8 Improving Transparency: International Law and State Cyber Operations differ (sometimes dramatically) on how they interpret the application of those rules to State and state-sponsored cyber operations. 6. States appear just as reluctant to invoke the language of international law in making accusations about other State’s cyber operations.6 In one notable exception, in 2018 five states (Australia, Canada, the Netherlands, New Zealand, and the United Kingdom) accused the GRU—Russia’s military intelligence arm—of responsibility for a series of cyber operations, including those targeting the Organization for the Prohibition of Chemical Weapons (OPCW) and the World Anti-Doping Agency (WADA). The U.K. Foreign Secretary suggested that Russia had a “desire to operate without regard to international law or established norms” while the Netherlands suggested, more broadly, that these Russian activities “undermine the international rule of law.”7 Unfortunately, these accusations did not delineate whether all of the GRU’s alleged operations violated international law or if only some did; nor did they See Dan Efrony and Yuval Shany, A Rule Book on the Shelf? Tallinn Manual 2.0 on Cyber-Operations and Subsequent State Practice, 112 AJIL 583, 586 (2018); Duncan B. Hollis & Martha Finnemore, Beyond Naming and Shaming: Accusations and International Law in Global Cybersecurity, 33 EURO. J. INT’L L. (forthcoming 2020). 7 Press Release, Foreign Commonwealth Office, UK exposes Russian cyber-attacks (Oct. 4, 2018), at https://www.gov.uk/government/news/uk-exposes-russian-cyber-attacks; National Cyber Security Centre (NCSC), Reckless campaign of cyber attacks by Russian military intelligence service exposed (Oct. 4, 2018), at https://www.ncsc.gov.uk/news/reckless-campaign-cyber-attacks-russian-military-intelligence-service-exposed; Netherlands Ministry of Defense, Netherlands Defence Intelligence and Security Service disrupts Russian cyber operation targeting OPCW (Oct. 4, 2018), at https://english.defensie.nl/latest/news/2018/10/04/netherlands- defence-intelligence-and-security-service-disrupts-russian-cyber-operation-targeting-opcw. Canada’s accusation incorporated both formulations. Press Release, Global Affairs Canada, Canada identifies malicious cyber-activity by Russia (Oct. 4, 2018) at https:// www.canada.ca/en/global-affairs/news/2018/10/canada-identifies-malicious- cyber-activity-by-russia.html (Russian activity demonstrates “a disregard for international law and undermine[s] the rules-based international order.”). In contrast, Australia and New Zealand accused Russia of “malicious cyber activity” without referencing international law at all. See, e.g., Press Release, New Zealand Government Communications Security Bureau, Malicious cyber activity attributed to Russia (October 4, 2018), at https://www.gcsb.govt.nz/news/malicious-cyber-activity-attributed-to-russia/; Media Release, Prime Minister of Australia, Attribution of a Pattern of Malicious Cyber Activity to Russia (Oct. 4, 2018), at https://www.pm.gov. au/media/attribution-pattern-malicious-cyber-activity-russia. 6 Inter-American Juridical Committee Fifth Report elaborate which international laws the accusers believed were violated. Most cases, however, are like the recent Canadian, U.S. and U.K. accusations that the GRU has targeted COVID-19 vaccine research – there is no mention of international law whatsoever.8 7. In recent years, a number of States have begun to offer some elaborations on how they understand international law applies in cyberspace. Beginning in 2012, the United States began to offer its views in a series of official speeches and statements.9 In 2018, the United Kingdom’s Attorney General made an important statement of U.K. views.10 In the ensuing years, other (mostly European) States have begun to offer their own detailed perspectives, including See, e.g., NCSC (United Kingdom), Press Release: UK and allies expose Russian attacks on coronavirus vaccine development (16 July 2020), at https://www.ncsc.gov.uk/news/uk-and-alliesexpose-russian-attacks-on- coronavirus-vaccine-development; Communication Security Establishment (Canada), Statement on Threat Activity Targeting COVID-19 Vaccine Development (16 July 2020), at https://cse-cst.gc.ca/en/media/2020-07-16; National Security Agency Central Security Service (United States), NSA Teams with NCSC, CSE, DHS CISA to Expose Russian Intelligence Services Targeting COVID-19 Researchers (16 July 2020), at https://www. nsa.gov/news- features/press-room/Article/2275378/nsa-teams-with-ncsc-cse-dhs-cisato-expose-russian-intelligence-services- target/. 9 See, e.g., Brian Egan, Remarks on International Law and Stability in Cyberspace (Nov. 10, 2016), in DIGEST OF U.S. PRACTICE IN INT’L LAW 815 (2016); U.S. Submission to Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security (Oct. 2016), in DIGEST OF U.S. PRACTICE IN INT’L LAW 823 (2016) (“2016 US GGE Submission”); U.S. Submission to Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security (Oct. 2014), in DIGEST OF U.S. PRACTICE IN INT’L LAW 732 (2014) (“2014 US GGE Submission ”); Harold Koh, International Law in Cyberspace (Sept. 18, 2012), in DIGEST OF U.S. PRACTICE IN INT’L LAW 593 (2012). In 2020, the General Counsel of the U.S. Department of Defense offered views on several key questions of international law’s application to cyberspace. It is not yet clear, however, whether his views reflect those of the whole United States or only the U.S. Department of Defense. See Paul C. Ney, DOD General Counsel Remarks at U.S. Cyber Command Legal Conference (March 2, 2020), at https://www.defense.gov/Newsroom/Speeches/Speech/Article/2099378/dod-general-counsel-remarks-at-us- cyber-command-legal-conference/; 10 Jeremy Wright, QC, MP, Cyber and International Law in the 21st Century (May 23, 2018), at https://www.gov.uk/government/speeches/cyber-and-international-law-in-the-21st-century (“U.K. Views”). 8 International Law and State Cyber Operations 9