Difference between revisions of "Scenario 03: Cyber operation against the power grid"
, 2 years ago
→Possible obligation not to conduct cyber operations against other states’ critical infrastructure: incorporating CS comments
(integrating review CS)
(→Possible obligation not to conduct cyber operations against other states’ critical infrastructure: incorporating CS comments)
As a consequence of the operation, many households are left without electricity for days, resulting in significant inconvenience for the local residents as well as some economic damage to company X and other actors in State A’s territory, including the State itself. However, the power cuts are limited to residential areas and no physical damage or personal injury is reported from any of the affected areas.
Much later, the source of the vulnerability is identified and the remote-control equipment is found and removed from the ICS at company X. Forensic analysis of the removed equipment determines that it was designed, installed, and controlled by the intelligence services of State B. State A is a member of a collective self-defence alliance O.
=== Examples ===
In its 2015 report, the UN group of governmental experts agreed on a formulation that “[a] State should not conduct or knowingly support ICT activity contrary to its obligations under international law that intentionally damages critical infrastructure or otherwise impairs the use and operation of critical infrastructure to provide services to the public“.<ref> UN GGE 2015 [https://documents-dds-ny.un.org/doc/UNDOC/GEN/N15/228/35/PDF/N1522835.pdf?OpenElement 'Report of the Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security report'] (22 July 2015) UN Doc A/70/174, para. 13(f).</ref> This raises the question whether a cyber operation such as the one described in this scenario infringes an obligation not to attack critical national infrastructure of other States.
However, it is
Secondly, although UN GGE reports are based on the consensus of governmental experts selected on the basis of equitable geographical representation,<ref> UNGA [http://www.un.org/en/ga/search/view_doc.asp?symbol=A/RES/68/243 Res 68/243] (27 December 2013) UN Doc A/RES/68/243, para 4.</ref> their views cannot be said to automatically reflect customary international law. The mandate of the UN GGE is decidedly not focussed on the identification of customary legal rules; rather, it includes the proposing and promoting of “[v]oluntary, ''non-binding norms'' of responsible State behaviour”.<ref> UN GGE 2015 [https://documents-dds-ny.un.org/doc/UNDOC/GEN/N15/228/35/PDF/N1522835.pdf?OpenElement 'Report of the Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security report'] (22 July 2015) UN Doc A/70/174, para 10. On the distinction between cyber rules and cyber norms, see K Mačák, ‘From Cyber Norms to Cyber Rules: Re-engaging States as Law-makers’ (2017) 30 LJIL 877, 877–99.</ref> As such, the legal valence of any normative statements found in one of the reports must be understood as minimal to none.