The Obligation Within the Obligation

Under international law, states are to prevent their territories from knowingly being used for acts that are contrary to the rights of other states, and this is universally known as the international obligation to prevent transboundary harm. Originally envisaged in the context of environmental law (Trail Smelter Arbitration) and reaffirmed in later judgments like the Corfu Channel case, this obligation has expanded to other areas of international law, including the prevention of the threat or use of force from the territories of states. This obligation takes on a higher level of importance in recent times with non-state actors taking ‘centre stage’ in the increased perpetration of harmful attacks from the territories of states. To further exacerbate these issues, computers and computer networks have gradually become a weapon of choice for such unlawful attacks. These challenges thus invite a re-assessment of the obligation to prevent that states owe and more so, the level of diligence they need to exercise in order to uphold it.

Here, I advance that the most important step in ensuring the fulfilment of this obligation, especially in the context of preventing cyber harm, is incorporating a duty to monitor cyber networks and infrastructures. The understanding and application of such a duty is of course, not without implications for state capacity and state responsibility under international law. In addition to these matters, there are also relevant human rights concerns, especially privacy rights, which I highlight briefly below. These issues however, are beyond the scope of the present analysis.

A Cyber Due Diligence Obligation Under International Law

Since the obligation to prevent asserts that states should not allow their territories to be knowingly used for preparing, planning or even orchestrating harmful acts against other states, there is an expectation that states should exercise a requisite level of due diligence – care and vigilance, to ensure this. It is now commonly accepted that the harmful acts to be prevented would include cyber–attacks, but the bindingness of such an obligation in cyberspace is still debated. Some states like Israel, Canada and the UK still refer to the obligation as a voluntary one, simply encouraging responsible state behaviour in cyberspace rather than demanding it.

This appears to follow the interpretation proffered by the International Court of Justice (‘ICJ’) in the Bosnian Genocide case. At paragraph 430, the ICJ held that a due diligence obligation is not one of result, requiring or guaranteeing that the crime (genocide in that instance) is indeed prevented, but rather one of conduct – only exerting best efforts within the available resources at the disposal of a state, to prevent said crime. Thus, a state may be held to be in breach of its obligation to prevent genocide or in our case here, cyber harm, ‘only’ where it fails to act or manifestly fails to take such reasonable and appropriate measures towards prevention. However, a key issue with engaging such an interpretation is that it downplays responsible state behaviour in cyber operations.

Mainly, what may be considered ‘reasonable measures’ is again subject to context due to differentiated capabilities of states. The due diligence obligation is addressed ‘in many contexts on the basis of common but differentiated responsibilities’, meaning that the obligation is ‘common’ because it is universal, but ‘differentiated’, because the differing levels in development of states have to also be considered. So arguably, more powerfully placed states like the US, the UK, Australia and other technologically advanced ones would be better placed to respond to the dictates of the due diligence obligation, while developing states like Nigeria may lack the technical and financial strength and resources to exercise the obligation to the same standard. Nonetheless, since what is expected of this obligation of conduct is simply each state’s own assessment of its capacity and resources and response in relation to that, the due diligence obligation is ‘presumably’ fulfilled.

But this kind of differentiated standard has long-term implications for the universality of the obligation. It is expected that more states will capitalize on this issue of ‘differentiation’ by hardly making any efforts to observe the obligation at all. Moreover, since states get to make these assessments for themselves, it will be difficult in many cases to hold any state accountable for failure to engage their ‘best effort’. (I talk about differentiated capacity in more detail here).

It would make sense to simply argue that the obligation should be identified as one of result rather than conduct, but that would be easier said than done. For one, many states are unwilling to identify and apply it as such, and really, international law moves only when states say so. In the meantime, to bridge the current gap, there should be serious consideration given to the specifications of cyber network structures used by states. There ought to be minimum security obligations integrated into states’ technical operations and further implemented through cyber security policies, since these cyber threats constitute both a national and international challenge. A passive, and in certain contexts, active monitoring of states’ cyber infrastructures should be a minimum standard that all states can incorporate.

Monitoring as Prevention

In cyberspace, due diligence strategies may generally include tracing the origin of a cyber-attack, investigating and possibly prosecuting accordingly, etc. While these steps are reasonable, they may speak to addressing the situation ‘after’ the fact. Compared to physical attacks or conducts involving physical harm, cyber-attacks may be deemed ‘unseen’, ‘sudden’, usually orchestrated at the ‘speed of light’ and may likely have manifested or caused some damage, before it becomes evident. Hence, it is unlikely for states to be aware of and address all potential cyber threats in time if there are no specific technical and administrative structures put in place to detect these threats ab initio.

Monitoring will allow real-time observation, identification, data collection and even risk assessment of potential cyber threats. It may engage tracing software, observation of network load, language and communication patterns etc. Good examples include cyber-attacks that run a pattern of denying access or service known as denial-of-service (DoS) or Distributed DoS (DDoS) attacks. They can engage a ‘mass of infected’ computers – botnets attacking a system and sending several requests for information until it starts to run slow or even crashes. These DDoS attacks usually have working patterns that are common knowledge – commands that use up more bandwidth than normal, repeated automated requests sometimes from a specific IP address or region, consistency in the timings of the requests etc., and this can become gradually obvious during cyber security monitoring.

Most states align with the view that in order not to overly burden states, the due diligence obligation would ideally be triggered where there is a real risk of substantial damage on another state’s territory. However, that risk of significant harm resulting from a cyber threat may not be easily ascertained before the threat itself materialises. Indeed, some cyber-attacks, when executed, may only cause negligible disruptions like one disrupting sporting activities on an official website, but it could also cause substantial damage, really fast. Hence, if states have to wait for all threats to materialise in order to assess the seriousness and before engaging in any appropriate response, the damage may be quite substantial, and a state may lose its ‘last window of opportunity’ to initiate any effective solutions.

Although prevention may come at a cost, again considering the management of state resources, this will be less when compared to the resources that will likely be invested in repairs and restoration after a damaging cyber-attack has occurred. Following the WannaCry attack on the NHS systems in the UK (mid-2017), for instance, the National Audit Office reported that it could have been avoided if basic best practices had been duly followed. Over £100m was spent on reconditioning and boosting cyber security after the attack.

Hence, irrespective of whether a cyber threat poses a real or serious risk of harm or a minimal one, being able to suppress the threat through early detection would be most effective and even efficient. The focus of the obligation of due diligence is moreover prevention instead of finding solutions after harm has occurred.

Failure to Prevent as a Basis of Responsibility

As highlighted by the Articles on the Responsibility of States for Internationally Wrongful Acts, regardless of the origin or even the character of an obligation, where a state acts contrary to the requirements of that obligation, it would be deemed a breach. Such breach constitutes an internationally wrongful act, which then engages the international responsibility of that state.

Thus, where a territorial state (a state where the cyber-attack emanated from) fails to act or take and exhaust all reasonable measures to prevent, it may be held to have breached its international obligation to prevent, which then entails its responsibility. The target state (the victim of the cyber-attack) may respond with proportionate countermeasures (see Rule 20 of the Tallinn Manual 2.0). Countermeasures can be both cyber in nature, for example, hack-back – a counterattack on the attacker’s network system, or non-cyber in nature like issuing sanctions or restricting business licences. This is to ensure that the territorial state bears the legal consequences for the breach of its obligation and is expected to take next steps in ensuring that it will apply better control over cyber infrastructures on its territory. The territorial state will be precluded from undertaking any countermeasures of its own, because the response by the target state is essentially a result of the internationally wrongful act occasioned by the territorial state in the first instance, and as such, the territorial state has no right to benefit from its own unlawful conduct. (see also Rule 6 of the Tallinn Manual 2.0).

On the other hand, if a state takes all practical and reasonable steps to prevent a cyber threat from its territory and the threat materialises regardless, the state would not be held to be in breach of its due diligence obligation and by extension, its obligation to prevent, as that obligation has been discharged in that instance.

Monitoring a state’s cyber infrastructure allows the state to handle the challenge in real-time. This would mean that the state becomes aware of the nature of the threat in time and can then take reasonable steps to prevent it. There are some present concerns that embedding this kind of monitoring obligation within the due diligence framework may of itself result in human rights violations. For one, privacy rights may be breached, if personal networks are somewhat implicated in a monitoring process. This is not an easy analysis and may even result in an unfavourable outcome for the parties involved. In fact, one could argue that under certain public law regimes (see art 8 of the European Convention on Human Rights for example) privacy rights are not absolute rights, which means they may be interfered with on the basis of serving specific legitimate interests.

Co–operation as Necessity

Where a state is unable to supress a cyber threat itself, either because it lacks the resources to do so or because it is simply incapable of preventing it, it could inform the target state or seek assistance from other states on the basis of mutual co-operation. States may sometimes be hesitant to share information or notify another state of a potential threat because they may not want to expose their cyber capabilities (see Rule 7 of the Tallinn Manual 2.0). In such cases, intelligence sharing may be discretionary, but the territorial state must still do all it can to supress the attack emanating from its territory. The state’s due diligence obligation is not dispensed with simply because it is unable to share its intelligence or cyber security information with other states. In fact, where a territorial state refuses to share information and still fails to act, that reluctance may be interpreted as an unwillingness to act to supress the threat from its territory. This may induce the victim state to undertake countermeasures in response, especially where the effects of the cyber-attack are substantial. Thus, where a state is incapable of supressing a cyber threat itself, it should seek assistance.

Conclusion

The obligation of due diligence, understood in the cyber context, requires that states exercise the requisite care and vigilance to prevent their cyber networks and infrastructures from being used in a way that will cause harm to other states. Since this is an obligation of conduct, states do not have to guarantee that cyber harm will surely be prevented, and no one expects them to do so, reasonably, but they must exhaust all reasonable measures at their disposal to prevent said harm. However, as there is no precise way of assessing how states keep up with these ‘best efforts’ especially since state capacities differ, incorporating a minimum standard of monitoring cyber infrastructures into this obligation would at the very least, make prevention easier. More so, it will ensure that states are only held responsible for cyber harm that they have manifestly failed to act or take proper steps to prevent. Then there is always the option of states seeking assistance or cooperation from other states if they are unable to discharge this obligation themselves. International law and relations are largely built on the strength of mutual assistance and cooperation.