Speculation has it that Iran wants to pursue legal action against the US-Israeli led Stuxnet cyberattack.If the rumors prove to be true, Irans case against the United States could give the international community a great opportunity to use the case as needed momentum towards setting official international regulations on cyberwarfare. Arguably, the Stuxnet cyberattack is an illegal act of force that violated the Charter of the United Nations, the IAEA safeguards regime, and Iranian sovereignty as well.
After the U.S.-Israeli cyberattack, Tehran took a relatively passive posture and never officially complained to international legal channels. Shortly before President Rouhani took office in Tehran,an anonymous Iranian diplomatmade public that Irans Foreign Ministry had enough evidence to take legal steps against the United States for the Stuxnet cyberattack.If Iran takes legal action against Washington it can demand that it receive compensations for damages caused and having its sovereignty violated by an illegal act of war. A lot is at stake as Irans determination against the cyberattack could set boundaries for future illegal cyber behavior.
Stuxnet is out of control
Speculation as to whether the US-Israel were behind the Stuxnet cyberattacks was finally confirmed in the summer of 2012 by David E. Sanger in hisNew York Times reportand later book,Confront and Conceal, stating that the United States had been collaborating with Israel to develop cyberweapons against Iran. Sanger confirmed the U.S. and Israel as authors of the Stuxnet virus through reliable sources that had direct knowledge of the covert initiative codenamed Olympic Games.
Anonymous U.S. officials disclosed to Sanger that the Stuxnet virus was developed by theCentral Intelligence Agency, theNational Security Agencyand Israels cyber agency,Unit 8200. Together they wrote the sophisticated virus coupled with another malware program calledFlameand additionalcyberweaponsfor attacks on Irans infrastructure. Although the covert operation against Irans nuclear energy program was first authorized by the Bush administration in 2007-2008, it was the Obama administration that vastly expanded the cyberwar against Iran and launched the cyberattacks in 2009 and 2010.
The Stuxnet cyberattacks against Iran arguably are the worlds first cyberattack intended to cause actual physical damage as the malware was programmed to target Irans enrichment performance. Stuxnet attacked in three waves- June 22, 2009, March 1, 2010, and May 11, 2010, and it infected its targets within a month. After the cyberattacks, it was believed that1,000 IR-1 centrifugesused to enrich uranium at Irans facility at Natanz were sabotaged during the attack including but not limited to30,000 IP addresses in Iran, several manufacturing sites inHormuzganand the control system of Kharg Island-which handles the vast majority of Irans crude oil exports.
According to Symantec the numbers verify that Stuxnet was mainly aimed at Iran as58.85% of reported Stuxnet infectionsoccurred in systems in Iran. Data collected by IAEA reports suggested Iran decommissioned and replaced nearly1,000 IR-1 centrifugesin the Fuel Enrichment Plant (FEP) at Natanz, late in 2009 or early in 2010. Irans ability to install and operate new IR-1 centrifuges for nuclear energy was hindered but Tehran soon began producing enriched uranium up to 20 percent in February 2010.
The reckless Stuxnet malware continued spreading around the world damaging100,000 computers across Europe, attacked aRussian nuclear facilities, 7,600 power,chemical and petrochemical plantsacross the world,30,000 organizationsand115 othercountries computers and infrastructure. After the cyberattacks against Iran, the Obama Administration was concerned that Iran might retaliate against American troops and interests throughout the region, including Israel. What the Obama Administration failed to consider was that Stuxnet would boomerang back to hurt American infrastructure. Despite the fact that Stuxnet was out of control, the Obama Administration would continue with the program. According to Sanger in Confront and Conceal, Inside the Pentagon and the CIA, there were meetings about whether the United States would be accused of being among the first to use a cyberweapon against a sovereign state.
The Legality against Stuxnet
Iran is an active member of the IAEA and a signatory to NPT with an indigenous civilian nuclear energy program. Another nation interfering with Irans right to enrich uranium under the IAEA safeguards and protocols clearly is an infringement on Irans sovereignty. Regardless of the extent of damage to Irans nuclear facilities by Stuxnet, the act was an illegal act of force by a foreign nation. Unfortunately, the international community of nations has yet to implement clear international laws in a cyber-context on cyberwarfare and cybersecurity. This may have been one of the main reasons for why Iran initially shied away from admitting it was cyberattacked with Stuxnet and taking legal action at the time.
The ambiguities of cyberwarfare legality and existing law structure and frameworks provide limited outlets for states seeking answers to foreign cyberattacks. Shortly before President Rouhanis election, the Center for the Strategic Studies of the Nuclear Program of Iran published an article stating that an anonymous diplomat told them that Iran believes Stuxnet is equivalent to a military strike and that Iran was preparing to take legal action against the United States. According to the article the anonymous diplomat said, time for legal action has arrived. The American government will be condemned based on both international standards and based on two documents of its own government specifically, thePentagons strategy in operating in cyberspaceand alsoAmericas national strategyto secure cyberspace.
The unnamed diplomat said that taking legal action against the US for Stuxnet is a priority for Rouhanis cabinet and that the Foreign Ministry is currently gathering legal documents and evidence in order to take legal action in international institutions. Statements by American officials will have an important role in these documents. Also, Iran feels that it can mount a strong front on the world stage on this case because other countries also face this danger.
If and when the Iranian government does decide to officially pursue legal action against the United States for its cyberattacks it could reference theCharter of the United Nationsto justify the legality against Stuxnet. In the present charter the UN provides two explicit articles against an illegal act of force. In Article 2, chapter 4, the UN charter states that member states must: refrain in their international relations from the threat or use of force against the territorial integrity or political independence of any state, or in any other manner inconsistent with the purposes of the united nations.
Sending a cyberattack to destroy or damage a foreign countrys civilian nuclear facility clearly would violate this article. In Chapter VII Article 39, in accordance with Article 40 and 41, the Security Council shall determine the existence of any threat to the pace, breach of peace or act of aggression, and can authorize force if necessary to maintain or restore peace, provided that certain factual conditions are met. The second explicit exception to the prohibition against the use of force refers Article 51 in which it says nothing in the present Charter shall impair the inherent right of individual or collective self-defense if an armed attack against a member of the United Nations, until the Security Council has taken measures necessary to maintain international peace and security.
Irans development of nuclear energy does not amount to an armed attack nor an actual danger to the world under article 51 of the UN charter. One may argue that there have been armed attacks by Iran via its support for Hamas and Hezbollah against the US or Israel thus, there is justification for launching a cyberattack against Iran. However, according to theInternational Court of Justice, supplying training and weapons to an enemy of a state does not, by itself, constitute an armed attack against that particular state.
In pursuing this idea of launching Stuxnet against Irans nuclear program as self-defense, according to the Responsibility of States for internationally wrongful acts adopted by the International Law Commission, the grounds for necessity where a State may violate a rule of international law in order to prevent a greater harm even where there has been no armed attack. Article 25 has been formulated as applying where such conflict is the only way for the State to safeguard an essential interest against a grave and imminent peril and the action by the State does not cause greater damage. Therefore, in order for the US and Israel to justify that they used Stuxnet as self-defense against Irans nuclear program they would have to factually prove that Iran had weaponized its nuclear program at the time and that the nuclear bombs Iran had built were a dire threat to both countries.
Second chances dont come often and in Irans case its best to avoid being the victim of another cyberattack by the US. Iran has a golden opportunity to test winning a legal case against the US that can facilitate new boundaries for illegal behavior in cyberwarfare. This is important as the international community has continued to fail to implement effective legal frameworks that can govern cyberwarfare and cybersecurity. Irans case against the US can help the international community make clear definitions on cyberwarfare and set into motion international cooperation on ratifying international laws and structures that will serve as a limit on cyberwarfare.
By following through in its legal preparation, Iran could develop a role for championing international cybersecurity as it has been the worlds largest victim of cyberwarfare. At a time when cyberwarfare is becoming more prevalent in our world, the international community should support opportunities such as Irans case in order to strengthen rules, regulations and principles governing cyberwarfare. As concerned citizens, we should support Iran in its legal action against US cyberattacks as it can be an important step against reckless cyberattacks and unregulated cyberwarfare.
By International Policy Digest
The Iran Project is not responsible for the content of quoted articles.
