Cyber Terrorism, Cyber Warfare and Legal Responses

no definition for terrorism. there have not been terrorist cyber attack with great demages Cyber warfare Physical demage of injury = breach of sovergenity loss of functionality (email of government dont work 2007 Estonia) = not serious enoug (Tallinn manual), could be seen in case that it leads to neseccity to repair assets, than it is breach If Estonia is visiting system of Russia just to read data, it is not a breach. It might be espionage but iis not prohiibited by international law. So they can do espionage   ( below the threshold of loss of functionality). This is happening more often then we think (like). If state A breaches diligence principle State B has a right to respond If there is gorup of hacker “X” operating from territory of state A and state be announce this to state A, state A has obligatory to do smthg. THIS IS obligation under international law, known as due diligence “A State must exercise due diligence in not allowing its territory, or territory or cyberinfrastructure under its governmental control, to be used for cyber operations that affect the rights of, and produce serious adverse consequences for, other States. ” Russia would have obligation to stop attacks due to international law (2007) “The conduct of a person or group of persons shall be considered as an act of state under international law if the person or group of persons is in fact acting on the instructions of, or under the direction or control of, that State in carrying out the conduct” (Article 8 or Articles on StateResponsibility)” financial support does not mean directing these groups. This is not enough to be under international law. USE OF FORCE Article 2(4) UN Charter “All Members shall refrain in their international relations from the threator use of force against the territorial integrity or political independence ofany state, or in any other manner inconsistent with the Purposes of the United Nations.” Tallinn manual art69  “A cyber operation constitutes a use of force when its scale and effects are comparable to non-cyber operations rising to the level of a use of force.” no definition USe of force needs to have physical consequences (needs to rice to certain level, one server down is not enough). This is strategically unclear, it gives them room for operatiion they want to conduct. Use of force is prohibited (Article2(4) UN Charter), unless: • self defence(Article 51 UN Charter) • authorised by UN SecurityCouncil(Chapter VII UN Charter) Self-defence TM “A State that is the target of a cyber operation that rises to the level of an armed attack may exercise its inherent right of self-defence. Whether a cyber operation constitutes an armed attack depends on its scale and effects.”(TM rule 71). Is cyber attack armed attack? Yes, but there has to be sufficiently great consequences (not closely specified) Self defence must be imideate, not after one month for example