Cyber101x Cyberwar, Surveillance and Security - Week 3 - Surveillance and National Security - International Law and Surveillance

INTERNATIONAL LAW AND SURVEILLANCE ACTIVITY



 DALE STEPHENS: In this module, we will be looking at the issue of international law and the conduct of surveillance. In an earlier module, we examined the national laws prohibiting surveillance within a country. While metadata collection was generally permitted and accessible by national security and law enforcement agencies, access to content required a warrant or some other very specific legislative permission. Do these rules and principles apply when conducting surveillance overseas? As I have previously outlined, the Five Eyes arrangement functioned as a collective intelligence gathering and sharing process. Intercepting signals intelligence and conducting surveillance and reconnaissance of other countries' military and government activities was the means of collecting this intelligence. Indeed, I mentioned that intelligence gathering and sharing arrangements were common around the world. Are these practices of conducting surveillance unlawful under international law? The short answer to that question is No. International law does not have any express prohibition of one state observing the activities of another state provided that certain conditions are met. This is to be contrasted with domestic law that does have something to say about this activity. In every nation of the world, there is undoubtedly some national law that makes espionage or the taking of state secrets a domestic crime. There is no international crime of espionage. International law is, however, very protective of rights of territorial integrity. The Convention on International Civil Aviation, also known as the Chicago Convention, reaffirms the principle of state sovereignty of national airspace. Accordingly, all states enjoy sovereignty over their land territory and associated airspace which extends over the land territory to the edge of their territorial sea limits, generally 12 nautical miles from the shore baseline. Hence, overflight of land territory or territorial sea limits by a foreign aircraft amounts to a breach of sovereignty and may, depending on the circumstances, constitute a breach of the principle of non-intervention. State practice in relation to responding to aerial trespass is patchy and accepted international opinion to host state reaction seems to be predicated upon the character of the over-flying aircraft. Namely, whether it is military or civilian, as well as the military significance of the area being overflown. Following the Soviet shoot down of Korean airliner KAL 007 in 1983, ostensibly on the grounds of its spying activity, world reaction was inflamed and almost universally negative. An amendment was added to the Chicago Convention in 1984 that directed that states party to the convention must refrain from resorting to the use of weapons against civil aircraft in flight. That in case of interception, the lives of persons on board and the safety of aircraft must not be endangered. It did also reaffirm that international rights under the UN charter were not affected by this amendment. Thus, indirectly acknowledging the rights against physical surveillance intrusion. The conduct of military reconnaissance by surface or subsurface vessels in the territorial sea limits of a state is subject to its own regulation under the UN Convention on the Law of the Sea. Military reconnaissance that occurs in the territorial sea limits of a coastal state that is aimed at collecting information to the prejudice of the coastal state's defence or security network is expressly deemed to be non-innocent passage under the Law of the Sea Convention. So, outside the national airspace or territorial sea limits of a state, international law is silent as to the conduct of physical surveillance or reconnaissance activity. Such silence suggests that there is a tacit acceptance of the right of nations to undertake such activity. In 2001, an incident involving the United States and China brought this issue into focus. In that instance, a US Navy EP-3 surveillance aircraft conducting surveillance activity outside of the territorial sea limits of China, but within the 200 nautical mile exclusive economic zone of China, collided with a Chinese F-8 fighter, causing the crash of the fighter and the loss of the pilot. Following this incident, the Chinese argument was that the US reconnaissance flight did not have 'due regard' to the security interests of China. And that such flights within this zone were not directed towards 'peaceful purposes'. The US countered that surveillance within this zone was legally permitted, and that 'due regard' was had to Chinese sovereign economic rights. The US took the position that routine surveillance activity did not constitute a use or threat to use force under international law. And hence, was consistent with the 'peaceful purposes' provision of the UN Convention on the Law of the Sea. The preponderance of academic opinion supported the US position, reaffirming the idea that outside of the territorial sea limits there existed no prohibition on physical surveillance activity. Though, what of surveillance that occurrs through cyber means, is that caught by current international law restrictions? There is no direct answer to that question, although there is no treaty or general customary international law prohibition. In fact, in the context of outer space and remote surveillance outside of national limits, the Soviet Union did initially assert that satellite surveillance was unlawful. That it violated the peaceful purposes requirements of the outer space treaty. But state practice has resolutely gone the other way. Not only is satellite surveillance not considered to be a violation of the outer space treaty, but other treaties dealing with arms limitations and reductions acknowledge the use of satellites for ensuring verification of obligations. In the context of cyber surveillance, original rules continue to apply. And as long as there is no physical trespass in the territorial regions of a state, then there is no prohibition. Of course, in the cyber context, data flows across and through servers in many countries. There is a right of non-intervention that exists in international law that might apply to prohibit interception of data in a foreign state. Though, that is not how the rule has traditionally applied. In the Nicaragua case, the International Court of Justice when examining this right determined that the principle was based on a conception of coercion. That a prohibited intervention was one that uses methods of coercion to compel certain choices by the subject state. This coercion was seen in the context of force and caught issues such as providing training or even funding to rebel groups. This is not the case with cyber surveillance, which is a passive activity of observation. Hence, it would seem that international law does not expressly prohibit states from engaging in surveillance of other states provided that physical territorial limits are respected. Despite this conclusion, it is also clear that in the context of cyber surveillance, that traditional targets of intelligence gathering, namely military installations and activities or government processes, are not the exclusive focus any more. Ironically, while cyber capabilities have developed exponentially over the past few years, there seems to be an inbuilt rationalisation between states as to its use vis-a-vis other state players. Indeed, in the area of cyber attacks, the notion of one state engaging in an all-out cyber offensive seems unlikely. As Professor Jack Goldsmith of Harvard Law School explains, the interdependence by states in the modern world makes this an increasingly unlikely situation. Let's turn to what he has to say on this issue. JACK GOLDSMITH: France has nuclear weapons. And Russia has nuclear weapons. They both have capabilities just in terms of capacities to use nuclear weapons against the United States. We don't worry about France using those weapons. It's not just capabilities that you focus on. It's also interest. Do they have an incentive to use them? Because of our relationship with France, we just don't worry about those nuclear weapons. I think a lot of the cyber situations are like that. We have growing capacities, enormous capacities from nations to do lots of harm to one another. But the question is, why would they? Why would the Chinese bring down the US banking system? It would harm their economy if they did that. Why would the US do that to the Chinese? So it's not enough to have capacities. There also have to be the incentives to use those. Now, that's not a completely happy story because there may be rogue nations that are willing to cause harm because they have little to lose. And most importantly, there may be non-state actors-- terrorist organisations, individuals, criminal gangs, all these entities are increasingly powerful in this space and are less invested in the state system and some of the critical infrastructure of a state. And for a certain price, either in terms of money or in terms of political or ideological gain, they may be willing to do quite a lot of harm. So even in the absence of robust treaties in this area, which I think are going to be very hard, if not impossible, to achieve, I think there's going to be a lot of self-restraint. Not necessarily in the espionage and theft area, but in the actual disruption and attack area. The real threat comes from non-state actors, I think. Or from rogue nations. DALE STEPHENS: As Professor Goldsmith has explained, the overall focus in the current threat climate is less on state capabilities and more on non-state actors and individual threats. Hence, the attention has turned to undertaking surveillance on these actors which necessarily requires individualised tracking. It is this very personal focus that has promoted legal concerns. Not surprisingly, the main arguments of resistance emanate from the human rights world. Recently, there has been tremendous advocacy that Article 17 of the International Covenant on Civil and Political Rights applies to limit such surveillance. Article 17 deals with rights of privacy. And its focus says much about modern surveillance capabilities and the personal nature of cyber operations. Article 17 is not absolute, however. And the terms used in the article, like 'arbitrary' and 'unlawful', condition its interpretation. Obtaining the balance between privacy and national security, which characterises this topic generally, also finds expression in how Article 17 may be understood.