34 Fifth Report Annex B “armed attacks” require analogous “violent” effects to those deemed to pass these thresholds in the past. The issue is how to handle novelties in the scale or effects of cyber operations (i.e., those operations that are not akin to either past kinetic operations—which surpassed the use of force threshold—nor economic or political sanctions—which did not). How should international law regard such cyber operations? Should they be placed, by default, below the use of force threshold or above it? Or, is further investigation and analysis needed to bifurcate cyber operations in this new “grey zone,” treating some of these novel operations as above, and others below, relevant thresholds?19 Thus, this question sought to acquire State perspectives on whether to define cyber operations as uses of force (or armed attacks) entirely by analogy to previous cases or to devise some new standard for doing so. 12. Bolivia, Chile, Guatemala, Peru, and the United States are all clear that both the prohibition on the use of force and the inherent right of self-defense in response to an “armed attack” may be triggered by cyber operations alone.20 As Guatemala explained: [A] cyber operation in and of itself can qualify as a use of force, since “use of force” does not exclusively mean physical See Michael N. Schmitt, Grey Zones in the International Law of Cyberspace, 42 YALE J. INT’ L. 1 (2017). 20 Bolivia Response, supra note 1, at 2-7 Chile Response, supra note 1, at 1 (Chile will refrain from using force “through cyberspace” in a manner that is against international law and will exercise “its right to self-defense against any armed attack carried out through cyberspace”); Guatemala Response, supra note 1, at 2; Peru Response, supra note 1, at 1-3; Koh, supra note 1, at 595 (Stating the U.S. view that (a) “Cyber activities may in certain circumstances constitute uses of force within the meaning of Article 2(4) of the UN Charter and customary international law”; and (b) “[a] State’s national right of self-defense, recognized in Article 51 of the UN Charter, may be triggered by computer network activities that amount to an armed attack or imminent threat thereof.”); 2014 US GGE Submission, supra note 1, at 734; Egan, supra note 1, at 816 (suggesting 2015 UN GGE also endorsed the right of self-defense). Ecuador also responded to the question affirmatively, but cited the definition of “armed attack” used in Article 92 of Tallinn 2.0, which defines that term in the context of an armed conflict (i.e., the jus in bello) – a distinct usage of the term from its expression in UN Charter Article 51 and the jus ad bellum. See Ecuador Response, supra note 1, at 1; MICHAEL N. SCHMITT (ED.), TALLINN MANUAL 2.0 ON THE INTERNATIONAL LAW APPLICABLE TO CYBER OPERATIONS (2017) (“Tallinn 2.0”); see also ICRC, Report on International Humanitarian Law and the Challenges of Contemporary Armed Conflict. In its OEWG comments, Colombia expressed the idea that self-defense is “essential to maintaining peace and stability in the ICT environment.” Colombia Comments, supra note 5. 19 Inter-American Juridical Committee force; it also covers threats to and violations of the security and protection of third parties . . . there is a right of legitimate defense against a cyber attack or operation against a country’s sovereignty.21 The 2014 U.S. Submission to the GGE emphasized its understanding that the “inherent right of self-defense potentially applies against any illegal use of force” suggesting a single threshold for both rules.22 This stands in contrast to States that view all armed attacks as uses of force but not all uses of force as armed attacks (the latter are said to involve only the “most grave” forms of a use of force).23 The United States also emphasized that its inherent right of self-defense can be triggered by cyber activities that “amount to an actual or imminent armed attack” and regardless of “whether the attacker is a State or non-State actor.”24 13. In contrast, Guyana’s response expressed doubts about the applicability of the jus ad bellum to cyber operations alone. Relying on Black’s Law Dictionary for a definition of force as “power dynamically considered,” Guyana indicated that a cyber operation “by itself may not constitute a use of force.”25 Similarly, it defined an armed attack as involving “weaponry” and to the extent “no physical weaponry is involved” in a cyber operation, it may not be considered an armed attack triggering self-defense.26 At the same time, Guyana did emphasize that cyber operations could be used in armed conflicts and governed by international humanitarian law (IHL).27 Guatemala Response, supra note 1, at 2; accord Peru Response, supra note 1, at 3 (citing the ICRC and Michael Schmitt for the idea that uses of force are not limited to kinetic force). 22 Koh, supra note 1, at 597. 23 See Military and Paramilitary Activities in and Against Nicaragua (Nicaragua v. U.S.) [1986] ICJ Rep. 14, 191 (June 27) (describing armed attacks as “the most grave forms of the use of force.”). 24 2014 US GGE Submission, supra note 1, at 734-5. The submission also reiterates the “unwilling or unable” test for engaging in self-defense against a State without its consent where “a territorial State is unwilling or unable to stop or prevent the actual or imminent attack launched in or through cyberspace.” Id. at 735. 25 Guyana Response, supra note 1, at 2. 26 Id. 27 See id. at 3, 5. 21 International Law and State Cyber Operations 35