Posts by Natasha Gooden

Cyberlaw wonks squint at NotPetya insurance smackdown: Should 'war exclusion' clauses apply to network hacks?

Re: Hopefully a cyber attack will be found to be an act of war

The interesting nature of the case highlights how a cyber attack can have many different effects and legal implications.

Whilst for companies and from a consumer protection perspective it may be attractive for the court to rule in favour of there being an act of war.

However, from the international law perspective extending the traditional boundaries regulation hostilities and warfare could be detrimental. To date, States have not affirmed that any cyber-attacks have reached the level of cyberwarfare. Attribution within international law is extremely challenging in the cyber domain and more often portray political agendas. Therefore, from an international legal perspective, it would not be surprising if the attack is not found to be an act of war.

The case itself does raise many questions and highlights how there is no clear cut position between 'cyberwar' and 'cyber peace'.

States themselves have been reluctant to define any acts as meeting the threshold for war. Which could be due to the complexities of the regulation which would then become applicable to the situations. As it can be seen in the article cyber activities do push the boundaries of the traditional regulation.

A further problem you highlighted is in regard to States/governments and how to respond. Most cyber activities are deemed below the threshold therefore with regard to an international legal response; countermeasures are becoming the most suitable response, although they are not without their legal burdens. However, with the involvement of private eneities, and this case directly this position is only challenged further. Therefore, due to the legal and policial ramifications it will cause it may be unlikely that the court does find the attacks to be an act of war.

Re: Prove it

I also agree - identifying and proving Russia's State involvement will be complex.

Attributing a cyber attack to any State or private entity is a notorious challenge in cyberspace and often very political in nature within international law. This may be why States have not found that cyber-attacks/cyber wars to have reached the thresholds to date. Whilst then allowing States may then use cyber means in their favour to continue without facing a legal burden. The court proceedings and the outcome will be highly awaited.

Re: It doesn't matter if it's war

Whilst the case itself does concern a contractual dispute, the journal wanted to highlight how within the domestic or international legal field many terms are used to describe 'cyber-attacks', 'cyber hostilities' and also 'cyber warfare'. Often the terms are used interchangeably by different actors as there is currently no consensus surrounding definitions.

With regards to the International Humanitarian Law aspect, the journal portrays the significant change within modern warfare and also how the lines of conflict and hostilities are being blurred beyond the parameters of traditional regulation. Where a range of actors, such as private companies and other Non-State Actors are affected by cyber-attacks. It reflects the current legal hurdles both States and private companies face in protecting and responding to cyber-attacks - where currently there are no clear cut answers in the international legal framework.

To date, States have been reluctant to define cyber warfare, therefore the courts ruling may provide insight into further understanding at the international level and also bring together understanding from different legal regimes and also different fields that attempt to regualte cyber issues.