International Law and Information Operations.pdf

8/14/2019 International Law and Information Operations.pdf

1/19

LEGAL STUDIESRESEARCH PAPER SERIES

Research Paper No. 2007-15 Date: 09-06-2007

Title: New Tools, New Rules: International Law

and Information Operations

Author: Duncan B. Hollis

Cite: New Tools, New Rules: International Law and Information Operationsin

THE MESSAGE OF WAR:INFORMATION,INFLUENCE AND PERCEPTION INARMED CONFLICT(G. David and T. McKeldin eds., forthcoming 2008)

This paper can be downloaded without charge from the

Social Science Research Network Electronic paper Collection:http://ssrn.com/abstract=1009224


2/19

New Tools, New Rules: International Law and

Information Operations

DUNCAN B.HOLLIS1

For more than a decade, military thinkers have debated the impactof information operations (IO) on armed conflict. Responding to the

possibilities (and vulnerabilities) inherent in the Internetsinterconnectivity and the worldwide spread of new forms of

communication, IO has emerged as a new category of warfare.2

According to the U.S. military, IO seeks to influence, disrupt, corrupt orusurp adversarial human and automated decision making while protecting

our own.3 It employs various methods to achieve these objectives. IO

can involve psychological operations (psyops) that utilize both new andold methods of conveying information (e.g., broadcasting satellite radio

messages, dropping leaflets from aircraft) with the aim of manipulating

the views of foreign governments, organizations, or individuals.4 Or, IO

may involve cutting-edge computer network attacks (CNA) that spreadviruses toor hack intoadversary computer systems for the purpose of

disabling, degrading, or destroying such systems (or the infrastructure

they support).5 The overall goals, however, remain the sameaffecting

and protecting information and information systems. Nor is the United

States alone in these efforts; more than thirty other statesincluding

1Assistant Professor of Law, Temple University Beasley School of Law, and,

from 1998-2004, Attorney Adviser, Office of the Legal Adviser, U.S.

Department of State. I want to thank Jeffrey Dunoff, Craig Green, David

Hoffman, David Kaye, Jaya Ramji-Nogales and Peter Spiro for valuable

comments on earlier versions of this paper, and George Deeney and Maria

Murphy for invaluable research assistance.2 See Michael N. Schmitt, Computer Network Attack and the Use of Force in

International Law: Thoughts on a Normative Framework, 37 COLUM. J.

TRANSNATL L. 885, 890 (1999).3 Chairman of the Joint Chiefs of Staff, U.S. Department of Defense,

Information Operations, Joint Publication 3-13, ix (Feb. 13, 2006) (JP 3-13)(listing 5 IO methodselectronic warfare; computer network operations,

including CNA; psychological operations; military deception; and operational

security).4 See id., at II-1. I regard psychological operations not involving information

networks to fall outside the IO definition and subject to regulation by existing

international law.5See, e.g., id., at II-4-II-5; Michael Schmitt, Wired Warfare: Computer Network

Attack and Jus in Bello, 84 I.R.R.C. 365, 367 (2002) (Schmitt II).


3/19

International Law & Information Operations The Message of War

2

China, India and Russiahave reportedly begun to develop similar IO

doctrines or capabilities.6

As militaries work through what IO can do, they must also wrestle

with when and how they can employ iti.e., the question of laws effect

on IO. Of course, states must address what domestic legal constraints, if

any, to place on their militaries IO. For international law, however, thequestion is not so much if legal rules constrain IO, but whether the

existing rules do so appropriately. IO conceives of information and

information systems as both new tools and new objectives for militaryactivities. As such, the existing international legal paradigm operates

largely by analogy and, even then, in a patchwork fashion. Most states

appear content with this situation, denying any need to develop IO-specific rules. In doing so, however, states are doing themselvesand

their militariesa great disservice. Even as it applies to IO, the existing

system suffers from several, near-fatal conditions: uncertainty (i.e.,military commanders lack a clear picture of how to translate existing rules

into the IO environment); complexity (i.e., overlapping legal regimesthreaten to overwhelm military commanders seeking to apply IO); and

insufficiency(i.e., the existing rules fail to address the basic challenges ofmodern conflicts with non-state actors). To redress these deficiencies, I

propose that states adopt a new set of rulesan international law for

information operations, or ILIO.

I. The Existing RegimeInternational Law by AnalogyIn the first treaty prohibiting a weapon of warthe 1868 St.

Petersburg Declarationthe parties agreed that the only legitimateobject which States should endeavour to accomplish during war is to

weaken the military forces of the enemy.7 IOs object, in contrast, is

differentit focuses on affecting the entire adversary (e.g., political

elites) not just its military, and those effects need not result from classic

applications of kinetic force. Such different goals might justify differentrules for IO (or even suggest prohibiting IO insofar as its objectives differ

from the St. Petersburg formulation).

But, it would be a mistake to justify ILIO on such grounds. In

reality, war has always been about the messagedeploying force not onlyto gain territory, but also to send messages influencing enemy (and even

allied) decision-making. Thucydides account of the Melian Dialogue

portrays Athens justification for its eventual slaughter of hostile Melianislanders purely in terms of message. Rejecting Melian pleas for

neutrality, the Athenians contended:

[I]t is not so much your hostility that injures us; it is ratherthe case that, if we were on friendly terms with you, our

6See MAX BOOT,WAR MADENEW448 (2006); Eric Talbot Jensen, Computer

Attacks on Critical National Infrastructure: A Use of Force Invoking the Rightof Self-Defense,22 STAN.J.INTL L. 207, 212 (2002).7 Declaration Renouncing the Use, in Time of War, of Explosive Projectiles

Under 400 Grammes Weight, Saint Petersburg, Nov. 29/Dec. 11, 1868.


4/19


3

subjects would regard that as a sign of weakness in us . . .

by conquering you we shall increase not only the size butthe security of our empire. We rule the sea and you are

islanders, and weaker islanders too than the others; it is

therefore particularly important that you should not

escape.

8

Nor is war as message an entirely western invention. Sun Tzu gauged

the ultimate military objective as lying well beyond the battlefield: to

win one hundred victories in one hundred battles is not the highestexcellence; the highest excellence is to subdue the enemys army without

fighting at all.9 Clausewitzs characterization of warfare belies any

claim that IOs goals are somehow newWar is not merely an act ofpolicy but a true political instrument, a continuation of political

intercourse, carried on with other means . . . [t]he political object is the

goal, war is the means of reaching it and means can never be consideredin isolation from their purpose.

10

Even if IOs objectives do not place it beyond the reach ofexisting international law, perhaps the tools employed in IO do. CNA, for

example, provides a new weapon that can be deployed instantaneouslyand surreptitiously thousands of miles away from its target. Although its

effects can certainly equate to those of kinetic force (e.g., the death and

destruction that would flow from unleashing a computer virus on anuclear power plants operating system), CNA also has the potential to

avoid, or at least minimize, such effects (e.g., where employed to disable

or usurp adversarial information systems temporarily). Such militarycapacity was never foreseen bylet alone available tostates in

developing the existing law of war. As a result, the law of war includesnoprovisions specifically addressing IO. In such circumstances, perhaps

the Lotus principlei.e., what international law does not prohibit, it

permitsexempts IO from existing international law?11

As with arguments differentiating IOs objectives, however,

exceptional arguments about IO methods cannot succeed. The Lotus

principle was adopted in a specific contextwhere states sought to apply

their criminal laws beyond their bordersand has never garnereduniversal application. Indeed, states have explicitly declined to extend

Lotus to the law of war. Under the Martens Clause, the absence of a

treaty provision explicitly prohibiting conduct during armed conflict does

8THUCYDIDES,HISTORY OF THE PELOPONNESIAN WAR, Book V, 95-97, at 402-

03 (R. Warner, trans., 1972). The Melians argued Athenian conquest would

send a different message: Is it not certain that you will make enemies of all

states who are at present neutral, when they see what is happening here and

naturally conclude that in course of time you will attack them too?Id.at 403.9SUN TZU,THE ART OF WAR111 (R. Ames, trans., 1993).10CARL VON CLAUSEWITZ,ON WAR87 (M. Howard, P. Paret, eds., 1984).11See The S.S. Lotus (Fr. v. Turk.), 1927 PCIJ Ser. A, no. 10, 18-19.


5/19


4

not mean that international law permits it.12

The modern version of the

clause, found in Additional Protocol I to the 1949 Geneva Conventions(AP I), indicates in such circumstances civilians and combatants remain

under the protection and authority of the principles of international law

derived from established custom, from the principles of humanity and

from the dictates of public conscience."

13

In other words, the law of wargoverns IO even without mentioning it.

Nor does CNAs novelty or other IO technological innovations

preclude application of the law of war and restrictions on the use of force.States have readily subjected prior novel developments in warfare

e.g., submarines, airpower, chemical and biological weaponsto legal

regulation. In its advisory opinion on nuclear weapons, the InternationalCourt of Justice had no doubt as to the applicability of international

law, reasoning that any threat or use of nuclear weapons must comply

with the international law applicable in armed conflict.14

Moreover, thelaw of war now explicitly requires its continued application to novel

developments. AP I Article 36 records the affirmative duty of statesdeveloping or acquiring a new weapon, means or method of warfare . . .

to determine whether its employment would in some or all circumstancesbe prohibited by this Protocol or by any other rule of international law

applicable.15

Thus, IO cannot escape a law of war analysis.16

To say the law of war covers IO does not, of course, tell us whenand how it applies. States have historically accommodated changes in

weapons, tactics and conflict in one of three ways. First, as AP I Article

36 suggests, states frequently extend existing rules to new types ofwarfare by analogy as was the case in analogizing the rules for land

warfare to the air. Second, states develop specific rules regulatingorprohibitingparticular weapons or their deployment, such as the treaties

on biological and chemical weapons.17 Third, states periodically seek to

12Named after Russias Friedrich Martens, the clause first appeared in Hague

Convention II with Respect to the Laws and Customs of War on Land of 1899.

It has continued to appear in subsequent law of war agreements, including the

1949 Geneva Conventions.13 Protocol Additional to the Geneva Conventions of 12 August 1949, and

relating to the Protection of Victims of Armed Conflict (Protocol I) 8 June 1977,

art. 1(2) (AP I); see also id., art. 35(1). Although not a party, the United States

considers many of AP Is provisions declaratory of customary international law.

See, e.g.,Michael J. Matheson, The United States Position on the Relation of

Customary International Law to the 1977 Protocols Additional to the 1949Geneva Conventions, 2 AM.U.J.INTL L&P. 419 (1987).14Legality of the Threat or Use of Nuclear Weapons (Advisory Opinion), 1996

ICJ Rep. 226 (July 8), 105(2)(D), 35 I.L.M. 809.15AP I,supra note 13, art. 36.16See Louise Doswald-Beck, Some Thoughts on Computer Network Attack and

the International Law of Armed Conflict, 76 INTL L.STUD. 163, 164 (2002).17 See Protocol for the Prohibition of the Use of Asphyxiating, Poisonous or

Other Gases, and of Bacteriological Methods of Warfare, 17 June 1925, 26


6/19


5

update and revise all of the law of war, usually in reaction to recent

experience; the Additional Protocols to the 1949 Geneva Conventionsrepresent the most recent iteration of that phenomenon.

18 At present,

there are no specific rules for IO, nor is there any sign of a more general

revision to accommodate IO. Thus, IO falls under the first approachthe

law of war governs IO by analogy.Conventional wisdom suggests that IO can be effectively

governed by the analogy approach. In 1998, states were cool to Russias

suggestion that international law prohibit information weapons.19

TheU.S. Department of Defense Office of General Counsel later rejected calls

for IO-specific rules as premature, arguing, for example, that the

process of extrapolation of the law of war to IO appears to bereasonably predictable.

20 More generally, in 2003 the International

Committee for the Red Cross (ICRC) opined that the existing legal

framework is on the whole adequate to deal with present day internationalarmed conflicts.

21 A majority of military thinkers agree, arguing in favor

of an analogy approach or decrying the possibility of IO-specific rules aspremature or unrealistic.22

U.S.T. 571; Convention on the Prohibition of the Development, Production and

Stockpiling of Bacteriological (Biological) and Toxin Weapons and on their

Destruction, 10 April 1972, 26 U.S.T. 583; Convention on the Prohibition of the

Development, Production, Stockpiling and Use of Chemical Weapons and on

their Destruction, 13 January 1993, 32 I.L.M. 800 (1993).18See AP I,supranote 13; Protocol Additional to the Geneva Conventions of 12

August 1949, and relating to the Protection of Victims of Non-International

Armed Conflicts (Protocol II), 8 June 1977 (AP II).19See Letter dated September 23, 1998 from the Permanent Representative of

the Russian Federation to the United Nations to the Secretary Generalconcerning Agenda Item 63, U.N. Doc. A/C.1/53/3 (1998); Report of the

Secretary General on Developments in the Field of Information and

Telecommunications in the Context of Information Security, U.N. Doc.

A/54/213 (1999).20 Office of the General Counsel, Department of Defense, An Assessment of

International Legal Issues in Information Operations(Nov. 1999), reprinted in

76 INTL L.STUD. 459, 475, 520 (2002) (DOD GC Memo).21 See ICRC, Report, International Humanitarian Law and the Challenges of

Contemporary Armed Conflicts 4 (Sept. 2003); Sean Watts, Civilian

Participation in Computer Network Attacks 32(on file with author).22 See, e.g., Eric Talbot Jensen, Unexpected Consequences from Knock-On

Effects: A Different Standard for Computer Network Operations, 18 AM. U.INTL L.REV. 1145, 1149 (2003) (Jensen II); Schmitt II,supra note 5, at 396. A

1999 Naval War College conference disfavored CNA-specific rules with respect

to information warfare. Philip A. Johnson, Is it Time for a Treaty on

Information Warfare?,76 INTL L.STUD. 439, 439 (2002). Many there argued

that the law of war could operate by analogy. See, e.g., Yoram Dinstein,

Computer Network Attacks and Self-Defense, 76 INTL L. STUD. 99, 114-115

(2002); Daniel B. Silver, Computer Network Attack as a Use of Force under

Article 2(4) of the United Nations Charter, 76 INTL L. STUD. 73, 75 (2002);


7/19


6

II. The Need for ILIO

A closer examination of the IO law-by-analogy approach revealssubstantial flaws in the conventional wisdom. First, even in the context

of armed conflict, there are serious translation problems with extending

the existing rules to IO. Such translation problems produce uncertainty

for those asked to employ IO, creating disincentives to engage in IO andconflicting views of what the law requires. Second, the vast majority of

IO scholarship has focused solely on regulating IOs application to armed

conflicts involving two or more states. But such analyses are clearlyinsufficient. They ignore the new reality of asymmetrical conflict

increasingly pitting statesnot against each otherbut against non-state

actors. Moreover, any consideration of IO beyond international armedconflict immediately encounters nearly incoherent complexity as IO finds

itself subject to multiple legal regimes. Such complexity undoubtedly

further clouds the minds of military commanders asked to employ IO.Third, and finally, the current rules operate almost exclusively in a

restrictive fashion, limiting when and how states employ IO. The currentregime fails to acknowledgelet alone encouragethe functional

benefits IO can achieve in both traditional and asymmetrical conflicts.By adopting ILIO, states could alleviate all of these problems.

Military commanders would benefit from a single set of rules, especially

if it covered the entire range of circumstances in which militaries mightemploy IO. At the same time, ILIO offers the possibility of lessening the

collateral costs of armed conflicts while improving the relative position of

states in their fight against global terror.

a. Translation ProblemsHundreds of rules currently govern when states can use force (the

jus ad bellum) and how they can use that force in an armed conflict (the

jus in bello). Some of these rules have little to say about IO specifically

(e.g., the protections owed the wounded, sick or shipwrecked). Othersinvolve principles of general applicabilityincluding those on the use of

force, distinction, military necessity, proportionality and perfidythat

encompass IO. Nevertheless, the gap between kinetic weaponry

(including biological and chemical variants) and IO methods can besubstantial, creating acute translation problems. Attempt to apply existing

basic principles, such as the rules on use of force or civilian distinction,

and either no clear rule emerges or the rule ends up operating incontravention of the policies that motivated the rule in the first place.

Douglas S. Anderson and Christopher R. Dooley,Information Operations in the

Space Law Arena: Science Fiction Becomes Reality, 76 INTL L.STUD. 265, 298

(2002). Others characterized the idea as premature or unrealistic. See, e.g.,

Charles J. Dunlap, Meeting the Challenge of Cyberterrorism: Defining the

Military Role in a Democracy, 76 INTL L. STUD. 353, 362-63 (2002); David

Tubbs, Perry G. Luzwick, Walter Gary Sharp, Sr., Technology and Law: The

Evolution of Digital Warfare, 76 INTL L.STUD. 7, 17 (2002).


8/19


7

Prohibition on the Use of Force: The U.N. Charter prohibits states

from the threat or use of force, except when authorized by the U.N.Security Council or pursuant to the inherent right of self-defense in

response to an armed attack.23

Historically, states defined force in terms

of the instrument used, including armed force within the prohibition,

but excluding economic and political forms of coercion.

24

Although notwithout controversy, this distinction reflects an effort to proscribe those

acts most likely to interfere with the U.N.s purposesmaintenance of

international peace and security.The use of force prohibition encounters real difficulty, however,

when translated into the IO context. Commentators have come to widely

divergent conclusions, such that no bright line rule exists for when IOconstitutes a use of force, let alone an armed attack for self-defense

purposes.25

Three different possibilities remain in play. First, the classic

instrumentality approach argues IO does not qualify as armed forcebecause it lacks the physical characteristics associated with military

coercion.

26

The U.N. Charter offers some support for this viewArticle41 lists measures not involving the use of armed force to include

complete or partial interruption of . . . telegraphic, radio, and othermeans of communication. Second, the target-based approach suggests

IO constitutes a use of force or an armed attack whenever it penetrates

critical national infrastructure systems.27

Third, the consequentialityapproach, favored by the U.S. Department of Defense, focuses on IOs

consequenceswhenever IO intends to cause effects equivalent to those

produced by kinetic force (death or destruction of property), it constitutesa use of force and an armed attack.

28

23U.N.CHARTER, arts. 2(4), 42, 51.24 Schmitt, supra note 2, at 905; Horace B. Robertson, Self-Defense against

Computer Network Attacks,76 INTL L.STUD. 121, 134 (2002).25 Silver, supra note 22, at 75; see also Emily Haslam, Information Warfare:

Technological Changes and International Law, J. CONFLICT & SECURITY L.4.2 (2000); DOD GC Memo, supra note 20, at 491. But see Davis Brown, A

Proposal for an International Convention to Regulate the Use of InformationSystems in Armed Conflict, 47 HARV.J.INTL L. 179, 181, n. 12 (2006) (jus ad

bellum of information warfare can be derived with little difficulty).26 Sean P. Kanuck, Information Warfare: New Challenges for Public

International Law, 37 HARV. INTL L. J. 272, 288-89 (1996); David DiCenso,

Information Operations: An Act of War, Air & Space Power Chronicles (July2000).27See, e.g., WALTER GARY SHARP,SR.,CYBERSPACE AND THE USE OF FORCE

129-132 (1999); Jensen,supra note 6, at 229.28DOD GC Memo, supra note 20, at 483; Schmitt, supranote 2, at 913, 919;

Silver, supra note 22, at 85; Dinstein, supra note 22, at 105; Robertson, supra

note 24, at 133. Not all uses of force will constitute an armed attack,bullets

fired across a border may be a use of force, but not an armed attack for purposes

of triggering self-defense. Dinstein, supra note 22, at 100.


9/19


8

The problem, however, goes beyond picking a definitional

standard; absent further elaboration, the novelty of IO methods generatesconfusion regardless of the standard chosen. The instrumentality

approach, for example, would not restrict IO against communications

systems. But, does that mean IO shutting down a civilian air traffic

communication systemdowning airliners and causing significantcasualtiesdoes not qualify as a use of force or give rise to a right of self

defense? In contrast, the target-based approach might suffer from over-

inclusion. IO can produce wide-ranging effects, from merelyinformational (distributing propaganda) to inconvenient (disrupting

systems temporarily via a denial-of-service attack) to potentially

dangerous (implanting a trojan horse doing no immediate harm but withthe potential to cause future injury) to immediately destructive (disabling

a system permanently via a virus). Does the targets identity as somehow

critical alone qualify such divergent acts as uses of force or armedattacks? Finally, even as the consequences approach covers IO effects

that replicate kinetic force, it excludes the very consequences that makeIO so novel. Neither kinetic force, nor political or economic sanctions,

can disable an entire stock market or banking system the way IO canimmediately and without casualties or physical destruction. Do we treat

IO as outside the Charter whenever its effects differ from kinetic force, or

do we include it under the prohibition where its effects have animmediacy not seen in economic or political coercion?

The Principle of Civilian Distinction: Irrespective of how it

commences, once states engage in armed conflict, thejus in belloapplies.Among that laws core principles is civilian distinction, requiring that

conflicting states shall at all times distinguish between the civilianpopulation and combatants and between civilian objects and military

objectives and accordingly shall direct their operations only against

military objectives.29

Militaries can only attack military objectivesthose objects which by their nature, location, purpose or use make an

effective contribution to military action and whose total or partial

destruction, capture or neutralization, in the circumstances ruling at the

time, offers a definite military advantage.30

All other objects are deemedcivilian and off-limits (as are civilians themselves unless they take a

direct part in the hostilities).31

Application of this principle has proved

29AP I, supra note 13, art. 48. Other jus in bello principles may also require

translation into the IO context, e.g., rules on indiscriminate weapons andproportionality. See, e.g.,id., art. 51(4)-(5); Knut Dormann,Applicability of the

Additional Protocols to Computer Network Attacks, I.C.R.C. 5, Nov. 19, 2004;

Doswald-Beck,supra note 16, at 168-69; Jensen II, supra note 22, at 1177-79;

Schmitt II,supra note 5, at 389-390.30AP I,supra note 13, art. 52(2).31Id. arts. 51(2), 52(1). The law of war also provides special protection to

certain objectse.g., medical facilities, objects indispensable to the civilian

populations survival such as drinking water.


10/19


9

difficult even in traditional international armed conflictswitness

questions about whether Serbian television stations or Baghdadselectrical power system constituted proper military objectives.

32 The IO

context, however, exacerbates existing confusion and, indeed, may

actually undermine the concept of civilian distinction entirely.

Among IOs most significant challenges to civilian distinction isconfusion surrounding (i) what IO triggers the civilian distinction

requirement; and (ii) the dual-use nature of most information

infrastructure.33

Generally, civilian distinction does not protect civiliansand their objects from all military operations, only those that qualify as

attacks, defined as violence against the adversary, whether in offense

or in defense.34

As in the use-of-force context, much depends on whichIO qualifies as an attack. IO that results in casualties or physical

destruction likely qualifies, but other effects remain open to debate (e.g.,

neutralizing a target, denying service to a system), while others certainlyfall outside the definition (e.g., psyops, electronic embargoes). The irony

of IO is that the less likely a particular IO functions as an attack, the morelikely its use against civilians and their objects is permissible. IOs

development may actually result in warfare having more impacts oncivilians by expanding militaries ability to target (but not attack) them.

In such circumstances, applying existing civilian distinction rules to IO

challenges the notion that the law of war should protect civilians and theirproperty as much as possible.

35

Restricting IO attacks to military objectives may equally run

afoul of the goal of protecting civilians and their property. The law ofwar places on states a responsibility to separate to the maximum extent

feasible civilian populations and objects from the vicinity of militaryobjectives and dangers of military operations.

36 When they do noti.e.,

where infrastructure has a dual-use serving both civilian and military

purposesit qualifies as a military objective subject to attack, even if itsprimary purpose is not military, but civilian. If that rule holds for IO,

then militaries may attack virtually all computer networks. As of 2000,

95% of all U.S. military traffic moved over civilian telecommunications

and computer systems, and the trend is clearly towards greater

32See DOD GC Memo, supra note 20, at 471-72; Schmitt II, supra note 5, at

381-82; Haslam,supra note 25, 4.3.2.33The status of civilians whom militaries employ to conduct IO raises its own

set of translation questions. See, e.g., Dormann,supra note 29, at 8-9; DOD GC

Memo,supra note 20, at 470-71; Schmitt II,supra note 5, at 383-84.34AP I,supra note 13, art. 49(1). However, all [a]cts or threats of violence the

primary purpose of which is to spread terror among the civilian population are

prohibited.Id., art. 51(2).35See Schmitt II,supra note 5, at 378-79; Haslam,supra note 25, 4.3.2. On the

other hand, even if it has more civilian effects, by having more humane effects

than traditional kinetic weapons, we might want IO to expand traditional

targeting rules. See Jensen II,supra note 22, at 1166.36AP I,supra note 13, art. 58.


11/19


10

consolidation of civilian and military technology.37

The dual-use rule

suggests, therefore, that U.S. adversaries may treat all U.S.communication systems as military objectives and attack them by IO or

kinetic means.38

As such, application of the civilian distinction principle

to IO not only involves uncertainty, it also suggests increasing tension

with the principles purported goal of restricting military attention oncivilians and their property as much as possible during conflict.

Both of these examples illustrate the scope and depth of confusion

that IO generates in the context of armed conflict. In both casesuse offorce and civilian distinctionthe current rules do not translate easily or

clearly. Nor are these isolated examples. Similar problems emerge in

deciphering how the rules on neutrality extend to IO that will oftentransitif not actually affectneutral states and their infrastructure.

Perfidyprohibiting certain deceptions that lead an enemy to believe it

must provide protected status (e.g., feigning surrender or civilianstatus)also raises a host of translation questions in the information

context.

39

All told, states are left without any real sense of what they can and

cannot do in their IO. This leaves militaries in a quandarythey canapply their own translation of the law of war and use of force prohibitions

to IO and trust others will acquiesce. But, foreign forces may not

acquiesce. Indeed, they may adopt conflicting translations that produceunanticipated uses of IO or kinetic force. Alternatively, militaries may

avoid IOs uncertainty, and decline to employ it entirely. For example,

during the 1999 Kosovo conflict, widely circulated reports described howplans to conduct an IO depleting Serbian leader Slobodan Milosevics

personal financial holdings were never executed.40

Of course, whenmilitaries avoid IO that usually means they rely instead on traditional

weaponry, which may actually cost more lives and damage than the more

novel IO method avoided.The lack of clarity has individual effects as well since certain

violations of the law of war (e.g., civilian distinction) constitute war

crimes. We live in an era of increasing individual legal responsibility at

national and international levels. Today, war crimes charges can seize theattention of courts in Belgium or Germany, not to mention the

International Criminal Court. Although jurisdictional hurdles may make

actual prosecutions of U.S. forces unlikely, that will not stop

37Arnaud de Brochgrave, Cyberthreats and Information Security: Meeting the21stCentury Challenge, CSISREPORT7 (May 2001); Dormann, supra note 29,

at 10; DOD GC Memo,supra note 20, at 472.38Doswald-Beck,supra note 16, at 167. Of course, as military objectives, they

would remain subject to the rules on discrimination and proportionality that

might limit how an adversarys military attacked them. See Schmitt II, supra

note 5, at 385.39See AP I,supra note 13, art. 37(1).40Dunlap,supra note 22, at 363.


12/19


13/19


12

conflict is clearly non-international, all agree the rules are more

rudimentary than those operating among states. There is no non-international counterpart to the use-of-force prohibition. Common

Article 3 of the Geneva Conventionswhich does applyappears to

have little relevance to IO, given its focus on humane treatment for

individuals not actively participating in the conflict. Additional ProtocolIIwhich governs classic civil warshas a few relevant rules, including

a prohibition on making civilians the object of attack and protecting

certain installations.44

But Protocol II requires no protection for civilianobjects, nor does it prohibit perfidy. The ICRC has recently suggested

not without controversythat customary international law fills in many

of these gaps, importing rules similar to those found in AP I such ascivilian distinction and rules on deception.

45 Of course, if true, that

simply replicates the translation questions for IO that already exist in the

international context.The most important IO questions occur when IO does not rise to

the level of an armed attack, since that will be where states and non-stateactors will most likely collide. After all, although militaries have devoted

extensive time to developing IO capabilities and doctrines, non-stateactors can perform IO as well. IO technology remains widely accessible,

much less expensive than traditional kinetic weaponry, relatively easy to

use, and capable of deployment from virtually anywhere in the world. Assuch, IO has a particular attraction to non-state actorsincluding

transnational criminal and terrorist elementslooking to target public or

private interests.Once IO leaves the law of war paradigm, however, state options to

conductor defend againstIO become much more limited. Absentstate sponsorship, IO by a non-state actor against a statewhether for

criminal or terrorist purposesmay not qualify as an armed attack. Self-

defense is likely not an option when dealing with non-state actors; statesare expected to deal with them through domestic law enforcement, not

military coercion.46

Even if a victim state traces CNA to a non-state actor

operating in another states territoryno easy task given the ability to

mask CNAs origins and route it through multiple statesit cannot

44AP II,supra note 18, arts. 11-13.45 Jean-Marie Henckaerts, Study on Customary International Humanitarian

Law: A Contribution to the Understanding and Respect for the Rule of Law in

Armed Conflict, 87 I.R.R.C. 175, 189 (2005). For U.S. views critical of theICRC study, see John Bellinger, Wrap Up Discussion I, Opinio Juris (Jan. 20.

2007), at http://www.opiniojuris.org/posts/1169328256.shtml.46See, e.g., Legal Consequences of the Construction of a Wall in the Occupied

Palestinian Territory, ICJ Adv. Op., 9 July 2004, 43 I.L.M. 1009, 1050; Silver,

supra note 22, at 93; Barkham,supra note 42, at 72. The U.S. State Department

Legal Adviser, however, has taken an opposing view. John Bellinger, Armed

Conflict with Al Qaeda, Opinio Juris, July 15, 2007, at http://

www.opiniojuris.org/ posts/1168811565.shtml#2795.


14/19


13

respond directly. To do so would implicate one of the fundamental

principles of the international legal orderthe principle of non-intervention, which provides a state with the right to be sovereign within

its own territory, free from external interference.47

A state will view

another state exercising military or law-enforcement powers within its

territory as a violation of that sovereignty. So, what should an injuredstate do? International law contemplates that the injured state would

notify the state from whose territory it believes the IO originated and

request that state put a stop to it.48

The requested state is expected tocomply with such requests, and only if the requested state is unable or

unwilling to do so, can the aggrieved state take counter-measures (or

perhaps, ala Afghanistan, exercise a right of self-defense against therequested state).

49

When a state is considering deploying IO in ways that will not

constitute a use of force (assuming it can overcome the translation hurdlesto make that call), the situation becomes even more complicated. States

have more than half a dozen different legal regimes to assess in decidingwhether and how to proceed. First, as with responding to non-state actor

IO, a state considering using IO offensively must consider the principle ofnon-intervention and whether its IO will improperly affect the territory of

another state. States are likely to view injury or physical damage as

interfering with their sovereign rights, but not all effects will so qualify.Although states generally treat it as violating their domestic law,

espionagethe covert collection of information about other states, often

in the other states territorydoes not violate any explicit provisions ofinternational law and states widely engage in it.

50As a result, the method

of IOi.e., whether it merely collects data as opposed to altering,usurping or destroying itmay dictate the principles application.

Second, states need to adjust their IO to take into account their

obligations under various, specialized regimes of international law. Forexample, since information infrastructures frequently use outer space to

relay communications or collect data, space law may affect IO. Under

Article IV of the Outer Space Treaty, states have agreed to use the moon,

other celestial bodies, and, by extension, space itself exclusively for

47See, e.g., EMERICH DE VATTEL,THE LAWS OFNATIONS OR THE PRINCIPLES

OF NATURAL LAW, Bk. I, Ch. III (1758); Military and Paramilitary Activities(Nic. v. U.S.), 1986 I.C.J. 4, 106.48DOD GC Memo,supra note 20, at 487-88; Dinstein,supra note 22, at 103.49See, e.g.,Corfu Channel (U.K. v. Alb.) 1949 ICJ 4, 22 (merits); Responsibility

of States for Internationally Wrongful Acts, art. 49, U.N.G.A. Res. 56/83,

Annex, 12 Dec. 2001; DOD GC Memo,supra note 20, at 488.50DOD GC Memo, supra note 20, at 516; Tubbs et al., supra note 22, at 16;

Simon Chesterman, The Spy Who Came in from the Cold War: Intelligence and

International Law, 27 MICH.J.INTL L. 1071 (2006).


15/19


14

peaceful purposes. 51

Although this does not automatically preclude

lawful military activity in space, determining the contours of peacefulpurposes has long been a subject of debate that IO will do nothing to

ease. Moreover, Article IX of the Outer Space Treaty imposes a notice

and consultation requirement before a state engages in any IO it believes

would cause potentially harmful interference with activities of otherStates Parties in the peaceful exploration and use of outer space.52

A

similar obligation exists under the Constitution of the International

Telecommunications Union (ITU). Article 45(1) requires that alltelecommunications stations operate so as not to cause harmful

interference to other states radio services or communications.53

In both

situations, states need to consider forgoing IO effects that might constituteharmful interference (e.g., jamming radio broadcasts). In the ITU,

however, the prohibition does not apply to military radio stations, which

may reopen the door to some otherwise prohibited acts.54

If for somereason IO transits or involves the sea or civilian airspace, additional legal

regimes will constrain IO.

55

Finally, states contemplating IO must assess how other states

domestic laws come into play. States whose territory is the target of anIO may regulate it under their criminal law based on effects within their

territory. States through whose territory IO transits en route to its

destination may do the same. Moreover, if a military conducts IO froman overseas base, the law of the host nation can regulate that conduct and

form a basis for prosecuting individuals engaged in the IO. Although

status of forces agreements (SOFAs) may protect these individuals ifacting in their official capacity, that protection often only applies where

both the sending and receiving state recognize the offense. If IO is only acrime under the receiving states laws, it retains exclusive jurisdiction.

Accordingly, depending on its contentwhich will vary enormously

foreign law may have significant implications for IO.Combined, these two problemsthe insufficiency of the law for

international armed conflict and the multiple, overlapping legal regimes

beyond the law of war paradigmsuggest a system that is extraordinarily

51 See, e.g., Treaty on Principles Governing the Activities of States in the

Exploration and Use of Outer Space, Including the Moon and Other Celestial

Bodies, Jan. 27, 1967, art. IV(2), 18 U.S.T. 2410 (Outer Space Treaty).52Id., art. IX; Anderson and Dooley,supra note 22, at 281-82.53Constitution of the International Telecommunications Union, 1 July 1994, art.

45(1), Annex, p. 1003.54Id.,art. 48.55 See, e.g., U.N. Convention on the Law of the Sea, 10 Dec. 1982, 1833

U.N.T.S. 396, arts. 19, 109 (UNCLOS). The United States regards UNCLOS

as generally codifying customary international law. Other regimes (e.g.,

cybercrime) that might otherwise appear applicable do not govern IO because

the negotiating states excluded their own conduct from regulation. See Council

of Europe Convention on Cybercrime, Treaty Doc. 108-11, ETC No. 185 (8

Nov. 2001); Explanatory Report, Cyber-Crime Convention, 38 (8 Nov. 2001).


16/19


15

hard for states and their militaries to navigate. If, as David Kaye

suggests, complexity in the law of war itself is already a problem forthose who use force, IO only compounds that problem given the array of

additional legal rules to consider, interpret and apply.56

Is it reasonable to

expect militaries and their lawyers to process all of these legal issues

simultaneously, particularly in situations where they may be asked toreact immediately? Do we necessarily want the disincentive to use IO

that such confusion creates where the alternative may be traditional uses

of force? In other words, perhaps the conventional wisdom on theviability of IO law by analogy is simply wrong.

III. ILIOs Benefits

Devising an international law for information operationsILIOcould rectify many of the deficiencies of the current legal system for IO

and provide states with additional functional benefits that do not currently

exist. First, ILIO can remedy uncertainty. Drafting new rules provides anopportunity to rectify all those translation problems that plague IO under

the laws of war. It could give states and their militaries a clear sense ofthe rules of engagement in the information age. Nor does ILIO have to

supplant the existing system entirely; it can easily preserve basicprinciples that continue to make sensesuch as the rule requiring

military necessity in using forcewhile adjusting others (e.g., civilian

distinction, perfidy) to fit the context in which IO occurs.Why not waitas the ICRC suggests

57and rely on what states

actually do in lieu of negotiating an ILIO? For starters, it can take years

for state practice to coalesce into binding custom. States will remainconfused and wary of IO in the interim. Second, attribution issues may

make it difficult to ever discern state practice in IO. IOs strength oftenlies in its anonymity and secrecyvictims of IO may not know they have

been subjected to it, let alone who is responsible (although constantly

changing technology ensures this will not always be the case). Thus, wemay not know what a state believes the law to be, until caught and forced

to justify a particular IO (assuming the victim state wants to publicize the

IO, rather than respond in kind). Ironically, this means states with weaker

IO skills may actually set the agenda. In contrast, by discussing ILIOprospectively, states can discuss the rules free from operational security

constraints and achieve greater certainty concerning their future conduct,

even if done in secret.The need for greater certainty is particularly acute for the United

States. Although it clearly has a comparative advantage in terms of IO

technology, the United States is simultaneously the most vulnerable to IOgiven the societys growing dependence on information and information

systems. In such circumstances, U.S. interests should favor ILIO. It

presents an opportunity to develop rules that could cement U.S.

56 See generally David Kaye, Complexity in the Law of War, in PROGRESS ININTERNATIONAL ORGANIZATION(2007).57Dormann,supra note 29, at 3.


17/19


16

comparative advantage while mitigating existing vulnerabilities. Of

course, other states with less developed IO capabilities are aware of thissituation and might be reluctant to endorse ILIO because of it.

But, ILIO could include functional benefits luring even reluctant

states to the bargaining table. Currently, the rules applicable to IO by

analogy are restrictive, limiting what states can do in the interest ofmaintaining international peace and security, protecting civilian

populations and prohibiting morally reprehensible conduct. But those

interests may not always be served only by restricting IO. If we live in aworld where the threat to states is no longer primarily from other states

but from non-state actors, do we serve international peace and security by

imposing so many restrictions on how states use IO against non-stateactors? Similarly, although IO may impose wider impacts on civilian

populations, IO also has the capacity to produce less harm overallor

even on an individual basisthan traditional warfare. Such possibilitiessuggest that we conceive of the ILIO project not simply as refining

restrictions on IO, but actually enabling it in circumstances that advancethe common interests of states.

For example, rather than seeing ILIO as essentially a question ofrestricting what states do to one another, ILIO could establish rules

enabling states to better meet the challenges posed by non-state actors,

particularly those bent on global terror. In the language of economists,ILIO may reduce the transaction costs states face in combating

transnational terrorism. The current systemwhich would prohibit a

state from responding to an al Qaeda IO attack from Pakistan directly orimmediately, requiring it in instead to ask Pakistan for assistanceis not

terribly efficient and may have high costs for that states safety andsecurity. In its place, ILIO offers an opportunity for states to

acknowledge their collective interest in combating non-state actors

engaged in terrorismto treat them as a threat to the state system itselfand devise cooperative mechanisms that increase the efficiency of such

efforts. This might involve, for example, states such as Pakistan

consenting to suspend the non-intervention principle in certain pre-agreed

circumstances and allowing injured states to respond immediately anddirectly to IO generated from their territory (i.e., to conduct an active

defense to CNA). There is already some precedent for this in the

maritime context, through the practice of shiprider agreements, inwhich a foreign state agrees that one of its officials may serve aboard a

U.S. ship and authorize it to conduct law-enforcement activities against

ships of that foreign state and even within the foreign states territorialseas.

58

58See, e.g., Agreement between the Government of the United States of America

and the Government of Jamaica Concerning Cooperation in Suppressing Illicit

Maritime Drug Trafficking, done at Kingston, May 6, 1997, as amended. Of

course, such cooperative efforts would need to be calibrated to protect legitimate

privacy interests even as they facilitate the fight against terror. See John F.


18/19


17

At the same time, let me be cleardeveloping new rules does not

mean sacrificing the bedrock rationales for the existing legal system,especially those applicable in international armed conflicts (i.e., to

minimize human suffering). To the extent the current law of war relies

extensively on the principle of reciprocity (i.e., a state grantsor

forgoescertain treatment towards the adversary on the expectation itsown forces will be treated likewise), ILIO can operate as a bargain among

the consenting states in much the same way. ILIOs translation of the use

of force prohibition would undoubtedly retain the principles inherentreciprocityi.e., each state agrees to refrain from force, however defined,

so long as the other side does so as well. Similarly, to the extent the law

of war also has a universalist or moral basis (i.e., states do not engage incertain acts even if done by the adversary because they deem such acts

morally reprehensible), nothing precludes ILIO from accommodating that

basis as welle.g., IO-tailored rules on perfidy.Finally, ILIO offers an opportunity for the law of war more

generally. It is no secret that the law of war has proven largelyinadequate (or incapable) of addressing non-international armed conflicts.

For the most part, states see such conflicts as implicating theirsovereignty (or, even their very survival) at levels not presented in

conflicts with other states. Similarly, when the conflict only involves one

state actor versus a non-state actor, the reciprocity rationale for the law ofwar is largely absent. As a result, states have been reluctant to agree to

detailed rules for such conflicts. For ILIO, however, many of the

sovereignty concerns areif not non-existentat least diminished. IOwill frequently lack any direct territorial impact or its impacts can be

temporary and more easily remedied than the casualties and destructionso often witnessed in civil wars. Moreover, the non-state actor threat

often transcends the territorial ambitions that dominated the post-colonial

era. To the extent actors like Al Qaeda constitute a threat, it is not simplyto certain nation states and their territorial integrity, but to the very

concept of a system of secular, equal sovereign states. As such, unlike

past non-international conflicts, there is a reciprocity concern herenot a

concern of reciprocating restrictions, but reciprocating cooperation toforestall a common threat. ILIO offers an opportunity to do this. It

provides states a chance to devise rules in areas that have so far proven

difficult to regulate, to elaborate what international law requires in non-international conflicts (and to coordinate rules in cases short of actual

conflict).

ConclusionConventional wisdoms favored law by analogy approach has

clear flaws. Its translation to IO is rife with uncertainty and complexity,

which will result in less IO or greater conflict among states, courts andinternational institutions about what international law requires of IO. At

Murphy, Computer Network Attacks by Terrorists: Some Legal Dimensions, 76

INTL L.STUD. 324, 344 (2002).


19/19


18

the same time, a law of war/use of force effort to regulate IO is clearly

insufficient where the fight with al Qaeda, the Taliban and otherinsurgents typifies future conflicts far more than old inter-state conflicts.

The need for ILIO becomes even more apparent as the uncertainty of IO

under the law of war is magnified and compounded in trying to discern

the array of rules that govern IO outside of an inter-state conflict. Suchdeficiencies in the status quo beg for a new framework. A newframework could not only remedy the existing systems deficiencies, but

offer additional advantages of its own. States may adopt cooperativemechanismscommon tools to address new threats, preserving their

strengths in IO technology while shoring up against their individual

vulnerabilities to IO.Obviously, ILIOs content can (and should) be subject to great

debate. Similarly, careful consideration needs to be given to the form

ILIO should take. The few suggestions to date have idealized amultilateral treaty that could contain precise and detailed rules on IO. A

framework convention might be more politically palpable, however,setting forth general principles for IO while reserving space for more

specific sets of rules as states agree on them. Nor, is a multilateral treatynecessarily the right format. Why not perfect ILIO first through bilateral

or regional arrangements? Or, perhaps the starting point should be an

experts code of conduct like the San Remo Manual.59

Of course, all ofthis presumes that states and military thinkers appreciate the need to move

beyond the law by analogy approach. The first step, therefore, is to

recognize the deficiencies of the current system and the need, not tomention the advantages, that would come from a new set of rulesan

ILIO.

59 SAN REMO MANUAL ON INTERNATIONAL LAW APPLICABLE TO ARMED

CONFLICTS AT SEA(L. Doswald-Beck, ed., 1995).

Documents

International Law and Information Operations.pdf