Illegal Cyber Operations and the Concept of ‘Positive Obligations’ of States
Résumé
"Bannelier-Christakis began by pointing out that hostile cyber operations are seen as one of the biggest threats to national security. Given this, it is important to consider the legal responsibilities states have in responding to this threat vis-à-vis other states. Bannelier-Christakis explained that the concept of due diligence is significant in this regard, since it places an obligation on states to notify other states and react to illegal cyber operations. The concept of due diligence is linked to the concept of the sovereignty of states: no state is allowed to knowingly allow their territory to be used to harm another. However, there remains a problem that is difficult if not impossible to overcome: how does one prove that there was knowledge of the attacks from the transit states? And, following on from this, how could these transit states therefore be held accountable?
Bannelier-Christakis went on to provide a number of examples that highlight this difficulty. She posed the question, what is the standard of proof required to show that a transit state knew that an operation was taking place? Additionally, does our principle of due diligence apply to those who try and evade requests of due diligence because they are ignorant and should the principle extend to those who ought to know?
The presentation then moved on to consider some of the potential implications of these questions, including – notably – whether cyber operations and due diligence combine to create a requirement that states should monitor all cyber activity (something that is described as a ‘cornerstone’ in the recently published French White Paper of Defence). If this is indeed the case, could due diligence become a Trojan horse for the erosion of civil liberties?
Bannelier-Christakis argued that states should only be permitted to operate within the limits stipulated by international law and that cyber diligence should only allow monitoring in a manner that links with other existing legal frameworks (including human rights frameworks).
What then are the positive obligations that states need to take? Bannelier-Christakis argued that we must first recognise that positive obligations should not create an unreasonable situation for the state; an element of reasonableness should figure in our expectations. Having said this, Bannelier-Christakis argued that some legislative measures are surely required to respond to these challenges and recognise states’ obligations to prevent and protect. This is something that the international strategy for cyberspace recognises as important in relation to protecting both public and private information infrastructure. But states should also be obliged to react and warn potential victims of cyberattacks and to try and terminate the illegal activity and punish the event.
Bannelier-Christakis concluded by reiterating that the concept of due diligence requires more than just a duty to terminate an attack. She argued that seeking an international agreement on cyberterrorism would be an effective way in which to make the concept of due diligence more compelling."