ILD 2012 | Panel Discussion: Beyond International Armed Conflict

Good morning, ladies and gentlemen. I am Captain Navy Geneviève Bernatier, the Deputy Judge Advocate General for Operational and International Law in Canada. I would like to welcome you to this morning's panel. On the first day of the conference, we heard about the numerous operational, technical and policy challenges related to cyber strategies and the use of cyber capabilities during armed conflict and other military operations. Yesterday, speakers delved deeper into examining the legal norms that govern such operations. Although some recognized that there may exist a requirement for states to progressively develop new norms, the majority of speakers found that the current USADBELIM and USANBELO legal corpus was sufficient to address cyber activities. This morning's panel is going to delve deeper into other legal issues, and it will explore the legal norms that govern the use of cyber capabilities during non-international armed conflict, counter-terrorism and peace operations. Each panelist will have 14 minutes to make their presentation, which will leave 30 minutes for Q&As at the end. Our first presenter, Professor Dr. Robin Geis, teaches international and European law at the University of Potsdam, Germany. Professor Geis will speak about the classification of non-international armed conflict and the challenges of applying such classification in the cyber context. Thank you very much, Genevieve. First of all, warm thanks to Mike Schmidt and the organizers for having me. I'm delighted to be here, and I will get right at it. The time frame is rigid, 14 minutes for a broad topic. My task this morning is straightforward, to speak on the notion of non-international armed conflict and cyber warfare. When I first looked at this assignment, the question that came to me is, is this really a topical and relevant issue? Because if you think of it, all the incidents that have been making headlines and everything we've been discussing, primarily at least, they have had an interstate dimension. Estonia, Georgia, Stuxnet, and the flame virus, that was all on an interstate level. But there has not been too much debate about cyber operations in non-international armed conflicts. So I'm sure we have consensus in the room that cyber operations and cyber dominance will be key in any future international armed conflict. The situation is, I think, more complex and not so clear in relation to non-international armed conflicts. The reason for this is probably that the scope of situations that falls within the notion of non-international armed conflicts is so broad. On the one end of the spectrum, you have Somalia, a failed state, armed factions fighting against each other. It's difficult for me to see what relevance cyber may have in such a scenario. It's rather the proliferation of small arms, AK-47, that we should be concerned about in Somalia. It's not sophisticated cyber tools. But then, if you start thinking about it, the warlords in Somalia, even there in this most rudimentary non-international armed conflict, they use cell phones to have their financial transactions. They use cell phone systems for communications. And I think Stuxnet and Flame have shown us there are many more inroads for cyber operations than we had ever thought there would be. And so I'm quite certain, even in a rather low-level non-international armed conflict, cyber is already of relevance. And now, of course, there is increasing relevance for cyber operations the more sophisticated the actors involved in the conflict get. So if you look at Afghanistan, where you have sophisticated NATO militaries being involved, there's, of course, significant cyber vulnerabilities for these states at home. And I think this is one of the major concerns, of course, that in a non-international armed conflict, a non-state actor could reach now across the globe, hit back at external states, Germany, U.S., in Afghanistan, and hit them at home. And you have other scenarios where non-state actors may have territorial control. They may be running power grids. They may have power plants and other things that are certainly susceptible to and vulnerable to cyber operations. So my assessment of the topicality of non-international armed conflict and cyber operations is this. It's not as relevant as it will be in international armed conflicts. I think cyber operations is first of all and primarily an interstate topic, but increasingly and with ever more reliance on cyber systems and with ever more sophisticated non-state actors' proliferation of cyber technology, I think we will also see more and more cyber operations in non-international armed conflicts. So this is just to lay out the scene of what I really want to do now in my presentation, and I want to look at two different questions. The first question is this. Can a non-state actor, by having resort to cyber operations alone without any kinetic operations, can a non-state actor trigger a non-international armed conflict just by attacking a state? Now Mike has already addressed this issue. I have a slightly different view on one point from Mike, and I just really want to focus on that. The second question I want to look at is what happens if in an already ongoing non-international armed conflict cyber operations are being executed? What are the particular challenges? What is it about cyber that could, maybe not, but that could make it difficult to apply the laws of armed conflict? So first question. Can a non-state actor with nothing else than cyber operations trigger a non-international armed conflict? My answer to this is, in theory, yes. In practice, only in very exceptional cases. It's not a likely scenario. Why is this? It's because the threshold for a non-international armed conflict is high. Mike has spoken about it. You need a relatively high threshold of violence, and then you need to have a non-state actor that has a certain sophisticated degree of an organizational structure. So I won't be looking into the violence again, because Mike did this yesterday. You need protracted armed violence, and it's difficult to see how this level of protracted armed violence, which doesn't mean a long duration of violence. It could be intensive action also, but not one-off action. So intensive acts by a non-state actor could reach that threshold, but it's difficult to see in a pure cyber context where that level would be reached. But now, the more problematic issue is, I think, this. You need to have an organized armed group. I think we can all agree, the Taliban, the FARC in Colombia, they are organized armed groups. And at the other end of the spectrum, it's quite clear that merely individuals and random hackers getting together are not an organized group. But in cyberspace, you have a lot of organized activity. You have denial-of-service attacks that find more and more followers. So somebody sitting at home, he thinks it's a good idea that this denial-of-service attack is ongoing, and he then makes his computer available to join in this denial-of-service attack to generate additional computer power. That scenario, too, I think you could not be speaking of an organized armed group, because we need to be cautious. It's a different thing whether you have organized activity or coordinated activity from having a distinct armed group that has sufficient organizational structure. So first of all, you need to have a distinct armed group, and then that group needs to have a certain organizational structure. And against this background, I think purely virtual groups will not qualify typically as an armed group. I accept there is a certain gray area, but my feeling is this would rather not be the case. Why do I have this feeling? I look at the Limay judgment by the International Tribunal for the former Yugoslavia. In that judgment, the court, the tribunal, had to assess the organizational structure of the Kosovo Liberation Army. And in doing so, the tribunal looked at various indicative criteria. Indicative, there could be others. This is why there is some gray area. But the indicative criteria the tribunal resorted to was the existence of military headquarters, the existence of internal regulations, and the establishment of a military police that could enforce discipline within these groups. Now if I look at this catalog of criteria, they're A, all objectively verifiable, and B, they all in a way presuppose a certain ability to exercise control over the members in the group. And I certainly think that the Taliban or the FARC, they're very well able to enforce discipline within their ranks. They do that, I think, with an AK-47. They do that very effectively. So I think in such a physically existent structure, they can impose control. And I just don't see how a virtually organized group of individuals, 50 individuals in 25 different countries, how they could come close to any degree of organization that I find in the Limay judgment. And even if they could, we would still have great difficulty in determining who is a member of this armed group. Now I'm not speaking about the legal criteria for membership in an armed group. Just factually, in cyberspace, you always run into the human-machine gap. You don't know who had his fingers on the keyboard. So if you have repetitive cyber attacks coming in, you may be able after a while to identify the machines involved in this and to locate them. But then it's another step to identify the natural persons behind these attacks. So it will take you a very long time before you even know who the natural persons in this virtual armed group will be. And therefore, I'm rather hesitant to accept that there could be purely virtual armed groups. It's a different thing if you have an organized armed group like the Taliban, a group that has the same organizational structure and they execute a cyber attack. That's a different story. That will qualify if they reach the threshold of violence. But pure virtual organization, I'm hesitant, more hesitant to accept. Okay, that's the first question. What legal challenges will we see if cyber operations are executed in an already ongoing non-international armed conflict? I think in many cases there will not be any particular problems, to be quite honest. If you can identify vulnerabilities of the non-state actors, cyber vulnerabilities, if the non-state actor for his military operations relies on cyber, then of course you can attack these facilities, you can do that via the air, or you can do it by using cyber operations. There is no prohibition, of course, on cyber operations, and especially in non-international armed conflict, cyber operations may be the weapon or the strategy of choice, because cyber operations can have reversible effects. And if you're out to win the hearts and minds of a civilian population, then this may be the weapon of first choice. And also, cyber weapons can be hyper-distinctive. I mean, Stuxnet has shown that these weapons can be very specifically directed at very particular targets. This is all the laws of war could hope for, in a way, so therefore I see a lot of potential for cyber operations if you can identify cyber vulnerabilities on behalf of the non-state actor. Okay, but I'm a lawyer, I like to look for trouble and for problems, and so in concluding I'll be doing that. So just to not be misunderstood, I think in many cases there will not be problems, and this is what I meant to put out now. Let me just briefly look at some problems that stem from the technological specificities of cyberspace. It's artificiality, it's interconnectedness, and it's the global dimension of cyberspace. Cyberspace is a global medium, by definition it transgresses all natural boundaries. Artificiality, what do I mean? In a traditional armed conflict, you would have a fighter plane flying through the air. No doubt the fighter plane is a military objective by nature, you can attack it. No doubt you cannot attack the air, it's just impossible to attack the air. In cyberspace it's the other way around. You have a malicious code traveling in cyberspace. There is no way you will detect the malicious code, it is zeros and ones, it's indistinguishable from any other codes that are traveling in cyberspace. What is more, in order to execute havoc in cyberspace, you don't even need a malicious code. It could be the right code that you sent at the wrong time, if you open a valve in a power plant 10 minutes too early. So what I'm saying, you will not be, take the analogy with the plane, you will not be able to attack the traveling software. What you will be looking at is the cyberspace as such, because as we heard, it's an artificial domain, it consists of physical components, and these physical components can theoretically be attacked. You can attack computers, you can attack the fiber cables, and so on, the satellites. So that's the first point, it's just an observation, artificiality. Second point, interconnectedness. Now, in cyberspace, everything is interconnected with everything, and everything can be used for military purposes. I think pretty much all of the cyber infrastructure is a dual-use object. And I think this is something we have to acknowledge, it's not a problem per se, dual-use is not prohibited by international humanitarian law, but in cyberspace, the cyber infrastructure is very susceptible to be used for military purposes, because there is no difference between a military computer and a civilian computer. You can launch a sophisticated cyber attack from your smartphone. You just need computer memory and computer power, and that's it. And so every civilian system can also always serve military purposes. Something to be kept in mind, the dual-use nature of the cyber infrastructure. Third and last point, the global dimension. And now I'm trying to bring all of these points together. The global dimension of cyberspace, here I think we're running into some new problems. Now, of course, everyone in the room is well aware about the debate we have been having about the global applicability of international humanitarian law, the laws of war. And of course, we have been having this debate in relation to terrorism and to drone strikes, and I really don't want to revisit this debate as such. But what I'm saying is, in the past we have been discussing the issue of the global applicability of IHL, a Taliban fighter leaving Afghanistan, and then the question arising, is he still a legitimate military target because of his status as a Taliban fighter, or does his status end as soon as he leaves Afghanistan? This is, I think, the two views that are out there. We have been having this debate in relation to persons, and now with cyber, I think we will see the same debate coming to us in relation to objects. Because in cyber, objects, in a way, are more important than persons. And I think really in terms of quantity, we'll reach a new dimension here. And let me explain what I mean. If the Taliban wanted to attack one of the NATO states, Germany or the United States, at home with a cyber attack, they will not be able to do that with a Stuxnet sophisticated malware tool and no non-state actor will ever be able to develop something as sophisticated as that. A more likely scenario is that they will set up a botnet. A botnet consists of different zombie computers in very different regions in the world. All of them you can remotely control and then use for your malicious purposes. Why do I think that this is a likely scenario? Because in 2010, you may recall, the so-called Mariposa botnet was discovered in Spain. It was a botnet that consisted of 13 million computers in over 150 states around the world. And all the computers involved in this botnet were used for criminal purposes. But of course, you could also use that botnet for military purposes. And this is a cyber attack scenario that is a more likely scenario for a non-state actor to be able to carry out because this is already being done for criminal purposes and the Taliban might do that as well for military purposes. If that happens, if you use different computer systems to carry out an attack, of course, you're using all of these computers to make an effective contribution to military action. That's the definition of a military objective. And thereby, you will render the computers involved in this attack in very many different states across the world a legitimate military objective. That's a consequence of the global application, if you believe in it, of the laws of armed conflict. I just think we really have to be aware that this is a consequence that we will need to face in cyberspace and that we will not only be talking about persons in relation to global applicability but also in relation to objects. Just food for thought. My take on this is it may not be such a big problem after all. This was just an observation because whether you can then get active in these different states, of course, will depend on the use at that level as well. Just because these things may qualify as a legitimate military objective doesn't automatically mean that you can go and intervene or destroy these different computers. But I also think we shouldn't jump too hastily to the laws of war to find answers for cyber security issues. Because in just this scenario, you have an incoming denial of service attack. It's coming from 150 different states. The only way that you will be really able to fend off this attack is with an automated response which realizes within milliseconds that somebody else is trying to overload your systems and before your systems are overloaded, you counter-hack and you block this attack. Now, you absolutely don't need the laws of war to be able to do this. I think this is a legitimate measure which could be imposed and you can base this on the plea of necessity and I think this would very well already serve your legitimate security interests to stop that attack immediately. Because in this denial of service scenario, before you know whether the Taliban was behind it or somebody who had a nexus to the conflict in Afghanistan, it'll take you weeks, months or years before you'll figure that out. So I think, again, maybe the laws of war are not the first choice in terms of cyber security. I think use ad bellum is the far more important aspect here and I think the plea of necessity as a circumstance precluding wrongfulness in this denial of service scenario would be a far better solution than relating to the laws of armed conflict. I think I've stirred discussions. Thank you very much. Thank you, Robin. Our next speaker, Professor William Banks of Syracuse University, is an internationally recognized authority in national security law, counter-terrorism and constitutional law. Professor Banks will speak about the counter-terrorism responses to transnational cyber operations against a state or its national or property by organized terrorist groups. Bill? Good morning. Thank you and thanks to Mike Schmidt and to the organizers of the conference. This has been a fabulous conference and if you're like me, you've been sitting feverishly taking notes now for two days, I'm sorry in a way that I'm not sitting up there because it's harder to take notes down here, especially when I'm speaking. The question that I've been asked to address is whether counter-terrorism law might provide a useful supplement or even a bridge to LOAC for responding to cyber intrusions when there's no armed conflict or when the cyber operations are not part of a larger kinetic operation. Over the last two days, several have made comments, I think, that caused me to reflect further on that question in thinking about today. Last night I went back through my notes and pulled out a few things that were thought-provoking to me and I thought I might just go back and remind us of what some of our colleagues have said over the last two days that may pertain to this panel. Back at the beginning, day one, Eric Greenwald, IHL or LOAC, he said that in terms of the use of force, he said the standard is you know it when you see it, or it might be. That was a bit disturbing to me. Later in his talk, he said that the attribution problems at the use-of-force level are really not so hard because only a few adversaries can do that, can make that degree of intrusion. I think that's a debatable conclusion. Jack Goldsmith, he said be careful in making the kinetic analogy. It underplays some important cyber attacks. And he also said that in looking at LOAC, the process of analogy should not be too lawyer-driven, speaking right to all the lawyers in the room. And I think that's a useful point as well. Yesterday, Daniel Bethlehem said maybe we should be looking at a different legal framework. The one that is in play now is driven too much by U.S. domestic law. Appropriate criticism, it seems to me. There's lots of uncertainty, said he, about what the law really is. And we should go slow in using Envelo analogies. One of the things that may happen if we work too quickly from existing Envelo is that the potential for countermeasures may be undersold. So today, I'd like to speak a little bit about what cyberterrorism is or may be. I'd like to say a few words about countermeasures, speaking dangerously to an audience who knows more about them, I'm sure, than I do. And then sort of conclude with some suggestions about the space that remains or may remain for counterterrorism law as, again, as a supplement to LOAC in this area. I thought that Robin's comments were wonderful and actually created, I think, even a little more space for the few points that I might like to make today. According to a recent Sandia Labs report, cyberterrorist uses Internet-based attacks in terrorist activities, including acts of deliberate large-scale disruption of computer networks. Another scholar well-known to many of us, Dorothy Denning, said that cyberterrorism, like terrorism generally, intends to intimidate or coerce governments in pursuit of political, religious, or ideological goals so that to qualify as a cyberterrorist, an attack should be sufficiently destructive, I'm quoting now, sufficiently destructive or disruptive to generate fear comparable to that from physical acts of terrorism. She said that attacks that lead to extended power outages, water contamination, or major economic losses would be examples. I think that's a useful point of departure. Now, there are others. Here in the United States, Una Hathaway and some co-authors wrote this last year that a cyberattack consists of any action taken to undermine the functions of a computer network for a political or national security purpose. Their definition, of course, applies to non-state actors and thus to terrorists. On the other side of the Atlantic, a recent volume on terrorism in international law Peshik says that the term terrorism should be reserved for acts of violence committed in time of peace or for the few acts designated specifically as terrorists under LOA. Whatever the definition, it's clear the definitions are in play and they're very difficult, as all of us know, that the effort to define terrorism in international law has been fraught for many years and shows no signs of concluding any time soon. Whatever the definition, should CTL account for cyberterrorism? Does it provide a useful legal paradigm? I think that it's clear over the last couple of days that the elephant in the room for many of us is the problem of attribution. As Joel Brenner wrote in his book, America the Vulnerable, the Internet is one big masquerade ball. You can hide behind aliases, you can hide behind proxy servers, and you can surreptitiously enslave other computers to do your dirty work. That's Brenner. Attribution can be aided by forensic tools, but it's not always fast, it's not always certain, and making the judgments, as Jack Goldsmith said the other day, are probabilistic. That's the most we can hope for. Because it's probabilistic, we lower the ex-ante disincentives to cyberattack and we further level the playing field for asymmetry, including opportunities for terrorists and terrorist organizations. Everyone here, I think, recognizes that whether dealing with state or non-state adversaries, the ad bellum authority to use military force is tied to attribution of the attack and thus identification of the enemy. I'll come back to attribution momentarily. So let's assume that a terrorist group has launched a series of cyberattacks where there's no ongoing or new armed conflict, using Mike Schmidt's very helpful set of reminders yesterday, no IAC because there's no state or no Article 49 attack, and no NIAC because no intensity or no organized armed group. As we've seen, one starting point in assessing the ad bellum authority to respond to aggression involves assessing the consequences. Again, cyber intrusions can range from the trivial to the devastating, and that scale has been well mapped out by others here. What law determines the permissible responses to a terrorist cyberattack, for example, on the New York Stock Exchange that causes widespread and considerable economic harm for a time but no physical damage? Is the destruction of property in that vein sufficient to trigger a counterterrorism response? The answer turns, at least in part, on whether the state wishes to use force in response. So a few words about countermeasures. Countermeasures, which are, as you all know, are temporarily lawful actions undertaken by an injured state in response to another state's internationally wrongful conduct, certainly offer one lawful response, but are they lawful if undertaken against non-state actors, including terrorists? The answer, I think, is maybe. Customary law permits state responses to international violations such as the norm of non-intervention that do not rise to the level of an armed attack justifying self-defense. There are lots of examples. As codified in the draft articles that have been referred to here several times, countermeasures must be targeted at the state responsible for the prior wrongful act. They must be temporary, instrumentally directed to inducing the responsible state to cease its violation. That's Article 49. Now, not too much has been said about countermeasures including active defensives, electronic active defensives, which attempt through in-kind response to disable the source of an attack while it's underway. Active defense countermeasures are a subset of reciprocal countermeasures where the injured state seizes obeying the same or related obligation to one that the responsible state violates. Active defenses, they then may employ electronic force. May they be used only when force is lawfully authorized? Yes, say scholars. Would counterterrorism law avoid the tautology involved in that analysis? That is, you can only use force if you conclude that you've had force used against you. Would counterterrorism law avoid the tautology in that reasoning and provide some legal authority, and if so, to do what exactly? Uses of countermeasures are complicated by the time it takes to determine attribution. That's why this is such an important problem. And because countermeasures are effective only if the attacking agent finds the countermeasure costly. Think about a terrorist organization. It has to be costly enough so as to discourage the intrusion, the behavior that gives rise to the countermeasure. Although the draft articles are directed at state-on-state actions, Article 16 does say that a state has an obligation, quote, not to allow knowingly its territory to be used for acts contrary to the rights of other states. Now, whether state practices coalesce around applying that norm of making states responsible for non-state actors is a good, I think, and remains an open question. The Security Council resolutions after 9-11 concerning the relationship between the Taliban and al-Qaeda suggests that the level of attribution that's required by the ICJ in cases like Tadich and Nicaragua may not be required. But, of course, those Security Council resolutions were in response to an armed attack. So, again, the analogy is not a perfect one. Even if state practice exists, such a norm may provide little benefit in dealing with terrorist groups that act independently of any state. Even if the authority is portable to terrorist attackers, countermeasures may be less effective against non-state actors because those actors can simply relocate many times to a different domain in some way. So, if a cyberattack constitutes an armed attack, as you all know, self-defense allows the victim state to conduct forceful operations in the state where terrorists are located if that state is unable or unwilling to police its own territory. But many have pointed out in their scholarship that the Charter's self-defense doctrine, as traditionally interpreted, may not leave states adequate authority to respond to the full range of cyberthreats they face. When do the non-kinetic intrusions constitute an armed attack? It may not be optimal, in my view, to permit open-ended formulations of self-defense to extend to any and every means necessary to respond to a cyberthreat. Does counterterrorism law provide a better alternative or one that could supplant, not supplant, but substitute, excuse me, not substitute, supplement LOAC in some circumstances? Ten years ago, Adam Roberts noted that counterterrorism operations are not entirely like or unlike armed conflict or other wars. The fact that counterterrorism involves pursuit of law enforcement and other non-use-of-force methods involves some fairly awkward confluences with international law generally and with the Ad Bellum and Imbello principles in particular. In 2006, the General Assembly adopted the Global Counterterrorism Strategy and embraced what was called the Common Framework to Fight Terrorism. It relied on the legal principles in LOAC, human rights law, refugee and asylum law, and criminal law together with the Charter to constitute that framework, yet the WJP agrees, quote, there is as yet no fully coherent international legal regime governing terrorism and responses to terrorism. They would locate the undefined corpus of CTL in criminal laws. It seems to me to be that comes up short to some degree. We heard on Monday afternoon from Chris Walls, I think, some very useful references to the kinds of activities that the United States through cybercom seeks to undertake in reacting to cyberattacks. Some of those, it seems to me, fit into this domain of counterterrorism law if the intrusion is coming from that direction. CTL may support a variety of responses, including active defenses, some economic intelligence and law enforcement operations and certain kinetic measures, all under the umbrella of counterterrorism law. Now, summing up, I see I'm running short of time. Let me suggest a few concluding points. Many in the international community were understandably critical when a series of counterterrorism measures undertaken by the United States in the wake of the 9-11 attacks went in directions that were unprecedented in international law. I think now 10 years, more than 10 years later, the critique of international CT law as the product of U.S. domestic law may be misplaced in the cyber context. I think it's time to take a fresh look. I think the cyber threats, as we all know, are much more dispersed, much more widely felt, and the Georgia-Estonia case has been excellent ones for a point of reference. The norms that CTL could support going forward need not be threatening either to the law of the charter or to international law generally. And third, the measures needed, I think, are not simply extensions of what we've done in the last decade necessarily. There may need to be new norms created in an antebellum sense. And finally, I think that the discussion at this conference shows that at least at the margins, the coherence of international law in responding to cyber threats really is in question. My friend and colleague Matt Waxman wrote a very persuasive article in the last year in the Yale International Law Journal where he said, essentially, we need for strategy and policy to drive the law here. It's going to take some time. The law is not mature, and the law can't leap ahead of policy and strategy. I think one of the striking things about this conference is how little policy discussion has been held. We all know that certainly in the United States, it's policy that has been lacking in driving this agenda forward. So I think the law agenda, including counterterrorism law, is going to have to go slow. I'll stop there. Thank you. Thank you, Bill. Our last speaker, Professor Dr. Jan Koeffner, is head of the International Law Center and associate professor of international law at the Swedish National Defense College. Professor Koeffner will discuss the applicable law of peace operations, the enjoyment and loss of protection, and responsibility in peace operations. Jan? Thank you, Jan. And thanks also to Mike and his team for the invitation. It's a pleasure to be here. As mentioned, I'm going to address international legal aspects of cyber operations in relation to peace operations. And to start off with, I will understand that notion of peace operations fairly broadly, to include not only traditional peacekeeping operations governed by the three core principles of consent, impartiality, and the use of force in self-defense or in defense of the mandate, but also more broadly, peace enforcement operations and peace building operations. Now, some of you might wonder what the cyber-specific issues might be that arise in the course of peace operations and I can assure you that you are not alone. However, after having reflected on the matter for some time, it would seem to me that three international legal aspects deserve our particular attention. And Jan already mentioned those. The first one is the applicable law that governs peace operations and cyber operations in the course of peace operations. The second issue is the protection and loss of protection of peace operations personnel and equipment in the cyber realm. And thirdly, I want to say some words about the issue of responsibility for cyber operations in the course of peace operations. So let me address these issues in turn. As far as the applicable law is concerned, we have, of course, to distinguish between, on the one hand, cyber operations that are being conducted in the course of peace operations below the threshold of an armed conflict from those that occur above that threshold. Now, in the first situation, i.e. below the threshold of an armed conflict, one possible scenario is that you have a peace operation that is mandated to monitor the implementation of and compliance with a peace agreement or provide security in a post-conflict environment. In such a case, the international legal framework governing cyber operations is international human rights law to the extent that functions are being exercised in a way that do amount to or can be equated with the exercise of jurisdiction by a state. States are, of course, bound by international conventional and customary international human rights law and several cases and quasi-judicial determinations have confirmed that their obligations do not automatically cease to apply in the extraterritorial context of peace operations, provided, of course, that they exercise jurisdiction. Admittedly, and I should stress that in an audience, with an audience like here, that there's no universal consensus on this question, the U.S. being one of the prominent opponents to extraterritorial application of human rights law, but I also need to stress that both universal and regional human rights bodies, as well as a significant number of individual states, have accepted or have had to accept that human rights law does not cease to apply automatically in such a context. Now, in a similar vein, international organizations, such as the United Nations, are bound by customary international human rights law. In other words, if and when an international organization exercises effective control over territory or control over one or more persons, the international organization is bound to respect the human rights of those who find themselves in its jurisdiction. And in the case of the United Nations, one can be slightly more specific, because the binding force of international human rights law does not only flow from the U.N.'s international legal personality, but is also further strengthened by the U.N. Charter, the U.N. Safety Convention, internal rules and practices. Now, cyber operations carried out in the context of peace operations below the threshold of an armed conflict are thus broadly put governed by human rights law, such as, for instance, the pertinent rights, I think, of privacy, freedom of speech, and the like, provided that the person whose rights are at issue finds him or herself in the jurisdiction of an international organization or troop-contributing nation. While the legal basis to conduct such operations may stem from the authorization in a pertinent U.N. Security Council resolution or from defense of the mandate or from self-defense, the actual conduct of such cyber operations are subject to the constraints as we know them from human rights law. In other words, if jurisdiction is being exercised in the context of a peace operation and it is considered necessary to gather intelligence in the cyber realm, for example, in order to prevent spoilers from reuniting an armed conflict or to prevent online postings that incite racial hatred, any interference with the cyber infrastructure, data, and so forth must be carried out in compliance with the requirement for lawfulness as they emanate from the relevant rights, such as the right to privacy, freedom of expression, et cetera. I should immediately add here that, obviously, those rights do not prevent such measures, as I mentioned, the blocking of sites that incite racial hatred and the like. Obviously, these are not absolute rights and they leave a considerable amount of leeway to take such countermeasures. However, and this is very important, under the current law, the formal applicability of human rights remains tied to the notion of jurisdiction. That is broadly put, and I generalize here, effective control. And, obviously, one of the operational advantages of cyber operations is that they do not require such effective control, either territorial or physical, for that matter, of a person in order to achieve that purpose. They can be carried out remotely and still can interfere at times quite considerably, I would submit, with a person's human rights. And it is difficult, at least to me, to see what international legal framework is then formally applicable to cyber operations carried out in the context of peace operations below the threshold of an armed conflict, if and when such cyber operations are conducted in circumstances that do not amount to an exercise of jurisdiction, as it is commonly understood. Now, in order to avoid a legal vacuum in that realm, then one may have to adopt something that has been mentioned several times during those two days, an effects-based approach to the question of jurisdiction, and hence determine the extent to which human rights law applies by reference to the effects that a given action, or in our case, a given cyber operation, produce. I stress again, this is, I think, not, or maybe not yet, well established in human rights law. We may deduce a certain move into that direction from more recent cases in certain contexts, such as the European one, but I would submit that this is an area in which an adjustment of the legal framework may have to be contemplated in order to take better account of the idiosyncrasies of cyber operations. Let me then move on to the applicable law that governs cyber operations in peace operations that take place above the threshold of an armed conflict. And it's here where I transition from the first issue of applicable law to the second one of protection and loss of protection of peace operations personnel and equipment in the cyber realm. Now, obviously, and I don't need to repeat that, the existence of an armed conflict triggers the applicability of the law of armed conflict, and if and when hostilities between a peace operation and a state or an organized armed group reach the level of an armed conflict, obviously, law applies. Accordingly, the peace operation would be entitled to attack members of the armed forces of the adversary, and the latter's military objectives and the military personnel and military equipment of the peace operation, including military cyber infrastructure and the like, are, of course, lawful targets. However, peace operations in which the hostilities between a peace operation itself and an adversary in and of themselves amount to an armed conflict are fairly exceptional. It is more common that a peace operation is deployed into a situation of an armed conflict between other parties. Think about Eastern Congo, for instance, or into a volatile situation that then deteriorates into an armed conflict, again, between other parties. And in these situations, the peace operation cannot, without more, conduct operations according to LOAC or be made the object of attack, whether through cyber means or otherwise, in accordance with LOAC. Essentially, the protection of a peace operation and its personnel and assets hinges on the peace operation not being a party to the armed conflict, and the protection of individual members of such peace operations depends on whether or not they are directly participating in hostilities. In other words, in the cyber realm, much as the kinetic world, personnel and cyber installations, editorial and units of peace operations are entitled to protection from attack to the extent that they are entitled to the protection given to civilians and civilian objects. The military personnel and equipment of a peace operation will, however, become subject to the law of armed conflict if and when the peace operation becomes a party to an armed conflict or is, or is being used to, directly participate in hostilities. And obviously, this being subject cuts both ways. It entitles the peace operation to conduct operations under LOAC, but it is also susceptible to being made the object of attack, including by cyber means within that regime. So one of the essential issues that comes to the fore is then the determination whether or not and for what time a peace operation is to be considered a party to an armed conflict. And that, in turn, involves a fairly complex issue or complex issues of fact and law and has to be determined on a case-by-case basis in light of the factual environment and the operationalization of the mandate of a peace operation within that environment. I'm running short of time, so let me then briefly turn to the third issue of responsibility for cyber operations in the course of peace operation. You may have noted that thus far I've been fairly vague in far as the relevant legal person that acts in peace operations is concerned. I have referred to both the United Nations and troop-contributing nations when discussing the applicable law, and I have also referred to the peace operation becoming a party to an armed conflict, and these imprecisions, for once, were deliberate because I wanted to preserve it for the discussion of issues of responsibility to now dig a little deeper into this question, into the question who the relevant actor actually is. That is, of course, not to say that that question is only pertinent in the realm of responsibility, i.e. secondary rules. Obviously they are not. To identify the actual legal person that is acting when peace operations are being conducted has also far-reaching consequences for the applicable primary rules. If we were to come to the conclusion that when a peace operation is being conducted it is only the United Nations that is acting, obviously we are also talking about the international legal rights and obligations of the United Nations that come into play, and, by contrast, if we were to say it is the troop contributing nations, it would be the rights and obligations of those TCNs that govern as primary rules the conduct of the TCN. However, the reason why I have reserved the issue until a discussion of responsibility is that both on the level of primary rules as well as secondary rules, the question is one of attribution. We determine the applicable primary rules by asking who, in fact, is acting. Is it the UN, is it the TCNs, or perhaps even both? And we also determine the responsibility of any of these actors by asking whether a given act or mission can be attributed to them. That is why I want to spend the last minute or one and a half on the question of attribution in peace operations. As many of you will know, the European Court of Human Rights has addressed this matter rather controversially in Bekhami and Saramati and some other cases and posited that the decisive factor for attributing acts within a peace operation is whether, and I quote, the United Nations Security Council retained ultimate authority and control so that operational command only was delegated, end of quote. And the court expressed its opinion that the mere fact that the presence of a peace operation in a receiving state was based on a Security Council resolution and that such a peace operation was exercising lawfully delegated Chapter 7 powers of the United Nations Security Council means that the action at hand is in principle attributable to the United Nations. And as many of us also know, of course the reactions to this judgment of the European Court were overwhelmingly critical and in my view rightly so. Not the least, the International Law Commission in its recent work on responsibility of international organizations has distanced itself from such a standard and has retained the standard of effective control when it comes to an organ of a state that is placed at the disposal of an international organization such as national contingents that are then placed at the disposal of the United Nations in the context of a peace operation. Now if we were to apply this, and I stress again in my view, correct standard of effective control or effective operational control more precisely, the question at hand, to our question at hand, a cyber operation in the context of a peace operation would then have to be attributed to the United Nations if and when the letter exercises effective operational control. Now one, and this is the final point that I make, one of the intriguing questions then is whether such an attribution to the United Nations automatically excludes a simultaneous attribution to the TCN. And an interesting development in that respect are two recent judgments, one from the Netherlands, the other from Belgium, both of which seem to suggest an answer in the negative. The Dutch judgment in particular expressly recognizes the possibility that more than one entity may possess effective control and that conduct in question hence can be attributed to more than one entity. While that possibility has also been contemplated in the work of the International Law Commission and academic writings, the Dutch court is, to my knowledge at least, actually the first judicial determination of the existence, or affirmation I should say, of the existence of such dual or maybe even multiple attributions. At the same time, I'm certainly not submitting here that this is a matter of course, that whenever you have a UN peace operation you can simultaneously attribute to both the United Nations or the TCN. If you look at the factual basis of the judgment as concerns for Benitez and hence also concern fairly exceptional, I would argue, circumstances, I think it would be a step too far to deduce from that judgment the general principle that there's always simultaneous application. However, there may be circumstances in which an act can be attributed to not only the United Nations but also the TCN. And with that, my time is up and I would like to thank you for your attention.