Book Symposium: Cyber War and the Question of Causation

Thanks to Kevin Govern and Duncan Hollis for providing the two previous posts (here and here) in this book symposium on Cyber War: Law and Ethics for Virtual Conflicts.

In my post, I want to explore the difficulties arising from causal investigations in cyber attacks.

Everyone knows that the increasing threat of cyber attacks will place immense pressure on the operational capacities for various intelligence and defense agencies. Speak with anyone in military operations (from several countries), and their lists of security concerns are remarkably similar: Russia, ISIS, and cyber (in no particular order). What is more controversial is whether the current legal regime regarding jus ad bellum and jus in bello is sufficient to adequately regulate cyber-attacks and cyberwar, or whether new legal norms should be developed to specifically address these issues.

My own view, which is the focus of my chapter on Cyber-Causation, is that there is insufficient clarity right now regarding the required causal connection between a cyber attack and its kinetic consequences, especially with regard to what counts as an armed attack for purposes of triggering the right to self-defense under Article 51, and what counts as an attack for purposes of jus in bello. I argue that the lacuna is not terribly surprising since the law of war has generally avoided issues of causation because, unlike tort and criminal law, issues of causation are usually (with some notable exceptions) fairly uncontroversial in wartime. Cyber might change that.

Let me explain in greater depth why I think that the increasing threat and deployment of cyber-weapons will force (or should force) the law of war to develop a sophisticated and nuanced account of causation. Causation is largely irrelevant (or at the very least uncontroversial) to the basic structure of the law of war. If you drop a bomb on a village, the results are fairly obvious. The one area (or one of the few) where causation is controversial is dual-use infrastructure targets that have some relationship to both civilian and military operations. Under the law of war, a target is only a permissible military target if, among other things, its destruction will make an effective contribution to the military campaign.

According to Article 52(2) of Additional Protocol I:

attacks shall be limited strictly to military objectives. Insofar as objects are concerned, military objectives are limited to those objects which by their nature, location, purpose or use make an effective contribution to military action and whose total or partial destruction, capture or neutralization, in the circumstances ruling at the time, offers a definite military advantage.

The problem is that destroying almost any civilian target will create some military advantage, if only because it might demoralize the civilian population and spur them to pressure their civilian leaders to sue for peace. But that is clearly overbroad. The difference between permissible and impermissible attacks has to do, in part, with the nature of the causal connection between the attack and the military advantage that it confers. Something about the causal relationship between the terror-killing of non-combatants and the resulting military advantage is impermissible and dangerous. So that is one area where IHL needs a good account of causation. But I think this is a rare case.

I believe that cyber-attack scenarios will trigger immense pressure on IHL to develop an account of causation that is consistent with the unique ways that IHL is adjudicated. I place less emphasis on which account of causation is abstractly correct and instead support the more modest claim that cyber-attacks implicate the concept of causation in previously unseen ways. The result is the emergence of a primary research agenda for IHL at both levels: theory (scholarship) and codification (via state practice and potential treaty provisions). The Tallinn Manual was an excellent start to this process, but I also encourage scholars of causation in other fields to join the conversation.

One reason why this question is so difficult to answer is that traditional theories of causation cannot be reflexively and uncritically grafted into the law of war. Simply put, IHL demands a level of publicity and transparency that generates a significant asymmetry as compared to other fields of domestic law, where the fact-finding machinery of domestic courts is more suited to parsing complex causal phenomena. George Fletcher (in Rethinking Criminal Law) famously distinguished between the pattern of subjective criminality and the pattern of manifest criminality. While the former is appropriate for the criminal law’s extensive fact-finding system, IHL is burdened by the lack of fact-finding resources, and must necessarily rely on the pattern of manifest criminality. Of course, there are international tribunals to adjudicate violations of IHL that constitute war crimes, but let’s remember: (i) only the worst violations of IHL will be adjudicated at an international tribunal; and more importantly (ii) tribunal adjudications are always ex post, never contemporaneous decisions within the moment. The law of war needs a theory of causation that allows all participants to clearly and quickly evaluate the legality of the conduct without needing a courtroom and a fact-finder to make complex factual (and even normative) assessments that may take months to finalize.

Cyberwar presents an especially acute case of this general phenomenon within IHL; the causal processes of a cyber-attack and its downstream consequences are difficult to chart, thus suggesting that the law governing cyberwar should place a premium on transparent rules that, like the pattern of manifest criminality, can be applied by a reasonable third-party observer.

If these issues interest you, feel free to check out the rest of the book here.