1. International Law in Military Operations: a NATO practitioner’s views Mr. Vincent Roobaert Senior Legal Advisor NATO Communications and Information Agency

2. Topics Legal aspects related to the right to use force in relation to cyber attacks (ius ad bellum) Legal aspects related to the conduct of cyber operations (ius in bello) 2

3. Cyber and article 5 of the NATO treaty Article 5 of the North Atlantic Treaty – represents the core of the NATO Alliance; – an armed attack against one of the Allies shall be considered as an attack against all of them While cyber had been adressed earlier (~2002), it received increased attention after the events in Estonia (2007) Currently discussed in relation to hybrid warfare. 3

4. Cyber attack as an armed attack? Discussions in MOD have led to different national policies (e.g. defensive / active defence / offensive). Attemps to develop analysis framework by academics to assist decision: – E.g., “Schmitt criteria”: list of factors that would be considered by States to determine that a cyber attack amounts to an armed attack Main challenges: absence of physical damage, difficulty to attribute, difficulty to make exact assessment of damage. – Estonia - 2007 4

5. Cyber attack as an armed attack? NATO’s position clarified at the Wales Summit in 2014: “[…] Cyber attacks can reach a threshold that threathen national and Euro-Atlantic prosperity, security and stability. Their impact could be aas harmful to modern societies as a conventional attack. We affirm therefore that cyber defence is part of NATO’s core tasks of collective defence. A decision as to when a cyber attack would lead to the invocation of Article 5 would be taken by the Noth Atlantic Council on a case-by-case basis”. 5

6. Rules of cyber conflict (i) Curent law not always adapted to cyber: – e.g., definition of object under Additional Protocol 1 covers physical object – How do we translate requirement to bears arm openly in a cyber environment States will need to adapt the old rules to the new technical reality. 6

7. Rules of cyber conflict (ii) Tallinn Manual is one among other attempts to clarify / interpret the law; – Tallinn 1.0: focus on armed conflict – Tallinn 2.0 (to be published): will cover also actions below the threshold of armed conflict. Tallinn manual is not a NATO document. It does not represent NATO doctrine. Tallinn manual states the law as it is, not as it should be. States retain responsiblity to develop the rules. 7

8. NATO RoEs and cyber Current NATO RoEs on cyber are found in MC 362/1 under the heading of “Information Operations” RoEs need to be implemented in order to be mission specific – link with NATO Cyberdefence policy; – national caveats (defensive / offensive cyber); – difficulties in attribution and prohibition to intrude into other networks (MC 362/1). 8

9. Thank you!!! Vincent ROOBAERT Senior Legal Advisor NATO Communications and Information Agency vincent.roobaert@ncia.nato.int 9