Ukraine Symposium – The Law of Crowdsourced War: Democratized Supply Chains – Part II

In the first of this two-part post addressing the legal and practical implications of democratized supply chains, I focused on the individual risks that those who engage in these activities incur. I explored whether their actions can amount to direct participation in hostilities with the attendant consequence of forfeiture of the protection against being deliberately attacked. But like General Krulak’s famous strategic-corporal, the independent actions of individuals supporting belligerent States can potentially have strategic consequences, enmeshing not just the individual actor in the conflict, but others as well, including the States where they reside, are present, or hold citizenship.

In this post, I turn to the collective risks that democratized supply chains might pose.  Specifically, I consider the implications for States under the law of neutrality and the principle of due diligence.

State Responsibility

As I noted in Part I, the likelihood that participation in crowd-sourcing efforts will fall back on and put any States at elevated risk of Russian retaliation, at least by means of force, is fairly low, but certainly not nil. And I must again emphasize, under customary international law, assessing whether States bear responsibility for the actions of independent actors is a very fact-dependent inquiry. As such, the observations here are general in nature.

As a starting point, under the law of State responsibility, States are presumptively not liable for the actions of independent, non-State actors. The primary exception to this rule, as set out in Article 8 of the International Law Commission’s Articles on State Responsibility, is that States assume direct responsibility for those actions when they are conducted under that State’s instructions, direction, or control. Stated slightly differently, a private actor or group of actors’ conduct is legally attributable to a State when that State exercises “effective control” over the conduct, i.e., the State determines the execution and course of the specific action and directly enables it or has the ability to order its cessation. (I.C.J., Paramilitary Activities Judgment, para. 115; Articles of State Responsibility, Art. 8, commentary para. 3).

There being little indication that these crowd-sourced logistics are being conducted at the behest (other than perhaps of Ukraine), let alone under the effective control of any State not presently part of the conflict, the only possible theories of international responsibility would have to flow from a failure to act affirmatively to prevent or disrupt these supply-chain activities. Of course, finding a breach by omission presupposes an international obligation to intervene. Under international law, the potentially relevant sources of such an affirmative duty are the law of neutrality and the principle of due diligence.

The Law of Neutrality

Much has been written on this blog and elsewhere about the specialized body of international law that defines the legal relationship between belligerent and neutral States and prescribes their corresponding rights and obligations. It is a body of law concerned almost exclusively with State, not individual, conduct. At its core, the law of neutrality establishes a duty on the part of neutral States not to participate in hostilities and to engage with belligerent States only on the basis of strict impartiality.

With respect to the Russia-Ukraine conflict, several States, the United States chief among them, have clearly adopted, either explicitly or implicitly, national policies that at a minimum reflect a modified or “qualified” approach to their neutrality obligations—distinguishing between Ukraine as the victim and Russia as the aggressor State to justify their extensive support for the former. Otherwise, the amount of military aid flowing into Ukraine from the United States, its NATO partners, and others simply cannot be squared with strict, traditional notions of neutrality law. Whatever the merits of these positions, the lack of strict fealty to neutrality law has occurred at the macro, interstate level. In contrast, what neutrality law has to say about individuals participating in crowdsourced logistics to support Ukraine is quite limited, and for those States that have already crossed into the territory of qualified or non-neutral status, those individual actions are likely subsumed in those national political decisions.

Even for States that have adhered to their neutrality obligations of non-participation and impartiality, the question is whether neutrality law imposes an affirmative obligation to disrupt private individual efforts when conducted by that State’s nationals or from its territory.  The short answer is no.

While (truly) “[n]eutral States have an obligation to refrain from providing war-related goods and services to belligerents,” that obligation does not extend to “preventing the export or transport, on behalf of one or other of the belligerents, of arms, munitions, or anything that can be of use to an armed force.” (DoD Law of War Manual, § 15.3.2.1). Such commercial transactions, including shipping of such supplies, whether done by corporations, individual citizens, or residents within a neutral State are not prohibited so long as exporting the supplies would not require involvement of the neutral State or convert the State’s territory into a base of military operations. (DoD Law of War Manual, § 15.3.2.1). And while historically some States have enacted domestic legislation proscribing or restricting exports to or in support of belligerent States, if they do so it must be done consistent with the obligation of impartiality.

Similarly, the duty of a neutral to prevent belligerents from establishing bases of operation on neutral territory (see e.g., Hague Convention XIII, art. 5) or recruiting or forming units of combatants (e.g., Hague Convention V, art. 4) does not encompass an obligation to prevent the transit through neutral territory of individuals seeking to volunteer their services to one belligerent or another. Nor are neutral States under an obligation to prohibit or prevent their nationals from joining the armed forces of belligerent States. (DoD Law of War Manual, § 15.5.2.2).

Because neutrality law does not establish an obligation on neutrals to intervene in these individual commercial and volunteer acts, the same would seem to hold true in the case of individuals voluntarily contributing war-sustaining equipment through crowdsourced supply chains.

There is one potential twist, however. When it comes to the use of communications facilities (e.g., the Internet) located in the territory of a neutral State, neutrality law similarly imposes no obligation “to forbid or restrict the use on behalf of the belligerents of [communications facilities] belonging to [the neutral State] or to companies or private individuals.” (Hague Convention V, art. 8). However, where a neutral State permits the transmission of communications through its facilities, it cannot do so in a way that “lends assistance to the belligerents on one side only,” and it must apply impartially any prohibitions or restrictions it chooses to place on their use.  (DoD Law of War Manual, § 15.5.3.1.). Not only must the neutral State adhere to the obligation of impartiality in this regard, it “must see to the same obligation being observed by companies or private individuals owning such communication equipment and facilities.” (DoD Law of War Manual, § 15.5.3.1.; See also Hague Convention V, art. 8).

At first blush, to the extent these democratized supply chains are reliant on Internet communications for their execution (which is substantially the case), it would appear that the law of neutrality obliges neutral States to ensure that at least certain individuals within their territory are also adhering to impartiality in the use of Internet infrastructure subject to the neutral State’s jurisdiction. That is, to some extent neutrality law can be seen as imposing a duty of due diligence “to prevent any violation of [a neutral’s] obligations and duties” by persons within its jurisdiction, at least with respect to the use of communications facilities. (Cf. DoD LoW Manual, § 15.3.2.2, fn. 73). Under this theory, failure to do so could be deemed not only a breach of neutrality law with attendant international liability attaching to the neutral State, but the “offending” individuals risk forfeit of the protections derived from being a national of a neutral State. That is, as discussed previously, they might be considered as direct participants in the hostilities or unprivileged belligerents. (DoD Law of War Manual, § 15.6.2.2).

Whether Hague Convention V or customary international law ever imposed a duty to prevent private individuals’ use of communications facilities to coordinate actions that might favor one belligerent over another is questionable. And extending such an interpretation to the cyber context, especially to the use of cyber infrastructure to facilitate crowd-sourced supply chains, likely proves too much. For starters, the relevant rules are aimed primarily at regulating belligerents’ erection and use of communications facilities on neutral territory (and the corresponding duty of neutrals to prevent it), not the communications, hostile or otherwise, of private individuals. At best, the obligation would extend only to those private actors providing access to communications facilities, not individual Internet users. Thus, as the Tallinn Manual 2.0 notes, the neutrality rules related to the exercise of belligerent rights by cyber means in neutral territory do not apply to private individuals or groups unless their conduct can be attributed to the neutral State under governing principles of State responsibility. (Tallinn 2.0, rule 151, commentary).

Further, applying neutrality law to the modern cyber context has generally proved quite difficult, with little State practice to draw from and discordance among the few sources considering the question or representing official statements of opinio juris. According to the Tallinn experts, Hague Convention V, Article 8, which specifies the lack of a neutral obligation to prohibit or restrict the use of communications facilities “on behalf of a belligerent,” applies with equal force to “cyber communications systems.” (Tallinn Manual 2.0, rule 151, Comment 4).   A contrary interpretation would be inconsistent with the underlying rationale motivating States to adopt Article 8 in the first place—that it would be “impractical for neutral States to censor or screen their publicly available communications infrastructure for belligerent traffic.” (DoD Law of War Manual, § 16.4.1). It is also worth noting that, at least according to the United States, furnishing supplies to a belligerent State from outside of its sovereign or occupied territory would not result in forfeiture of the protections stemming from neutral status. (DoD Law of War Manual, 8 15.6.2.2).

At the risk of redundancy, ultimately context matters. And each case would have to be assessed on its particular facts. For example, the issue might very well be moot where the State involved has already been providing support to Ukraine in a manner inconsistent with strict neutrality principles. And while the enemy always gets a vote, whatever the neutrality-law implications of participating in these supply chains may present, the practical risks of actual blowback against individual States is likely low.

The Principle of Due Diligence

Resting alongside of, and grounded somewhat in similar interests, is the principle of due diligence. This principle, and debates over its normative status in international law, have garnered significant attention over the last decade or so in the context of international law’s role in regulating cyber operations. (See, e.g., here). Whatever the relative merits of a purported international obligation of due diligence, what these debates have revealed is a lack of consensus among States that, perhaps beyond a few specific contexts such as environmental law, the principle has achieved the status of generally applicable customary international law.  For example, Israel does not consider due diligence to be a binding rule of international law in the cyber context; a position many consider the United States to share (see here and here). Where Russia stands on due diligence is unclear. Assuming arguendo that due diligence constitutes a binding customary international legal obligation, it likely triggers no duty on States to affirmatively prevent or disrupt the crowd-sourced logistics activities of private actors.

In broad strokes, due diligence is said to levy an affirmative obligation on States to ensure “territory and objects over which they enjoy sovereignty are not used to harm other States.” (Tallinn Manual 2.0, R. 6, commentary). The concept is reflected in dictum from the International Court of Justice’s Corfu Channeljudgment that a State has an “obligation not to allow knowingly its territory to be used for acts contrary to the rights of other States.” As this quote implies, there are at least two constituent elements to due diligence, both of which present challenges in application to the context of crowdsourcing and democratized logistics: a specific type and threshold of harm; and knowledge on the part of the relevant State that the qualifying harm is ongoing and emanating from its territory.

Before turning to the substantive elements of the due diligence principle, there is a strong case that to the extent it is a general rule of international law regulating the relations between States, due diligence is displaced at the outset by the law of neutrality by the legal maxim lex specialis derogat legi generali—whereby more specific rules prevail over general rules of international law. For example, debates are legion over whether or the degree to which international human rights law is displaced by the law of armed conflict during war. But outside discussions of the relationship between neutrality law and the U.N. Charter discussed above, the degree to which neutrality law displaces or modifies other general, interstate legal obligations has received less attention.

Like LOAC, there can be little doubt that the law of neutrality qualifies as a specialized body of law defining at least certain aspects of the relations between belligerent and non-belligerent States. Application of the lex specialis maxim would therefore seem to be in order, and as set out above, neutrality law establishes specific obligations of neutral States with respect to non-State actors and activities on or occurring from its territories. Stated differently, it is arguably the law of neutrality that establishes the diligence neutral States owe to belligerent States regarding cross-boundary harms, not due diligence generally.

Setting aside the important and possibly dispositive lex specialis analysis, consensus over the substantive contours of due diligence, like its normative status, is similarly lacking. Regarding the knowledge element, the Tallinn Manual 2.0 contributors agreed that it can be satisfied by either actual or constructive knowledge but rejected a broader duty to monitor cyberinfrastructure and activities in a State’s territory in order to intervene when required. Some, however, go further, arguing for a more aggressive duty to prevent covered harms with a concomitant duty to preemptively discover their occurrence.  As I’ve written here, applying such an aggressive view to activities carried out in, or reliant on, the digital domain raises significant concerns about, and potential conflicts with, international human rights obligations regarding, inter alia, privacy and free speech. It would also “place an unreasonable expectation on states and substantially broaden their exposure to claims of breach and the attendant, potentially escalatory consequence of countermeasures.”

Absent an affirmative preventive duty or being put on actual notice, establishing that any particular State has the requisite knowledge that crowdsourcing activities are occurring from or implicate its territory is clearly a challenge, as both a matter of fact and law. Of course, a victim State can bring the issue to the attention of the State it views as owing it due diligence, but at least in the cyber context, States will often be reluctant to do so for fear of compromising means and methods of intelligence collection. In such cases an allegation of breach would have to rest on a claim that the responsible State is otherwise on actual or constructive notice. On this point, relatedly Russia has argued in its official submissions to the UN Group of Governmental Experts for a high evidentiary bar to attributing malicious cyber operations directly to a State. Whether it would hold itself to such a standard when assessing whether another State has knowledge of crowdsourced logistics activities is at best questionable.

Perhaps more problematic is the issue of whether crowdsourced logistics activities amount to harms within the ambit of the due diligence principle. Difficult in its own right, this question is complicated further by the interaction of the law of neutrality—even if it does not entirely displace due diligence—on the question of whether these activities can be viewed as contrary to Russia’s rights as a matter of law.

Consensus among experts and those States that have endorsed the existence of due diligence as a rule of customary international law is that only actions resulting in serious adverse consequences for the victim State will trigger the territorial State’s duty to act. Nevertheless, most also agree that the exact threshold of harm is unsettled.  Acts “causing inconvenience, minor disruption, or negligible expense” are generally considered insufficient. (Tallinn Manual 2.0, Rule 6, comment 26). Supporting or enhancing a belligerent’s ability to wage war is certainly not trivial, but the disaggregated and geographically dispersed nature of these democratized supply chains, among other factors, arguably diminishes the “seriousness” of the harms flowing from any one State. Given the unsettled nature of the harm threshold, it is difficult to assert that these crowdsourcing activities trip due diligence obligations.

Further, and perhaps more challenging, is the generally held view that transboundary harms at issue must also qualify as unlawful if conducted by the territorial State itself. On this point, the law of neutrality intrudes into the analysis in potentially contradictory ways. On one hand, as noted above, under neutrality law non-belligerent States have an obligation to refrain from providing war-related goods and services to belligerents. On the other, they generally do not have an obligation to prevent private actors from doing so. Levying an obligation through due diligence on States to prevent or disrupt the very actions that neutrality law countenances would not only eschew the lex specialis principle, but turn the law on its head.

Finally, once triggered, the due diligence obligation is only one of feasibility, and even then, it is a rule of conduct, not consequence. That is, if it is infeasible for a particular State to identify the source of or take effective action to stop harmful crowdsourced logistics activities emanating from within its borders, it has not breached its obligation of due diligence. Even if it takes responsive measures, so long as they are reasonable—very much a function of each State’s specific capacity and capabilities, or lack thereof—it matters not that they are ineffective. This feasibility qualifier substantially limits the circumstances of legal risk to those non-belligerent States implicated by private individuals engaging in supplying logistics to Ukraine.

Concluding Thoughts

Where Russia stands on due diligence is somewhat of an open question. Judging from its UN GGE submissions, and the significant amount of harmful, criminal cyber activity conducted from its territory, it probably is not a fan and would likely reject any assertions that it is legally bound by the principle. But as in all things, duplicitous and opportunistic invocation of international law is not beyond Russia’s play book. The same likely holds true for how Russia might “interpret” other States’ neutrality obligations. As they say, in the end the enemy gets a vote.

And just as in the case of DPH and individual risks, the practical risks of Russian retaliation against States, qua States, for the crowdsourcing activities of private individuals is a distinct question and likely low, especially given the potentially more significant escalatory dynamics at play; something Russia has thankfully sought to avoid thus far.

***

Gary Corn is the Director of the Technology, Law & Security Program and Adjunct Professor of Cyber and National Security Law at the American University Washington College of Law.

Photo credit: www.mil.gov.ua