Does Russia’s Election Meddling Break International Law?

US spies say Russia meddled in the US presidential election. However, the world’s top minds in cyber warfare aren’t sure if the act constitutes coercion by one state against another. That legal ambiguity is why weaponising stolen information is such a difficult tactic for the United States to counter.

Even the latest version of NATO’s guide to such questions can’t offer a definitive answer. Recently, the alliance’s Cooperative Cyber Defence Centre of Excellence, or CCD COE, released its much anticipated update to the Tallinn Manual, which bills itself as “the most comprehensive analysis of how existing international law applies to cyberspace.”

The manual’s first edition was published two years after Russia’s seminal distributed-denial-of-service attacks on Estonia in 2007. Compiled by 20 experts, it sought to outline the best thinking about what laws apply to states attacking each other over the internet.

Much has changed since then; most importantly, Russia executed a concerted effort to steal and publicise politicians’ email with the aim of influencing the US election. That’s what makes the recent update so important. It provides a roadmap for how states should respond to incidents like that in the future.

In terms of international law, the question is whether by stealing emails and releasing them through Wikileaks and other outlets Russia forced the United States to do something that the latter would not otherwise.

That would constitute meddling in the internal affairs of another state by means of “coercion”, i.e., in a way that prohibits the target from acting freely. It’s an idea that goes back to 1758 but that has taken on new relevance now.

To get a sense of how contentious the issue has become, check out the recent discussion of information warfare at Yale Law School. Right around the 21-minute mark, a small argument breaks out between a young law student and the expert panel over whether Russia coerced a particular election outcome. In reply, West Point’s Aaron Brantly argues that the DNC hack, and subsequent doxxing via Wikileaks, “was not coercion” because it lacked a threat of force.

“We may not like that. It sounds better to say it was coercion. But, in reality, we drank the Kool-Aid ourselves,” Brantly said. “It’s our responsibility as a civil society to process that information.”

Others note that there’s (as yet) no firm evidence that the data theft changed the election’s outcome, so it’s impossible to prove that the meddling caused the United States government or people to do something that they otherwise would not have done.

Bottom line: the degree to which the DNC hack constitutes an act of illegal coercion is a somewhat subjective matter. Even the experts who updated the manual could not come to a consensus.

“The counter view notes that there may have been an impact on the election and the fact that the impact is the result of the hacking differentiates it from mere propaganda or other means of exerting ‘influence’ (as distinct from intervention) by means of information,” said Michael Schmitt, the editor of the manual and a law professor at both the University of Exeter and the Naval War College. “The Russians are masters at playing the ‘gray area’ in the law, as they know that this will make it difficult to claim they are violating international law and justifying responses such as countermeasures.”  

Schmitt explained why that matters. If you could show that Russia’s influence on the election had been coercive then the United States would be legally justified in employing countermeasures that matched the offense, such disrupting the functioning of the Russian government in a way “that would be unlawful but for the fact that they are response to the unlawful activities of the target state and are designed to cause the target state to comply with the law.”

But if the attack was not coercive, then the only real response that the US can employ is something called “retorsion,” or what Schmitt calls unfriendly, but lawful, actions.

“The expulsion of the Russian diplomats and sanctions fall into this category. This is because neither the expulsion of foreign officials nor the imposition of economic sanctions is unlawful,” he said.

At some point, better exit polling and other metrics may allow governments to more effectively trace influence operations to specific effects. You might, for instance, be able to prove beyond reasonable doubt (or at least with high statistical confidence) that a Russian influence campaign did throw the election one way or the other. Until then, drawing a clear link between doxxed information and voter behavior will be next to, impossible, to conclude.

That’s why Russian influence campaigns like the one targeting the DNC will continue.

DefenseOne

Information Warfare isn’t just Russian – It’s also American as Apple Pie:

 

 

« Data Realities: 2017 & Beyond
Malware Traders Switch To Less Suspicious File Types »

Directory of Suppliers

C3IA Solutions

C3IA Solutions

C3IA is a provider of secure ICT, technical programme management and information security services and solutions.

Workspace Technology

Workspace Technology

Workspace Technology provide secure, energy efficient Data Centre solutions and Rack Hosting services.

MWR InfoSecurity

MWR InfoSecurity

MWR InfoSecurity provide specialist advice and solutions in all areas of cyber security,

Somerdata

Somerdata

Somerdata provides specialist cybersecurity consulting, surveillance and communications solutions to Law Enforcement and security agencies worldwide.

Beyond Security

Beyond Security

Beyond Security's testing solutions accurately assess and manage security weaknesses in Networks, Networked Software and Websites.

Lockton

Lockton

Lockton is the world’s largest privately owned insurance brokerage firm. Commercial services include Cyber Risk insurance.

Clearwater Compliance

Clearwater Compliance

Clearwater Compliance specialize in Privacy, Security, Compliance and Risk Management Solutions for Health Care, Law Firms and other businesses.

STMicroelectronics

STMicroelectronics

ST is a global semiconductor company serving customers across the spectrum of electronics applications including Smart Cars and the Internet of Things.

NATO Communications and Information Agency (NCIA)

NATO Communications and Information Agency (NCIA)

The NCIA Cyber Security Service Line is responsible for planning and executing all life cycle management activities for cyber security.

Alipay

Alipay

Alipay.com is a third-party online payment platform and a leader in online payments with 400 million users.

AccessPay

AccessPay

AccessPay's cloud based payments technology connects your business to all major UK & International payments networks through one easy to use tool.

PCI Pal

PCI Pal

PCI Pal’s secure cloud payment solutions are certified to the highest level of security by the leading card companies.

EventTracker

EventTracker

EventTracker delivers business-critical solutions to consolidate, correlate and detect changes that impact the performance, availability and security of IT infrastructures.

SensePost

SensePost

SensePost is SecureData’s independent elite consulting arm, renowned for its expertise, 17 year track record and innovation on the frontlines of cybersecurity.

Secret Double Octopus

Secret Double Octopus

Secret Double Octopus offers the world’s only keyless multi-shield authentication technology for users and things.