Articles Hacking Elections: An Act of War? June 5, 2017 On March 20, the House Intelligence Committee commenced with hearings on Russia's potential interference in the 2016 U.S. presidential elections. On the first day of the hearings, former FBI Director James Comey and NSA Director Admiral Michael Rogers were called to testify. In the wake of these hearings, many prominent members of both political parties have alleged that Russia's actions amount to an Act of War. Rep. Bonnie Watson Coleman (D-N.J.) claimed, in a House Homeland Security Committee meeting, that Russia's actions constituted "a form of war on our fundamental democratic principles."1 Some took it even further: Sen. Ben Cardin (D-Md.) claimed that Russia's actions were akin to a "political Pearl Harbor."2 Former Vice President Dick Cheney has also argued that "in some quarters, [Russia's actions] would be considered an act of war."3 Senator John McCain (D-Ariz.), one of the original proponents of this viewpoint, was also one its most vocal advocates.4 Unfortunately, the term Act of War has a particular meaning under international law and is not appropriate as a metaphorical, rhetorical tool. A bit of background on Russia's alleged actions is important to properly contextualize and conceptualize these actions in the broader spectrum of the law of cyber warfare. There are two key allegations against Russia: (1) That Russian actors gained unauthorized access to Democratic National Committee (and related individuals') email accounts, which allowed them to leak countless confidential and private emails, and (2) That Russian actors sponsored a misinformation campaign spreading "fake news" through social media and other sources.5 Allegations Fall Short Even assuming that the underlying allegations, in their broadest and most expansive form, are correct, Russia's actions unambiguously fall substantially short of an Act of War under the international law of cyber warfare. Whether an action amounts to an Act of War is a complex, intricate, legal question with serious political and military implications. It is not a vague, abstruse general term that can be filled with any meaning that might be politically expedient. The fact that Russia's actions do not constitute an Act of War does not exculpate them from liability for their actions, if true. International law has developed to recognize many other forms of nation-state interference, and Russia's actions, if true, very likely amount to a violation of the international law prohibition on the interference of one nation-state on the internal affairs of another. While this might be a far less juicy headline, it is a far more legally and politically sound one. This difference is not merely aesthetic or intellectual. To understand why Russia's alleged actions fall into this latter category, we must first understand what an Act of War actually is and why Russia's conduct falls short of that demanding standard. An analysis of whether any action is considered an Act of War must begin with UN Charter Article 2(4), which provides that "[a]ll Members shall refrain in their international relations from the threat or use of force against the territorial integrity or political independence of any state, or in any other manner inconsistent with the Purposes of the United Nations." One key question is whether cyber-attacks are governed by Article 2(4). The Tallinn Manual on the International Law Applicable to Cyber Warfare, a military manual published by an international group of experts working with the NATO Cooperative Cyber Defense Center of Excellence, states that "a cyber operation constitutes a use of force when its scale and effects are comparable to non-cyber operations rising to the level of a use of force." Furthermore, the manual states that "cyber psychological operations intended solely to undermine confidence in a government […] does not qualify as a use of force."6 Simply put, mere political coercion, no matter how egregious or outrageous, categorically cannot rise to the level of a use of force for the purposes of triggering Article 2(4). Categorization If Russia's actions are not an Act of War, how should their conduct be categorized? The Tallinn Manual, in its newest edition, presciently offers valuable insight on this topic. Rule 66–Intervention by States, holds: "A State may not intervene, including by cyber means, in the internal or external affairs of another State."7 In order for a state to have been found to interfere in the affairs of another state, a two-prong test must be satisfied: (1) the act must involve the affairs of the state, and (2) the act must be coercive in nature.8 To the first prong, elections are the paradigmatic example of a state's internal affairs. They are a categorical example of a state function that is purely domestic and internal. The second prong poses a more complicated question. International law differentiates between persuasive acts and coercive acts. Only the latter reaches the level of a breach of the prohibition on intervention, while the former is not deemed to be violative of international legal norms. While both forms of conduct have the potential to meaningfully influence the affairs of another state, the key difference between the two is whether the act in question has the potential to compel a state to follow a certain course of action.9 In the case of the allegations against Russia, it quite clear that there was a targeted campaign to compel a certain outcome. Targeted hacking and misinformation campaigns very likely constitute coercion. As such while Russia's actions do not amount to an Act of War, it is very likely that they do constitute a violation of the prohibition of intervention in the affairs of another state. Implications What does this mean on a practical level? As the world's attention tilts towards cyber warfare, and the rules governing it continue to grow, we will be faced with many difficult choices. The 2016 election represents one of these choices. There was certainly reprehensible conduct that should be condemned globally, but unrestrained, hyperbolic, jingoistic rhetoric opens the doors to a Pandora's box of danger and disaster. One risk is opening the doors to inappropriate uncalled-for escalation. If we were to, hypothetically, accept that Russia's alleged conduct represented an Act of War, we would be well within our rights to respond with a proportionate countermeasure.10 Importantly, this response would, theoretically, not be limited to the cyber domain. A nation that is the victim of an Act of War has the right to respond with a commensurate Act of War in whatever domain (air, land, sea) it deems appropriate. It is not hard to imagine how this could quickly escalate into a disastrous total war. With that being said, the United States is not without recourse for a violation of the prohibition on interference with another state's affairs; in fact, the rules governing our potential response are exactly the same, namely that we may respond with a proportionate countermeasure that is implemented in order to ensure the target's compliance with international legal norms (the critical difference being that actions proportionate to a violation of the prohibition of interference with the domestic affairs of a state are generally quite different than those commensurate to an Act of War).11 Less obvious (but no less dangerous) than the possibility of inappropriate escalation in this conflict, is the question of precedent. Rhetorical excess in this context provides a double-edged sword of dangerous precedents. First is the fact that international legal norms are often defined by the practice of states. If many states come to the conclusion that a certain sort of action falls outside the realm of acceptable international practice or constitutes an Act of War, it is possible for a customary norm of international law to develop accordingly. The precise scope and contours of this process are complex and outside the scope of this article, but the conduct and consensus of nations can create new and independent international legal norms. The possible prudence of deeming Russia's alleged conduct an Act of War notwithstanding, any such attempt to develop customary international norms must be carried out with a great deal of careful and thorough consideration, not made by the junior speechwriters of individual legislators. The other edge of the sword is that, by deeming certain actions to be Acts of War and then failing to respond with adequate, commensurate action, equivalent to what might be called for should the country be attacked through kinetic means, the United States risks creating the impression that operations in the cyber realm will not be treated as seriously as those in the kinetic realm. If Canada were to shoot missiles across the border into New York, the United States would surely not merely expel a couple of diplomats. It would surely take aggressive, commensurate military action to respond to the aggressive Act of War. If instead of sending missiles, Canada were to hack into the electrical grid and cause explosions as lethal and destructive as missiles, the same degree of responsive action would be called for. By deeming the Russian actions an Act of War and then not taking meaningful, commensurate action, the United States risks creating the impression that Acts of War taken in the cyber realm will not be treated with the same seriousness as Acts of War in the kinetic realm. This sets up a dangerous system of perverse and corrupt incentives for all future conflicts. Conclusion We march towards an uncertain future. The scale, scope, and effects of cyber operations are only beginning to be appreciated. Furthermore, the law governing these operations is complex, dynamic, and constantly changing. Ensuring that conduct and reactions are in compliance with the norms of international law is a daunting task that requires careful analysis, but it can, and must be done. Without doing so, we put ourselves on an inevitable collision course with calamity. Endnotes: 1. http://thehill.com/policy/cybersecurity/ 325606-democrats-step-up-calls-that-russian-hack-was-act-of-war. 2. Id. 3. http://www.politico.com/story/2017/03/ dick-cheney-russia-2016-election-act-of-war-236556. 4. http://www.cnn.com/2016/12/30/politics/mccain-cyber-hearing/. 5. https://www.intelligence.senate.gov/sites/default/files/documents/ICA_2017_01.pdf. 6. Michael Schmitt, TALLINN MANUAL 2.0 ON THE INTERNATIONAL LAW APPLICABLE TO CYBER OPERATIONS Rule 69. 7. Id., at Rule 66. While there is a rich history that led to development of this principle, it is sufficient to understand that principle derives from a nation-state's sovereignty. It is a violation of International Law for a nation-state to coercively violate another state's sovereignty. The affairs of a state are covered by this conception of sovereignty, thus creating the prohibition on state intervention into another state's affairs. Id. 8. Id. 9. Id. 10. Id., at Rule 23 11. Id., at Rules 20, 21, & 23. Benjamin Dynkin is a law clerk at Grauman Law Group. Barry Dynkin is of counsel at the firm, where he heads the cybersecurity practice. Daniel Garrie is the editor-in-chief of the Journal of Law and Cyber Warfare and a partner at Zeichner Ellman & Krause.
Hacking Elections: An Act of War? June 5, 2017 On March 20, the House Intelligence Committee commenced with hearings on Russia's potential interference in the 2016 U.S. presidential elections. On the first day of the hearings, former FBI Director James Comey and NSA Director Admiral Michael Rogers were called to testify. In the wake of these hearings, many prominent members of both political parties have alleged that Russia's actions amount to an Act of War. Rep. Bonnie Watson Coleman (D-N.J.) claimed, in a House Homeland Security Committee meeting, that Russia's actions constituted "a form of war on our fundamental democratic principles."1 Some took it even further: Sen. Ben Cardin (D-Md.) claimed that Russia's actions were akin to a "political Pearl Harbor."2 Former Vice President Dick Cheney has also argued that "in some quarters, [Russia's actions] would be considered an act of war."3 Senator John McCain (D-Ariz.), one of the original proponents of this viewpoint, was also one its most vocal advocates.4 Unfortunately, the term Act of War has a particular meaning under international law and is not appropriate as a metaphorical, rhetorical tool. A bit of background on Russia's alleged actions is important to properly contextualize and conceptualize these actions in the broader spectrum of the law of cyber warfare. There are two key allegations against Russia: (1) That Russian actors gained unauthorized access to Democratic National Committee (and related individuals') email accounts, which allowed them to leak countless confidential and private emails, and (2) That Russian actors sponsored a misinformation campaign spreading "fake news" through social media and other sources.5 Allegations Fall Short Even assuming that the underlying allegations, in their broadest and most expansive form, are correct, Russia's actions unambiguously fall substantially short of an Act of War under the international law of cyber warfare. Whether an action amounts to an Act of War is a complex, intricate, legal question with serious political and military implications. It is not a vague, abstruse general term that can be filled with any meaning that might be politically expedient. The fact that Russia's actions do not constitute an Act of War does not exculpate them from liability for their actions, if true. International law has developed to recognize many other forms of nation-state interference, and Russia's actions, if true, very likely amount to a violation of the international law prohibition on the interference of one nation-state on the internal affairs of another. While this might be a far less juicy headline, it is a far more legally and politically sound one. This difference is not merely aesthetic or intellectual. To understand why Russia's alleged actions fall into this latter category, we must first understand what an Act of War actually is and why Russia's conduct falls short of that demanding standard. An analysis of whether any action is considered an Act of War must begin with UN Charter Article 2(4), which provides that "[a]ll Members shall refrain in their international relations from the threat or use of force against the territorial integrity or political independence of any state, or in any other manner inconsistent with the Purposes of the United Nations." One key question is whether cyber-attacks are governed by Article 2(4). The Tallinn Manual on the International Law Applicable to Cyber Warfare, a military manual published by an international group of experts working with the NATO Cooperative Cyber Defense Center of Excellence, states that "a cyber operation constitutes a use of force when its scale and effects are comparable to non-cyber operations rising to the level of a use of force." Furthermore, the manual states that "cyber psychological operations intended solely to undermine confidence in a government […] does not qualify as a use of force."6 Simply put, mere political coercion, no matter how egregious or outrageous, categorically cannot rise to the level of a use of force for the purposes of triggering Article 2(4). Categorization If Russia's actions are not an Act of War, how should their conduct be categorized? The Tallinn Manual, in its newest edition, presciently offers valuable insight on this topic. Rule 66–Intervention by States, holds: "A State may not intervene, including by cyber means, in the internal or external affairs of another State."7 In order for a state to have been found to interfere in the affairs of another state, a two-prong test must be satisfied: (1) the act must involve the affairs of the state, and (2) the act must be coercive in nature.8 To the first prong, elections are the paradigmatic example of a state's internal affairs. They are a categorical example of a state function that is purely domestic and internal. The second prong poses a more complicated question. International law differentiates between persuasive acts and coercive acts. Only the latter reaches the level of a breach of the prohibition on intervention, while the former is not deemed to be violative of international legal norms. While both forms of conduct have the potential to meaningfully influence the affairs of another state, the key difference between the two is whether the act in question has the potential to compel a state to follow a certain course of action.9 In the case of the allegations against Russia, it quite clear that there was a targeted campaign to compel a certain outcome. Targeted hacking and misinformation campaigns very likely constitute coercion. As such while Russia's actions do not amount to an Act of War, it is very likely that they do constitute a violation of the prohibition of intervention in the affairs of another state. Implications What does this mean on a practical level? As the world's attention tilts towards cyber warfare, and the rules governing it continue to grow, we will be faced with many difficult choices. The 2016 election represents one of these choices. There was certainly reprehensible conduct that should be condemned globally, but unrestrained, hyperbolic, jingoistic rhetoric opens the doors to a Pandora's box of danger and disaster. One risk is opening the doors to inappropriate uncalled-for escalation. If we were to, hypothetically, accept that Russia's alleged conduct represented an Act of War, we would be well within our rights to respond with a proportionate countermeasure.10 Importantly, this response would, theoretically, not be limited to the cyber domain. A nation that is the victim of an Act of War has the right to respond with a commensurate Act of War in whatever domain (air, land, sea) it deems appropriate. It is not hard to imagine how this could quickly escalate into a disastrous total war. With that being said, the United States is not without recourse for a violation of the prohibition on interference with another state's affairs; in fact, the rules governing our potential response are exactly the same, namely that we may respond with a proportionate countermeasure that is implemented in order to ensure the target's compliance with international legal norms (the critical difference being that actions proportionate to a violation of the prohibition of interference with the domestic affairs of a state are generally quite different than those commensurate to an Act of War).11 Less obvious (but no less dangerous) than the possibility of inappropriate escalation in this conflict, is the question of precedent. Rhetorical excess in this context provides a double-edged sword of dangerous precedents. First is the fact that international legal norms are often defined by the practice of states. If many states come to the conclusion that a certain sort of action falls outside the realm of acceptable international practice or constitutes an Act of War, it is possible for a customary norm of international law to develop accordingly. The precise scope and contours of this process are complex and outside the scope of this article, but the conduct and consensus of nations can create new and independent international legal norms. The possible prudence of deeming Russia's alleged conduct an Act of War notwithstanding, any such attempt to develop customary international norms must be carried out with a great deal of careful and thorough consideration, not made by the junior speechwriters of individual legislators. The other edge of the sword is that, by deeming certain actions to be Acts of War and then failing to respond with adequate, commensurate action, equivalent to what might be called for should the country be attacked through kinetic means, the United States risks creating the impression that operations in the cyber realm will not be treated as seriously as those in the kinetic realm. If Canada were to shoot missiles across the border into New York, the United States would surely not merely expel a couple of diplomats. It would surely take aggressive, commensurate military action to respond to the aggressive Act of War. If instead of sending missiles, Canada were to hack into the electrical grid and cause explosions as lethal and destructive as missiles, the same degree of responsive action would be called for. By deeming the Russian actions an Act of War and then not taking meaningful, commensurate action, the United States risks creating the impression that Acts of War taken in the cyber realm will not be treated with the same seriousness as Acts of War in the kinetic realm. This sets up a dangerous system of perverse and corrupt incentives for all future conflicts. Conclusion We march towards an uncertain future. The scale, scope, and effects of cyber operations are only beginning to be appreciated. Furthermore, the law governing these operations is complex, dynamic, and constantly changing. Ensuring that conduct and reactions are in compliance with the norms of international law is a daunting task that requires careful analysis, but it can, and must be done. Without doing so, we put ourselves on an inevitable collision course with calamity. Endnotes: 1. http://thehill.com/policy/cybersecurity/ 325606-democrats-step-up-calls-that-russian-hack-was-act-of-war. 2. Id. 3. http://www.politico.com/story/2017/03/ dick-cheney-russia-2016-election-act-of-war-236556. 4. http://www.cnn.com/2016/12/30/politics/mccain-cyber-hearing/. 5. https://www.intelligence.senate.gov/sites/default/files/documents/ICA_2017_01.pdf. 6. Michael Schmitt, TALLINN MANUAL 2.0 ON THE INTERNATIONAL LAW APPLICABLE TO CYBER OPERATIONS Rule 69. 7. Id., at Rule 66. While there is a rich history that led to development of this principle, it is sufficient to understand that principle derives from a nation-state's sovereignty. It is a violation of International Law for a nation-state to coercively violate another state's sovereignty. The affairs of a state are covered by this conception of sovereignty, thus creating the prohibition on state intervention into another state's affairs. Id. 8. Id. 9. Id. 10. Id., at Rule 23 11. Id., at Rules 20, 21, & 23. Benjamin Dynkin is a law clerk at Grauman Law Group. Barry Dynkin is of counsel at the firm, where he heads the cybersecurity practice. Daniel Garrie is the editor-in-chief of the Journal of Law and Cyber Warfare and a partner at Zeichner Ellman & Krause.