(Credit: istockphoto.com/enot-poloskun)
No. 4
The Plea of Necessity and Cyber Warfare
By Captain Katharina J. Rienks
A strict observance of the written law is doubtless one of the high
duties of a good citizen, but not the highest. The laws of necessity,
of self-preservation, of saving our country when in danger, are of
higher obligation. To lose our country by a scrupulous adherence to
written law, would be to lose the law itself, with life, liberty,
property and all those who are enjoying them with us; thus absurdly
sacrificing the end to the means.1
The Ballistic Missile Defense System (BMDS) is one of the most important, yet largely unnoticed, homeland defense mechanisms operated by the United States. The system is a highly sophisticated network featuring an integrated, layered architecture that provides multiple opportunities to detect and destroy incoming missiles and their warheads before they can reach their targets.2 The BMDS protects both the homeland and our deployed military forces, as well as some of our allies worldwide.3 The system’s architecture includes networked sensors and ground- and sea-based radars for target detection and tracking; ground-and sea-based interceptor missiles for destroying a ballistic missile; and a command, control, battle management, and communications network linking the sensors and interceptor missiles.4 Interference with the BMDS could have catastrophic effects on the United States’ capability to detect and destroy various kinds of missiles.5
For the purposes of this article, imagine that—through continuous monitoring—the Command and Control, Battle Management, and Communication (C2BMC) system detects a cyber operation disrupting the various ground- and sea-based radars and surveillance systems that make up the early warning systems. United States Cyber Command (USCYBERCOM) traces the operation back to a government building within North Korea. Intelligence suggests that the intent of the operation was to affect only one of the ground-based radars in an effort to “grandstand” North Korea’s cyber capabilities. Unbeknownst to North Korea, the operation is affecting a majority of the early warning systems. The operation has not caused any physical damage to the BMDS, but is severely limiting communication within the system.
Diplomatic relations with North Korea are non-existent. Due to a contentious trade war with China, relations are strained, and China refuses to mediate between the United States and North Korea. Allies of the United States unsuccessfully attempted to engage in diplomacy with China and North Korea. While the futile attempts at diplomacy are ongoing, the cyber operation crippling the BMDS is progressing. At the same time, attempts to reset and repair the early warning systems from within the United States are in progress. However, the only way to neutralize the cyber operation is to take the source of the operation completely offline.
To prevent a complete loss of all BMDS early warning capabilities, the U.S. Strategic Command (USSTRATCOM) Commander is considering a conventional military strike on the power transformer in North Korea that is supplying the building with electricity. In the alternative, USCYBERCOM recommends a cyber operation to shut down the power grid in North Korea, take the source offline, and end the operation.
In this scenario, there have been no casualties or damages resulting from the cyber operation. In fact, most Americans are going about their days as usual, with no knowledge of the severely degraded BMDS. Intelligence suggests that the intent behind the operation of infecting one of the systems that comprises the BMDS was to show the United States that it is vulnerable. Additionally, there is no evidence that any of the states with Intercontinental Ballistic Missile (ICBM) capabilities are planning an attack on the United States or its allies.
The first proposed course of action is an air strike on the transformer supplying electricity to the building that controls the cyber operation, carried out by F-16s from the 36th Fighter Squadron, Osan Air Base, Republic of Korea (ROK). This course of action would destroy the transformer and shut down part of the power grid for an extended period of time. The alternate approach of a cyber operation would not cause any territorial intrusion or visible damages. Instead, it would shut down the entire power grid and cause widespread power outages in hospitals, schools, public transportation, and other important infrastructure. Both proposed courses of action require causing at least some temporary power outages.
In the absence of an armed conflict and its associated remedies under the United Nations (U.N.) Charter, this article examines whether the proposed kinetic strike or cyber operation by the United States would be a permissible response under the plea of necessity. This article gives a brief overview of the current state of international law as it applies to cyber operations and introduces the concept of the plea of necessity, also known as the necessity doctrine. Within this basic framework, this article examines the elements of a plea of necessity and whether either of the proposed courses of action would be justified. The analysis shows that the plea of necessity would not justify an action amounting to a use of force in response to a cyber operation that is below the use of force threshold. Alternatively, under the plea of necessity, the proposed cyber operation has the potential to be a viable option—if it remains below the use of force threshold. This article then concludes that the plea of necessity is a limited remedy that may justify an otherwise belligerent act, but only in specific circumstances.
A robust body of advisory, non-binding opinions attempted to examine cyber operations; but, laws and international agreements remain lacking
Background
International Law Applicable to Cyber Operations
Despite cyber warfare capabilities developing at a dizzying rate, the jus ad bellum and the jus in bello of the past century regulate today’s cyber warfare, just like they have regulated traditional warfare in the past.6 While the law of armed conflict (LOAC) and the U.N. Charter are well-established, cyber operations complicate the traditional use of force framework.7 A robust body of advisory, non-binding opinions attempted to examine cyber operations; but, laws and international agreements remain lacking. This article examines a remedy outside the scope of the traditional laws pertaining to armed conflict, focusing on the plea of necessity. First, however, a brief review of the current legal landscape is helpful in understanding the various categories of cyber operations.
Article 2 of the Geneva Convention of 1949 (GC I) first introduced the term “armed conflict” and the laws pertaining to it.8 Despite laying out the rules applying to armed conflict, GC I does not actually define what constitutes armed conflict or the use of force. In an attempt to prevent armed conflict, Article 2(4) of the U.N. Charter prohibits both the threat of force, as well as the use of force: “[A]ll members shall refrain in their international relations from the threat or use of force against the territorial integrity or political independence of any state, or in any other manner inconsistent with the purposes of the United Nations.”9
To fully understand how a cyber operation might be categorized as a use of force, it is important to understand the jurisprudence that has attempted to define use of force and armed conflict. The International Court of Justice (ICJ) held that armed conflict involves action by armed forces across international borders, as well as such armed actions carried out by “armed bands, groups, irregulars, or mercenaries.”10 Similarly, according to conclusions of the International Law Association’s (ILA) Committee, an armed conflict requires an intense exchange of fighting by organized armed groups.11 Under this traditional framework of armed conflict, it is irrelevant in which domain the conflict takes place, be it on land, at sea, in the air, or in cyberspace.12 To aid in the analysis, the U.N. Charter lists specific acts that generally do not amount to the use of force. For example, Article 41 of the U.N. Charter lists “complete or partial disruption of economic relations and of rail, sea, air, postal, telegraphic, radio, and other means of communication, and the severance of diplomatic relations” as conduct that does not constitute a use of force.13
Applying the Traditional Use of Force Framework to Cyber Operations
With categorical exclusions on the one hand, and vaguely-defined concepts on the other, experts and scholars have long struggled to categorize cyber operations.14 The Tallinn Manual 2.0 on International Law Applicable to Cyber Warfare is a good starting point. While the Tallinn Manual 2.0 is not binding law, it analyzes and clarifies how concepts of traditional warfare may apply to cyber operations.
The Tallinn Manual 2.0 defines armed conflict as a situation involving hostilities, including cyber operations, whether or not they meet resistance.15 For purposes of defining “hostilities,” a cyber operation arising to a use of force is a “cyber operation, whether offensive or defensive, that is reasonably expected to cause injury or death to persons or damage or destruction to objects.”16 The Tallinn Manual 2.0 specifically focuses on the use of intentional violence against a target in determining whether a use of force exists.17
Furthermore, the International Tribunal for the Former Yugoslavia (ICTY) held in the Tadić case that uses of force are not limited to activities that release kinetic force.18 Thus, cyber operations can amount to a use of force if they are sufficiently violent and cause intended death or destruction.19 Harold Koh, the then-legal advisor for the Department of State, echoed this sentiment when he stated, “if the physical consequences of a cyber-attack work the kind of physical damage that dropping a bomb or firing a missile would, that cyberattack should equally be considered a use of force.”20 Combining the approaches of both the Tallinn Manual 2.0 and the ICTY, the Department of Defense and international commentators adopt this “consequence centric” approach to defining cyber operations.21
Contrary to cyber operations that cause death or destruction, states generally agree that the term “use of force” does not apply to political, psychological, or economic coercion, or to minor cyber operations that threaten information systems, manipulate information, or steal data.22 Similarly, espionage does not violate public or customary international law.23 These activities fall below the use of force and would not justify a use of force in response.24
If a state faces a cyber operation qualifying as an armed attack, it may exercise its inherent right to self-defense as laid out in Article 51 of the U.N. Charter.25 For example, a cyber operation that affects the Supervisory Control and Data Acquisition (SCADA) controller of a dam and interferes with its safety mechanisms could be a use of force. This is because it combines the intent to cause grave harm with the effect of a breach, leading to casualties and widespread damage.26 Under those circumstances, the victim state could legally respond with a use of force under Article 51 of the U.N. Charter.27
Now, with this general framework in mind, consider this article’s scenario of interference with the BMDS. North Korea’s operation caused no casualties or physical damage. Furthermore, there does not seem to be any immediate intent to cause casualties or damages—either by the perpetrator, North Korea, or by countries that could harm the United States—by exploiting the lack of an early warning system against ICBMs.
In fact, it seems that the scope of the interference goes beyond the intent of the operation, and the full effect is unknown to anyone except the United States. Arguably, with the lack of any scale and effect that would satisfy the consequence-centric approach, the cyber operation in our scenario falls just below the threshold for a use of force.28
This conclusion eliminates the United States’ opportunity to lawfully respond with means authorized as self-defense under Article 51 of the U.N. Charter. It is clear, however, that the ongoing cyber operation causes significant harm to the United States and is more serious than a cyber operation intended to influence public opinion, steal financial information, or hack into the system of a major movie production company.29 In the already gray zone of cyber operations, an equally obscure concept known as the plea of necessity may offer an alternate way of responding to the ongoing threat.
In the already gray zone of cyber operations, an equally obscure concept known as the plea of necessity may offer an alternate way of responding to the ongoing threat
The Plea of Necessity and Its Application to Cyber Operations
The Draft Articles on the Responsibility of States for Internationally Wrongful Acts (Draft Articles) formulated by the International Law Commission of the United Nations (ILC) are the starting point for any plea of necessity analysis. The Draft Articles have undergone continuous review and modification since 1956, adjusting to the developing field of international law.30 The latest version of the Draft Articles has been widely applied by the ICJ and, though not converted into a convention, courts largely agree that the Draft Articles form the legal framework for state responsibilities with regards to internationally wrongful acts.31
Historically, the central theme of the plea of necessity was that a
state had the fundamental right to self-preservation.32
Most importantly, a threat to this fundamental right justified a state
taking steps to preserve its existence, even if those steps would be
wrongful if there was no threat.33 The Draft Articles describe and distinguish the plea of necessity as follows:
The plea of necessity is exceptional in a number of respects. Unlike consent (art. 20), self-defence (art. 21) or countermeasures (art. 22), it is not dependent on the prior conduct of the injured State. Unlike force majeure (art. 23), it does not involve conduct which is involuntary or coerced. Unlike distress (art. 24), necessity consists not in danger to the lives of individuals in the charge of a State official but in a grave danger either to the essential interests of the State or of the international community as a whole. It arises where there is an irreconcilable conflict between an essential interest on the one hand and an obligation of the State invoking necessity on the other. These special features mean that necessity will only rarely be available to excuse non-performance of an obligation and that it is subject to strict limitations to safeguard against possible abuse.34
Despite the use of the concept of necessity for almost two hundred years, redress under the plea of necessity is rare and extremely limited.35 One of the best-known cases of necessity is the case of the Caroline. In 1837, British armed forces entered U.S. territory to attack and destroy the Canadian rebel vessel Caroline, which was carrying recruits and military material to Canadian insurgents.36 While the case of the Caroline is often referred to as a case of preemptive self-defense, much of the justification at the time also relied on the concept of necessity; in fact, the two concepts were used interchangeably during diplomatic exchanges at the time.37 British statesman and treaty negotiator Lord Ashburton justified the use of force in the territory of another state. He said, there must be “a strong overpowering necessity” that could “for the shortest possible period” and “within the narrowest limits” suspend the obligation to respect the independent territory of another state.38 The strong and overpowering necessity in the case of the Caroline was that the British feared another attack from the United States. The argument for the use of force in the case of the Caroline was a combination of self-defense and self-preservation, which then evolved into a belief that the use of force was necessary to prevent a potential future attack.39
the ILC cautioned against subverting the plea of necessity into a plea of “military necessity”
Since 1837, customary international law and the appropriate bases for the use of force have developed; and, today, many commentators consider the Caroline an example of preemptive self-defense rather than necessity.40
However, the ICJ has repeatedly held that the
Caroline was a case of necessity.41 With this historical understanding of necessity as a starting point, the necessity doctrine developed over the years to encompass more than just the mere self-preservation of a state.42
This expansion, discussed below, makes necessity an interesting concept
for cyber operations.
To shed light on the more contemporary plea of necessity, the ILC
appointed Judge Roberto Ago to conduct a thorough study on the necessity
doctrine, published in 1980.43 While there are certain limitations, many of the basic frameworks introduced by Judge Ago have a timeless application. Considering that states currently apply rules formulated for the warfare of past centuries to cyberspace, a forty-year-old analysis of an almost 200-year-old legal concept does not seem unduly outdated.
After reviewing doctrines and the decisions of international tribunals, Judge Ago approached necessity from a slightly different angle and found that it is not a right emanating from the right of self-preservation, but rather an excuse to breach a state’s international obligation when necessary to protect an essential interest.44
Similarly, the ILC noted, “necessity is used to denote those exceptional
cases where the only way a state can safeguard an essential interest
threatened by a grave and imminent peril is, for the time being, not to
perform some other international obligation of lesser weight or
urgency.”45 In exceptional circumstances, necessity could permit a state to escape liability for belligerent acts that would normally constitute a violation of international law.46 Interestingly, Judge Ago recognized that there does not have to be a link between a state’s very existence and recourse under the plea of necessity.47 As a result, the definition of necessity expanded significantly, to include essential interests which themselves alone are not linked to a state’s existence.48
The Torrey Canyon incident of 1967 best exemplifies the movement toward a more expansive definition of necessity.49 The Torrey Canyon, a Liberian tanker carrying crude oil, ran aground off the coast of Cornwall, England.50 The oil began to leak into the Atlantic Ocean.51 As the Torrey Canyon continued to leak large amounts of oil, the British government was facing the risk of an environmental disaster.52 After various attempts at containing the spill, the British government bombed the vessel in order to burn off the remaining oil.53
Despite the Torrey Canyon incident clearly posing an environmental threat, it was not a threat even remotely linked to the very existence of Great Britain.54 However, the ILC found that the British government’s actions were justified under a plea of necessity, even if the Liberian government had objected to the bombing of the vessel.55
In its opinion, the ILC noted the following:
[W]hatever other possible justifications there may have been for the
British Government’s action, it seems to the Commission that, even if
the ship owner had not abandoned the wreck and even if he had tried to
oppose its destruction, the action taken by the British Government would
have had to be recognized as internationally lawful because of a state
of necessity.56
The ILC’s commentary demonstrates the development of the plea of necessity being applied beyond mere self-preservation.57
With this general framework created by Judge Ago and the ILC, it seems possible to apply this well-established concept of necessity to a cyber operation that threatens an essential interest of the victim state. However, the threshold for an essential interest is high, and the stakes become higher when the proposed response is an act amounting to a use of force.58 The ILC intentionally drafted the plea of necessity narrowly to prevent abuse by states and to further the balancing of state sovereignties.59 In fact, while not specifically excluding forcible action, the ILC cautioned against subverting the plea of necessity into a plea of “military necessity.”60 To go even further, Judge Ago clearly excluded the use of force against the territorial integrity of a state as justifiable under the plea of necessity.61 Many commentators agree and argue that exceptions to the prohibition against the use of force only arise in cases of self-defense under Article 51 of the U.N. Charter, or subject to U.N. Security Council authorization.62 Notably, while raising the issue of use of force under the plea of necessity, the Tallinn Manual 2.0 leaves the ultimate question unanswered.63 Clearly, the limitations for the use of the plea of necessity are significant. It is under those strict limitations that this article analyzes whether the proposed kinetic strike or cyber operation could be justified in the given scenario.
Would the Proposed Responses to the BMDS Scenario Be Justified by the Plea of Necessity?
Scholars and practitioners must analyze and apply the elements of the plea of necessity to answer this overarching question. The Draft Articles articulate the following analytical framework:
- Necessity may not be invoked by a State as a ground for precluding the wrongfulness of an act not in conformity with an international obligation of that State unless the act: (a) is the only way for the State to safeguard an essential interest against a grave and imminent peril; and (b) does not seriously impair an essential interest of the State or States towards which the obligation exists, or of the international community as a whole.
- In any case, necessity may not be invoked by a State as a ground for precluding wrongfulness if: (a) the international obligation in question excludes the possibility of invoking necessity; or (b) the State has contributed to the situation of necessity.64
In the given scenario, the United States did not contribute to (i.e., provoke) the situation of necessity; therefore, we will not discuss the last element. The analysis is fact-specific and may change considerably with even only slight variations, particularly in cyber operations where attribution is difficult.65 With this in mind, the elements of a plea of necessity may now be applied to the scenario.
Is an Essential Interest of a State at Risk?
The threshold question in this analysis is whether the BMDS constitutes an essential interest of the United States. The Draft Articles do not specifically lay out what constitutes an essential interest of a state. Rather, the Draft Articles caution that whether an interest is essential “depends on the circumstances and cannot be pre-judged.”66 As Judge Ago noted, a threat to an essential interest “represents a grave danger to the existence of the State itself, its political or economic survival, the continued functioning of its essential services, the maintenance of internal peace, the survival of a sector of its population, [and] the preservation of the environment of its territory or a part thereof.”67 Curiously, there are a substantial number of cases where the plea of necessity was invoked based on the environmental protection of a specific area or species.68 This suggests a general broadening of the scope of an essential interest in certain circumstances and forms the starting point for the BMDS analysis.
The analysis is fact-specific and may change considerably with even only slight variations
Is Ballistic Missile Defense an Essential Interest of the United States?
In determining whether a working defense mechanism would constitute an essential interest, it is best to look to other incidents where a state invoked the plea of necessity on a “defense-based” theory. As previously discussed, although concepts of self-defense and necessity were used interchangeably at the time, the Caroline case is the most relatable scenario. Nevertheless, in a way, the underlying analysis is similar. How? Because the acts were intended to prevent a potential future attack. In the BMDS scenario, the United States is facing a threat to one of its unproven—yet most important—assets of homeland defense.69
Under the umbrella of a North Atlantic Treaty Organization (NATO) ballistic missile defense system, missile defense is an integral part of homeland defense worldwide, not just in the United States.70 In fact, missile defense is so important to peace worldwide that NATO Secretary General Jens Stoltenberg considers it “an important tool for NATO’s core task of collective defense.”71
With the threat that ballistic missiles pose, and the considerable
efforts aimed at defending against them, it would seem that under the
analysis of Judge Ago—as well as the Draft Articles—the BMDS scenario
would be a threat to an essential interest, i.e., the ability to provide
homeland defense. Therefore, the threshold element is met. The grave and
imminent peril determination is the next consideration.
Is the Essential Interest Threatened by a Grave and Imminent Peril?
To satisfy the conditions for a plea of necessity, the essential
interest must be threatened by a grave and imminent peril.72
Furthermore, the threat cannot merely be a possibility—it must be
objectively established by the evidence.73
This does not mean the threat must occur immediately, as the analysis
does not exclude a threat that will occur in the future, as long as such
future occurrence is certain.74
In the BMDS scenario, the grave and imminent peril has already materialized, as the cyber operation that is degrading communications between the various early warning systems is ongoing. For purposes of the grave and imminent peril analysis, it is important to recall what the threatened essential interest is. As established above, the essential interest is not the very existence of the United States as a nation state, but rather maintaining a functional homeland defense system. This essential interest is in grave and imminent peril because the operation to degrade this function is in progress. Therefore, the grave and imminent peril analysis is relatively straightforward. The peril is grave by virtue of the potential for a complete degradation of the BMDS, leaving the United States and its allies without a functioning BMDS. The peril is also imminent because it is ongoing and continues to affect additional early warning systems. The BMDS scenario therefore meets the requirements for an essential state interest in grave and imminent peril. Consequently, the focus now shifts to the proposed courses of action.
Is the Proposed Action the Only Way to Guard Against the Peril?
How to Determine the “Only Way”
As discussed earlier, the use of force pursuant to the plea of necessity to justify otherwise wrongful conduct is extremely limited. This strict limitation becomes obvious when engaging in the analysis of whether a belligerent act is the only way to guard against the grave and imminent peril. Judge Ago noted that if a state acts in a way that violates another state’s rights, it must “truly be the only means available to it for averting the extremely grave and imminent peril which it fears.”75 Judge Ago further elaborated, “[I]t must be impossible for the peril to be averted by any other means, even one which is much more onerous but which can be adopted without a breach of international obligations.”76 Acting under a plea of necessity is improper if there are other lawful means available, even if they may be more costly or less convenient.77 The word “way” does not only mean unilateral action, but may be comprised of cooperative action with other states or international organizations, such as through diplomacy.78 Lastly, any action under the plea of necessity is also subject to the concept of proportionality.79
This part of the analysis is by far the most fact dependent and may change considerably with any variation of the facts. The BMDS scenario simplifies the facts to focus on the analysis of the legality of a belligerent act under the plea of necessity. The facts reveal that diplomacy and stateside attempts at repairing the early warning system have failed. In this scenario, the only way to end the cyber operation is to take the server completely offline. Physical destruction of the transformer or a cyber operation shutting down the power grid are the only ways to achieve the desired result. While it is—admittedly—simplified, the purpose of this article is not to determine whether there are other ways to neutralize the threat, but to analyze whether either of the proposed courses of action would be justified under the plea of necessity. Therefore, this article accepts the proposed courses of actions as viable and exclusive and now moves on to the analysis of the two courses of action.
Military Action Invoked by the Plea of Necessity
With the plea of necessity already being a limited concept, military action is even more restricted when invoked under the plea of necessity. Going back to 1837, the Caroline incident may be the only true example of military action invoked by a plea of necessity. States have invoked military action pursuant to necessity in the context of humanitarian intervention, but this justification was met with strong resistance by the U.N. Security Council.80
For cyber operations that do not amount to a use of force, there is no
precedent for using force in response. Commentators have grappled with
the possibility of justifying forcible action in such a scenario.81
Some commentators are steadfast in their opinion that such uses of force
are only legal pursuant to a U.N. Security Council authorization, or in
self-defense under Article 51 of the U.N. Charter.82
Other experts recognize this severely limits states, subjecting them to
considerable risk as they must wait until a cyber operation qualifies as
a use of force; at which point considerable damage may have already been
done.83
The plain language of the Draft Articles do not prohibit the use of force pursuant to necessity, but they do impose strict limitations and suggest that other international treaties are better equipped to regulate the use of force.84 Despite the lack of a clear exclusion of the use of force as a remedy due to necessity, the balancing test discussed as part of the next element likely renders any use of force in the necessity context wrongful.
Does the Conduct in Question Seriously Impair an Essential Interest of the Other State?
This element necessarily requires a balancing test between the intended actions to combat the grave and imminent peril and the rights of the other state.85 In the end, the protected essential interest must be of “greater importance than the other state’s interest that will be temporarily disregarded.”86 The Draft Articles make this balancing requirement even more stringent by introducing a standard of “a reasonable assessment of the competing interests, and not merely the point of view of the acting state.”87 Upon analyzing the limiting factors, it becomes clear that a response to below-use-of-force conduct almost automatically excludes the use of force by virtue of the necessary balancing of obligations.88
Nevertheless, some experts have departed from this strict reading of the plea of necessity, especially in cases of humanitarian intervention and counterterrorism.89 In situations of counterterrorism, some commentators argue that the use of force may be excusable under the plea of necessity, but only if the target is a non-state actor operating out of a state that is unwilling or unable to prevent its territory from being used for the purpose of planning and executing terrorist attacks.90 The argument put forth is that an “anticipatory strike” against non-state actors in the territory of an “unable” state can be conceptualized much like the Caroline case and, therefore, be an excusable use of force pursuant to the plea of necessity.91 Notably, this use of force only seems to be excusable against non-state actors in the territory of another state, and is clearly distinguishable from the present scenario. Thus, even though the use of force may be excusable in those limited circumstances, it does not change the strict balancing requirement with regard to a nation–state adversary.
One scenario where the use of force has been used against a state actor, despite the lack of justification due to self-defense or a Security Council resolution, is in the context of humanitarian intervention. However, the legality versus morality debate of such forceful interventions have continued to challenge scholars of international law.92 A thorough discussion of Humanitarian Intervention and the Responsibility to Protect (R2P) is beyond the scope of this article. Suffice it to say that the use of force in cases of humanitarian intervention is often seen as “illegal but legitimate” and, in some way, a necessary choice of the lesser evil.93 Neither of the circumstances where the use of force pursuant to the plea of necessity has been considered aids the analysis of the North Korea scenario. The adversary is a state actor engaging in a cyber operation, not a humanitarian crime. Therefore, despite the possibility of applying the plea of necessity in conjunction with the use of force in cases of non-state actor terrorism or humanitarian intervention, the current scenario requires the balancing of state interests as written in the Draft Articles. As a result, resorting to the use of force becomes increasingly untenable.
Does the Proposed Kinetic Strike Seriously Impair an Essential Interest of the Other State?
A balancing test of the BMDS scenario quickly reveals an issue with the first proposed course of action. A kinetic strike within the borders of another sovereign state that will likely cause destruction, a significant power outage, and possibly casualties, clearly amounts to a use of force.94 Compared to the threat to the United States, the proposed kinetic strike within the territory of another state has a significantly more serious impact.95
The kinetic strike course of action would disregard the basic state obligations regarding the use of force.96
Even after establishing that an essential interest of the United States
is in grave and imminent peril, a reasonable assessment of the proposed
action would conclude that the use of force against the territorial
integrity of North Korea would not pass the balancing test, and is
therefore not justified by a plea of necessity.
Does the Cyber Operation Seriously Impair an Essential Interest of the
Other State?
The second proposed course of action may offer a viable alternative to a
kinetic strike, but balancing test concerns remain. Nevertheless, the
scales may be slightly in favor of executing the proposed cyber
operation. The North Korean fundamental interest that is affected by the
cyber operation is that of having control over its power grid and
providing electricity to its citizens. If the majority of the country
would be without power, hospitals, and public services, citizens would
surely suffer. However, upon balancing North Korea’s interest in its
power grid against the United States’ interest in a functional BMDS, the
viability of this option reveals itself. Both interests aim at providing
essential services to its citizens—electricity on the one hand and
homeland defense on the other. Both operations in isolation are
internationally wrongful acts carried out via cyber means. However,
neither operation has the intent to cause casualties and destruction.
North Korea’s intent was to grandstand its cyber capabilities, the
United States’ intent is to shut down power to the server and end the
malicious cyber operation.
Depending on the effects of the shutdown, the U.S. cyber operation may
barely remain below the threshold of a use of force under a
consequence-centric approach. Remaining below the threshold is an
important factor given the severe limitations pertaining to the use of
force.97 If the shutdown is short, and the targeted building has a backup generator, the effects on the civilian population may be limited and proportional.98
If the proposed response can limit its effects on the population as much as possible, the cyber operation is now somewhat comparable to Great Britain’s response in the Torrey Canyon incident. Just as Liberia did not intend an uncontrollable oil spill, North Korea did not intend for the cyber operation to have such a disproportionate impact. However, much akin to Liberia who simply abandoned a tanker gushing oil onto Cornwall’s coastline, North Korea is also unwilling to remediate the issue.99
The facts now align with Judge Ago’s baseline view that the plea of necessity may justify a state violating its obligations in the face of grave and imminent peril. When balanced, the United States’ response impedes on the interest of North Korea; but, considering the interests sought to be protected, it does not unduly impede under the circumstances. Therefore, if it is limited and proportional, the cyber operation could be justified under a plea of necessity.100 The last step is to determine whether either course of action is explicitly or implicitly excluded from relying on the plea of necessity.
Does the Proposed Course of Action Explicitly or Implicitly Exclude Reliance on Necessity?
Even if a case meets all of the above elements, a state may not rely on necessity if such reliance is explicitly or implicitly excluded.101 The ILC states that reliance on military necessity is excluded in certain humanitarian conventions that govern behavior during armed conflict.102 This is logical, as necessity should never be relied upon to violate human rights obligations established by the Geneva Conventions, the Hague Convention, and Customary International Law. Furthermore, the Draft Articles make it clear that the plea of necessity is not intended to cover conduct that is regulated by the primary obligations established by the U.N. Charter.103 However, considering that paragraph 19 of the Draft Articles continues to discuss military necessity and forcible humanitarian intervention, this assertion is somewhat vague.104
State sovereignty and the prohibition of the use of force are cornerstone obligations regulated by treaty provisions and international humanitarian law, but they do not explicitly exclude recourse under a theory of necessity.105 However, based on the balancing test above, it seems that any use of force in response to a below-the-threshold cyber operation would be implicitly excluded due to tipping the scales in favor of regulation by treaty provisions and international humanitarian law.106 Thus, application of this last factor once again eliminates the kinetic strike option, but would not eliminate the counter cyber operation if it remains below the use of force threshold.
Nevertheless, the scales may be slightly in favor of executing the proposed cyber operation
Conclusion
On the surface, the plea of necessity seems to be an advantageous concept for responding to cyber operations that do not meet the use of force threshold. Upon diving deeper into its elements and limitations, it becomes clear why this seemingly flexible and malleable framework has seen limited use. It is easy to argue that a state interest is essential and that a peril is imminent and grave. The built-in safeguards of the plea of necessity make it difficult to apply, and rightfully so. With the first two elements being very malleable, the mandatory balancing of state obligations—in addition to explicit and implied exclusions—are necessary safeguards to avoid the abuse of this doctrine. It is in the depths of this balancing test where the kinetic strike option runs aground. The plea of necessity will not justify the use of force in response to a below-the-threshold cyber operation.
However, the proposed cyber operation could be justified by the plea of necessity under the right set of facts. While not a straightforward way out of uncharted waters, the plea of necessity may, after careful analysis and balancing of the available courses of action, offer a limited option when responding to below-the-threshold cyber operations in the future. TAL
Capt Rienks is the Chief, Military Justice at Ninth Air Force/Air Forces Central Command at Shaw Air Force Base in South Carolina.
Notes
1. Extract of a Letter from Thomas Jefferson to John B. Colvin (Sept. 20, 1810) in 11 The Works of Thomas Jefferson, 3, 146 (Paul Leicester Ford, ed.) (1905).
2. The Ballistic Missile Defense System (BMDS), U.S. Dep’t of Def. Missile Def. Agency, https://www.mda.mil/system/system.html (last visited July 14, 2020)
[hereinafter BMDS].
3. Jonathan Masters, Ballistic Missile Defense, Council on Foreign Relations (Aug. 15, 2014), https://www.cfr.org/backgrounder/ballistic-missile-defense.
4. BMDS,
supra
note 2.
5. Masters, supra note 3.
6. David Wallace et al., Revisiting Belligerent Reprisals in the Age of Cyber?, 102 Marq. L. Rev. 81, 82 (2018) (Jus ad bello refers to the conditions under which States may resort to war or to the use of armed force in general, jus in bellum is the law that governs the way in which warfare is conducted.).
7. Walter G. Sharp, Sr., Cyber Space and the Use of Force
5 (1999).
8. Geneva Convention for the Amelioration of the Condition of the
Wounded and Sick in Armed Forces in the Field art. 2, Aug. 12, 1949, 6
U.S.T. 3114, 75 U.N.T.S. 31.
9. U.N. Charter art. 2, ¶ 4.
10. Military and Paramilitary Activities in
and Against Nicaragua (Nicar. v. U.S.), Judgment, 1986 I.C.J. Rep. 14,
¶ ١٩٥ (June 27).
11. What is War? An Investigation in the Wake of 9/11
10 (Mary E. O’Connell ed., 2012).
12. Catherine Lotrionte,
Reconsidering the Consequences for State-Sponsored Hostile Cyber
Operations Under International Law, 3 Cyber Def. Rev. 73, 77 (2018).
13. U.N. Charter art. 41.
14. Lotrionte, supra note 12, at 81.
15. Tallinn Manual 2.0
on the International Law Applicable to Cyber operations 415–17 (Michael N. Schmitt ed., 2d ed. 2013) (hereinafter
Tallinn Manual 2.0).
16. Id.
17. Id.
18. Prosecutor v. Tadić, Case No. IT-94-1-I, Decision on Defence Motion for Interlocutory Appeal, ¶ 120, ¶ 124 (Int’l Crim. Trib. for the Former Yugoslavia Oct. 2, 1995) (holding that despite the lack of a kinetic effect, chemical weapons are prohibited in armed conflict).
19. Id.
20. Harold Hongju Koh, Legal Adviser, Dep’t of State, International Law in Cyberspace: Remarks as Prepared for Delivery to the USCYBERCOM Inter-Agency Legal Conference (Sept. 18, 2012), reprinted in 54 Harv. Int’l l. J. Online, 1, 4 (2012), https://harvardilj.org/wp-content/uploads/sites/15/2012/12/Koh-Speech-to-Publish1.pdf.
21. Todd C. Huntley, Controlling the Use of Force in Cyberspace: The Application of the
Law of Armed Conflict During a Time of Fundamental Change in the
Nature of Warfare, 60 Naval L. Rev. 1, 22 (2010).
22. Sheng Li, When Does Internet Denial Trigger the Right of Armed
Self-Defense?, 38 Yale J. Int’l L. 179, 184 (2013); see also Huntley, supra note 21, at 31.
23. Commander Roger D. Scott, Territorially Intrusive Intelligence Collection and International
Law, 46 A.F. L. Rev. 217, 218 (1999).
24. See Huntley, supra note 21, at 31.
25. U.N. Charter art. 51 (recognizing the “inherent right of individual or collective self-defense” of United Nations members faced with an armed attack and containing no language that would limit the right to self-defense to armed attacks by States); see also Tallinn Manual 2.0, supra note 15, at 345 (recognizing that the issue of whether acts of non-State actors can constitute an armed attack absent involvement by a State is a matter of debate among the experts).
26. U.S. Dep’t of Def., DoD Law of War Manual para. 16.3.1 (June 2016, updated Dec. 2016) (listing examples of cyber
operations that would cross the threshold of a use of force: triggering
a nuclear plant meltdown; opening a dam above a populated area and
causing destruction; and disabling air traffic control services,
resulting in airplane crashes and the crippling of a military’s
logistics systems).
27. Michael N. Schmitt,
“Below the Threshold” Cyber Operations: The Countermeasures Response
Option and International Law, 54 Va. J. Int’l. L. 698, 698 (2014); Tallinn Manual 2.0, supra note 15, at 339.
28. Tallinn Manual 2.0, supra note 15, at 340–41; Lotrionte, supra note 12, at 87. See also Koh, supra, note 20, at 4; Military and Paramilitary Activities in and Against Nicaragua (Nicar. v. U.S.), Judgment, 1986 I.C.J. Rep. 14, ¶ 195 (June 27) (The term “scale and effects” was introduced by the International Court of Justice in its opinion in the case of Nicaragua v. United States of America when the court discussed to what scale an act would have to rise, and what effects it must have to be considered a use of force.).
29. For background information on the aforementioned operations, see Daniel J. Weizner, How Cambridge Analytica, Facebook and Other Privacy Abuses Could Have
Been Prevented, Lawfare (Apr. 4, 2018, 7:00 AM), https://www.lawfareblog.com/how-cambridge-analytica-facebook-and-other-privacy-abuses-could-have-been-prevented; Alyssa Newcomb, Massive Equifax Data Breach Could Affect Half of the U.S.
Population, NBC News (Sept. 10, 2017, 6:01 PM), https://www.nbcnews.com/tech/security/massive-equifax-data-breach-could-impact-half-u-s-population-n799686; Press Release, U.S. Dep’t of Just., North Korean Regime-Backed Programmer Charged With Conspiracy to Conduct Multiple Cyber Attacks and Intrusions (Sept. 6, 2018), https://www.justice.gov/opa/pr/north-korean-regime-backed-programmer-charged-conspiracy-conduct-multiple-cyber-attacks-and.
30. James Crawford, Articles on Responsibility of States for Internationally Wrongful
Acts,
U.N. Audiovisual Library of Int’l L., 1, 1–2, http://legal.un.org/avl/pdf/ha/rsiwa/rsiwa_e.pdf (last visited July
14, 2020).
31.
The Development of International Law by the International Court of
Justice 81(Christian Tams & James Sloan eds., 2013).
32. Roman Boed,
State of Necessity as a Justification for Internationally Wrongful
Conduct, 3 Yale Hum. Rts. & Dev. L.J. 1, 4 (2000).
33. Id.
34. Draft Articles on Responsibility of States for Internationally Wrongful Acts, with Commentaries, [2001] 2 Y.B. Int’l Law Comm’n 80, U.N. Doc. A/56/10 [hereinafter Draft Articles].
35. Christian Schaller, Beyond Self-Defense and Countermeasures: A Critical Assessment of the Tallinn Manual 2.0’s
Conception of Necessity, 95 Tex. L. Rev. 1619, 1621–22 (2017).
36. Draft Articles, supra note 34, at 81 (discussing the facts of the Caroline incident).
37. Roberto Ago (Special Rapporteur), Addendum to the Eighth Report on State Responsibility, [1980] 2 Y.B. Int’l Law Comm’n 61, 65, U.N. Doc. A/CN.4/318/ADD.5-7; Correspondence Between Great Britain and the United States,
Respecting the Arrest and Imprisonment of Mr. McLeod, for the
Destruction of the Steamboat Caroline, April 24, 1841, 29
British and Foreign State Papers 1133, 1137–38 (1840-1841).
38. Correspondence Between Great Britain and the United States,
Respecting the Destruction of the Steamboat Caroline, July 28,
1842, 30
British and Foreign State Papers 193, 196 (1841-1842).
39. James Green, Docking the Caroline: Understanding the Relevance of the Formula in Contemporary Customary International Law Concerning Self-Defense, 14 Cardozo J. Int’l & Compar. L. 429, 438 (2006).
40. Id. at 432.
41. Draft Articles, supra note 34, at 81. See also Ago, supra note 37, at 39.
42. Boed, supra note 32, at 7.
43. Ago, supra note 37 (Despite his analysis appearing to be somewhat dated, this should not discourage a close look at his report and analysis.).
44. Id. at 19–20.
45. Draft Articles, supra note 34, at 80 (further listing the elements of a plea of necessity).
46. Id. at 84 (discussing “military necessity” and the extreme limitations associated with invoking military actions pursuant to a plea of necessity); Legal Consequences of the Construction of a Wall in the Occupied Palestinian Territory, Advisory Opinion, 2004 I.C.J. 136, ¶ 140 (July 9) (In applying the defense of necessity under customary law, the ICJ notes that it only applied in “strictly defined conditions.”).
47. Ago, supra note 37, at 21.
48. Boed, supra note 32, at 10.
49. Id.
50. Draft Articles, supra note 34, at 82.
51. Id.
52. Id.
53. Id.
54. Boed, supra note 32, at 10.
55. Int’l Law Comm’n, Rep. on the Work of Its Thirty-Second Session, U.N. Doc. A/35/10 (1980), reprinted in [1980] 2 Y.B. Int’l L. Comm’n 39, U.N. Doc.A/CN.4/SER.A/1980/Add.1 (Part 2).
56. Id.
57. Boed, supra note 32, at 10.
58. Michael N. Schmitt, Peacetime Cyber Responses and Wartime Cyber Operations Under
International Law: An Analytical Vade Mecum, 8 Harv. Nat’l Sec. J. 239, 252 (2017).
59. Id.
60. Draft Articles, supra note 34, at 84 (discussing the rare incidents where necessity has been invoked to excuse military actions abroad. It should be noted that those incidents of “military necessity” were in a humanitarian intervention context.).
61. Ago, supra note 37, at 21 (“Moreover, in view of the compelling reasons which lead to the definitive affirmation of the prohibition of the use of force against the territorial integrity or political independence of any State, it seems to us inconceivable that the legal conviction of States would today accept ‘necessity’ as justification for a breach of that prohibition and, more generally, for any act covered by the now accepted concept of an ‘act of aggression.’”).
62. Schaller, supra note 35, at 1621–22.
63. Tallinn Manual 2.0, supra note 15, at 140.
64. Draft Articles, supra note 34, at 80.
65. U.S. Dep’t of Def., Department of Defense Cyberspace Policy Report: A
Report to Congress Pursuant to the National Defense Authorization Act
for Fiscal Year 2011, Section 934, 4 (Nov. 2011), https://apps.dtic.mil/dtic/tr/fulltext/u2/a552759.pdf.
66. Id.
67. Ago, supra note 37, at 14.
68. Draft Articles, supra note 34, at 81–82 (discussing the environmental basis for necessity in the cases of Russian Fur Seals, Torrey Canyon, the Gabćíkovo-Nagymaros Project, and the Fisheries Jurisdiction case).
69. See FY17 Ballistic Missile Defense Systems, Off. of U.S. Sec’y of Def., https://www.dote.osd.mil/Portals/97/pub/reports/FY2017/bmds/2017bmds.pdf?ver=2019-08-19-113818-163
(last visited July 14, 2020).
70. See Jens Stoltenberg, Editorial, Defending our Nations From Ballistic Missile Threats,
NATO (May 12, 2016), https://www.nato.int/cps/en/natohq/opinions_130662.htm?selectedLocale=en.
71. Id.
72. Draft Articles, supra note 34, at 83.
73. Id.
74. Gabčíkovo-Nagymaros Project (Hung. v. Slovk.), 1997 I.C.J. 7, ¶ 54 (Sept. 25) (The court held that grave and imminent peril “does not exclude...that a ‘peril’ appearing in the long term might be held to be ‘imminent’ as soon as it is established, at the relevant point in time, that the realization of that peril, however far off it might be, is not thereby any less certain and inevitable.”).
75. Ago, supra note 37, at 20.
76. Id.
77. Draft Articles, supra note 34, at 83; see also Lotrionte, supra note 12, at 97.
78. Draft Articles, supra note 34, at 83.
79. Id.
80. Id. at 84; S.C. Res. 143, ¶ 1 (July 14, 1960); see also Nicole Hobbs, The UN and the Congo Crisis of 1960, Harvey M. Applebaum ’59 Award, 19 (2014), http://elischolar.library.yale.edu/applebaum_award/6.
81. Tallinn Manual 2.0, supra note 15, at 140.
82. Id.
83. Id.
84. Draft Articles, supra note 34, at 84.
85. Lotrionte, supra note 12, at 97.
86. Id.
87. Draft Articles, supra note 34, at 83.
88. Anders Henriksen, Lawful State Responses to Low-Level Cyber-Attacks,
84 Nordic J. Int’l L. 323, 350 (2015).
89. Anthea Roberts, Legality vs. Legitimacy: Can Uses of Force Be Illegal But
Justified?,
in Human Rights, Intervention, and the Use of Force (Philip Alston & Euan Macdonald eds., 2008); Ian Johnstone,
The Plea of “Necessity” in International Legal Discourse:
Humanitarian Intervention and Counter-Terrorism, 43 Colum. J. Transnat’l L. 337 (2004–05).
90. Jure Vidmar, The Use of Force as a Plea of Necessity, 111
Am. J. Int’l L. Unbound, 301, 305 (2017).
91. Id.
92. See Christine Chinkin, Kosovo: A “Good” or “Bad” War?, 93 Am. J. Int’l L. 841, 843 (1999) (“How can I, as an advocate of human rights, resist the assertion of a moral imperative on states to intervene in the internal affairs of another state where there is evidence of ethnic cleansing, rape and other forms of systematic and widespread abuse, regardless of what the Charter mandates about the use of force and its allocation of competence?”); Heidrali Teimouri & Surya P. Subedi, Responsibility to Protect and the International Military Intervention
in Libya in International Law: What Went Wrong and What Lessons Could
Be Learnt from It?, 23
J. Conflict & Sec. L. 3 (2018).
93. Vidmar, supra note 90, at 306.
94. See Military and Paramilitary Activities in and Against Nicaragua (Nicar. v. U.S.), Judgment, 1986 I.C.J. 14 (June 27) (The ICJ discusses
the use of force under customary international law throughout its
opinion.).
95. Ago, supra note 37, at 21.
96. U.N. Charter art. 2, ¶ 4.
97. See Ago, supra note 37, at 19.
98. See Factsheet on North Korea, U.S. Energy Info. Admin., https://www.eia.gov/beta/international/analysis.php?iso=PRK (June 2018) (According to the Energy Information Administration, only twenty-seven percent of households in North Korea had access the electricity in 2016).
99. Report of the International Law Commission on the Work of Its Thirty-Second Session, U.N. Doc. A/35/10 (1980), reprinted in [1980] 2 Y.B. Int’l L. Comm’n 39, U.N. Doc.A/CN.4/SER.A/1980/Add.1 (Part 2).
100. Id. at 40.
101. Draft Articles, supra note 34, at 84.
102. Id.
103. Id.
104. Id.
105. See Ago, supra note 37, at 41.
106. Id.