Is Foreign State Hacking of an Election An Act of War?

A couple of days ago Benjamin Dynkin, Barry Dynkin & Daniel Garrie, published an intriguing article in the New York Law Journal, “Hacking Elections: An Act of War?” (Subscription required.)  The article is well heeled; Benjamin Dynkin is a law clerk at Grauman Law Group. Barry Dynkin is of counsel at the firm, where he heads the cyber security practice. Daniel Garrie is the editor-in-chief of the Journal of Law and Cyber Warfare and a partner at Zeichner Ellman & Krause.  And its worth summarizing here as food for thought (inasmuch as possibly some intellectual navel-gazing ;-)

We can all agree that Russian interference (from weaponizing electioneering content to outright hacking of system elements) in the United States 2016 election has sparked controversy and heated debate.  Pundits and politicians alike have made broad claims about the scope, impact, and significance of the interference and hacking.  Some, such as Senator John McCain, have gone as far as to declare it an Act of War.  And that's what I suspect sparked this NYLJ article.

So what is an "Act of War?" As the article from the New York Law Journal defines it from references:

“The term Act of War has a particular meaning under international law and is not appropriate as a metaphorical, rhetorical tool” (Dynkin et al. 2017).

While some will throw around the term “Act of War” as a vague measure of a situation's gravity, the term has a precise meaning and comes along with serious implications and expectations.

This raises the question of whether Russia’s actions constitute an act of war. The NYLJ authors point to the UN Charter Article 2(4) (caution: that's a link to some dense detailed content) which explicitly defines an Act of War as:

“The threat or use of force against the territorial integrity or political independence of any state, or in any other manner inconsistent with the Purposes of the United Nations."

In order to interpret whether Russia’s use of cyber means fits inside this definition the authors make use the Tallinn Manual on the International Law Applicable to Cyber Warfare. The manual clearly states that “cyber psychological operations intended solely to undermine confidence in a government […] does not qualify as a use of force." Given this interpretation, Russia’s actions, which sought to undermine confidence, do not constitute an "Act of War."

The article points to other classifications that better fit with Russia’s recent actions, mainly state interference.  In order to qualify as state interference, the action must involve the affairs of a state and be coercive. There's little doubt that an election is considered an affair of the state, and the targeted hacking and misinformation spread by Russia can easily be interpreted as coercive rather than persuasive. This means that Russia’s actions, while not an Act of War, do constitute state interference, an action that violates international law (Dynkin et al. 2017).

Now, there is an important difference between state interference and Acts of War. When international legal norms or laws are violated there is an expectation of an appropriate and proportionate response. For an Act of War, the proportionate response is an Act of War in turn. The response to state interference would be less dramatic, perhaps expelling diplomats or sanctions (as we saw in December in the latter days of the Obama Administration).

The NYLJ article further points to two distinct issues with declaring Russia’s actions as a Act of War if they fail to meet the criteria.

1. The first is obvious; it could lead to an unnecessary escalation of violence with disastrous repercussions (Dynkin et al. 2017).
2. The second possibility is perhaps just as dangerous. Failure to respond to an action declared an Act of War with a proportionate response would set a problematic precedent under which cyber attacks are not deemed as equal to other attacks, despite how devastating they can be (Dynkin et al. 2017).

Quoting from the article, the implications here are serious:

What does this mean on a practical level? As the world's attention tilts towards cyber warfare, and the rules governing it continue to grow, we will be faced with many difficult choices. The 2016 election represents one of these choices. There was certainly reprehensible conduct that should be condemned globally, but unrestrained, hyperbolic, jingoistic rhetoric opens the doors to a Pandora's box of danger and disaster. One risk is opening the doors to inappropriate uncalled-for escalation. If we were to, hypothetically, accept that Russia's alleged conduct represented an Act of War, we would be well within our rights to respond with a proportionate countermeasure. Importantly, this response would, theoretically, not be limited to the cyber domain. A nation that is the victim of an Act of War has the right to respond with a commensurate Act of War in whatever domain (air, land, sea) it deems appropriate. It is not hard to imagine how this could quickly escalate into a disastrous total war.

Of course, the U.S. is not without recourse for state interference. In fact, the rules governing potential response are the same; that is, a response is possible employing a proportionate countermeasure that is implemented in order to ensure the target's compliance with international legal norms. The difference is that actions proportionate to interference with the domestic affairs are quite different than those to an Act of War.

In this new realm of state interactions, the correct classification off attacks and proportionate responses are extremely important. If states fail to accurately identify and respond to cyber threats there will be an escalation either in cyber attacks or in conventional responses; both of which would be dangerous, destabilizing and likely deadly.

This is an important topic of consideration as the conversation continues about our electoral infrastructure now being a matter of national security, the concept of critical infrastructure, and the approach we, as a nation and its government, must take to protect the operational continuity of our democracy and electoral processes as matters of our sovereignty.