38
states and cyberspace
refrain from the threat or use of force as embodied in the United Nations Charter; (b) obligations for the protection of fundamental human rights; (c) obligations of a humanitarian character prohibiting reprisals; [or] (d) other obligations under peremptory norms of general international law’.62 While points (b)–(d) are relevant in the cyber context, the critical issue is point (a). The majority of the International Group of Experts agreed that it implies that cyber countermeasures may not involve the threat or use of force (Rule 11); the legality of threats or uses of force is exclusively regulated by the United Nations Charter and corresponding norms of customary international law. A minority of Experts favoured the approach articulated by Judge Simma in the International Court of Justice’s Oil Platforms judgment. He took the position that proportionate countermeasures could involve a limited degree of military force in response to circumstances below the Article 51 threshold of ‘armed attack’.63 However, all Experts agreed that cyber countermeasures may not rise to the level of an ‘armed attack’ (Rule 13). 6. Cyber countermeasures ‘shall, as far as possible, be taken in such a way as to permit the resumption of performance of the obligations in question’.64 In short, they should, to the extent feasible, consist of measures that have temporary or reversible effects. In the realm of cyberspace, this requirement implies that actions involving the permanent disruption of cyber functions should not be undertaken in circumstances where their temporary disruption is technically feasible and would achieve the necessary effect. As indicated by the phrase ‘as far as possible’, the requirement that the effects of the cyber countermeasures be temporary or reversible is not of an absolute nature. 7. Although the Articles on State Responsibility impose no requirement for countermeasures to be quantitatively or qualitatively similar to the violation of international law that justified them, widespread agreement exists that countermeasures must be ‘proportionate’ to be lawful. Two tests of proportionality have been advanced. The first, articulated in the Naulilaa arbitral award, requires that countermeasures be proportionate to the gravity of the initiating breach.65 The objective of this test is to avoid escalation. The second test, drawn from the International Court of Justice’s Gabčíkovo-Nagymoros 62 63 64
Articles on State Responsibility, Art. 50. Oil Platforms judgment, paras. 12–13 (separate opinion of Judge Simma). 65 Articles on State Responsibility, Art. 49(3). Naulilaa arbitration at 1028.