Inside Cyber Warfare - Jeffrey Carr [44]
Support from the General Principles of Law
The general principles of law common to civilized nations also support recognition of a duty to prevent cyber attacks. It is a well-established principle under the domestic laws of most states that individuals should be responsible for acts or omissions that have a causal link to harm suffered by another individual. While international law is not obligated to follow the domestic laws of states, international law may be derived from the general principles common to the major legal systems of the world. Most states use causation as a principle for establishing individual responsibility, lending credence to the idea that a state’s responsibility also should also be based on causation.
Thus, if a state failed to pass stringent criminal laws, did not investigate international cyber attacks, or did not prosecute attackers, it should be held responsible for international cyber attacks against another state because its omission helped create a safe haven for attackers to attack other states. Furthermore, as evidenced in the Corfu Channel case, the general duty to prevent attacks already allows states to be held accountable for causation to some degree, which supports using causation analogies from domestic laws when interpreting the customary duty to prevent cyber attacks.
Support from Judicial Opinions
Finally, judicial opinions further support recognition of a state’s affirmative duty to prevent cyber attacks from its territory against other states. In Tellini, a special committee of jurists held that a state may be held responsible for the criminal acts of nonstate actors when it “neglect[s] to take all reasonable measures for the prevention of the crime and pursuit, arrest and bringing to justice of the criminal.”[31] In S.S. Lotus, the Permanent Court of International Justice held that “a state is bound to use due diligence to prevent the commission within its dominions of criminal acts against another nation or its people.”[32]
In Corfu Channel, the International Court of Justice held that states have a duty “not to allow knowingly its territory to be used for acts contrary to the rights of other states.”[33] Although these are older cases, their principles still stand for and support the notion that states have a duty to prevent their territory from being used to commit criminal acts against another state, as well as a duty to pursue, arrest, and bring to justice criminals who have conducted cross-border attacks on other states.
Fully Defining a State’s Duty to Prevent Cyber Attacks
A state’s duty to prevent cyber attacks should not be based on a state’s knowledge of a particular cyber attack before it occurs, but rather on its actions to prevent cyber attacks in general. Cyber attacks are extremely difficult for states to detect prior to the commission of a specific attack, and are often committed by individuals or groups who are not even on a state’s radar. However, just because cyber attacks are difficult to prevent does not mean that states can breach their duty to prevent them. Stringent criminal laws and vigorous law enforcement will deter cyber attacks. States that do not enact such laws fail to live up to their duty to prevent cyber attacks.
Likewise, even when a state has stringent criminal laws, if it looks the other way when cyber attacks are conducted against rival states, it effectively breaches its duty to prevent them through its unwillingness to do anything to stop them, just as if it had approved the attacks. In other words, a state’s passiveness and indifference toward cyber attacks make it a sanctuary state, from where attackers can safely operate. When viewed in this light, it becomes apparent that a state can be