In the past few years, States’ legal positions on international law in cyber-space have addressed the application of countermeasures. In this context, some States have put forward the claim that injured States may rely on their allies in the taking of countermeasures against the wrongdoing State. Countermeasures, say these States, can be taken individually or collectively. ‘Collective countermeasures’ is the term that has been gaining ground in practice and in the literature to refer to the collaboration between States in the taking of countermeasures. The use of this label to refer to the idea of collaboration between States in the taking of countermeasures is problematic, insofar as it elides some legal and conceptual distinctions that are key to assessing the legality of collaboration in this field. First, it does not distinguish the different forms that collaboration can take: from joint action by two (or more) States, to aid and assistance, to the (more radical) idea that a State may take countermeasures on behalf of another (what we will refer to as ‘proxy countermeasures’). Second, it fails to distinguish between the bilateral and multilateral character of the obligation initially breached.
In this article, we ask whether and, if so, under what conditions States may collaborate in the taking of countermeasures against another State. We assume that the injured State is entitled to take countermeasures against the wrongdoing State, so the question that arises is that of the permissibility for a third State (State C) to collaborate with the injured State in the taking of countermeasures against the wrongdoer. We structure the analysis around the two distinctions mentioned. First, in considering the position of the third (collaborating) State, we distinguish three forms of collaboration:
(a) where two States jointly take a countermeasure;
(b) where one State assists another State in taking a countermeasure; and
(c) where one State takes a countermeasure at the request and on behalf of another State.
In practice these will often be blurred, but at a doctrinal level, it is important to distinguish these factual situations since the legal rules applicable to each vary and the permissibility of State C’s conduct may – and does, as we will argue – differ from case to case.
Second, in assessing the legality of State C’s conduct in connection with the injured State’s countermeasures, we consider whether State C has an entitlement in its own right to take a countermeasure in response to the wrongdoing State’s initial breach:
(i) State C would have such an entitlement if the obligation breached by the wrongdoing State was owed erga omnes or erga omnes partes, including to State C.
(ii) State C would not have such an entitlement where the obligation breached was owed bilaterally as between the injured and wrongdoing States.
Whether States other than an injured are permitted to resort to countermeasures against the wrongdoer for the breach of an erga omnes obligation is still controversial. We will assume, for the sake of argument, that this is now accepted at customary law (if it were not, then all situations of collaboration would be analysed under scenario (ii)).
As we will argue, the cases where State C is entitled to take a countermeasure in its own right – that is, where the prior affects an obligation erga omnes – are straightforward. In all cases, State C acts permissibly, assuming all other conditions for the taking of countermeasures are met. By contrast, the cases where State C does not have an independent entitlement to take a countermeasure are much more complex and the law is, in many respects, uncertain. We conclude by turning to broader considerations, including those animating this development in the cyber-sphere. In thinking about development of the law, we flag some considerations that States may wish to bear in mind.
