International Law Applied to Operations in Cyberspace

This document clarifies and explains French cybersecurity policies. In terms of Cyberoperations Against France in Peacetime, the French government “reserves the right to respond to any cyberattack against it that infringes international law” (p. 6). Specifically, France takes violations over their sovereignty very seriously, which they define as when there is information location on or involving its territory. On the flip side, France pledges to weed out non-state actors that might be using France for malicious attacks against other countries or organizations. While the international community has spoken out against the use of force for retaliation in the event of a cyberattack, France “does not rule out the possibility that a cyberoperation without physical effects may also be characterized as a use of force” (p. 7). This stance allows France more freedom to retaliate as they see fit. They specifically categorize a cyberattack as an armed attack if the attack causes “substantial loss of life or considerable physical or economic damage” (p. 8). While this disagrees with the international community, France is setting an important precedent on the damages of cyberattacks and shutting them down for good. Additionally, France vows to investigate all cyberattacks to figure out what type it was and where it came from. The international community claims that a State is responsible for cyberattacks from its borders. However, France claims that states should have the option to take credit or disavow the attack, considering they do not have complete authority over every citizen at all times.
When considering International Law Applicable to Cyberoperations in Armed Conflict Situations, France prioritizes precaution, proportionality, and restraint. While the Tallinn Manual asserts that a cyberattack is constituted if it falls within Article 49 of AP I in the Geneva Convention, France believes that a cyberattack can occur even if there is no human injury or loss of life. However, they stand by the principle of distinction, which states that there must be a separation between the civilians and combatants. In other words, a state should not shut down an entire country, which would harm the healthcare, education, and infrastructure of innocent people when they can conduct a controlled attack. Furthermore, France states that they should be able to attack back retroactively before they are attacked. Although this contradicts the Tallinn Manual, France asserts that they will not exceed what is deemed necessary to eliminate the threat. To conclude, France posits that a neutral State, just like in physical war, should not be infiltrated or attacked on the cyber level.