Inside Cyber Warfare - Jeffrey Carr [38]
The right of territorial integrity generally gives way to the right of self-defense. The principle underlying this balancing act is that when one state violates another state’s territorial integrity, it forfeits its own right to territorial integrity. This principle evolved out of state-on-state attacks, but it also may be applied in a similar manner when states are indirectly responsible for the violations of another state’s territorial integrity by nonstate actors. The key is whether the host-state tried to prevent its territory from being used to commit criminal acts against the victim-state.
As always, before a state resorts to self-defense, it must ensure that it meets the criteria of necessity, proportionality, and, if using the subset of anticipatory self-defense, imminency. Effectively, a state must have no viable alternatives to the use of force, and it must limit its use of force to securing its defensive objectives.
The application of these requirements may vary depending on whether the acts of the nonstate actors were imputed based on direct control or indirect attribution. In cases of direct control, the victim-state may immediately impute responsibility to the host-state and act in self-defense against it and the nonstate actors inside it. In cases of indirect attribution, a victim-state must overcome another hurdle before conducting cross-border operations, and ensure that it has properly linked the actions of the nonstate actors to the host-state. This may be done by issuing an ultimatum to the sanctuary state to comply with its international obligations or else.
The sanctuary state must then either act against the nonstate actors, or willingly allow the victim-state to enter its territory and mount operations against the nonstate actors. Otherwise the victim-state can impute responsibility and conduct its cross-border operations into the host-state. However, in doing so, the victim-state must limit its targets to the nonstate actors, unless the host-state uses force to oppose the lawful cross-border operations.
Based on the foregoing analysis, it is evident that victim-states may forcibly respond to armed attacks by nonstate actors located in another state when host-states violate their duty to prevent those attacks. With cyber attacks, imputing state responsibility in this manner provides states a legal path to utilize active defenses without having to conclusively attribute an attack to a state or its agents. In effect, imputing responsibility is the equivalent of attributing the attack to the state or its agents. Thus, imputing responsibility provides states a way around the attribution problem and response crisis. However, just because there is a legal pathway to get around the requirement that armed attacks be attributable to a state or its agents does not mean that cyber attacks by nonstate actors lend themselves to this framework. As a result, it is imperative to explain why cyber attacks constitute armed attacks, what a state’s duty to prevent cyber attacks means, and the factual circumstances that would allow a victim-state to forcibly respond to a cyber attack.
* * *
[7] Schmitt, supra note 2, at 540–41 (quoting John Basset Moore in S.S. Lotus [Fr. v. Turk.] 1927 P.C.I.J. [ser. A] No. 10, at 4, 88 [Moore, J., dissenting]).
[8] Corfu Channel case (Merits), 1949 I.C.J. Rep. 4, 22 (Apr. 9).
[9] Case Concerning United States Diplomatic and Consular Staff in Tehran, 1980 I.C.J. Rep. 3, 32–33, 44 (May 24).
[10] Prosecutor v. Tadic, Case No. IT-94-1-A, I.C.T.Y. App. Ch., at 49 (July 15, 1999).
[11] See 2001 Draft Articles on the Responsibility of States for Internationally Wrongful Acts, UN Doc. A/CN.4/L.602/Rev. 1 (2001). The draft articles were later commended to state governments in 2001 and 2004. See G.A. Res. 56/83, UN Doc. A/RES/56/83 (Jan. 28, 2002); G.A. Res. 59/35, UN Doc. A/RES/59/35 (Dec. 16, 2004).
[12] Proulx, Vincent-Joel. 2005. “Babysitting Terrorists: Should States Be Strictly