Academic journal article The Yale Law Journal

Duties Owed: Low-Intensity Cyber Attacks and Liability for Transboundary Torts in International Law

Academic journal article The Yale Law Journal

Duties Owed: Low-Intensity Cyber Attacks and Liability for Transboundary Torts in International Law

Article excerpt

NOTE CONTENTS  INTRODUCTION  I. THE PUZZLE OF LOW-INTENSITY STATE-SPONSORED CYBER ATTACKS     A. The Problem    B. The Gap in International Law  II. LIABILITY IN INTERNATIONAL LAW     A. Liability and the Duty To Prevent and Redress Transboundary       Harm    B. Liability and the Articles on State Responsibility    C. Dual Liability Standards  III. APPLYING LIABILITY FOR TRANSBOUNDARY HARM TO LOW-INTENSITY STATE-SPONSORED CYBER ATTACKS     A. Contemporary Approaches and Cyber: An Absurd Result?    B. Applicability to Low-Intensity State-Sponsored Cyber Attacks    C. Complications of a Liability System        1. The Issue of Intent       2. Scale of Damages       3. Enforcement  IV. THE BENEFITS OF INTERNATIONAL LIABILITY     A. Pragmatic Appeal to States and Emphasis 011 Redress    B. Clarification of the Law of Countermeasures    C. Recognition of Duties Owed to Third Parties  CONCLUSION 


On November 24, 2014, a menacing red skull flashed on every employee's screen at Sony Pictures Entertainment's headquarters in Culver City, California. The attackers, calling themselves the "Guardians of Peace," scrubbed more than one hundred terabytes of Sony's data and leaked thousands of confidential documents. (1) The attackers threatened to release more documents if Sony did not stop the release of The Interview, Sony's newest political-satirical film on North Korea, and made clear their intention to cause further harm and even violence. (2) In the end, many theaters caved to the attackers' demands, refusing to screen the film--but not before the attacks resulted in tens of millions of dollars in damage, (3) including the destruction of Sony data systems, (4) the corruption of thousands of computers, (5) the loss of millions of dollars in revenues, (6) and leaked trade secrets. (7)

In the aftermath of the attack, the U.S. government made an unprecedented accusation, officially attributing the Sony attack to the government of North Korea. (8) After an FBI investigation that linked the attack's code, infrastructure, and overall design to previous attacks that were believed to have been carried out by North Korea, (9) the State Department officially condemned North Korea on December 19, 2014. (10) In a special press release, President Obama vowed that the United States would respond proportionally in the arena of its choosing. (11)

International legal and technology experts have since hotly debated the attribution of the Sony attack. Some have claimed that the United States misattributed or prematurely attributed the attack to North Korea. (12) Others have noted that the United States's actions could set a dangerous precedent. (13) In any case, observers recognize that the United States's response was a key example--now one of a steadily growing number (14)--of a state officially accusing another of a cyber attack. (15) Yet even if attribution is possible, a more pressing question for international law emerges: what international law has North Korea violated by committing this attack?

As surprising as it may seem, the traditional international legal perspective seems to answer "none." (16) Despite the increasingly common and destructive nature of state-sponsored cyber attacks, (17) it is difficult to locate the precise source of illegality for these "low-intensity" cyber attacks. (18) In the language of the Draft Articles on State Responsibility, states are only responsible for acts attributable to the state that are "wrongful" under international law. (19) Low-intensity state-sponsored cyber attacks do not fit this bill. Scholars have recognized this "gap" for low-intensity cyber attacks and sought solutions. Some have tried to broaden current international legal categories of impermissible conduct to cover these attacks. (20) Others have declared that a new treaty or legal regime is needed before international law can render low-intensity attacks wrongful. (21) Neither approach has proved satisfactory thus far. …

Search by... Author
Show... All Results Primary Sources Peer-reviewed


An unknown error has occurred. Please click the button below to reload the page. If the problem persists, please try again in a little while.