In discussions to date about how international law applies in cyberspace, commentators have tended to focus their attention on how the rules on the use of force, or the law of armed conflict, apply to cyber activities conducted by states that give rise to physical damage, injury or death.

But in practice, the vast majority of state cyberattacks fall below this threshold. Far more common are persistent, low-level attacks that may leave no physical trace but that are capable of doing significant damage to a state’s ability to control its systems, often at serious economic cost.

Such cyber incursions might include network disruptions in the operation of another government’s websites; tampering with electoral infrastructure to change or undermine the result; or using cyber means to destabilize another state’s financial sector.

For these kinds of cyber operation, the principle of sovereignty, and the principle of non-intervention in another state’s internal affairs, are the starting point.

A UN Group of Government Experts (GGE) agreed in 2013 and 2015 that the principles in the UN Charter, including sovereignty and the prohibition on intervention in another state’s affairs, apply to states’ activities in cyberspace. The 2015 GGE also recommended eleven (non-binding) norms of responsible state behaviour in cyberspace.

However, states have not yet reached agreement on how to apply these principles. Until recently, there has also been very little knowledge of what states actually do in cyberspace, as they usually conduct cyber operations covertly and have been reluctant to put their views on record.

A new Chatham House research paper analyses the application of the principles of sovereignty and non-intervention to state cyberattacks that fall below the principle of use of force. As well as analysing the application of the law in this area, the paper also makes recommendations to governments on how they might best make progress in reaching agreement in this area.

Existing rules or new rules?

As the research paper makes clear, there is currently some debate, principally between countries in the West, about the extent to which sovereignty is a legally binding rule in the context of cyberspace and, if so, how it and the principle of non-intervention might apply in practice.

In the last few years, certain states have put on record how they consider international law to apply to states’ activities in cyberspace, namely the UK, Australia, France and the Netherlands. While there may be some differences in their approaches, which are discussed in the paper, there also remains important common ground: namely, that existing international law already provides a solid framework for regulating states’ cyber activities, as it regulates every other domain of state-to-state activity.

There is also an emerging trend for states to work together when attributing cyberattacks to hostile states, enabling them to call out malign cyber activity when it violates international law. (See, for example, the joint statements made in relation to the NotPetya cyber attack and malicious cyber activity attributed to the Russian government).

However, other countries have questioned whether existing international law as it stands is capable of regulating states’ cyber interactions and have called for ‘new legal instruments’ in this area.

This includes a proposal by the Shanghai Cooperation Organization (led by Russia and China) for an International Code of Conduct on Information Security, a draft of which was submitted to the UN in 2011 and 2015, without success. The UN has also formed a new Open-Ended Working Group (OEWG) under a resolution proposed by Russia to consider how international law applies to states’ activities in cyberspace.

The resolution establishing the OEWG, which began work earlier this year, includes the possibility of the group ‘introducing changes to the rules, norms and principles of responsible behaviour of States’ agreed in the 2013 and 2015 GGE reports. In the OEWG discussions at the UN in September, several countries claimed that a new legal instrument was needed to fill the ‘legal vacuum’ (Cuba) or ‘the gap of ungoverned areas’ (Indonesia).

It would be concerning if the hard-won consensus on the application of international law to cyberspace that has been reached at past GGEs started to unravel. In contrast to 2013 and 2015, the 2017 meeting failed to reach an agreement.

On 9 December, a renewed GGE will meet in New York, but the existence of the OEWG exploring the same issues in a separate process reflects the fact that cyber norms have become an area of geopolitical rivalry.

Aside from the application of international law, states are also adopting divergent approaches to the domestic regulation of cyberspace within their own territory. The emerging trend towards a ‘splinternet’ – i.e. between states that believe the internet should be global and open on the hand, and those that favour a ‘sovereignty and control’ model on the other  – is also likely to make discussions at the GGE more challenging.

Distinct from the international law concept of sovereignty is the notion of ‘cybersovereignty’, a term coined by China to describe the wide-ranging powers it assumes under domestic law to regulate its citizens’ access to the internet and personal data within its territory. This approach is catching on (as reflected in Russia’s recently enacted ‘Sovereign Internet Law’), with other authoritarian states likely to follow suit.

The importance of non-state actors

In parallel with regional and UN discussions on how international law applies, a number of initiatives by non-state actors have also sought to establish voluntary principles about responsible state behaviour in cyberspace.

The Global Commission on the Stability of Cyberspace, a multi-stakeholder body that has proposed principles, norms and recommendations to guide responsible behaviour by all parties in cyberspace, recently published its final report. The Cybersecurity Tech Accord  aims to promote collaboration between tech companies on stability and resilience in cyberspace. President Macron’s ‘Paris Call for Trust and Security in Cyberspace’ has to date received the backing of 67 states, 139 international and civil society organizations, and 358 private-sector organizations.

It remains to be seen in the long term whether the parallel processes at the UN will work constructively together or be competitive. But notwithstanding the challenging geopolitical backdrop, the UN GGE meeting next week at the least offers states the opportunity to consolidate and build on the results of past meetings; to increase knowledge and discussion about how international law might apply; and to encourage more states to put their own views of these issues on the record.

On Thursday, the US House of Representatives passed a resolution affirming its authority under the War Powers Resolution Act, and reminding the president, the American people and the world that when it comes to the use of military force, Congress must be taken into account. 

President Donald Trump replied by retweeting John Bolton, his former national security advisor, who tweeted that the War Powers Act was ‘unconstitutional’, effectively dismissing Congressional efforts to rein in the president.

This round of legal Twitter diplomacy came days after the president tweeted that ‘legal notice (to Congress) is not required, but it is given nevertheless’ and that ‘should Iran strike any US person or target, the United States will quickly and fully strike back, and perhaps in a disproportionate manner.’ 

President Trump’s overt attacks on Congressional authority and disregard for the law are not normal for a US president, but legal constraints over the president’s authority to use military force have been eroding for several years.

In 1973, Congress passed the War Powers Act, requiring the president to report to Congress and acquire Congressional approval for continued overseas troop deployments. But Congressional authority over the use of military force has continued to diminish, especially since the 9/11 attacks. 

Now, Congress is pushing back – a resolution similar to that passed by the House is likely to be voted on by the Senate soon. Given the intense frustration of some senators over the president’s handling of the current conflict, this resolution may pass, though the president is still likely to veto. 

The bigger problem, of which this is one part, is the expansion of executive authority, and it predates this presidency. Many argue that executive power is greatest on matters of foreign policy, and that in this domain the US president is unconstrained. As partisanship has increased and the demands on Congress have made it harder for its members to cultivate foreign policy expertise, the power of the president has grown.

So the fact that Congress is taking active steps to check the president’s power not only on the question of impeachment, but also on foreign policy, is significant, even if the law is not likely to restrain President Trump. But Congress is also playing a long game. And its growing determination to assert its authority matters not only for this presidency, but also for the future.

Political constraints

In the short term, other constraints matter more. Even if President Trump rejects legal restraints – and shuns diplomatic pressure that might have mattered to other presidents – he is not impervious to political restraint.

Already there are signs that Trump listens to his key Republican allies in Congress. When Senator Lindsay Graham pushed back against the president’s threat to attack cultural heritage sites in Iran, and the Pentagon failed to shore up the president’s threat, the president changed his position. The threats also provoked an overwhelming response in Europe, and across the Middle East, but the president has shown that he is willing to disregard international admonishment. Not so for domestic allies.

Nor is this the first time that Senator Graham’s views have mattered. When the president announced his decision to pull troops from northeast Syria, effectively abandoning the Kurds, a key partner to the US in its fight against ISIS, Senator Graham and Senator Mitch McConnell pushed back and it mattered. 

Public opinion also matters to the president, especially Republican public opinion, and this is likely to affect the president’s next steps. Recent polls suggest that Americans feel less safe as a result of the killing of General Qassem Soleimani by a considerable margin of 55% to 24%.

But the same survey also shows that a majority of Americans support the decision to kill Soleimani. Already Vice President Mike Pence has spoken at a rally in Ohio designed to bolster support for this Presidential action.  

So what might change public opinion and will this alter the president’s future steps?

Americans are very reluctant to support further deployments of troops overseas. President Trump knows this and he has consistently stated that he seeks to pull US troops out of the Middle East.

In fact, the opposite has happened. And once again, the decision to kill General Soleimani is pulling the US further into the Middle East and putting into stark light the inconsistency of Trump’s foreign policy ambitions. In recent days, the United States has committed to sending thousands of troops to the region.

Continued US troop deployments may not play well with Trump’s base, though they currently support his Iran policy. But absent an obvious justification, this could change, so it is not surprising that this has become a rallying point for Vice President Pence.

An even greater political risk, and one that will matter to the president, is the risk to US military personnel and civilians overseas. Public support for the killing of Soleimani and increased US presence in the region is bound to dissipate if Americans are killed.

But it isn’t clear how the president will respond, and already the death of one American in the militia attack on 27 December seems to have been a critical factor in Trump’s decision to authorize the assassination of General Soleimani.  

So far, Iran’s response appears to be calibrated to avoid this kind of public backlash, and keep the door open to some sort of managed resolution of the current crisis.

But the considerable risk of miscalculation and mistakes has already been born out. A week after the killing of Soleimani, the world is tuning in to the tragic news that a civilian airliner departing Iran for Ukraine appears to have been accidentally shot down by an Iranian missile, resulting in the deaths of all 176 people on board, including 82 Iranians and 63 Canadians.

Whether the US president is constrained is a critical question for Americans, for US democracy and for the rest of the world. Trump is different, but he is not unconstrained. Steps taken by Congress along with diplomatic and political pressure mean he is still operating within boundaries. But it is clear that these boundaries are being redefined.

There are two well-established ideas in trade. Individually, they are correct. Combined, they can lead to a conclusion that is unfortunately wrong.

The first idea is that, across a range of economic sectors, the EU and the US have been engaged in a battle to have their model of regulation accepted as the global one, and that the EU is generally winning.

The second is that governments can use their regulatory power to extend strategic and foreign policy influence.

The conclusion would seem to be that the EU, which has for decades tried to develop a foreign policy, should be able to use its superpower status in regulation and trade to project its interests and its values abroad.

That’s the theory. It’s a proposition much welcomed by EU policymakers, who know they are highly unlikely any time soon to acquire any of the tools usually required to run an effective foreign policy.

The EU doesn’t have an army it can send into a shooting war, enough military or political aid to prop up or dispense of governments abroad, or a centralized intelligence service. Commission President Ursula von der Leyen has declared her outfit to be a ‘geopolitical commission’, and is casting about for any means of making that real.

Through the ‘Brussels effect’ whereby European rules and standards are exported via both companies and governments, the EU has indeed won many regulatory battles with the US.

Its cars, chemicals and product safety regulations are more widely adopted round the world than their American counterparts. In the absence of any coherent US offering, bar some varied state-level systems, the General Data Protection Regulation (GDPR) is the closest thing the world has to a single model for data privacy, and variants of it are being adopted by dozens of countries.

The problem is this. Those parts of global economic governance where the US is dominant – particularly the dollar payments system – are highly conducive to projecting US power abroad. The extraterritorial reach of secondary sanctions, plus the widespread reliance of banks and companies worldwide on dollar funding – and hence the American financial system – means that the US can precisely target its influence.

The EU can enforce trade sanctions, but not in such a powerful and discriminatory way, and it will always be outgunned by the US. Donald Trump could in effect force European companies to join in his sanctions on Iran when he pulled out of the nuclear deal, despite EU legislation designed to prevent their businesses being bullied. He can go after the chief financial officer of Huawei for allegedly breaching those sanctions.

By contrast, the widespread adoption of GDPR or data protection regimes inspired by it may give the EU a warm glow of satisfaction, but it cannot be turned into a geopolitical tool in the same way.

Nor, necessarily, does it particularly benefit the EU economy. Europe’s undersized tech sector seems unlikely to unduly benefit from the fact that data protection rules were written in the EU. Indeed, one common criticism of the regulations is that they entrench the power of incumbent tech giants like Google.

There is a similar pattern at work in the adoption of new technologies such as artificial intelligence and the Internet of Things. In that field, the EU and its member states are also facing determined competition from China, which has been pushing its technologies and standards through forums such as the International Telecommunication Union.

The EU has been attempting to write international rules for the use of AI which it hopes to be widely adopted. But again, these are a constraint on the use of new technologies largely developed by others, not the control of innovation.

By contrast, China has created a vast domestic market in technologies like facial recognition and unleashed its own companies on it. The resulting surveillance kit can then be marketed to emerging market governments as part of China’s enduring foreign policy campaign to build up supporters in the developing world.

If it genuinely wants to turn its economic power into geopolitical influence – and it’s not entirely clear what it would do with it if it did – the EU needs to recognize that not all forms of regulatory and trading dominance are the same.

Providing public goods to the world economy is all very well. But unless they are so particular in nature that they project uniquely European values and interests, that makes the EU a supplier of useful plumbing but not a global architect of power.

On the other hand, it could content itself with its position for the moment. It could recognize that not until enough hard power – guns, intelligence, money – is transferred from the member states to the centre, or until the member states start acting collectively, will the EU genuinely become a geopolitical force. Speaking loudly and carrying a stick of foam rubber is rarely a way to gain credibility in international relations.

This article is part of a series of publications and roundtable discussions in the Chatham House Global Trade Policy Forum.

The WTO Ministerial Conference in June 2020 presents a critical opportunity to move ahead on better alignment of trade and environmental sustainability objectives, policymaking and governance. In light of the challenges facing the WTO, meaningful efforts to address environmental sustainability would also help to reinvigorate the organization and strengthen its relevance. 

In this context, the meeting aims to advance discussion on two questions: How can the multilateral trade system better contribute to meeting the UN Sustainable Development Goals and the Paris climate goals? What priorities and tangible outcomes on trade and environmental sustainability should be advanced at the WTO Ministerial Conference in Nur Sultan in June and beyond?

The event will be hosted by the US and the Americas Programme and the Hoffmann Centre for Sustainable Resource Economy at Chatham House in partnership with both the Global Governance Centre and the Centre for Trade and Economic Integration at the Graduate Institute, Geneva.

We gratefully acknowledge the financial support for this event from the Chatham House Global Trade Policy Forum’s founding partner AIG and supporting partners Clifford Chance LLP, Diageo plc and EY, and on the Graduate Institute side, from the government of Switzerland.