explains how fundamental Russian assumptions on the nature of cyber activity need to be considered when countering, or engaging with, Russian cyber initiatives.
The Strategic Studies Institute is pleased to offer this detailed analysis as an essential guide to the mindset of an important cyber actor, and one which it is essential for the United States to understand.
DOUGLAS C. LOVELACE, JR.
Director
Strategic Studies Institute and U.S. Army War College Press
KEIR GILES is the director of the Conflict Studies Re - search Centre (CSRC), a group of deep subject matter experts on Eurasian security formerly attached to the United Kingdom (UK) Ministry of Defence. Now operating in the private sector, CSRC provides in-depth analysis on security issues affecting Russia and its relations with overseas partners. After beginning his career working with paramilitary aviation in the former Soviet Union and Ukraine immediately following the fall of the Soviet Union, Mr. Giles joined the BBC Monitoring Service (BBCM) to report on political and military affairs in the former Soviet space. While attached from BBCM to CSRC at the UK Defence Academy, he wrote and briefed for UK and North Atlantic Treaty Organization (NATO) government agencies on Russian defense and security issues. Uniquely, he is a double Associate Fellow of the Royal Institute of International Affairs (Chatham House) in London, UK, as well as a regular contributor to research projects on Russian security issues in both the UK and Europe. Mr. Giles’s work has appeared in academic and military publications across Europe and in the United States.
ANDREW MONAGHAN is a Research Fellow in the Russia and Eurasia Programme at Chatham House and Academic Visitor at St Antony’s College, Oxford, UK. Additionally, he is the Founder and Director of the Russia Research Network, an independent organization for the generation of information and expertise on Russian politics, security, and economic issues based in London. In this capacity, he has served as an expert witness to the House of Commons Foreign Affairs Select Committee. Until late 2012, Dr. Monaghan directed Russia related research in the Research Division of the NATO Defense College in Rome. In this role, he was also the senior researcher on energy security matters. Prior to that, he held positions as a Senior Research Associate at the Advanced Research and Assessment Group, part of the Defence Academy of the UK, and a Visiting Lecturer in the Defence Studies Department of King’s College, London, the civilian academic arm of the Joint Services Command and Staff College at the Defence Academy. Dr. Monaghan holds an M.A. in war studies and a Ph.D. in Russian foreign policy (Russian perspectives of Russia-European Union security relations) from the Department of War Studies, King’s College.
The United States and its allies are in general agreement on the legal status of conflict in cyberspace. Although key principles remain unresolved, such as what precisely constitutes an armed attack or use of force in cyberspace, overall there is a broad legal consensus among Euro-Atlantic nations that existing international law and international commitments are sufficient to regulate cyber conflict.
This principle is described in multiple authoritative legal commentaries. But these can imply misleadingly that this consensus is global and unchallenged. In fact, China, Russia, and a number of like-minded nations have an entirely different concept of the applicability of international law to cyberspace as a whole, including to the nature of conflict within it. These nations could therefore potentially operate in cyberspace according to entirely different understandings of what is permissible under international humanitarian law, the law of armed conflict, and other legal baskets governing conduct during hostilities.
U.S. policymakers cannot afford to underestimate the extent to which Russian concepts and approaches differ from what they may take for granted. This includes the specific question of when, or whether, hos- tile action in cyberspace constitutes an act or state of war. Recent Russian academic and military commentary stresses the blurring of the distinction between war and peace, and asks to what extent this distinction still exists. This suggestion of a shifting boundary between war and peace is directly relevant to consideration of at what point Russia considers itself to be at war and therefore subject to specific legal constraints on actions in cyberspace.
Conversely, actions that are considered innocent and friendly by the United States and European nations are parsed as hostile actions by Russia, leading to Russian attempts to outlaw “interference in another state’s information space.” The Russian notion of what constitutes a cyber weapon — or in Russian terminology, an information weapon — is radically different from our assumptions.
Initiatives put forward by Russia for international cooperation on legal initiatives governing cyber activity have received a mixed response from other states. But they need to be taken into account because of the alternative consensus on cyber security opposing the views of the United States and its close allies, which is growing as a result of an effective Russian program of ticking up support for Moscow’s proposals from other countries around the world.
This Letort Paper explores the Russian approach to legal constraints governing actions in cyberspace within the broader framework of the Russian understanding of the nature of international law and commitments, with the aim of informing U.S. military and civilian policymakers of views held by a potential adversary in cyberspace. Using a Russian perspective to examine the legal status of various activities in cyberspace, including what constitutes hostile activity, demonstrates that assumptions commonly held in the United States may need to be adjusted to counter effectively — or engage with — Russian cyber initiatives.
The United States and its allies devote considerable time and expense to considering the legal dimensions of cyber conflict. Although key definitions for establishing legality remain unresolved, such as what precisely constitutes an armed attack or use of force in cyberspace, the legal debates within and between Euro-Atlantic militaries are generally in harmony and derive from a broader legal consensus in these nations. This consensus holds that existing international law and international commitments are sufficient to regulate cyber conflict, and furthermore that certain individual rights in using cyberspace are inalienable.
Authoritative legal commentaries, such as the Tallinn Manual on the International Law Applicable to Cyber Warfare, released in early 2013,1 reflect this Western consensus. But they can misleadingly imply that this consensus is global and unchallenged. Significantly, the Manual does not include among its contributors any legal experts from nations considered potential adversaries in cyberspace, notably China and Russia.
In fact, China, Russia, and a number of like-minded nations have an entirely different concept of the applicability of international law to cyberspace as a whole, including to the nature of conflict within it. These nations could therefore potentially operate in cyberspace according to entirely different understandings of what is permissible under international humanitarian law, the law of armed conflict, and other legal baskets governing conduct during hostilities.
This Letort Paper will explore the Russian approach to legal constraints governing actions in cyberspace, within the broader framework of the Russian understanding of the nature of international law and commitments, to inform U.S. military and civilian policymakers of views held by a potential adversary in cyberspace. It will examine the legal status of activities in cyberspace, including what constitutes hostile activity from a Russian perspective, to demonstrate that assumptions commonly held in the United States may need to be adjusted effectively to counter — or engage with — Russian cyber initiatives.
In conventional conflict, the legal constraints on combatants are clearly understood and well defined. Precisely when and how a state of war arises (jus ad bellum) and how parties must conduct themselves during conflict (jus in bello) have been established through customary law and international legal commitments over the course of centuries. Generally accepted among developed nations, these principles give a degree of stability and predictability to the extent of armed conflict, particularly in terms of legal constraints on col- lateral damage, proportionality, initiation of conflict, self-defense, and humanitarian impact.
In cyberspace, no such consensus exists. This is because the view of legality held by the United States and its allies is not a global one, and other key actors in cyberspace have an entirely different approach. It is therefore important for U.S. planners to understand that potential adversaries may be operating according to an entirely different set of assumptions regarding what is permissible behavior in cyberspace in terms of international law.
Descriptions of the state of regulation of activity in cyberspace as a whole are replete with metaphor. Establishing commonly agreed norms and rules of behavior for this new domain has been compared to the early days of nuclear weapons with no mutual understanding on the rules of deterrence, to the motor car with no rules of the road, to the long development of international maritime law, and much else besides. A common perception is that online activity, and in particular hostile online activity, is so new a phenomenon that there should be little surprise that a commonly agreed regulatory framework is still a distant prospect.
The Italian Job“”