Introduction
“International law, in particular the Charter of the United Nations, is applicable and essential to maintaining peace, security and stability and promoting an open, secure, stable, accessible and peaceful ICT [information and communications technology] environment.”Footnote 1 While this conclusion should be considered undisputed (as it is part of both the 2021 report of the Group of Governmental Experts on Advancing Responsible State Behaviour in Cyberspace in the Context of International SecurityFootnote 2 and the 2021 report of the Open-Ended Working Group on Developments in the Field of Information and Telecommunications in the Context of International SecurityFootnote 3), how international law applies to the use of ICT is still a matter of discussion among States. Thanks in part to this legal uncertainty, as argued by some scholars, the current global security landscape is characterized by a “permanent low-intensity warfare that the principal actors often deny entirely”Footnote 4. Therefore, as this paper will show, it is safe to say that the competition in cyberspace between the two blocs of States – the first led by the United States and the second led by China and Russia – has become quite explicit, although each bloc is reluctant to acknowledge its involvement. Competition in cyberspace, however, cannot be seen as an entirely new phenomenon. To define the relations between the United States and the Soviet Union during the Cold War, Philip C. Jessup suggested the opportunity to overcome the traditional dichotomy between “war” and “peace” and to consider a “state of intermediacy” which is neither one thing nor the other. According to this jurist, “in a state of intermediacy it would be recognized that the hostile parties could engage in conduct which would not be peaceful and yet would be short of what may now conveniently be called total war”.Footnote 5
This paper argues that the lack of a common understanding on how international law applies to ICT – which paved the way for this state of intermediacy – is caused by some fundamental opacities in international law, rather than by the absence of domain-specific legally binging norms. The aim of the paper is twofold: it will explain the areas of opacity, and it will propose some mitigation measures.
With the exception of a narrow interpretation of the notion of espionage, mitigation measures may not be easily achievable as international law now stands. Therefore, the paper will deeply analyze espionage and its limits under international law, across various regimes of international law. Although the analysis will not define the final status of espionage under international law, it will nevertheless conclude that activities going beyond information-gathering should not be considered as espionage.
As a consequence, States should follow a legally sound interpretation of the notion of espionage and should distinguish it from other forms of hostile activities. This also implies, in accordance with the principle of distinction, that cyber operations – beyond mere intelligence-gathering – conducted by a State should not be conducted by civilians but by members of the armed forces.
Although the conclusion stated above may not appear to be particularly innovative, States’ practice seems to show otherwise. Indeed, as suggested by some scholars, “there is a high probability that many, if not most, of the personnel substantively involved in cyber operations may actually be civilians”.Footnote 6 Available studiesFootnote 7 on governance of States’ cyber capabilities show that military and intelligence entities can be organized following different models, ranging from collaboration to separation or centralization. Whatever model is used, it is safe to say that States are often pursuing a strong integration between military and civilian cyber capabilities,Footnote 8 thereby producing a blurred division of responsibilities between the armed forces and civilian intelligence agencies. In other words, we may see civilian intelligence agencies contributing to the execution of tasks that in other domains would clearly fall under the sole responsibility of the armed forces. So, unsurprisingly, it has been argued that
[c]onsideration needs to be given to whether the integration of intelligence and military cyber capabilities is the best approach in light of the risks and whether instead there is a need to create clear space between the different organizations within a state that have a legitimate reason to operate in cyberspace.Footnote 9
On the other hand, such proactivity by civilian intelligence agencies may also explain the concerns raised by some States with different geopolitical mindsets – such as Russia,Footnote 10 JapanFootnote 11 and BrazilFootnote 12 – on the need to clarify the notion of combatants’ and civilians’ direct participation in hostilities, in the context of the law applicable to ICT. Of course, one might argue that the overall argument put forward in this article is too Western-centric, since non-Western States may not “necessarily agree on a societal pact as did Europe in the case of the Westphalian order. In such countries the state monopoly on the use of force was not, and still is not, necessarily accepted or legitimized by the wider population.”Footnote 13 In that respect, however, it is sufficient to note that the rules-based international order presupposes that States – through their democratic legitimacy – should maintain the monopoly on the use of force. International humanitarian law (IHL), indeed, has enlarged the notion of combatants in order to deal with guerrilla and resistance movements. As will be shown in this article, however, these movements should be seen as an exception to the general rule, rather than as evidence that States’ monopoly over the use of force is outdated.
Areas of opacity in international law
Cyberspace as the main area of competition between States
Generally speaking, before addressing any legal problem, it is necessary to understand the context within which the problem lies. To that end, it is pertinent to recall that cyberspace is a contested domain between States, as shown by many key political documents issued by the United StatesFootnote 14 and the North Atlantic Treaty Organization (NATO).Footnote 15 ChinaFootnote 16 and RussiaFootnote 17 have shown the same level of perception of the threat. Even reports on cyber attacks issued by private “big tech” companies seem to be inconclusive with regard to a clear understanding of today's conflicts in cyberspace. Looking to the Microsoft Digital Defense Report 2023, it is possible to find information on cyber attacks that, according to Microsoft, should be attributed to nation-State actors, primarily acting as proxies of Russia and China.Footnote 18 The report, however, gives no information about any alleged cyber attacks executed by Western States (or their proxies). Conversely, “[a] report jointly released by China's National Computer Virus Emergency Response Centre (CVERC) and Chinese cybersecurity company 360 revealed that the US’ Central Intelligence Agency (CIA) has been responsible for plotting ‘colour revolutions’ around the world”.Footnote 19
On the other hand, it is relevant to note that such competition has not had a spillover effect in other domains, at least so far. In order to corroborate this conclusion, it seems important to mention two examples. When Albania, a NATO member, declared itself to have been the target of cyber attacks orchestrated and sponsored by the Islamic Republic of Iran,Footnote 20 NATOFootnote 21 and its allies (including Albania) did not trigger the Article 5 collective self-defence clause. Notwithstanding this example, NATO doctrine does not rule out that option.Footnote 22 In the ongoing war between Russia and Ukraine, NATO and its allies are clearly supporting Ukraine, including with weaponsFootnote 23 and intelligence.Footnote 24 This support, however, does not include actions, such as launching an attack from NATO territory or enforcing a no-fly zone, that would bring NATO forces into direct conflict with RussiaFootnote 25 – but in the cyber domain, that clear red line does not seem as strict. To that end, it is worth nothing that, according to a European Union Agency for Cybersecurity report, “Ukraine's IT Army managed to target various entities and conducted mostly coordinated Distributed Denial of Services (DDoS) attacks but was not limited to such attacks”.Footnote 26 While Ukraine's IT Army is shrouded in a certain degree of mystery, it is safe to say that at least some of its activities have taken place from outside Ukraine.Footnote 27 As one scholar has pointed out, however, this situation “has to date not spurred any legal, ethical, nor political conversations on co-belligerency in cyberspace, the role of Ukrainian owned companies operating from NATO/EU member states, and their targeting of Russian civilian infrastructure in cooperation with the Ukrainian government”.Footnote 28 This concern seems justified in light of two concurring factors: (i) the due diligence responsibility requiring States not to allow their territory to be used for malicious cyber activities, and (ii) the fact that Russia has publicly drawn attention to cyber attacks having originated from NATO member nations.Footnote 29 Of course, as the same practice seems also to have been adopted by the Russian side,Footnote 30 any potential Russian démarche should be deprived of most of its value.
Cyberspace's state of intermediacy and the principle of distinction
Taking into account that the principle of distinction does not apply in peacetime, one may reasonably argue that this principle should not have a specific relevance, unless of course in cases of armed conflict or war. In such cases, States may indeed enjoy a broad discretion in relying on civilian agencies for forcible cyber operations, thereby upsetting the view adopted in this paper.
As shown above, cyberspace is one of main areas of competition between States. This does not mean, of course, that State competition is limited to cyberspace, but rather that competition in cyberspace is qualitatively different from competition in other domains. In other words, in land, sea, air and space, States are confronting each other only through means that may not be perceived as use of force, except, of course, for the rare situations when States have a clear intention to make war (i.e., animus belligerendi). In cyberspace, however, States are ready to confront each other, even executing – directly or via their proxies – cyber operations that may be perceived as (or confused with) the use of force. This is not an insignificant difference. At the end of the day, State competition is not a new phenomenon; as explained already in the past,
[b]etween the two extremes of “pure” peace and “total” war, the states of the world arena may in these terms be observed continuously to engage each other for power and other values, by all instruments of policy, in a continuum of degrees in coercive practices, ranging from the least intense to the most intense.Footnote 31
Current conflicts in cyberspace, however, differ from the past examples of limited use of force, because they have a permanent and persistent nature (temporal element) and their scope is not limited to a specific geographical area (spatial element). As argued by Jessup, “it has not infrequently been the practice of states to insist that they were not at war even when they were engaged in large-scale military operations against another state”.Footnote 32 Indeed, the examples suggested by Jessup in that respect – and the additional examples that can be proposed on the basis of subsequent State practice,Footnote 33 including the ongoing war between Russia and UkraineFootnote 34 – are characterized by a restricted animus belligerendi, coupled with limited temporal and spatial elements. Competition in cyberspace, instead, cannot be considered as traditional competition, since in this specific situation (recte in this specific situation only) States are employing instruments of policy that are almost indistinguishable from the instruments of policy that would characterize wartime. In other words, in waging ongoing, permanent low-intensity cyber warfare, States are showing a sort of animus belligerendi, at least from a qualitative – although not quantitative – point of view. Therefore, the principle of distinction in cyberspace – in the present author's opinion – should be interpreted in a broader way than in the other domains. In other words, the principle of distinction in cyberspace should be considered not only in wartime or in the context of an armed conflict, but also in the state of intermediacy.
Where do the opacities lie?
The lack of any significant spillover effect from cyberspace into the traditional domains in the confrontation between the State blocs is indeed very good news, but at the same time, it is reasonable to wonder why it is so. This ambiguous political attitude is workable due to a combination of reasons, some of which are inherent to some of IHL's structural features; other factors instead lie in some opacities of international law.
The fist element of opacity lies in the notion of direct participation in hostilities (DPH). To illustrate this conclusion, it is opportune to borrow some examples already proposed by a distinguished scholar:Footnote 35
(a) a distributed denial-of-service (DDoS) attack, or more complex ones, such as cyber operations aimed at disrupting assets or infrastructure;
(b) use of a smartphone application to report movements of enemy troops, vehicles or aircraft by uploading location-tagged images or videos; and
(c) provision of cyber threat intelligence (CTI) solutions to defend cyber infrastructure against cyber attacks.
Should civilians perform any of the cyber operations described above, a case-by-case assessment should be undertaken in light of DPH. In accordance with the International Committee of the Red Cross (ICRC) Interpretive Guidance on the Notion of Direct Participation in Hostilities under International Humanitarian Law (ICRC Interpretive Guidance),Footnote 36 it will be necessary to ascertain whether the following three cumulative conditions are satisfied: (i) threshold of harm, (ii) direct causation, and (iii) belligerent nexus. While the notion of DPH is outside of the scope of this paper (and so also is the overall discussion on the customary nature of the ICRC Interpretive Guidance), it is still important to make a few comments in this regard. The notion of DPH is broader than the concept of “attack”, so providing tactical intelligence is widely considered as a form of DPH.Footnote 37 Therefore, assuming that cyber operations under example (a) above will target military networks, thereby adversely affecting the military operations or military capacity of an adversary, it is reasonable to conclude that DPH could be satisfied. Conversely, examples (b) and (c) will more likely not be qualified as DPH, unless the information provided will be useful for the conduct and/or execution of a tactical military operation. Of note, should CTI solutions include “hack-back” operations, considerations made for example (a) will be applicable mutatis mutandis. Overall, in the case of the transmission of intelligence, the possibility of meeting DPH conditions cannot be ruled out, even if the transmission per se is not an operation implying physical damages. As a further complication, it is also important to recall that intelligence operations cannot be distinguished from military operations based only on their harmful nature. Military operations, in coherence with the notion of DPH, also comprise the operational preparation of the environment, which is instrumental to the future execution of a harmful operation.Footnote 38 This uncertainty, however, is not cyber-specific but is rather inherent to the nature of the notion of DPH.
There are, however, other opacities that are more cyber-specific. As a first opacity, the notion of use of force in cyberspace needs to be mentioned. According to the Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations (Tallinn Manual 2.0), “[a] cyber operation constitutes a use of force when its scale and effects are comparable to non-cyber operations rising to the level of a use of force”.Footnote 39 The said Tallinn Manual rule – which seems not widely disputedFootnote 40 – is too generic, and as such, it is unsettled as to where the threshold for the use of force in cyberspace is set. It cannot be ruled out that some cyber operations may eventually – and perhaps even unintentionally – cross such a threshold. On the other hand, as deterrence depends on the perceivable credibility of the willingness to use force in self-defence, whenever there is uncertainty on the threshold for the use of force, no effective deterrence can be achievedFootnote 41 because the lack of clarity incentivizes some States to remain just below the threshold in order to avoid escalation. Additionally, as a further complication, it is worth noting that self-defence in accordance with Article 51 of the United Nations (UN) Charter is limited to the case of an armed attack, i.e. the most grave forms of the use of force, as stated in the International Court of Justice's (ICJ) Nicaragua judgment.Footnote 42 In the case of cyber operations reaching the threshold for the use of force but not constituting an armed attack, an injured State will be entitled to apply countermeasures. In accordance with the 2001 Draft Articles on Responsibility of States for Internationally Wrongful Acts (DARSIWA), however, countermeasures “shall not affect the obligation to refrain from the threat or use of force as embodied in the Charter of the United Nations”.Footnote 43 Therefore, the injured State's reaction should not reach the same level of intensity,Footnote 44 thus depriving the injured State of proportionate response options, at least in theory. Without equating a proportional response with effective response, the above limitations certainly raise further questions about the relevant thresholds, and whether the deterrent effect of the legal rules is well calibrated with the currently prevailing interpretations.Footnote 45
The second opacity lies in Article 52 of Additional Protocol I to the 1949 Geneva Conventions (AP I). According to Article 52, “[c]ivilian objects shall not be the object of attack or of reprisals”. The notion of “object” contained in that article, as argued by the Tallinn Manual 2.0, “is not to be interpreted as including data, at least in the current state of the law”.Footnote 46 Thus, the majority of Group of Experts that drafted the Tallinn Manual 2.0 concluded that “an attack on data per se does not qualify as an attack”, although they agreed that “a cyber operation targeting data may sometimes qualify as an attack when the operation affects the functionality of cyber infrastructure or results in other consequences that would qualify the cyber operation in question as an attack”.Footnote 47 This narrow interpretation of the notion of “object” may also have practical implications, as it could pave the way for the political and social perception that cyber operations are less harmful than traditional combat operations.
The third opacity is the definition of espionage under international law. While espionage is explicitly recognized in times of armed conflict, in peacetime (and in a state of intermediacy as well), the scope of “espionage” is disputed. As any clear definition of espionage is lacking in treaty law, States, with a view to avoiding legal constraints, could be tempted to style/label cyber operations as unacknowledged intelligence operations rather than as military operations.Footnote 48 This opacity, a fortiori, is relevant because the distinction between intelligence and military operations/activities is inherently highly controversial in the cyber domain, as often the same malware can be used for theft, for spying or for causing damage/malfunctions.
The fourth opacity lies in ICJ case law on States’ responsibility for non-State actors' conducts. Consistent with the Nicaragua judgment,Footnote 49 attribution of cyber operations by non-State actors requires that the sponsoring State had effective control of the operations during which the alleged violations were committed. Lacking such effective control, non-State actors remain responsible for their acts, while the sponsoring State will not be responsible for the acts of the non-State actors, but for its own conduct vis-à-vis the injured State. Therefore, covert operations resulting in financial support, training, or supply of weapons, intelligence and logistic support to non-State actors could constitute a breach of the principle of non-intervention, but may not be sufficient for establishing a violation of the prohibition on the threat or use of force. As a consequence, covertly promoting non-State actors – including “patriotic hackers”, criminal gangs or even tech companies – in order to conduct cyber operations will most likely not implicate the responsibility of the sponsoring State, at least with regard to the prohibition on the threat or use of force. In other words, in the case of non-State actors conducting malicious cyber operations, the sponsoring State will likely not risk provoking a reaction in self-defence by the injured State or collective self-defence also involving the allies of the injured State. It might be thought that whenever a State gives support to non-State actors, it is performing an activity that is opaque in itself, and that therefore we are not facing a cyber-specific opacity, but this seems to be only partially true. In the cyber domain (recte in the cyber domain only), a State might provide support to a non-State actor, even if the latter is not extraterritorially based. In other words, while in the physical domain a non-State actor needs to be deployed on the territory of a State in order to affect that State, in the cyber domain this is optional. As a consequence, a State can be injured by malicious cyber operations executed by a non-State actor that is not based inside its territory. This specific feature makes cyber operations by non-State actors both more difficult to be addressed (from the injured State's perspective) and easier to be supported (from the sponsoring State's perspective).
The fifth opacity can be found in some structural features of the law of State responsibility. As is well known, “[q]uestions of evidence and proof of [a breach of an international obligation] fall entirely outside the scope” of the DARSIWA.Footnote 50 Therefore, unless a breach of an international obligation is brought to an international court or arbitration proceeding that will adjudicate the case in accordance with its rules of procedure, no fixed standard for burden of proof that a State shall meet for attribution can be found in general international law. Consequently, any response to malicious cyber operations is inherently controversial because of the complexities related to attribution. No one can fail to see that this is not a cyber-specific problem, but cyberspace further exacerbates the existing issue. Moreover, in physical domain, whenever the attribution is contentious, the discussion over attribution has often been circumvented by applying Article 11 of the DARSIWA on conduct acknowledged and adopted by a State as its own. In the case of cyberspace, however, States have so far been quite hesitant to apply Article 11 of the DARSIWA, although this possibility should not be ruled out.Footnote 51
Mitigation measures
In order to foster stability in cyberspace, tackling the identified opacities would be beneficial. This section will thus propose some mitigation measures, although some of them might not be easily achievable under current international law.
It is worth noting that one mitigation measure to manage the uncertainty surrounding the use of force threshold is known as the cumulative effect theory. This theory, expressly endorsed by NATO,Footnote 52 implies the possibility of considering as an armed attack a series of malicious cyber activities which otherwise, considered in isolation, would not have been considered as an armed attack. Notably, in the author's opinion, consistency with the cumulative effect theory may further corroborate the need to apply the principle of distinction in cyberspace, even before the eruption of an armed conflict (i.e., in the state of intermediacy). In the end, if States are inclined to consider as an armed attack a series of malicious cyber activities which otherwise would not have been considered so, it would be reasonable to apply to each of those malicious cyber activities the principle of distinction, as if the armed conflict had already started. The cumulative effect theory alone, however, is not completely effective. As shown above by the example of cyber attacks against Albania, States, at least so far, have been quite reluctant to apply the theory in practice. Although understandable given that the concrete application of the cumulative effect theory could lead to an escalation to an armed conflict not limited to the cyber domain, this reluctance may nevertheless make the theory itself less credible. So, in the case of cyber operations below the threshold for the use of force, deterrence might be achieved by mainly relying on countermeasures, including especially countermeasures by a plurality of injured States or on behalf of an injured State (i.e., collective countermeasures). Countermeasures, however, are still only perceived as a remedy available to an individual State, and the legitimacy of collective countermeasures is disputed.Footnote 53
With reference to the notion of “object”, the situation is not particularly encouraging. Although the aforementioned Tallinn Manual 2.0 position may be considered unsatisfactory, it cannot be denied that it follows the traditional intent of the drafters of AP I, as well as the language of the latter.Footnote 54 Therefore, a new notion of “object” for cyber warfare should require either the agreement on a new treaty provision or consistent State practice supporting an updated interpretation of the relevant provision of AP I, considering developments in ICT.
Concerning the definition of espionage under international law, it would be sufficient to apply the already existing legal provisions, as well as enforcing the principle of distinction under IHL. Both arguments will be analyzed in the following sections.
As seen above, existing ICJ case law is one important factor that may contribute to States’ support to – and reliance on – non-State actors for certain cyber operations. The likelihood of changing the ICJ effective control test, however, seems very low. On the one hand, that test has been confirmed in ICJ case law subsequent to the Nicaragua case, in the Genocide judgment.Footnote 55 On the other hand, the high threshold of the effective control test has been one reason for avoiding the attribution to the United States for the acts committed against Nicaragua by the Contras, a CIA-supported militia. Thus, unless an agreement with the Russian/Chinese bloc can be found, the ICJ is not likely to be willing to change its settled case law. If changed, it would most probably be perceived as a double standard.
Finally, questions of evidence and proof of a breach of an international obligation of a State cannot be changed through an adaptive reading of the existing legal framework. This conclusion indeed takes into account the fact, clearly shown in the ongoing war between Russian and Ukraine, that the UN Security Council is unable to effectively handle conflicts involving one permanent member of the Council. A mitigation measure, instead, would require new rules, potentially including compulsory arbitration. Currently, it is unlikely that any agreement in that respect can be reached in the near future.
Definition of espionage under international law
What does it mean to spy?
With respect to espionage, the Tallinn Manual 2.0 argues that “although peacetime cyber espionage by States does not per se violate international law, the method by which it is carried out might do so”.Footnote 56 Even assuming that customary international law does not prohibit espionage per se, the statement appears equivocal, unless a clear definition of espionage is provided.Footnote 57 In a peacetime situation, three possible scenarios should be considered. The first of these is cyber operations causing physical damage. These operations, as seen above, should be considered as a use of force and as such should be almost undisputedly considered unlawful, primarily as a violation of the prohibition on the use of force and a violation of sovereignty.Footnote 58 As a corollary, cyber operations causing physical damage cannot be considered (or justified) as part of espionage operations. The second scenario consists of cyber operations – below the use of force thresholdFootnote 59 – causing loss of functionality. In this scenario, there are different legal opinions. According to the Tallinn Manual 2.0,
the Experts agreed that, in addition to physical damage, the remote causation of loss of functionality of cyber infrastructure located in another State sometimes constitutes a violation of sovereignty, although no consensus could be achieved as to the precise threshold at which this is so due to the lack of expressions of opinio juris in this regard.Footnote 60
The third scenario involves cyber operations aimed at exfiltration of data and causing neither physical damage nor the loss of functionality. In that respect, the Tallinn Manual 2.0 explains that “no consensus could be achieved as to whether, and if so, when, a cyber operation that results in neither physical damage nor the loss of functionality amounts to a violation of sovereignty”.Footnote 61
Therefore, while the third scenario clearly falls within the scope of espionage, it is not immediately obvious – and therefore calls for a detailed examination – whether the second scenario may also fall within the scope of espionage. In other words, for the purposes of this article, it is a relevant question to discuss whether cyber operations causing a loss of functionality (except for de minimis consequencesFootnote 62) could be, vel non, justifiable as falling within the notion of (peacetime) espionage,Footnote 63 or otherwise should be considered as unlawful, as a violation of sovereignty or as a prohibited intervention. It is outside of the scope of this article to discuss the question of whether cyber operations aimed at exfiltration of data and causing neither physical damage nor the loss of functionality might be, vel non, legally justifiable. As will be explained, espionage should be understood as only comprising information-gathering,Footnote 64 thereby excluding from the notion of espionage cyber operations causing a loss of functionality (except for de minimis consequences). To corroborate such a conclusion, espionage in its various facets will be analyzed.
Wartime espionage
To begin with, in order to understand the complexity surrounding wartime espionage, it is opportune to recall the following extract from Oppenheim:
[A]rticle 24 of the Hague Regulations now enacts the old customary rule that a belligerent has a right to employ all methods necessary to obtain information, and these methods include espionage and treason. But this right stands face to face with the right to consider and punish as war criminals enemy individuals, whether soldiers or not, committing acts of espionage or treason. There is an irreconcilable conflict between the necessity of obtaining information on the one hand, and self-preservation on the other; and accordingly espionage and treason bear a twofold character. On the one hand, International Law gives a right to belligerents to make use of espionage and treason. On the other hand, the same law gives a right to belligerents to consider espionage and treason, committed by enemy soldiers or enemy private individuals within their lines, as acts of illegitimate warfare, and consequently punishable.Footnote 65
In addition, still relying on Oppenheim, it is opportune to recall that
[e]spionage must not be confounded, firstly, with scouting, or secondly, with despatch-bearing. According to article 29 of the Hague Regulations, espionage is the act of a soldier or other individual who clandestinely, or under false pretences, seeks to obtain information concerning one belligerent in the zone of belligerent operations with the intention of communicating it to the other belligerent. Therefore, soldiers not in disguise, who penetrate into the zone of operations of the enemy, are not spies. They are scouts who enjoy all privileges of the members of armed forces, and they must, if captured, be treated as prisoners of war.Footnote 66
The Hague Regulations, however, do not provide a clear legal definition of espionage. Nonetheless, as argued by the Commentary on the Additional Protocols to the 1949 Geneva Conventions,Footnote 67 “by giving a sufficiently precise description of those who shall not be considered as spies, it is possible to deduce the constitutive elements of espionage in any specific case, by means of a contrario reasoning”.Footnote 68 Therefore, on the basis of Article 29 of the Hague Regulations defining the requirements to be considered a spy, it is possible to conclude that espionage should be limited to seeking to obtain information in the zone of operations with the intention of communicating it to the enemy, acting secretly, in disguise or under false pretences.Footnote 69
Notably, wartime espionage is subjected to a narrow territorial scope, as it is limited to enemy-controlled territory. So, as suggested by the Tallinn Manual 2.0, “cyber spying will most likely occur as a close access cyber operation”.Footnote 70 Conversely, cyber (wartime) espionage performed from outside enemy-controlled territory should be outside of the scope of the rule on wartime espionage.Footnote 71 In the end, from a practical point of view, as remote cyber espionage would often not be qualified as wartime espionage, the chance to apply Article 29 of the Hague Regulations to cyber operations is likely overstated nowadays.
In the end, for the purposes of this article, it is relevant to conclude that, in times of war, to constitute espionage in accordance with Article 29 of the Hague Regulations, the actual conduct/actus reus must be limited to information-gathering in disguise in the enemy controlled territory. In other words, even accepting the narrow definition of “object” in cyber warfare mentioned above, in the event of damage or loss of functionality caused as an effect of a cyber espionage operation, the cyber operation should be considered outside of the definition of espionage (except for de minimis consequences). As recalled in the Tallinn Manual 2.0, “[b]y styling a cyber operation as a ‘cyber espionage operation’, a State cannot therefore claim that it is by definition lawful under international law”.Footnote 72
Peacetime espionage
Legal opinion on espionage during peacetime is not unanimous, although the majority view appears inclined to consider that espionage does not per se violate international law. This means that espionage is neither legal nor illegal, and so the method by which it is carried out might similarly be neither legal nor illegal.Footnote 73 Such positions rely also on the fact that no treaty explicitly forbids espionage. Be that as it may, it is also true that peacetime espionage cannot be easily equated to wartime espionage, because the States concerned are not necessarily enemies, and they may even be allies. This factual situation may induce States to self-restrain their reaction towards espionage, thereby giving the impression that espionage is considered lawful, even when the conduct/actus reus is performed inside the territory of the spied-upon State.Footnote 74
Conversely, in cases of intelligence agencies having carried out (inside the territory of the injured State) activities other than intelligence-gathering, an injured State has been considered, with no major discussion, entitled to legitimately complain.Footnote 75 It is true that practice has also shown that complaints by injured States in cases of unlawful activities conducted inside their respective territories, performed by foreign intelligence services, are far from being the general rule.Footnote 76 The fact that injured States have not always taken steps against the injuring State after a violation of international law, however, cannot be interpreted as evidence that such violations did not occur. Indeed, as is well known in criminal law, the fact that the prosecution of a crime may be conditional upon a complaint by the victim does not make the conduct of such crime lawful, should the complaint not be filed.
Locus commissi speculationis: The case of remote cyber espionage
At the beginning of the conquest of outer space, the USSR attempted to qualify observation from space for the purposes of collecting intelligence as illegal.Footnote 77 Subsequent State practice, however, has not followed this view. With specific reference to espionage in the cyber domain, it is difficult, at this stage, to predict whether State practice will follow the same evolution of space espionage. Some South American StatesFootnote 78 (particularly BrazilFootnote 79), the African UnionFootnote 80 and the European CommissionFootnote 81 firmly opposed cyber espionage, while the majority of States seem reluctant to take any position, with the remarkable exception of the United States.Footnote 82 Even looking to the Tallinn Manual 2.0 is not particularly helpful as only cyber espionage conducted from inside the territory of the spied-on State is considered a violation of sovereignty.Footnote 83 Conversely, the Manual notes that “[t]he Experts were incapable of achieving consensus as to whether remote cyber espionage reaching a particular threshold of severity violates international law”.Footnote 84 That said, the Manual seems to be indirectly supporting a permissive approach.Footnote 85
It is true that some restrictions on remote espionage can be found in soft law and only in cases of economic espionage.Footnote 86 However, in practice and at the current stage, these restrictions seem not to have changed the understanding of espionage. In that respect, it is sufficient to recall the recent (October 2023) Skvortsov case of the Stockholm District Court.Footnote 87 According to the charge, Mr Skvortsov set up a platform for transferring technology to Russia, circumventing sanctions, in order to increase Russia's military capabilities. The District Court acquitted the defendant – although it found that the latter had largely acted in the way that the prosecutor claimed – because “[n]othing has emerged other than the activity having been solely intended for technology acquisition, and not aimed at obtaining information that could constitute espionage”.Footnote 88
Human rights might impose some limitations on remote cyber espionage. This may occur in two different ways: (a) expanding the notion of territorial jurisdiction in case of remote cyber espionage, and (b) tackling transnational dissident cyber espionage.Footnote 89
On point (a), it is worth recalling that, according to the Tallinn Manual 2.0, human rights
appl[y] to all persons on a State's territory irrespective of where the State's cyber activities that implicate the human right in question occur. For instance, a State's human rights law obligations attach when the communications of an individual who is located in its territory are intercepted abroad by that State or when the State acquires access to the individual's data that is stored electronically beyond its borders.Footnote 90
Thus, the Tallinn Manual 2.0 seems to frame the question of cyber remote espionage taking as its centre of gravity the effect over the affected individual, rather than the location where the cyber operations are executed. Therefore, the Manual considers cyber remote espionage as a question of extraterritorial human rights jurisdiction. In that respect, the Manual takes no definitive position on the possibility of considering remote cyber espionage as a form of effective control,Footnote 91 thereby triggering human rights courts’ extraterritorial jurisdiction. European Court of Human Rights (ECtHR) case law, however, seems to suggest otherwise. In the case of Wieder and Guarnieri v. The United Kingdom, the ECtHR held that interception, extraction, filtering, storage, analysis and dissemination of communications of the applicants – when the latter were based outside of British territory – by the UK intelligence agencies could constitute a human rights violation. More specifically, with regard to the scope of its jurisdiction, the Strasbourg Court pointed out that “the interference with the applicants’ rights under Article 8 of the Convention took place within the United Kingdom and therefore fell within the territorial jurisdiction of the respondent State”.Footnote 92 Notably, while some States, in primis the United States, may not necessarily follow ECtHR case law, it is true that other tribunals may concur with the Strasbourg Court.Footnote 93
On point (b), we can mention the British cases of Ghanem Al-Masarir v. Kingdom of Saudi ArabiaFootnote 94 and Shehabi and Anor v. Kingdom of Bahrain,Footnote 95 where the High Court affirmed its jurisdiction over the claims of dissidents for the damages suffered as a result of cyber espionage conducted, respectively, by Saudi Arabia and Bahrain. In other words, the British court denied that Saudi Arabia and Bahrain were immune from UK jurisdiction pursuant to the State Immunity Act of 1978 with respect to cyber espionage over dissidents, when the latter were based inside British territory. However, we cannot fail to notice that US case law, in the same situation, has taken an opposite stance and affirmed that the Foreign Sovereign Immunities Act bars plaintiffs’ claims for damages suffered as a result of cyber espionage.Footnote 96 The judicial decisions of the US judiciary over dissident cyber espionage, of course, are without prejudice to US promotion of voluntary and non-legally binding principles to counter the proliferation and misuse of commercial spyware.Footnote 97
That said, US practice concerning the prosecution of espionage in the cyber domain seems to deviate from traditional practice. American case law, for quite some time, has allowed the prosecution of espionage committed extraterritorially, provided the criminal conduct was committed, at least in part, on the territory of a third country.Footnote 98 In other words, espionage entirely conduced from the territory of the spying State was not prosecuted. In cases of espionage in the cyber domain, however, the US has issued indictments charging Russian intelligence officers, operating from Russian territory, for attempting, supporting and/or conducting computer intrusions targeting critical infrastructures,Footnote 99 as well as executing computer intrusions and attacks intended to support Russian government efforts to undermine, retaliate against or otherwise destabilize the United States as well as foreign countries other than the United States.Footnote 100
Peacetime cyber espionage: Interim conclusion
All in all, although at this stage it would appear premature to come to a definitive conclusion on the legality, vel non, of remote cyber espionage, it is safe to say that it should be limited to information-gathering. This means that cyber operations causing a loss of functionality (except for de minimis consequences) should be removed from the espionage definition. In addition, it is not insignificant to notice that some States, although reluctant to acknowledge openly the legality of espionage, seem open to accepting the possibility of cyber reconnaissance (i.e., the use of cyber capabilities to obtain information about activities, information resources or system capabilities) for securityFootnote 101 or law enforcement reasons.Footnote 102 In the end, uncertainty surrounding espionage may – at most – allow us to consider as lawful (rectius not unlawful) cyber reconnaissance measures regardless of the consent of the territorial State concerned, but not cyber operations causing loss of functionality (except for de minimis consequences). Notably, this proposed approach also seems consistent with the limited national case law available.Footnote 103
Why is espionage so “attractive”?
At the end of this part of the article, it is opportune to try to comprehend why States seem particularly inclined to style/label cyber operations as intelligence operations, thereby relying on civilian intelligence agencies for their execution, including beyond mere intelligence-gathering. This question is not a mere pretext, since, generally speaking, civilian intelligence agencies’ primary missions/tasks are intelligence-gathering, counter-espionage and analysis. Therefore, in cyberspace (recte in cyberspace only), States practice seems to support a broader remit for civilian intelligence agencies.
To understand States’ preference in favour of civilian intelligence agencies, it is necessary to recall the concepts of covert action and clandestine operations. These two concepts can be summarized as follows: “clandestine operations are designed to be secret in the sense that the operators take action to avoid detection. In contrast, covert actions are unacknowledged in the sense that the deploying government refuses to admit that the actors are working on behalf of the State.”Footnote 104 While clandestine operations are generally understood as usual and traditional response options available to military forces, covert actions are instead part of the legal framework applicable to civilian intelligence agencies only. The latter consideration, of course, is without prejudice to the possibility of also employing military assets for covert actions – should that be the case, however, military forces will not follow the usual war powers procedure, but rather the applicable law on intelligence. While the details differ from each national legal system to the next, from a practical point of view, relying on the law on intelligence, rather than war powers, allows governments broader freedom of action. Generally speaking, domestic law on intelligence has a more narrow scrutiny and a different timing for parliamentary oversight compared to war powers. In the case of military operations in accordance with war powers, these generally require ex ante (or nearly ex ante) approval by the parliamentary plenary assembly. In the case of covert actions authorized on the basis of domestic law on intelligence, however, the Executive is merely requested to notify – ex post and in a confidential manner – a selected committee of the parliament about the actions. A few examples in this regard seem opportune here.
As a derogation from the War Powers Resolution of 1973 – which aims to check the Executive Branch's power when committing US military forces to an armed conflict – a special provision for cyber operations has been adopted in the United States. US Code §394 (inserted within Title 10) establishes that
[t]he Secretary of Defense shall develop, prepare, and coordinate; make ready all armed forces for purposes of; and, when appropriately authorised to do so, conduct, military cyber activities or operations in cyberspace, including clandestine military activities or operations in cyberspace, to defend the United States and its allies, including in response to a malicious cyber activity carried out against the United States or a United States person by a foreign power.
With regard to congressional oversight, US Code §394 establishes that “[t]he Secretary shall brief the congressional defense committees about any military activities or operations in cyberspace, including clandestine military activities or operations in cyberspace, occurring during the previous quarter”.Footnote 105 In summary, as pointed out by some scholars, the US Congress “has given the green light for military cyberspace operations to ‘go dark’”,Footnote 106 enacting for the US Armed Forces a dedicated legislation for cyber operations, mirroring the already existing domestic legal framework applicable to the Central Intelligence Agency (CIA) (i.e., Title 50 of the US Code and specifically §3093 on covert actions).
In France, Article 2321-2 of the Code de la Défense, in order to respond to a cyber attack targeting information systems affecting the war or the economic potential, security or survival capacity of the nation, allows the agencies designated by the prime minister (i.e., intelligence agencies and the French Armed Forces as well)Footnote 107 to perform the technical operations necessary to classify the attack and to neutralize its effects by accessing the information system from which the attack originated. Measures adopted pursuant to Article 2321-2, however, fall outside the parliamentary prerogatives set out in Article 35 of the French Constitution.Footnote 108
A similar law has been adopted in Italy as well: Decree-Law No. 115 of 9 August 2022 grants the Italian prime minister the authority to authorize the adoption of counter-intelligence measures in cyberspace (i.e., offensive cyber operations/“hack-back”).Footnote 109 According to the Decree-Law, an implementing regulation issued by the prime minister, having sought the opinion of the Joint Parliamentary Committee for the Security of the Republic, defines the content of the counter-intelligence measures in cyberspace. Notably, such an implementing regulation is not required to be published, so it is not publicly available. From a procedural point of view, however, the text of the Decree-Law clarifies that counter-intelligence measures in cyberspace shall be executed by the intelligence agencies, eventually in cooperation with the Italian Armed Forces. The execution of counter-intelligence measures in cyberspace is decided by the prime minister on his own and is communicated to the Joint Parliamentary Committee for the Security of the Republic within thirty days of the date of conclusion of the operations. This means that counter-intelligence measures in cyberspace do not require ex ante parliamentary approval pursuant to Law No. 145 of 21 July 2016, as in the case of military deployment abroad.Footnote 110
Finally, even British practice seems to confirm the impression that cyber operations are perceived as intelligence operations and, as such, the relevant domestic legal framework on intelligence is applied. In the UK, the National Cyber Force (NCF) has been established as a “partnership between defence and intelligence”.Footnote 111 From a legal point of view, “[o]perations conducted by NCF are subject to rigorous governance and are consistent with all UK and international law, including international humanitarian law when applicable”.Footnote 112 From a domestic point of view, NCF operations are conducted in line with the intelligence legal framework, i.e. the Intelligence Services Act of 1994, the Regulation of Investigatory Powers Act of 2000 and the Investigatory Powers Act of 2016.Footnote 113
Can a State employ civilians to take direct part in hostilities?
The previous section concluded that the notion of espionage might have limited application for justifying cyber operations, beyond information-gathering. The aim of this section is to corroborate the position that civilian intelligence agencies cannot be employed by States for combat cyber operations. This point, however, demands a premise aimed at defining the notion of combat operations. As stated above, intelligence-gathering, in the case of information useful for the conduct and/or execution of a tactical military operation, should be considered as DPH. As the discussed legal provision on wartime espionage does not preclude civilians from carrying out such activity, those civilians possibly involved in it can be attacked for such time as they are directly engaged in such activity. On the other hand, DPH is broader than intelligence-gathering for tactical purposes. Therefore, for the purposes of this article, the notion of combat operations, including in the cyber domain, should be construed as close to the concept of hostilities, meaning “acts of violence by a belligerent against an enemy in order to put an end to his resistance and impose obedience”.Footnote 114 Those acts of violence, in the context of the cyber domain, should not, in the opinion of the present author, be limited to those implying physical consequences but should also comprise acts that may rest in the cyber domain causing loss of functionality. This position, although not fully settled as seen above, seems consistent with the need to consider espionage as limited to information-gathering only.
Extensive literature has addressed the question of civilians’ direct participation in hostilities. According to Baxter,Footnote 115
[c]landestine activities in warfare are not confined to the work of the spy, the armed guerrilla, and the franc-tireur. Sabotage, intelligence activities other than espionage, propaganda, and psychological warfare may also be carried [out] by civilians or disguised military personnel, and their importance, by comparison with hostilities in arms, has become so great that partisan warfare has been given the name of “sabotage with violence”.Footnote 116
For the purposes of the present article, however, the question to be discussed is slightly different. We are not discussing whether civilians can take part in hostilities, a question that is perhaps less clear than it may appear at first glance.Footnote 117 Instead, we are going to analyze whether a State can directly employ civilians taking part in hostilities. Therefore, the present article is not aimed at criticizing Baxter's view. It seems safe to say that Baxter considered it lawful for civilians to perform not only espionage but also other clandestine activities other than espionage, such as sabotage. This reasonable conclusion, however, should not necessarily be read as implying that Baxter was also supporting the possibility of States directly employing civilians to perform intelligence activities other than espionage, such as combat functions.
The CIA's “drone war” on terrorism
The Barron Memorandum
The first relevant document to discuss is the so-called Barron Memorandum on the applicability of federal criminal laws and the Constitution, which contemplated lethal operations against Shaykh Anwar al-Aulaqi,Footnote 118 issued by the Office of Legal Counsel of the US Department of Justice. The Barron Memorandum is particularly relevant since the previous Congress oversightFootnote 119 with respect to the CIA's “drone war” on terrorism had cast some doubts on its legality.Footnote 120 The Memorandum analyzed the legality of the use of drones. This assessment was not limited to international law, as it also – and mainly – addressed the question from a domestic legal point of view (i.e., federal criminal laws and the Constitution). In short, the Memorandum considered the use of drones lawful, in accordance with the “public authority justification, which can render lethal action carried out by a governmental official lawful in some circumstances”.Footnote 121 Additionally, the Memorandum clarified that the public authority justification “would be available because the operation would constitute the ‘lawful conduct of war’”.Footnote 122
Notably, the Barron Memorandum distinguished the position of the Department of Defense from the position of the CIA, although in both cases it reached the same conclusion. Unfortunately, the part of the Memorandum concerning the CIA has not been fully disclosed, so it is difficult to understand and comment on the reasoning of the Memorandum in that respect. In any event, the disclosed footnote 44 may still be relevant for the present article. In particular, this footnote points out two arguments:Footnote 123 firstly, the mere fact that CIA personnel were involved in a drone strike is not per se a violation of the law of war, although CIA personnel could not enjoy immunity from prosecution under the domestic law of the countries where the strike occurred;Footnote 124 and secondly, any reference to the Supreme Court’s decision in Ex parte Quirin, 317 U.S. 1 (1942) – “suggesting that passing through enemy lines in order to commit ‘any hostile act’ while not in uniform ‘renders the offender liable to trial for violation of the laws of war’” – is not conclusive, as it was not clear whether the Court intended to refer only to conduct that would constitute perfidy or treachery. In any event, even though the Supreme Court’s decision in Ex parte Quirin should be interpreted in the sense that any hostile acts performed by unprivileged belligerents are per se violations of the laws of war, such a conclusion lacks clear support and State practice.Footnote 125
The Targeted Killing in Pakistan case
Discussions over the legal implications stemming from the CIA's “drone war” on terrorism were not confined to the United States, as the German Federal Public Prosecutor was forced to open a criminal case in response to press reports about a drone operation in which German citizens had allegedly been killed. After the investigation, the Prosecutor dismissed the case on the basis of a reasoned decisionFootnote 126 which was not further validated/approved by an independent judge (such validation/approval is not required by German procedural law). For the purposes of this article, however, it is sufficient to mention just one of the conclusions of the Prosecutor's decision, which is that the latter argued that CIA operatives who were exercising operational responsibility for the aerial drone deployments should have qualified as armed forces for the purposes of the law of non-international armed conflict.Footnote 127
States’ reliance on civilians for combat operations
With respect to the possibility of relying on civilians to wage war, it should be noted that the only piece of legislation expressly precluding States from employing civilians in that respect is the Paris Declaration Respecting Maritime Law of 16 April 1856,Footnote 128 which prohibits privateering. The Paris Declaration, however, has been not ratified by many States (including the United States), and its capacity to reflect a customary international prohibition on privateering has been questioned by some scholars.Footnote 129
To shed some light on the doubtful question of States’ reliance on civilians for combat operations, it seems opportune to spend a few words on the definition of combatants and prisoners of war (PoWs). As pointed out by the Commentary on AP I, with regard to combatant and PoW status in guerrilla warfare,
the law of The Hague coped rather well during 1939–1945, so as to survive virtually intact, even at the end of the Diplomatic Conference of 1949. Hundreds of thousands, if not millions of resistance fighters opposed the occupying armies in Europe and elsewhere, often with nothing more than makeshift equipment at their disposal, but the Hague Regulations were not, on the whole, seriously shaken thereby.Footnote 130
During the negotiations on Article 43 of AP I, there was an attempt to enlarge the criteria for recognizing as lawful combatants even subjects/people who are not part of the regular armed forces.Footnote 131 This was done in order to deal with wars of national liberation and conflicts for self-determination, in which guerrilla fighters could not distinguish themselves from the civilian population during their military operations and still retain any chance of success. In that respect, the text finally
restated the obligation of the guerrilla fighter to distinguish himself clearly from the civilian population, but limited that requirement to that part of the time in which he was conducting his military operations and accepted as an adequate minimum sign of distinction the carrying of arms openly.Footnote 132
So, it should not be contentious that AP I was only aimed at regulating guerrilla fighters in cases of internal (non-international) armed conflict. The drafters of Article 43 of AP I had envisioned fighters autonomously organized in the context of wars of national liberation or occupation of their national territory by a foreign aggressor. Following a historical and teleological interpretation, nothing suggests that AP I was aimed at giving States the right to employ civilians for combat operations. In addition, the logical and coherent interpretation of IHL implies that States should not directly employ civilians for combat functions, including, of course, in the cyber domain. To that end, recalling the Commentary on AP I is helpful. The Commentary, speaking about guerrillas, clearly points out, firstly, that
any concept of a part-time status, a semi-civilian, semi-military status, a soldier by night and peaceful citizen by day, also disappears. A civilian who is incorporated in an armed organization … becomes a member of the military and a combatant throughout the duration of the hostilities (or in any case, until he is permanently demobilized by the responsible command …), whether or not he is in combat, or for the time being armed.Footnote 133
Secondly, the Commentary states that
[a]ny interpretation which would allow combatants as meant in Article 43 to “demobilize” at will in order to return to their status as civilians and to take up their status as combatants once again, as the situation changes or as military operations may require, would have the effect of cancelling any progress that this article has achieved.Footnote 134
Thus, there is no plausible reason to allow States to directly employ civilians for combat cyber functions, since their employment, in practice, would have precisely the effect of allowing a situation that IHL seeks to prevent. It is true that the Additional Protocols – and their Commentary as well – do not explicitly preclude States from directly employing civilians for combat functions. To support the proposed view, it is pertinent to discuss Article 43(3) of AP I in conjunction with Article 43(7). On one hand, Article 43(3) recognizes that “there are situations in armed conflicts where, owing to the nature of the hostilities an armed combatant cannot so distinguish himself”. As can be inferred from the travaux preparatoires and the provision's drafting history, “[t]hat exception recognized that situations could occur in occupied territory and in wars of national liberation in which a guerrilla fighter could not distinguish himself [from the civilian population] throughout his military operations and still retain any chance of success”Footnote 135. Coherently with the exceptional nature of the Article 43(3), the subsequent paragraph 7 of the same article further clarifies that “[t]his Article is not intended to change the generally accepted practice of States with respect to the wearing of the uniform by combatants assigned to the regular, uniformed armed units of a Party to the conflict”. Thus, precluding States from directly employing civilians for combat cyber functions is simply the only reasonable interpretation that does not deprive the mentioned paragraph 7 of all practical effect. This is of course without prejudice to the possibility of also applying Article 43(3) to “regular” armed forces, “though only under the same exceptional circumstances as for members of so-called guerrilla forces”,Footnote 136 such as “advisers assigned to certain resistance units”.Footnote 137 Article 43(3), which allows the incorporation of paramilitary or law enforcement agencies into the regular armed forces provided that a notification requirement to the other parties is fulfilled, also supports the view that States should not be allowed to directly employ civilians for combat cyber functions. While it may be true that “the notification does not seem to be a constitutive element of the status of the units concerned”,Footnote 138 this cannot be interpreted as forfeiting the notification requirement as such. From a systematic point of view, should a government be free to employ civilian intelligence agencies for combat cyber operations, the said notification requirement for the incorporation of paramilitary or armed law enforcement agencies into the regular armed forces would not have any raison d’être. In other words – vis-à-vis States’ relationships – failing to fulfil the notification requirements should be considered as a breach of IHL. Conversely, in case of application of the same provision by a State vis-à-vis an individual, the lack of notification should not deprive an individual of the protection afforded by IHL.
Of course, not allowing States to directly employ civilians for combat functions does not mean that States – including governments in exile or States partially occupied by an aggressor State – should also be precluded from providing weapons or political, financial and logistic support to guerrilla and resistance movements, including in the cyber domain, as in the case of the Ukrainian IT Army. From a law of State responsibility perspective, as long as support to a non-State actor is below the (high) threshold of effective control,Footnote 139 the supporting State cannot be held responsible for the actions of a non-State actor.Footnote 140 We are aware that the settled ICJ case law on the law of State responsibility – particularly the effective control test – might appear contradictory with IHL, particularly with Article 91 of AP I (according to which a belligerent party shall be responsible for all acts committed by persons forming part of its armed forces) in conjunction with Article 43(1) of AP I (according to which guerrilla and resistance movements shall fall within the notion of armed forces belonging to a belligerent party). Indeed, this is precisely the situation here. Nevertheless, as rightly argued by Milanovic, Article 91 is not necessarily to be interpreted as meaning that the conduct of guerrilla and resistance movements should be attributable to the State, as “it could just as easily mean that the State is responsible for failing to properly supervise the group and ensure respect for IHL, that is, for failing to discharge a positive obligation of due diligence”.Footnote 141
Precluding States from employing civilian intelligence agencies (and even more so, of course, private contractors) for combat cyber operations is also consistent with Article 58 of AP I on precautions against the effects of attacks.Footnote 142 With this provision, as explained by the Commentary,
States have subscribed here to a triple duty to act, which must imperatively be translated into instructions to be given, and first of all into measures to be taken already in peacetime, even though, strictly speaking, the article is only addressed to Parties to a conflict. Some of these measures have a preventive or precautionary character since they are concerned with preventing the construction of certain buildings in particular places, or removing objectives from an area where such buildings are located, or otherwise separating the population and their homes from dangerous places.Footnote 143
Therefore, the practical location of military cyber forces and civilian intelligence agencies within the same premises – which is a concrete precondition usually needed to employ civilians for combat cyber operations – seems hard to reconcile with the provision on precautions against the effects of attacks.Footnote 144 In addition, practical – and permanent – location of military cyber forces and civilian intelligence agencies within the same premises would also render almost inapplicable the provision on civilian DPH limiting the “targetability” of civilians only to such time as they take direct part in hostilities.
If we look to the law of naval warfare, the conclusion that States should not rely on civilian intelligence agencies for combat cyber operation is further corroborated. Under the law of naval warfare, legitimate combatants are warships only. A warship, in accordance with Article 29 of the UN Convention on the Law of the Sea, is defined as
a ship belonging to the Armed Forces of a State bearing the external marks distinguishing such ships of its nationality, under the command of an officer duly commissioned by the government of the State and whose name appears in the appropriate service list or its equivalent, and manned by a crew which is under regular Armed Forces discipline.Footnote 145
The prohibition against relying on civilian vessels for combat operations is also corroborated by the strict limits, including the notification requirement, applicable to the possibility of converting merchant ships into warships in accordance with the Convention relating to the Conversion of Merchant Ships into War Ships.Footnote 146
In the end, precluding States from directly employing civilian intelligence agencies for combat functions is an implicit obligation, on the basis of a systematic and structural interpretation of IHL. Such an implicit obligation, it should be emphasized, does not infringe on States’ warfighting capability. Every State remains free to employ anyone for combat functions; the State is just requested to formally enrol him or her into its armed forces or to duly notify the other parties in accordance with Article 43(3) of AP I.
Prosecution of war crimes committed by belligerents without privileges
According to the Barron Memorandum mentioned above, CIA drones strikes were lawful because, inter alia, the US Supreme Court's decision in Ex parte Quirin was not conclusive or, in any event, its conclusion lacked clear support and practice. It should be noted that the Barron Memorandum disregarded US practice, for example, under the Manual for Military Commissions, Part IV, §5(13), which criminalizes unprivileged belligerent acts. So, if one were to embrace the Barron view, the conclusion should be that US practice would not be consistent with international law. This seems not to be the case, as the Barron Memorandum justification, rather than the mentioned US practice, seems not to be consistent with international law.Footnote 147
The US Supreme Court's decision in Ex parte Quirin should instead be considered in line with relevant State practice on the prosecution of unlawful combatants (recte belligerents without privileges, such as saboteurs not wearing uniform and not carrying arms openly), which appears to be legally sound from an international law perspective. In this respect, reference should be made to (1) the Federal Court of Singapore's decision in Krofan and Andea v. Public Prosecutor,Footnote 148 (2) the Privy Council's decision in Bin Haji Mohamed Ali and Another v. Public Prosecutor,Footnote 149 and (3) the Israeli Military Court sitting in Ramallah's decision in Military Prosecutor v. Omar Mahmud Kassem and Others.Footnote 150
It is true that the judgment in the case of Skorzeny and Others, issued by the General Military Government Court of the US Zone of Germany,Footnote 151 may support a different conclusion, as the defendants were acquitted on all charges, including those related to engagement in a reconnaissance mission while wearing the uniform of the adversary. However, the acquittal was based on the lack of sufficient evidence, and based on questions of fact. In any event, the Skorzeny case still offers some interesting points to be considered on the use of enemy uniforms. Particularly, the judgment pointed out that
[i]t is a generally recognised rule that the belligerents are allowed to employ ruses of war or stratagems during battles. … When contemplating whether the wearing of enemy uniforms is or is not a legal ruse of war, one must distinguish between the use of enemy uniforms in actual fighting and such use during operations other than actual fighting.Footnote 152
Moreover, while the use of enemy uniforms during actual fighting is undisputedly unlawful,
[o]n the use of enemy uniforms other than in actual fighting, the law is uncertain. Some writers hold the view that until the actual fighting starts the combatants may use enemy uniforms as a legitimate ruse of war, others think that the use of enemy uniforms is illegal even before the actual attack.Footnote 153
That said, the further development of IHL cannot be disregarded, as State practice subsequentFootnote 154 to Skorzeny supports a restrictive approach on the use of enemy uniforms as a legitimate ruse of war. As the notion of attack includes not only situations where combatants are actually engaged in an attack but also operations preparatory to an attack, some leading scholars have concluded that “[u]ndoubtedly, therefore, camouflage in plain clothes or the enemy's uniform by members of special units of armed forces is a violation of the applicable norms of international law, for which legally permissible sanctions may be imposed”.Footnote 155 In conclusion, wearing a uniform, in the case of armed forces, or otherwise complying with the requirement of distinction, in the case of guerrilla fighters, is definitely a requirement for – lawfully – directly participating in hostilities. We should not forget, however, that Article 44(3) of AP I could change this conclusion. On the one hand, the “relaxed” level of distinction provided for in that article, as convincingly argued by some scholars, should be applied “only in ‘enemy-controlled battlespace’”.Footnote 156 This implies that Article 44(3) should be relevant only in the exceptional case of cyber operations executed from a location where control by the adversary “rise[s] to the level of physical control by the military or other security forces over a relatively well-defined area”.Footnote 157 Secondly, and, more importantly, Article 44(3) confirms for combatants the obligation to distinguish themselves from the civilian population in the moment of the execution of the attack. Failing to do so can entail the prosecution of such unprivileged belligerent acts.
Should the foregoing conclusion be accepted, there is no reason not to apply it also to cyber warfare. The fact that cyber warfare is characterized by remote and over-the-horizon engagements may support the idea that the requirement of wearing a uniform is no longer indispensable, but the relevance of such a requirement cannot be denied as a matter of lex lata. Failing to do so would otherwise support the conclusion that civilian intelligence agencies may also shoot cruise missiles or employ other long-range weapons. If this were true, the principle of distinction as a whole would be irretrievably jeopardized. Indeed, as pointed out by some scholars, “the post-Westphalian construction expanding the license to kill by making persons lawful military targets who according to a traditional legal understanding would just be civilian criminals has not been accepted as law by the international community at large”.Footnote 158 In addition, it goes without saying that wearing a uniform is not just “dressing in some clothes” for the sole purposes of visual identification, but rather marks the individual's membership in the armed forces – or in an equivalent entity entitled to be a legitimate combatant – with all the rights and obligations stemming from such status. As argued by some scholars, the underlying rationale for wearing a uniform is “that soldiers identify themselves as belonging to a particular political entity on whose behalf they fight”.Footnote 159 As a consequence, the practice of relying on civilian intelligence agencies for combat cyber operations – through the styling/labelling of such operations as espionage rather than as military operations – should be further objected to as it undermines the “conceptual and political link between the soldier and a collective force”Footnote 160 that is required by IHL. In the end, as pointed out by Sean Watts,
[e]xisting treaty-based definitions of the combatant class thus could be interpreted to restrain individual conduct as well as states’ composition of their fighting forces. Such a view interprets the combatant-civilian status regime as not merely a means of classifying individuals for purposes of treatment upon capture, but also as a self-imposed limit on how states organize for combat. States that employ civilians to take direct part in hostilities would be in breach of such limits.Footnote 161
Of course, as seen above, given that providing tactical intelligence could be qualified as DPH, we are not ready to rule out the possibility of States relying on civilians in the cyber domain. States should, however, be precluded from employing such civilians (or otherwise relying on them) for cyber operations that go beyond intelligence-gathering, including those causing loss of functionality.
Conclusion
Competition and confrontation between the United States and its allies versus China and Russia is a fact that no one can reasonably contest, particularly in cyberspace.Footnote 162 This competition is resulting in ongoing low-intensity cyber warfare, and so it calls on us to revitalize the debate over the possibility of overcoming the dichotomy between peace and war. The need to consider also a status mixtus – or state of intermediacy – was already acknowledged in the course of the Cold War.Footnote 163 The relevance of such a status mixtus is today even more pressing than in the past. Particularly, differently from the Cold War, nowadays cyber competition is waged through means and capabilities that are indistinguishable from those that would characterize wartime. Therefore, in the present author's opinion, the IHL principle of distinction should be considered and applied, even before the eruption of a full-scale war, whenever wartime means and capabilities – including cyber ones – are employed by States.
This state of intermediacy is fostered by some opacities surrounding how international law applies to cyberspace. Apart from the vagueness of the notion of DPH, as is common in the other domains, this paper has identified five opacities that are cyber-specific: the use of force threshold, the notion of object in IHL, the definition of espionage under international law, the threshold of control for a State's attribution in case of non-State actors, and questions of evidence and proof for State attribution. To minimize the ongoing low-intensity warfare currently being waged, tackling the identified opacities would be beneficial. With a view to possible (and desirable) de-escalation, this paper has investigated some possible mitigation measures to address the identified opacities. The conclusion in that respect, as international law now stands, is that the only viable solution is a return to a narrow interpretation of the notion of espionage. A genuine notion of espionage, indeed, cannot legitimize civilian intelligence agencies’ involvement in combat operations, including in the cyber domain. Despite some legal documents on the CIA's “drone war” on terrorism suggesting otherwise, the viable mitigation measure, as shown in this article, is consistent with the principle of distinction. That principle, indeed, should be interpreted as precluding States from directly employing civilians – including, but not limited to, those who are part of civilian intelligence agencies – for cyber operations that go beyond intelligence-gathering, including those causing loss of functionality.
State practice, however, shows that military and intelligence capabilities are increasingly merged out of the “desire for perceived operational and fiscal efficiency”.Footnote 164 This practice has blurred the division of responsibilities between armed forces and civilian intelligence agencies. From a practical point of view, there are other ways to involve civilian experts in cyber warfare without necessarily relying on civilian intelligence agencies and undermining the principle of distinction between civilians and combatants. To that end, it is important to recall the Cyber Defence Unit of the Estonian Defence League, which is a national defence organization, voluntary and militarily organized, operating under the authority of the Ministry of Defence.Footnote 165
At the end of the day, the discussion on civilian involvement in cyber operations goes beyond a “turf war” between civilian intelligence agencies and armed forces, because it impinges on the core values of IHL. Consequently, as a question of principle rather than a question of organizational design between different branches of the Executive, the possibility of employing civilian intelligence agencies for cyber operations other than intelligence-gathering should be carefully limited. Failing to do so may not only undermine the achievements reached so far by IHL in terms of the protection of civilians, but may also weaken the overall credibility of any démarche against States that may be engaged in sponsoring malicious cyber activities performed by civilians entities, such as criminal gangs.
Open access
