turns on a definition of “force,”165 which could be interpreted strictly in accordance with the text, or with the broad object and purpose of the U.N. Charter.166 Although it is a contentious issue, it may be stated with some confidence that the boundaries of “force” do not precisely coincide with armed force only.167 What matters then are the ends sought, not the means. For example, “a CNA specifically intended to directly cause physical damage to tangible property or injury or death to human beings is reasonably characterized as a use of armed force and, therefore, encompassed in the [Article 2(4)] prohibition.”168 Thus it is theoretically possible for a CNA to rise to the level of an armed attack. The CNA itself is only an instrument to carry out that attack in the same way that any other weapon would be.
Second, the 1986 Libya attack precedent held that states which unwittingly, or permissively, allow their territory to be used to carry about attacks are committing an act of aggression.169 The problem then becomes one of attribution, i.e., the all too familiar scenario of computer systems being used maliciously without the knowledge of the network administrator. For example, many of the ‘zombie’ computers used to carry out botnet attacks against Estonia were shown to have been located in the U.S. Should Estonia then have a right of self-defense against the U.S.? Upping the ante, how would it be possible to prove a causal chain in the heat of a cyber attack with a society’s
165 Michael N. Schmitt, Computer Network Attack and the Use of Force in International Law: Thoughts on a Normative Framework, 37 Colum. J. Transnat’l L. 885 (1999).
166 Vienna Convention on the Law of Treaties, May 23, 1969, art. 31(1), 1155 U.N.T.S. 331 (1969). Analysis based on both UN Charter travaux and text leads to an interpretation excluding economic, and for that matter political, coercion from Article 2(4)'s prescriptive sphere. See Doc. 784, I/1/27, 6 U.N.C.I.O. Docs. 331, 334, 609 (1945).
167 Schmitt, supra note 165.
168 Id. The severity of a CNA attack may be considered along a sliding scale, which includes such factors as: severity, immediacy, directness, invasiveness, measurability, and presumptive legitimacy. Id.
169 UNGAR 41/38 on Nov. 20, 1986.