Transit States and Malicious Cyber Operations: No Due Diligence Obligation
The Tallinn Manual 2.0 advances the view that a transit State has a due diligence obligation to take feasible measures to terminate malicious cyber operations that may affect the rights of other States that it knows are transiting its territory or infrastructure under governmental control (rule 6, paras. 13-14 and rule 7). This post argues instead that no such obligation exists under international law in respect of transit States. There are considerable practical difficulties in implementing such an obligation which the Tallinn Manual acknowledges, but the objections explained in this post are principally legal and legal policy objections.
For the purposes of this post, transit States are those whose territory or infrastructure carries data packets from the State of origin to the destination State. This includes States hosting routing infrastructure, data centres, submarine or terrestrial cables, fibre-optic networks, and other communications infrastructure through which data transit.
Against this background, I now turn to my legal and legal policy objections to recognising a due diligence obligation for transit States.
Legal Objections to a Due Diligence Obligation in Respect of Transit States
First, international law does not recognise a general customary right of transit or a due diligence obligation in respect of transit States. Transit is instead regulated by specific treaty regimes and context-specific rules, rather than by a general principle of customary international law ( United Nations Convention on the Law of the Sea (LOSC) arts. 17– 26; art. 40 Vienna Convention on Diplomatic Relations, Paramilitary Activities 1986, paras. 154-160). In the absence of a specific customary rule governing transit, it cannot be argued that such a rule has simply been transposed into cyberspace on the basis that existing international law applies there.
Moreover, even assuming that a customary transit rule existed, it would not be readily transferable to cyberspace. Existing transit regimes concern the movement of persons or goods through physical means across geographically defined territory. Cyber operations, by contrast, involve the transmission of data packets through a decentralised network whose routing is determined by technical protocols rather than by territorial, legal or political considerations. The two situations are therefore materially different.
Second, the 2021 UN Group of Governmental Experts (GGE) Report refers to the responsibilities of transit States only in the context of the voluntary norms of responsible State behaviour (GGE 2021, norm 13(c), para. 29). Admittedly, a number of States and international organisations, including the African Union, Costa Rica, the Czech Republic, Italy, the Republic of Korea and Norway, have expressed the view that transit States are subject to such an obligation. However, other States and organisations, including Austria, Estonia, the European Union, France, Germany, Japan, Romania, Switzerland, and Thailand, have made no reference whatsoever to transit States when setting out their position on due diligence (here). The existing evidence therefore falls well short of establishing widespread and representative State practice accompanied by opinio juris. Consequently, it cannot be concluded that there is a cyber specific customary international law due diligence obligation incumbent upon transit States.
Third, the Tallinn Manual supports its position with regard to transit States by formulating due diligence in terms of the “use” of territory, which seems to be a broad concept. However, not every use, or any incidental territorial connection, is sufficient to trigger the due diligence obligation. There must be a deliberate and material use of territory that contributes substantially to the malicious cyber operation.
Also, due diligence presupposes a territorial or other nexus between a State and the source of the risk by virtue of which the State concerned is able to exercise meaningful control over the source of the risk and employ its authority and power to prevent or terminate harmful conduct. The mere fact that some element of an operation has a fleeting or incidental territorial connection with a State, as in the case of transit States, does not establish such a nexus coupled taking also into consideration the fact that the perpetrators of the operation remain located in another State and are subject to that State’s power and authority.
Fourth, due diligence requires a relationship between the State from whose territory the harmful activity originates and the targeted State. The territorial State has a due diligence obligation towards the injured State because it is the source of the operation and has the authority and power to put an end to it. The transit State falls outside this relationship. The malicious operation neither originates from its territory nor is its author located within its territory or jurisdiction. The transit State functions merely as a fleeting or incidental conduit through which data packets pass. This role is often involuntary. Routing decisions are determined by the architecture and technical protocols of cyberspace rather than by decisions of the territorial or transit State.
Only if the transit State becomes a source of the operation for example, by hosting its command-and-control centre, is its due diligence obligation triggered alongside that of the State where the authors of the operation are located. However, this is fundamentally different from a situation in which the operation merely transits through the State’s territory or infrastructure.
Fifth, extending due diligence to transit States, in particular on the basis of “use” of territory, would fundamentally extend the personal scope of the due diligence and alter the nature of the obligation, transforming it into a general duty of policing. Because cyber traffic routinely traverses multiple jurisdictions before reaching its destination, virtually every State’s territory may be used, and thus every State could become a potential transit State. Due diligence would thus cease to be an obligation owed by the State from whose territory harmful activities originate because their authors are located there or because they are planned, prepared, initiated, conducted or substantially carried out there and instead become a global obligation requiring States to police cyber operations incidentally passing through their infrastructure.
Sixth, recognising such an obligation would produce disproportionate legal consequences. A breach of due diligence entails international responsibility and may entitle the injured State to adopt countermeasures. Under the law of State responsibility, responsibility depends upon the breach of an international obligation (International Law Commission, Articles on Responsibility of State for Internationally Wrongful Acts, art. 2) rather than upon the degree of causal contribution to the wrongful act, although the latter may be relevant to reparations. Yet the transit State’s contribution to the underlying operation is minimal and purely incidental when compared with that of the territorial State from which the operation originates. Nevertheless, both States would incur responsibility for breach of the due diligence obligation and would equally become potential targets of countermeasures. This produces an inequitable result. It is also conceivable that the territorial State might escape responsibility because it lacked the requisite knowledge or took reasonable measures within its capacity, whereas the transit State could nonetheless incur responsibility solely because malicious traffic briefly traversed its infrastructure but had knowledge and more capabilities to deploy. Such an outcome would be difficult to justify as a matter of legal policy.
Seventh, the proposed obligation creates serious problems concerning mistakes. The law of State responsibility generally does not recognise mistake of fact or mistake of law as a circumstance precluding wrongfulness. In practice, however, a transit State may be technically incapable of determining whether transiting data are malicious or whether the underlying operation is internationally wrongful. The victim State may have consented to the operation, or the operation may constitute a lawful countermeasure. Equally, the transit State may be unaware of the legal obligations governing the relationship between the State of origin and the target State. Even if the transit State acts in good faith, it may breach obligations towards the territorial or victim State. It can thus incur international responsibility and become subject to countermeasures. It would be paradoxical for the obligation of due diligence designed to prevent violations of international law to expose States to responsibility precisely because they are unable to ascertain the legal character of transiting cyber operations.
Eighth, it is frequently argued that the due diligence obligation imposed upon transit States would be relatively modest because it depends upon that State’s knowledge and capacity. However, if an obligation can rarely be fulfilled in practice because of the limitations inherent in knowledge and capacity, it loses much of its normative force. A legal obligation that operates only in exceptional circumstances is unlikely to provide meaningful guidance to States or to contribute to legal certainty.
Conclusion
For these reasons, I contend that transit States are not subject to a legal obligation of due diligence. This does not mean that they should not act responsibly. Once a transit State becomes aware that malicious cyber operations are passing through its territory or infrastructure, it should take feasible and appropriate measures to the circumstances. Such measures may include notifying the State of origin, the destination State or potentially affected third States; cooperating with the States concerned to prevent or terminate the operation; and, assisting in mitigating its spread or effects. These measures represent responsible international behaviour, but they should not be conflated with a binding due diligence obligation under international law.
***
Nicholas Tsagourias is Professor of International Law at the University of Sheffield, UK.
The views expressed are those of the author, and do not necessarily reflect the official position of the United States Military Academy, Department of the Army, or Department of Defense.
Articles of War is a forum for professionals to share opinions and cultivate ideas. Articles of War does not screen articles to fit a particular editorial agenda, nor endorse or advocate material that is published. Authorship does not indicate affiliation with Articles of War, the Lieber Institute, or the United States Military Academy West Point.
Photo credit: Allison Saeng via Unsplash+
