The Origins and Legal Core of Neutrality

The panel first provided a general overview of the concept of neutrality. It underlined that neutrality is a flexible, complex, multifaceted concept whose understandings and applications have evolved across various geopolitical and technological contexts. For instance, neutrality can simultaneously imply or refer to a set of legal principles (incl. rights and duties), certain behavioral traits, practices, and reputation, as well as an organization or state policy.

Reflecting on findings from a recent study on “The Law of Neutrality in Cyberspace”, published by the Center for Security Studies, the introduction of the panel noted that, traditionally, neutrality has been linked to some expectations of non-participation, impartiality, and due diligence in exchange for some protection or a guarantee of independence. Historically, however, it has also served many other functions, including ensuring continuous international commerce, promoting and fostering international peace and security, mitigating escalation, or fostering integration and social cohesion.

One core aspect of neutrality is its legal core – the law of neutrality –, which is very much state-centric. This body of law, which belongs to international humanitarian law (IHL), regulates the relations between belligerent and neutral states during an international armed conflict. It was for the most part codified in the 1907 Hague Conventions V & XIII after centuries of evolving state practice. The law provides a set of reciprocal rights and duties to the neutral and belligerent states, which include the duty for a belligerent to respect a neutral state’s inviolability in exchange for the neutral state’s non-participation, impartiality, and preventive measures against violations of its neutrality.

The application of international law to cyberspace has been widely recognized. However, the application of IHL is still disputed by some states. Nonetheless, there is a legal argument to the application of the law of neutrality to cyberspace, which goes back to the ICJ’s 1996 opinion on the Legality of the Threat or Use of Nuclear Weapons which states that  “no doubt that the principle of neutrality, whatever its content, which is of a fundamental character similar to that of the humanitarian principles and rules, is applicable […] to all international armed conflict, whatever type of weapons might be used”.

Despite this, the law of neutrality in cyberspace remains quite a niche topic. While the non-binding Tallinn manual and Oslo manual have some specific rules on neutrality in cyberspace, only six states (i.e., the United States, France, Switzerland, Romania, Italy, and the Netherlands) have referenced and addressed it explicitly in their legal opinions. From these, a core set of rights and duties can be identified. Some of these are quite undisputed, such as conducting cyber operations from or against neutral infrastructure under sovereign protection. Others, while recognized, still need further discussions to be operationalized. This is notably the case for a neutral state’s prevention duty or the issue around the legality of routing cyber operations through neutral infrastructure.

Given the complexity of neutrality and its still-undefined implications in the wider context of thinking responsible state behavior in cyberspace, we believed that the IGF was a unique space to bring a multistakeholder view to the topic. In so doing, we sought to challenge, map and test the limits of the concept by promoting a dialogue with both actors that have historically advocated for neutrality (Switzerland) with other non-governmental stakeholders that have been the object of certain protections under the agreed GGE cyber norms. 

Conceptualizing Neutrality in Cyberspace

The speakers’ opening remarks highlighted the context of increasing state-sponsored cyberattacks and broadened the discussion beyond the legal core of neutrality. Subsequently, the participants from different stakeholder groups were invited to elaborate on how they use the concept in their daily activities.

The panel member from academia started by highlighting that the old legal rules of neutrality are still applicable. However, there has been a deliberate decision not to develop them further by countries to limit their duties. Hence, the operationalization of neutrality will most likely be “forged by fire”. The speaker particularly focused on the due diligence norm and highlighted two legal cases that might be of particular importance in the future. The first is the Corfu Channel Case between the UK and Albania, whose verdict shows that due diligence does not require attribution. Second, there is the Alabama tribunal, which highlights that there is some duty to prepare and that a too-slow reaction to a cyber-incident may already result in demands for compensation.

 The government representative highlighted the fuzzy conceptual borders of cyberspace and neutrality, which means that neutrality principles still need to be made more precise and operationalized. The actor further highlighted that for a permanently neutral country such as Switzerland, the concept can also have a promotional aspect as part of its foreign and security policy. Specific questions that come up for permanently neutral states in cyberspace are often focused on the limits and thresholds of international collaboration. Joint training, exercises, and interoperability are still needed despite permanent neutrality. 

 The member of civil society viewed the concept of neutrality through the lens of humanitarian values and the protection of human rights. From this perspective, neutrality is about supporting stability in cyberspace and providing technical support and access to knowledge regardless of location, identity, or beliefs. In terms of the on-the-ground practice this translates into free cybersecurity and cyber peace-building support for NGOs.

The representative of the private sector discussed the increasing militarization of cyberspace and noted the need for a neutral status of the CERT communities that track advanced persistent threats. This is similar to how humanitarian organizations, such as the International Committee of the Red Cross, need to be able to do their job and help with kinetic incidents independent of politics. In support of these considerations, it remained critical to account for the distinct characteristics of activities in cyberspace, particularly the covert nature of much activity and the use of cyber capabilities below the threshold of armed conflict. Still, there should be a pragmatic development of duties with a particular focus on transparency in the sharing of threat intelligence and collaboration with Interpol in cybercrime investigations.

 The member of the technical community highlighted that a timely response to cybersecurity incidents often requires collaboration between multiple countries. However, in some ways the most important question today is how to deal with multinational tech giants. As non-state actors they are mostly out of the scope of the law of neutrality. At the same time, these companies dominate the public core of the Internet today. Tech giants have an incentive to remain neutral to some degree to maintain business relationships, however, they are not equidistant to countries. For example, some tech giants directly collaborate with the military, for example to provide cloud solutions.

Cyber Norms and Neutrality

Having covered the nexus between the broad and at times undefined notion of neutrality and the everyday activities of each speaker, representatives were then invited to reflect on the operationalization of neutrality in the context of international cyber norms. As highlighted during the workshop, there are multiple norms of responsible behavior in cyberspace that have been agreed in the 2015 GGE report that hint to notions of neutrality and protections of specific actors and territories. Below follows a list of those mentioned by the speakers:

• Norm 3 (13c)– States should not knowingly allow their territory to be used for internationally wrongful acts using ICTs;
• Norm 6 (13f)– A State should not conduct or knowingly support ICT activity contrary to its obligations under international law that intentionally damages critical infrastructure or otherwise impairs the use and operation of critical infrastructure to provide services to the public;
• Norm 7 (13g) – States should take appropriate measures to protect their critical infrastructure from ICT threats, taking into account General Assembly resolution 58/199 on the creation of a global culture of cybersecurity and the protection of critical information infrastructures, and other relevant resolutions;
• Norm 8 (13h)– States should respond to appropriate requests for assistance by another State whose critical infrastructure is subject to malicious ICT acts. States should also respond to appropriate requests to mitigate malicious ICT activity aimed at the critical infrastructure of another State emanating from their territory, taking into account due regard for sovereignty;
• Norm 11 (13k) – States should not conduct or knowingly support activity to harm the information systems of the authorized emergency response teams (sometimes known as computer emergency response teams or cybersecurity incident response teams) of another State. A State should not use authorized emergency response teams to engage in malicious international activity.

The representative from academia returned to the discussion around due diligence, highlighting that it could be a starting point for thinking obligations and accountability beyond attribution. Furthermore, he referred to Norm 7 and stressed that due diligence could help states think through the necessary protections that need to be in place when securing critical information infrastructures. This would provide more clarity as to what could be considered the appropriate measures (possibly compensation) if an intrusion is identified. However, as he noted, we should also consider Norm 8 on requests for assistance as it deals with the capacity of states in responding to particular attacks. Two questions followed: "When can a state reject a request and on what basis?" and "Should private companies be allowed to assist? If so, how?" The lack of a definition of critical infrastructure poses significant challenges to thinking about the operationalization of these norms. 

The speaker from government noted that some norms could benefit from information sharing and the building up of a database of cases. Practices such as these would allow for states to have a better sense of the context of operations and of the interpretation of Norm 3. In addition, he suggested that Norm 11, although important, lacks specificity. Domestically, it is fundamental that states have channels in place for tracking attacks associated with critical sectors. CI operators should be in contact with CERTs and other areas of the government and mechanisms such as MoUs should also be in place to facilitate information exchange and timely response.   

When it comes to civil society organizations and front-line human rights defenders, the challenge is one of thinking the character of those actors. The representative from a civil society organization suggested that, in light of Norm 7, human rights defenders working with those directly affected by cyberattacks and assisting them in recovering should be considered critical infrastructure and off-limits. She noted that if one should consider the 5 neutrality functions as per Riklin, the CyberPeace Institute, for example, would be considered under the function of integration given that it convenes a diverse range of actors on threats of relevance to civil society and particularly vulnerable groups.

The representative from the private sector argued that states need to think carefully about how norms for responsible state behavior co-exist with non-state actors. Doing so would help non-state actors understand how they can carry out their activities and what protections are in place (or can be expected). These practices could help strengthen transparency over state action and provide a landscape of greater certainty for private companies working in this space. 

Finally, the CERT representative brought an important point of how contextual and institutional shifts can often challenge the implementability of a specific norm. That is the case of Norm 11 that talks about states not targeting CERTs. As the representative noted, CERTs were once thought of as independent and somewhat autonomous focal points for incident reporting. However, as new models such as that of the national cybersecurity centers (often linked to intelligence agencies) and national security concerns rise, CERTs have become more linked to government and geopolitical tensions. These and other dynamics have direct implications in thinking about the interpretation of Norm 11 as they would be structural aspects and organizational impediments for neutrality. 

The challenge of neutrality is not an easy one. The evident consolidation of cybersecurity as a key element in states' political agendas and strategic actions (e.g. offensive use of cyber capabilities) has led to an even more intense dispute over what can and should be protected in the context of cyber operations. As highlighted by the government representative, that does not mean that states should not strive (and they should) to define better parameters for what is or is not allowed even below the threshold of armed conflict. This could be achieved via due diligence or through confidence-building measures. Overall, participants agreed that even though neutrality can be interpreted as an apolitical concept, we need to consider that the key questions 'who' decides 'what' and 'whom' can be considered neutral, carries political power and potential for special protections.