International Law and Intelligence Gathering: Mind the Gaps

Intelligence gathering is a fundamental element of both statecraft and the conduct of hostilities. Its integral role in armed conflict is evident in the Israel intelligence service, the Shin Bet, having provided “surgical intelligence” for the July 2024 targeting of the Hamas military leader, Mohammed Dief. The reported Israeli killing of Hamas leader Ismail Haniyeh in Tehran and the Iranian counterintelligence reaction also highlight the dominant role intelligence agencies play in shadow conflict. Both the Ukrainians and the Russians make extensive use of civilian agents located in enemy territory to provide targeting information for their strikes. In addition, States are increasingly recruiting and directing espionage agents through social media (see here, here, here, and here).

As Lawrence Freedman noted in his 2022 book, Command, the collection and analysis of intelligence has taken on an oversized role in modern military operations, with one quarter of British General Nick Carter’s 800-person headquarters in Afghanistan (2009-2010) working “on the intelligence side” (p. 495). The wide range of modern intelligence categories for information collected by States and in some cases by non-State actors include SIGNIT (signals intelligence), HUMINT (human intelligence), IMINT (image intelligence), GEOINT (geospatial intelligence), MASINT (measurement and signature intelligence), open-source intelligence (OSINT), CULTINT (cultural intelligence), and even CRIMINT (criminal intelligence).

History and religion reinforce the point. The Christian Bible refers to spying, as do the writings of Sun Tzu and the Indian book, The Arthashastra. The prophet Muhammad, medieval kings, and renaissance rulers all relied on spying. In his 2018 book, The Secret World: A History of Intelligence, Christopher Andrew identifies two major turning points in intelligence history: the European Renaissance, because of the link between intelligence and diplomacy, the recruitment of spies, and the interception of correspondence and code breaking; and the First World War, with technological advances in wireless and telegraphic communication (SIGINT) (p. 4-6).

State investment in civilian and military intelligence gathering organizations matched the explosion of intelligence gathering in the post-Second World War era. These include: the biggest intelligence alliance in history, the “Five Eyes” community (the United States, the United Kingdom, Canada, Australia and New Zealand); Russia’s Foreign Intelligence Service (SVR); Israel’s Mossad; and China’s Ministry of State Security (MSS). The flip side of such intelligence gathering is counterintelligence carried out by organizations such as Russia’s Federal Security Service (FSB); the United Kingdom’s Security Service (MI5); the United States’ Federal Bureau of Investigation (FBI); Ukraine’s Security Service (SBU); the Canadian Security Intelligence Service (CSIS); and depending upon the State, police Special Branch organizations.

Military agencies include the American Defense Intelligence Agency (DIA), Russia’s Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU), the Israeli Military Intelligence Directorate (Aman), and Ukraine’s Main Directorate of Intelligence (GUR). National police forces are also sometimes involved in the investigation and prosecution of national security offences, including espionage. In addition, non-State actors carry out intelligence and counterintelligence activities. As Amy Zegart noted, “[i]n the twenty-first century, the tip of the spear isn’t a spear. It’s intelligence” (Spies, Lies, and Algorithms, p. 43).

Intelligence Gathering and Espionage

The opening sentence of Christopher Andrew’s history of intelligence states “[t]wenty-first-century intelligence suffers from long-term historical amnesia.” The legal analysis of intelligence gathering also suffers from amnesia regarding extensive State involvement in espionage, as well as its treaty and customary law basis during armed conflict. Other significant gaps impact it as well. The analysis is too often divided into a simple binary of peacetime and wartime collection, which does not adequately account for the complexity of hybrid conflicts where belligerents pretend they are not “at war,” or the use of intelligence in the exercise of State self-defence.

The contemporary discussion of intelligence gathering, including cyber espionage, appears at times to be overly focused on inter-State intrusions against territorial sovereignty. It fails to consider the complexity of such activity arising in other situations including non-international armed conflict, transnational operations against non-State actors, peacekeeping, and even situations of occupation, that is, scenarios where the military and security forces are physically conducting operations and collecting intelligence within a territory subject to “peacetime” rules. It also does not adequately address the extensive intelligence collection carried out by non-State opponents against States including transnationally.

The 2021 Department of Defense Dictionary defines intelligence as “[t]he product resulting from the collection, processing, integration, evaluation, analysis, and interpretation of available information” (p. 107). “Espionage,” a term used interchangeably with “spying,” is applied to the secret gathering of such information (not all intelligence gathering involves secrecy; e.g. OSINT, elements of HUMINT such as interrogation). Aspects of spying during armed conflict are different than in peacetime. Article 29 of the 1907 Hague Land Warfare Regulations states that “[a] person can only be considered a spy when, acting clandestinely or on false pretences, he obtains or endeavours to obtain information in the zone of operations of a belligerent, with the intention of communicating it to the hostile party.” A spy can be a civilian or a member of the armed forces, and for the latter, espionage is particularly uniform-related (e.g., in civilian clothes or enemy uniform). However, the secret collection of intelligence is not spying if it is done in one’s own uniform.

In any event, it is hardly a secret that virtually all States engage in some form of intelligence gathering and espionage, considering the commonplace security measures designed to protect State secrets (e.g. the use of Sensitive Compartmented Information Facilities (SCIFs), information classification systems, personnel background checks). States are increasingly concerned with espionage given the pervasive global reliance on digital technology and the advent of cyber operations. Espionage creates a unique connection between treachery and treason, particularly regarding HUMINT. It can involve “what amounts to the recruitment and development of traitors, and, although a traitor also may be a spy, the traitor aspect will earn greater disrespect and loathing.” This has, perhaps inevitably, led to States criminalize espionage and treason under their domestic laws.

International Law and Espionage

Over the years, only a few academic articles have addressed the international law of intelligence gathering (e.g., see here and here). However, in the post 9/11 period, scholars are paying increased attention to the subject, particularly focusing on inter-State espionage (see here, here, and here). The subject attracted particular interest with the growth of cyber operations and the development of the 2013 Tallinn Manual on the International Law Applicable to Cyberwarfare and its successor, the 2017 Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations. The latter addresses both wartime and peacetime cyber espionage.

In a 2016 article, Professor Ashley Deeks provided a very helpful framework that divides competing narratives into the realpolitik and the formalist perspectives on international law and intelligence. The realpolitik or permissive viewpoint, which prefers that international law provide few limits on State activity, encompasses two subgroups: one that believes international law fails to regulate intelligence gathering; and another that holds the law affirmatively permits it as evidenced by the widespread involvement of States in that activity. In contrast, the restrictive formalists “advocate for international legal constraints to apply broadly and strictly to all intelligence activity” (p. 606). This approach views State intelligence gathering as restricted by “customary international law (CIL) related to sovereignty, non-intervention, and territorial integrity; the Vienna Convention on Diplomatic Relations (VCDR); the International Covenant on Civil and Political Rights (ICCPR) or, more generally, human rights-focused CIL principles; and [international humanitarian law]” (p. 612).

That both the permissive and the restrictive camps rely on the same, nearly century-old Lotus case highlights the need for further analysis. Whether territorial sovereignty serves as a principle or a rule of international law animates much of the post-Tallinn Manual 2.0 discussion about cyber espionage (see, e.g., Professor Gary Corn and Robert Taylor here and Professor Michael Schmitt and Liis Vihul, here), with the Manual adopting a formalist “rule” approach. However, at times, the argument almost seems ideological, as both camps have moved toward the center and away from more extreme permissive and restrictive interpretations.

The practical distance between the two camps is small. Both adopt the approach that international law generally fails to regulate intelligence gathering, but that Article 2(4) of the UN Charter’s prohibition on the use of force restricts cyber espionage, as does the customary international law prohibition on intervention outlined in the 1986 Paramilitary Activities case (para. 205). There are other rules of international law prohibiting espionage as well. As James Kraska points out, when transiting a State’s territorial sea, “the use of innocent passage as a subterfuge for intelligence collection is not consistent with Article 19 of [the UN Convention on the Law of the Sea].”

Less clear is the scope of the acts that constitute prohibited intervention in a cyber context, especially cyber operations that “do not fit squarely within the traditionally recognized elements of the nonintervention rule.” How this principles-versus-rule cyber debate will be resolved is unclear, although the International Court of Justice (ICJ) ruled in the context of the 1984 Maritime Boundaries case that “the terms ‘rules’ and ‘principles’ [are] no more than a dual expression to convey one and the same idea.”

Likewise, the Paramilitary Activities case treats the prohibition on the use of force, non-intervention, and sovereignty as overlapping “principles” having the force of law (i.e., a rule) in restricting State action (paras. 205, 251). However, in application, the scope of such rules is not fully fleshed out, open to interpretation, and may not be as restrictive as might first appear. Applying sovereignty as a “rule” resulted in the Tallinn Manual 2.0 conclusion that “[c]yber espionage per se, as distinct from underlying acts that enable the espionage … does not qualify as intervention because it lacks a coercive element” (p. 323). Further, a reader of the Manual will be struck by the lack of consensus among the experts involved on questions such as whether non-consensual physical presence on another State’s territory violates its sovereignty (rule 4, p. 19).

Largely missing in the contemporary discussion is whether there is a treaty or customary international law authority for conducting espionage. Some suggest there is limited opinio juris concerning a customary exception to the general rule of the inviolability of territorial sovereignty. Yet how much opinio juris is required, and what are its potential sources? This issue requires further analysis given the ICJ Statute’s emphasis in Article 38(1)(b) on State practice, States’ failure to react over time serving as “acceptance of law (opinio juris),” and the International Committee of the Red Cross (ICRC)’s reference to “sufficiently dense practice” in its Customary Humanitarian Law Study (p. xlvi). As a former Central Intelligence Agency (CIA) lawyer said, “the practice of states recognizes espionage as a legitimate function of the state, and therefore it is legal as a matter of customary international law.”

The lack of an acknowledgment that intelligence gathering during inter-State warfare finds its authority in both treaty and customary international law is a clear gap in the contemporary discussion. As Article 24 of the 1907 Hague Land Warfare Regulations states, “[r]uses of war and the employment of measures necessary for obtaining information about the enemy and the country are considered permissible” (emphasis added). The Hague Regulations were recognized by the 1946 Nuremburg Tribunal as “declaratory of the laws and customs of war.” The 1996 Nuclear Weapons case acknowledged the same customary status (para. 75), as did the 2024 Wall advisory opinion (para. 89) and the 2024 Occupied Palestinian Territory advisory opinion (para. 96). Indeed, such intelligence gathering had long been understood to include espionage (e.g., the 1914 UK Manual of Military Law, para. 158, and the 1914 U.S. Rules of Land Warfare, para. 200).

In the 1950 Hostage case, the U.S. Military Tribunal at Nuremberg ruled that “[b]y the law of war it is lawful to use spies” (p. 58). The contemporary military and humanitarian law manuals of the United Kingdom, the United States (here and here), Denmark, and Australia likewise reflect the lawfulness of espionage. Going further, the link between Article 24 of the Hague Regulations and espionage also exists in the ICRC’s 1987 Commentary to Additional Protocol I (para. 1765), as well as the 2010 Air and Missile Warfare Manual Commentary (p. 259 and 260).

Importantly, intelligence gathering is an integral part of targeting, and ultimately, compliance with the foundational humanitarian law principle of distinction. This does not mean there are no limitations. Other related legal rules of armed conflict, such as the prohibitions against torture and abuse during interrogations, misuse of medical emblems, and treacherous killing limit intelligence gathering too.

Given the same widespread historical use by States of espionage during “peacetime,” it is difficult to see why there could not be a similar acknowledgement of its customary law status. It may be that formalists see such an acknowledgement as too empowering. That need not be the case. Treaty or customary international law would still limit a customary rule. Conversely, realpolitik “failure to regulate” advocates might see a customary rule as too limiting on an otherwise extremely broad inherent right to act. However, acknowledging a customary legal basis could better provide a standard against which novel uses of new technologies, such as those highlighted by Gary Brown (e.g. pre-positioning cyber capabilities on computers or networks) might be better assessed (p. 627). Moreover, the use of novel approaches does not automatically equate to illegality. As the ICJ noted in the Paramilitary Activities case, “[r]eliance by a State on a novel right or an unprecedented exception to the principle might, if shared in principle by other States, tend towards a modification of customary international law” (para. 108). Therefore, in both peace and war a customary law rule could be amended.

Assessing the customary law status of espionage is just the tip of the iceberg regarding issues that need to be addressed. Some scholars have suggested, for example, that a State’s right to act in self-defence “may also justify the collection of intelligence.” However, the law governing that right operates at the strategic level in terms of necessity, proportionality, and so on. In contrast, humanitarian law governs the actual conduct of operations during periods of armed conflict. Outside of armed conflict, peacetime rules apply. Unfortunately, there is a lack of consensus regarding the thresholds for acting in self-defence, or when an armed conflict begins or ends in hostilities against non-State actors (see Geoff Corn et. al, The Law in War: A Concise Overview p. 9-26 (2nd ed. 2023)). Frequently, belligerents deny hostilities even exist in a security environment where hybrid or grey zone conflicts abound. Identifying whether and when “wartime” or “peacetime” espionage rules apply, and the differences that result, demands further study.

Intelligence Gathering in Situations of Governance

The need to address the legal basis for intelligence gathering and espionage in non-international armed conflict and other situations of governance is perhaps even more pressing. These situations can involve a State faced with a traditional internal insurgency, foreign forces assisting such a government, transnational counterterrorism, and peacekeeping. Another situation of governance is that of occupied territory during international armed conflict. Such hostilities clearly occur within the territory of a State, setting up a potential clash between the collection of intelligence by security forces related to the conflict and a domestic legal regime that ordinarily regulates such activity. While the academic discussion of privileging of humanitarian law as the lex specialis has focused on its relationship with international human rights law, practitioners must also frequently consider its operation with respect to the domestic laws of the territorial State. Even the collection of wireless communications, which is seen as uncontroversial in a transnational context, may violate domestic laws.

States can rely on intelligence gathering during internal hostilities in much the same way as international conflicts. It is an integral part of the conduct of operations and is key in ensuring compliance with the humanitarian law principles of distinction and protection of the civilian population. This points toward the legal authority to gather intelligence as part of operations during non-international armed conflict also being based in customary international humanitarian law.

How to apply the law in an internal armed conflict will depend upon the scope and scale of the hostilities, and sometimes the governing authority’s political decisions. In the nearly 30-year Troubles in Northern Ireland, for example, the hostilities were such that the State chose to exclusively apply domestic law. In contrast, where a conflict intensifies (and particularly where insurgents begin to control territory), a State is more likely to leverage a more fulsome use of intelligence gathering capabilities governed by international humanitarian law, including SIGINT, IMINT, and HUMINT. That said, in such situations, a combination of military, civilian intelligence agency, and police-generated intelligence will likely guide the character of such operations.

The situation becomes more complex when foreign forces are involved. If they exercise overall control over the insurgents the conflict becomes international in character, while support for the government occurs in the context of a non-international conflict. As the 20-year conflict in Afghanistan showed, consent, a resolution by the UN Security Council, or self-defence may provide the legal basis to support to a State. At its height, the NATO mission included “more than 130,000 … troops from 50 NATO and partner countries,” many of which conducted operations supported by their own national military and civilian intelligence agencies.

Depending upon the operational situation, the territorial State may seek to place restrictions on some types of intelligence gathering in the exercise of its sovereignty. In many situations, a Status of Forces Agreement (SOFA) may assist in resolving jurisdictional issues. However, it is likely an intervening State will operate freely, particularly regarding actions impacting on targeting, force protection, and operational success. Nor is the intelligence gathering by a foreign force likely to be limited to within the territory. During Canada’s Afghanistan operations, for example, SIGINT accounted for 75-80 percent of actionable intelligence. Canada’s Communications Security Establishment (CSE) also deployed personnel to facilitate the “fusing of national and theatre, strategic, operational, and tactical SIGINT operations” (David Charters, Canadian Military Intelligence: Operations and Evolution from the October Crisis to the War in Afghanistan, p. 273).

Missions based on a Chapter VII UN Security Council Resolution or Chapter VI “robust peacekeeping” mandates may rely on “all necessary means” as an authority for intelligence gathering. However, as an integral part of military operations, a State will likely use intelligence gathering for force protection and the completion of any mission mandate notwithstanding an agreement to comply with domestic laws (see here and here). The potential for conflict between international humanitarian law-based operations and national laws also exists for occupied territory. The security forces of the occupying power are generally unlikely to see themselves as being bound by the laws that remain in place in the occupied territory regarding the conduct of operations. However, in dealing with members of organized resistance movements, who may be viewed as criminals, local police and other security forces may comply with domestic restrictions on intelligence gathering activity to facilitate prosecutions.

Finally, significant gaps remain in the law governing intelligence activities in situations other than armed conflict (i.e., peacetime). Regarding espionage carried out by diplomatic personnel, in the 1980 Tehran case, for example, the ICJ held that the appropriate response to allegations that United States personnel were spying was to declare them persona non grata and require they leave the country, or for Iran to completely break off diplomatic relations (paras. 81-87). The court did not deem such activity unlawful under international law and such diplomatic responses are not much of a restraint.

Increasingly, some (particularly formalists) are treating reliance on intelligence gathering as a violation of the international human rights law right to privacy. However, this approach lacks consensus regarding the scope of such a right and whether the relevant human rights treaties have extra-territorial application. Further, not all States are parties to those treaties (e.g., China is not party to the International Covenant on Civil and Political Rights (ICCPR)). There is also the issue of permissible treaty derogations, a lack of consensus on customary international human rights law, and concerns that customary law has no accountability mechanism. Gaps and uncertainty over human rights law application have led to new theories such as Frédéric Sourgens’s “Privacy Principle” (critiqued here), or Ashley Deeks’s sliding scale approach that is less restrictive for traditional espionage, but applies more constraints impacting on individuals (p. 669).

Concluding Thoughts

Intelligence gathering including espionage is not simply “unregulated.” It has a treaty and customary law basis during armed conflict and could be viewed as having a customary law basis during peacetime. However, this is only the beginning of the conversation. Ashley Deeks has noted States such as the United Kingdom and the United States apply human rights laws to their intelligence services (p. 662). However, “[n]either state appears to treat the CIL rules of sovereignty and territorial integrity as imposing limits on their extraterritorial intelligence activities” (p. 663).

Notwithstanding a general dislike by international lawyers of the theory of tu quoque (i.e., “you do it, too”), the fact that virtually all States are involved in intelligence gathering will continue to significantly impact any effort to fill perceived gaps in the international law surrounding such activity. Until legal scholars address those gaps, intelligence gathering will remain most directly regulated by a limited number of international crimes related to torture, abuse, and prohibited treacherous activity during armed conflict, and perhaps most effectively during both peace and war by national laws prohibiting intelligence gathering, including espionage. The impact extends beyond espionage, however, as the law has long equated the status and treatment of military and civilian unprivileged belligerents to spies. Covert action such as sabotage is also intimately linked to intelligence gathering and espionage. Importantly, the lack of clarity concerning intelligence gathering provides a fertile environment within which 21st century shadow conflicts thrive.

***

Ken Watkin served for 33 years in the Canadian Forces, including four years (2006-2010) as the Judge Advocate General.

Photo credit: U.S. Army