Methodology of identifying customary international law applicable to cyber activities

Abstract

What is striking about recent scholarship on the application of customary international law to cyber activities is how little has been dedicated to the preliminary question of how one identifies the applicability of existing rules of customary international law to cyber operations. Yet, the answer to this preliminary question holds the key to answering many of the questions which arise regarding whether existing rules of customary international law apply to cyber activities. This article seeks to answer the preliminary question. After providing background on the nature of customary international law, and in light of recent scholarly trends and what is often implied in literature on cyber activities, it makes the argument that rules of customary international law are not interpretable. Accordingly, reference must be made to state practice accepted as law for the purpose of identifying applicable customary international law; the article provides guidance on how this should be done. For a precedent of state practice to be relevant to determining the existence of a customary rule applicable to a cyber activity, pursuant to the International Court’s jurisprudence, the precedent must not have significant distinguishing features from the cyber activity concerned. For determining whether a precedent of opinio juris recognizes the existence of a customary rule applicable to the cyber activity, it is necessary to determine whether the relevant state pronouncement intended to accept as law a rule applicable thereto. In anticipation of objections, the article also addresses the practicability of the approach laid out.

1. Introduction

Cyber technologies, which for the purpose of the present article connote technologies relating to digital communication, ¹ pose many difficulties relating to the identification and application of international law. Indeed, numerous volumes – particularly over the past few years – have been written on the application of various areas of international law to the use of cyber technologies. ² While much of this literature discusses the application of treaty rules to the use of cyber technologies, the literature frequently engages with the application of customary international law.

Scholars who have written on the application of international law to cyber operations have sometimes touched upon issues of methodology in identifying customary international law. ³ Yet, what is striking about the recent scholarship is how little has been dedicated to the question of how one identifies the applicability of existing rules of customary international law to cyber operations. ⁴ In other words, very little attention has been given to the question of methodology for determining the applicability to cyber operations of rules of customary international law which did not develop with cyber operations in mind. For example, the second edition of the Tallinn Manual – probably the most influential piece of academic literature regarding international law and cyber operations – simply states that its authors:

were unanimous in their estimation that existing international law applies to cyber operations … Accordingly, the task of the International Groups of Experts [which drafted the successive Manuals] was to determine how such law applies in the cyber context, and to identify any cyber-unique aspects thereof. ⁵

Yet, the answer to the preliminary question of determining the relevance of (pre)existing customary international law to cyber operations holds the key to answering many of the questions which arise regarding whether existing rules of customary international law apply to cyber activities. Accordingly, the purpose of this article is to provide a guiding answer to the question how one identifies whether existing rules of customary international law are applicable to cyber activities; or, perhaps to be more precise, whether existing state practice accepted as law is relevant for identifying customary international law applicable to cyber activities.

One might question the practical value of an article focusing on pre-cyber-age (so-to-speak) rules of customary international law in identifying applicable customary international law to cyber operations. Indeed, in recent years, a growing number of states have published their positions on the application of international law to cyber operations. ⁶ Moreover, there is little reason to doubt that many such statements constitute the acceptance as law (opinio juris) of the states which authored them.

However, there are several reasons why these statements – as things currently stand and for the foreseeable future – generally do not relieve the need to have recourse to rules of customary international law already in existence prior to the widespread use of cyber technologies to determine the legality of cyber operations. First, most of the states which have pronounced their positions – at least beyond general recognition of the applicability of international law, or areas thereof, to cyber operations – are western states. While some Latin American states have expressed their legal positions as well, ⁷ as far as I am aware no African state has expressed detailed positions on the application of international law. ⁸ Similarly, Asian states too have remained silent on the application of international law to cyber operations, with the exceptions of Japan, to a lesser extent Singapore, and precariously Iran. ⁹ As is well established, for the development of customary international law, state practice accepted as law must be representative of different geographical regions and interests of states. ¹⁰ The absence of major geographical regions from the discussion on the application of international law to cyber operations undermines any claim that the recent flurry of government statements is sufficiently representative.

Second, the states which have expressed their positions are often in disagreement. Take for example the discussion on the concept of ‘attack’ under international humanitarian law (IHL) – a concept crucial for determining the applicability of rules concerning distinction, proportionality, and precautions to acts in the conduct of hostilities. ¹¹ Some states consider that only acts which cause physical damage, or death or injury to persons, can amount to ‘attacks’; ¹² others consider that causing the loss of functionality of cyber infrastructure can, too, amount to an ‘attack’; ¹³ and others, still, also consider that additional disruptive cyber operations, such as the deletion of data, can amount to an ‘attack’. ¹⁴ Such lack of uniformity prevents custom on the matter from developing. ¹⁵

Third, the fact remains that, while these statements cover significant ground on the application of international law to cyber operations, they hardly cover the entire corpus of rules of international law potentially relevant to cyber operations. Thus, few statements address in detail the application of the law of neutrality to cyber operations. ¹⁶ Similarly, for example, very few address questions relating to the inviolability of state property. ¹⁷ For these reasons, it is usually necessary to determine whether pre-existing rules of customary international law apply to cyber operations.

As for the article’s structure, it will begin with more general observations on the nature of customary international law (Section 2). These observations will inform many of the arguments in the sections of the article which will follow. Then, in light of recent scholarly trends and what is often stated or implied in literature on cyber activities, the article will make the argument that rules of customary international law are not interpretable (Section 3), making it necessary to refer (back) to state practice accepted as law for the purpose of identifying applicable customary international law. The article will seek to provide guidance on how this should be done (Section 4). In anticipation of objections to the guidance laid out, the article will address the practicability of the approach laid out (Section 5).

2. The nature of customary international law

For many years, various theories have been provided on the nature of customary international law. ¹⁸ It would be beyond scope of the present article to adequately analyse this rich literature. Rather, I shall briefly lay out the approach I have followed. As a starting point, we should ask how international law binds. As the late Prosper Weil wrote: ‘[l]e droit international existe, je l’ai rencontré’. ¹⁹ That is, states usually abide by international law and certainly invoke it, but most importantly recognize it as law – that is how we know it exists. ²⁰ Perhaps more significantly, states very rarely query why international law in general – or customary international law in particular – is binding. ²¹

According to states, how does customary international law become binding? In contrast to what may have been the situation in previous times, the past few years have seen a substantial number of states express their position on this question, in light of the International Law Commission’s invaluable work on the identification of customary international law. States have overwhelmingly supported the position that state practice and acceptance as law, or opinio juris, are constitutive elements of customary international law. ²² Pertinently for the next section of this article, I am unaware of any state considering that additional or alternative elements are relevant in identifying customary rules.

Of course, implicit in this method of determining the nature of customary international law is a state-centred analysis. Others have favoured broadening the scope of actors relevant in determining the nature of sources of international law, such as international courts and tribunals. ²³ However, considering state-centred and horizontal nature of international law, ²⁴ I believe such positions go too far.

A few additional observations should be made regarding the subjective element of customary international law. There is sometimes disagreement regarding the appropriate name of this element. While the term enshrined in Article 38(1)(b) – ‘accepted as law’ or ‘acceptée comme étant le droit’ – is often employed, the Latin term opinio juris is employed as much – if not more. The latter derives from the longer term opinio juris sive necessitates. ²⁵ While directly translating to mean ‘legal opinion or necessity’, ²⁶ it in essence refers to ‘the view (or conviction) that what is involved is (or, perhaps, should be) a requirement of the law, or of necessity’. ²⁷

Yet, the term opinio juris is often employed by states ritually; basically, as a synonym for ‘accepted as law’. ²⁸ One rarely finds states using on their own accord the full term ‘opinio juris sive necessitatis’. ²⁹ Moreover, there also does not seem to be a significant difference between ‘acceptance as law’ and opinio juris, even when the latter is understood literally. One would need to be naïve to believe a state would have ‘view’ or ‘conviction’ that something is or should be law without some form of acceptance in that process. ³⁰

If the subjective element of customary international law is the equivalent to acceptance as law, this would mean that it is a unilateral juridical act (acte juridique) ³¹ – ‘the exercise of a power, i.e. a manifestation of will intended to produce the legal consequences determined by this will’. ³² It is unilateral since the legal effects of one state’s acceptance as law are not dependent on any other state. ³³ While there must indeed be acceptance as law attached to the practice on the part of a generality of states for a customary rule to develop ³⁴ – and in this sense legal effects are dependent on other states – this does not vitiate from the proposition that the acceptance as law on the part of each state is an independent exercise.

3. Applying existing rules of customary international law to cyber operations by interpreting those rules?

A technique which has been both expressly and implicitly employed in quite a broad range of scholarship seeking to apply existing rules of customary international law to cyber operations is that of interpretation. ³⁵ The contention in this scholarship is not (solely) that one may engage in interpretation to properly comprehend a state’s practice or to give meaning to the opinio juris pronounced by a state. ³⁶ Rather – and this is the key point – it appears to be argued or presumed that rules of customary international law, once in existence, can be interpreted without needing to have recourse to the state practice accepted as law which gave rise thereto in determining their scope and content.

This trend in scholarship on international law applicable to cyber operations should be considered in light of a broader recent trend in international legal scholarship of considering that rules of customary international law can be the subject of interpretation. ³⁷ Significantly, there seems to be growing interaction between the trend in cyber-focused international law scholarship and the broader scholarly trend on interpretability of customary international law. ³⁸ Given that the generalist scholarship has focused in great detail on the questions of interpretation of rules of customary international law, it is useful to consider this broader trend in tandem with scholarship on cyber operations to properly comprehend what, in the eyes of its proponents, is involved in the interpretation of rules of customary international law.

From the various strands of recent scholarship supporting the notion of ‘interpretability’ of customary rules, it seems that the key proposition is that once a rule of customary international law has crystallized, one need not have reference to state practice and acceptance as law (opinio juris) which gave rise to the rule in question to determine the rule’s applicability to a given situation. ³⁹ Rather, by making use of interpretive technique(s) – that is, techniques for providing meaning to something ⁴⁰ – one may elucidate existing rules of customary international law and thus determine their applicability to given situations. ⁴¹ While the precise interpretative techniques applicable in this context are somewhat less clear, the literature on the interpretability of customary international law often places emphasis on teleological interpretation – giving effect to the purported purpose of a given rule. ⁴²

To further elaborate on what the interpretability of customary international law potentially entails for cyber operations, some examples are useful. Consider the obligation a state owes to foreign nationals in its territory under customary international law to provide protection to their property – an obligation of particular relevance to foreign investors – associated with the concept of ‘full protection and security’ (FPS). ⁴³ For the purposes of customary international law, this rule has been understood to obligate the state to provide protection from physical violence against the foreign person’s property. ⁴⁴ In the context of cyber operations:

[t]he physical security approach would imply, for example, that failures in the exercise of due diligence against cyberattacks and cyberterrorism would not fall under the scope of the [FPS] standard unless some form of “physical” property (e.g. a hard drive or server) is affected. ⁴⁵

However, if customary international law is interpretable, the argument could be made that:

[t]aking into account the fact that immaterial goods have acquired in the last decades an importance they did not have before, it would be logical to extend the scope of application of the FPS standard to attacks carried out by a third party to intangible assets. ⁴⁶

Conversely, if customary international law is not interpretable, one would need to have reference to state practice and opinio juris to determine whether the FPS standard extends to protection from cyber operations.

Similarly, consider the issue of ‘collective’ countermeasures. Under the customary law of state responsibility, ‘[t]he wrongfulness of an act of a State not in conformity with an international obligation towards another State is precluded if and to the extent that the act constitutes a countermeasure taken against the latter State’. ⁴⁷ The practice which gave rise to this customary rule concerned measures taken by an injured state against the injuring state. ⁴⁸ However, largely due to the disparities in cyber capabilities among states, ⁴⁹ it has been suggested in recent years that a third state, upon request from an injured state, may adopt ‘collective’ countermeasures against the responsible state. ⁵⁰ In other words, the third state’s responsibility is precluded because it is adopting a countermeasure, despite the third state itself not being injured by an internationally wrongful act. ⁵¹ In justifying the possibility of recourse to ‘collective’ countermeasures, Michael Schmitt and Sean Watts expressly embrace the possibility of interpreting rules of customary international law, arguing that ‘international law must be interpreted in a manner that affords states a practical remedy when facing clearly unlawful conduct’. ⁵² Yet, in the absence of the possibility of interpreting existing customary rules, it seems difficult to justify the possibility of a third state adopting countermeasures, given the paucity of state practice on the matter. ⁵³

What is perhaps most striking about recent literature on the question of interpretability of customary rules is that, with isolated exceptions, ⁵⁴ the authors of this literature seem to mostly agree that rules of customary international law are themselves interpretable. For example, in a recent edited volume on customary international law, the several articles therein dedicated to the subject of interpretation of customary international law all agree that customary rules are interpretable. ⁵⁵ Is there a case for the contrary position?

3.1 The case for non-interpretability

The identification of a rule of customary international law is determined, as reaffirmed in Section 2, by the state practice and acceptance as law giving rise thereto. Indeed, not a single state appears to have considered that additional or alternative elements are relevant in the identification of customary international law. As the ILC underlined, the ‘identification’ – interchangeable with ‘determination’ – of rules of customary international law concerns both identifying the existence and identifying the content of rules. ⁵⁶ When one interprets a rule, one is essentially engaging in an operation of identification of the rule, as the interpretation instructs what the rule actually is. ⁵⁷ For example, when one interprets Article 2(4) of the UN Charter for the purpose of determining whether cyber operations causing severe financial harm are prohibited as a ‘use of force’, ⁵⁸ one is in essence identifying the rule contained in Article 2(4).

Accordingly, when one contends that a rule of customary international law may be subject to interpretation, they presume that elements other than state practice and acceptance as law are relevant in identifying customary international law, as the interpretation determines the scope and content of the rule; namely, what the rule actually is. It should therefore follow that a customary rule in existence cannot be subject to interpretation, as this goes beyond the valid two-element methodology for the identification of customary international law. This is at least to the extent that the term ‘interpretation’ is not merely used to refer to discerning the existence and scope of state practice and opinio juris. ⁵⁹ Indeed, ‘interpretation’ can also connote ‘ascertain[ment] whether a given rule can claim to be part of the international legal order’. ⁶⁰

It follows that it is state practice in combination with acceptance as law which determine the content of the customary rule, and it is to these elements one should refer in seeking to determine whether – and, if so, how – a given matter is governed by customary international law. How one should go about this task will be the focus of Section 4; in the meantime, it suffices to make the relatively straightforward argument in this and the previous paragraphs.

It should be emphasized that this argument is not novel and has been stated or implied by scholars of far greater stature than myself, albeit primarily during times in which there was little pushback to this argument. For example, Tullio Treves observed that ‘[o]nce the content of a customary international rule has been ascertained there [is] no “linguistic veil” to be pierced in order to determine its meaning’. ⁶¹

Despite suggestions to the contrary, ⁶² the ILC appears to have implicitly rejected the proposition that crystallized customary rules may be interpreted. ⁶³ As Conclusion 2 of the ILC’s Conclusions on Identification of Customary International Law stipulates, ‘[t]o determine the existence and content of a rule of customary international law, it is necessary to ascertain whether there is a general practice that is accepted as law (opinio juris)’. ⁶⁴ The commentary appended to Conclusion 2 elaborates:

To establish that a claim concerning the existence or the content of a rule of customary international law is well-founded thus entails a search for a practice that has gained such acceptance among States that it may be considered to be the expression of a legal right or obligation (namely, that it is required, permitted or prohibited as a matter of law). The test must always be: is there a general practice that is accepted as law? ⁶⁵

The proposition that customary rules are interpretable suggests something different; that one need not ‘always’ have reference to state practice and opinio juris to determine the content of a customary rule. Thus, it is difficult to see how the proposition that customary rules are interpretable may be reconciled with the ILC’s position. Accordingly, in identifying the applicability of rules of customary international which existed prior to times when use of cyber technologies became widespread, one must have recourse to the state practice accepted as law which gave rise to those rules.

3.2 Contrary ICJ jurisprudence?

Some of the scholars who consider rules of customary international law interpretable have sought to deduce from the ICJ’s jurisprudence recognition of the interpretability of customary rules. Accordingly, it is useful to analyse the main ICJ cases, in chronological order, on which reliance has been placed for the purpose of demonstrating the Court’s recognition of the interpretability of customary international law. This is not to say that the analysis below is exhaustive of all the ICJ cases which have been invoked in illustrating purported interpretation of custom. Rather, they are the cases where reliance has been placed on the Court’s express reasoning to justify the interpretability of rules of customary international law. ⁶⁶

Some may question why focus is placed on arguments based on ICJ jurisprudence, rather than other courts or tribunals. Indeed, the jurisprudence of other international courts and tribunals is relied upon as authority for the proposition that rules of customary international law are interpretable. ⁶⁷ However, first, for reasons of space, it would be beyond the scope of the present article to consider every case referred to. Second, one cannot ignore the ICJ’s paramount expertise in generalist issues of international law, in comparison with other international courts and tribunals. ⁶⁸ Its jurisdiction is general, ⁶⁹ rather than limited to rules enshrined in a specific instrument, as is the case for most international courts and tribunals, and therefore its expertise is expected to encompass customary international law. Its 15 judges are primarily persons who ‘are jurisconsults of recognized competence in international law’. ⁷⁰ This is not something which can be said about many international courts and tribunals. For some international courts and tribunals, the constitutive instruments provide that a judge’s expertise need not always lie in international law; ⁷¹ in others, the expertise of many of the judges is, in practice, outside international law. ⁷² Accordingly, the ICJ’s jurisprudence is most authoritative on questions relating to the nature of customary international law.

3.2.1 The Barcelona Traction case

Reference is sometimes made to a brief, isolated passage in Barcelona Traction. ⁷³ This was a case which, inter alia, concerned the ability of an applicant state to exercise diplomatic protection on the basis of the nationality (Belgium) of shareholders of a company, incorporated in a third state (Canada), and in regard to measures taken by the respondent state (Spain) relating to the company. In this regard, the Court referred to its task of ‘interpreting the general rule of international law concerning diplomatic protection’. ⁷⁴

Should the Court’s dictum in Barcelona Traction be understood as going beyond mere identification of the customary rule of diplomatic protection – considering ‘interpret’ can also connote law-ascertainment ⁷⁵ – and referring to actual interpretation of a crystallized customary rule? Upon reading the Barcelona Traction second phase judgment in its entirety, it appears the Court refrained from any interpretation of a customary rule it already determined existed. ⁷⁶ On the contrary, the Court expressed its desire to strictly follow the law developed by states. ⁷⁷ Perhaps most instructive is the Court’s explicit rejection of the applicability to corporations of the Nottebohm ‘genuine connection’ test of nationality of a natural person in determining an applicant state’s ability to exercise diplomatic protection. ⁷⁸ The application of the ‘genuine connection’ test would seemingly have been possible were the already recognized rule of nationality for diplomatic protection from Nottebohm ‘interpreted’, ⁷⁹ instead of referring back to state practice.

3.2.2 The Nicaragua case

Another case to which reference is made for the purpose of proving the interpretability of customary rules is the Nicaragua case. There, the Court observed that ‘[r]ules which are identical in treaty law and in customary international law are also distinguishable by reference to the methods of interpretation and application’. ⁸⁰ It has thus been argued that, ‘[i]n this way, the ICJ accepted that there are methods of interpretation, which are specifically tailored to the needs of customary international law’. ⁸¹

Yet, before seeking to discern anything from this ‘cryptic’ passage in the Nicaragua case, ⁸² it is necessary to recognize that the passage’s focus is on different means of implementation of parallel treaty and customary rules, ⁸³ rather than any purported interpretability of customary rules. Thus, the Court explained immediately afterwards that ‘[a] State may accept a rule contained in a treaty … because the treaty establishes what that State regards as desirable institutions or mechanisms to ensure implementation of the rule’. ⁸⁴ Accordingly, to read into an isolated passage a proposition as dramatic as that customary rules are interpretable – rather than making economical use of language by using a term which can also connote law-ascertainment – seems quite far-fetched. Moreover – and perhaps more pertinently – in the Nicaragua case, too, the Court did little to demonstrate that it, in actuality, sought to interpret an existing customary rule.

3.2.3 The Arrest Warrant case

Although reference is made less often to the Arrest Warrant case in literature supporting the interpretability of custom – perhaps since no explicit statement is made therein to actual ‘interpretation’ – it is nevertheless a case of interest due to the Court’s reasoning therein. The case concerned an international arrest warrant issued by Belgium in April 2000 against Abdoulaye Yerodia Ndombasi – at the time the Foreign Minister of the Democratic Republic of the Congo – for alleged war crimes and crimes against humanity. The DRC’s principal, if not sole, ⁸⁵ legal ground in its submissions for the illegality of the arrest warrant was that it violated Yerodia’s immunity ratione personae; ⁸⁶ that is, an absolute immunity for the person from criminal process, as opposed to immunity ratione materiae, which would solely apply to acts conducted in an official capacity.

In determining the scope of immunity serving foreign ministers enjoy under customary international law, the Court stated that it ‘must … first consider the nature of the functions exercised by a Minister for Foreign Affairs’. ⁸⁷ After surveying the nature of these functions, observing that a foreign minister ‘occupies a position such that, like the Head of State or the Head of Government, he or she is recognized under international law as representative of the State solely by virtue of his or her office’, ⁸⁸ it went on to declare:

The Court accordingly concludes that the functions of a Minister for Foreign Affairs are such that, throughout the duration of his or her office, he or she when abroad enjoys full immunity from criminal jurisdiction and inviolability. That immunity and that inviolability protect the individual concerned against any act of authority of another State which would hinder him or her in the performance of his or her duties. ⁸⁹

At face value, the Court’s reasoning in identifying customary international law smacks of interpretation. ⁹⁰ Instead of surveying state practice accepted as law to determine whether foreign ministers enjoy immunity ratione personae, the Court referred to the functions of foreign ministers, the latter’s similarity to other officials who enjoy immunity ratione personae, and concluded that foreign ministers, too, enjoy such immunity. ⁹¹

Yet, a word of caution is necessary regarding a conclusion that the Court essentially recognized the interpretability of customary rules. In properly understanding the scope of a judgment, it is often indispensable to have recourse to the parties’ pleadings. Formally, these ‘show what evidence was, or was not, before the Court and how the issues before it were formulated by each Party’. ⁹² However, the pleadings also go some way in explaining why the Court in particular cases elaborates in detail, or asserts quite summarily, findings of law. ⁹³ As the late James Crawford observed regarding one of custom’s elements, ‘the strictness of the Court’s approach to opinio juris may depend on whether the state of the law is a primary point of contention between the parties to a dispute’. ⁹⁴

During the Arrest Warrant proceedings, the DRC was adamant that foreign ministers enjoy immunity ratione personae and that this immunity is absolute. ⁹⁵ Conversely, while Belgium contended that Yerodia’s immunity did not apply in regard to war crimes and crimes against humanity, Belgium maintained a more ambiguous position regarding whether the immunity was, to begin with, ratione personae in nature. In its counter-memorial, it began by stating that, ‘ordinarily and as a matter of general proposition, Ministers for Foreign Affairs are immune from suit before the courts of foreign states, and the persons of Ministers for Foreign Affairs are inviolable’. ⁹⁶ However, Belgium proceeded to refer to Sir Arthur Watts’ Hague Lectures, where he opined, regarding, inter alia, immunity of foreign ministers, that ‘specially favourable treatment is in general … accorded to State representatives where that is necessary to enable them to carry out their functions’. ⁹⁷ Belgium sought to expand on this argument, claiming that ‘[i]mplicit in this appreciation is the proposition that the scope and application of these privileges and immunities are limited to circumstances involving the performance by the person concerned of official functions’. ⁹⁸

Yet, in the oral proceedings, the DRC, in laying out the points of agreement between the parties, stated that ‘Belgium no longer seems to dispute the fact that, during their period of office, Ministers for Foreign Affairs enjoy the same immunity from suit in foreign courts as heads of State in office’. ⁹⁹ Rather, the DRC described the point of disagreement as relating to whether an exception to foreign ministers’ absolute immunity existed ‘when accusations directed against Ministers in office relate to crimes under international law’. ¹⁰⁰ Interestingly, while the DRC’s description of the points of (non-)contention was seemingly at variance with what was stated in Belgium’s counter-memorial, Belgium did not appear to take issue with the DRC’s description. Indeed, in its oral pleadings, Belgium focused on whether an exception for war crimes and crimes against humanity existed regarding the immunity ratione personae. ¹⁰¹

In this light, the Court was faced with a half-hearted attempt on Belgium’s part to argue that immunity ratione personae was unnecessary for foreign ministers to exercise their functions, and thus inapplicable thereto, whereas the DRC sought to interpret Belgium’s contentions in a manner that displayed no disagreement on this point. Thus, the Court’s analysis on the general scope of foreign ministers’ immunities – which Judge Oda described as ‘address[ing] this question merely by giving a hornbook-like explanation’ ¹⁰² – was essentially responding to the one precarious argument that was made in the case on the issue; and, pertinently, on the very terms of that argument. The absence of any detailed examination of state practice accepted as law – or even reference thereto – in this part of the judgment cannot be contemplated without regard to this near-absence of disagreement between the parties.

3.3 Interim conclusion

To summarize this section, I argue that rules of customary international law cannot conceptually be subject to interpretation. Moreover, the ICJ’s jurisprudence provides, at best, very weak support for the proposition that customary rules are interpretable; in fact, the opposite would seem to be the better conclusion to reach from this jurisprudence. ¹⁰³ On this basis, it follows that in determining the applicability of existing customary international law to cyber activities, one may not have recourse to interpretive techniques. Instead, one must have recourse to existing state practice accepted as law (opinio juris). Thus, for example, in the abovementioned instance of the customary FPS standard, ¹⁰⁴ one cannot suffice by referring to the significance of intangible goods today to justify the applicability of the FPS standard to the protection of intangible assets from malicious cyber operations. One must have recourse to state practice accepted as law to determine the standard’s applicability – with the answer likely to be negative. ¹⁰⁵ Similarly, one cannot ‘interpret’ the existing customary international law on countermeasures to justify recourse to ‘collective’ countermeasures by a state with advanced cyber capabilities on behalf of a state with lesser capabilities; ¹⁰⁶ here, too, only reference to state practice accepted as law can provide the answer whether such recourse is lawful.

Yet, in support of the position that customary international law is interpretable, the argument has been made that:

[t]he requirements of widespread, representative, constant and uniform state practice accompanied by opinio juris would never be precise enough to account for newly emerging situations, that in any other case (and especially in the case of written instruments) would be easily addressed through the process of interpretation. ¹⁰⁷

Clearly, the advent cyber activities constituted a ‘newly emerging situation’. However, do these potential difficulties render interpretation necessary? The following section of this article seeks to demonstrate the contrary.

4. Determining the relevance of existing state practice and acceptance as law to cyber activities

In laying out a suggested methodology for determining whether existing practice and opinio juris carry relevance for the identification of applicable customary international law to a cyber activity, I shall address each element of customary international law in turn – first state practice and then opinio juris.

4.1 Determining the relevance of existing state practice

On the subject of determining whether precedents of state practice are relevant to a given situation, it must be conceded that the general rules laid out by states on the identification of custom do not provide too much guidance on the matter, and hence one may contend that there is genuine indeterminacy in the rules for identifying customary international law. ¹⁰⁸ On the one hand, it would be somewhat absurd to consider that precedents of practice must involve the exact same circumstances as a particular given instance. On the other hand, the fact remains that it is state practice which – together with acceptance as law – crystallizes custom; hence, the respective precedents of state practice should remain the source for instruction on whether – and, if so, how – customary international law governs a particular set of circumstance.

There has in fact been significant discussion in the jurisprudence of the International Court – both the PCIJ and the ICJ – on questions regarding whether precedents of practice are relevant to the determination whether custom governs a particular matter. Save a few exceptions, ¹⁰⁹ this jurisprudence is generally overlooked. However, the International Court has attained a persuasive approach, under which custom constitutes a workable source of international law while remaining true to the element of state practice. This jurisprudence will be analysed, distilling from the International Court’s approach a methodology for determining the relevance of precedents of state practice in identifying customary international law applicable to cyber activities.

4.1.1 The Lotus case

In the Lotus case, upon laying out its methodology for determining whether a rule prohibited Turkey’s prosecution of the French Lieutenant Demons following a high seas collision between the French-flagged Lotus and the Turkish-flagged Boz-Kourt, the PCIJ stated that relevant practice ‘must be ascertained by examining precedents offering a close analogy to the case under consideration; for it is only from precedents of this nature that the existence of a general principle applicable to the particular case may appear’. ¹¹⁰

Accordingly, in its search for a prohibitive customary rule, the PCIJ omitted from its consideration purported precedents of practice involving crimes committed against one state’s nationals in another state’s actual territory. ¹¹¹ Similarly, it omitted considering precedents relating to the exercise of jurisdiction concerning single-vessel incidents, opining that ‘it is impossible … to make any deduction from them in regard to matters which concern two ships and consequently the jurisdiction of two different States’. ¹¹²

4.1.2 The North Sea Continental Shelf cases

In the North Sea Continental Shelf cases, the ICJ was tasked with determining the law governing the delimitation of a continental shelf between lateral states. In seeking relevant conduct of states regarding continental shelf delimitation between lateral costal states, the ICJ considered ‘the case of median-line delimitations between opposite States as different in various respects, and as being sufficiently distinct not to constitute a precedent for the delimitation of lateral boundaries’. ¹¹³

The ICJ’s approach should be contrasted with Judge Ammoun’s suggestion that the Court ought to have also considered practice concerning delimitation between opposite coastal states, as well as delimitations of other maritime zones, since ‘[t]he underlying concept common to all these stretches of water, which is decisive by way of analogy, is that they all proceed from the notion of the natural prolongation of the land territory of the coastal States’. ¹¹⁴ The Court’s approach should also be contrasted with that of Judge ad hoc Sørensen, who opined in his dissenting opinion that it is artificial to distinguish between adjacent and opposite coastal states for the purposes of delimitation, referring to ‘[t]he difficulties of drawing a clear-cut distinction between the two types of geographical situations’. ¹¹⁵

4.1.3 The Arrest Warrant case (again)

Returning to the Arrest Warrant case, discussed in Section 3, but focusing on the point of contention which clearly separated the parties therein on customary international law – namely, whether there existed an exception to the absolute immunity of ministers of foreign affairs when faced with charges of war crimes and crimes against humanity ¹¹⁶ – the ICJ was careful to narrowly delimit the practice relevant to its analysis. Thus, the ICJ rejected the relevance of the House of Lords Pinochet case, ¹¹⁷ as it did not attest to ‘any form of exception to the rule according immunity from criminal jurisdiction and inviolability to incumbent Ministers for Foreign Affairs, where they are suspected of having committed war crimes or crimes against humanity’. ¹¹⁸

Similarly, the Court rejected the relevance of provisions governing the (lack of) immunity of officials in office found in treaties and other instruments constituting international criminal tribunals – as well as the practice of such bodies – as these ‘do not enable it to conclude that any such an [sic] exception exists in customary international law in regard to national courts’. ¹¹⁹ It should be noted that Judge ad hoc Van den Wyngaert criticized the Court for its ‘minimalist approach by adopting a very narrow interpretation of the “no immunity clauses” in international instruments’, ¹²⁰ rather than taking instruction from purported general trends in practice. ¹²¹

4.1.4 The Jurisdictional Immunities case

More recently, in the Jurisdictional Immunities case, upon assessing whether Germany was immune from proceedings in Italian courts regarding atrocities Germany committed during the Second World War on Italian territory, the Court was confronted with an argument that a territorial tort exception to state immunity precluded Germany’s immunity – that is, an exception to the foreign state’s immunity from jurisdiction for matters concerning torts conducted on the forum state’s territory. ¹²² Instead of examining general precedents regarding torts committed on the forum state’s territory to determine the existence of a customary rule providing such an exception in the circumstances in casu, the Court confined its analysis ‘to acts committed on the territory of the forum State by the armed forces of a foreign State, and other organs of State working in co-operation with those armed forces, in the course of conducting an armed conflict’. ¹²³

Quite revealing is the discussion on the Court’s distinguishing criteria in some of the individual opinions appended to the 2012 judgment. ¹²⁴ Judge Koroma emphasized the ‘nearly limitless liability’ resulting from incidents that occur during armed conflicts – as compared to traffic accidents and the like – that states could be exposed to. ¹²⁵ Judge Keith went further, stressing that armed forces’ acts during armed conflict ‘are acts at the international, inter-State level, of a sovereign nature relating to the implementation of foreign, security and defence policies of the defendant State and are to be assessed according to international law’. ¹²⁶

Conversely, Judge ad hoc Gaja, seemingly addressing the points raised by the former Judges, dissected these justifications and refuted them. ¹²⁷ First, in rhetorical fashion he observed that ‘the conduct of all State organs is equally attributed to the State … Why should a distinction be made between military and other organs of the same State?’. ¹²⁸ Regarding the rationale mentioned by Judge Koroma, Judge ad hoc Gaja opined that ‘[t]he fact that military activities may cause injuries on a large scale does not seem a good reason for depriving the many potential claimants of their judicial remedy’. ¹²⁹ Finally, it appears that Judge ad hoc Gaja considered the fact that reparation for violations of jus cogens norms was at stake as a reason why the form of ‘tort’ in casu militates in favour of an exception to immunity. ¹³⁰

4.1.5 Taking stock of the International Court’s jurisprudence

In seeking to draw guidance from the cited jurisprudence of the successive International Courts, it should be conceded that it will often come down to the judgment of the person seeking to determine the existence of a customary rule where to draw the line regarding which precedents of conduct are relevant for determining whether a practice exists of relevance to a particular matter. ¹³¹ Moreover, the answer is extremely contextual, since each customary rule governs different types of matters in highly diverse circumstances. In this regard, Dapo Akande, Antonio Coco, and Talita de Souza Dias are correct in contending that ‘the exercises of selecting, describing, and evaluating State practice and opinio juris are pervaded by subjectivity and are thus subject to different interpretations’. ¹³²

However, the above cases – particularly when the Court’s position can be contrasted to those of individual judges ¹³³ – provide helpful indicators where the line should be drawn when one seeks to determine whether precedents of state conduct are pertinent in identifying the existence of a general state practice upon determining the existence of a customary rule applicable to the point at issue. It seems that the Court refrained from relying on precedents of conduct which could only at a relatively abstract level be analogous to the cases it was confronted with. Instead, it appears that the Court was only willing to consider instances of conduct which did not have significant distinguishing features from the instance at bar. This was so even where reasonable arguments could be – and were – made to ignore such distinctions.

How does this methodology apply to the identification of customary international law applicable in the cyber context? Consider the law governing blockade in armed conflict – the blocking of all enemy or third state navigation or flight to and from the adversary’s territory or parts thereof. ¹³⁴ A blockade’s validity – and hence the legality of its enforcement – depends on fulfilment of certain conditions; in particular, it must be declared to all states and it must be effectively enforced. ¹³⁵ This law is based on decades – and in the case of maritime blockade, centuries – of state practice in those domains. ¹³⁶ According to the majority of authors of the Tallinn Manual, ‘it is reasonable to apply the law of blockade to operations designed to block cyber communications into and out of territory under enemy control’. ¹³⁷

Yet, there are significant differences between blocking the navigation of vessels and the flight of aircraft, on the one hand, and blocking cyber communications, on the other hand, which render the practice regarding naval and aerial blockades irrelevant for identifying custom applicable to a cyber blockade. For one, a vessel or aircraft in breach of the blockade may be captured and condemned as prize, with title thereto passing to the capturing state; ¹³⁸ it is difficult to conceive how capture and condemnation of data packets could occur. Moreover, the interference with third states’ communications – save with the adversary – would be minimal in the cyber context. Indeed, a typical internet user does not control the route data packets take, and the versatility of the internet would generally mean that data packets would be rerouted, with the user not experiencing noticeable changes in their internet experience. ¹³⁹ The same could not be said in the instance of a naval or aerial blockade, which would necessitate conscious changes in navigation and flight routes to avoid the blockade. ¹⁴⁰

Conversely, regarding notification of a naval or aerial blockade, there was – and is – nothing in the way of using cyber means in notifying a naval or aerial blockade, despite the absence of cyber technologies when the requirement of notification developed. Indeed, historically, notifications have been sent out through various means to get the message of the blockade communicated to other states; such means have included ‘diplomatic means’, telegraphy and print media. ¹⁴¹ There thus do not appear to be significant distinguishing features between notifying the blockade through cyber means – such as by emailing representatives of foreign governments or announcing the blockade on appropriate websites ¹⁴² – and the practice which gave rise to the notification requirement. ¹⁴³

4.2 Determining the scope of acceptance as law

Save instances in which silence would constitute acquiescence in the development of a certain customary rule – which would occur rarely, given the strict circumstances in which silence constitutes acquiescence under international law ¹⁴⁴ – it seems that acceptance as law is most often manifested in the form of words. As noted in Section 2, acceptance as law constitutes a unilateral juridical act. A unilateral juridical act – and accordingly acceptance as law – must be interpreted above all by reference to the intention of its author. ¹⁴⁵ This understanding is inherent in the concept of unilateral juridical act expressing the will or consent of its author. ¹⁴⁶

How should a state’s intentions in its acceptance as law be discerned in determining whether it encompasses cyber activities, or at least certain kinds of cyber activities? It seems that the ordinary meaning of the words expressing the acceptance as law should constitute a starting point. ¹⁴⁷ One should also have regard to the entire statement in which acceptance as law is expressed in order to understand the meaning of relevant parts of it, as well as other official statements made in connection with it, ¹⁴⁸ since the context of an expression of opinio juris will likely inform the expression of opinio juris itself. ¹⁴⁹ Take for example a Czechoslovakia statement in 1964 recognizing a prohibition on intervention extending to ‘any external pressure exercised against the right of a State freely to choose a particular social system or political regime’. ¹⁵⁰ Elsewhere in its statement it doubled-down on this sweeping approach, ¹⁵¹ while echoes of this approach may be found in other Czechoslovak statements from the same period. ¹⁵² Thus, reading the quoted statement in its context, there is little in the way of considering that Czechoslovakia’s sweeping opinio juris – ‘any external pressure’ – was intended to encompass a prohibition extending to state-orchestrated disinformation campaigns on social media stoking fear regarding candidates running for government abroad so that those candidates will not be elected. ¹⁵³

In an expression of acceptance as law, sometimes a concept will be employed which has a specific meaning in international law, or at least in a certain field of international law. ¹⁵⁴ For example, in the Tunisia/Libya case, the Court referred to ‘[t]he fact that the legal concept [of the continental shelf], while it derived from the natural phenomenon, pursued its own development’; ¹⁵⁵ that is, one distinct from the meaning of the scientific concept.

How does one identify whether the concept carries a specific meaning in an international legal context, rather than interpret it according to its ordinary meaning in context? Perhaps the most instructive case in this regard is Spain v. Canada, where one of the key questions facing the Court was whether Spain’s submissions fell within Canada’s Optional Clause declaration reservation, which excluded from the Court’s competence ‘disputes arising out of or concerning conservation and management measures taken by Canada with respect to vessels fishing in the [Northwest Atlantic Fisheries Organization] Regulatory Area … and the enforcement of such measures’. ¹⁵⁶ In interpreting the term ‘conservation and management measures’, the ICJ primarily referred to how the term has ‘long been understood by States in the treaties which they conclude’, as well as how it is used ‘in the practice of States’, including ‘in their enactments and administrative acts’. ¹⁵⁷ Ultimately, as indeed implied by the Court, the question whether a peculiar legal meaning of a concept is borne out from the practice of states is one that should be considered while giving weight to all evidence available. To this should be added, in reservation, that one should also seek to discern whether the expression(s) on the part of the state, or its other statements on the subject, indicate that a meaning different from the generally accepted legal meaning is actually intended.

It is useful to illustrate the relevance of legal concepts in the cyber context. States in their opinio juris have recognized the unlawfulness of conducting ‘attacks’ against civilian objects. ¹⁵⁸ What cyber operations constitute ‘attacks’? As evident from IHL instruments and state practice, the term ‘attack’ is an IHL concept; ¹⁵⁹ it has a meaning peculiar in IHL. ¹⁶⁰ Hence when states use the concept ‘attack’ in their opinio juris, it should be understood in its IHL meaning. This in turn informs whether states accepted as law the possibility of cyber operations amounting to ‘attacks’ and, if so, which cyber operations. It is beyond the scope of this article to provide a detailed analysis on how the term ‘attack’ has been understood by states, beyond the somewhat ambiguous definition in the First Additional Protocol to the Geneva Conventions which provides that ‘attacks’ are ‘acts of violence against the adversary, whether in offence or in defence’. ¹⁶¹ However, it is worth recalling, from the Introduction, that states which have pronounced on the matter in the cyber context diverge in their current understanding of the concept ‘attack’, rendering it necessary to refer to (pre)existing state practice accepted as law on the matter. ¹⁶² A similar divergence is apparent in academic literature. ¹⁶³ Nevertheless, in previous decades, it seems there was little disagreement in state practice that ‘attack’ in IHL referred to ‘violent acts directed at harming the adversary (including the civilian population and civilian objects) through physical injury or destruction’. ¹⁶⁴ It would follow that cyber operations causing physical damage to a civilian object – such as remotely commanding the internal fan of a computer, constituting a civilian object, to stop functioning and thereby causing the computer to overheat and catch fire – could constitute a violation of IHL, according to states’ opinio juris. ¹⁶⁵ Conversely, a cyber operation merely causing a computer to stop functioning, such as by deleting all the software thereon, would not fall within states’ opinio juris which gave rise to the prohibition of attacking civilian objects, as physical destruction is not caused. ¹⁶⁶

5. A realistic methodology?

It is conceivable that the methodology espoused in this article for determining the relevance of existing state practice accepted as law for identifying existing rules of customary international law applicable to cyber activities will be criticized for being unrealistic or impractical. Therefore, in this section, I shall address some likely criticisms.

One likely criticism arises from arguments made by proponents of the interpretability of rules of customary international law, within the meaning explained in Section 3. In this regard, some seem to imply that the necessity of referring back to the relevant state practice and acceptance as law in determining whether something is governed by a customary rule – the methodology suggested in this article – is a burdensome task which is both impractical and does not reflect reality. ¹⁶⁷

However, I believe this position is quite far from the truth. First, it is a matter of fact that those interested in identifying the true scope of a rule, and particularly whether such or other rules are applicable to a given situation, very often have extensive reference to the practice of states. Indeed, from my own practical experience, states – or, more precisely, their legal advisers – do not simply take for granted stipulations in documents purporting to codify customary international law and merely interpret them. Rather, particularly when they are likely to be especially affected by a potential customary rule, they will have recourse to the materials available evidencing, vel non, the existence of a state practice accepted as law. This is the case, even though the workings of those practising international law tend to be concealed from the public eye – often for the purpose of allowing those practising to express themselves freely to their counselees. ¹⁶⁸

Nevertheless, in litigation, where parties to proceedings are frequently compelled to present publicly their analyses, participants often go to great lengths in bringing practice and statements of acceptance as law to demonstrate their positions – incidentally demonstrating the feasibility of the exercise of a thorough empirical analysis in determining the existence of a general state practice accepted as law. At time of writing, there have yet to be instances of international litigation where a significant disagreement existed on customary international law applicable to cyber operations. ¹⁶⁹ However, other instances of litigation involving disputes on customary international law are indicative of the feasibility of a thorough empirical analysis. For example, in the Chagos Archipelago advisory proceedings, the question arose whether the right of self-determination – as it existed in in the years 1965–1968 – encompassed a right of the people to the territorial integrity of the entire non-self-governing territory, or whether part of the non-self-governing territory may be excised therefrom by the colonial power prior to the achievement of statehood by the people. The Court had recognized on previous occasions that the right to self-determination was of a customary nature, without pronouncing on the question of territorial integrity. ¹⁷⁰ However, those states with direct interests in the subject-matter of the proceedings sought to demonstrate in relatively great detail that state practice and acceptance as law did, or did not, encompass a right to territorial integrity in such circumstances. ¹⁷¹

Furthermore, rigorous analysis of the existing customary international law based on empirical evidence is what should be expected from serious practitioners and scholars. ¹⁷² States themselves have emphasized the necessity of this rigour. ¹⁷³ After all, the existence and scope of a purported customary rule often have wide-ranging and serious implications for those subjects of international law bound thereby, and hence rigorous analysis will very often be commensurate to the importance of the issue at stake. For example, consider a situation where a foreign investor falls victim to a ransomware operation, which causes financial losses of millions of dollars. ¹⁷⁴ Subsequently, the investor makes a claim against the host state for violating its customary FPS obligation. ¹⁷⁵ Surely, a rigorous examination whether host states have an FPS obligation towards foreign investors vis-à-vis malicious cyber operations is commensurate to the millions of dollars which could be owed by the host state to the investor.

In any event, the task of examining practice in today’s day and age is more straightforward than seemingly imagined. As the years progress, more and more inductive studies in various areas of international relations are conducted for the purpose of discerning the status of customary international law on a certain matter. Practitioners and scholars alike make reference to such studies, while scrutinizing and building upon them. ¹⁷⁶ For example, in understanding whether ‘collective’ countermeasures are a valid basis for precluding international responsibility, ¹⁷⁷ a vast repertoire of state practice relating to countermeasures is recorded in the ILC’s work on state responsibility, ¹⁷⁸ as well as in more recent scholarly works. ¹⁷⁹ International law scholarship has come some way from the times, lamented by Georg Schwarzenberger in 1947, where the norm in literature was ‘repetition of quotations from the very limited repertoire of diplomatic notes which are taken over from one textbook into another and only rarely supplemented by casual personal excursions of writers into the unknown wilderness of state papers’. ¹⁸⁰ This is not to say that there is not contemporary literature for which Schwarzenberger’s description is accurate; ¹⁸¹ rather, there have been improvements.

Implied sometimes in literature on international law and cyber activities is that recourse to interpretation of rules of customary international law, rather than confining analysis to state practice accepted as law, is necessary to overcome the difficult process of customary international law crystallization for the purpose of addressing contemporary challenges. ¹⁸² Yet, the sources of international law provide a solution to these strictures: the conclusion of a treaty. The reality of international law today is that rights and obligations are primarily found in treaties. ¹⁸³ Of course, drafters of a given treaty do not generally foresee all future challenges which will arise regarding the subject-matter of a treaty, so that drafting a treaty on cyber-related issues will not necessarily provide comprehensive solutions to future problems. ¹⁸⁴ Moreover, treaty negotiations are not a walk in the park. However, the failure of states, until now, to develop the law through treaty and address challenges related to cyber activities seems to be a lack of political will ¹⁸⁵ – not any limitations or difficulties inherent in this process.

The fact that most rules of international law are treaty-based bears another important consequence. Recourse to customary international law is often not only unnecessary but also erroneous due to it not being the applicable law. ¹⁸⁶ For example, it has been observed that ‘[t]he human right that is most susceptible to violation by cyber operations is the right to privacy’. ¹⁸⁷ Considering that the right to privacy is enshrined in several international and regional human rights treaties, ¹⁸⁸ it would generally be unnecessary to look beyond these instruments in determining whether the right to privacy had been violated in a given instance. ¹⁸⁹ As alluded to earlier, ¹⁹⁰ when a rule enshrined in a treaty is the applicable law, it is necessary to interpret the text of the treaty to determine the rule enshrined therein. ¹⁹¹

6. Conclusion

If one is persuaded by the arguments made in this article, it follows that, in order to determine whether an existing rule of customary international law governs a certain cyber activity, it is necessary to have recourse to the relevant state practice and acceptance as law (opinio juris) and discern therefrom – and only therefrom – whether and how customary international law governs the cyber activity. For a precedent of state practice to be relevant in determining the existence of a customary rule applicable to a cyber activity, pursuant to the International Court’s jurisprudence, the precedent must not have significant distinguishing features from the cyber activity concerned. For determining whether a precedent of opinio juris recognizes the existence of a customary rule applicable to the cyber activity, it is necessary to determine whether the relevant state pronouncement intended to accept as law a rule applicable thereto. Conversely, rules of customary international may not be subject to interpretation. To quote the ILC, again, ‘[t]he test must always be: is there a general practice that is accepted as law?’ ¹⁹²

Admittedly, the present article does not provide shortcuts for the identification of customary international law applicable to cyber activities. Yet, it must be emphasized that, in addition to laying out a feasible methodology, it essentially lays out a methodology for implementing what states, the makers of customary international law, have only recently reaffirmed: the identification of customary international law must be grounded in state practice accepted as law.