Countermeasures and retorsion in cyberspace

Faced with a hostile cyber operation that does not reach the threshold of armed attack, a state has two families of responses. Retorsion covers unfriendly but lawful acts: expelling diplomats, economic sanctions, public attribution, suspending cooperation. Countermeasures, codified in the International Law Commission's 2001 articles on state responsibility, are acts normally contrary to international law but made lawful because they respond to the other state's internationally wrongful act. They must aim to end that act, be proportionate, temporary, and in principle be preceded by a demand for cessation. In cyberspace, a countermeasure may take the form of an operation against the attacker's infrastructure. The Tallinn Manual discusses its conditions at length, and states disagree, notably on whether collective countermeasures on behalf of an ally are possible. For insurance, the issue is the causal chain. A state countermeasure can itself cause damage to private companies, in the targeted state or elsewhere, and then fall under the state-act or war exclusion. The law of self-defense, reserved for armed attack, is distinct: it is the boundary between these regimes that tells whether one is entering an armed conflict.