Tallinn Manual 2.0

Tallinn Manual 2.0
Name	Tallinn Manual 2.0
Caption	Cover of the manual published by the NATO Cooperative Cyber Defence Centre of Excellence
Country	Estonia
Language	English
Subject	International law applicable to cyber operations
Publisher	Cambridge University Press
Pub date	2017
Pages	572

Tallinn Manual 2.0 is a comprehensive, non-binding study that applies international law to cyber operations, authored by an international group of experts convened under the aegis of the NATO Cooperative Cyber Defence Centre of Excellence in Tallinn, Estonia. The work builds on an earlier project led by the United Kingdom and Estonia to interpret rules from instruments such as the United Nations Charter, the Helsinki Final Act, and the Geneva Conventions in the context of cyber activities. It was published as a multi-author manual intended to guide practitioners in states including United States, Russia, China, France, Germany, Japan, India, Brazil and South Africa.

Background and Development

The project began after high-profile incidents involving cyber operations that implicated states such as United States in the Office of Personnel Management data breach, Estonia in the 2007 cyber incidents often attributed to Russia, and Georgia during the 2008 conflict. The NATO Cooperative Cyber Defence Centre of Excellence brought together academics and practitioners from institutions like Harvard Law School, Oxford University, Cambridge University, Yale University, Stanford Law School, Tel Aviv University, University of Toronto, Karl-Franzens-Universität Graz, European University Institute, Max Planck Institute, Australian Strategic Policy Institute, Chatham House, RAND Corporation, Center for Strategic and International Studies, Brookings Institution, Council on Foreign Relations, Carnegie Endowment for International Peace, International Committee of the Red Cross, and the International Law Commission. Leading experts with backgrounds at organizations including the United Nations, the International Court of Justice, the International Criminal Court, the North Atlantic Treaty Organization, the European Union External Action Service, and national bodies from United Kingdom, Norway, Sweden, Finland, Poland, Italy, Spain, Netherlands and Belgium participated. The Manual’s drafting committee referenced precedents such as the Tallinn Manual (2013), the Budapest Convention, the UN Group of Governmental Experts reports on information security, and scholarship from figures affiliated with Michael Schmitt and Marco Roscini.

Scope and Contents

The Manual systematically addresses how sources like the United Nations Charter, customary international law as reflected in cases from the International Court of Justice including Nicaragua v. United States, and treaties such as the Geneva Conventions and the Hague Conventions apply to cyber operations. Chapters treat concepts including peacetime uses of force in light of Article 2(4) of the UN Charter, the law of armed conflict under Common Article 2 of the Geneva Conventions, the law on countermeasures and self-help drawing on doctrines discussed in opinions from the International Law Commission and writings from jurists at Harvard and Yale. It offers rule-like statements and commentary on issues such as state attribution referencing the Draft Articles on Responsibility of States for Internationally Wrongful Acts, countermeasures connected to decisions like those in the Corfu Channel case, humanitarian exceptions influenced by interpretations from the International Committee of the Red Cross, and protections for critical infrastructure analogous to rulings in tribunals like the International Criminal Tribunal for the Former Yugoslavia.

Legal Interpretations and Key Conclusions

The Manual advances key conclusions on thresholds for use of force as understood through precedents like Caroline affair analogies and modern state practice involving Stuxnet, NotPetya, Sony Pictures hack, and the SolarWinds intrusion. It interprets attribution standards in light of evidence principles from bodies such as the International Court of Justice and reflects on measures available to states including countermeasures, necessity and proportionality doctrines traced to scholarship at Cambridge and rulings like those in Nicaragua v. United States and the Corfu Channel case. The Manual discusses the applicability of the Geneva Conventions to cyber operations affecting civilians and combatants, building on analyses found in reports from the International Committee of the Red Cross and commentaries by experts at Oxford and Harvard. It delineates how principles from the Law of Armed Conflict and human rights law as articulated in decisions of bodies like the European Court of Human Rights and the Inter-American Court of Human Rights may constrain cyber operations.

Reception and Criticism

Reception among actors including the United States Department of Defense, Ministry of Defence (United Kingdom), and academic commentators at institutions such as Georgetown University, Columbia Law School, New York University School of Law, University of Chicago, King's College London, Vrije Universiteit Amsterdam and Leiden University was mixed. Supporters praised the Manual for clarifying norms cited by the UN Group of Governmental Experts and informing policy at agencies like National Security Agency and GCHQ, while critics from think tanks such as Human Rights Watch, Electronic Frontier Foundation, Amnesty International, and some scholars at Moscow State University and Peking University contended it reflected Western state practice and had limited legitimacy without universal state endorsement. Debates involved inputs from legal scholars like Mary Ellen O'Connell, Michael N. Schmitt, David Kaye, Richard Clarke, Joseph Nye, and practitioners from Microsoft, Google, Facebook, Amazon, and Kaspersky Lab.

Influence and Application in Practice

States and organizations including the United States Cyber Command, European Union Agency for Cybersecurity, NATO, OTAN, Organisation for Security and Co-operation in Europe, African Union, Association of Southeast Asian Nations, ASEAN Regional Forum, G7, G20, Council of Europe, Interpol, and national ministries of foreign affairs from Canada, Australia, New Zealand, South Korea, Israel, Turkey, Saudi Arabia and United Arab Emirates have cited the Manual in policy papers, legal opinions and military doctrine. Private sector actors including Cisco Systems, IBM, Symantec, CrowdStrike, Palo Alto Networks, FireEye, Team Cymru, and Mandiant have used its analyses to guide incident response and attribution approaches, while courts and arbitral panels have referred to its principles in disputes involving state responsibility.

Subsequent Developments and Related Projects

Following publication, related initiatives emerged such as ongoing work by the United Nations Group of Governmental Experts and the UN Open-Ended Working Group on developments in the field of information and telecommunications, updated scholarship at Oxford Internet Institute, Berkman Klein Center, Stanford Cyber Policy Center, Center for Internet and Society (Stanford), and further manuals from the NATO CCDCOE. Academic and policy projects at European Council on Foreign Relations, Atlantic Council, Heritage Foundation, Hoover Institution, Defence Science and Technology Laboratory, and regional centers in Tallinn and Tallinn University of Technology continue to explore cyber norms, attribution, and the intersection with sanctions regimes administered by bodies like the United Nations Security Council and European Commission. The Manual’s influence informs curriculum at law faculties including Harvard Law School, Yale Law School, Columbia Law School, NYU School of Law, King's College London, and policy training at institutions such as the NATO Defense College and Monterey Institute of International Studies.

Category:Cyber law