M ODIFICACIÓN DE PROYECTO O ACTIVIDAD ( SUMA DE IMPACTOS ) Y AFECTACIÓN

The U.N. Charter Art. 2(4) states that “[a]ll Members shall refrain in their international relations from the threat or use of force against the territorial integrity or political independence of any state, or in any other manner inconsistent with the Purposes of the United Nations.” The requisite evidentiary burden for demonstrating the use of force and the violation of art. 2(4) is a matter of some debate.

Proof or evidence of the use of force is not addressed within Art. 2(4), and the available ICJ case law is more concerned with defining force rather than the evidence or proof needed to demonstrate it.153 Tsagourias summed up the issue of evidence for the use of force as “th[e] standards concerning the availability and probity of evidence in cases involving armed attacks, uses of force or interventions are rather lax.”154 _{This in part may be related}

to the traditional understanding of force; that is, force involves a kinetic event, which is an event that involves a physical, observable cause and effect. After a kinetic event, the impacted state could present proof gained through traditional criminal and intelligence services to demonstrate what state was responsible for the event. The question of state responsibility for a kinetic attack is normally a relatively straightforward proposition (with the exceptions of terror attacks or the involvement of non-state actors in kinetic attacks, which are more difficult as to matters of proof and attribution.) In this manner, an injured state merely needed to link a kinetic event in which force was utilized to the purported state believed to have used force before the injured state could legally respond in self-defense.155

153 See, Military and Paramilitary Activities in and Against Nicaragua (Nicar. v. U.S.) 1986 I.C.J. 14 (June 27) (The ICJ goes to great lengths to explain what does and does not constitute force, but says nothing about the evidence needed except to say that a right to self-defense was a subjective interpretation on behalf of the victim state. It must be noted that the ICJ in Nicaragua held that the right to self-defense was reserved only for use of force incidents attributed to state actors, a distinction that has been thoroughly repudiated by state practice and emerging CIL.)

154 Nicholas Tsagourias, Cyber-attacks, Self-defence and the Problem of Attribution, 17 J. Conflict & Security L. 235 (2012). Cf., Michael N. Schmitt, Responding to Transnational Terrorism Under

the Jus ad Bellum 83, in, Essays on Fault and War at the Fault Lines (2012) (“[I]nternational

law contains no express evidentiary standard governing the quality of the information upon which States may resort to force in self-defense.”)

120

The evidence or proof of an attack needed for a state to respond in self-defense is subjective; it depends on the victim state’s assessment of the attack. If an attack is of great enough magnitude to meet or exceed the scale and effect test156 and be considered an armed attack, the injured state may respond in self-defense under art. 51 of the U.N. Charter, however, the injured state will bear the responsibility to demonstrate to a high degree of confidence of who was responsible and that the attack met the threshold to be considered an armed attack thus necessitating an action in self-defense. The focus of the needed evidence is on the attack itself, evidence of a subjective nature need not be demonstrated, the focus is solely on the objective nature of the attack.

Proving or delineating evidence of a cyber-attack that amounts to force is a different problem. Due to the nature of cyber-attacks, which is discussed in detail, infra, chapter four, there will be limited digital evidence of an attack, and depending on the state’s interpretation of whether the cyber-attack constitutes a use of force, there may or may not be a kinetic effect from the attack. At present, there is no clear test or threshold for when a cyber-attack will rise to the level of force, how to identify those behind the attacks, and how to prove who is responsible for such an attack. One could adopt a mechanism similar to the strict liability approach for malicious cyber-attacks, in that any use of cyber-based weapons with a kinetic impact may equate to force; however, this only answers part of the question. The matter of proof, evidence, or attribution remains.

156 Military and Paramilitary Activities in and Against Nicaragua (Nicar. v. U.S.) § 195, 1986 I.C.J. 14 (June 27). (“In the case of individual self-defence, the exercise of this right is subject to the State concerned having been the victim of an armed attack...There appears now to be general agreement on the nature of the acts which can be treated as constituting armed attacks. In particular, it may be considered to be agreed that an armed attack must be understood as including not merely action by regular armed forces across an international border, but also ‘the sending by or on behalf of a State of armed bands, groups, irregulars or mercenaries, which carry out acts of armed force against another State of such gravity as to amount to’ (inter alia) an actual armed attack conducted by regular forces, “or its substantial involvement therein”. This description, contained in Art. 3, paragraph (g), of the Definition of Aggression annexed to General Assembly resolution 3314 (XXIX), may be taken to reflect customary international law. The Court sees no reason to deny that, in customary law, the prohibition of armed attacks may apply to the sending by a State of armed bands to the territory of another State, if such an operation, because of its scale and effects, would have been classified as an armed attack rather than as a mere frontier incident had it been carried out by regular armed forces. But the Court does not believe that the concept of “armed attack” includes not only acts by armed bands where such acts occur on a significant scale but also assistance to rebels in the form of the provision of weapons or logistical or other support. Such assistance may be regarded as a threat or use of force, or amount to intervention in the interna1 or external affairs of other States. It is also clear that it is the State which is the victim of an armed attack which must form and declare the view that it has been so attacked…”)

121

The ICJ has stated that the greater the claim of wrongfulness against a state, the greater the degree of evidence that is needed to prove the wrongful conduct.157 This idea also applies to cyber-attacks but may be difficult to implement in cyberspace where the majority of evidence will be indirect or circumstantial. In an ideal world, a state would only respond to cyber-attacks that amount to force if the injured state had clear and convincing evidence that the authors of an attack were state X, could prove the attacks originated from state X, and could legally attribute the attacks to state X. However, as a pragmatic argument, this idea of proof or evidence of the highest magnitude would only be effective before an international tribunal because states will respond to acts of force against them based on multiple factors, including a degree of evidence they alone deem necessary.

This study argues that, at a minimum, a state must possess clear and convincing evidence that a state is responsible for a cyber-attack prior to taking acts against that state in self- defense. As Professor Michael Schmitt stated:

[c]lear and convincing evidence is a level more probative of the issue at hand than ‘‘preponderance of the evidence,’’ which simply means that the evidence makes the matter more likely than not. It is, on the other hand, less probative than the ‘‘beyond a reasonable doubt’’ standard typically required for a guilty finding in a criminal case. Used in the context of justifying a use of force, clear and convincing evidence of a forthcoming armed attack is evidence that would convince a reasonable State to act defensively in same or similar circumstances.158

Schmitt justified the clear and convincing evidentiary standard for the use of force and self- defense by positing that “[i]n light of the near universal characterization of OEF [Operation Enduring Freedom] as lawful, it appears that the international community accepts ‘clear

157 Case Concerning Application of the Convention on Prevention and Punishment of the Crime of Genocide (Bos. & Herz. v. Serbia /Montenegro), 2007 I.C.J. 43, 90 – 91 § 208-210.

(“[T]he Court requires proof at a high level of certainty appropriate to the seriousness of the allegation…The Court has long recognized that claims against a State involving charges of exceptional gravity must be proved by evidence that is fully conclusive…The Court requires that it be fully convinced that allegations made in the proceedings, that the crime of genocide or the other acts enumerated in Article III have been committed, have been clearly established. The same standard applies to the proof of attribution for such acts...”)

158 Michael N. Schmitt, Responding to Transnational Terrorism Under the Jus ad Bellum 84, in, Essays on Fault and War at the Fault Lines (2012).

122

and compelling’ as an appropriate evidentiary standard in self-defense cases.”159 _Schmitt

premised his belief on the UN Security Council’s acceptance of United States Ambassador John Negroponte’s statement regarding the September 11th terrorist attacks to the Security Council, in which Ambassador Negroponte stated that the United States had “obtained clear and compelling information that the Al-Qaeda organization, which is supported by the Taliban regime in Afghanistan, had a central role in the attacks.”160

Given that the majority of evidence in malicious cyber-attacks will be circumstantial, a higher burden of proof would be unreasonable. A higher evidentiary burden, proof beyond a reasonable doubt, requires that the proof “precludes every reasonable hypothesis except that which it tends to support”161 _{or simply, that there is no plausible explanation that}

another state could be responsible for the attack. For instance, this is the burden of proof adopted by the International Criminal Court as the necessary burden of proof for a criminal conviction.162 However, such a burden of proof cannot work for cyber-attacks; first, the forensic abilities of computer science for technical attribution cannot, in the majority of

159 Id.

160 Id. quoting, Letter dated 7 October 2001 from the Permanent Representative of the United States of America to the United Nations Addressed to the President of the Security Council, UN Doc. S/2001/946 (October 7, 2001). See also, Black’s Law Dictionary 635 (9th ed. 2011). (“Clear and convincing proof” is that the “[e]vidence indicating that the thing to be proved is highly probably or reasonably certain.”). Cf. Microsoft v. i4i Ltd., 131 S.Ct. 2238 (2011) (Thomas J. Concurring) n.4 -5 (Discussing the terms clear and convincing and burden of proof). See also,

Santosky v. Kramer, 455 U.S. 745, 756 (1982) (“This Court has mandated an intermediate

standard of proof—‘clear and convincing evidence’—when the individual interests at stake in a state proceeding are both ‘particularly important’ and ‘more substantial’ than mere loss of money.”)

161 Black’s Law Dictionary 1334 (9th ed. 2011). See also, Miles v. United States, 103 U.S. 304 (1881) (“The evidence upon which a jury is justified in returning a verdict of guilty must be sufficient to produce a conviction of guilt, to the exclusion of all reasonable doubt...”). Rome Statute of the International Criminal Court art. 66(3) U.N. Doc. A/CONF.183/9 (as corrected 12 July 1999) (“In order to convict the accused, the Court must be convinced of the guilt of the accused beyond reasonable doubt.”). But cf. Tony Gerdwin-Meyer, What Probability is Involved in

“Beyond Reasonable Doubt” in Criminal Trials? Kings College London (2014),

http://www.ucl.ac.uk/ ~ucgbarg/doubt.htm (Arguing that the “beyond reasonable doubt” threshold be based upon the theory that “the probability of guilt, is a Bayesian probability: it is the degree of belief that the facts could have arisen consistent with innocence [i.e., broadly, that the defense account is plausible]. If this proposition is capable of reasonable belief, above some low threshold probability, then the jury should acquit—even if it may appear much more likely that the evidence arose through guilt.”).

162 Rome Statute of the International Criminal Court art. 66(3) U.N. Doc. A/CONF.183/9 (as corrected 12 July 1999).

123

cases, find such evidence for cyber-attacks, and second, because this is not a question of criminal liability.163

It is recognized that the application of the clear and convincing burden of proof is highly malleable depending upon the victim state’s interpretation of the facts. However, by elucidating a standard for the burden of proof, it enables a baseline for the minimum proof needed to invoke the right to self-defense and for the purposes of attributing a use of force to a state. It also establishes a baseline of evidence needed to attribute cyber-attacks and the needed burden of proof for the implementation of any other form of liability. The clear and convincing burden should not be viewed as the maximum level of proof a state must possess, but as the minimum evidence needed. The greater the proof, the more justified the response to a cyber-attack.