U.S. can respond to cyberattacks without showing proof first, legal expert says

There is no requirement in international law for the U.S. or any other state that has been cyberattacked to show any evidence it may have that justifies any response it may make, the leading expert on cyber and the laws of war said Wednesday.

“Our position was, states may respond without providing the evidence based upon which they act,” said Michael N. Schmitt,  lead author of the Tallinn Manual, widely regarded as the definitive guide to cyberwarfare and international law.

The issue has been highlighted over the past week, as U.S. officials have accused Russian intelligence agencies of running a broad-ranging influence campaign designed to help President-elect Donald Trump to victory in the recent U.S. election. The officials have published their charges in great detail, but by-and-large have not provided the sensitive intelligence sources and methods upon which they are based.

Schmitt spoke at the Suits and Spooks conference, an intelligence and cybersecurity conference in Washington.

It’s an issue that’s complicated by the always-tricky issue of attribution in cyberspace, where hackers can easily hide their identity or masquerade as someone else.

“Certainty of knowledge is a critical issue,”  said Schmidt, but the consensus of the legal experts in the Tallinn group was that “States don’t have to be right, states have to be reasonable.”

Schmidt dismissed as “nonsense” the idea that Russian interference in the election might constitute an act of war, or what international lawyers call an “armed attack.”

But he said there was a vigorous debate among scholars about whether it constituted an “internationally wrongful act” — which would  in turn open Russia up to the possibility of U.S. countermeasures.

“Countermeasures is a legal term of art,” said Schmitt, meaning a course of action that would be unlawful in itself, except that it’s a response to an internationally wrongful act.

“Clearly if the Russians had manipulated election returns …  that would have constituted an ‘internationally wrongful act,’ a violation of international law,” he said. But as it was, “On the question of whether the activity of releasing [stolen] information [from the Podesta and DNC emails] that was in fact truthful, was a violation of international law, the lawyers were bitterly divided,” he said.

The debate turned on whether the document dumps could be seen as “coercion,” he said.