Foreign Cyber Interference in Elections: An International Law Primer, Part II

Part I of this series examined attribution as the first element of cyber election interference as an internationally wrongful act, and then looked at the prohibition of intervention as a possible primary rule that such interference can breach. Now, in Part II, I will examine the possible breaches of the obligation to respect sovereignty and of international human rights law.

Obligation to Respect Sovereignty

Foreign activities in cyberspace might also violate the rule of sovereignty. Before discussing how, it must be cautioned that one state, the United Kingdom, has rejected the proposition that cyber activities can amount to a violation of sovereignty, relying instead on the rule of intervention to serve as the bulwark against foreign election interference. However, that stance, which has been discussed in depth elsewhere (see, e.g., here and here), has not been adopted by any other state. On the contrary, a growing number of states, including France,  the Netherlands, Germany, Iran, the Czech Republic, Austria, and Switzerland, have taken the opposite position, and, seemingly, so has NATO (with the UK reserving). The analysis that follows proceeds on the basis that the requirement to respect the sovereignty of other states is a primary rule of international law (see Tallinn Manual 2.0, Rules 1-5).

Max Huber famously set forth the classic definition of sovereignty in the 1928 Island of Palmas arbitration: “Sovereignty in the relations between States signifies independence. Independence in regard to a portion of the globe is the right to exercise therein, to the exclusion of any other State, the functions of a State.” This formulation contains within it both instances of how sovereignty can be violated.

First, sovereignty can be violated based on an infringement of territorial integrity and inviolability. There is general agreement that a cyber operation causing physical damage or injury in another state qualifies as a violation of its sovereignty. Consensus also appears to have coalesced around treating a relatively permanent loss of functionality of cyber infrastructure as the requisite damage (see, e.g., Czech Republic, France). While physical damage is unlikely in the election interference context, the US government has warned that foreign governments may try to compromise election infrastructure (functionality) in the upcoming elections.

Unfortunately, there is no such consensus as to a loss of functionality that is temporary or that causes the affected cyberinfrastructure to operate in a manner other than intended, as in making it operate slowly or generate spurious results. This is problematic because such consequences can be expected of election-related hostile cyber operations, a real-world example being the denial of service attacks targeting Ukraine in 2014.

France has addressed hostile cyber operations generating consequences of this nature in its legal doctrine. In 2018, the Ministry of the Armies noted that it would treat “[a]ny cyberattack against French digital systems or any effects produced on French territory by digital means” that is attributable to a state as a breach of its sovereignty. While the precise parameters of the standard are indistinct, France presumably would treat a cyber operation targeting its government election hardware or software or that causes “effects” on other systems, such as a denial of service operation directed at a campaign’s website, as a breach of its sovereignty. It remains to be seen whether other states will be willing to go as far in interpreting the territorial aspect of the sovereignty rule.

Second, sovereignty may be violated by cyber activities that interfere with, or usurp, an “inherently governmental function” of the target state. The issue in the election context is interference. An inherently governmental function is one that only states may perform or authorize non-state entities to carry out; conducting elections clearly qualifies. Importantly, there is no requirement that the interference rises to the level of coercion, as is the case with the prohibition of intervention – any interference with the state’s ability to perform the function qualifies. And unlike the violation of sovereignty on the basis of territoriality, there is no requirement of any particular physical or functional effects. The only essential consequence is interference itself.

It is not altogether clear whether all interference with an election is encompassed in the rule. Of course, a foreign state’s cyber activity that directly diminishes the government’s ability to conduct the election violates that state’s sovereignty on this basis. Examples include temporarily disrupting the proper functioning of election hardware and software, blocking access to online government information about the election, and altering that information.

It is somewhat unsettled as to whether cyber activities that are not directed against the government’s systems can violate sovereignty. It would seem reasonable that those that indirectly disrupt the smooth execution of the election, such as voter suppression activities, would qualify. As an example, posting incorrect information as to how, where, or when to vote could fairly be characterized as interfering with the state’s ability to conduct the election.

The open question is whether cyber activities that involve information or disinformation that does not affect the manner in which the election is carried out ever violate sovereignty. Consider, for instance, operations designed to foster societal division, as in exploiting racial fault lines by means of “dog whistles.” If such operations are causally related to the requisite consequences (e.g., by inciting riots that cause damage or injury), a violation of the rule might possibly be made out, but even this remains uncertain.

Obligations to Respect Human Rights

There is widespread consensus that human rights must be respected and protected online as they are offline (see, e.g., 2015 GGE Report; 2012, 2014, 2016, 2018 Human Rights Council; Tallinn Manual 2.0, Rules 34-38). Several specific rights loom large in the online election interference context – the freedom of expression; the right to privacy; the right of citizens to participate in public affairs, vote and stand for elections; and the right of all peoples to self-determination. However, the applicability of human rights to cyber election interference operations may be questioned on grounds of extraterritoriality, a much-contested issue in various other contexts. Each of these points will be addressed in turn.

Freedom of expression is guaranteed by both treaty and customary international law. It is enshrined in such instruments as the International Covenant for Civil and Political Rights (art. 19), the Universal Declaration of Human Rights (art. 19) and regional treaties like the European Convention on Human Rights (art. 10). As described in Article 19(2) of the ICCPR, it encompasses the “freedom to seek, receive and impart information and ideas of all kinds, regardless of frontiers, either orally, in writing or in print, in the form of art, or through any other media of his choice.”

States that interfere with elections abroad implicate the freedom of expression when they, for instance, interfere with candidates’ online campaigns (impart) or alter or erase online information about candidates that voters wish to access (seek). As to states countering foreign online election interference, any activity that impedes online expression, such as requiring internet service providers or social media companies to filter, delete, or label data posted or transmitted by the interfering state, must itself be justifiable pursuant to the human rights standards described below.

Like the right to freedom of expression, the right to privacy is a customary right that also finds expression in treaty law (e.g., ICCPR, art. 17; UDHR, art. 12; ECHR, art. 8). It too can be implicated by election interference, as was well illustrated by the exfiltration and public dissemination of private email during the 2016 US presidential elections.

Both treaties and customary law also guarantee the right of all citizens to participate in public affairs, to vote in elections and to stand for election (e.g., ICCPR, art. 25; UDHR, art. 21; ECHR Protocol 1, art. 3; American Convention on Human Rights, art. 23). While international case law has historically focused on internal interference with these rights, there is no reason in principle to exclude interference by third states from their scope (on the extraterritoriality point, see below). Thus, for example, cyber operations resulting in voter suppression would directly impede enjoyment of the right to vote. As for influence operations, the Human Rights Committee has noted (General Comment No. 25, para. 19) that “[v]oters should be able to form opinions independently, free of violence or threat of violence, compulsion, inducement or manipulative interference of any kind (emphasis added).”

None of the aforementioned individual rights are absolute. States may limit their exercise or enjoyment by measures that pursue a legitimate aim, are necessary to achieve that aim, are prescribed by law, and are proportionate (see, e.g., General Comment No. 34, para. 22). However, it is extremely unlikely that electoral interference by a foreign state could satisfy these requirements, if only because it would not be pursuing an aim regarded as legitimate under human rights law.

It has been suggested that the human right to self-determination, which again is protected both by customary and treaty law (ICCPR, art 1; International Covenant on Economic, Social and Cultural Rights, art. 1; UN Charter, arts. 1 and 55), might be implicated by foreign election interference. Self-determination includes the right of a people to determine their own political arrangements. Those taking the position that the issue of self-determination surfaces in the context of foreign election interference do so on the basis that elections represent the sovereign will of a people with respect to the nature of their governing political system and, therefore, disrupting them interferes with their exercise of self-determination.

The argument is facially plausible, but this interpretation of the right presents numerous challenges. It is a collective, not individual, right, which raises issues as to its enforcement; the right typically applies in the context of the emergence of a state; there are practical difficulties in determining that the interference actually blocked the will of the people; and it is unclear whether the concept of a “people” in international law, which is already unsettled, can refer to the entire population of an established state or only to a sub-group. Nevertheless, this is an interesting proposition that could gain traction in the face of chronic foreign election interference by cyber means, especially when such interference is systematic and large-scale.

Whether any of these human rights apply to foreign cyber election interference depends on the contentious issue of extraterritoriality, that is, whether states owe human rights obligations to those in the territory of another state. After all, election interference operations by a foreign state are extraterritorial by definition. Of course, in the case of specific treaty obligations the answer is to be found through interpretation of the instrument’s jurisdictional provisions. The discussion that follows takes on the issue in a general sense.

Restrictive views on the matter hold that human rights do not apply extraterritorially. The United States, for example, has long taken this position with respect to the ICCPR (but see a 2010 US State Department Legal Adviser memorandum). The European Court of Human Rights adopted a somewhat less restrictive (but still restrictive) position regarding the European Convention on Human Rights in the Bankovic case, which involved the right to life. By the restrictive approaches, even if election interference by cyber means theoretically implicates human rights such as the freedom of expression or the right to privacy, it would not be unlawful because the relevant treaties would not apply in the first place.

The various opposing views argue that extraterritorial cyber operations are covered by human rights law. Under one, the negative obligation to respect human rights (i.e., to refrain from conduct) simply should be understood to apply extraterritorially. By a second, termed the “functional approach,” control over the exercise or enjoyment of rights provides a basis for their application (for a discussion of both views, see here). For instance, with respect to the right to life, the Human Rights Committee has interpreted state jurisdiction under the ICCPR as reaching “all persons over whose enjoyment of the right to life [the state] exercises power or effective control. This includes persons located outside any territory effectively controlled by the State, whose right to life is nonetheless impacted by its military or other activities in a direct and reasonably foreseeable manner.”

The same logic could be applied to rights such as the freedom of expression or privacy that are implicated by foreign election interference, as they may be impacted as described above by the remotely conducted election interference. Indeed, three distinguished officials have recently asserted that “[t]he right to freedom of expression, which includes the right to seek, receive and impart information and ideas of all kinds, regardless of frontiers, through any media, applies to everyone, everywhere.” In this regard, as the Human Rights Committee has noted, it would seem “unconscionable” to interpret human rights law to permit a state to violate human rights on the territory of another state in a way that it “could not perpetrate on its own territory” (see also the German Federal Constitutional Court’s judgment on the extraterritoriality of the Basic Law, in which the Court held that fundamental rights protections apply to surveillance operations abroad, thereby making any subsequent legal policy not to extend protections to other types of transnational cyber operations difficult to reconcile with the judgment).