It is widely acknowledged that armed reprisals—the limited use of military force by a state in response to a prior illegal action perpetrated against that state—were formally banned by the UN Charter in 1945.Footnote 1 Despite this, states have routinely engaged in the practice and continue to do so today, often with little opposition from the international community. On April 13, 2018, for example, the United States, the United Kingdom, and France launched more than one hundred missiles at Syrian chemical weapons facilities in response to the use of chemical weapons by Bashar al-Assad's regime against civilians in the city of Douma. While these airstrikes are more appropriately characterized as “third-party reprisals,” since those undertaking the reprisals were not the actual victims of the wrongful actions in question, it is noteworthy that only a very small minority of the over seventy states that expressed a view claimed that these strikes violated international law (including, unsurprisingly, Syria, Iran, and Russia).Footnote 2 Likewise, on February 26, 2019, India undertook airstrikes against a terrorist training camp located in Pakistan in reprisal for a suicide attack that killed approximately forty Indian soldiers in Indian-administered Kashmir almost a week earlier.Footnote 3 Beyond increased tensions and calls for restraint, this, too, garnered little international condemnation.Footnote 4
The advent and proliferation of cyber capabilities has arguably created further incentive for reprisals, as state and nonstate actors acquire the ability to undertake cyber operations that, legally speaking, may rise to the level of a use of force or even an “armed attack,” which would give rise to the right of self-defense under Article 51 of the UN Charter.Footnote 5 Indeed, on May 5, 2019, the Israeli Defense Forces destroyed a building in which they alleged Hamas was poised to launch cyberattacks on Israel—therein constituting the first time that a state has conducted a kinetic military operation directly in response to an imminent malicious cyber operation.Footnote 6 This illustrates what might be called “cross domain reprisals,” whereby an actor resorts to the use of kinetic force in a reprisal against a hostile cyber operation, or vice versa. Such a cross-domain reprisal was again demonstrated by the United States in response to Iran downing a U.S. surveillance drone and alleged attacks on oil tankers near the Strait of Hormuz on June 20, 2019. In this case, the United States opted to conduct cyber operations aimed at disabling Iranian intelligence facilities and missile launch systems, precisely because such operations were intended to fall below what would constitute an armed attack.Footnote 7 Lastly, and most recently, on January 3, 2020, the United States killed top Iranian general Qasem Soleimani, as well as nine other Tehran-backed militia officials, at Baghdad International Airport via a drone strike.Footnote 8 While the legality of the strike is still being debated, the immediate international response from states and the United Nations has largely been one of alarm, with fears that the “assassination of Soleimani could ignite serious escalation in the region and possibly lead to war.”Footnote 9
The purpose of this essay is to examine the international law of reprisals in light of these and other instances of states resorting to military measures short of war more generally, paying particular attention to recent developments in the rules governing hostile cyber operations. The first section examines reprisals in international law and suggests that the ban on reprisals was perhaps never as absolute as some believe. The next section examines the developments in the rules of hostile cyber operations and recent trends in state practice, and suggests that these may be further weakening the ban on reprisals. We conclude with a discussion of the dangers that eroding this ban may present, especially in an era of increasing weaponization of cyber capabilities.
The Ban on Reprisals
The contemporary doctrine of armed reprisals has its origins in the ancient practice of “private reprisals.” During the Middle Ages, private individuals were empowered by “letters of marque and reprisal” to undertake acts of self-help against foreign states or their citizens as a means to recover damages incurred by some wrongful act perpetrated by those parties.Footnote 10 By the end of the seventeenth century, with the increasing role of the state and the rise of state responsibility, private reprisals were generally tolerated less, while public reprisals emerged as an important means of self-help, short of war, for states to address and deter wrongful acts conducted against them. Further, throughout the eighteenth and nineteenth centuries, since the right of states to use force was generally understood to be fairly unlimited, it was thought that the right to armed reprisals was also unlimited. This led some commentators to conclude that there was little basis to distinguish between war and reprisals, as their legality was not in question—at least not until the emergence of rules that placed limitations on the resort to force.Footnote 11
While the League of Nations era (1920–1945) succeeded in placing certain limitations on states’ ability to resort to force, it was during this period that the first coherent doctrine of reprisals emerged. The so-called Naulilaa Arbitration between Portugal and Germany, which originated from a 1914 incident involving a German reprisal against Portuguese military positions in present-day Angola, is understood to have established the customary criteria for lawful armed reprisals of the time. These were: (1) There must have been a prior violation of international law by the target state against the claimant state; (2) there must have been an attempt by the claimant state to obtain reparation or redress for the alleged wrong by peaceful means (and such an attempt must have failed or been inappropriate for the circumstances); and (3) the force used in the reprisal must have been proportionate to the original harm done by the target state.Footnote 12
Although it appears reprisals were not entirely forbidden during the League of Nations period,Footnote 13 the UN Charter definitively banned the practice in international law in 1945. Under Charter rules, states are prohibited from using force (Article 2[4]) unless it is either part of a UN-authorized enforcement operation or at the invitation of the state in question, or if they are acting in self-defense against an “armed attack” under the authority of Article 51 of the Charter.Footnote 14 However, not all uses of force rise to the level of an armed attack; “only the most grave uses of force” are grounds for invoking the right to self-defense, whereas lower-level military actions that do not meet the “scale and severity” threshold of an armed attack are not legal grounds for resorting to self-defensive force.Footnote 15 So, even if a state is the victim of the unlawful use of force, if that use of force does not rise to the level of what is considered an armed attack, the victim state may not respond in kind with proportionate force. Such an act would be considered an unlawful reprisal, or a “forcible countermeasure.” This interpretation of the Charter is supported by numerous UN documents, resolutions by UN bodies, expert opinions, and opinions of international tribunals.Footnote 16
However, as early as the 1950s and 1960s, a pattern began to emerge in the conditions under which the UN Security Council was willing to condemn certain instances of reprisals. In essence, those reprisals receiving criticism by the Council were denounced on the basis of their disproportionality, targeting of civilian assets, or the observation that they primarily served a punitive vs. deterrent function.Footnote 17 Scholars such as Derek Bowett observed that some reprisals were more readily condemned by the Council during this period than others, suggesting that it was not the reprisals themselves that were drawing condemnation, but the fact that some did not meet the criteria for what members of the Council believed was acceptable. While certainly driven by prevailing political realities of the time, Bowett nevertheless saw international law evolving in such a way that “reprisals remain illegal de jure, [but] become accepted de facto,” at least if they met certain criteria.Footnote 18
Bowett and other skeptics of the ban on reprisals advanced their claims in the context of a UN collective security system that had been unable to consistently and effectively enforce a system of collective judgment and enforcement, causing states to rely on self-help more than the framers of this system had intended.Footnote 19 As is well known, the UN Charter originally envisaged the right of states to use force in self-defense under Article 51 as a temporary measure available only to the victim state until the collective security mechanisms of the UN could be activated, and a multilateral force could be dispatched. Relatedly, collective enforcement under Chapter VII of the Charter was supposed to be implemented according to Article 43, which commits all UN member states to make their armed forces and military facilities available to the UN Security Council “on its call” to maintain international peace and security.Footnote 20 Needless to say, this is not how the lawful practice of self-defense occurs today. Rather, self-defense remains the purview of states, while collective enforcement under Chapter VII relies on states voluntarily acting on behalf of the UN. Since the Council is not able to consistently and effectively enforce these elements of the collective security system, states have unsurprisingly resorted to self-help, including reprisals.
The International Court of Justice (ICJ) has also suggested certain qualifications in the ban on reprisals. In the Military and Paramilitary Activities in and Against Nicaragua case (Nicaragua v. United States of America) (1986)—which is often cited as evidence in support of the ban on reprisals—the United States argued that its use of force against Nicaragua was an act of collective self-defense primarily on behalf of El Salvador, which had been attacked by insurgents who were supposedly armed and equipped by Nicaragua. However, the court concluded that uses of force that do not amount to an armed attack (in this instance, Nicaragua's alleged assistance to Salvadorian insurgents) do not sanction collective measures involving the use of force, but only permit nonforcible countermeasures on the part of the victim state. In this case, therefore, the use of force by the United States against Nicaragua on behalf of other states was illegal.Footnote 21 The court explicitly ruled that “States do not have a right of ‘collective’ armed response to acts which do not constitute an ‘armed attack.’”Footnote 22 Yet, it is not clear whether the court was saying that the United States acted illegally because forcible reprisals are illegal, or because the United States was not itself the victim of an unlawful act by Nicaragua, and therefore had no right to act on behalf of the victim state. Describing this ambiguity, Tom Ruys claims that “it is rather flabbergasting that the Court flags a crucial potential gap in the rules on the use of force, which would seem to be prima facie” at a disjuncture with the existing international laws on use of force and self-defense.Footnote 23
The more recent Oil Platforms case (Islamic Republic of Iran v. United States of America) (2003), however, leaves open the question of whether armed reprisals may ever be lawful. In this case, the court refused to address whether the United States acted lawfully when it attacked three Iranian oil platforms in response to an Iranian naval mine severely damaging a U.S. Navy ship, thus missing an opportunity to settle the legal status of reprisals in international law. In a separate opinion, Justice Bruno Simma left the door open for reprisals, interpreting the ruling in Nicaragua as limiting the collective use of force, such that self-defense may be undertaken individually or collectively, whereas reprisals may only be undertaken by the victim state alone.Footnote 24 He thus concluded that in response to lower-level hostile actions, such as the naval mines deployed by Iran, states would be entitled to undertake “proportionate countermeasures.” Simma argued that the court in Nicaragua could not have understood this to mean “mere pacific reprisals,” but should have rather interpreted it as “defensive military action ‘short of’ full-scale self-defense”—that is, armed reprisals.Footnote 25
In short, states’ interpretation of and commitment to the illegitimacy and illegality of reprisals is not as concrete as once thought. Nevertheless, the increasingly permissive international climate pertaining to reprisals has also been facilitated by the rules, attitudes, and activities undertaken in what is now considered to be the fifth domain of war. Cyberspace, as a new avenue through which states and nonstate actors alike can conduct hostile operations, is influencing the return of reprisals in a profound way, in terms of both the rules applicable to cyberspace and the state conduct pertaining to cyber operations in recent years. At the core of this apparent erosion are the Tallinn Manuals.
Developments in the Rules and Attitudes regarding Hostile Cyber Operations
Responding to an increase in malicious cyber activities, the NATO Cooperative Cyber Defence Centre of Excellence invited a group of international legal experts (hereafter referred to as the “experts”) to shed light on how cyber operations ought to comply with international law.Footnote 26 The final outputs—known as the Tallinn Manual (2013) and Tallinn Manual 2.0 (2017)—are the most internationally renowned sources on international law applicable to cyber warfare and cyber operations, respectively.Footnote 27 The Tallinn Manuals are not in themselves legally binding, but rather constitute “an expression of the opinion of the two International Groups of Experts as to the state of the law.”Footnote 28 Of course, there are also a huge number of other excellent works that examine cyber operations in light of the laws and ethics of armed conflict.Footnote 29 However, the Tallinn Manuals boast the insights of legal experts from countries around the world (including, to name a few, Belarus, China, Israel, Thailand, and the United States), in areas ranging from human rights law to space law, and with observers from nongovernmental organizations such as the International Committee of the Red Cross.Footnote 30 Given the sheer breadth of expert insight and legal peer review in considering the law applicable to cyberspace, the findings of the two Tallinn Manuals are thus deserving of attention.
A pillar of both of the Tallinn Manuals is that, for the purposes of determining whether an act qualifies as a “use of force” or an “armed attack,” they do not make a distinction between a malicious cyber operation or a kinetic operation, so long as the “scale and effects” are comparable.Footnote 31 This is in accord with the ICJ's understanding of international customary law pertaining to “any use of force, regardless of the weapons employed.”Footnote 32 What matters in the cyber context, according to the Tallinn Manual 2.0, “is not the instrument used that determines whether the use of force threshold has been crossed, but rather . . . the consequences of the operation and its surrounding circumstances.”Footnote 33 Therefore, if a state falls victim to a cyber operation that qualifies as an armed attack, that state can lawfully resort to (collective or individual, cyber or kinetic) self-defense measures pursuant to Article 51. What the Tallinn Manual 2.0 fails to make clear in any certain terms, however, is what a state may lawfully do if it is affected by a cyberattack that falls short of qualifying as an armed attack.
Addressing countermeasures specifically, all of the experts contributing to the Tallinn Manual 2.0 maintain that, as per international customary law, countermeasures (cyber or otherwise) must not rise to the level of an armed attack.Footnote 34 However, the experts then become divided over whether a countermeasure that crosses the use of force threshold, but does not reach the level of an armed attack, would be considered lawful.Footnote 35Most of the experts purportedly reaffirmed the conventional view that the “injured state” is not permitted to respond to the wrongful act perpetrated against it with a use of force.Footnote 36 The victim state would be entitled to impose countermeasures against the offending state in such a way that suspends its legal obligations to that state, but only to the end of inducing the offending state to re-comply with its legal obligations.Footnote 37 Under no circumstances, according to the conventional view, is the injured state permitted to resort to even a proportionate use of force.Footnote 38 As such, most of the experts writing for the Tallinn Manual 2.0 maintain that there is an obligation on the part of the injured state to refrain from using “forcible countermeasures,” cyber or otherwise. The Tallinn Manual 2.0 explicitly notes that this view thereby replicates Article 50(1) of the Articles on State Responsibility and maintains the jurisprudence of the International Court of Justice.Footnote 39
A small number of the Tallinn Manual experts, on the other hand, adopt the view that an injured state could resort to “forcible countermeasures,” cyber or otherwise, in response to a wrongful use of force, so long as those forcible countermeasures satisfy attendant international legal obligations.Footnote 40 According to the Tallinn Manual 2.0, the experts’ reasoning was hinged on the logic that an injured state would be otherwise denied of a proportionate response by being restricted to measures that necessarily fall below the use of force. Indeed, these experts (who, again, represent only a minority) took their lead from Justice Simma's separate opinion pertaining to the Oil Platforms case, and explicitly cited this as influencing their view.Footnote 41
As a consequence of this disagreement and division, the Tallinn Manual 2.0 provides “no such limitation”—that is, the obligation of injured states to refrain from using forcible countermeasures—in its rules on countermeasures.Footnote 42 Whereas existing international law holds fast on the view that countermeasures must not entail the use of force, recent developments in the view of international law applicable to cyberspace leave this open for debate. In other words, because the experts failed to agree, the Tallinn Manual 2.0 does not explicitly outline whether a forcible countermeasure, cyber or otherwise, in response to an initial use of force, would be considered unlawful. By deciding to refrain from including such a limitation, the Tallinn Manual 2.0 thus fails to clearly rearticulate and recommit to a hard ban on countermeasures that rise to the level of a use of force—in other words, the ban on reprisals.
This point of contention is particularly concerning because, by the experts’ own reasoning, there is no distinction between cyber or kinetic operations, as long as the scale and severity are commensurate to the extent to which the act can be regarded as a “use of force” or an “armed attack.” As such, states might feel at liberty to interpret the Tallinn Manual 2.0's leniency as permitting both cyber and noncyber forcible countermeasures in response to both cyber and noncyber uses of force. This problematically paves the way for states to respond to cyber uses of force with traditional kinetic uses of force.
An example of this, noted earlier, is the decision by the Israel Defense Forces (IDF) to airstrike a building where a Hamas cyber operation was allegedly underway. In May 2019, the IDF's official Twitter account tweeted, “CLEARED FOR RELEASE: We thwarted an attempted Hamas cyber offensive against Israeli targets. Following our successful cyber defensive operation, we targeted a building where the Hamas cyber operatives work. HamasCyberHQ.exe has been removed.”Footnote 43 This, admittedly, is a different species of reprisal, since it took place in the context of ongoing hostilities between Israel and Hamas (in other words, a “belligerent reprisal”), and it sought to thwart a suspected cyber operation, thus potentially qualifying as an anticipatory reprisal. Nevertheless, it highlights the problematic potential for states to resort to force in response to even a suspected cyberattack. The softening on the view of forcible countermeasures prompted by the Tallinn Manual 2.0 is therefore troubling. If states believe that they are permitted to resort to forcible countermeasures (at least insofar that their actions will fail to elicit widespread international condemnation), then this is likely to continue to erode the ban on reprisals. Traditional forcible countermeasures are then likely to become easier to contemplate and countenance, ipso facto, thereby risking retaliation and escalation.
Conclusion: Dangers of the Return of Reprisals
When subjected to a use of force, states have an array of pacific actions that they may lawfully resort to under the category of countermeasures.Footnote 44 Nothing in international law has overturned the obligation of states to refrain from using force unless authorized by the UN Security Council or in self-defense under the auspices of Article 51. We are not suggesting anything to the contrary. Our point is that recent interpretations of international law, as evidenced by Justice Simma in the Oil Platforms case and the expert opinions in the Tallinn Manuals, as well as recent state breaches of the law (which have been met with feeble international condemnation), highlight that the ban on reprisals is in a fragile and fractured state.
Each of the cases introduced at the outset of this paper have their own respective complexities. For instance, the airstrikes by the United States, the U.K., and France in Syria technically qualify as a “third-party reprisal” and the case is further complicated by humanitarian considerations. India's reprisals were against the militant group Jaish-e-Mohammed, a nonstate actor not bound by international law but nonetheless based in Pakistan, and Israel's missile strike against Hamas occurred prior to the alleged hostile cyber operation. Yet if we consider Justice Simma's view that proportionate countermeasures could include “defensive military action,” and the Tallinn Manual 2.0's failure to include a limitation on forcible countermeasures, it is conceivable that each of these reprisals could be interpreted as permissible. This is because the mere fact that they qualify as forcible countermeasures does not, according to these views, call for concern, as long as the forcible countermeasures adhere to other legal requirements, such as proportionality. Indeed, it is debatable whether Israel's choice to conduct airstrikes was proportionate to a suspected imminent use of cyber force; it is likewise debatable whether Pakistan's decision to shoot down two Indian warplanes was proportionate with India's own reprisal against a nonstate actor. Nevertheless, the fact that these forcible countermeasures were taken in response to a threat or use of force is not, ostensibly, that with which Justice Simma or the Tallinn Manual 2.0 would take issue.
The example discussed in this paper that would be most appropriately viewed as a lawful countermeasure is the U.S. decision to employ offensive cyberspace operations against Iranian military targets on June 20, 2019. The United States was reportedly “cocked and loaded” for a missile attack against military sites in Iran, but such a reprisal was reportedly called off by U.S. president Donald Trump because the predicted death toll of 150 Iranian personnel was “not proportionate to shooting down an unmanned drone.”Footnote 45 Instead, the United States chose to launch cyberattacks against Iranian facilities precisely because—as the head of the U.S. Cyber Command insisted—these operations are “calibrated to stay well below the threshold of war.”Footnote 46 However, the emerging norms governing cyber operations, as illustrated by the experts’ opinions in the Tallinn Manual 2.0, suggest that these actions may still be considered a use of force if the cyber actions produce results similar in “scale and effect” to a kinetic use of force. This response is in itself concerning because it would suggest that Iran could have interpreted malicious cyber operations conducted by the United States as a use of force. If Iran interpreted the actions in this way, then, according to at least some of the Tallinn Manual 2.0 experts, Iran would be permitted to engage in proportionate forcible countermeasures, cyber or otherwise. Again, it is contentious whether the consequences of the U.S. cyber operation could be considered to be on par with a kinetic missile strike. But by lowering the bar for resorting to forcible countermeasures in response to an initial use of force, these developments necessarily increase the risk of retaliation and the likelihood of escalation. Such developments are therefore dangerous because they hint at, as Shane Darcy puts it, “a reinstatement of the doctrine of armed reprisals, [which] would undermine the established rules of international law on the use of military force and facilitate unilateral resort to force that would actually threaten international peace and security.”Footnote 47
As both Brunstetter's and Pearlman's contributions to this roundtable suggest, there are sound moral and strategic reasons for resorting to limited strikes vs. waging actual war, insofar as we assume that a state's intention in using a limited strike is to try to avoid escalation.Footnote 48 However, even if we agree that limited force is less likely to result in escalation than actual war, applying the principle of the “probability of escalation” in the practice of limited use of force “is plagued by ambiguity” and raises a number of concerns.Footnote 49 First, even if the intention of a state is to limit escalation by opting for limited strikes, whether the situation escalates is ultimately not up to that state, but rather the target state. This places a lot of faith in an entity that is already assumed to be untrustworthy and unpredictable to accurately interpret the limited nature of the strike as an indication of a desire not to escalate, and to act accordingly. As Robert Jervis reflects in the context of the limited U.S. strike that killed Soleimani: “The success of coercion depends on the adversary's choices. . . . Iran may choose acquiescence as the path most in its interest, but this is indeed a choice.”Footnote 50
Second, we should be cautious in assuming that the absence of (immediate) escalation is because the states involved accurately interpret the limited strike as a mechanism intended to avoid escalation. Such an outcome could just as easily be a result of the power asymmetries that characterize most of the examples of limited force examined in this roundtable, wherein the weaker party knows that it would suffer far more if the situation escalated. In this sense, if reprisals are back on the table as a policy option, they are seemingly a tool primarily at the disposal of the powerful against the weak. It is likely that they would be more prone to escalate in less asymmetrical disputes.
Third, and owing to this, weaker states may thus calculate that they are more able to compete by resorting to cyber operations. But again, the deployment of cyberattacks is replete “with multiple opportunities for misunderstandings and miscalculations,” which could produce unforeseen effects, and result in mounting malicious exchanges within cyberspace.Footnote 51 Moreover, as noted above, cyber operations could reasonably be interpreted as entailing a use of force, even if states launch them to explicitly avoid escalation. In such cases, states may then find themselves the targets of kinetic force in reprisal or retaliation.
Not only does contemplating limited strikes as a tool for conflict settlement chip away at the restrictions on the resort to force, it erodes the obligation that states have to resolve their disputes peacefully and normalizes this sort of violence in international politics. The emphasis in international politics should remain on exploring avenues for peaceful recourse to tensions and acting earlier in response to humanitarian emergencies—not lowering the bar for the resort to violence, albeit short of war.
Such developments are further troubling considering recent developments in the use of force against nonstate actors, wherein governments and commentators increasingly recognize that nonstate actors no longer need to be under the “effective control” of a state in order to undertake an armed attack for the purposes of Article 51.Footnote 52 As a result, states have increasingly asserted a broad right to use self-defensive force against nonstate actors in the territory of another state, even without the state's permission if the state is “unable or unwilling” to neutralize the threat.Footnote 53 The United States famously asserted this right after the September 11, 2001, terrorist attacks when it targeted al-Qaeda in the territory of Afghanistan without the country's permission. Since that time, numerous other states (including Colombia, Ethiopia, India, Kenya, Russia, and Turkey) have adopted a similar view to justify their own uses of force against hostile nonstate groups operating in neighboring states.Footnote 54 The various armed activities conducted against the Islamic State in Syria in 2015 hinged on the same interpretation of the law, which was endorsed by the UN Security Council and declared by some to be a “Grotian moment” that created a new rule of international law.Footnote 55 Combined with the normalization of reprisals and the proliferation of cyber capabilities, such an interpretation of international law stands to significantly increase the situations in which states feel they have the right to target nonstate actors located in other states with either cyber or kinetic force.
Our concern in this paper is that the weakening of the ban on reprisals, in tandem with other developments pertaining to uses of cyber force and self-defense against nonstate actors, is (1) leading to a permissive normative-legal environment in which states are more likely than before to resort to uses of force over continuing to pursue alternative pacific measures; and (2) leading to situations ripe for escalation. Suggesting that states may resort to force in reaction to an initial unlawful use of force (cyber or otherwise) not only precariously dilutes the prohibition on reprisals but also threatens to dissolve the distinction between Article 2(4) and Article 51 altogether. Indeed, the precise purpose of the gap between Article 2(4) and Article 51 is to serve as a buffer against escalatory violence. An erosion of this safeguard, facilitated by the return of reprisals, is thus a dangerous development in light of the uncertainty involved in resorting to even limited uses of force and the high costs of further destabilizing the international order.
