Malicious Cyber Operations, “Hackbacks” and International Law: An Austrian Example as a Basis for Discussion on Permissible Responses

Abstract

In January 2020, Austria publicly announced that some of its governmental institutions have been hit by a significant malicious cyber operation and that it cannot be denied – at least for the moment – that a state was behind this operation. One month later, the Austrian Foreign Ministry declared the cyber operation to be officially over. While Austria noted that it took “countermeasures” against the operation, it is not entirely clear what it meant by that. This article elaborates the question what response options a state like Austria would have against a malicious cyber operation under the current framework of international law. It, hence, tries to answer when a “hackback” is lawful under international law and when it is not.

Plea of Necessity: Legal Key to Protection against Unattributable Cyber Operations

“…23 Thus, a prerequisite for the application of countermeasures is the attributability of the cyber operation to a state. 24 As noted above, the attributability of cyber operations is highly problematic, and countermeasures will therefore often not be available. Even if the cyber operation was attributed to a state, the countermeasures would still have to conform to other conditions: proportionality 25 and the prohibition of the threat or use of force.…”

“…2: "There is an internationally wrongful act of a State when conduct consisting of an action or omission: (a) is attributable to the State under international law; and (b) constitutes a breach of an international obligation of the State. "24 ARSIWA 2001 with commentaries, Art. 22, p. 75, para.…”