Machines: cyberspace and the laws of war

The ability of a machine to detect an attack and thus trigger a state’s self-defence mechanisms is the dystopian vision painted by Russell Buchan and Nicholas Tsagourias in their enthralling survey on the legal apparatus surrounding the use of force.

But is such a machine up to the challenge of satisfying itself that self-defence criteria have been fulfilled? And without such a reassurance would automatic cyber defence be lawful? The machine would need to identify whether an armed attack or the mere use of force had been committed, and whether a state or non-state actor was responsible. What is more, bereft of human input, ‘would the machine be tricked by false positives if intent and context cannot be assessed by the machine?’.

This nightmare scenario, with a state on the brink of war, highlights a major foible of artificial intelligence. The authors write: ‘Even if AI reaches the point of emulating human reasoning, the problem of being able to explain and justify the use of force for legal as well as political purposes remains. How can humans disentangle the machine’s reasoning?’

The authors consider whether cyber-attacks fall under the ambit of Article 2(4) of the United Nations Charter. They cite reports by the Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security, confirming that cyberspace comes under the auspices of international law. The authors affirm: ‘Any cyber-attack which produces effects equivalent to those generated by kinetic force will fall within the rule prohibiting the use of force.’ These effects on, for example, a server or network may not be immediately obvious but would cause ‘second-order physical effects’, such as plane collisions arising from manipulation of air traffic control data.

But do cyber-attacks achieve a certain ‘threshold of harm’? The authors note: ‘There are those who maintain that any use of force irrespective of its gravity would suffice [to reach the threshold of harm in order for Article 2(4) to be triggered].’ If, for example, a computer system is disrupted and causes a dam to open, thus flooding a nearby village, then Article 2(4) would apply to such an attack ‘causing real world physical harm’. Attacks on critical national infrastructure, such as air and maritime transport, banking and financial services, e-commerce, water supply, food distribution and public health are ‘particularly pernicious’.

In this accessible survey, the authors also look at the UN collective security system, armed reprisals, humanitarian interventions and peacekeeping operations.

Nicholas Goodman is a sub-editor at the Law Society Gazette