Cyber Espionage

From the Cuckoo’s Egg to Global Surveillance: Cyber Espionage that Becomes Prohibited

Intervention

Nicolas Jupillat†

I. Introduction ........................................................................ 934   II. Misconceptions about the Regulation of State Conduct

in Cyberspace ..................................................................... 937   A. From “Code is Law” to “Law is Law” ......................... 937   B. International Law is the Law of Nations ....................... 938   C. International Law is Law .............................................. 939   D. Cyberspace and Normative Opportunism ..................... 940  

III. Sovereignty ........................................................................ 940   A. Generally ....................................................................... 940   B. Sovereignty in Cyberspace ........................................... 942   C. Non-Intervention ........................................................... 945  

1.   The Origin of the Coercion Concept ..................... 948   2.   The Meaning of Coercion ...................................... 949  

IV. Espionage Generally .......................................................... 951   A. Wartime ........................................................................ 951   B. Peacetime ...................................................................... 953  

1. Definition ................................................................ 953   2. Unsettled Law ......................................................... 954   3. Exceptions to the Case Law Gap ............................ 959  

C. International Domains and Organizations .................... 961   1. Domains .................................................................. 962   2. Organizations .......................................................... 966  

IV. Cyber Espionage ................................................................ 967   A. What Cyber Espionage is and how it Differs from

Traditional Espionage ................................................. 967   1. Computer Network Exploitation ............................. 968   2. Communications Intelligence ("COMINT") ........... 970   3. Secret Information-Sharing ..................................... 972  

B. Why Should Cyber Espionage Be Deterred? ................ 974  

† Visiting Professor, University of Detroit Mercy School of Law and Center for Cyber Security and Intelligence Studies, Google Policy Fellow at the Canadian Internet Policy and Public Interest Clinic, IEEE Global Initiative for Ethical Considerations in Artificial Intelligence and Autonomous Systems Law Committee.

934 N.C. J. INT'L L. [Vol. XLII

C. How And When Cyber Espionage Becomes Illegal ..... 978   1. How ......................................................................... 978   2. When: Scale and Coercion ...................................... 979   3. When: Context and Threat of Disclosure

(Information Warfare) ........................................... 981   V. Functionalism and other Moot Preclusions of State

Responsibility .................................................................... 984   VI. Conclusion ......................................................................... 987  

I. Introduction The Cuckoo’s Egg is the nickname of a persistent computer

intrusion that occurred at the Lawrence Berkeley National Laboratory in 1986.1 It is the very first documented case of cyber espionage.2 As a matter of fact, cyber espionage marked the beginning of what is now commonly referred to as cyber warfare, and continues to be its most common manifestation today, consistently ahead of cyber sabotage among state-sponsored operations.3 Recent examples confirm the extent of the phenomenon and its consequences, from the multiple high-profile Chinese operations observed since 2003,4 to the 2013 Snowden disclosures of the U.S. National Security Agency’s mass-scale foreign surveillance programs,5 and the recent Democratic

1 See generally CLIFFORD STOLL, THE CUCKOO’S EGG (1989) (detailing a first- person account of how the author tracked the person who hacked the Lawrence Berkeley National Laboratory computer). 2 See generally A FIERCE DOMAIN: CONFLICT IN CYBERSPACE, 1986 TO 2012 (Jason Healey et al. eds., 2013) (providing a history of disruptions and other cyber attacks). 3 Cyber sabotage is referred to as cyber warfare to the exclusion of espionage. See Paolo Passeri, 2016 Cyber Attacks Statistics, HACKMAGEDDON (Jan. 19, 2017), http://www.hackmageddon.com/ [https://perma.cc/UW8D-MKS9]. 4 Starting in the early 2000’s with Titan Rain and Byzantine Hades and more recently with the 2015 U.S. Office of Personnel Management data breach which lost 21.5 million personnel files, including sensitive information such as health and financial history, arrest records, and fingerprint data. See Symantec, 2016 Internet Security Threat Report, 21 INTERNET SEC. THREAT REPORT 1, 37 (Apr. 2016); see also INFO. WARFARE MONITOR, TRACKING GHOSTNET: INVESTIGATING A CYBER ESPIONAGE NETWORK (2009) (alleging global surveillance program akin to NSA programs known as GhostNet discovered in 2009). 5 See Bruce Schneier, There’s No Real Difference Between Online Espionage and Online Attack, ATLANTIC (Mar. 6, 2014), http://www.theatlantic.com/technology/archive/2014/03/theres-no-real-difference- between-online-espionage-and-online-attack/284233/ [https://perma.cc/V8PW-BCGM]

2017 FROM THE CUCKOO'S EGG TO GLOBAL SURVEILLANCE 935

National Committee hack attributed to Russia in the context of the 2016 United States Presidential election campaign.6 As early as 2013, United States Director of National Intelligence James Clapper had already warned the Senate Intelligence Committee “that cyber-attacks and cyber espionage [had] supplanted terrorism as the top security threat facing” the United States.7

However, the international community has been ostensibly slow to tackle the issue. The 2015 Report of the United Nations Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security only reasserts the right to privacy in the digital age, relegating cyber espionage and extraterritorial surveillance as mere human rights concerns.8 Merely noting the “need to preserve global connectivity and the free and secure flow of information,”9 the Report, though intended as a code of responsible state conduct in cyberspace, fails to deal with the most pressing of current cyber threats, and instead focuses on longer term, if not conceptual, computer security threats such as cyber use of force.10 And yet, the material and political implications of cyber espionage are such that it can no longer be ignored. Cyber espionage contributes to tension escalation across the world, and may cause significant incidental damage to computer network infrastructure. It may also constitute a threat to the unified domain name system upon which the global internet relies, especially as more states could seek to withdraw from a global internet that in

(discussing other sophisticated surveillance networks, such as Red October and The Mask, which are attributed to Russia and Spain, respectively). 6 See Spencer Ackerman & Sam Thielman, US Officially Accuses Russia of Hacking DNC and Interfering with Election, GUARDIAN (Oct. 8, 2016, 9:09 AM), https://www.theguardian.com/technology/2016/oct/07/us-russia-dnc-hack-interfering- presidential-election [https://perma.cc/UE5A-ETGS]. 7 Mark Hosenaball & Patricia Zengerle, Cyber Attacks Leading Threats Against U.S.: Spy Agencies, REUTERS (Mar. 12, 2013, 3:07 PM), http://www.reuters.com/article/us-usa-threats-idUSBRE92B0LS20130312 [https://perma.cc/A4GV-Z7AB]. 8 See Group of Government Experts on Developments in the Field of Information and Telecommunications in the Context of International Security, Report of the Group of Governmental Experts on Developments in the Field of Information and Telecommunication in the Context of International Security, U.N. DOC. A/70/174 (July 22, 2015) [hereinafter U.N. DOC. A/70/174]. 9 Id. ¶ 30. 10 See id.

936 N.C. J. INT'L L. [Vol. XLII

large part enables mass-scale and remote data collection.11 The intensity of the threat can only increase with our growing reliance on telecommunications infrastructure, the development of the internet of things, and machine learning.

Under international law, this lack of direction is aggravated by the persistent uncertainty surrounding the legality of espionage,12 as well as the definition of non-intervention.13 There is a need to specify the interpretation of existing rules of international law, especially if we are to maintain international peace and security and friendly relations among states. Foreign surveillance has recently prompted a fair amount of literature, mainly focused on its deleterious human rights consequences, and the need to reaffirm the extraterritorial applicability of treaty law.14 Nevertheless, little has been said about the rights of states to object to what can also appear to be a serious violation of their sovereignty. This paper aims to lay the foundations for a productive conversation on the evolving definition of espionage, intervention, and sovereignty in the digital age. It also highlights the need for further cross-disciplinary research in the fields of law, cyber warfare, and intelligence-gathering technology.

11 See Sascha Meinrath, The Future of the Internet: Balkanization and Borders, TIME (Oct. 11, 2013), http://ideas.time.com/2013/10/11/the-future-of-the-internet- balkanization-and-borders/ [https://perma.cc/XYA2-XAT5]. 12 A. John Radsan, The Unresolved Equation of Espionage and International Law, 28 MICH. J. INT’L L. 595, 596–97 (2007). 13 See SIR MICHAEL WOOD, THE PRINCIPLE OF NON-INTERVENTION IN CONTEMPORARY INTERNATIONAL LAW: NON-INTERFERENCE IN A STATE’S INTERNAL AFFAIRS USED TO BE A RULE OF INTERNATIONAL LAW: IS IT STILL? 2 (Feb. 27, 2007), https://studylib.net/download/8433936 (Summary of the Chatham House International Law Discussion Group meeting held on Feb. 27, 2007). 14 See Francesca Bignami, Towards a Right to Privacy in Transnational Intelligence Networks, 28 MICH. J.INT’L L. 663, 665 (2007); see also Ilina Georgiva, The Right to Privacy under Fire – Foreign Surveillance under the NSA and the GCHQ and Its Compatibility with Art. 17 ICCPR and Art. 8 ECHR, 31 UTRECHT J. INT’L & EUR. L. 104, 104–30 (2015); Marko Milanovic, Human Rights Treaties and Foreign Surveillance: Privacy in the Digital Age, 56 HARV. INT’L L.J. 81, 81 (2015); Beth Van Schaack, The United States’ Position on the Extraterritorial Application of Human Rights Obligations: Now is the Time for Change, 90 INT’L. L. STUD. 20, 20 (2014).

2017 FROM THE CUCKOO'S EGG TO GLOBAL SURVEILLANCE 937

II. Misconceptions about the Regulation of State Conduct in Cyberspace

A. From “Code is Law” to “Law is Law” There is a common misconception about the relationship

between code and the law. Lawrence Lessig, among other intellectuals, has posited that code was the law of cyberspace.15 Notwithstanding certain nuances to this idea, his theory boils down to arguing that code is what regulates and governs cyberspace.16 Thankfully, this intellectual trend is waning, as other intellectuals are now recognizing that not only does law have its place, but also that code and law operate on two different planes of reality.17 Urs Gasser, the executive director for Harvard’s Berkman Klein Center for Internet & Society confirms that “gradually, that approach is starting to change.”18 “Post- Snowden, there’s a renewed emphasis on ‘law as law,’ to regulate code.”19 In fact, it stands to reason that code is to cyberspace what the natural laws of physics are to the real world. Code determines what is possible in cyberspace the same way that the laws of physics determine what is possible in reality. But it certainly does not tell us what is allowed or not. In real life, one can use a chair to hurt someone by breaking it on their back, if that is the intention. The material is light enough to be lifted, yet rigid enough to cause harm. The laws of physics make that possible, but that quite obviously does not make it legal. The same goes for cyberspace. Code may make it possible to steal information, but it does not make it lawful.

15 See LAWRENCE LESSIG, CODE: AND OTHER LAWS OF CYBERSPACE 7–8 (2000) [hereinafter CODE AND OTHER LAWS]; see also Lawrence Lessig, Code is Law: On Liberty in Cyberspace, HARV. MAG. (Jan. 1, 2000), http://harvardmagazine.com/2000/01/code-is-law-html [https://perma.cc/URH4-XET5]. 16 See CODE: AND OTHER LAWS, supra note 15. 17 See David Pogue, Don’t Just Chat, Do Something, N.Y. TIMES: BOOKS (Jan. 30, 2000), http://www.nytimes.com/books/00/01/30/reviews/000130.30poguet.html [https://perma.cc/6Q66-8L43]. 18 See Robert Levine, The ‘Right to be Forgotten’ and Other Cyberlaw Cases Go to Court, BLOOMBERG (June 23, 2016, 2:48 PM), https://www.bloomberg.com/news/articles/2016-06-23/the-right-to-be-forgotten-and- other-cyberlaw-cases-go-to-court [https://perma.cc/A37L-TUQJ]. 19 Id.

938 N.C. J. INT'L L. [Vol. XLII

B. International Law is the Law of Nations The classical foundations of international law, which are

commonly attributed to the Dutch jurist Hugo Grotius,20 date back to the seventeenth century, with premises in the sixteenth century contributions of French jurist Jean Bodin to the concept of sovereignty.21 Also known as the “Westphalian system,” named after the Treaty of Westphalia of 1648, which concluded the Thirty Years War in Europe, the international legal order is comprised of nation-states who exercise exclusive political authority over their own territories,22 and form international norms through mutual consent,23 either by contracting with one another through treaties or through uniform state practice, which may concur to the formation of international customary law when performed in conjunction with opinio juris, which refers to a state acting with a sense of legal obligation.24

States remain the primary subjects of international law. The fact that a myriad of non-state actors are involved in shaping cyberspace does not mean that they “govern” or “regulate” cyberspace. States retain this consubstantial prerogative. Let us consider human societies as a metaphor for the world community. Emergent qualities inevitably derive from the sum of all individual behavior, but that does not make each individual a member of the governing body. Likewise, as much as non-state actors also concur to shaping the world community, they still do not form part of the governing body. The governing body is the community of states. Non-state actors cannot enter intro international conventions, and their behavior is not norm-creating. They are bound by the domestic and international legal systems, where only states legislate and enforce the law. Non-state actors are objects of international law, with certain rights and obligations that are only granted or imposed by virtue of state will.

20 See EMER DE VATTEL, THE LAW OF NATIONS OR PRINCIPLES OF THE LAW OF NATURE APPLIED TO THE CONDUCT AND AFFAIRS OF NATIONS AND SOVEREIGNS § 7 (Joseph Chitty ed., trans., T. & J. W. Johnson, Law Booksellers 6th ed., 1844) (1797) [hereinafter THE LAW OF NATIONS]. 21 See WM. A. DUNNING, Jean Bodin on Sovereignty, 11 POL. SCI. Q. 82, 84 (1896). 22 See THE LAW OF NATIONS, supra note 20, § 205. 23 See id. at v. 24 Opinio Juris Sive Necessitatis, BLACK’S LAW DICTIONARY (10th ed., 2014).

2017 FROM THE CUCKOO'S EGG TO GLOBAL SURVEILLANCE 939

C. International Law is Law International law is sometimes discarded as ineffective due to

unrealistic expectations. The fact that the law does not always influence individual or state behavior the way that was intended does not make it irrelevant. U.S. domestic criminal law being broken on a regular basis does not make us question the relevance of the U.S. legal system as a whole. As Quincy Wright says the “[l]aw . . . formulates the values, not the behavior, of the community.”25 This more generally illustrates a traditional tension, among international legal scholars, between the realists, who believe that force alone can change state behavior, and the idealists, who contend that ideas and values also shape state behavior.

States want to be seen acting in compliance with international law, and will go to great length to have their positions drafted using language borrowed from international law to give more authority to their arguments. International law is a language. In the first presidential debate of the 2016 U.S. election, Secretary Hillary Clinton made clear references to international law when asked about cyber warfare, even correcting herself to use more specific international law terminology.26 She and other higher officials often use international legal terminology to signify that international law applies, and that current and future actions and declarations are potentially norm-creating.27 States may only be bound by International Court of Justice decisions when they agree to the jurisdiction of the Court in advance (through a compromissory clause or optional clause declaration) or on a case- by-case basis (through special agreement or forum prorogatum), but the international legal order is first and foremost founded on the premise of reciprocity.28 This principle can be summed up as

25 Quincy Wright, Espionage and the Doctrine of Non-Intervention in Internal Affairs, in ESSAYS ON ESPIONAGE AND INTERNATIONAL LAW 8 (Roland Stanger ed., 1962). 26 See Aaron Blake, The First Trump-Clinton Presidential Debate Transcript, Annotated, WASH. POST: FIX (Sept. 26, 2016), https://www.washingtonpost.com/news/the-fix/wp/2016/09/26/the-first-trump-clinton- presidential-debate-transcript-annotated/?utm_term=.b341fd1057c0 [https://perma.cc/6H53-KJ3U] (“[W]e are seeing cyber attacks coming from states, organs of states.”). 27 See id. 28 See Francesco Paris & Nita Ghei, The Role of Reciprocity in International Law, 36 CORNELL INT’L. L.J. 93, 93–94 (2003) (explaining why reciprocity is important in

940 N.C. J. INT'L L. [Vol. XLII

“don’t do unto others what you don’t want others to do unto you.” This is what holds the international community together.

D. Cyberspace and Normative Opportunism On the other side of unrealistic expectations, there are claims

that existing norms and principles do not apply to new technology. There is a tendency, sometimes motivated by political opportunism, to claim the need for new rules and radically new interpretations of existing norms and principles. The novel and different character of cyberspace prompts certain observers to think that “old” concepts of borders and sovereignty ought to be radically reinvented.29 I do not share this view. The White House took a far more reasonable approach in 2011: though there might be a need for minor adjustments, international law is not obsolete.30 International law is well drafted and broad enough to encompass new technological developments.31 It would appear hazardous to throw away long-established concepts and principles, as this would only create more uncertainty, which could have far- reaching consequences, including outside of cyberspace.

III. Sovereignty

A. Generally Sovereignty has an internal and an external component.

Internally, sovereignty refers to a state’s exclusive jurisdiction over its own territory. In addition to land, territory includes territorial waters and airspace. As arbitrator Max Huber explained in the Island of Palmas Arbitration Award: “sovereignty in the

international law). 29 Sean P. Kanuck, Information Warfare: New Challenges for Public International Law, 37 HARV. INT’L L.J. 243, 288 (1996) (“Cyberspace and information alike transcend physical boundaries, thereby requiring a legal paradigm that looks beyond merely the locus of events.”). 30 THE WHITE HOUSE, INTERNATIONAL STRATEGY FOR CYBERSPACE 9–10 (2011). 31 See Hague Convention (II) with Respect to the Laws and Customs of War on Land, July 29, 1899, 32 Stat, 1803, Martens Nouveau Recueil [hereinafter Hague II] (Martens Clause: “Until a more complete code of the laws of war is issued, the High Contracting Parties think it right to declare that in cases not included in the Regulations adopted by them, populations and belligerents remain under the protection and empire of the principles of international law, as they result from the usages established between civilized nations, from the laws of humanity and the requirements of the public conscience.”).

2017 FROM THE CUCKOO'S EGG TO GLOBAL SURVEILLANCE 941

relations between states signifies independence. Independence in regards to a portion of the globe is the right to exercise therein, to the exclusion of any other State, the functions of a State.”32 Externally, sovereignty translates as state equality before the law. States have the same rights and obligations in their relations with one another.

Sovereignty is a principle of freedom and political independence. Despite being often confused with power, sovereignty only implies freedom, the freedom to choose its own policy orientations, including alliances and economic dependencies whenever self-sufficiency is not attainable, and it rarely is.

Sovereignty and extraterritorial jurisdiction. It is generally recognized that a state’s jurisdiction may extend beyond its borders in certain specific cases. Those include flag vessels, and registered air or space crafts in international domains. On rarer occasions, will extraterritorial jurisdiction be recognized on criminal offense that unfolded on another state’s territory. The protective principle claim of extraterritorial jurisdiction can be made when a state’s national security is at stake. The active and passive personality principles apply based on the nationality of the perpetrator on the one hand, and that of the victim on the other. Finally, universal jurisdiction is the idea according to which a court may have jurisdiction over any case where international criminal law, as well as certain peremptory norms of international law, are violated, regardless of where the crime took place and nationality of the individuals involved. This form of jurisdiction is controversial and only concerned with the most heinous crimes. At any rate, extraterritorial jurisdiction does not in any way imply that a state has extraterritorial authority over any given matter. A state may not intervene in the internal affairs of other states on a claim of extraterritorial jurisdiction. If no extradition treaty exists between the state seeking jurisdiction over a case and the state where the perpetrator or victim is located, then there is very little recourse for the state seeking jurisdiction to have the individual in question tried by their own domestic court system. At best, states may seek to exercise their right to grant diplomatic protection to their own nationals not residing or otherwise not located on their

32 Island of Palmas (Netherlands v. United States), 2 R.I.AA. 829, 838 (Perm. Ct. Arb. 1928).

942 N.C. J. INT'L L. [Vol. XLII

territory.

B. Sovereignty in Cyberspace The “cyber” prefix derives from the word cybernetics, which

refers to the science of communication and automatic control systems in both machines and living things.33 William Gibson coined the term cyberspace in 1982 in his novel “Burning Chrome,”34 after the creation of the ARPAnet in 1969, and soon after the creation of the web in 1980. There are multiple definitions of cyberspace, but I will retain that of the NATO CCD COE. In 2013, the North Atlantic Treaty Organization’s Cooperative Cyber Defence Centre of Excellence convened a group of international experts to discuss the applicability of international law to cyber warfare.35 Their work, known as the Tallinn Manual, defines cyberspace as the “environment formed by physical and non-physical components, characterized by the use of computers and the electro-magnetic spectrum, to store, modify, and exchange data using computer networks.”36 It therefore includes devices that are not constantly connected to it, such as memory sticks. Some states, such as Russia, will more commonly employ the phrase “information space” to include the cognitive realm, whereby anything that influences the human psyche is part of cyberspace.37 Cyberspace is a widely-used term despite some debate over its relevance, especially as a “space.”38 Quite obviously, cyberspace is unlike sea, land, air, and outer space. One cannot inhabit cyberspace, or make any territorial claims over cyberspace proper or any portion thereof. It is

33 Cybernetics, OXFORD ONLINE DICTIONARY, https://en.oxforddictionaries.com/definition/cybernetics [https://perma.cc/Q4NV- LVUD]. 34 See Scott Thill, March 17, 1948: William Gibson, Father of Cyberspace, WIRED, Mar. 17, 2009, https://archive.wired.com/science/discoveries/news/2009/03/dayintech_0317 [https://perma.cc/PN42-PE34]. 35 See U.N. Doc. A/70/174, supra note 8. 36 TALLINN MANUAL ON THE INTERNATIONAL LAW APPLICABLE TO CYBER WARFARE 258 (Michael N. Schmitt, ed., Cambridge University Press 2013) [hereinafter TALLINN MANUAL]. 37 See KEIR GILES & WILLIAM HAGESTAD II, DIVIDED BY A COMMON LANGUAGE: CYBER DEFINITIONS IN CHINESE, RUSSIAN, AND ENGLISH §§ 5(B)–(C) (2013). 38 Martin C. Libicki, Cyberspace Is Not a Warfighting Domain, 340 AM. J.L. & POL’Y INFO. SOC’Y 325–340 (2012).

2017 FROM THE CUCKOO'S EGG TO GLOBAL SURVEILLANCE 943

therefore not so much a “space,” as it is rather a network of networks. Air Law would probably give a more relevant basis for further comparative work, as it is a legal framework conceived to be applied to networks (airports being nodes connected by international travel routes), and is also an earlier compromise between global private and public interests.39

The fact that there was no central government, no central planning in the development of the internet has prompted many libertarian, not to say anarchist thinkers to deny the applicability of the concept of sovereignty in cyberspace.40 Yet, though the internet certainly poses a number of new challenges, it is far from being ungoverned or irrelevant to state action.

By denying state sovereignty, such ideologies are negating fundamental and legitimate public order functions traditionally performed by states under the social contract. A borderless world, either on or off line is a myth, as other forms of regulation and decision-making processes would inevitably emerge and fill the void. Nothing guarantees that such decisional structures would not tend towards some sort of centralization, or would necessarily be more likely to serve the collective good. Such a world would not necessarily be more democratic by nature. The rule of law within a state with a democratically elected government is the sole system that retains a semblance of legitimacy, despite the normative opportunism engendered by the novelty of the internet.

The Tallinn Manual, provides a series of draft rules that constitute a strong indication of how international law will apply to cyber warfare.41 Even though these rules are non-binding as such, the International Court of Justice, whose function is to settle

39 LUCIEN RAPP, HAGUE ACADEMY OF INTERNATIONAL LAW, LEGAL IMPLICATIONS OF GLOBAL TELECOMMUNICATIONS § 65, at 44 (1998) (“Faut-il s’étonner que le transport aérien fournisse ainsi un cadre à l’effort nécessaire de reconstruction d’un régime institutionnel et juridique des activités des télécommunications? . . . depuis le début du siècle, les thèses de la souveraineté des Etats et de la liberté de l’air se sont affrontées au cours des diverses réunions d’associations internationales de juristes.”). 40 In discussing his 1996 Declaration of Independence of Cyberspace, John Perry Barlow stated the following: “[the Internet] is inherently extra-national, inherently anti- sovereign and your [states’] sovereignty cannot apply to us. We’ve got to figure things out ourselves.” See TIM JORDAN, CYBERPOWER: THE CULTURE AND POLITICS OF CYBERSPACE AND THE INTERNET 182–183 (2002). 41 See TALLINN MANUAL, supra note 36, at 5–6.

944 N.C. J. INT'L L. [Vol. XLII

disputes in accordance with international law, recognizes academic work as a subsidiary source of the law.42 The Tallinn Manual asserts that “although no State may claim sovereignty over cyberspace per se, States may exercise sovereign prerogatives over any cyber infrastructure located on their territory, as well as activities associated with that cyber infrastructure,” whether public or privately owned.43 The physicality of cyberspace is therefore the first entry point of cyberspace into sovereign territory. This physical layer is fundamental, as cyberspace relies on physical infrastructure (cables, computers, satellites, etc.) to exist. This idea is confirmed by two UN Group of Governmental Experts Reports on Developments in the field of information and communication technology in the context of international security with the following language: “State sovereignty and international norms and principles that flow from sovereignty apply to State conduct of ICT-related activities, and to their jurisdiction over ICT infrastructure within their territory.”44

The need to reaffirm sovereignty in cyberspace may seem paradoxical both in practice and in theory. But I believe it is important for at least two reasons. First, preserving sovereignty is important to prevent internet fragmentation (a.k.a. balkanization of the internet). If state sovereignty is preserved, there will be less temptation for states to withdraw into national intranets or join alternate domain name systems where they feel their interests will be better preserved. Secondly, in the context of global surveillance, as with other globalized threats to fundamental rights, sovereignty may unexpectedly act as an additional rampart against the erosion of privacy. The United Nations Human Rights Committee and other human rights treaty bodies are only quasi- judicial bodies that cannot enforce compliance.45 Furthermore, despite the existence of inter-state complaint mechanisms, no state

42 U.N. Charter Statute of the International Court of Justice art. 38(1)(d), 59 Stat. 1031, U.N.T.S. 993 (“The teachings of the most highly qualified publicists of the various nations, as subsidiary means for the determination of rules of law.”). 43 See TALLINN MANUAL, supra note 36, at 15–18 (Rule 1). 44 See U.N. Doc. A/70/174, supra note 8. 45 See UN Human Rights Treaty Bodies, INT’L JUST. RESOURCE CTR., http://www.ijrcenter.org/un-treaty-bodies/ [https://perma.cc/Y5ZD-L38Q] (detailing each treaty body monitors compliance in their respective issue area rather than specifically having the power to enforce any specific laws or regulations).

2017 FROM THE CUCKOO'S EGG TO GLOBAL SURVEILLANCE 945

has yet resorted to them,46 and the extraterritorial application of human rights treaty bodies remains at issue. From the concept of sovereignty derives a responsibility for states to invoke their territorial integrity and political independence to protect their own nationals against human rights violations committed on their soil by foreign states.47 This can be argued to be somewhat akin to a “reverse” responsibility to protect.48

C. Non-Intervention The principle of non-intervention in the internal and external

affairs of other states is the corollary of state sovereignty.49 It includes the prohibition of use of force, as set forth in Article 2.4 of the Charter of the United Nations and other forms of prohibited interventions.50 Prohibited intervention is intervention in a state’s sovereign affairs, a matter where the said state should decide freely, and is coercive in nature.51 Non-intervention is broader than the principle of territorial integrity, as it includes both a state’s internal and external affairs.52 It is also referred to as “non-

46 See Human Rights Bodies—Complaints Procedures, U.N. HUM. RTS. OFF. HIGH COMMISSIONER, http://www.ohchr.org/EN/HRBodies/TBPetitions/Pages/HRTBPetitions.aspx#interstate [https://perma.cc/G5XU-XK4F]. 47 See Oren Gross, Cyber Responsibility to Protect: Legal Obligations of States Directly Affected by Cyber-Incidents, 48 Cornell Int’l L.J. 481, 492 (2015) (“Justifications for sovereignty no longer rest exclusively on sovereignty’s own presumptive legitimacy, but rather expand to incorporate justifications that derive from the individuals whose rights are to be protected, and from their right to a safe framework in which they can enforce their autonomy and pursue their interests.”). 48 R2P is short for “Responsibility to Protect,” a doctrine that posits the responsibility (and right) of states to intervene in the internal affairs of other states, and potentially use force, for the purpose of putting an end to the worst human rights violations. Background Information on the Responsibility to Protect, OUTREACH PROGRAMME ON RWANDA GENOCIDE & U.N., http://www.un.org/en/preventgenocide/rwanda/about/bgresponsibility.shtml [https://perma.cc/Z5MA-LJZN]. 49 LASSA OPPENHEIM, OPPENHEIM’S INTERNATIONAL LAW: PEACE 428 (9th ed., 1992). 50 U.N. Charter art. 2, ¶ 4. 51 See OPPENHEIM, supra note 49, at 432. 52 See Non-Intervention (Non-interference in Domestic Affairs), ENCLOPEDIA PRINCETONIENSIS, https://pesd.princeton.edu/?q=node/258 [https://perma.cc/Z3PY- 2AGV] [hereinafter Non-Intervention]; see also U.N. Charter.

946 N.C. J. INT'L L. [Vol. XLII

interference.”53 The principle was first formulated by de Vattel in the eighteenth century.54

The treaty law of non-intervention stems from the 1933 Montevideo Convention and its 1936 additional protocol on non- intervention, wherein the United States reservations read, “interference with the freedom, the sovereignty, or other internal affairs, or the processes of the Governments of other nations.”55

In 1926, the premise of the prohibition of intervention in case law appeared in the Lotus case judgment, in which the Permanent Court of International Justice indicated that a “state . . . may not exercise its power in any form in the territory of another state.”56

In the 1949 Corfu Channel case, the International Court of Justice also regarded “the alleged right of intervention as the manifestation of a policy of force, such as has, in the past, given right to the most serious abuses and as such cannot, whatever be the present defects in international organization, find a place in international law.”57

The principle was then reaffirmed in Article 2.7 of the 1945 Charter of the United Nations, which extends it to international organization action by providing that “[n]othing contained in the present Charter shall authorize the United Nations to intervene in matters which are essentially within the domestic jurisdiction of any state or shall require the Members to submit such matters to settlement under the present Charter; but this principle shall not prejudice the application of enforcement measures under Chapter VII.”58 Under Article 41 of the 1961 Vienna Convention on Diplomatic Relations, the parties specified that diplomats should not “interfere in the internal affairs” of the host state.59

Two major United Nations General Assembly (“UNGA”)

53 Non-Intervention, supra note 52. 54 M. DE VATTELL, DROIT DES GENS OU PRINCIPES DE LA LOI NATURELLE ¶ 37 (1758). 55 Montevideo Convention on the Rights and Duties of States, COUNCIL FOREIGN REL., http://www.cfr.org/sovcorfereignty/montevideo-convention-rights-duties- states/p15897 [https://perma.cc/7WM4-6CDA] (referring to the United States’ reservations). 56 S.S. Lotus (Fr. v. Turk.), Judgment, 1927 P.C.I.J. (ser. A) No. 10, at ¶ 39 (Sept. 7). 57 Corfu Channel (U.K. v. Alb.), Judgment, 1949 I.C.J. Rep. 4, ¶ 121 (Apr. 9). 58 U.N. Charter art. 2, ¶ 7. 59 Vienna Convention on Diplomatic Relations art. 41, ¶ 1, Apr. 18, 1961, 23 U.S.T. 3374, 500 U.N.T.S. 95 [hereinafter Vienna Convention].

2017 FROM THE CUCKOO'S EGG TO GLOBAL SURVEILLANCE 947

Resolutions also reaffirmed this principle, one of which being entirely dedicated to it.60 UNGA Resolution 2625 of 1970 states that “armed intervention and all other forms of interference or attempted threats against the personality of the state or against its political, economic and cultural elements, are in violation of international law.”61 UNGA Resolution 2131 reads, “[D]irect intervention, subversion and all forms of indirect intervention . . . constitute a violation of the Charter of the United Nations.”62 These UNGA resolutions affirm, “the practice of any form of intervention not only violates the spirit and letter of the Charter of the United Nations but also leads to the creation of situations which threaten international peace and security.”63 They also go on to say, using remarkably broad language, that no state has “the right to intervene, directly or indirectly, for any reason whatsoever, in the sovereignty of any other state.”64 Though United Nations General Assembly Resolutions are generally not regarded as legally binding,65 these two can be argued to be codifications of international customary law. In the 1986 case concerning the Military and Paramilitary Activities in and Against Nicaragua, the International Court of Justice confirmed the customary nature of the principle by stating that the “principle of non-intervention involves the right of every sovereign State to conduct its affairs without outside interference; though examples of trespass against this principle are not infrequent, the Court considers that it is part and parcel of customary international law . . . . [I]nternational law requires political integrity . . . to be respected.”66

Prohibited intervention is not limited to use of force. In the 2005 case concerning Armed Activities on the Territory of the Congo, the International Court of Justice made it clear that the principle of non-intervention prohibits a state from “interven[ing],

60 See G.A. Res. 2625 (XXV) (Oct. 24, 1970); see also G.A. Res. 2131 (XX) (Dec. 21, 1965). 61 See G.A. Res 2625, supra note 60. 62 See G.A. Res 2131, supra note 60. 63 See G.A. Res. 2625, supra note 60; see also G.A. Res. 2131, supra note 60. 64 See G.A. Res. 2625, supra note 60; see also G.A. Res. 2131, supra note 60. 65 Are UN Resolutions Binding?, DAG HAMMARSKJOLD LIBRARY (Jan. 9, 2017), http://ask.un.org/faq/15010 [https://perma.cc/DFB8-E2VW]. 66 Military and Paramilitary Activities in and Against Nicaragua (Nicar. v. U.S.), Judgment, 1986 I.C.J. Rep. 14, ¶ 202 (June 27).

948 N.C. J. INT'L L. [Vol. XLII

directly or indirectly, with or without armed force, in support of an internal opposition in another State.”67 Below the use of force threshold, intervention seems characterized when there is either intrusion or coercion.

Following, the unauthorized intrusion into the territory of another state, to the exclusion of minor border incidents, are prohibited. This is a corollary of the territorial integrity principle, which itself is derived from the sovereign right of states to freely decide who and what enters their borders. Quincy Wright goes as far as to say that “any penetration of the territory of a state by agents of another state in violation of the local law is also a viola- tion of the rule of international law imposing a duty upon states to respect the territorial integrity and political independence of other states.”68 There is therefore no damage necessary for unauthorized penetration to be constituted.69 Does intrusion have to be physical? If state sovereignty extends to cyber infrastructure located on a state’s territory, then there is a presumption of sovereignty over data located therein. But whether cyber intrusion equals physical intrusion remains to be seen. Presumably, the coercion criterion offers a more reliably applicable concept in cyberspace, as it does not imply or require intrusion to be manifested.

1. The Origin of the Coercion Concept UNGA Resolution 2625, and UNGA Resolution 2131 first

introduced the idea of coercion by putting forth that no state may use “any . . . type of measures to coerce another State in order to obtain from it the subordination of the exercise of its sovereign rights and to secure from it advantages of any kind.”70

In the Nicaragua case, the International Court of Justice enshrined the concept, and referred to it as “[t]he element of coercion, which defines, and indeed forms the very essence of, prohibited intervention.”71 The Court added that “the principle

67 Armed Activities on the Territory of The Congo (Dem. Rep. Congo v. Uganda), Judgment, 2005 I.C.J. Rep. 168, ¶ 164 (Dec. 19). 68 Wright, supra note 25, at 12. 69 David Weissbrodt, Cyber-Conflict, Cyber-Crime, and Cyber-Espionage, 22 MINN. J. INT’L L. 347, 363 (2013). 70 G.A. Res. 2625, supra note 60; see also G.A. Res. 2131, supra note 60. 71 Military and Paramilitary Activities in and Against Nicaragua (Nicar. v. U.S.),

2017 FROM THE CUCKOO'S EGG TO GLOBAL SURVEILLANCE 949

forbids all States or groups of States to intervene directly or indirectly in the internal or external affairs of other States” and that “a prohibited intervention must [accordingly] be one bearing on matters in which each State is permitted, by the principle of State sovereignty, to decide freely. . . .”72 One of these is the choice of a political, economic, social and cultural system and the formulation of foreign policy. “Intervention is wrongful when it uses . . . methods of coercion” in regard to such choices, which must remain free ones.73

2. The Meaning of Coercion Still in the Nicaragua case, the Court adds that “[t]he element

of coercion . . . is particularly obvious in the case of an intervention which uses force.”74 The term “obvious” employed here suggests that not only is prohibited intervention not limited to cases of use of force, but that the element of coercion itself also encompasses situations that fall below the use of force threshold.

The 1969 Vienna Convention on Law of Treaties provides that “a treaty shall be interpreted in good faith in accordance with the ordinary meaning to be given to the terms of the treaty in their context and in the light of its object and purpose.”75 Coercion implies constraint, of at least two kinds. You may be coerced into doing something (“Do this . . . or else”). Here, force or intimidation is used to induce compliance against the victim’s will. This has little application in the context of espionage, as espionage is not used to compel a state to do or abstain from doing something, or act in any particular way. Espionage is neither force nor the threat thereof. Nevertheless, coercion is also constituted when you have to undergo something being done to you against your will. Here, the coercive power uses its position of superiority to do whatever they please despite the victim’s lack of consent. This second definition of coercion is especially relevant to certain cases of cyber espionage and mass surveillance operations, which continue to exist despite strong opposition from target states.

Oppenheim wrote that “the interference must be forcible or

Judgment, 1986 I.C.J. Rep. 14, ¶ 205 (June 27). 72 See id. ¶ 206. 73 Id. ¶ 205. 74 Id. 75 Vienna Convention, supra note 59, art. 31.

950 N.C. J. INT'L L. [Vol. XLII

dictatorial, or otherwise coercive, in effect depriving the state intervened against of control over the matter in question,”76 which scholars, such as Ziolkowski, have interpreted to mean intervention necessarily implies forcing a state to change its policy, thus preferring the first definition of coercion exposed above.77 According to this view, no form of espionage would indeed be coercive. Though it does affect state behavior, as they acquire encryption capabilities and lay new submarine cables to bypass certain access points,78 this is not the behavior the spying state intends to elicit. Arguably, spying is not meant to elicit any particular behavior, much less any behavior that would make further spying more challenging. However, the words of Oppenheim could also be interpreted to validate the second definition of coercion. What control over foreign or domestic policy does one state retain in the face of mass-scale data collection? Edwin de Witt Dickinson writes, “coercion is present if intervention cannot be terminated at the pleasure of the state that is subject to the intervention,” therefore, including any acts performed against a state’s will.79 This is a strong validation of the second definition of coercion, which I would argue applies in full force in the context of cyber espionage.

McDougall and Feliciano go even further by asserting that coercion is “doing something against the value of sovereignty,” in other words, against the spirit of sovereign independence.80 Privacy policy is an area in which states must be able to decide

76 See OPPENHEIM, supra note 49, at 432. 77 Katharina Ziolkowski, Peacetime Cyber Espionage – New Tendencies in Public International Law, in PEACETIME REGIME FOR STATE ACTIVITIES IN CYBERSPACE: INTERNATIONAL LAW, INTERNATIONAL RELATIONS AND DIPLOMACY 425, 433 (Katharina Ziolkowski ed., 2013) [hereinafter PEACETIME REGIME FOR STATE ACTIVITIES IN CYBERSPACE] (“Scholars assert that illegal coercion implies massive influence, inducing the affected state to adopt a decision with regard to its policy or practice which it would not entertain as a free and sovereign state.”). 78 Nancy Scola, Brazil Beings Laying Its Own Internet Cables to Avoid U.S. Surveillance, WASH. POST (Nov. 3, 2014), https://www.washingtonpost.com/news/the- switch/wp/2014/11/03/brazil-begins-laying-its-own-internet-cables-to-avoid-u-s- surveillance/?utm_term=.4ec79e4e3fea [https://perma.cc/93TE-HMG2]. 79 EDWIN DE WITT DICKINSON, THE EQUALITY OF STATES IN INTERNATIONAL LAW 260 (1920). 80 Myres S. McDougal & Florentino P. Feliciano, International Coercion and World Public Order: The General Principles of the Law of War, 67 YALE L.J. 771, 782 (1958).

2017 FROM THE CUCKOO'S EGG TO GLOBAL SURVEILLANCE 951

freely, including what level of human rights protection is appropriate depending on cultural norms and political context.

The UN Group of Governmental Expert consensus report of June 2015 on principles of responsible state behavior in cyberspace reasserted that international law applied to the use of information and communications technologies, including sovereignty and non-intervention:

In their use of ICTs, States must observe, among other principles of international law, State sovereignty, the settlement of disputes by peaceful means, and non-intervention in the internal affairs of other States.81

IV. Espionage Generally

A. Wartime While not providing a definition of espionage, the law of

armed conflict does, however, define the agent of espionage. A spy is an individual acting clandestinely or under false pretense to obtain information “in the zone of operations of a belligerent, with intention of communicating it to a hostile third party.”82 The terms “spy” and “espionage,” are used in the Hague Regulations, Geneva Convention IV and Additional Protocol I.83

Legal scholars have further defined a wartime spy as someone who “penetrates secretly, or in disguise, or under false pretenses within the lines of an enemy”84 to “[obtain] military information”85 or “discover the state of his [sic] affairs, to pry into its designs”86 for the benefit of the opposing army.87 The nature of the

81 See U.N. DOC. A/70/174, supra note 8, ¶ 28(b). 82 Hague Convention Respecting the Laws and Customs of War on Land (Hague IV) art. 29, Oct. 18, 1907, 36 Stat. 2277, 1 Bevans 631. 83 Practice Relating to Rule 107 Spies, INT’L COMMITTEE RED CROSS, https://ihl- databases.icrc.org/customary-ihl/eng/docs/v2_rul_rule107_sectionb [https://perma.cc/GA6M-2X37] [hereinafter Spies] (outlining how Article 30 of the 1899 Hague Regulations, Article 30 of the 1907 Hague Regulations, Article 5 of the 1949 Geneva Convention IV, Article 46(1), and Article 45(3) of the 1977 Additional Protocol I address spies). 84 See WILLIAM EDWARD HALL, A TREATISE ON INTERNATIONAL LAW 537 (1895); see also OPPENHEIM, supra note 49. 85 See HALL, supra note 84, at 537. 86 H.W. HALLECK, INTERNATIONAL LAW, OR, RULES REGULATING THE INTERCOURSE OF STATES IN PEACE AND WAR 406 (1861). 87 See HALL, supra note 84 at 537; see also HALLECK, supra note 86.

952 N.C. J. INT'L L. [Vol. XLII

information collected seems to have been the object of some debate, with the Tallinn Manual regarding the military nature of the information unnecessary for the characterization of espionage while the Harvard Air and Missile Warfare Manual considers that that information must be of some military character.88 Arguably, this debate does not apply in peacetime, where the collection of information not related to military activity equally qualifies as espionage.

The purpose of identifying espionage operations under the law of armed conflict is also much more specific. Wartime espionage is a clandestine, yet lawful practice.89 From a law of armed conflict standpoint, espionage is akin to a ruse de guerre, and does not constitute a wrongful act, and therefore does not give rise to state responsibility.90 And if conducted during conflict by any entity that is not a party to the conflict, it is left unregulated.91

Spying does, however, have consequences for the spy or agent sent by either party to a conflict. A spy indeed does not benefit from combatant immunity or prisoner of war status upon capture.92 This is interestingly severe, as it seeks the individual agent’s responsibility, not that of the sending state. By targeting spies alone, state parties to The Hague and Geneva conventions may have wanted to ensure espionage would remain part of the wartime arsenal while still discouraging its recourse as much as possible. The Tallinn Manual experts go as far as to say that (cyber) espionage operations would make a civilian a direct participant in hostilities, therefore making such civilian targetable by enemy forces whose information was collected for the benefit of the opposing side.93 However, a person in uniform who conducts reconnaissance missions is not considered a spy and therefore

88 TALLINN MANUAL, supra note 36, at 194 (Rule 66(b)(8)); see also Manual on International Law Applicable to Air and Missile Warfare, HARV. PROGRAM ON HUMANITARIAN POL’Y & CONFLICT RES. r. 118, http://ihlresearch.org/amw/HPCR%20Manual.pdf [https://perma.cc/MEU6-GNU5]. 89 See HALLECK, supra note 86, at 406–07. 90 United States of America Practice Relating to Rule 57 Ruses of War, INT’L COMMITTEE RED CROSS (Feb. 28, 2017), https://ihl-databases.icrc.org/customary- ihl/eng/docs/v2_cou_us_rule57 [https://perma.cc/3RJQ-C5GS]. 91 TALLINN MANUAL, supra note 36, at 194 (Rule 66(b)(7)). 92 See Spies, supra note 83 (referencing the Oxford Manual, which prohibits individuals captured as spies from demanding prisoner-of-war treatment). 93 TALLINN MANUAL, supra note 36, at 194 (Rule 66(b)(4)).

2017 FROM THE CUCKOO'S EGG TO GLOBAL SURVEILLANCE 953

retains combatant status.94 Interestingly, the 1949 Geneva Convention IV provides for humane treatment and fair trial of spies to limit the effects of the loss of prisoner of war status.95 A spy who successfully rejoins the armed forces to which the spy belongs regains combatant immunity.96 In other words, past spying activities do not make the individual lose combatant status forever. This convoluted legal framework that sanctions spies in some circumstances but not the sending state is a revealing prelude to the ambivalent law of espionage in peacetime. Furthermore, the legality of espionage in times of war derives from the lack of obligation to respect the territory or government of an opponent state party to a conflict. But that cannot hold true in peacetime, where there is an obligation to respect territorial integrity and political independence.97

B. Peacetime

1. Definition As there are no general treaty provisions regarding espionage

in peacetime, a definition of espionage can only be extrapolated from the law of armed conflict with some necessary adjustments.

Oppenheim proposed a broader definition of a spy, which begins to cover both wartime and peacetime operations. According to him, spies are “secret agents of a State sent abroad for the purpose of obtaining clandestinely information in regard to military or political secrets.”98 From this definition of spy derives the confirmation that espionage is data collection characterized by its clandestine nature and the fact that it is state-sponsored. But it is arguably no longer limited to gathering military or political secrets. Espionage is a much broader phenomenon that targets much more than just foreign governments. Espionage can be economic and industrial, or take the form of extraterritorial surveillance. The term “surveillance” is used in reference to domestic surveillance, but its new extraterritorial component

94 See HALL, supra note 84; see also HALLECK, supra note 86. 95 Geneva Convention Relative to the Treatment of Prisoners of War art. 5, Aug. 12, 1949, 6 U.S.T. 3316, 75 U.N.T.S. 137. 96 Hague II, supra note 31, art. 31. 97 U.N. Charter art. 4, ¶ 1. 98 HALL, supra note 84, at 770, 772.

954 N.C. J. INT'L L. [Vol. XLII

makes it a subcategory of espionage.99 Indeed, very much like traditional espionage, extraterritorial surveillance also includes state-sponsored operations intended to be covert, aimed at targets located abroad, and concerned with gathering knowledge—facts or propositions to which a degree of probability can be assigned— that inform national security decision makers.100

I will therefore define peacetime espionage as a clandestine state-sponsored intelligence-gathering operation, or series of operations, conducted through physical penetration into foreign territory (“HUMINT”) or remote data collection techniques (CYBINT, SIGINT (including COMINT and ELINT), IMINT, and others).

2. Unsettled Law The international law of espionage is at best unsettled,101 if not

ambiguous.102 “There is no international jurisprudence on peacetime espionage . . . .”103 It is also worth noting that, while national laws universally condemn espionage,104 it is dubious that an act that violates domestic law necessarily entails state responsibility under international law.105 Therefore, one must look to international customary law to attempt to settle this issue. As

99 Dinah PoKempner, Cyberspace and State Obligations in the Area of Human Rights, in PEACETIME REGIME FOR STATE ACTIVITIES CYBERSPACE, supra note 77, at 239, 253 (“Surveillance or monitoring of communications by the authorities or agents of another State is typically espionage.”). 100 Myres S. McDougal et al., The Intelligence Function and World Public Order, 46 TEMPLE L.Q. 365, 367 (1973). 101 James Kraska, Putting Your Head in the Tiger’s Mouth: Submarine Espionage in the Territorial Sea, 54 COLUM. J. TRANSNAT’L L. 164, 172 (2015). 102 See PoKempner, Cyberspace and State Obligations in the Area of Human Rights, in PEACETIME REGIME FOR STATE ACTIVITIES CYBERSPACE, supra note 77, at 253 (“While espionage is usually a criminal offence in municipal law, there is generally a legal disconnect regarding peacetime espionage in international law, making an international rule of prohibition or permission difficult to articulate.”). 103 Craig Forcese, Spies Without Borders: International Law and Intelligence Collection, 5 J. NAT’L SEC. L. & POL’Y 195, 202 (2011); see also John See Yoo & Glenn Sulmasy, Counterintuitive: Intelligence Operations and International Law, 28 MICH. J. INT’L L. 625, 628 (2007) (“Nowhere in international law is peaceful espionage prohibited.”). 104 Ziolkowski, Peacetime Cyber Espionage – New Tendencies in Public International Law, in PEACETIME REGIME FOR STATE ACTIVITIES IN CYBERSPACE, supra note 77. 105 See Forcese, supra note103, at 201–02.

2017 FROM THE CUCKOO'S EGG TO GLOBAL SURVEILLANCE 955

previously stated, a legally binding custom is born out of state practice and opinio juris.106

In relation to confidential state practices, the Second Report of the International Law Commission’s Special Rapporteur on the Formation and Evidence of Customary International Law explains, “[i]t is difficult to see how practice can contribute to the formation or identification of general customary international law unless and until it has been disclosed publicly.”107 Just because espionage is clandestine by nature, however, does not mean that we don’t know of it as an extensive practice. As a matter of fact, espionage is at least as old as international relations.108 It has long existed before the development of international law in its current form.109

In the 1969 North Sea Continental Shelf Cases,110 the International Court of Justice stated that in order to find that a customary rule has emerged there must be “extensive and virtually uniform” state practice in favor of that rule.111 Several scholars argue that such constant and widespread state practice is evidence enough of the lawfulness of espionage.112 But state practice alone is not necessarily sufficient to show a mandatory rule of international customary law.113 Custom also requires the condition of opinio juris to be fulfilled.114 In the North Sea Continental Shelf Cases, the International Court of Justice (“ICJ”) judgment is unequivocal:

[n]ot only must the acts concerned amount to a settled practice, but they must also be such, or be carried out in such a way, as to be evidence of a belief that this practice is rendered obligatory

106 See id. 107 Michael Wood (Special Rapporteur on the Formation and Evidence of Customary International Law), Second Report on Identification of Customary International Law, ¶ 47, U.N. Doc. A/CN.4/672 (May 22, 2014). 108 See Ziolkowski, Peacetime Cyber Espionage – New Tendencies in Public International Law, in PEACETIME REGIME FOR STATE ACTIVITIES IN CYBERSPACE, supra note 77 at 425 (“Espionage has existed since the dawn of human history.”). 109 See id.; see also Yoo & Sulmasy, supra note 103, at 626–28. 110 North Sea Continental Shelf (Ger. v. Den.; Ger. v. Neth.), Judgment, 1969 I.C.J. Rep. 3 (Feb. 20). 111 Id. at 43, ¶ 74. 112 Ashley Deeks, An International Legal Framework for Surveillance, 55 VA. J. INT’L L. 291, 302 (2015). 113 See North Sea Continental Shelf, at 44, ¶ 77. 114 See id.

956 N.C. J. INT'L L. [Vol. XLII

by the existence of a rule of law requiring it. The need for such a belief, i.e., the existence of a subjective element, is implicit in the very notion of the opinio juris sive necessitatis. The States concerned must therefore feel that they are conforming to what amounts to a legal obligation. The frequency, or even habitual character of the acts is not in itself enough.115 There is little chance that opinio juris is constituted in the

conduct of espionage.116 States are not spying on each other thinking they are doing so in all legality.117 They are aware of the questionable character of espionage.118 The very concealed nature of such operations points to the fact that states do not “believe” they are allowed to perform them.119 Here, the importance of opinio juris takes on its full meaning. What’s more, sending states have not historically objected to their spies being convicted, deported, or declared persona non-grata by the spied upon state.120 Therefore, it appears that spying states do not consider their own acts of espionage legal. Now, “not explicitly legal” does not necessarily entail “illegal.” It may just be that the practice in question is unregulated, that there is a gap in the law.121 When Oppenheim says a government “cannot officially confess to having commissioned a spy,”122 it may be that it fears future sanction, or that it simply considers it unfriendly and therefore awkward to reveal.123

In a related attempt to assert the legality of espionage, some may also see the so-called Lotus principle as another possible justification of constant state practice translating as lawful practice. The Lotus case has introduced the idea that international obligations cannot be presumed.124 Thereby affirming that state

115 See id. 116 See id. 117 See Radsan, supra note 12, at 596. 118 See id. 119 See id. 120 See Wright, supra note 25, at 3. 121 Deeks, supra note 112, at 300. 122 OPPENHEIM, supra note 49, at 770–72. 123 See Julius Stone, Legal Problems of Espionage in Conditions of Modern Conflict, in ESSAYS ON ESPIONAGE AND INTERNATIONAL LAW 39 (Ohio State Univ. Press ed., 1962). 124 S.S. Lotus (Fr. v. Turk.), Judgement, 1927 P.C.I.J. (ser. A) No. 10, at 18 (Sept. 7).

2017 FROM THE CUCKOO'S EGG TO GLOBAL SURVEILLANCE 957

sovereignty would imply presumptive legality of state action, therefore including the widespread recourse to espionage. But this oft-cited Lotus principle has been highly contested.125 Such principle only holds if counter-balanced by the principles of sovereignty and political independence. State action that harms sovereign rights of other states cannot be presumed to be legal. It follows that widespread state practice alone is not sufficient to entail the legality of the practice of espionage, either on the ground of an established custom or that of presumptive legality.

The behavior of spied upon states is also commonly misinterpreted to imply lawfulness. The general reluctance of spied upon states to seek reparation in court or through diplomatic channels, in the form of satisfaction or otherwise, does not mean that such abstention implies the consent of the said states to be subjected to espionage or that they felt there was no obligation owed to them. As the Court says concerning the non-objection of states to the principle of equidistance for lateral territorial delimitations at sea, “[t]here is no evidence that they so acted because they felt legally compelled . . . they might have been motivated by other obvious factors.”126 In the case of espionage, those other factors might be the willingness of spied-upon states to maintain the status quo and be allowed to spy as well. As much as consent of the victim state might preclude responsibility of the spying state, it certainly does not imply an absence of obligation. Mere tolerance does not imply legality. As a matter of fact, states have not always remained silent, even before the advent of cyber espionage. In a public declaration to the United Nations, the representative of the U.S.S.R. said: “The object to which illegal surveillance is directed constitutes a secret guarded by a sovereign state, and regardless of the means by which such an operation is carried out, it is in all cases an intrusion into something guarded by a sovereign state in conformity with its sovereign prerogative.”127 Likewise, the state parties to the United Nations

125 Hugh Handeyside, The Lotus Principle in ICJ Jurisprudence: Was the Ship Ever Afloat?, 29 MICH. J. INT’L L. 71, 72 (2007). 126 See North Sea Continental Shelf (Ger. v. Den.; Ger. v. Neth.), Judgment, 1969 I.C.J. Rep. 3 (Feb. 20). 127 Joseph Soraghan, Reconnaissance Satellites: Legal Characterization and Possible Utilization for Peacekeeping, 13 MCGILL L.J. 458, 470–71 (1967) (emphasis added).

958 N.C. J. INT'L L. [Vol. XLII

Convention on the Law of the Sea have expressed the view that “any act aimed at collecting information to the prejudice of the defence [sic] or security of the coastal state . . .” was in violation of the right of innocent passage through the territorial sea of the coastal state. This may be the only general provision of treaty law prohibiting information-collection on the territory of other states— the territorial sea being an integral part of a state’s territory— which, though only applicable to state parties, is a strong indication that at least a substantial number of states may indeed regard espionage as illegal per se under certain circumstances. That being said, the lack of case law prevents the issue from being more clearly settled.

Certain scholars go as far as to say that the only possible ground of espionage illegality is collateral illegality:128 Julius Stone takes the example of the U-2 incident that he claims was illegal on grounds of territorial intrusion alone.129 However, minor territorial intrusions are common, and not always sanctioned, but the illegality of this particular instance was not questioned.130 Therefore, was espionage an aggravating factor, at least? To Stone, once the territorial intrusion element is removed, espionage alone is to be considered legal because spying activities conducted from outer space and international waters is allowed.131 Since there is no possible territorial intrusion in such international spaces, he interprets the legality of espionage in those spaces as proof that espionage alone does not infringe on international law.132 But here, he fails to appreciate the specificities of international spaces, among which the absence of sovereign claims, among other difficulties exposed later (lack of distinction between espionage “in” and “from” international spaces, narrowly- tailored national technical measures of verification, and technology allowing for far more precise remote data-collection than ever before).133 In fact, the existence of collateral illegality in traditional espionage is a convenient way to avoid having to legally characterize acts of espionage themselves. The obvious

128 See Stone, supra note 123, at 32. 129 Id. 130 See id. 131 Id. at 34. 132 Id. 133 See id.

2017 FROM THE CUCKOO'S EGG TO GLOBAL SURVEILLANCE 959

unlawfulness of the coincidental intrusion was enough to postpone the need to address espionage in itself.

Hence the conclusion that espionage has mostly been left unregulated, and has remained in this grey area of being neither legal nor illegal,134 spying states and target states seemingly preferring the status quo of uncertainty up until now.135

3. Exceptions to the Case Law Gap There are, however, two notable exceptions in which cases of

espionage were directly or indirectly brought to the ICJ.136 In those cases, the ICJ either did not have a chance to render a final judgment or did not take any clear or general position.137 However, nothing in its official documents seems to oppose future condemnation of certain cases of espionage.138

In a 1980 case concerning U.S. diplomatic and consular staff in Tehran, the court referred to “espionage” and “interference in internal affairs” as “abuses” of the functions of embassy staff members.139 It even makes a clear distinction between the two with the conjunction “or.”140 This should not be interpreted to mean that espionage may never constitute interference or intervention. Rather, it places both concepts on an equal footing, making espionage as reprehensible as intervention. It suggests that espionage does not have to be part of a broader act of intervention for it to be reprehensible. It is an abuse in its own right, at least when committed by diplomatic personnel.141

The focus on the diplomatic personnel in the discussion of abuse is reminiscent of the law of armed conflicts that also focuses on the spy’s responsibility more than the state’s.142 However, diplomatic personnel does not risk as much as a spy captured in wartime. Unlike the latter, who loses combatant immunity, the

134 Forcese, supra note 103, at 204. 135 Id. 136 See id. at 201. 137 See id. 138 See id. at 204. 139 United States Diplomatic and Consular Staff in Tehran (U.S. v. Tehran), Judgment, 1980 I.C.J. 38, ¶ 85 (May 24). 140 Id. 141 See id. ¶¶ 28, 85. 142 Id. ¶ 86.

960 N.C. J. INT'L L. [Vol. XLII

diplomatic immunity of embassy staff is preserved.143 The worst thing that may happen to them is being deported to their sending state, and being declared persona non-grata.144 What’s more, the Court seems to have left the door open to some sort of state responsibility as well.145 Drawing from the Vienna Conventions of 1961 and 1963, the Court states:

Beyond that remedy for dealing with abuses of the diplomatic function by individual members of a mission, a receiving State has in its hands a more radical remedy if abuses of their functions by members of a mission reach serious proportions. This is the power . . . to break off diplomatic relations with a sending State and to call for the immediate closure of the offending mission.146

Espionage is therefore considered an “abuse” of diplomatic functions whose “proportions” may warrant breaking off diplomatic relations.147 Though not explicit, and limited to the specific case of diplomatic missions, this form of retorsion is arguably a step towards the recognition of state responsibility for acts of espionage by the Court.

In 2013, a more typical case of traditional espionage was brought to the ICJ when Timor-Leste initiated a court action against Australia.148 The dispute concerned Australia’s seizure of certain documents and data, which belonged to Timor-Leste, as well as correspondence between Timor-Leste and its legal advisers related to a pending Treaty Arbitration between Australia and

143 See Amien Kacou, Foreign Government Officials in the U.S. Enjoy Some Protection from Prosecution, but not in all Matters, NOLO, http://www.nolo.com/legal- encyclopedia/what-is-diplomatic-immunity.html [https://perma.cc/8BRV-YUVS]. 144 See Vienna Convention on Diplomatic Relations art. 9, ¶ 1, Apr. 18, 1961, 23 U.S.T. 3374, 500 U.N.T.S. 95 (“The receiving State may at any time and without having to explain its decision, notify the sending State that the head of the mission or any member of the diplomatic staff of the mission is person non grata or that any member of the staff of the mission is not acceptable.”); see also United States Diplomatic and Consular Staff in Tehran (U.S. v. Tehran), Judgment, 1980 I.C.J. 39, ¶ 85 (May 24) (discussing a purpose of the afore-cited provision to be to provide a remedy for possible abuses of diplomatic functions). 145 See U.S. v. Tehran, at 40, ¶ 85. 146 Id. 147 Id. 148 Questions Relating to the Seizure and Detention of Certain Documents and Data (Timor-Leste v. Austl.), Provisional Measures, 2014 I.C.J. 147, ¶ 1 (Mar. 3).

2017 FROM THE CUCKOO'S EGG TO GLOBAL SURVEILLANCE 961

Timor-Leste.149 This case did not involve an extraterritorial component; the said property was seized from the business premises of a legal adviser of Timor-Leste located in Australia.150 The International Court of Justice nonetheless declared Timor- Leste’s claimed “right to conduct arbitration proceedings or negotiations without interference by Australia, including the right of confidentiality of and non-interference in its communications with its legal advisers . . .” to be plausible in its provisional order on the merits of the case.151 Thus, the nature of the seized property and its relation to the state’s sovereign right to conduct foreign policy freely was potentially sufficient for Australia’s seizure of secret or confidential information without Timor-Leste’s permission, a classic act of espionage, to be considered illegal. The case was unfortunately dropped by Timor-Leste,152 leaving a missed opportunity for the ICJ to more directly consider the legality of espionage in the international realm. In its order discontinuing the proceedings, the court quoted a letter, dated June 2, 2015, sent by an agent of Timor-Leste, which stated: “[f]ollowing the return of the seized documents and data by Australia on 12 May 2015, Timor-Leste has successfully achieved the purpose of its application to the court, namely the return of Timor-Leste’s rightful property, and therefore implicit recognition by Australia that its actions were in violation of Timor-Leste’s sovereign rights.”153 This is an interesting indication of the current paradigm shift under international law, whereby some states are, at the very least, finally protesting the legal status quo.

C. International Domains and Organizations The law of espionage in international domains, or as governed

by international organizations such as the International Telecommunication Union, is no more explicitly articulated than it is as a general matter.

149 Id. 150 Id. 151 Id. ¶ 22. 152 See Questions Relating to the Seizure and Detention of Certain Documents and Data (Timor-Leste v. Austl.), Order, 2015 I.C.J. 3 (June 11). 153 Id.

962 N.C. J. INT'L L. [Vol. XLII

1. Domains International domains governed by treaty regimes include the

high seas, outer space, and Antarctica.154 The treaties establish a principle of common and peaceful usage, as well as the prohibition (or freeze in the case of Antarctica) of territorial claims over international spaces or any portion thereof.155 Espionage operations conducted within those international spaces is therefore generally admitted, as it does not risk infringing upon any state’s sovereignty.156 The treaties even provide for strategic observation for the purpose of ensuring that no treaty provisions or any general provisions of international law are violated by any state party.157 The difficulty of legal appreciation stems from the rarely made distinction between espionage conducted within an international domain, and espionage conducted from an international domain and directed at sovereign territory.158 Several scholars either fail to make the distinction,159 or go as far as to say that such a distinction would be “unrealistic and artificial . . . and . . . would raise many new problems of definition.”160 Surely enough, spying activities from Antarctica may not be very common or useful, as the continent is far away from population centers and seats of government. But it is undeniable that there is an essential difference between, for example, station observation on remote celestial bodies161 on the one hand, and Earth-oriented observation on the other, in terms of sovereignty implications. Outer space is all around us, and the reach of Earth observation technology

154 Katharina Ziolkowski, General Principles of International Law as Applicable in Cyberspace, in PEACETIME REGIME FOR STATE ACTIVITIES CYBERSPACE, supra note 77, at 135, 167. 155 See id. 156 See Kraska, supra note 101, at 173 (“Certainly, there is no prohibition of intelligence and espionage activities conducted beyond state territory.”). 157 JOHN KISH, INTERNATIONAL LAW AND ESPIONAGE 102 (David Turns ed., 1995). 158 Id. 159 Id. 160 Hamilton DeSaussure, Remote Sensing by Satellite: What Future for an International Regime?, 71 AM. J. INT’L L. 707, 710 (1977). 161 G.A. Res. 34/68, art. 15 (Dec. 5, 1979) (“Each State Party may assure itself that the activities of the other States Parties in the exploration and use of the moon are compatible with the provisions of this Agreement. To this end, all space vehicles, equipment, facilities, stations and installations on the moon shall be open to other State Parties.”).

2017 FROM THE CUCKOO'S EGG TO GLOBAL SURVEILLANCE 963

allows for mass coverage of sovereign territory. The same goes, to a lesser extent, with the high seas.162 Surely, the sovereignty implications of such spying activities are not artificial, as substantial surface of sovereign territory can be covered by technology located in outer space and the high seas, especially as remote-sensing and other technologies allow for far greater precision than it did during the Cold War.163 There is no escaping the far-reaching remote-sensing capabilities of space-faring nations.164 As early as 1960, the U.S. spy satellite Corona and Keyhole were later said to have shone an “enormous floodlight” in a “darkened warehouse.”165 The cases of Earth and land oriented spying activities, conducted from outer space and the high seas respectively, offer a much earlier illustration of extraterritorial surveillance, one that did not necessitate the physical presence of a spy on a foreign territory to clandestinely collect information, long before the internet existed.166

The main framework used for the justification of extraterritorial surveillance conducted from international spaces is inherently linked to the concept of national technical means of verification, which are monitoring techniques employed to verify compliance with international law.167 Certain treaties specifically provide for such measures, but they are commonly used to monitor clandestine activities going against the non-proliferation of dangerous substances, including the development of nuclear, biological or chemical weapons.168 Remote intelligence operations in international spaces has therefore been considered “key to the

162 See Kraska, supra note 101, at 178 (documented cases of spying activities from international waters: Soviet operations in the Caribbean sea and Gulf of Mexico, U.S. operations off the coast of Vietnam, China, Korea, and Israel). 163 See William J. Broad, Spy Satellites’ Early Role As ‘Floodlight’ Coming Clear, N.Y. TIMES (Mar. 8, 2017, 9:15 PM), http://www.nytimes.com/1995/09/12/science/spy- satellites-early-role-as-floodlight-coming-clear.html [https://perma.cc/QHG3-TTKZ]. 164 Id. 165 Id. 166 Id. 167 Treaty on the Limitation of Anti-Ballistic Missile Systems, U.S.–U.S.S.R., May 26, 1972, 23 U.S.T. 3435; see Interim Agreement Between the U.S. and the U.S.S.R. on Certain Measures with Respect to the Limitation of Offensive Arms, U.S.–U.S.S.R., May 26, 1972, 23 U.S.T. 3462; Treaty on the Elimination of Intermediate-Range Missiles and Shorter-Range Missiles art. V, U.S.-U.S.S.R., Dec. 8, 1987, S. Treaty Doc. No. 11 (1988). 168 See Treaty on the Limitation of Anti-Ballistic Missile Systems, supra note 167.

964 N.C. J. INT'L L. [Vol. XLII

contemporary global security system.”169 But this is the sole purpose for which extraterritorial surveillance from an international space is explicitly allowed.170 What’s more, national technical means of verification have to be used “in a manner consistent with generally recognized principles of international law,” one of which being state sovereignty.171

One high seas example, of a Soviet trawler found sailing one mile from Chesapeake Bay lighthouse, about twelve miles from Cape Henry, Virginia, illustrates a fairly open view of spying activities from international spaces.172 U.S. naval forces did not protest, as the ship remained in international waters at all times.173 Rear Admiral Charles C. Kirkpatrick, Navy Chief Information Officer, said the ship was equipped with eleven antennae, and was obviously a “snooper,” but that it would not be interdicted in international waters.”174 But this isolated case of tolerated land- oriented espionage from the high seas is far from being the norm.175

In space, the question is just as unsettled. “Did a state have a possessory interest in information about its own terrain, population, or military activities?” asks Kanuck.176 The question has been left unanswered. As Christol puts it, “science and technology had eliminated the policy option of national privacy (emphasis added) built on the contention of national sovereignty.”177 This outlook was replaced by that of “open skies,” which, paradoxically was also supported by the view that a state could engage in information-gathering through remote sensing by virtue of its national sovereignty.”178 Paradoxical indeed. The “open skies” approach meant that a sensed state could

169 Kraska, supra note 101, at 174. 170 See id. 171 Treaty on the Limitation of Anti-Ballistic Missile Systems, supra note 167, art. V. 172 Jack Raymond, Soviet Trawler Called Spy Ship: Navy Says Craft that Sailed Through Missile Test Area off L. I. was a ‘Snooper’, N.Y. TIMES, July 14, 1960, at 8. 173 Id. 174 Id. 175 See Kraska, supra note 101, at 178. 176 Kanuck, supra note 29, at 279. 177 Carl Q. Christol, Remote Sensing and International Space Law, 16 J. SPACE L. 21, 24 (1988). 178 Id.

2017 FROM THE CUCKOO'S EGG TO GLOBAL SURVEILLANCE 965

not claim a right to prior consent.179 The 1986 U.N. General Assembly resolution, Principles

Relating to Remote Sensing of the Earth from Space, which does support the right of states to engage in remote sensing data- gathering as a matter of principle, also accords the “sensed state” the right to access this data.180 This provision tends to acknowledge the sovereignty of the sensed state over such data.181 The resolution further provides that “States operating remote sensing satellites shall bear international responsibility for their activities and assure that such activities are conducted in accordance with these principles and the norms of international law, irrespective of whether such activities are carried out by governmental or non-governmental entities or through international organizations to which such States are parties.”182

The travaux indicate that this could be interpreted to mean that the dissemination of information thus gathered that adversely affects other states would give rise to state responsibility. During the negotiation process of the resolution, a Brazilian proposal of February 8, 1982 specified: “A State conducting remote sensing activities on Earth shall be held internationally responsible for the dissemination of any primary data or analyzed information that adversely affects the interests of a sensed State.”183 One other proposal, made by Nigeria, aimed to restrict the sharing of data with the sensed state.184 Disclosure to states other than the sensed states would’ve been considered giving rise to state responsibility, regardless of the actual harm or damage caused as a result of the dissemination of such data.185 Kanuck interestingly notes: “For instance, the remote sensing debate could be easily resolved under such a construction. The intelligence collection causes no damage, but any interventionist use of such information would produce a violation.”186

179 Id. at 26. 180 G.A. Res. 41/65, at ¶ XII (Dec. 3, 1986). 181 See id. 182 Id. at ¶ XIV. 183 Jefferson Hane Weaver, Lessons in Multilateral Negotiations: Creating a Remote Sensing Regime, 7 TEMP. INT’L & COMP. L.J. 29, 58 (1993). 184 See id. at 56–57. 185 See id. 186 Kanuck, supra note 29, at 290.

966 N.C. J. INT'L L. [Vol. XLII

2. Organizations The oldest international organization is the one that governs

international telecommunications.187 The International Telegraph Union was established in 1865 to regulate tariffs, codes, and routing.188 As wireless technology emerged, it introduced radio regulations to ensure the equal distribution of radio frequencies on the spectrum.189 It became the International Telecommunication Union (“ITU”) in 1932.190 It now also assigns orbits for telecommunication satellites, and promotes the development of telecommunication infrastructure in the developing world.191 It has a constitution and produces regulations to be implemented by all 193 United Nations Member States.192 Some of its regulations have been interpreted to govern international surveillance. The stoppage of telecommunications clause reads: “Member States also reserve the right to cut off, in accordance with their national law, any other private telecommunications which may appear dangerous to the security of the State or contrary to its laws, to public order or to decency.”193 “Which may appear” has been argued to render signals intelligence lawful, since it would imply preemptive interception and analysis of the said telecommunication.194 But this provision does not seem to apply to communication not transiting through the state’s territory. In other words, it certainly does not provide for a general right to probe the international telecommunications network. The ITU Constitution also provides for the secrecy of communications,195 but solely “in terms of divulgence to the general public, not

187 See Overview of ITU’s History, ITU (Mar. 8, 2017, 10:40 PM), http://www.itu.int/en/history/Pages/ITUsHistory.aspx [https://perma.cc/FM8F-UBDP]. 188 Id. 189 Id. 190 History, ITU (Mar. 8, 2017, 10:44 PM), http://www.itu.int/en/about/Pages/history.aspx [https://perma.cc/M5CG-QNG8]. 191 About ITU, ITU (Mar. 8, 2017, 10:45 PM), http://www.itu.int/en/about/Pages/default.aspx [https://perma.cc/M3AU-6LXQ]. 192 See id.; see also Constitution of the International Telecommunication Union, Jan. 1, 2012, 1825 U.N.T.S. 31251 [hereinafter ITU Const.]. 193 ITU Const., supra note 192, art. 34 (emphasis added). 194 A.M. Rutkowski, International Signals Intelligence Law: Provisions and History, 4 LAWFARE RES. PAPER SERIES 1, 4 (2016). 195 ITU Const., supra note 192, art. 37.

2017 FROM THE CUCKOO'S EGG TO GLOBAL SURVEILLANCE 967

governments.”196 Article 37.1 reads: “Member States agree to take all possible measures, compatible with the system of telecommunication used, with a view to ensuring the secrecy of international correspondence.”197 Article 37.2 reads: “Nevertheless, they reserve the right to communicate such correspondence to the competent authorities in order to ensure the application of their national laws or the execution of international conventions to which they are parties.”198

IV. Cyber Espionage

A. What Cyber Espionage is and how it Differs from Traditional Espionage

The Cuckoo’s Egg incident and global surveillance are two opposite manifestations of cyber espionage.199 One is more discrete, while the other occurs on a much larger scale.200 I chose the expression “global surveillance” because it is a convenient way to convey both the mass-scale and extraterritorial components of foreign surveillance. Foreign includes both extraterritorial and transnational surveillance (e.g. when target located outside of spying state territory interacts with someone located on the said state’s territory).201 There are several categories of remote (meta-) data collection methods that arguably qualify as cyber espionage when the target (whether discriminate or indiscriminate) is located in one state and the operation is pursued by or on behalf of another state. They may not be cyber techniques per se, but have all greatly been enabled by cyber capabilities. Such operations include computer network exploitations, communications intelligence or interception (“COMINT”), and secret information- sharing programs carried out by virtue of public-private partnerships or international agreements. They sometimes overlap

196 Rutkowski, supra note 194, at 5. 197 ITU Const., supra note 192, art. 37. 198 See id. 199 Review: The Cuckoo’s Egg by Cliff Stoll, ESSAYS ON SECURITY (Mar. 8, 2017, 11:10 PM), https://www.essaysonsecurity.com/2017/01/15/review-the-cuckoos-egg-by- cliff-stoll/ [https://perma.cc/DV5Q-DCTJ]. 200 See id. 201 Forcese, supra note 103, at 183 (“territorial” describes purely domestic spying, “extraterritorial” describes purely foreign spying and “transnational” describes spying that straddles state borders).

968 N.C. J. INT'L L. [Vol. XLII

(e.g. NSA’s Upstream program), or are otherwise used in conjunction with one another.

1. Computer Network Exploitation Computer network exploitation is cyber espionage par

excellence. It is commonly referred to as hacking. It can be local but it can be conducted from virtually anywhere on the globe, and therefore enables large parts of purely extraterritorial operations. In the United States, this is typically Tailored Access Operations. The high profile Democratic National Committee and SONY Hacks are examples of computer network exploitations.

In the Cuckoo’s Egg, the intruder used Lawrence Berkeley National Laboratory computers to reach many others, especially computers of military and defense contractors.202 The intruder was allowed to thrive so his tactics and approach could be documented.203 He successfully penetrated more than thirty computers, collected data, and caused very minor damage.204 All of this was performed over the ARPAnet, mostly through what is now called zero-day attacks, exploiting existing flaws in the system’s security and working their way up to system manager privileges.205 After assuming that it was a prankster from the nearby University of California, Berkeley campus, the investigation pointed to sources in Germany, and techniques used by the KGB.206

The techniques used in computer network exploitations show several elements that can arguably be considered coercive in the second definition of the term I put forward.207 The very term brute force attack, for example, provides a picturesque indication of its coercive nature.208 Some of the most common techniques also

202 See Healey, supra note 2. 203 Id. 204 Id. 205 Id. 206 Id. 207 See Non-Intervention, supra note 52, section III C. 208 Definition: Brute Force Cracking, TECHTARGET (July 2006), http://searchsecurity.techtarget.com/definition/brute-force-cracking [https://perma.cc/93LK-NQ6S] (“Brute force (also known as brute force cracking) is a trial and error method used by application programs to decode encrypted data such as passwords or Data Encryption Standard (DES) keys, through exhaustive effort (using brute force) rather than employing intellectual strategies. Just as a criminal might break

2017 FROM THE CUCKOO'S EGG TO GLOBAL SURVEILLANCE 969

include man in the middle attacks,209 (spear) phishing attacks,210 and the already mentioned zero-day attacks. The more secured the targeted system, the more invasive and therefore coercive the exploitation thereof. The more energy, financial, technical, and human resources are required to break into a system, the more coercive the cyber espionage operation is. Hacking is also potentially a form of territorial intrusion, since states do retain sovereign rights over cyber infrastructure located on their territory, whether public or private.

Furthermore, whether intended or not, hacking may cause incidental damage.211 Either way, there is little difference between a computer network exploitation and a computer network attack. The difference between the two is at best subtle, if not misleading. Not to mention that one can easily enable the other (brute force attack to gain information versus gaining information to carry out more destructive attacks). Microsoft’s General Counsel Brad Smith once concluded: “Indeed, government snooping potentially now constitutes an ‘advanced persistent threat,’ alongside sophisticated malware and cyber-attacks.”212 He was thus suggesting it is only the end result that differs.213 Computer network exploitations constitute cyber sabotage, the coercive nature of which appears to be fairly obvious.214

into, or ‘crack’ a safe by trying many possible combinations, a brute force cracking application proceeds through all possible combinations of legal characters in sequence.”). 209 Margaret Rouse, Definition: Man-in-the-Middle Attack (MitM), TECHTARGET, http://internetofthingsagenda.techtarget.com/definition/man-in-the-middle-attack-MitM [https://perma.cc/A3HS-W6NU] (“A common method of executing a MitM attack involves distributing malware that provides the attacker with access to a user’s Web browser and the data it sends and receives during transactions and conversations.”). 210 Margaret Rouse, Definition: Phishing, TECHTARGET, http://searchsecurity.techtarget.com/definition/phishing [https://perma.cc/3KGL-GSTV] (“Phishing is a form of fraud in which the attacker tries to learn information such as login credentials or account information by masquerading as a reputable entity or person in email, IM or other communication channels.”). 211 Healey, supra note 2, at 105 (“Break-ins ultimately destroy the network connectivity they exploit.”) (Nearest copy available at Library of Congress). 212 Jim Edwards, Microsoft Says Government Surveillance Is An “Advanced Persistent Threat” That May Be Unconstitutional, BUS. INSIDER (Dec. 5, 2013, 10:44 AM), http://mobile.businessinsider.com/microsoft-government-surveillance-advanced- persistent-threat-unconstitutional-2013-12 [http://perma.cc/B3XY-UACA]. 213 Id. 214 Id.

970 N.C. J. INT'L L. [Vol. XLII

2. Communications Intelligence (“COMINT”) COMINT,215 or communications intelligence, is not new, but

there is a much greater amount of data available in the digital age, and the liberalization of the international telecommunications market has paved the way for new types of interception opportunities.216 COMINT can be extraterritorial or transnational depending on whether or not communication travels through intercept point located in spying state.217 In the United States, COMINT typically falls under Special Source Operations. Legal consequences may depend on where communication is intercepted.

COMINT presents geographical limitations, as not all states are equal in terms of access to global telecommunication infrastructure, nor does all traffic transit through all states in comparable volumes, either due to geographical or economic constraints.218 A country’s COMINT capability depends on its geographical location, and ability to plant intercept points on international spaces or foreign territory (thus constituting a breach of territorial integrity in the latter case).219 But the path of information cannot always be predicted, and data does not necessarily take the most direct, but the cheapest route, as a reportedly leaked National Security Agency slide claims.220

Submarine cables account for ninety-nine percent of global internet traffic.221 The USS Jimmy Carter submarine can wiretap

215 See Sulmasy & Yoo, supra note 103, at 631 (“Communications Intelligence (COMINT) is the technical information derived from the interception of foreign communications by one other than the intended recipient.”). 216 See Lawrence D. Sloan, Echelon and the Legal Restraints on Signals Intelligence : A Need for Reevaluation, 50 DUKE L.J. 1467, 1471–74 (2001). 217 Id. 218 Ingrid Burrington, Up to 70 Percent of Global Internet Traffic Gores Through Northern Virginia, NEXTGOV (Jan. 8, 2016), http://www.nextgov.com/big- data/2016/01/70-percent-global-internet-traffic-goes-through-northern-virginia/124976/ [https://perma.cc/3QLW-3YNS] (estimating that 70% of international internet traffic goes through the U.S.). 219 Id. 220 NSA Slides Explain the PRISM Data-Collection Program, WASH. POST. (July 10, 2013), http://www.washingtonpost.com/wp-srv/special/politics/prism-collection- documents/ [https://perma.cc/UT7T-CE9Y]. 221 Douglas Main, Undersea Cables Transport 99 Percent of International Data, NEWSWEEK (Apr. 2, 2015, 12:39 PM), http://www.newsweek.com/undersea-cables- transport-99-percent-international-communications-319072 [https://perma.cc/23QY- G5JD].

2017 FROM THE CUCKOO'S EGG TO GLOBAL SURVEILLANCE 971

on submarine cables.222 This sort of practice appears to be an old and widespread practice.223 This is arguably intrusive and potentially damaging to the cable.224 Most probably in violation of 1884 Convention for the Protection of Submarine Telegraph Cables, which does not have any specific provision about espionage or wiretapping, but whose Article 2 states that “[i]t is a punishable offence to break or injure a submarine cable, willfully or by culpable negligence, in such manner as might interrupt or obstruct telegraphic communication, either wholly or partially, such punishment being without prejudice to any civil action for damages.”225 Damage to submarine cables can have far-reaching consequences given the amount of internet traffic that relies on them.226

Clandestine intercept points or servers located on foreign territory require territorial intrusion to plant the intercept point.227 Here, the very intrusion could be unlawful in itself, as a form of prohibited intervention.228 If the intercept point is not on foreign territory, then it is not an intrusion, but legality would depend on other factors.229 For example, certain intercept points defeat the purpose of “peaceful usage” of common domains if placed in international waters, or outer space, especially as signals

222 Glenn Zorpette, Making Intelligence Smarter, IEEE XPLORE (2004), http://ieeexplore.ieee.org/ielx5/6/21038/975021/975021.html [https://perma.cc/ZG8J- X8EQ]; New Nuclear Sub is Said to Have Special Eavesdropping Ability, N.Y. TIMES (Feb. 20, 2005), http://www.nytimes.com/2005/02/20/politics/new-nuclear-sub-is-said- to-have-special-eavesdropping-ability.html [https://perma.cc/P842-H6AS] [hereinafter New Nuclear Sub]. 223 See Ewen MacAskill et al., GCHQ Taps Fibre-Optic Cables for Secret Access to World’s Communications, THE GUARDIAN (June 21, 2013, 12:23 PM), https://www.theguardian.com/uk/2013/jun/21/gchq-cables-secret-world- communications-nsa [https://perma.cc/V4K3-ZJL8]; see also Matthew Carle, Operation Ivy Bells, MILITARY.COM, http://www.military.com/Content/MoreContent1/?file=cw_f_ivybells [https://perma.cc/V5W9-KK7J]. 224 Id. 225 Convention for the Protection of Submarine Telegraph Cables art. II, Mar. 12, 1884, 24 Stat. 989, T.S. No. 380. 226 New Nuclear Sub, supra note 222. 227 See ELLA SHOSHAN, APPLICABILITY OF INTERNATIONAL LAW ON CYBER ESPIONAGE INTRUSIONS § 4.6, at 46–47 (2014). 228 Id. 229 Id.

972 N.C. J. INT'L L. [Vol. XLII

intelligence and remote sensing technology allow for far more precise data-collection than anticipated when the law of the sea and outer space developed. Also, the amount of data transiting through international spaces is unprecedented.230

If an intercept point placed by State A is on the territory of State B to spy on State C, it is still an unauthorized intrusion on State B, even if it is not the target of the data-collection operation. However, State B’s responsibility would also arise if State B has knowledge of the intercept server’s existence and purpose, and does nothing to mitigate its effects on other States. In the Corfu Channel case, the International Court of Justice ruled that states cannot knowingly let their territory be used in ways that adversely affect other states.231 Therefore, a state’s responsibility may arise if it knowingly lets cyber infrastructure located on its territory be used for espionage purposes of other states that amount to intervention.232 This would be the case even if the state from whose territory the cyber espionage operation is conducted does not benefit from the data thus collected and is not otherwise an accomplice of the spying state.233 If the intercept point is on the spying state’s territory, then legality would rely on scale and context, as we shall see below. EU and BRICS234 have started laying their own intercontinental submarine cable connections to avoid passing through U.S. nodes.235 This investment in circumventing U.S. access points, shows states do not consent to being subjected to mass-interception of their data.236

3. Secret Information-Sharing Information-sharing programs are not new either, and not

230 See JAMES MANYIKA ET AL., MCKINSEY GLOB. INST., DIGITAL GLOBALIZATION: THE NEW ERA OF GLOBAL FLOWS 30 (2016) (“Cross-border used bandwidth has grown 45 times larger over the past decade. In absolute terms, it has grown from 4.7 terabits per second (Tbps) in 2005 to 211.3 Tbps in 2014, for an annual growth rate of 52 percent.28 Over the next five years, total Internet Protocol (IP) traffic is projected to triple, while cross-border used bandwidth is projected to post a nine-fold increase.”). 231 Corfu Channel (U.K. v. Albania), Judgment, 1949 I.C.J. Rep. 35 (Apr. 9). 232 See id. 233 See id. 234 BRICS is an acronym for the countries of Brazil, Russia, India, China, and South Africa. 235 Scola, supra note 78. 236 Id.

2017 FROM THE CUCKOO'S EGG TO GLOBAL SURVEILLANCE 973

necessarily carried out through cyber means, but then again, there is a greater amount of data available in the digital age.237 It is mostly transnational (information shared by two states or stored on private servers located on spying state’s territory), sometimes extraterritorial (private servers located in spied upon state).238 Corporate partnerships, whether formalized or not, with internet service providers, telecommunications companies, internet corporations (social media platforms, cloud computing service providers, service apps, etc.) constitute one type of agreements through which secret information-sharing practices occur.239 In the United States, such actors are labeled “data providers” by PRISM program executives.240 One important indicator of state consent (or lack thereof) to such practice is the existence of domestic data location legislation in the target state.241 There might be a presumption of consent on the part of the target state in the absence of domestic legislation requiring data to be stored within that state’s territory.242 If, however, such legislation exists then it is clear indication that the target state does not want its citizens’ personal data spied upon.243 The recent passage of the EU-U.S. Privacy shield agreement to govern EU-U.S. data transfers is further evidence of states perceiving such data-collection programs as invasive, whether servers are located on spied upon state or spying state.244 The EU intended to protect its citizens in both scenarios.245 Furthermore, Australia v. Timor showed that data

237 See MANYIKA, supra note 230, at 30. 238 See David Kris, U.S. Government Presents Draft Legislation for Cross-Border Data Requests, LAWFARE: SURVEILLANCE (July 16, 2016, 8:07 AM), https://www.lawfareblog.com/us-government-presents-draft-legislation-cross-border- data-requests [https://perma.cc/X8DX-SFAN]. 239 NSA Slides Explain the PRISM Data-Collection Program, supra note 220. 240 See id. 241 See Lothar Determann, Local Data Residency Requirements for Global Companies, BAKER & MCKENZIE: INSIGHTS (Aug. 2015), http://www.bakermckenzie.com/en/insight/publications/2015/08/local-data-residency- requirements-for-global-com__/ [https://perma.cc/XSY2-YDQE]. 242 See id. 243 See id. 244 European Commission Press Release IP/16/216, EU Commission and United States Agree on New Framework for Transatlantic Data Flows: E.U.–U.S. Privacy Shield (Feb. 2, 2016). 245 Julia Fioretti, EU Says US Explanation of Yahoo Email Scanning Not Enough, REUTERS (Jan. 11, 2017, 4:20 PM), http://www.reuters.com/article/us-eu-usa-yahoo

974 N.C. J. INT'L L. [Vol. XLII

theft occurring on spying state territory can still be considered espionage.246 Therefore, domestically located data handed over by a private company could still potentially qualify as espionage.

In the case of international agreements with foreign partner agencies, there is obviously no violation of sovereignty if data intended for spying state is collected by “target” state itself on its own territory, but it potentially becomes a violation of sovereignty when data-collection efforts are mutualized against a third state.247 Another sovereignty issue here, is the fact that the “requesting” state has no control over the information-collection process performed by the partner state, which may be more invasive than intended by the requesting party.248 The Five Eyes network249 born out of the U.K.-U.S. agreement is emblematic of that sort of intelligence-sharing cooperation programs.

B. Why Should Cyber Espionage Be Deterred? Cyber espionage presents the risk of occasioning an escalation

of tension and conflict for several reasons; mostly pertaining to its unprecedented scale,250 specific characteristics, and potential consequences.

First and foremost, cyber espionage is both cost-efficient251 and

idUSKBN14V2MN?feedType=RSS&feedName=technologyNews&utm_source=Twitter &utm_medium=Social&utm_campaign=Feed%3A+reuters%2FtechnologyNews+%28R euters+Technology+News%29 [https://perma.cc/PRP2-DQ52]. 246 See Questions Relating to the Seizure and Detention of Certain Documents and Data (Timor-Leste v. Australia), Provisional Measures, Rep. 2014 I.C.J. 147 (Mar. 3). 247 Cf. U.S. JOINT CHIEFS OF STAFF, MULTINATIONAL OPERATIONS III–6, at (d)(1) (2007) (citing the collection and sharing of information as a potential sovereignty issue). 248 Cf. id. 249 The “Five Eyes” is an alliance of five English-speaking countries—the United States, the United Kingdom, Australia, Canada, and New Zealand. See Paul Farrell, History of 5-Eyes—Explainer, GUARDIAN (Dec. 2, 2013, 12:30 AM), http://www.theguardian.com/world/2013/dec/02/history-of-5-eyes-explainer [https://perma.cc/TB3F-ELAK]; FIVE EYES, https://www.privacyinternational.org/node/51 [https://perma.cc/C8RP-UXJK]. 250 See PoKempner, Cyberspace and State Obligations in the Area of Human Rights, in PEACETIME REGIME FOR STATE ACTIVITIES CYBERSPACE, supra note 77, at 252–53 (explaining that state-sponsored espionage is on a “pervasive scale” and could be of “unlimited by scale or duration”). 251 See Healey, supra note 2, at 98 (“[E]spionage over networks can be cost efficient, offer nearly immediate results, and target specific locations.”).

2017 FROM THE CUCKOO'S EGG TO GLOBAL SURVEILLANCE 975

has considerably less damaging consequences for spying states.252 Director of National Intelligence, John Clapper, had the opportunity to lament that foreign actors in cyberspace “remain undeterred from conducting reconnaissance, espionage, and even attacks in cyberspace because of the relatively low costs of entry, the perceived payoff, and the lack of significant consequences.”253 Indeed, the practice of cyber espionage is remote by essence, and therefore rarely requires sending an agent into foreign territory. Not only does that imply less risk for spies, but it is also less detectable and more challenging to attribute to the spying state. With traditional espionage involving human intelligence, the risk taken by the agent (and the state that risks losing its most competent and talented agents) could be self-deterring in some cases. It also meant it had to be more discreet and targeted. When the United States began flights over of Soviet bloc countries in 1956, the risks were known.254 In 1960, the U-2 piloted by Gary Francis Powers was shot down over the territory of the U.S.S.R.255

Cyber espionage’s cost-efficient and remote nature, coupled with the development of the global internet, allow for unprecedented mass-scale data-gathering opportunities. Cost- efficiency also means that a much larger number of states can engage in cyber espionage activities than in conventional forms of espionage requiring more resources.256

Data-mining technology,257 which is being enhanced by

252 See PoKempner, Cyberspace and State Obligations in the Area of Human Rights, in PEACETIME REGIME FOR STATE ACTIVITIES CYBERSPACE, supra note 77, at 253 (explaining that cyber espionage “made the means of surveillance vastly more cost- effective”). 253 JAMES R. CLAPPER, DIR. OF NAT’L INTELLIGENCE, STATEMENT FOR THE RECORD TO THE SENATE ARMED SERVICES COMMITTEE, WORLDWIDE THREAT ASSESSMENT OF THE U.S. INTELLIGENCE COMMUNITY 3 (Feb. 9, 2016). 254 See Alexander Orlov, A “Hot” Front in the Cold War, CIA (June 27, 2008, 7:39 AM), https://www.cia.gov/library/center-for-the-study-of-intelligence/csi- publications/csi-studies/studies/winter98_99/art02.html [https://perma.cc/J39Q-M4J8]. 255 The U–2 Spy Plane Incident, EISENHOWER PRESIDENTIAL LIBR., http://www.eisenhower.archives.gov/research/online_documents/u2_incident.html [https://perma.cc/BMS7-FJ59]. 256 See Ziolkowski, Peacetime Cyber Espionage – New Tendencies in Public International Law, in PEACETIME REGIME FOR STATE ACTIVITIES IN CYBERSPACE, supra note 77, at 425. 257 See Glenn Greenwald, XKeyscore: NSA Tool Collects ‘Nearly Everything a User Does on the Internet’, GUARDIAN (Feb. 26, 2017, 8:56 AM),

976 N.C. J. INT'L L. [Vol. XLII

machine learning258 and supported by rising computing power, make it even easier to make sense of the considerable flow of information intercepted or otherwise collected.259 As a result, mass-scale data collection is becoming less of an impediment to intelligence analysis.260 Big data and deep learning are actually fueling new software capable of predicting individual, as well as collective behavior such as social unrest.261

The unprecedented scale of the phenomenon is both problematic in itself, and because of its possible consequences. There is a quantitative leap from conventional espionage.262 The current scale of espionage makes it change in nature. As Hegel263 showed, past a certain threshold, quantity becomes quality. Punctual espionage was less harmful to state interests, and certainly less invasive.264 Having access to the kind of intelligence available in the digital age is not the same as only collecting punctual intelligence on a foreign country’s arsenal, capacity, or the intentions of its government. Stephen Chabinsky, a senior FBI official says “A spy might once have been able to take out a few books’ worth of material . . . . Now they take the whole library.

https://www.theguardian.com/world/2013/jul/31/nsa-top-secret-program-online-data [https://perma.cc/RP8Z-AT64] (explaining that the NSA’s XKeyscore is an example of new data mining technology). 258 Machine learning is associated with significant advancements in speech recognition, image recognition, and language processing. Machine Learning, SAS, https://www.sas.com/en_us/insights/analytics/machine-learning.html [https://perma.cc/6GMW-Z8NR]. 259 See id. 260 Frank Konkel, The CIA Says It Can Predict Social Unrest as Early as 3 to 5 Days Out, DEF. ONE (Oct. 5, 2016), http://www.defenseone.com/technology/2016/10/cia- says-it-can-predict-social-unrest-early-3-5-days-out/132121/ [https://perma.cc/2G7R- VFFN]. 261 Id. 262 See Ziolkowski, Peacetime Cyber Espionage – New Tendencies in Public International Law, in PEACETIME REGIME FOR STATE ACTIVITIES IN CYBERSPACE, supra note 77, at 425. 263 See generally David Gray Carlson, Hegel’s Theory of Quality (Cardozo L. Sch. Jacob Burns Inst. For Advanced Legal Stud. Working Paper 017, 2000), https://papers.ssrn.com/sol3/papers.cfm?abstract_id=241950 [https://perma.cc/K5FQ- 3BNT] (explaining Hegel’s theory which shows that quality and quantity are interrelated). 264 See War in the Fifth Domain, ECONOMIST (July 1, 2010), http://www.economist.com/node/16478792 [https://perma.cc/9CBZ-L9D4].

2017 FROM THE CUCKOO'S EGG TO GLOBAL SURVEILLANCE 977

And if you restock the shelves, they will steal it again.”265 There is also a greater number of targets; now, average citizens, and not just critical threat actors or foreign governments can be espionage targets.266

Incidental loss or damage, whether intended or unintended, is another reason why cyber espionage should be deterred. Cyber espionage may cause immaterial and material damage.267 It may hinder the availability and integrity of data, and may also interfere with the functionality of systems, sometimes permanently damaging hardware or infrastructure.268 This kind of collateral damage was also possible with traditional espionage when an agent had to physically break into installations to access the information thus sought. But remote data-collection can also cause severe damage, sometimes heavier, as more systems can be affected by a single act of espionage, including dual-use infrastructure.269 Loss can also be economic, as there are multiple documented cases of State-sponsored intellectual property theft.270 Cyber intrusions more broadly represent a security threat, as they may enable further attacks by weakening the targeted system.

265 Id. 266 See Justin Sink & Chris Strohm, Hackers, Corporate Spies Targeted by Obama Sanction Order, BLOOMBERG TECH. (Apr. 1, 2015, 8:59 AM), https://www.bloomberg.com/news/articles/2015-04-01/u-s-economic-sanctions-to-target- cyber-attacks-cyberspying [https://perma.cc/7T5H-M8PB]. 267 See James Stavridis, How to Win the Cyberwar Against Russia, FOREIGN POL’Y: VOICE (Feb. 2, 2017), http://foreignpolicy.com/2016/10/12/how-to-win-the-cyber-war- against-russia/ [https://perma.cc/2DL7-93NX]. 268 Id. (“North Korea’s attack on Sony Pictures, which did millions of dollars of damage to hardware.”). 269 See Rob Knake, Russian Hackers Were Only Getting Started in the 2016 Election, FORTUNE (Jan. 15, 2017), http://fortune.com/2017/01/15/russian-hackers-2016- election-cyber-war/ [https://perma.cc/4Y8W-B8C9]. 270 China reportedly stole the designs for the F-35 fighter jet, corporate secrets for steel, and the blueprints for gas pipelines that supply much of the United States. See David E. Sanger & Nicole Perlroth, Hackers From China Resume Attacks on U.S. Targets, N.Y. TIMES (May 19, 2013), http://www.nytimes.com/2013/05/20/world/asia/chinese-hackers-resume-attacks-on-us- targets.html [https://perma.cc/4GDZ-CYDW]; see also Spencer Ackerman & Jonathan Kaiman, Chinese Military Officials Charged with Stealing US Data as Tensions Escalate, GUARDIAN (May 20, 2014, 3:58 AM), https://www.theguardian.com/technology/2014/may/19/us-chinese-military-officials- cyber-espionage [https://perma.cc/ECX2-J2RM].

978 N.C. J. INT'L L. [Vol. XLII

Unintended consequences271 can therefore be more harmful than the intended eavesdropping.

What’s more, the threat of cyber espionage is now augmented by the possibly of ensuing dissemination of the information to a much larger and global audience than was possible before the internet and the globalization of the telecommunications market.272 The internet allows for instant mass publication at no cost. This presents a higher threat for personal as well as classified information. In the digital age, stolen data may no longer be known to the spying state alone. Mass-dissemination may be intentionally used as a new weapon of information warfare, or it may be that stolen data inadvertently gets lost or leaked by personnel without the spying state’s instructions.

For the aforementioned reasons and others, the scale and potential consequences273 of cyber espionage make it a rising element of tension escalation in the world.274 It has been observed that the balkanization of the internet movement has considerably amplified after the 2013 Snowden disclosures; cyber espionage is a major threat to the globally interconnected nature of the internet.275

C. How And When Cyber Espionage Becomes Illegal

1. How There is no prohibition of espionage per se, but cyber

espionage significantly differs in scale, characteristics, and

271 Intended damage would exceed the scope of this article, as it could be interpreted as prohibited use of force. 272 See PoKempner, Cyberspace and State Obligations in the Area of Human Rights, in PEACETIME REGIME FOR STATE ACTIVITIES CYBERSPACE, supra note 77, at 256. 273 Though tempting, I am intentionally not using the expression “scale and effects” reserved for assessing whether an occurrence of use of force reaches the threshold of an armed attack. 274 See Jerome Cartillier, Obama Vows to Slap Russia Over Hacking, Tensions on Rise, YAHOO NEWS (Dec. 16, 2016), https://www.yahoo.com/news/obama-says-us- retaliate-against-russian-hacking-022451853.html [https://perma.cc/8LQG-SDF8]. 275 See John Naughton, Edward Snowden’s Not the Story. The Fate of the Internet Is, GUARDIAN (July 27, 2013, 5:01 PM), https://www.theguardian.com/technology/2013/jul/28/edward-snowden-death-of-internet [https://perma.cc/V86N-572C]; see also Sascha Meinrath, The Future of the Internet: Balkanization and Border, TIME (Oct. 11, 2013), http://ideas.time.com/2013/10/11/the- future-of-the-internet-balkanization-and-borders/ [https://perma.cc/L69H-2QHH].

2017 FROM THE CUCKOO'S EGG TO GLOBAL SURVEILLANCE 979

consequences from pre-cyber espionage. We are moving away from the status quo and legal ambivalence of espionage under international law.276 Deeks evokes a “shift from agnosticism.”277 Prohibition of espionage may not have been warranted in the past, but certain cases of espionage are becoming illegal for the very reasons brought forth by those international legal scholars who viewed traditional espionage as illegal per se. Their arguments didn’t hold in the past, but they take on their full meaning now. However, it would be unreasonable to declare espionage illegal ipso facto, as some cases of traditional and even cyber espionage would still be discreet enough to be tolerable under the law. I believe the existing theory of non-intervention offers the most useful framework to deter certain types of cyber espionage. In a word, espionage remains neither legal nor illegal per se, but it may rise to the level of prohibited intervention in cases that I shall briefly expose. I would argue that it is a scale and context question. The historically ambivalent law of espionage allows for that type of quantity assessment. The same way that possession of recreational drugs can be tolerated in small amounts in certain legal systems and be criminalized past a certain threshold.

It is worth warning the reader that I do not in any way promote the idea, contended by certain politicians278 and scholars, that (cyber) espionage may sometimes rise to the level of use of force, if not armed attack.279 This would be an unreasonable and unnecessary development. As stated before, intervention does not have to amount to use of force to be unlawful.280

2. When: Scale and Coercion In regard to the National Security Agency’s cyber espionage

activities, several political declarations of states are clear

276 See Deeks, supra note 112, at 315. 277 Id. 278 See Theodore Schleifer & Deirdre Walsh, McCain: Russian Cyberintrusion an “Act of War”, CNN (Dec. 31, 2016, 1:27 AM), http://edition.cnn.com/2016/12/30/politics/mccain-cyber-hearing/ [https://perma.cc/SR99-X485] (showing McCain claiming that Russia’s “cyber intrusion is an act of war”). 279 See id. (“These events have already proved why it’s to everyone’s benefit that Cyber Command will soon be elevated by the military to the status of a full combatant command.”).

280 See Non-Intervention, supra note 52, at III (C.).

980 N.C. J. INT'L L. [Vol. XLII

indications of the lack of consent of target states on the one hand, and lack of opinio juris on the part of the United States on the other.281 These also suggest how crucial scale was in their legal assessment of the situation.282 Then Brazilian President Dilma Roussef to the United Nations:

[I]ntrusion and meddling in such a manner in the life and affairs of other countries is a breach of international law and as such an affront to the principles that must guide the relations among them, especially among friendly nations. A country’s sovereignty can never affirm itself to the detriment of another country’s sovereignty.283 Brazil also asked the U.S. President for an explanation,

apology and guarantee of non-repetition.284 Then France’s Foreign Affairs Minister, Bernard Kouchner said it was unacceptable conduct from allies, saying “Let’s be honest, we eavesdrop too. Everyone is listening to everyone . . . . The magnitude of the eavesdropping is what shocked us.”285 Germany called the revelations “completely unacceptable.”286

On the other hand, President Obama, while he attempted to justify the National Security Agency’s spying activities, did not speak to the question of legality.287 Instead, he justified these

281 See Josh Levs & Catherine E. Shoichet, Europe Furious, ‘Shocked’ by Report of U.S. Spying, CNN (Feb. 28, 2017, 9:06 AM), http://www.cnn.com/2013/06/30/world/europe/eu-nsa/ [https://perma.cc/GT3N-4TUD]. 282 See id. 283 News Wrap: Brazil President Calls U.S. Spying on Allies ‘Totally Unacceptable’, PBS (Feb. 27, 2017, 9:04 AM), http://www.pbs.org/newshour/bb/world-july-dec13- newswrap_09-24/ [https://perma.cc/X68X-5GVL]. 284 Brian Winter, Exclusive – Brazil’s Rousseff wants U.S. Apology for NSA Spying, YAHOO NEWS (Feb. 27, 2017, 9:09 AM), https://www.yahoo.com/news/exclusive- brazils-rousseff-wants-u-apology-nsa-spying-013035060.html?ref=gs [https://perma.cc/RH9A-MYQX]. 285 NSA Spying Threatens to Hamper U.S. Foreign Policy, CBS NEWS (Feb. 27. 2017, 9:21 AM), http://www.cbsnews.com/news/nsa-spying-threatens-to-hamper-us- foreign-policy/ [https://perma.cc/P8U5-3XUL] (emphasis added). 286 Jeff Black, Germany’s Merkel Calls Obama: Did NSA Monitor my Cellphone?, NBC NEWS (Feb. 27, 2017, 9:25 AM), http://www.nbcnews.com/news/other/germanys- merkel-calls-obama-did-nsa-monitor-my-cellphone-f8C11452362 [https://perma.cc/3SZW-JNU6]. 287 See Luke Johnson, Obama Defends NSA Programs, Says Congress Knew About Surveillance, HUFFINGTON POST (June 7, 2013, 12:45 PM), http://www.huffingtonpost.com/2013/06/07/obama-nsa_n_3403389.html [https://perma.cc/QDU5-HDQ5].

2017 FROM THE CUCKOO'S EGG TO GLOBAL SURVEILLANCE 981

activities on national security grounds.288 Justifying state action in the name of national security, in a plea of necessity, or other preclusion of responsibility, though common practice, does not negate the underlying illegality of the act in question.

Further indications of opinio juris that scale makes cyber espionage less acceptable is that it does not allow states to guarantee a fundamental right in their own territory.289 Beyond the important issue of extraterritorial application of human rights obligation, the long series of “privacy in the digital age” resolutions and reports at the UN are also proof that mass-scale surveillance is less tolerable to states namely because of its deleterious effects on human rights.290

3. When: Context and Threat of Disclosure (Information Warfare)

When cyber espionage does not rise to the level of intervention by itself, it may still elicit and therefore be part and parcel of a prohibited act of intervention. Context is therefore key, whether in

288 See id. 289 See Ziolkowski, General Principles of International Law as Applicable in Cyberspace, in PEACETIME REGIME FOR STATE ACTIVITIES CYBERSPACE, supra note 77, at 153. 290 See Human Rights Council Res. 20/8, U.N. Doc. A/HRC/20/L.13, ¶ 1 (June 29, 2012) (“The Human Rights Council . . . [a]ffirms that the same rights that people have offline must also be protected online.”); G.A. Res. 68/167 (Dec. 18, 2013); G.A. Res. 26/13, ¶ 5 (July 14, 2014) (Calls upon all states to address security concerns on the internet in accordance with their international human rights obligations to ensure protection of freedom of expression, freedom of association, privacy and other human rights online.”); G.A. A/C.3/69/L.26/Rev.1, 3 (Nov. 19, 2014) (“Deeply concerned at the negative impact that surveillance and/or interception of communications, including extraterritorial surveillance and/or interception of communications, as well as the collection of personal data, in particular when carried out on a mass scale, may have on the exercise and enjoyment of human rights.”); see G.A. Res. 69/166 (Dec. 18, 2014) (discussing the right to privacy in the digital age); see 2015 Report of the Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security, G.A. Res. 69/166 (Dec. 18, 2014) (“Welcoming the adoption by the Human Rights Council of resolution 26/13 of June 26 2014 on the promotion, protection and enjoyment of human rights on the internet.”); see Human Rights Council, The Right to Privacy in a Digital Age, U.N. Doc. A/HRC/27/37 (June 30, 2014); see also The Right to Privacy in the Digital Age, OHCHR (Feb. 28, 2017, 1:48 PM), http://www.ohchr.org/EN/Issues/DigitalAge/Pages/DigitalAgeIndex.aspx [https://perma.cc/3HQ6-GL5U].

982 N.C. J. INT'L L. [Vol. XLII

the context of international negotiations,291 or, as we saw very recently with the so-called Democratic National Committee (“DNC”) Hack, national election periods.292 The latter event prompted the RAND Corporation to call for the prohibition of cyber espionage conducted for the purpose of political interference.293 Thus showing how intricately connected cyber espionage and interference are. The DNC Hack was an alleged attempt to manipulate the outcome of the 2016 United States presidential election.294 The exact impact of the alleged operation is difficult to assess. However, if confirmed, any attempt by a state to manipulate foreign public opinion is widely considered to wrongfully interfere with democratic processes.295 Here, it is not so much the fact that the public should not have access to certain potentially relevant information about presidential candidates. What is argued to have crossed the line is that it was coming from a foreign entity with the intent of manipulating the election.296 This type of state-sponsored dissemination of information also escapes the jurisdiction of the victim state, which therefore has no

291 Memorial of the Democratic Republic of Timor–Leste, Questions Relating to the Seizure and Detention of Certain Documents and Data (Timor-Leste v. Austl.), 2014 I.C.J. Application Instituting Proceedings 57 (April 28, 2014). 292 See Michael Wood, Non–Intervention (Non-Interference in Domestic Affairs), ENCYCLOPEDIA PRINCETONIENSIS, https://pesd.princeton.edu/?q=node/258 [https://perma.cc/J9KL-XURZ] (“Interference in political activities (such as through financial or other support for particular political parties, comment on upcoming elections or on the candidates; seeking to overthrow the government–so–called ‘regime change.’).”). 293 Martin C. Libicki, The DNC Hack: Are New Norms Needed?, RAND BLOG (Feb. 28, 2017, 8:26 PM), http://www.rand.org/blog/2016/09/the-dnc-hack-are-new-norms- needed.html [https://perma.cc/D3RS-2XT3]. 294 See Eric Lipton et al., The Perfect Weapon: How Russian Cyberpower Invaded the U.S., N.Y. TIMES (Feb. 28, 2017, 8:31 PM), https://www.nytimes.com/2016/12/13/us/politics/russia-hack-election-dnc.html?_r=0 [https://perma.cc/ZR7L-EX4H]; see also Stavridis, supra note 266 (“All democratic nations have a stake in pushing back against this blatant interference in the democratic political process.”). 295 See Stavridis, supra note 267. 296 See Ellen Nakashima, Russian Government Hackers Penetrated DNC, Stole Opposition Research on Trump, WASH. POST (Feb. 27, 2017, 8:43 PM), https://www.washingtonpost.com/world/national-security/russian-government-hackers- penetrated-dnc-stole-opposition-research-on-trump/2016/06/14/cf006cb4-316e-11e6- 8ff7-7b6c1998b7a0_story.html?utm_term=.43884b9021d5 [https://perma.cc/UJ27- ECYG].

2017 FROM THE CUCKOO'S EGG TO GLOBAL SURVEILLANCE 983

resource to go after the perpetrator of the information theft or disclosure of classified information.297 Foreign powers also have more resources to steal larger amounts of classified information.298 Their nuisance capacity in accessing and revealing classified or otherwise sensitive material is higher than that of national media organizations.299 Dissemination also elevates privacy threat, as countless private individuals end up in the “email dumps,”300 sometimes without even realizing it.

In his statement on “Actions in Response to Russian Malicious Cyber Activity and Harassment,”301 President Obama officially responded to the “data theft and disclosure activities.”302 The use of the expression “malicious cyber activity” is noteworthy, as the only “malicious cyber activity” involved in the DNC hack was hacking.303 Disclosure of information is not a form of cyber activity. This emphasis on the data-gathering component tends to corroborate the idea that the United States is going after espionage as a decisive element of the alleged prohibited intervention of Russia, an element to be condemned in it of itself. If this case of cyber espionage was legal, why not focus on the “disclosure activities?” It is also interesting that the statement should avoid the word espionage, when the subsequent FBI report points to Russian intelligence agencies being behind the operation.304

297 Alain Megias, How Cyber Jurisdiction Affects Cybercrime Prosecution, I– POLICY (Feb. 27, 2017, 8:51 PM), http://www.i-policy.org/2011/02/how-cyber- jurisdiction-affects-cybercrime-prosecution.html [https://perma.cc/GP34-3RSU]. 298 See Heli Tiirmaa-Klaar, Cyber Diplomacy: Agenda, Challenges, and Missions, in PEACETIME REGIME FOR STATE ACTIVITIES CYBERSPACE, supra note 77, at 509, 515. 299 See id. 300 See Raphael Satter & Maggie Michael, WikiLeaks’ Document Dumps Contain Plenty of Private Data, BOS. GLOBE (Feb. 27, 2017, 9:01 PM), https://www.bostonglobe.com/news/world/2016/08/23/wikileaks-document-dumps- plenty-private-data/xrQEmoFoT3DTD3inmQS9IO/story.html [https://perma.cc/6V7A- G52K]. 301 Press Release, President Barack Obama, Statement by the President on Actions in Response to Russian Malicious Cyber Activity and Harassment (Dec. 29, 2016), https://www.whitehouse.gov/the-press-office/2016/12/29/statement-president-actions- response-russian-malicious-cyber-activity [https://perma.cc/XLN2-4S9R] [hereinafter Press Release Obama]. 302 See id. 303 See id. 304 DEPT. OF HOMELAND SEC. & FED. BUREAU OF INVESTIGATION, REF. NO. JAR-16- 202961, JOINT ANALYSIS REPORT: GRIZZLY STEPPE – RUSSIAN MALICIOUS CYBER

984 N.C. J. INT'L L. [Vol. XLII

President Obama further evokes “Russia’s efforts to undermine established international norms of behavior, and interfere with democratic governance” as well as “cyber activity that seeks to interfere with or undermine our election processes and institutions.”305 Again, the only cyber activity was the data theft itself and nothing else.

V. Functionalism and other Moot Preclusions of State Responsibility The law of state responsibility was set out in 2001 by the

International Law Commission in a series of articles; these responsibilities are usually considered codifications of international customary law.306 States are responsible to other states for their infringement on international law.307 A state’s responsibility rises when an act or omission that is attributable to the state constitutes a breach of an international obligation of that state.308 The responsible state is under an obligation to cease the wrongful act in question, and offer appropriate assurance and guarantee of non-repetition.309 In addition, the responsible state must make full reparation for the injury through restitution, compensation, or satisfaction.310 Additionally, in cases where acts of non-state actors are not attributable to a state, states still have an obligation to put an end to any activities that they know are occurring on their territory and that adversely affects other

ACTIVITY (Dec. 29, 2016), https://www.us- cert.gov/sites/default/files/publications/JAR_16-20296A_GRIZZLY%20STEPPE-2016- 1229.pdf [https://perma.cc/36R8-M2UW]. 305 See Press Release Obama, supra note 301. 306 See generally Draft Articles on Responsibility of States for Internationally Wrongful Acts, with commentaries, in Report of the International Law Commission on the Work of Its Fifty-third Session, 56 U.N. GAOR Supp. (No. 10) at art. 31(1), U.N. Doc. A/56/10 (2001), http://www.un.org/law/ilc [https://perma.cc/3J6Y-58TV] [hereinafter ILC Draft Articles]. 307 See Ziolkowski, General Principles of International Law as Applicable in Cyberspace, in PEACETIME REGIME FOR STATE ACTIVITIES CYBERSPACE, supra note 77, at 135. 308 See Terry D. Gill, Non-Intervention in the Cyber Context, in PEACETIME REGIME FOR STATE ACTIVITIES CYBERSPACE, supra note 77, at 217, 226. 309 See Michael N. Schmitt, Cyber Activities and The Law of Countermeasures, in PEACETIME REGIME FOR STATE ACTIVITIES CYBERSPACE, supra note 77, at 659, 664. 310 See id.

2017 FROM THE CUCKOO'S EGG TO GLOBAL SURVEILLANCE 985

states.311 There are defenses available for states to claim preclusion of responsibility.312 These include consent by the injured state, self-defense, force majeure, distress, necessity, and countermeasures.313 Only consent, necessity, and self-defense could theoretically be invoked in the context of cyber espionage that reaches the threshold of intervention.314 In the case of self- defense, only in so far as espionage can be considered a pre- requisite for the exercise of self-defense, not because espionage should be equated to an armed attack.315 That being said, it appears that no preclusions of state responsibility hold in cases of cyber espionage.316

Consent of the spied-upon state, as was shown earlier, would be difficult to argue. Necessity may be invoked to preclude responsibility if it “is the only way for the State to safeguard an essential interest against a grave and imminent peril;” and it “does not seriously impair an essential interest of the State or States towards which the obligation exists, or of the international community as a whole.”317 This would be equally difficult to argue, as the International Law Commission itself recognizes that “necessity will only rarely be available to excuse non-performance of an obligation and that it is subject to strict limitations to safeguard against possible abuse.”318 The plea of necessity would therefore not be justified by the kind of national security threats invoked by states engaging in mass-scale surveillance. Though serious, these rarely amount to a “grave and imminent peril” to “an essential interest.”319 Besides, there is no evidence for mass-scale

311 The Corfu Channel Case (United Kingdom of Great Britain and Northern Ireland v. Albania), Judgment, 1949 I.C.J. 22 (Apr. 1949). 312 See Ziolkowski, General Principles of International Law as Applicable in Cyberspace, in PEACETIME REGIME FOR STATE ACTIVITIES CYBERSPACE, supra note 77, at 462–63. 313 See Michael N. Schmitt, Cyber Activities and The Law of Countermeasures, in PEACETIME REGIME FOR STATE ACTIVITIES CYBERSPACE, supra note 77,, at 659, 667. 314 See id. 315 See id. at 679. 316 See Ziolkowski, General Principles of International Law as Applicable in Cyberspace, in PEACETIME REGIME FOR STATE ACTIVITIES CYBERSPACE, supra note 77, at 463. 317 See ILC Draft Articles, supra note 306, art. 25. 318 Id. 319 Id.

986 N.C. J. INT'L L. [Vol. XLII

surveillance being effective against international terrorism.320 Likewise, the argument that intelligence is the pre-requisite for

the exercise of the right to anticipatory self-defense321 does not hold. Mass-scale surveillance is not tailored narrowly enough, and gathers more information about ordinary citizens than it does about potential criminals, terrorists, or armed groups.322 It also does not discriminate among individuals acting on their own accord and those acting on the instructions of, or under the direction or control of a state.323 Self-defense can only be exercised in the case of an armed attack committed by a state which is either imminent or actual.324 More generally, the functionalist approach echoes the logic of international spaces, where strategic observation is allowed for the purpose of guaranteeing peace and security.325 Some argue that the same justification can be used in any case of espionage, regardless of the international or non-international character of the space.326 During the cold war, every effort was made to avoid a nuclear war, therefore espionage, taken as a national technical means of verification, was seen as a necessary sacrifice to ward off the more serious risk of a nuclear war.327 “Reciprocal espionage” was the counterpart of nuclear deterrence.328 No party could surprise the other with an attack.329 Spying therefore was serving a “common interest” function.330 The same idea seems to pour into current foreign intelligence practices, not to ward off nuclear war, but the

320 See Mass Surveillance Isn’t the Answer to Fighting Terrorism, N.Y. TIMES (Feb. 28, 2017, 8:30 PM), https://www.nytimes.com/2015/11/18/opinion/mass-surveillance- isnt-the-answer-to-fighting-terrorism.html?_r=0 [https://perma.cc/2HYG-EUHQ]. 321 David Weissbrodt, Cyber–Conflict, Cyber–Crime, and Cyber–Espionage, 22 MINN. J. INT’L L. 347, 365 (2013). 322 See Sink & Strohm, supra note 266. 323 See Gill, supra note 308, at 227. 324 See Ziolkowski, General Principles of International Law as Applicable in Cyberspace, in PEACETIME REGIME FOR STATE ACTIVITIES CYBERSPACE, supra note 77, at 437. 325 See id. at 438. 326 See id. 327 See Stone, supra note 123; see also Luke Pelican, Peacetime Cyber-Espionage: A Dangerous but Necessary Game, 20 COMMLAW CONSPECTUS 363, 372–73 (2012). 328 See Stone, supra note 123, at 31. 329 See id. at 43. 330 See id. at 31, 41.

2017 FROM THE CUCKOO'S EGG TO GLOBAL SURVEILLANCE 987

threat of terrorism. The common argument is that it is necessary for both national and global security purposes,331 much like during the cold war. Yet, the threat of terrorism is incommensurate with that of a nuclear war. Mass-scale foreign surveillance is also not targeted at specific threat actors, as data is collected about volumes of different individuals and entities. While reciprocal espionage was a key aspect of nuclear deterrence in the Cold War, the efficacy of global surveillance in preventing transnational crime and terror attacks has yet to be established.332

VI. Conclusion Espionage is neither legal nor illegal per se. Some espionage

will continue to be tolerable, especially in the legitimated yet narrowly-tailored exercise of the inherent right to self-defense and national technical means of verification. But cyber espionage, depending on scale and context, is arguably more invasive and coercive than conventional espionage ever was. Therefore, cyber espionage that elicits or amounts to intervention is unlawful.

Whether international law is effective or not has no bearings on whether or not espionage should, in some circumstances, be illegal. Formulating the values of the international legal order has to precede working on a strategy to enforce compliance. Values and objectives need first to be clearly defined, if we are to implement them at all. We cannot forsake the values on the ground that they cannot be enforced. Values are not sufficient conditions, but they certainly are necessary conditions to influencing state behavior.

It is also important for states to have clarity as to what standards they are being held against. We can no longer afford the status quo as to the legality of espionage under international law. To move away from uncertainty, states should be encouraged to take cyber espionage matters to the International Court of Justice for clarification, tangible sanctions, and potential damages. The Ahmadou Sadio Diallo case, in which the International Court of Justice awarded damages in a human rights case for the first time, certainly created a welcome precedent in that respect.333 Bi- or

331 See Pelican, supra note 327, at 382. 332 See id.

333 Ahmadou Sadio Diallo (Republic of Guinea v. Democratic Republic of the Congo), Compensation, Judgment, I.C.J. Reports 2012 at 324.

988 N.C. J. INT'L L. [Vol. XLII

multilateral agreements akin to the anti-spying treaties passed by the United States and China,334 and which have shown substantial success,335 could also be developed. An International Law Commission working group should be called on to codify customary law on espionage and cyber espionage, thereby paving the way for a court decision or a global treaty on cyber espionage.

In the meantime, as governments begin to be more vocal against other states’ spying activities, it is important to remember that reciprocity is key to international law compliance. States cannot continue to both condemn and carry out mass surveillance programs. As United States Department of State Legal Advisor Harold Koh said in 2012: “[i]f we succeed in promoting a culture of compliance, we will reap the benefits. And if we earn a reputation for compliance, the actions we do take will earn enhanced legitimacy worldwide for their adherence to the rule of law.”336 Action should be taken to restore trust for the sake of maintaining international peace and security, as well as an open internet. “Once trust is broken, the open, cooperative character of our networks may be lost forever.”337 As the exponential development of technology modifies our perception of reality and international relations, it may be that, contrary to what Quincy Wright wrote in 1962,338 wars are in fact made both in the minds of men and in technological development.

334 Stephan Kravchenko, Russia More Prey Than Predator to Cyber Frim Wary of China, BLOOMBERG TECH. (Feb. 28, 2017, 8:38 AM), https://www.bloomberg.com/news/articles/2016-08-25/russia-more-prey-than-predator- to-cyber-firm-wary-of-china [https://perma.cc/CT6W-LM9B]; Ellen Nakashima & Steven Mufson, U.S., China Vow Not to Engage in Economic Cyberespionage, WASH. POST (Feb. 28, 2017, 8:48 AM), https://www.washingtonpost.com/national/us-china- vow-not-to-engage-in-economic-cyberespionage/2015/09/25/90e74b6a-63b9-11e5-8e9e- dce8a2a2a679_story.html?utm_term=.d20536037139 [https://perma.cc/YP9J-L4VS]. 335 Eva Galperin, The Year in Government Hacking: 2016 Review, ELEC. FRONTIER FOUND. (Feb. 28, 2017, 8:54 AM), https://www.eff.org/deeplinks/2016/12/year- government-hacking [https://perma.cc/2ADM-WCXU]. 336 Brian J. Egan, Legal Adviser, Berkeley Law Sch., Remarks on International Law and Stability in Cyberspace (Nov. 10, 2016), https://www.law.berkeley.edu/wp- content/uploads/2016/12/egan-talk-transcript-111016.pdf [https://perma.cc/9RLW- 6YAS]. 337 Healey, supra note 2, at 99. 338 See generally QUINCY WRIGHT, PREVENTING WORLD WAR III, SOME PROPOSALS (1962) (referencing Quincy Wright’s collection written at the height of the Cold War on topics including the arms race, reducing international tensions, and building a more global society).