By Karen Kelly
At some point in early 2020, cyberhackers breached thousands of websites around the world, accessing data in U.S. federal government agencies, the U.K. government, the European Parliament, NATO, and more.
Described as the worst cyber-espionage incident in history, the attack gave the hackers—suspected Russian agents—access to sensitive information for months before it was discovered.
While American politicians described the attack as an act of war, Professor Leah West says cyberattacks reside in a grey area of international law.
“It’s very clear in international law that the use of force against other states is prohibited,” explains West, a specialist in national security law at the Norman Paterson School of International Affairs (NPSIA). “It’s the stuff that falls below that level of use of force that is really kind of unique to the cyber domain. The fact that we can really manipulate other people’s stuff in another country without using force is pretty new.”
West is investigating these so-called “below threshold” cyber operations in her research, funded by a SSHRC Insight Development Grant. While cyber attacks are not covered in warfare treaties, the international community is trying to establish a baseline (called customary law) for when a cyberattack has gone too far.
“The premise of my work is that we’re not going to get any treaties on this issue, especially the low-level activities in the shadows,” says West, who was a Department of Justice lawyer who worked for CSIS. “So I am looking at what customs are emerging to create a baseline of understanding.”
West is working with graduate students Evelyn Fortin and Antoine Bourget-Rousseau of NPSIA and Raagul Sriprakas of the Infrastructure Protection & International Security program to study what the top 17 cyber superpowers say and do in response to cyberattacks. These include the Five Eyes alliance—the United States, Canada, United Kingdom, Australia, and New Zealand—as well as European and Asian countries.
“What do their statements say? Do their agencies engage in cyber activities? What do the courts say? A practice will begin to develop around this and that’s what we’re looking for,” says West. “If you can say that a consensus is developing, it will snowball.”
While cyber attacks may not be technically illegal, West fears the damage they cause will endure.
“I’m worried about attacks that will question the validity and integrity of systems we rely on for our government to run,” she says. “There are serious implications for our trust in the institutional foundations of democracy.”
