Scenario 3 – State B conducts a major offensive cyber operation that constitutes a serious threat to State A’s national security Amid growing tensions between State A and State B,7 the armed forces of State B conduct a major offensive cyber operation against State A, destroying servers located in State A used by State A’s military headquarters. This renders State A unable to communicate with naval vessels operating in international waters off the coast of State B. It will take several months to replace the destroyed servers, at substantial cost. International law may assist State A in the following ways: First, it provides rules of legal attribution, meaning that under the customary international law on state responsibility (as outlined in Scenario 1), the acts of the armed forces, as an organ of State B, would be attributable to State B. Second, it defines states’ rights and obligations, meaning that State B’s cyber operation may constitute an unlawful use of force contrary to Article 2(4) of the UN Charter against State A (unless such actions were taken in self-defence or authorised under a Chapter VII resolution of the UN Security Council). This would turn on whether the operation caused damage to State A’s infrastructure and objects (its military servers) and subsequent impact on the functioning of its military communications systems that was akin in scale and effects to a traditional kinetic operation that would rise to the level of a use of force. Third, assuming State B’s conduct violated international law, it would entitle State A to invoke the international legal responsibility of State B and demand that State B cease unlawful act/s (if they were continuing) and make full reparation for State A’s injuries. Reparation could entail compensation for financially assessable damage, as well as assurances or guarantees of non-repetition. As international law governs the dispute, State A may seek to pursue resolution through legal as well as political avenues including, for example, by seeking a resolution consistent with the Charter of the United Nations, including Chapter VI (Pacific Settlement of Disputes) 8 (which could include the International Court of Justice, as outlined in Scenario 1) and/or Chapter VII (Action with Respect to Threats to the Peace, Breaches of the Peace, and Acts of Aggression)9. 7 For the purposes of this scenario, there is not a state of armed conflict between State A and State B immediately prior to State B’s offensive cyber operation. 8 See note 5 above. 9 For example: Article 39 of the UN Charter provides that “The [UN] Security Council shall determine the existence of any threat to the peace, breach of the peace, or act of aggression and shall make recommendations, or decide what measures shall be taken in accordance with Articles 41 and 42 to maintain or restore international peace and security.” 5 www.dfat.gov.au/cyberaffairs