There’s War and There’s War War

There’s a post at Lawfare discussing an interesting topic. How big does an act of war need to be before it provokes a retaliatory response? The context is cyberwarfare.

In his remarks, Rogers pointed to the U.N. Charter’s Article 51 standard. This was an important maneuver, and it was consistent with the approach generally taken by the U.S. government to analyze cyber operations with an eye toward applicable international legal standards. However, the U.S. interpretation of the U.N. Charter may not always work to its advantage.

In particular, one challenge that the U.S. faces in the cyber domain is that the United States, unlike some states, does not recognize a gap between a “use of force” under Article 2(4) or an “armed attack” under Article 51. In implementing this interpretation, the United States holds that Article 2(4) is not implicated in the cyber domain, absent some physical manifestation involving, as Koh explained, a “significant” destructive effect. For example, in the case of Russian cyberattacks on the electoral system, since the attacks did not cause physical harm and attain requisite “scale and effects,” they did not trigger Article 2(4).

Cyberattacks have not only the potential for causing significant economic harm but for causing physical damage or people losing their lives.

The practical reality is likely that little will be done about cyberattacks by other countries until after a genuinely devastating attack occurs. When that happens whether it’s covered by international law isn’t likely to make much difference.