A Slap on the Wrist: Combatting Russia’s Cyber Attack on the 2016 U.S. Presidential Election
A Slap on the Wrist: Combatting Russia's Cyber Attack on the 2016 U.S. Presidential Election
Christina Lam 0 1 2
0 Thi s Notes is brought to you for free and open access by the Law Journals at Digital Commons @ Boston College Law School. It has been accepted for inclusion in Boston College Law Review by an authorized editor of Digital Commons @ Boston College Law School. For more information , please contact
1 Part of the Computer Law Commons, Election Law Commons , International Law Commons
2 Boston College Law School
Follow this and additional works at: https://lawdigitalcommons.bc.edu/bclr
1 See, e.g., Joshua Green, Why 2016 May Be the Most Important Election of Our Lifetim,e
BLOOMBERG BUSINESSWEEK (Nov. 5, 2015),
(recognizing that “the chasm” between the Republican and Democratic parties was “the greatest
it’s ever been”); Danielle Kurtzleben, The Most ‘Unprecedented’ Election Ever? 65 Ways It Has
Been, NPR (July 3,
(listing the ways in which the
2016 presidential election was “unprecedented”)
2 William A. Galston, Republicans and Democrats Divided on Important Issues for a Presiden
tial Nomine,e BROOKINGS (June 3, 2015), htt/p/ws:ww.brookings.edu/blog/fixgov/2015/06/03/
VAQ9-VKMQ]; Green, supra note 1.
3 See Green, supra note 1 (stating that Democratic and Republican presidential candidates point
the country towards entirely different futures in regards to the Affordable Care Act, the makuep- of
the Supreme Court, and immigration policies); Bradley Klapper et al., Why It Matters: Issues at Stake
in Election, U.S. NEWS (Sept. 17, 2016), https://www.usnews.com/news/politics/articles/2016-09-17/
Donald Trump and Democratic candidate Hillary Clinton appealed to the
many voters who were angry and frustrated with the status quo, thereby
escuring their party’s presidential nomination in a bitterly fought primary
election.4 Both candidates only grew more extreme ineir thviews and
shrouded in controversy as Election Day neared and, in fact, were deemed
the two most disliked presidential candidates in nearly forty years5. Once it
seemed as though the election could not possibly create more media
hedalines, suspicions e merged that Russia hacked the Democratic National
The DNC reported a breach of its computer network on June 14, 2016,
which was quickly attributed to Russian hacker7s.The devastating fallout
occurred in waves beginning on July 22, 2016when WikiLeaks published
nearly twenty thousand -emails and eight thousand attachments from top
DNC officials.8 The hackers continued to leak massive amounts of sensitive
campaign information in the days leading up to the November 7, 2016 U.S.
On October 7, 2016, the U.S. Intelligence Community publiclxy- e
pressed confidence that the Russian government was behind the cybert- a
tack on the DNC1.0 Then, on December 29, 2016, U.S. President Barack
Obama issued an Executive Order, taking measures against Russia for
prepetrating the cyber attack11. Specifically, the order blocked five Russian
entities and four Russian individuals from engaging in business with the
United States and seized all of their assets in the United Stat1e2sO.bama
also authorized the U.S. Department of State to declare thirt-yfive Russian
diplomats “persona non grata” and close two Russian compounds on U.S.
On January 6, 2017, the U.S. Director of National Intelligence released
its official conclusion that theRussian government was behind the DNC
hacks.14 Although Russia’s motives for interfering with the election are still
not entirely clear, the Director of National Intelligence and many others
believe that the hacks were intended to help Donald Trump win
thepresidency.15 There was, however, no indication that the Russian government
tampered with the voting process itself.16
This Note examines the legal ramifications of the U.S. response to
Russia’s cyber attack on the DNC1.7 Part I links this attack to the alarming
rise of state-sponsored hacking aimed at the United States.18 Part II
discusses the international law of response, focusing on the provisions relevant to
the U.S. response to Russia’s cyber attack1.9 Lastly, Part III argues that the
United States was forced to rely on general and outdated international law
principles when responding to Russia’s cyber attack, emphasizing the need
for a new international treaty that would guard against -ssptaotnesored
cyber attacks and punish them effectively when they occur.20
I. THE ESCALATING TREND OF STATE-SPONSORED CYBER
ATTACKS ON THE UNITED STATES
In light of the heightened dependence on technology in the digital age,
it was inevitable that states would add computers to their
arsena21l.Traditionally, a government sponsoring an attack would send armed nationals
into enemy territory, potentially placing them in grave dang2e2r.With the
advent of technology, however, states are now able to wreak havoc on any
target without even crossing a borde2r3. States have already wielded their
technological capabilities to undermine the infrastructure of countries
around the world, and Russia’s cyber attack on the DNC was merely the
latest in an escalating trend of state-sponsored hacking directed at the
United States.24 Each of these eevnts elicited a drastically different U.S.
re21 Irène Couzigou, The Challenges Posed by Cyber-Attacks to the Law on Se-lfDefense, in
SELECT PROCEEDINGS OF THEEUROPEAN SOCIETY OF INTERNATIONAL LAW 245 (Christina
Binder et al. eds., 2016); Matthew C. Waxman, Cyber-Attacks and the Use of Force: Back to the
Future of Article 2(4,) 36 YALE J. INT’L L., 421, 422–23 (2011); Daniel D. Brecht,Are Cyber
Threats the New Terrorism Frontier?,CYBER DEF. MAG., Dec. 2014, at 28; Ian Sherr & Seth
Rosenblatt, Sony and the Rise of State-Sponsored Hacking, CNET (Dec. 20, 2014), https://www.
22 Brecht, supra note 21; Gavin Millard, How Can You Fend Off a Nation?,INFOSECURITY
(Jan. 18, 2016), https://www.infosecurity-magazine.com/opinions/how-can-you-fend-off-a-nation/
23 Brecht, supra note 21, at 28–29; see Waxman, supra note 21, at 422–23 (noting that, due to
cyber attacks, “[m]ilitary defense networks can be remotely disabled or damaged” and “[p]rivate
sector networks can be infiltrated, disrupted, or destroyed”); Millards,upra note 22 (noting that
“hired thugs, instead of being given swords and guns, are afforded extensive resources and the-c
nologies . . . ” to carry out cyber attacks). State-sponsored attacks are carried out at the direction of
the government for a political purpose. Millards,upra note 22. In contrast, attacks that are not
state-sponsored (sometimes referred to as “private”) are merely an individual or group operation
to achieve a personal end. Kimberly Peretti & Jared SlaSdtea,te-Sponsored Cybercrime from
Exploitation to Disruption to Destruction, 10SCITECH LAW. 12, 13 (2014); Millard, supra note
24 See, e.g., Elizabeth A. Rowe, RATs, TRAPs, and Trade Secrets, 57 B.C. L. REV. 381, 400
(2016) (recognizing that “[f]oreign governments have used strategic cyberattacks in growing
numbers ”); Peretti & Slade,supra note 23, at 13 (identifying significant stat-esponsored cyber
attacks on China, Iran, South Korea, and Australia); Sherr & Rosenblatts,upra note 21
(identifying North Korea’s cyber attacks on the United States). There is not a generally agreed-upon
definition of the term “cyber attack” or related terms such as “cyber espionage” and “cyber teorrrism,”
largely because questionable cyber activities are constantly evolving.See MICHAEL N. SCHMITT,
TALLINN MANUAL ON THE INTERNATIONAL LAW APPLICABLE TO CYBER WARFARE 106 (2013)
(defining cyber attack as “a cyber operation, whether offensive or defensive, that is reasonably
expected to cause injury or death to persons or damage or destruction to objects”); Waxman, supra
note 21, at 422 (defining cyber attack as the “efforts to alter, disrupt, or destroy computer systems
or networks or the information or programs on them”); Memorandum from Gen. James E. Ct-ar
wright for Chiefs of the Military Servs., Commanders of the Combatant Commands, Dirs. of the
Joint Staff Directories on Joint Terminologyfor Cyberspace Operations 5 (Nov. 2011) (defining
cyber attack as “[a] hostile act using computer or related networks or systems, and intended to
disrupt and/or destroy an adversary’s critical cyber systems, assets, or functions”). In fact, there is
not even a consensus as to whether “cyber attack” should be written as one word or two. Gary D.
sponse.25 This Part illustrates this trend with two stat-esponsored hacks on
the United States that occurred prior to the Russian cyber attack on the
DNC.26 Section A identifies a few of China’s numerous hacks otnhe U.S.
government.27 Section B describes North Korea’s highly invasive hacks on
a U.S. company, Sony Pictures Entertainment2.8 Section C then provides a
detailed account of the Russian cyber attack on the DNC and the U.Se.- r
A. China’s Hacks on the U.S. Government
The Chinese government has been a usual suspect in hacks on various
U.S. government agencies and companies30. For example, China was
cacused of hacking the Federal Deposit Insurance Corporation’s (“FDIC”)
computer network between 2010 and 201331. According to investigators,
Solis, Cyber Warfare, 219 MIL. L. REV. 1, 2 (2014). The DNC’s computer network breach was
arguably an act of cyber espionage (i.e., “unauthorized viewing and copyionfg data files”) or
cyber terrorism (i.e. “unlawful attacks and threats of attack against computers, networks, and the
information stored therein when done to intimidate or coerce a government or its people in
furtherance of political or social objectives)”. OFFICE OF THE DIR. OF NAT’L INTELLIGENCE, supra
note 14; Michael Gervais, Cyber Attacks and the Laws of War, 30 BERKLEY J. INT’L L. 525, 534;
Solis, supra, at 3 (quoting CLAY WILSON, CONGRESSIONAL RESEARCH SERVICE, RL32114,
BOTNETS, CYBERCRIME, AND CYBERTERRORISM: VULNERABILITIES AND POLICY ISSUES FOR
CONGRESS 12 (2008)). This Note, however, refers to the breach of the DNC’s computer network as a
cyber attack because its information was not only viewed and copied, but also disseminated to the
public without a clear motive.See OFFICE OF THEDIR. OF NAT’L INTELLIGENCE, supra note 14;
Waxman, supra note 21, at 422.
25 Compare Gary Brown & Christopher D. YungE,valuating the USC-hina Cybersecurity
Agreement, Part 1: The US Approach to CyberspaceT,HE DIPLOMAT (Jan. 19, 2017), http/:/the
diplomat.com/2017/01/evaluating-the-us-china-cybersecurity-agreement-part-1-the-us-approachto-cyberspace/ [http://perma.cc/H98N-VVYR] (reaching cyber security agreement with China in
response to hacks), with Exec. Order No. 13,687, 80 Fed. Reg. 819 (Jan. 2, 2015) b(arring certain
North Korean individuals and organizations from accessing U.S. financial systems in response to
hacks), and Press Release, The White House,supra note 12 (freezing assets of certain Russian
individuals and entities and barring them from doing business with the United States as well as
expelling Russian diplomats and closing two Russian compounds).
26 See infra notes 30–93 and accompanying text.
27 See infra notes 30–37 and accompanying text.
28 See infra notes 38–58 and accompanying text.
29 See infra notes 59–93 and accompanying text.
30 Brown & Yung, supra note 25; Robert Windrem, Exclusive: Secret NSA Map Shows China
Cyber Attacks on U.S. Target,s NBC NEWS (July 30, 2015),
31 MAJORITY STAFF OF HOUSE COMM. ON SCIENCE, SPACE, & TECH., INTERIM STAFF
REPORT: COMM.’S INVESTIGATION OF FDIC’S CYBERSECURITY 6 (2016) [hereinafter H. FDIC
PORT]; Aaron Mamiit, FBI Launched Probe into FDIC Hack: Was China Really Behind the Secu
rity Breach?, TECHTIMES (Dec. 24, 2016), htt/p/w:ww.techtimes.com/articles/190030/2016
perma.cc/6UAD-QKGJ]; Jose Pagliery, China Hacked the FDIC—and US Officials Covered it up,
viruses were installed on twelve computers and ten servers at the FDIC,
including personal computers belonging to highra-nking FDIC officials3.2
These viruses enabled the installer to access information on the computers
and servers, such as banking data and employee records.33
China was also accused of hacking the U.S. Office of Personnel
Mnaagement in December 2014, obtaining the personal information of over
twenty million federal employees3.4 The damage was so extensive that it
prompted the United States to negotiate a cyber security agreement with
China.35 On September 25, 2015, President Barack Obama of the United
States and President Xi Jinping of China officially agreed that their
respcetive governments would not engage in or support cyb-eenrabled theft for
commercial gain.36 At least one report showed that Chinese government
hacking activity decreased ninety percent in the months following
B. North Korea’s Hacks on Sony
On November 24, 2014, Sony Pictures Entertainment (“Sony”)s-di
covered a major breach of its computer network38. Employees at all Sony
Report Says, CNN TECH (July 13, 2016),
http//:money.cnn.com/2016/07/13/technology/chinafdic-hack/ [http://perma.cc/QF69-N6RF]. The Federal Deposit Insurance Corporation is a
government agency that regulates U.S. commercial banks. Mamiit, supra; Pagliery, supra.
32 H. FDIC REPORT, supra note 31, at 6; Pagliery, supra note 31.
33 Mamiit, supra note 31; Pagliery, supra note 31.
34 Ellen Nakashima, Chinese Breach Data of 4 Million Federal Workers, WASH. POST (June 4,
[http://perma.cc/FAA9-3DWT]; David E. SangerU,.S. Decides to Retaliate Against China’s
Hacking, N.Y. TIMES (July 31, 2015),
ht/t/pwsw:w.nytimes.com/2015/08/01/world/asia/usdecides-to-retaliate-against-chinas-hacking.html [http://perma.cc/FLW6-E8KX]. The Office of
Presonnel Management is a federal agency responsible for recruiting and retaining federal employees.
Our Agency, OPM.GOV, https://www.opm.gov/about-us/ [http://perma.cc/BT2S-Z4P3].
35 Brown & Yung, supra note 30; Ellen Nakashima & Steven Mufson,U.S., China Vow Not to
Engage in Economic Cyberespionage,WASH. POST (Sept. 25, 2015), http://www.washingtonpost.
36 Brown & Yung, supra note 30; Nakashima & Mufson, supra note 35.
37 Joseph Menn & Jim Finkle,Chinese Economic Cyber-Espionage Plummets in U.S.:
Experts, REUTERS (June 21, 2016), http://www.reuters.com/article/us-cyber-spying-china-idUSKCN
0Z700D [http://perma.cc/6KR6-VQL8]; Nafeesa Syeed, U.S. Cyber Deal with China Is Reducing
Hacking, Official Says, BLOOMBERG TECH. (June 28, 2016), https://www.bloomberg.com/news/
38 Alex Altman & Alex Fitzpatrick, Everything We Know About Sony, The Interview, and North
Korea, TIME (Dec. 17, 2014), http://time.com/3639275/the-interview-sony-hack-north-korea/ [http://
perma.cc/SS8V-TXHG]; Lori Grisham, Timeline: North Korea and the Sony Pictures Hack, USA
TODAY (Dec. 18, 2014),
offices worldwide found themselves unable to login to their computers.39 In
addition, glowing, red skeletons displayed on theircrseens along with the
message “Hacked By #GOP . . . . We’ve already warned you, and this is just
a beginning . . . . We’ve obtained all of your internal data including your
secrets . . . .”40 The “GOP,” or Guardians of Peace, also posted a message
using at least three of Sony’s Twitter accounts specifically threatening
Sony’s Chief Executive Officer.41 The hacks brought Sony to a standstill as
employees were forced to shut down their computers.42
Almost immediately, North Korea was accused of orchestrating the
attack as revenge for Sony’s production of “The Interview.”43 The timing was
indeed suspicious, occurring just a month away from the scheduled release
date of the comedy about two journalists recruited by the U.S. Central
Intelligence Agency to assassinate North Korean leader Kim Jong-un.44 In June
2014, the isolationist, totalitarian state sent a letter to the United Nations
Secretary General condemning the movie4.5 Specifically, North Korea
erferred to the “The Interview” as the “undisguised sponsoring ofertrorism,
as well as an act of war” and pledged “decisive and merciless
countermeasure” if “the U.S. administration tacitly approves or supports” the mov4i6e.
North Korea publicly denied responsibility for the Sony hacks, but called it
a “righteous deed.”47
The hackers’ reign of terror continued when, on November 27, 2014,
five of Sony’s films were posted on illegal file-sharing sites.48 By December
2, 2014, thousands of Sony documents were leaked and many contained
sensitive employee data such as employees’ social security numbers, home
addresses, and salaries.49 Soon after, Sony staff received an e-mail
threatening to harm their families if they did not promote the GOP’s goa5l0sT.he
hackers also posted a message demanding that Sony cancel the release of
“The Interview” and distributed links to thousands o-fmeail exchanges
from top Sony executives’ accounts.51
Sony ultimately surrendered to the hackers’ demands on December 17,
2014, cancelling “The Interview’s” release.52 This announcement came only
shortly after the hackers’ threat to execute attacks on movie theaters
prompted several major theater chains to back out of showing the film.53 On
December 19, 2014, the U.S. Federal Bureau of Investigation publicly
announced its official conclusion that North Korea waressponsible for the
cyber attack on Sony.54
On January 2, 2015, President Obama signed an Executive
Ordermiposing sanctions on North Korea for the cyber attack on 55SoTnhyi.s
marked the first time in history that the United States had retaliated ine- r
sponse to a foreign cyber attack on a U.S. company5.6 Specifically, the
Executive Order barred ten individuals and three organizations, including
North Korea’s main intelligence agency and primary arms exporter, from
accessing U.S. financial systems.57 In reality, these sanctions only
minimally affected North Korea because it has long been one of the most isolated
countries in the world.58
C. Russia’s Cyber Attack on the DNC
The media first reported that Russian hackers breached the DNC’s
computer network on June 14, 2016 and shortly thereafter, a hacker named
Guccifer 2.0 claimed responsibility5.9 Crowdstrike, an American cyber
security firm, promptly analyzed the breach and confirmed the inieti-al r
ports.60 The fallout began on July 22, 20—16just three days before het
Democratic National Convention—when WikiLeaks published “part one”
of a “new Hillary Leaks series.”61 Part one was comprised of 19,252 e-mails
imposes-sanctions-north-korea-sony-hack-the-interview [http://perma.cc/GR5A-KTTY]; see
Exec. Order No. 13687 (sanctioning North Korea).
56 Ellen Nakashima, Why the Sony Hack Drew an Unprecedented U.S. Response Against
North Korea, WASH. POST (Jan. 15,
[ht/t/pp:erma.cc/A4N3QPP9]; Roberts, supra note 55.
57 Exec. Order No. 13,687; Roberts, supra note 55.
58 See Roberts, supra note 55 (recognizing that the sanctions “barr[ed] only limited further
commercial engagement with the already heavily-isolated state”).
59 Alperovitch, supra note 7; Fishel & Stracqualursi, supra note 6; Adi Robertson, WikiLeaks
Posts Leaked DNC Emails, Including Donor Personal Information,THE VERGE (July 22, 2016),
http://www.theverge.com/2016/7/22/12259258/wikileaks-leaked-democratic-national-committeeemails-personal-information [http://perma.cc/56B8-FSTN]. Guccifer 2.0 claimed to be a lone,
Romanian hacker. OFFICE OF THEDIR. OF NAT’L INTELLIGENCE, supra note 14. Investigators
found, however, that the hacker “made multiple contradictory statements and false claims about
his likely Russian identity . . . .” Id.
60 Alperovitch, supra note 7; Fishel & Stracqualursi, supra note 6; Lipton et al., supra note 7;
Nakashima, supra note 6. Crowdstrike recognized two known Russian hacking groups’
“distcintive handiwork” in the DNC hacks and assigned them the code names “Cozy Bear” and “Fancy
Bear.” Alperovitch, supra note 7; Lipton et al., supra note 7. Around June 2015, Cozy Bear sent
spear-phishing e-mails to a number of American government agencies, nonprofits, and gonv-er
ment contractors including the DNC. Alperovitch,supra note 7; Lipton et al.,supra note 7. As
soon as someone clicked on one of these em-ails, the hackers were able to enter the network and
download documents. Alperovitch, supra note 7; Lipton et al.,supra note 7. Fancy Bear did not
become involved until sometime around April 2016, first hacking the Democratic Congressional
Campaign Committee and then the DNC. Alperovitch, supra note 7; Lipton et al., supra note 7.
61 Fishel & Stracqualursi, supra note 6; Hamburger & Tumulty,supra note 8. The main
objective of the Democratic National Convention is to nominate the party’s presidential
candidaMtei.chael Saul, Democratic National Convention 101,DAILY NEWS (Aug. 21, 2008),http://www.ny
and 8,034 attachments from hi-grhanking DNC officials6.2 The e-mails
spanned from January 2015 to May 2016 and contained a number omf- i
portant conversations.63 For example, one e-mail showed party officials
discussing a campaign strategy to undermine Clinton’s main competitor for the
Democratic presidential nomination, Bernie Sande6r4s. The e-mails also
disclosed paryt donors’ personal information including their addresses,
credit card numbers, and even some passport and social security numbers.65
The hacks again incited chaos when, on October 6, 2016, DCLeaks
published e-mails from Capricia Marshall’s accoun66t. Marshall worked
closely with Clinton on her campaign and the -emails thus divulged
sensitive information about campaign efforts, including conversations with the
media and networking strategies.67
The day after DCLeaks released Marshall’s -emails, WikiLeaks
published the first batch in a series of fifty thousand-me ails from an account
belonging to Clinton campaign chairman John Podesta6.8 At least some of
62 Fishel & Stracqualursi,supra note 6; Hamburger & Tumultys,upra note 8; Robertson,
supra note 59. Some of the highr-anking DNC officials involvedwere Communications Director
Luis Miranda, National Finance DirectorJordan Kaplan, and Finance Chief of Staff Scott Comer.
Fishel & Stracqualursi, supra note 6; Hamburger & Tumulty, supra note 8; Robertson, supra note
63 Fishel & Stracqualursi,supra note 6; Hamburger & Tumultys,upra note 8; Robertson,
supra note 59.
64 See Hamburger & Tumulty, supra note 8 (quoting email from Marshall to Miranda discussing
plan to publicly question Sanders’ religious beliefs); Tobias SalingeLr,eaked DNC Email Floated
Plan to Question Sanders’ Religio,n N.Y. DAILY NEWS (July 23, 2016),http://www.nydailynews.
perma.cc/DB52-RWMQ] (quoting same email).
65 Hamburger & Tumulty, supra note 8; Robertson, supra note 59.
66 Rosalind S. Helderman& Tom Hamburger, Hacked Emails Appear to Reveal Excerpts of
Speech Transcripts Clinton Refused to Release, WASH. POST (Oct. 7, 2016), https://www.washington
[//hptetprm:a.cc/L76PZQ9K]; Sainato, supra note 9. The e-mails were made publicly available atCapricia Marshall, DC
htt[p://perma.cc/TN58NXCC]. DCLeaks’ website states that it was created by “American hacktivists” to collect, analyze,
and publish e-mails from high-level officials. DCLEAKS, http://dcleaks.com/index.php/about/ [http://
perma.cc/PQ36-KDC9]. There is strong evidence, however, that DCLeaks is actually managed by
Russian hackers. Does a Bear Leak in the Woods?, THREATCONNECT (Aug. 12, 2016), https://www.
67 Helderman & Hamburger, supra note 55; Sainato, supra note 9. For example, one em-ail
from MSNBC News producer Sheara Braun to a Clinton campaign spokesman and Marshall
detailed a weekly piece to “inform young people” about how Clinton is an “amazing, intelligent
woman who probably faced more nonsense back in the day because she is a woman .. . .” Sainato,
supra note 9.
68 Eliza Collins, Four of the Juiciest Leaked Podesta Email,s USA TODAY (Oct. 13, 2016),
http://www.usatoday.com/story/news/politics/onpolitics/2016/10/13/four-juiciest-leaked-podestaemails/92014368/ [http://perma.cc/B6KW-M8G2]; Fishel & Stracqualursi,supra note 6;
Krawthe e-mails brought the Clinton Campaign into disrepute.69 For example, an
email exchange between a Center for American Progress fellow and
Clniton’s Communications Director stated that conservatives are attracted to
Catholicism due to “the systematic thought and severely backwards gender
relations” and because “[t]heir rich friends wouldn’t understand if they
On November 7, 201—6 the day before the presidential elect—ion
WikiLeaks published thousands of additional e-mails from DNC officials.71
This was yet another massive leak of information that should have been
kept confidential, including an e-mail attachment regarding Clinton’s efforts
to raise millions of dollars for the United States to host a pavilion at the
World Exposition 2010 Shanghai China7.2 According to the e-mail
attachment, Clinton, as Secretary of State, ignored ethics guidelines in the process
of soliciting donations for the U.S. pavilion and the donors later received
“favorable treatment” from the U.S. Department of State.73
chenko et al., supra note 9. The -emails were made publicly available aTthe Podesta Emails,
WIKILEAKS, https://wikileaks.org/podesta-emails/ [http://perma.cc/8H3Q-DEGL].
69 See Collins, supra note 68 (identifying four leaked e-mails that “reflect poorly on the
campaign and raise question about relationships”); Krawchenko et al.,supra note 9 (detailing
numerous leaked e-mails, including some that reveal “a penchant for secrecy that has fueled questions
about Clinton’s trustworthiness”). Former New Hampshire Governor John H. Sununu stated on
the Trump Campaign’s behalf that the e-mails “revealed an underlying sense of religious bigotry.”
Collins, supra note 68. Other e-mails that brought the Clinton Campaign into disrepute: (1)
indicated that Hillary Clinton unfairly received debate questions in advance; (2) disclosed information
from the Department of Justice about upcoming hearings on the release Soefcretary Clinton’s
State Department e-mails; (3) discussed soliciting support from “needy Latinos”; and (4) conds-i
ered including jokes about Mrs. Clinton’s private e-mail server into speeches. Collins, supra note
68; Krawchenko et al., supra note 9.
70 Collins, supra note 68.
71 Fishel & Stracqualursi, supra note 6; Haberman & Rappeport, supra note 9.
72 ‘Disregarded Ethics Guidelines’: Clinton Document Raised Issues with 2010 Shanghai Expo,
FOX NEWS (Nov. 7,
[http://perma.cc/Q3L5CYLD]. The World Exposition 2010 Shanghai China was a six-month event and had seventy million
visitors. Kenneth Pletcher,Expo Shanghai 2010, ENCY. BRITANNICA, https://www.britannica.com/
event/Expo-Shanghai-2010 [http://perma.cc/F2HN-L2MB]. Its goal was to hhilgight urban life
using massive structures, or pavilions, which over 190 countries and 50 organizations constructed.
Id. The Obama administration let construction plans for the U.S. pavilion fall to the wayside. Kim
Ghattas, Hillary Clinton Visits ‘Her’ Shanghai Expo Pavilio,n BBC NEWS (May 23, 2010,)
http://www.bbc.com/news/10142881 [http://perma.cc/8VV7-K6QA]. Secretary Clinton believed a
U.S. pavilion was necessary to maintaining its relationship with China and took over the project.
Id. The final product was heavily criticized: a “dull steel structure” with three short movine-s i
tended to portray the “American spirit.” Id.
73 ‘Disregarded Ethics Guidelines,’ supra note 72; Richard Pollock, WIKILEAKS: Campaign
Manager Says “Clinton Had Little Consideration for Ethics,” DAILY CALLER (Nov. 6, 2016), http://
dailycaller.com/2016/11/06/wikileaks-campaign-manager-says-clinton-had-little-considerationfor-ethics/ [http://perma.cc/C54K-AZR4]. For example, Secretary Clinton influenced Russia to
sign a multi-billion aircraft deal with The Boeing Company. Pollock,supra. Two days later,
On January 6, 2017, the Office of the Director of National Intelligence
released an assessment laying out the conclusion that President of Russia
Vladimir Putin “ordered an influence campaign” intentionally designed to
challenge public confidence in the American democracy, destroy Clinton’s
credibility, and increase Trump’s chances of winning the 2016 U.S. pir-es
dential election.74 According to investigators, the Russian government
directed its intelligence agencies to obtain information from U.S. campaign
organizations, think tanks, and lobbying groups.75 The assessment
pinpointed Russia’s Main Intelligence Directorate (known as the GRU) as
responsible for breaching the DNC’s computer network and using the Guccifer 2.0
persona, DCLeaks, and WikiLeaks to release the acquired data.76
In response to Russia’s cyber attack on the DNC, U.S. President
Barack Obama issued anExecutive Order on December 28, 207176.It
amended an April 1, 2015 Executive Order, under which anyone found
negaging in or responsible for certain cy-beenrabled activities outside the
United States would have their assets in the United States frozen abned
prohibited from participating in business transactions in the United States.78
Specifically, the April 1, 2015 Executive Order applied to cy-benerabled
activities with the purpose or effect of “harming .. . a critical infrastructure
sector,” “causing a significant disrupt to the availability of a computer or
ing gave over two million dollars to the pavilion even though it was on a list of companies to
avoid for donations because it would likely “be seen as an attempt to curry favor with American
officials.” Id. As an example of favorable treatment, Proctor & Gamble gave three million dollars
to the pavilion and, allegedly, received the Secretary’s Corporate Excellence Award froMmrs.
Clinton in exchange. Id.
74 OFFICE OF THE DIR. OF NAT’L INTELLIGENCE, supra note 14; Gilsinian & Calamur, supra
note 15; Michael D. Shear & David E. SangerP,utin Led a Complex Cyberattack Scheme to Aid
Trump, Report Finds, N.Y. TIMES (Jan. 6, 2017), https://www.nytimes.com/2017/01/06/us/politics/
75 OFFICE OF THE DIR. OF NAT’L INTELLIGENCE, supra note 14.
76 Id. The Main Intelligence Directorate, or GRU, is the Russian army’s intelligence branch.
Shaun Walker, US Expulsions Put Spotlight on Russia’s GRU Intelligence Agency, THE GUARDI
AN (Dec. 30, 2016),
77 Gambino et al., supra note 11; Sanger, supra note 11; Wroughton, supra note 11; see Exec.
Order No. 13,757, 82 Fed. Reg. 1 (Dec. 28, 2016) (responding to Russia’s cyber attack).
78 James Killick et al.,U.S. Expands Cyber-Related Sanctions Executive Order and
Degsinates Russian Parties, WHITE & CASE (Jan. 2, 2017), https://www.whitecase.com/publications/alert/
cc/5XKL-X66R]; see Exec. Order No. 13,757; Exec. Order No. 13,694, 80 Fed. Reg. 18,077 (Apr.
1, 2015). The April 1, 2015 Executive Order stated, in relevant part:
All property and interests in property that are in the United States, that hereafter
come within the United States, or that are or hereafter come within the possession or
control of any United States person of the following persons are blocked and may
not be transferred, paid, exported, withdrawn, or otherwise dealt in . . . .
Exec. Order No. 13,694, at 18,077.
network . . .” or “causing a significant misappropriation of funds or oe-c
nomic resources, trade secrets, personal identifiers, or financial information
for commercial or competitive advantage or financial gain.”79
The December 28, 2016 Executive Order expanded the list of cyb-er
enabled activities covered to include “tampering with, altering, or causing a
misappropriation of information with the purpose or effect of interfering
with or undermining election processes or institutions .. . .”80 The
December 28 Executive Order also explicitly identified five Russian entitiesn-(i
cluding the GRU) and four Russian individuals that violated the new
provision.81 Accordingly, their assets in the United Stateswere frozen and they
were barred from doing business with anyone in the United States.82
After issuing the December 28, 2016 Executive Order, President
Obama announced that the U.S. Department of State declared th-ifritvye
Russian diplomats and consular officials in the United States “persona non
grata.”83 Accordingly, the diplomats were expelled from the United States
and given seventy-two hours to leave.84 The U.S. Department of State also
informed the Russian government that it could no longer access two
compounds it owned in the United States.85 According to U.S. officials, the
Russians primarily used them to conduct intelligence activities8.6 Russian
83 Gambino et al., supra note 11; Sanger, supra note 11; Press Release, The White House,
supra note 12.
84 Gambino et al., supra note 11; Sanger, supra note 11; Press Release, The White House,
supra note 12.
85 Mark Mazzetti & Michael S. SchmidtT,wo Russian Compounds,Caught Up in History’s
Echoes, N.Y. TIMES (Dec. 29,
2016),https://www.nytimes.com/2016/12/29/us/politics/russia-spycompounds-maryland-long-island.html [http://perma.cc/TSD8-3M7N]; Press Release, The White
House, supra note 12; Killick et al., supra note 78. One of the compounds was a fourteen-acre
property in Upper Brookville, New York known as “Norwich House.” Killick etsuaplr.,a note 78;
Mazzetti & Schmidt, supra. The other was located along the Corsica River in Centreville, Maryland
and included a three-story brick mansion, a swimming pool,a soccer field, and tennis courts. Killick
et al., supra note 78; Mazzetti & Schmidt, supra.
86 Daniella Diaz, What Do We Know About the Russian Compounds in the US,?CNN POL.
(Dec. 30, 2016),
http://www.cnn.com/2016/12/30/politics/russian-federation-compounds-what-dowe-know/ [http://perma.cc/6HRN-6C3S]; Mazzetti & Schmidt, supra note 85; Robert Windrem et
al., The Spy Next Door: What Went on in Russia’s Shuttered U.S. Compounds?, NBC NEWS (Dec.
cials, however, insisted that the compounds were merely used as vacation
homes for Russian diplomats.87
President Obama announced that the sanctions came after his ad mn-i
istration issued multiple warnings to the Russian government and were a
“necessary and appropriate response to efforts to harm U.S. interests in
violation of established international norms of behavior.”88 He went on to give
assurance that these actions were only the beginning of the U.S. response to
Russia’s hacks.89 It was widely speculated that further U.S. action involved
executing retaliatory hacks on Russian intelligence agencies.90
Russia openly condemned the sanctions, particularly because they
were imposed just three weeks before President Obama was leavinf-g o
fice.91 Specifically, a spokesperson for Russia President Vladimir Putin
stated that the order was intended “to further harm Rus-Asiamnerican ties,
which are at a low point as it is” and “deal a blow on the foreign policy
plans of the incoming administration[.]”92 Russia denied responsibility for
the hacks and vowed to retaliate against the United States for imposing
87 See Mazzetti & Schmidt, supra note 85 (describing the compounds as “[a] pair of luxurious
waterfront compounds . . . [that] have for decades been a retreat for Russian diplomats, places to
frolic in the water, play tennis and take lengthy steam baths” and noting that “Obama adminisat-r
tion officials described the compounds differently: as beachside spy nests sometimes used by
Russian intelligence operatives to have long conversations on the sand to avoid being snared by
American electronic surveillance”); Andrey Rezchikov et aRl.u,ssia Wants the Return of Its
American Dachas Illegally Taken by Obama,RUSS. BEYOND THE HEADLINES (Feb. 13, 2017),
http://rbth.com/international/2017/02/13/russia-wants-the-return-of-its-american-dachas-illegallytaken-by-obama_701328 [http://perma.cc/66WW-H2J8] (noting that Russian diplomats used both
compounds to host receptions and festivities, including Victory Day celebrations and New Year’s
parties for children); Adam Taylor, The Luxurious, 45-Acre Compound in Maryland Being Shut
Down for Alleged Russian Espionage, WASH. POST (Dec. 29, 2016), https://www.washingtonpost.
(identifying a Russian ambassador that previously described one of the compounds as a
“traditional Russian summer house, or dacha, he was used to back home” and quoting his wife as saying
that they went there “to hide for a while” from their “hectic life”).
88 Press Release, The White House, supra note 12.
II. THE INTERNATIONAL LAWS AND PRINCIPLES UNDERLYING THE U.S.
RESPONSE TO RUSSIA’S CYBER ATTACK
There is not a comprehensive, international legal framework that
explicitly prohibits state-sponsored cyber attacks, let alone one that prescribes
a punishment.94 Consequently, in responding to Russia’s cyber attack on the
DNC, the United States was forced to rely on international laws and
principles that were not directly applicable9.5 Specifically, the U.S. response
nivolved the doctrine of retorsions, economic sanctions law and practice, and
the Vienna Convention on Diplomatic Relations.96 This Part discusses these
international laws and principles generally and in the context of the U.S.
94 Oona A. Hathaway et al.,The Law of Cyber-Attack, 100 CAL. L. REV. 817, 840–41 (2012);
Duncan B. Hollis, Why States Need an International Law for Information Operation,s11 LEWIS &
CLARK L. REV. 1023, 1037 (2007); Jens David Ohlin,Did Russian Cyber Interference in the 2016
Election Violate International Law?, 95TEX. L. REV. 1579, 1579–80 (2017); Matthew J. Sklerov,
Solving the Dilemma of State Responses to Cyber Attacks: A Justification for the Use of Active
Defenses Against States Who Neglect Their Duty to Prevent 6 (Apr. 2009) (unpublished LL.M.
thesis, The Judge Advocate General’s School) (on file with the Homeland Security Digital Library).
The only international law that address any form of cyber crime is the Convention on Cybercrime
(also referred to as the Budapest Convention). The uCnocil of Europe drafted the Convention on
Cybercrime and submitted it for signatures in 2001. Hathaway et al.,supra, at 862–63; Chart of
Signatures and Ratifications of Treaty 185, COUNCIL OF EUR., https://www.coe.int/en/web/conventions/
full-list/-/conventions/treaty/185/signatures?p_auth=W4JU5WPj [http://perma.cc/3BGD-U4DR]. As
of April 17, 2018, fifty-seven countries ratified it; the United States is one, Russia and China are not.
Chart of Signatures and Ratifications of Treaty 185, supra.The Convention on Cybercrime requires
states to criminalize a broad range of cyber crimes under domestic law including child pornography
and copyright infringement. Convention on Cybercrime, Nov. 23, 2001, E.T.S. 185, T.I.A.S. 13174.
It does not apply to government action, such as state-sponsored cyber attacks. Hathaway et al., supra,
at 877; see Convention on Cybercrime, supra. There are arguments that Russia’scyber attack on the
DNC violated an international law that does not explicitly address cyber crime, such as the right to
self-determination—a country’s right to structure their own government. Ohlin, supra.
95 See Hathaway et al., supra note 94, 840–41(arguing that laws of war are extremely hard to
apply to cyber attacks); Hollis, supra note 94, at 1037, 1039–40 (acknowledging that “there are no
specific rules” for information operations such as cyber attacks and the laws of war apply by
analogy); Sklerov, supra note 94 (recognizing that there is not a comprehensive treaty for international
cyber attacks and states are forced to “practice law by analogy”).
96 See Philip Bump, How to Be Declared ‘Persona Non Grata’ and Get Yourself Kicked Out of
the United Sattes, WASH. POST (Dec. 29, 2016),https://www.washingtonpost.com/news/the-fix/
wp/2016/12/29/how-to-be-declared-a-persona-non-grata-and-get-yourself-kicked-out-of-the-unitedstates/?utm_term=.bf73f6087adb [http://perma.cc/K6NJ-MHF2] (identifying U.S. reliance on the
Vienna Convention on Diplomatic Relations (“VCDR”) in responding to Russia’s cyber attack);
Ryan Goodman, International Law and the US Response to Russian Election Interferen,ceJUST
SECURITY (Jan. 5, 0217),
https://www.justsecurity.org/35999/international-law-response-russianelection-interference/ [http/:/perma.cc/H8KM-DWMC] (identifying U.S. use of retorsions ei-n r
sponding to Russia’s cyber attack); Greg Miller et al.,Obama’s Secret Struggle to Punish Russia for
Putin’s Election Assault, WASH. POST (June 23, 2017), https/:/www.washingtonpost.com/graphics/
perma.cc/QZT5-789X] (identifying U.S. use of economic sanctions in responding to Russia’s
response to Russia’s cyber attack on the DNC9.7 Section A of this Part
explains the doctrine of retorsions9.8 Section B provides a detailed overview
of economic sanctions9.9 Section C addresses the Vienna Convention on
Diplomatic Relations.100 Lastly, Section D shows how each of these
international laws and principles were in play in the U.eSs.pornse to Russia’s
cyber attack on the DNC.101
Retorsions, or unfriendly acts taken consistently with the acting state’s
international obligations, have long been recognized as a remedy in
international law.102 They are often referred to as a form of “self-help,” actions that
states take to enforce their rights or protect their interests without
authorization from an international organization.103 Retorsions typically involve one
state acting against another, but international organizations may use them or
be subject to them.104
97 See infra notes 102–189 and accompanying text.
98 See infra notes 102–117 and accompanying text.
99 See infra notes 118–145 and accompanying text.
100 See infra notes 146–167 and accompanying text.
101 See infra notes 168–189 and accompanying text.
102 Int’l Law Comm’n, Rep. on the Work of its Fifty-Third Session, U.N. Doc. A/56/10, at 325
(2001); Tom Ruys, Sanctions, Retorsions and Countermeasures: Concepts and International Legal
Framework, in RESEARCH HANDBOOK ON UN SANCTIONS AND INTERNATIONAL LAW 24 (Larissa
van den Herik ed. 2017;) THOMAS GIEGERICH, RETORSION, MAX PLANCK ENCY. OF PUB. INT’L L.
¶ 2; Joacquín Alcaide Fernández, Countermeasures, OXFORD BIBLIOGRAPHIES, http://www.oxford
perma.cc/86CN-TCBP] (last updated Oct. 29, 2013). Retorsions are distinguished from
countermeasures, which have effectively replaced the nineteenth century idea of reprisals, or “acts of
selfhelp by the injured State, acts in retaliation for acts contrary to international law on the part of the
offending State, which have remained unredressed after a demand for amends.” Ruyssu,pra, at
32; Matthias Ruffert, Reprisals, OXFORD PUB. INT’L L., http://opil.ouplaw.com/view/10.1093/
law:epil/9780199231690/law-9780199231690-e1771 [http://perma.cc/3NMS-VDC8] (last updated
Sept. 2015). Unlike retorsions, countermeasures are unlawful acts; they arienconsistent with the
imposing state’s international obligations, andmust be taken in response to an international law
violation. ECONOMIC SANCTIONS AND INTERNATIONAL LAW 42 (Matthew Happold & Paul Eden
ed. 2016); Hathaway et al., supra note 94, at 845 n.109. The rules on countermeasures are mainly
found in the Draft Articles on Responsibility of States for Internationally Wrongful Acts, which
provide that an injured state may employ countermeasures in response to an “internationally
wrongful act.” Int’l Law Comm’n,Rep. on the Work of ItsFifty-Third Session, supra, at 324. In
order for an act to be deemed “internationally wrongful,” it must satisfy two conditions set forth in
Article 2: (1) it must violate one of the perpetrating state’s international obligations; and (2) the
act must be attributable to the state against which countermeasures are sought. Id. at 68.
103 Ruys, supra note 102, at 24;GIEGERICH, supra note 102, ¶1. State action taken without
support from another state or an international organization is often called “unilateral” action.
Richard B. Bilder, The Role of Unilateral State Action in Preventing International Environmental
Injury, 14 VAND. J. TRANSNAT’L L. 51, 54 (1981).
104 Ruys, supra note 102, at 24; GIEGERICH, supra note 102, ¶ 1.
International law does not explicitly restrain the use of retorsions and
states generally view them as a right rather than a privileg10e5. In fact, an
international law violation is not required to justify retorsions, but they
sometimes succeed international law violations.106 States enjoy wide
discretion when imposing retorsions; the only real limitation is that they must be
consistent with the imposing state’s international obligations.107
What an individual state’s international obligations are—and whether a
certain act violates one of those obligatio—nsis far from clear under the
current international law framework.108 Article 38 of the Statute of the
nIternational Court of Justice provides some guidance, identifying the primary
sources of law as international conventions, international custom, general
principles of law, and the judicial decisions and teachings from the most
highly qualified publicists.109 Given the ever-expanding regulatory breadth
of international law and the constantly developing, complex relationships
between countries, many states have countless international obligations that
are difficult to ascertain.110 Thus, the limitation that retorsions must be
consistent with the acting state’s international obligations ias significant and
105 Ruys, supra note 102, at 24;GIEGERICH, supra note 102, ¶ 1; see Fernández, supra note
102 (stating that the doctrine of retorsions is not covered by the International Law Commission’s
work on international responsibility).
106 CHARLES CHENEY HYDE, INTERNATIONAL LAW CHIEFLY AS INTERPRETED AND APPLIED
BY THE UNITED STATES VOLUME II 169–70 (1922); Ruys, supra note 102, at 24; GIEGERICH,
supra note 102, ¶ 1.
107 Ruys, supra note 102, at 24; GIEGERICH, supra note 102, ¶¶1, 14. Retorsions are not
elgally required to be proportional to the act they are in response tGo.IEGERICH, supra note 102,
108 MATH NOORTMANN, ENFORCING INTERNATIONAL LAW: FROM SELF-HELP TO
); see Ruys, supra note 102, at 24 (recognizing the dificfulty “in
determining whether or not certain measures do or do not amount to a breach of an international
obligation of the State (or organization) engaging in them”).
109 Statute of the International Court of Justice art. 38. The Statute of the International Court
of Justice (ICJ) is annexed to the United Nations (UN) CharteBr.asic Documents, INT’L CT. OF
JUST., http://www.icj-cij.org/en/basic-documents [http://perma.cc/44NN-7GYK]. The UN Charter
established the ICJ as the UN’s “principal judicial organ.” U.N. Charter art. 92, 93 ¶1. The Statute
of the ICJ sets forth the rules and procedures for the ICJ.See Statute of the International Court of
110 See NOORTMANN, supra note 108 (“Considering the increasing sophistication of
international regulation and law-making, the very question of whether a specific measure constitutes a
violation of an international obligation or not is likely to become the very subject of the dispute.”);
Ruys, supra note 102, at 24 (determining whether an act is consistent with a state’s international
obligations may require “careful scrutiny ... under relevant customary law, bilateral treaty law
and multilateral treaty law”).
111 See NOORTMANN, supra note 108 (recognizing that “it is not easy to determine whether a
specific measure violates a legal obligation in a given situation or not”);see Ruys, supra note 102,
at 24 (recognizing the difficulty in determining whether certain measures are a breacohf the
imposing state’s international obligations).
Nevertheless, certain retorsions are ordinarily considered legal,
eespcially those by which the imposing state revokes a privilege that it was
nuder no obligation to give at the outse1t1.2 For instance, retorsions may
involve refusing access to ports, canceling diplomatic visits, and declaring
diplomats “personas non grata.”113 They may also involve revoking
international aid, recalling military assistance, or withdrawing from an
international organization.114 States usually cannottake more severe action without
violating one of its international obligations.115 For example, if a state were
to impose a trade embargo or threaten military intervention, it would likely
violate the principle of non-intervention or the prohibition on thethreat or
use of force set forth in Article 2(4) of the United Nations (UN) Charte1r1.6
Therefore, retorsions are typically a very mild form of retaliation, causing
only minimal disruption to the receiving state’s affairs. 117
112 See NOORTMANN, supra note 108 (acknowledging the ICJ’s holding in Nicaragua v.
United States); GIEGERICH, supra note 102, ¶ 10 (identifying retorsions which involve a state invoking
a privilege such as denying ship access to ports and terminating economic aid). NInicaragua v.
United States, Nicaragua argued that the United States illegally intervened in its affairs in ceasing
U.S. economic aid to Nicaragua out of vehement disapproval of the Nicaraguan government.
Military and Paramilitary Activities in and Against Nicaragua (Nicar. v. U.S.), Judgment, 1986 I.C.J.
14, 67 (June 27). The ICJ held, rather vaguely, that “the cessation of economic aid, the giving of
which is more of a unilateral and voluntary nature, could be regarded as such a violation [of the
obligation not to defeat the object and purpose of the treaty] only in exceptional circumstances.”
113 Ruys, supra note 102, at 24; YONG ZHOU, INTERNATIONAL RELATIONS AND LEGAL
COOPERATION IN GENERAL DIPLOMACY AND CONSULAR RELATIONS 336 (2014); GIEGERICH, supra
note 102, ¶ 10.
114 ZHOU, supra note 113; GIEGERICH, supra note 102, ¶ 10.
115 Ruys, supra note 102; see GIEGERICH, supra note 102, ¶24 (“Even though a specific
measure of retorsion does not as such violate international law, its use for an illegitimate end,
namely an intervention, will render it unlawful if its coercive force is strong enough to pose a
serious threat to the self-determination of the target State . . . .”).
116 Ruys, supra note 102; see GIEGERICH, supra note 102, ¶ 25 (recognizing that interrupting the
supply of critical goods to another state is illegal). The customary international
principlenoonfintervention was codified in the UN General Assembly’s 1965 Declaration on the Inadmissibility of
Intervention and Interference in the Domestic Affairs of States.William Mattesich, Digital
Destruction: Applying the Principle of Non-Intervention to Distributed Denial of Service Attacks Manifesting
No Physical Damage, 54COLUM. J. TRANSNAT’L L. 873, 879–80 (2016); Carolyn Dubay,A
Refresher on the Principle of Non-Intervention, INT’L JUDICIAL MONITOR (2014), http://www.judicial
monitor.org/archive_spring2014/generalprinciples.html [http://perma.cc/EX7J-XF86]. There, the
principle of non-intervention is formulated as: “[n]o State has the right to intervent, directly or
indirectly, for any reason whatsoever, in the internal or external affairs of any other StaGte.”A. Res.
36/103 (Dec. 9, 1981). Article 2(4) of the UN Charter declares that “[a]ll Members shall refrain in
their international relations from the threat or use of force against the territorial integrity or poli-t
cal independence of any state, or in any other manner inconsistentwith the Purposes of the United
Nations.” U.N. Charter art. 2, ¶ 4.
117 GBENGA ODUNTAN, INTERNATIONAL LAW AND BOUNDARY DISPUTES IN AFRICA 326
(2015); GIEGERICH, supra note 102, ¶ 29.
Like retorsions, sanctions are measures intended to enforce states’
rights or protect their interests.118 In fact, sanctions are often confused with
retorsions or considered an umbrella term that includes retorsions.119 Unlike
retorsions, though, sanctions are not usuallydefined as limited to actions
that are consistent with the state’s international obligatio12n0s.There is,
however, not a widely agreed upon definition of the term “sanctions” and
there are at least three different ways of defining it.121
The first way is to broadly define sanctions as any action, whether
taken by a state or institution, “against a State to compel it to obey
international law or to punish it for a breach of international la1w22.”The second is
much narrower: sanctions are the UN Security Council’s actions pursuant to
Article 41 of the UN Charter.123 A number of scholars embrace a third, more
middle ground approach, recognizing sanctions as any international
organizations’ actions taken against its members and in accordance with
118 Natalino Ronzitti, Conclusion, in COERCIVE DIPLOMACY, SANCTIONS AND
INTERNATIONAL LAW 287 (Natalino Ronzitti ed. 2016);see Ruys, supra note 102, at 22–23 (recognizing
“sanction” as referring to a certain type of measure to “(i) coerce or change behavior; (ii) to
constrain access to resources needed to engage in certain activities; or (iii) to signal and stigmatize”).
119 CHRISTINA ECKES, EU COUNTER-TERRORIST POLICIES AND FUNDAMENTAL RIGHTS: THE
CASE OF INDIVIDUAL SANCTIONS 16 (2009); see JAN KLABBERS, INTERNATIONAL LAW 183
(2017) (describing retorsions as “the most ubiquitous of sanctions”);Hans-Martien ten Napel, The
Concept of International Crimes of States: Walking the Thin Line Between Progressive Develop
ment and Disintegration of the International Legal Orde,r1 LEIDEN J. INT’L L. 149, 151 (1988)
(describing retorsions as individual sanctions).
120 See KLABBERS, supra note 119, at 183 (“[W]hat characterizes the retorsion is that
itermains within the law”);ALAIN PELLET & ALINA MIRON, SANCTIONS, MAX PLANCK ENCY. OF
PUB. INT’L L., ¶ 4 (declining to limit sanctions to actions consistent with a state’s international
121 Ruys, supra note 102, at 19–22; Clara Portela, The EU’s Use of ‘Targeted Sanctions’3
(CEPS, Working Paper No. 391, 2014);Boris Kondoch, Sanctions in International Law, OXFORD
(last updated Sept. 28, 2016).
122 Ruys, supra note 102, at 19(quoting Sanctions, A DICTIONARY OF LAW (Johnathan Law
ed. 2015)); see PELLET & MIRON, supra note 120, ¶ 4 (defining sanctions broadly as “all types of
consequences triggered by the violation of an international legal rule”).
123 Ruys, supra note 102, at 20; PELLET & MIRON, supra note 120, ¶ 11; see U.N. Charter art.
41 (“The Security Council may decide what measures not involving the use of armed force are to
be employed to give effect to its decisions . . . . These may include complete or partial interruption
of economic relations and of . . means of communication, and the severance of
124 Ruys, supra note 102, at 21; Michael Brzoska, International Sanctions Before and Beyond
UN Sanctions, 91 INT’L AFF. 1339, 1345 (2015); PELLET & MIRON, supra note 120, ¶ 10; see
Kondoch, supra note 121 (recognizing a common understanding that sanctions “refers to the
multilateral measures adopted by states through the United Nations or another international
Under any definition, sanctions may take a variety of forms including
trade embargos, travel bans, and asset freezes.125 Sanctions may also serve a
number of different purposes.126 For instance, they may be designed to alter
behavior, inhibit access to resources, or send a messa1g27e.Furthermore,
sanctions may be specifically targeted to affect only certain individuals
deemed responsible for objectionable activity, rather than broadly affecting
a country’s population as a whole.128
Sanctions imposed today are most frequently in the category of
“eocnomic sanctions.”129 “Economic sanctions” are sometimes defined as the
“deliberate, government inspired withdrawal, or threat of withdrawal, of
customary trade or financial relations.”130 For instance, economic sanctions
may take the form of freezing or seizing assets, trade embargoes,
tariffnicreases, or bans on cash transfers.131
Economic sanctions have a long and contentious histo1r3y2. The UN
Charter merely states that the UN Security Council may impose economic
and certain other sanctions, but is silent as to whether individual states may
impose sanctions.133 Nevertheless, many argue that economic sanctions are
contrary to international law because they are coercive to an extent that they
are a prohibited use of force under Article 2()4 of the UN Charter and
voilate the customary international law principle of n-oinntervention.134
Accordingly, the UN General Assembly has adopted a number of resolutions in
attempt to bar states from imposing economic measu—resincluding both
sanctions and retorsions—without UN authorization.135 One such resolution
is the 1965 “Declaration on the Inadmissibility of Intervention in theo-D
mestic Affairs of States and the Protection of Their Independence and
Svoereignty.”136 This resolution prohibited states from coercing another state
using economic, political, or other measures to interfere with its sovereignty
or receive a benefit.137 A similar resolution was adopted in 1995 and entitled
“Economic Measures as a Means of Political and Economic Coercion
against Developing Countries.”138 There, the UN General Assembly
strongly encouraged states to adopt urgent and effective measures to cease
employing coercive measures against developing countries that are not
authorized by the UN or are inconsistent with the UN Charter.139 Even if these UN
resolutions are not binding upon UN member states, the international
community has repeatedly acknowledged that economic sanctions are illegal.140
These resolutions and other organizational attempts to limit the use of
economic sanctions were largely unsuccessful1.41 Many only bind a few
states, contain vague or overly broad provisions, or lack an effectivne- e
forcement mechanism.142 Many states, especially the United States,
routinely impose economic sanctions on their own accord without
formaclonsequences.143 Economic sanctions thus remain an optimal yet legally dubious
choice for states and international organizations seeking to pressure, punish,
134 Szasz, supra note 129, at 456; CARTER, supra note 129, ¶¶ 12–13.
135 See G.A. Res. 46/210, ¶ 1 (Dec. 20, 1991;) G.A. Res. 2131 (XX), ¶2 (Dec. 21, 1965;)
Szasz, supra note 129, at 456.
136 G.A. Res. 2131, supra note 135; Szasz, supra note 129, at 457.
137 G.A. Res. 46/210, supra note 135.
138 Id.; Szasz, supra note 129, at 457.
139 G.A. Res. 46/210, supra note 135; Szasz, supra note 129, at 457.
140 Doraev, supra note 133, at 376–77; see Szasz, supra note 129, at 458 (noting that the
niternational community has adopted strong resolutions of condemnation of the U.S. economic
sanctions on Cuba).
141 CARTER, supra note 129, ¶18; see Szasz, supra note 129, at 455, 458 (stating that
eocnomic sanctions are widely used even though states cannot claim a general legal right to impose
142 CARTER, supra note 129, ¶ 13; see HUFBAUER ET AL., supra note 130, at 139–40 (noting
that the UN does not have a military to enforce its arms embargos and UN resolutions on arms
embargos are vague).
143 See CARTER, supra note 129, ¶ 33 (acknowledging that “[e]conomic sanctions have
ebcome a fact of international life and a tool of international diplomacy” and “[e]fforts . . to
somehow limit these sanctions under the UN Charter or customary international law made little hde-a
way”); Masters, supra note 126 (acknowledging that economic sanctions are widely used and,
although U.S. sanctions have evoked anger, the United States was never formally reprimanded).
or shame states.144 This is mainly due to their co-setfficient, low-risk
nature—not necessarily their effectiveness which is generally inconsistent and
C. The Vienna Convention on Diplomatic Relations
The Vienna Convention on Diplomatic Relations (“VCDR”)
signed in 1961 and nearly all countries have agreed to be bound to 1i4t6. It
culminated the effort to codify customary international law on diplomatic
relations between states1.47 The VCDR now serves as a comprehensive
framework for creating, maintaining, and ceasing diplomatic relations on a
Under Article 9 of the VCDR, a state is allowed to pronounce a
dipolmat it has received into its territory “persona non grata.1”49 States’ right to
144 CARTER, supra note 129, ¶33; Masters, supra note 126; see Doraev, supra note 133, at
388 (“[T]he United States historically considers economic sanctions as a legitimate tool of its
foreign policy . . . . Nevertheless, although this practice might be supported by the ancient ‘Lotus
principle’ that a state is permitted to do evtehriyng, which is not affirmatively prohibited, the
United States prefers to keep a distance from debates on the legality of sanctions.”).
145 CARTER, supra note 129, ¶33; Richard N. Haass,Economic Sanctions: Too Much of a
Bad Thing, BROOKINGS (June 1, 1998),
https://www.brookings.edu/research/economic-sanctionstoo-much-of-a-bad-thing/ [http://perma.cc/7SPZ-58JG] (“In a global economy, unilateral csa-n
tions tend to impose greater costs on American firms than on the target, which can usually find
substitute sources of supply and financing.”); Masters, supra note 126.
146 Vienna Convention on Diplomatic Relations, AM. SOC’Y INT’L L., https://www.asil.org/eisil/
vienna-convention-diplomatic-relations [http:/p/erma.cc/4YM5-W3UG] [hereinafter VCDR, AM.
SOC’Y INT’L L.]; Jan Wouters & Sanderjin DuquetT,he Vienna Conventions on Diplomacy and
Consular Relatio,ns OXFORD BIBLIOGRAPHIES, http://www.oxfordbibliographies.com/view/
document/obo-9780199743292/obo-9780199743292-0112.xml [http/:/perma.cc/97GQ-XDH9] (last
updated Jan. 11, 2018). As of August 16, 2017, the VCDR has 191 partiVesi.enna Convention on
Diplomatic Relations, UN TREATY COLLECTION, https://treaties.un.org/Pages/ViewDetails.aspx?src=
147 VCDR, AM. SOC’Y INT’L L., supra note 146; Wouters & Duquet, supra note 146.
148 VCDR, AM. SOC’Y INT’L L., supra note 146; Wouters & Duquet,supra note 146. The
VCDR is similar to the Vienna Convention on Consular Relations (“VCCR”), which was signed
in 1963. Wouters & Duquet, supra note 146. Whereas the VCDR pertains to diplomats, the VCCR
governs consuls. Id. Both diplomats and consuls are representative of foreign governments, but
consuls receive less extensive immunities under the VCCR than diplomats under the VCDR. Cami
Green, Counsel, Consul, or Diplomat: Is There Any Practical Significance for Practitioners?, 1 U.
MIAMI INT’L & COMP. L. REV. 143, 148–49 (1991). Whether a foreign representative is a
dipolmat or consular is usually determined simply by how the receiving state identifies them. Id. at 149.
149 Vienna Convention on Diplomatic Relations, Apr. 18, 1961, 23 U.S.T. 3227, 323343,–
500 U.N.T.S. 95, 102 [hereinafter VCDR]; CRAIG BARKER, INTERNATIONAL LAW AND
INTERNATIONAL RELATIONS 167 (2000). Article 9 of the VCDR is as follows:
1. The receiving State may at any time and without having to explain its id-ec
sion, notify the sending State that the headof the mission or any member of the
diplomatic staff of the mission is persona non grata or that any other member of the
staff of the mission is not acceptable.
declare a diplomat “persona non grata” pr-edates the VCDR and is one of
the most ancient principles of diplomatic la1w50. In declaring a diplomat
“persona non grata,” the diplomat is “not acceptable” and the state that sent
the diplomat must “recall the person concerned or terminate his functions
with the mission.”151
Article 9 of the VCDR does not entitle the receiving state to physically
remove the diplomat.152 Rather, the sending state must tell them to return.153
If, for whatever reason, the diplomat does not leave within a reasonable
time, the receiving state may treat them as any other foreign individu—al
that is, without diplomatic immunity or privileges.154 Aside from these
procedural limitations, states have free-reign to declare diplomats “persona non
grata”; they can make the declaration at any time, for any reas1o55n.The
right is not susceptible to abuse, because in reality, its exercise nmi mially
disrupts the sending state’s affairs, merely requiring them to ensure that the
unwelcome diplomat departs and perhaps reorganize the diplomatic mission
to some extent.156
Although the VCDR permits a state to expel foreign diplomats, it
heavily restricts a state’s ability to interfere with the premises of a
diplomat2. If the sending state refuses or fails within a reasonable period to carry out its
obligations under paragraph 1 of this article, the receiving State may refuse to
recognize the person concerned as a member of the mission.
150 Amer Fakhoury, Persona Non Grata: The Obligation of Diplomats to Respect the Laws
and Regulations of the Hotsing State, 57 J.L. POL’Y & GLOBALIZATION 110, 111 (2017); JEAN
D’ASPREMONT, PERSONA NON GRATA, MAX PLANCK ENCY. OF PUB. INT’L L., ¶ 1 [hereinafter
PERSONA NON GRATA].
151 VCDR, supra note 149, 23 U.S.T. at 3233–34, 500 U.N.T.S. at 102.
152 Id.; PERSONA NON GRATA, supra note 150, ¶¶ 10, 12.
153 VCDR, supra note 149, 23 U.S.T. at 3233–34, 500 U.N.T.S. at 102; PERSONA NON
GRATA, supra note 150, ¶ 12; VCDR, AM. SOC’Y INT’L L., supra note 146.
154 VCDR, supra note 149, 23 U.S.T. at 3234, 500 U.N.T.S.at 102; PERSONA NON GRATA,
supra note 150, ¶¶ 12–13. Forty-eight hours is typically considered a reasonable time after which
a diplomat declared “persona non grata” must leave the receiving statPeE.RSONA NON GRATA,
supra note 150, ¶ 13.
155 Id. ¶ 5; see VCDR, supra note 149, 23 U.S.T. at 3233–34, 500 U.N.T.S. at 102 (providing
that states may declare a diplomat “persona non grata” at any time and without explanation).
156 See BARKER, supra note 149, at 168 (showing that the right is not susceptible to abuse
because states are strongly hesitant to declare diplomats “persona non grata,” likely because they
fear retaliatory action); PERSONA NON GRATA, supra note 150, ¶ 14 (showing that the right is not
susceptible to abuse because diplomats declared “persona non grata” are not “automaticallys-di
missed” and “[i]t is incumbent upon the sending State to decide on the ensuing career of the agent
concerned”). Although the declaration of “persona non grata” declaration is considered a powerful
and controversial one, it is mainlythe unwelcome diplomat that feels its effects, rather than the
sending state’s government. See Bump, supra note 96; PERSONA NON GRATA, supra note 150,
ic mission such as embassies or consulat1e57s. The idea that diplomatic
premises are protected is central to diplomatic law and was widely regc-o
nized as early as the eighteenth century1.58 In the VCDR, the premises of a
diplomatic mission are expansively defined as “the buildings or parts of
buildings and the land ancillary thereto, irrespective of ownership, used for
the purposes of the mission including the residence of the head of the ms-i
sion.”159 In particular, Article 22 of the VCDR plainly states that “[t]he
premises of the mission shall be inviolable” and “their furnishings and other
property thereon .. . shall be immune from search, requisition, attachment
or execution.”160 Article 30 extends the same inviolability and protection
granted to premises of diplomatic missions to a diplomatic agent’s private
residence.161 The VCDR does not prescribe a punishment for a violation of
its terms, other than that a state may expel diplomats and sever all
diplomatic relations with the offending state.162 The offended state has the option to
appeal to the world’s primary judicial body—the International Court of
Justice (ICJ). 163 States rarely pursue this option, howeve16r4. The ICJ must
agree to hear the case and have jurisdiction over the parties, which is not
automatic. 165 Even if the ICJ hears the case and finds in the offended state’s
favor, its decisions are often not adhered to and it lacks an effective
enforcement mechanism.166 Consequently, many international law violations
go unpunished. 167
D. The Legality of the U.S. Response to Russia’s Cyber Attack
President Obama’s press release in conjunction with the December 29,
2016 Executive Order referred to the measures taken against Russia ine-r
sponse to its cyber attack on the DNC as “sanctions.”168 The United States,
however, imposed the measures without support from the UN Security
Council or other international organization and therefore do not qualify as
sanctions under the two more restrictive definitio16n9s.Even under the
broadest definition of sanctions as “any action against a State to compel it
to obey international law or to punish it for a breach of international law,”
the U.S. measures fall shor1t7.0 The Obama Administration did not state
whether Russia’s cyber attack violated international law, only that it
violated “established international norms of behavior.”171 This is not a distinction
without a difference, as the term “international norms” does not indicate an
international legal obligation.172
166 See, e.g., Amuda-Kannike Abiodun et al., An Examination of the Enforcement of ICJ
Decisions Through Regional Organizations and Specialized Agencies, 59 J.L. POL’Y &
GLOBALIZATION 21, 21 (2017) (stating that ICJ enforcement is inadequate); Aloysius P. Llamzon, Jurisdiction
and Compliance in Recent Decisions of the International Court of Justice, 1E8UR. J. INT’L L.
815, 825–44 (detailing five recent instances of ncoonm-pliance with ICJ decisions)B.ut see
PHILIPPE COUVREUR, THE INTERNATIONAL COURT OF JUSTICE AND THE EFFECTIVENESS OF
INTERNATIONAL LAW 80 n.128 (2016) (noting that non-compliance with the ICJ’s decisions is
“extremely rare” but acknowledging a number of cases of nocno-mpliance); How the Court Works,
INT’L CT. OF JUST., http://www.icj-cij.org/en/how-the-court-works [http://perma.cc/37DJ-D2EY]
(explaining that it is rare for an ICJ decision to go unimplemented because cases have to be
submitted and parties have to consent to jurisdiction).
167 See Abram Chayes & Antonia Handler Chayes, On Compliance, 47 INT’L ORG. 175, 197–
201 (1993) (recognizing that the international legal system tolerates a lot of cnoomnp-liance);
Koplow, supra note 163, at 54–55 (pointing out that treaty violations are often inconclusive).
168 Press Release, The White House, supra note 12.
169 See Exec. Order No. 13,757 (taking measures pursuant to U.S. law only); Ruys, supra note
102, at 20–21 (identifying two more restrictive definitions of sanctions).
170 Ruys, supra note 102, at 19 (quotingSanctions, supra note 122); see Goodman, supra note
96 (recognizing that the question of whether Russia violated international law is irrelevant to dre-te
mining the legality of the U.S. measures against Russia because they were retorsions); Patrick
Tukcer, Did Russia’s Election Meddling Break International Law? Experts Can’t AgreGe,OV’T EXEC.
(Feb. 8, 2017), ht/t/pw:
ww.govexec.com/technology/2017/02/did-russias-election-meddling-breakinternational-law-experts-cant-agree/135260/ [http://perma.cc/DW77-B7SA] (recognizing the U.S.
expulsion of diplomats and economic measures as retorsions).
171 Press Release, The White House, supra note 12; Goodman, supra note 96.
172 Goodman, supra note 96; see Jelena Cupac, Emerging International Norms and State
Behavior: Chinese Foreign Policy Between “Plur aist Pull” and “Solidarist Push,” 9 CEU POL.
SCI. J. 39, 39–40 (recognizing international norms of behavior as “ingredients of international
In actuality, the United States largely executed its response to Russia
pursuant to the doctrine of retorsions, unfriendly acts that do not violate the
acting state’s international obligations.173 Although retorsions are the most
unregulated mode of international response, the United States had numerous
international legal obligations in responding to Russia’s cyber attackn,- i
cluding the VCDR and the prohibition on imposing coercive economic
measures without support from an international organization.174 Pursuant to
Article 9 of the VCDR, the United States was undoubtedly permitted to
declare thirty-five Russian diplomats “personas non grata.”175 It is less clear,
though, whether the United States actedconsistently with its international
obligations when closing two Russian compounds on U.S. territory and
taking economic measures against certain Russian entities and individuals.176
In regards to the U.S. closure of two Russian compounds, Article 22 of
the VCDR prohibited it if the compounds were “premises of a mission.1”77
Media reports conflicted as to whether the two Russian compounds were
mainly used as surveillance outposts for Russian spies or as vacation homes
for Russian diplomats.178 Either way, the two compounds were reasonably
considered protected premises under the VCD17R9. The VCDR defines
“premises of the mission” quite broadly, extending it to any building and the
land connected with it used for “the purposes of the missio1n80.”In fact,
records showed that at least one of the compounds received a partial tax
exemption due to its status as a government embassy, which is typically
considered a protected diplomatic premises under Article 22 of
VCDR.181 The VCDR does not define what constitutes “purposseof the
mission” and does not expressly require that the premises be used solely for
“purposes of the mission.”182 The phrase therefore arguably encompasses
both surveillance and vacationing, and likely neither served as the sole
purpose of the Russian compounds18.3 Alternatively, the Russian compounds
could have been rendered inviolable under Article 30 because they were
“[t]he private residence of a diplomatic agent,” which the VCDR also does
not define.184 It was therefore highly likely that the United States acted
contrary to its international law obligations under the VCDR in closing the two
Similarly, the U.S. economic measures taken against Russia were in
conflict with UN resolutions prohibiting the use of coercive, economic
measures without UN authorization1.86 The U.S. measures are reasonably
deemed coercive to the extent that they were aimed at changing Russian
policies, such as those regarding cyber surveillanc1e8.7 The United States
181 Tehran, 1980 I.C.J. Rep., ¶ 19; Diaz, supra note 86.
182 See VCDR, supra note 149, 23 U.S.T. at 3231, 500 U.N.T.S. at 98 (neglecting to define
“purposes of the mission”);PREMISES OF DIPLOMATIC MISSIONS, supra note 158, ¶17 (noting
that conducting activities contrary to diplomatic missions, such as smuggling, on diplomatic
premises does not affect inviolability).
183 See VCDR, supra note 149, 23 U.S.T. at 3231, 500 U.N.T.S. at 98 (neglecting to define
“purposes of the mission”); PREMISES OF DIPLOMATIC MISSIONS, supra note 158, ¶ 17
(recognizing that diplomatic premises may be used for nodnip-lomatic purposes and remaininviolable);
Diaz, supra note 86 (providing accounts of the Russian compounds as being used for surveillance
and vacationing). “Purposes of the mission” in the VCDR could be construed to include vacation
homes for diplomats because diplomatic missions often serve to maintain the sending state’s
presence in that country. See VCDR, supra note 149, 23 U.S.T. at 3231, 500 U.N.T.S.at 98
(identifying “functions of a diplomatic mission” as including “[r]epresenting the sending State in thee- r
ceiving State”). Surveillance could also reasonably be considered a “purpose of the mission”;
illicit or questionable activities do not impact the inviolability of the premises of a
mission.PREMISES OF DIPLOMATIC MISSIONS, supra note 158, ¶17. Also, even if vacationing and usrveillance
are not proper purposes, the VCDR does not specify that a property must be usedsolely for
“purposes of the mission” in order to be considered a “premises of a mission.”See VCDR, supra note
149, 23 U.S.T. at 3231, 500 U.N.T.S. at 98. It is hihgly probable that the Russian diplomats also
used the two compounds for some other purpose, such as for conducting negotiations inp-erson or
over the phone. See Diaz, supra note 86.
184 Rezchikov et al.,supra note 87; see VCDR, supra note 149, 23 U.S.T. at3240, 500
U.N.T.S. at 110 (neglecting to define “private residence of a diplomatic agent”).
185 Rezchikov et al.,supra note 87; see VCDR, supra note 149, 23 U.S.T. at 3237, 500
U.N.T.S. at 106 (recognizing inviolability of premises of diplomatic missions).
186 G.A. Res. 46/210, supra note 135; G.A. Res. 2131, supra note 135; Doraev, supra note
133, at 376–77.
187 See Matthew Happold, Economic Sanctions and International Law: An Introduction in
ECONOMIC SANCTIONS AND INTERNATIONAL LAW 3 (Matthew Happold & Paul Eden ed. 2016)
(“[I]t is argued that all ‘coercive measures’ are unlawful; that is, measures whic.h. s.eek to
require the target State to change its policies on any matter within its domestic jurisdiction .. . .”);
and other countries, however, have routinely taken noemcoic measures
without authorization from the UN or another international organization,
and were never concretely reprimanded1.88 International practice therefore
indicates that the U.S. economic measures were legal, but they were
nevertheless contrary to several UN resolutions and the general trend in modern
III. COMBATTING STATE-SPONSORED CYBER ATTACKS
WITH A NEW CYBER TREATY
There is not an international law that directly applied to Russia’s cyber
attack on the DNC.190 Consequently, it was indeterminable whether Russia
violated the law and the United States was extremely challenged to
formulate a response consistent with international law1.91 The United States
ultimately grounded its response in generic and anachronisticinternational law
principles and thereby skirted the bounds of the law, if not violated192it.
John J.A. Burke, Economic Sanctions Against the Russian Federation are Illegal Under Public
International Law, 3 RUSSIAN L. J. 126, 127 (2015) (arguing that the economic sanctions imposed
on Russia for its annexation of Crimea were in violation of international law because
theynitended to cause change in Russia’s foreign policy).
188 See Doraev, supra note 133, at 388 (recognizing that U.S. use of economic measures may
be justified by the Lotus principle because they are not affirmatively prohibPitEedL)L;ET &
MIRON, supra note 120, ¶ 7 (stating that “[i]n a rather primitive legal order such as public
international law, with no centralized institutions to establish a violation of rules and ensure thnei-r e
forcement, [use of unilateral sanctions] is mainly incumbent upon States”)s;ee also Haass, supra
note 145 (identifying consequences of U.S. economic sanctions to include, for exampnl-e, “i
creased economic distress on Haiti, triggering a dangerous and expensive exodus of people from
Haiti to the United States” and increasing Pakistan’s dependence on a nuclear option as opposed
to concrete reprimands from other countries or an international organization).
189 See G.A. Res. 46/210, supra note 135 (strongly discouraging unilateral, coercive economic
measures); G.A. Res. 2131, supra note 135 (prohibiting unilateral, coercive economic measures);
Int’l Law Comm’n, Rep. on the Work of its Thirt-yFirst Session, U.N. Doc. A/34/10
(1979),reprinted in  2 Y.B. Int’l L. Comm’n 121, U.N. Doc. A/CN.4/SER.A/1979/Add.1 (Part 2)
(allowing “for the trend in modern international law to reservtehe term ‘sanction’ for reactive
measures applied by virtue of a decision taken by an international organization followinga breach
of an international obligation”); Doraevs,upra note 133, at 388 (recognizing that international
practice considers U.S. unilateral, economic measures legal because they are not affirmatively
190 Ido Kilovaty & Itamar Mann, Towards a Cyber-Security Treaty, JUST SECURITY (Aug. 3,
2016), https://www.justsecurity.org/32268/cyber-security-treaty [http://perma.cc/U8XE-UE3T];
Miller et al., supra note 96; see Hathaway et al., supra note 94; Hollis, supra note 94, at 1037,
1039–40; Sklerov, supra note 94.
191 Goodman, supra note 96; Miller et al., supra note 96.
192 See GIEGERICH, supra note 102, ¶ 1 (recognizing retorsions as an ancient remedy in
international law); Goodman, supra note 96 (identifying U.S. use of retorsions in responding to
Russia’s cyber attack on the DNC); PREMISES OF DIPLOMATIC MISSIONS, supra note 158, ¶ 1
(recognizing that inviolability of diplomatic premises under the VCDR is an ancient principle of
international law); Rezchikov et al.,supra note 87 (claiming that U.S. response to Russia’s cyber attack
on the DNC violated the VCDR).
Even so, the U.S. measures were far from effective in punishing Russia and
deterring future cyber attacks.193 As this Part argues, these issues emphasize
the dire need for a new international treaty—one that specifically applies to
state-sponsored cyber attacks, ensures detailed and unbiased investigations,
sets forth a predetermined response, and provides an effective reme1d94y.
This Part identifies three features the new cyber treaty needs to successfully
combat future state-sponsored cyber attacks.195 Section A recommends that
the treaty clearly and precisely define “st-astpeonsored cyber attack.”196
Section B proposes that the treaty create an international cyber seycurit
council.197 Lastly, Section C advocates for a punishment provision.198
A. Defining State-Sponsored Cyber Attacks
The new international cyber treaty should explicitly prohibit states
sponsored cyber attacks and provide a definition that is as clear and concise
as possible.199 This definition would improve states’ ability to quickly and
193 See Miller et al., supra note 96 (stating that President “Obama approved a modest package
combining measures that had been drawn up to punish Russia for other issues. .. with economic
sanctions so narrowly targeted that .. . their impact [w]as largely symbolic”); Sanger, supra note
11 (stating that the U.S. measures against Russia were “not as biting as previous ones” and it is
unclear what impact they will have except on the expelled diplomats); Rebecca Crootof,The DNC
Hack Demonstrates the Need ofr Cyber-Specific Deterrents, LAWFARE (Jan. 9, 2017), https//:
[http://perma.cc/MY96D576] (characterizing the U.S. measures against Russia as “too little, too late,” “confusing and
weak,” and “insufficient”). The U.S. measures taken against Russia for the cyber attack on the
DNC were bound to fail for at least four reasonsS. ee Miller et al., supra note 96; Sanger, supra
note 11. First, the United States waited far too long to announce the measures—six months after it
was first suspected that Russia hacked the DNC—and they appeared as an afterthought rather than
a swift condemnation of the attackS.ee Miller et al.,supra note 96; Sanger,supra note 11;
Crootof, supra. Second, the U.S. measures were not clearly aimed at a particular Russian act
connected with the DNC cyber attack and thus did not serve as a strong punishment or deterrenSt.ee
Miller et al., supra note 96; Sanger, supra note 11. Third, the United States already had numerous,
highly burdensome sanctions in place against Russia for annexing Crimea in 2014; the new
measures merely compounded these and were unlikely to encourage Russia to change its behavior.
See Sanger, supra note 11. Fourth, the United States did not quickly provide adequate evidence to
support its conclusion that Russia committed the cyber attack, thereby allowing Russia and Prei-s
dent-elect Donald Trump to deny Russia’s involvement.See Miller et al., supra note 96; Sanger,
supra note 11.
194 See Hathaway et al., supra note 94, at 877 (arguing for a new international cyber treaty);
Kilovaty & Mann, supra note 190 (recognizing need for a new cyber treaty after Russia’s cyber
attack on the DNC); infra notes 199–236 and accompanying text.
195 See infra notes 199–236 and accompanying text.
196 See infra notes 199–210 and accompanying text.
197 See infra notes 211–217 and accompanying text.
198 See infra notes 218–236 and accompanying text.
199 See Gary D. Brown, The Wrong Questions About Cyberspace, 217 MIL. L. REV. 214, 223–
25 (2013) (understanding that any definition of cyber attack will not be perfect, but a necessary
discussion and should not prevent the development of law and policy on the issue); Hathaway et
al., supra note 94, at 881 (urging states to adopt a clear definition of cyber attack); Hollissu,pra
accurately determine when a state-sponsored cyber attack has occurred.200
It would also provide states with a defensible basis for relying on the tar-e
ty’s provisions when executing a response.201
One appropriate definitionof “state-sponsored cyber attack” is “the
unauthorized viewing or copying of data of another state by a government
agent which is used for any purpose other than to inform government oif-f
cials of national security htreats.”202 This definition is broad enough to
cacount for the sophisticated and innovative nature of sta-tseponsored cyber
attacks.203 At the same time, it narrowly applies only to government agents’
actions rather than, for example, lone credit card data thieves, which are
usually not impactful enough to warrant an international response.204 It also
does not apply to government-executed, cyber espionage purely for national
security purposes, such as a government agent tapping into a foreign
terrorist cell’s computer network to determine whether they plan to attack that
agent’s home state.205 Many countries, including the United States, Russia,
note 94, at 1032–33 (explaining that information operations attacks have a variety of aims and
methods and being overly narrow eliminates its aspects that should be legally analyzed).
200 See Hathaway et al., supra note 94, at 823–26 (recognizing that definitions of cyber attack
vary widely and it is difficult to determine what has occurred); Sklerovs,upra note 94, at 14–19
(recognizing that conduct cannot be regulated effectively unless it is understood).
201 See Hathaway et al., supra note 94 (implying that states do not have a strong basis for
issuing a response to cyber attacks because the laws of war are extremely hard to apply); Hollis,
supra note 94, at 1037, 1039–40 (implying that states do not have a strong basis for issuing ae-r
sponse to cyber attacks because there are not specific rules and states have to find analogies in the
law); Sklerov, supra note 94 (implying that states do not have a strong basis for issuing a response
to cyber attacks because there is not a comprehensive treaty for international cyber attacks and
states must resort to applying law by analogy).
202 See Gervais, supra note 24, at 534 (defining cyber espionage as “the unauthorized viewing
and copying of data files”); Hathaway et al., supra note 94, at 826 (defining cyber attack as “any
action taken to undermine the functions of a computer network for a political or national security
purpose”); Solis, supra note 24, at 3, quoting WILSON, supra note 24, at 12 (defining cyber
terrorism as “unlawful attacks and threats of attack against computers, networks, and the information
stored therein when done to intimidate or coerce a government or its people in furtherance
ofoplitical or social objectives”).
203 See Hathaway et al., supra note 94, at 824 (recognizing the need for a definition of cyber
attack that does not exclude the broad range of potential threats to national security); Hollis, supra
note 94, at 1032–33 (advocating for a broad definition of information operations attacks to avoid
defining away important aspects); Sklerov,supra note 94, at 15 (recognizing that cyber attacks
come in numerous different forms).
204 See Hathaway et al., supra note 94, at 830–31 (arguing that cyber crimes not executed for
a political or national security purpose such as Internet fraud and identity theft should not be
considered cyber attacks because they do not raise the same international law questions); Peretti &
Slade, supra note 23, at 13–14 (distinguishing credit card data theft as minor and straightforward
unlike state-sponsored cyber attacks).
205 See Brown & Yung, supra note 30 (identifying China’s intrusion into U.S. networks to
steal highly classified information such as trade secrets, intellectual property, and negotiating
strategies for economic benefit as different and less acceptable than spying for national security
and China, routinely employ and heavily rely on cyber espionage activities
to protect their citizenry.206 The new treaty would therefore be more likely
to obtain ratifications and other forms of consent if it did not govern this
conduct.207 A large number of ratifications is essential to the treaty’s success
because, as with any treaty, it will only bind the states that consenot bte
bound to it.208 In other words, states that do not ratify or otherwise consent
to the new cyber treaty will not be obligated under it to cease committing
cyber attacks.209 The treaty especially needs to be ratified by states that are
strongly suspected of perpetrating cyber attacks in the past, such as Russia
and China, in order to strongly deter them from committing futu-re a
B. Creating an International Cyber Security Council
The new treaty should create an international cyber security council.211
The Organisation for the Prohibition of Chemical Weapons (“OPCW”)
would serve as an appropriate model2.12 The OPCW is an independent
niternational organization that was created by the Chemical Weapons
Convention (“CWC”), a treaty that bans chemical weapons.213 The OPCW has vast
authority to enforce the CWC, such as by confirming that chemical
weapons are destroyed and recommending that member states impose sanctions
on non-compliant states.214 Similarly, an international cyber security council
should be an independent international organization with authority over the
cyber treaty’s member states21.5 It should also have expansive power to
conduct investigations into suspected stat-esponsored cyber attacks and to
impose sanctions on perpetrators.216 The international cyber security council
would thereby ensure that state-sponsored cyber attacks are swiftly
identified, attributed to the perpetrating state, and punished appropriately. 217
C. Punishing State-Sponsored Cyber Attacks
The treaty should expressly authorize a punishment for state-sponsored
cyber attacks.218 The treaty should not identify the precise punishment, even
though that would eliminate state discretion and promote consistency in
punishing state-sponsored cyber attacks. 219 Due to the varied and
incresaingly sophisticated nature of state-sponsored cyber attacks, the punishment
the Development, Production, Stockpiling and Use of Chemical Weapons and on their Destruction,
April 29, 1997, 1974 U.N.T.S. 45, 319 (1993[)hereinafter CWC] (making numerous declarations
with respect to chemical weapons including compelling their destruction).
214 About OPCW, supra note 213; Organisation for the Prohibition of Chemical Weapon, s
supra note 213; The Chemical Weapons Convention (CWC) at a Gla n,cseupra note 213; see
CWC, supra note 214, 1974 U.N.T.S. at 335–36 (giving the Conference of the OPCW broad
powers and functions).
215 See GEERS, supra note 213, at 123, 130 (identifying the CWC as having authority to
compel signatories not to produce, use, or keep existing chemical weapons and a useful model for a
cyber weapons convention); Kilovaty & Manns,upra note 190 (advocating for an independent
organization to monitor and assist with cyber attacks).
216 See Mette Eilstrup-Sangiovanni, Why the World Needs an International Cyberwar
Cnovention, PHIL. & TECH. ¶ 3.2.3 (2017) (recommending an international cyberwar convention that
creates a collective mechanism for investigation, enforcement, and punishment); Kilovaty &
Mann, supra note 190 (recommending an international cybe-srecurity organization that has
uathority to investigate cyber attacks).
217 See Eilstrup-Sangiovanni, supra note 216 (arguing that an international cyber convention
would allow for collective action resulting in faster and more reliable attribution of cyber attacks
and meaningful enforcement and punishment); Kilovaty & Mann,supra note 190 (arguing that an
international cyber-security organization would be able to monitor and attribute cyber attacks).
218 See Eilstrup-Sangiovanni, supra note 217, ¶3.2.5 (advocating for an international cyber
convention that ensures cyber aggressors are consistently punished); John Markoff & Andrew E.
Kramer, U.S. and Russia Differ on a Treaty for CyberspaceN,.Y. TIMES (June 27, 2009), https/:/
www.nytimes.com/2009/06/28/world/28cyber.html [http://perma.cc/XN48-CHRC] (quoting aU.S.
State Department official on the need for a cyber treaty to criminalize cyber attacks).
219 See IRISH PENAL REFORM TRUST, IPRT POSITION PAPER 3: MANDATORY SENTENCING 2
(2013) (identifying mandatory minimum sentencing schemes as completely eradicating judges’
discretion); Eilstrup-Sangiovanni, supra note 216, ¶3.2.5 (arguing that the international cyber
convention should lay down clear rules for when punishment is appropriate, but not what exactly
the punishment should be).
needs to be flexible to ensure that it is proportional2.20 Therefore, similar to
the CWC, the cyber treaty should broadly authorize the international cyber
security council to issue punitive action against the perpetrating s2ta21te.
This punishment provision would significantly improve a victim state’s
ability to obtain adequate recourse against the perpetrating state in the wake
of a state-sponsored cyber attack.222 It would also deter states from
perpetrating cyber attacks and ultimately reduce their occurrence.223
This punishment provision, together with the definition and cyber
seucrity council provisions, comprise a specific, comprehensive treaty to address
state-sponsored cyber attacks.224 Drafting this treaty, obtaining the necessary
support, and implementing the recommended provisions will likely be an
raduous process.225 Also, like any treaty, it is not guaranteed to be
successful. 226 Nevertheless, state-sponsored cyber attacks are wreakinghavoc with
increasing regularity and sophistication and a specific, comprehensive inrt-e
national cyber treaty is an imperative step towards combatting them.227
State-sponsored cyber attacks are a severe, global threat. Russia’s
cyber attack on theDNC demonstrated that the current international legal
framework is woefully inadequate for combatting this threat. The United
States was forced to apply general and outdated international law principles.
As a result, the United States may have violated those principles and issued
220 See IRISH PENAL REFORM TRUST, supra note 219 (recognizing that mandatory minimum
sentencing schemes do not provide judges with flexibility to adjust the sentence according to the
circumstances); Eilstrup-Sangiovanni, supra note 217, ¶ 3.2.5 (recognizing the need for a
proportional response to cyber attacks).
221 See CWC, supra note 213, 1974 U.N.T.S. at 336 (giving the Conference of the OPCW
broad authority to take necessary measures to ensure compliance with the CWC and redress and
remedy violations); Eilstrup-Sangiovanni, supra note 217, ¶3.2.5 (proposing an international
cyber convention that allows for a punishment, but not specifying what the punishment should be).
222 See Kilovaty & Mann, supra note 190 (acknowledging that international law does little to
remdy state-sponsored cyber attacks and policymakers should consider a cyber-specific treaty).
223 See Eilstrup-Sangiovanni, supra note 217, ¶3.2.5 (arguing that punishing cyber attacks
will strengthen deterrence).
224 See Hathaway et al., supra note 94, at 877; Kilovaty & Mann, supra note 190.
225 See Eilstrup-Sangiovanni, supra note 217, ¶1 (admitting that coming to international
agreement on cyber attacks will be extremely difficult and require lengthy and complex negao-ti
tions); Hathaway et al., supra note 94, at 882 (identifying challenge of bridging divides between
the United States and other cyber powers when drafting a cyber treaty).
226 See Hathaway et al., supra note 94, at 882–84 (laying out the challenges that an
international cyber treaty will likely face); Kilovaty & Manns,upra note 190 (conceding that adapting
the CWC to cyberspace will not resolve all threats and challenges).
227 See Hathaway et al., supra note 94, at 883–85 (asserting need for international cyber treaty
despite challenges it will face); Kilovaty & Mann,supra note 190 (recognizing growing issue of
state-sponsored cyber attacks and need for international cyber treaty).
a response that was ill suited for its goals: to punish Russia and deter future
cyber attacks. In the continued absence of legal reform, -sstpaotensored
cyber attacks will continue to occur and grow in sophistication.
In order toeffectively combat against stat-esponsored cyber attacks,
countries should come together and negotiate a new, international treaty
specifically tailored to the issue. This treaty should contain three provisions.
First, it should identify a clear and comprehensive definition of -“state
sponsored cyber attack. Second, it should create an international cyber
security council. Third, it should expressly authorize a punishment for -state
sponsored cyber attacks. The treaty would thereby deter states from
mcomitting these attacks and provide an effective remedy when they occur.
13 Gambino et al., supra note 11; Sanger , supra note 11; Press Release, The White House, supra note 12; see Exec . Order No. 13 ,757; infra notes 149-151 and accompanying text (explaining that “persona non grata” means “not acceptable” and its declaration requires the sending state to “recall the diplomat concerned or terminate his functions with the mission”).
14 OFFICE OF THE DIR . OF NAT'L INTELLIGENCE , NAT'L INTELLIGENCE COUNCIL , ICA 2017- 01D, ASSESSING RUSSIAN ACTIVITIES AND INTENTIONS IN RECENT US ELECTIONS ( 2017 ). The U.S. Director of National Intelligence is the head of the U.S. Intelligence CommunityC.areers at ODNI, OFFICE OF THEDIR . OF NAT'L INTELLIGENCE , https://www.dni.gov/index.php/careers/ careers-at-odni [http://perma.cc/3HMS-QCMM].
15 OFFICE OF THE DIR . OF NAT'L INTELLIGENCE , supra note 14; Craig Forcese ,The “Hacked” US Election: Is International Law Silent, Faced with the Clatter of Cyrillic Keyboards? , JUST SECURITY (Dec. 16 , 2016 ), http/s/:www.justsecurity.org/35652/hacked-election -international-law-silentfaced-clatter-cyrillic-keyboards/ [http://perma.cc/636S-WNJ3] ; Kathy Gilsinian & Krishnadev Claamur, Did Putin Direct Russian Hacking? And Other Big Question,s THE ATLANTIC ( Jan . 6, 2017 ), https://www.theatlantic.com/international/archive/2017/01/russian-hacking-trump/510689/ [h/t/tp: perma.cc/S49E-C9J8]. There was rampant speculation about Russia's impetus for interfering with the 2016 U.S. Presidential Election. Kurt Eichenwald,Why Vladimir Putin's Russia Is Backing Donald Trump , NEWSWEEK (Nov. 4 , 2016 ), http://www.newsweek. com/donald-trump-vladimir-putin-russiahillary-clinton-united- states- europe- 516895 [http/:/perma.cc/ZGR3-QMFQ]. For example, some claimed that Russia was more concerned with lessening Clinton's chances of winning because it was believed that she improperly interfered with Russian affairs while serving as Secretary of State . Id.
16 OFFICE OF THEDIR. OF NAT'L INTELLIGENCE , supra note 14; Forcese,supra note 15; Gilsinian & Calamur, supra note 15.
17 See infra notes 21-236 and accompanying text.
18 See infra notes 21-93 and accompanying text.
19 See infra notes 94-189 and accompanying text.
20 See infra notes 190-236 and accompanying text.
39 James Cook , Staff at Sony Pictures Are Being Forced to Use Pens and Paper After a Massive Hack, BUS . INSIDER (Nov. 28 , 2014 ), http://www.businessinsider.com/staff-at -sony-picturesare-using-pens-and-paper-after-a-massive- hack- 2014- 11 [http/:/perma.cc/WL2S-WVSN]; Grsiham, supra note 38; Elizabeth Weise & Claudia PuigS,ony Hack May Be Linked to James Franco Comedy, USA TODAY (Dec. 1 , 2014 ), http://www.usatoday.com/story/tech/2014/12/01/hack-attacksony -pictures-north- korea- the-interview/19733463 [http://perma.cc/YQ5Y-XLG7].
40 Grisham, supra note 38; Weise & Puig, supra note 39; Aly Weisman, A Timeline of the Crazy Events in the Sony Hacking Scanda,l BUS . INSIDER (Dec. 9 , 2014 ), http://www.businessinsider. com/ sony-cyber-hack- timeline- 2014- 12 [http://perma.cc/W344-VBQV].
41 Sean Gallagher , Sony Pictures Hackers Release List of Stolen Corporate Files , ARS TECHNICA (Nov. 26 , 2014 ), http/s/a:rstechnica.com/security/2014/11/sony-pictures -hackers-release-listof-stolen-corporate-files/ [http://perma.cc/BXP3-PMYW]; Weisman, supra note 40.
42 Cook, supra note 39; Weisman, supra note 40.
43 Grisham, supra note 38; Weise & Puig, supra note 39; Weisman, supra note 40.
44 Grisham, supra note 38; Weisman, supra note 40. Kim Jongu-n became the third “supreme leader” of North Korea immediately after the death of his father , Kim Jong-il, on December 17 , 2011 . Profile: Kim Jong-un, North Korea's Supreme Commander, BBC NEWS (Jan. 6 , 2016 ), http://www. bbc.com/news/world-asia-pacific- 11388628 [http://perma.cc/9G4Z-4LFS]; Paul Szoldra et al., How a Quiet Boy from North Korea Became One of the World's Scariest Dictator,sBUS . INSIDER (Sept. 9 , 2016 ), /h/twtpw: w.businessinsider.com/kim-jong-un-life -2016-9/#some-originally-believed-thatkim-jong-uns-aunt-and-uncle-were-actually-calling-the-shots- 9 [http//:perma.cc/36HF-FNSD]. As “supreme leader,” Kim Jong-un has complete control over the country, including the world's fourthlargest military . Szoldra et al., supra. Under the Kim family regime, North Korea is known as “the world's most oppressed nation” where there is “no freedom of speech or religion,” “the world's most closed nation” where there is “no freedom of information,” and the “world's darkest nation” where there is “little light, politically, spiritually, and even physically.” Benedict Rogers, North Korea in the Dark , N.Y. TIMES (Jan. 28, 2013 ), http/:/www.nytimes.com/ 2013 /01/29/opinion/north-korea-in-thedark.html [http://perma.cc/6PP7-BJFS].
45 Weise & Puig, supra note 39; Weisman, supra note 40.
46 Weise & Puig, supra note 39; Weisman, supra note 40.
47 Grisham, supra note 38; Weisman, supra note 40.
48 Weise & Puig, supra note 39; Weisman, supra note 40.
49 Kevin Roose , Hacked Documents Reveal a Hollywood Studio'sStunning Gender and Race Gap , SPLINTER (Dec. 1 , 2014 ), http://fusion.net/story/30789/hacked-documents -reveal-a-hollywoodstudios-stunning- gender- and - race-gap/ [http://perma.cc/JA46-4VA3]; Weisman, supra note 40.
50 Andrea Mandell & Elizabeth Weise , Sony Hit Again, Employee Families Threatened, Files Released, USA TODAY (Dec. 5 , 2014 ), http//:www.usatoday.com/story/life/movies/2014/12/05/ sony-hacked -again-this-time- employee- families-threatened/19970141/ //p[hetrtmp:a.cc/ZPU9- REYD]; Weisman, supra note 40.
51 Sherr & Rosenblatt, supra note 21; Weisman, supra note 40.
52 Grisham, supra note 38; Sherr & Rosenblatt, supra note 21.
53 Altman & Fitzpatrick, supra note 38; Grisham, supra note 38.
54 Grisham, supra note 38; see Press Release, FBI, Update on Sony nIvestigation (Dec. 19 , 2014 ) ( on file with FBI National Press Office) (basing conclusion, in part, on “links to other mlaware that the FBI knows North Korean actors previously developed,” “significant overlap between the infrastructure used in this attack and other malicious cyber activity . . . linked to North Korea,” and “similarities to a cyber attack . . against South Korean banks and media outlets, which was carried out by North Korea”).But see Altman & Fitzpatrick, supra note 38 (acknowledging that the evidence indicated that North Korea was behind the hacks, but “hackers will often dissect and imitate successful techniques”); Paul,New Clues in Sony Hack Point to Insiders, Away from DPRK , SECURITY LEDGER (Dec. 28 , 2014 ), http//ss:ecurityledger.com/ 2014 /12/new-clues -insony-hack-point-to-insiders-away-from-dprk/ [http://perma.cc/Q23M-L928] (detailing cyber security firm Norse's allegation that their investigation revealed that six individu-alosne a former Sony employee and none based in North Korea-were directly involved in the Sony hacks ).
55 Dan Roberts , Obama Imposes New Sanctions Against North Korea in Response to Sony Hack, THE GUARDIAN (Jan. 2 , 2015 ), https://www.theguardian.com/us-news/ 2015 /jan/02/obama-
80 Exec. Order No. 13 , 757 ; Killick et al., supra note 72.
81 Exec. Order No. 13 , 757 . The five entities were: (1) Main Intelligence Directorate (a.k.a GRU); (2) Federal Security Service (a.k.a FSB); (3) Special Technology Center; (4) Zorsecurity; and (5) Autonomous Noncommercial Organization “Professional Association of Designers of Data Processing Systems .” Id. The four individuals were: (1) Igor Valentinovich Korobov; (2) Sergey Aleksandrovich Gizunov; (3) Igor Olegovich Kostyukov; and (4) Vladimir Stepanovich Alexseyev . Id.
90 Lee Ferran , The NSA Is Likely 'Hacking Back'Russia's Cyber Squads , ABC NEWS ( July 30 , 2016 ), http://abcnews.go.com/International/nsa-hacking -back-russias-cyber-squads/story ?id= 41010651 [http://perma.cc/BQN8-QXHP]; Ellen Nakashima, Obama Administration Is Close to Announcing Measures to Punish Russai for Election Interference, WASH . POST (Dec. 27 , 2016 ), https://www.washingtonpost.com/world/national-security/ the-white-house-is-scrambling-for-away-to-punish-russian- hackers- via-sanctions/ 2016 /12/27/0eee2fdc-c58f - 11e6 - 85b5 -76616a33048d_ story.html?utm_term= .70fe81b3a3da [http://perma.cc/RWS5-BFZ6].
91 Gambino et al., supra note 11; Sanger, supra note 11.
92 David Jackson , Obama Sanctions Russian Officials Over Election Hackin , gUSA TODAY (Dec. 29 , 2016 ), https://www.usatoday.com/story/news/politics/2016/12/29/barack-obama - russiasanctions - vladimir-putin/95958472/ [http://perma.cc/5CG4-WLEV]; Sanger, supra note 11.
93 Jackson, supra note 92; Sanger, supra note 11.
125 Ruys, supra note 102, at 21; Brzoska, supra note 124, at 1343-45; Meredith Rathbone et al., Sanctions , Sanctions Everywhere: Forging a Path Through Complex Transnational Sanctions Laws, 44 GEO . J. INT'L L . 1055 , 1057 ( 2013 ).
126 Ruys, supra note 102, at 22; Jonathan Masters , What Are Economic Sanctions?, COUNCIL ON FOREIGN REL ., https://www.cfr.org/backgrounder/what-are - economic-sanctions [http://perma. cc/ATR7-KHEX] (last updated Aug. 7 , 2017 ).
127 Ruys, supra note 102, at 22-23; Masters, supra note 126.
128 Portela, supra note 121, at 4; Gary Clyde Hufbauer & Barbara Oegg, Targeted Sanctions: A Policy Alternativ,e PETERSON INST . FOR INT'L ECON. (Feb . 23, 2000 ),https://piie.com/ commentary/speeches-papers/targeted-sanctions - policy-alternative [http://perma.cc/5JMV-2V99]. Sanctions specifically targeted to affect only certain individuals are sometimes referred to as “smart sanctions . ” Portela, supra note 121 , at 4; Hufbauer & Oegg, supra.
129 Paul Szasz , The Law of Economic Sanctions, in 71 INTERNATIONAL LAW STUDIES 455; BARRY E . CARTER, ECONOMIC SANCTIONS , MAX PLANCK ENCY . OF PUB . INT'L L. , ¶ 33 .
130 GARY CLYDE HUFBAUER ET AL ., ECONOMIC SANCTIONS RECONSIDERED 3 (3d ed. 2009 ).
131 Barry Klodokin , What Are Sanctions?, THOUGHTCO., https://www.thoughtco.com/whatare-sanctions- 3310373 [http://perma.cc/TL3N-C8N2] (last updated May 15, 2017 );Masters, supra note 126.
132 CARTER, supra note 129, ¶ 7; see Szasz, supra note 129 , at 455 ( acknowledging that there are numerous instances in which economic sanctions have been imposed with questionable effectiveness and legal issues) . Economic sanctions were imposed as early as 432 B.C. when Pericles limited the entry of products from Megara, Greece to Athens, Greece in retaliation for Megara adding new territory and kidnapping three womenC . ARTER, supra note 129, ¶ 7. In the eyars since then, states have continued to impose economic sanctions to achieve various, and often controversial, objectives such as inciting a governmental regime change, interfering with a state's development of nuclear weapons, protecting human rights, and fighting terrorism . Id.
133 UN Charter art. 41 ; Mergen Doraev , The “Memory Effect” of Economic Sanctions Against Russia: Opposing Approaches to the Legality of Unilateral Sanctions Clash Again, 3U7 . PA. J. INT'L L . 355 , 373 - 74 ( 2015 ).
157 See VCDR , supra note 149 , 23 U.S. T. at 3233-34 , 3237 , 500 U.N.T.S. at 102 , 106 (recognizing right to expel diplomats and heavily restricting interference with diplomatic premises);see also United States Diplomatic and Consular Staff in Tehran (U.S. v . Iran)J,udgment, 1980 I.C.J. Rep . 64 , ¶ 62 (May 24) (recognizing the inviolability of diplomatic premises under the VCDR) .
158 ERNEST MASON SATOW , SATOW'S DIPLOMATIC PRACTICE 101 (6th ed. 2009 ) ;JEAN D'ASPREMONT, PREMISES OF DIPLOMATIC MISSIONS, MAX PLANCK ENCY . OF PUB . INT'L L. , ¶ 1 [hereinafter PREMISES OF DIPLOMATIC MISSIONS] .
159 VCDR, supra note 149 , 23 U.S.T. at 3231 , 500 U.N.T.S. at 98.
160 Id. at 3237 , 500 U.N.T.S. at 106.
161 Id. at 3240 , 500 U.N.T.S. at 110.
162 See VCDR , supra note 149 , 23 U.S. T. at 3233-34 , 500 U.N.T.S. at 102 ( permitting states to declare diplomats “persona non grata” and sever diplomatic relations).
163 David A. Koplow , Indisputable Violations: What Happens When the United States Unambiguously Breaches a Treaty?, 37 FLETCHER F . WORLD AFF . 53 , 54 - 55 ( 2013 ); see Tehran, 1980 I.C.J. Rep ., ¶¶ 62 - 63 ( deciding case between Iran and United States regarding VCDR violations, including the inviolability of premises provision).
164 See Koplow , supra note 163 , at 54-55 ( noting that the ICJ resolves only two to three cases a year and it does not have automatic jurisdiction); S. GoziOe gbodo, An Overview of the Challenges Facing the International Court of Justice in the 21st Centur,y18 ANN . SURV. OF INT'L & COMP . L. 93 , 107 ( 2012 ) (identifying that four out of five permanent Security Council members have rejected the ICJ's compulsory jurisdiction, severely reducing its power and influence ).
165 See Koplow , supra note 163 , at 54-55 ( noting that the ICJ does not have automatic jursidiction over the United States, Russia, and other key international actorsB)a; sis of the Court's Jurisdiction, INT'L CT . OF JUST ., http://www.icj-cij.org/en/basis-of-jurisdiction [http/:/perma. cc/MH4T-DDFS] (identifying the ways in which the ICJ is granted jurisdictional authority, which are based on consent of the states involved in contentious proceedings ).
173 Int'l Law Comm'n, Report on the Work of Its Fifty-Third Session, supra note 102 , at 325; Goodman, supra note 96; Tucker, supra note 170.
174 Ruys, supra note 102, at 24; Doraev,supra note 133, at 376-77; GIEGERICH, supra note 102, ¶ 1 .
175 Bump, supra note 96; see VCDR , supra note 149 , 23 U.S. T. at 3233-34 , 500 U.N.T.S. at 102 ( establishing right to declare diplomats “personas non grata”).
176 See VCDR , supra note 149 , 23 U.S.T. at 3237 , 500 U.N.T.S. at 106 ( recognizing invioalbility of premises of diplomatic missions);Doraev , supra note 133, at 376-77 ( recognizing customary international law prohibition on coercive, economic measures imposed unilaterally); Press Release, The White House, supra note 12 (announcing closure of two Russian compound on U.S. territory and economic measures against four Russian entities and five Russian individuals ).
177 See VCDR , supra note 149 , 23 U.S.T. at 3237 , 500 U.N.T.S. at 106 ( recognizing invioalbility of premises of diplomatic missions)R;ezchikov et al., supra note 87 ( quoting Professor Dmitry Labin of Moscow State Institute of International Relations as stating that the VCDR “establishes the immunity of a state and its property used for [diplomatic purposes]” and the U.S. seizure of the Russian compounds was “a blatant violation” of the VCDR) .
178 See Diaz , supra note 86 (describing Russian compounds as quie;t)Mazzetti & Schmidt, supra note 85 (describing Russian compounds as “luxurious waterfront compounds” used as “a retreat for Russian diplomats”); Windrem et al ., supra note 86 ( describing Russian compounds as “festooned with all manner of antenna for capturing communications” and having “clear electronic views of several critical U .S. facilities”).
179 See VCDR , supra note 149 , 23 U.S.T. at 3231 , 500 U.N.T.S. at 98 ( defining “premises of the mission”); Rezchikov et al ., supra note 87 ( arguing that the Russian compounds were protected premises under the VCDR) .
180 VCDR, supra note 149 , 23 U.S.T. at 3231 , 500 U.N.T.S. at 98.
206 See Brown & Yung, supra note 30; see Jeffrey H. Smith , Keynote Address, 28 MICH. J. INT'L L . 543 , 544 ( 2007 ) (stating that espionage is a “fixture in international affairs”).
207 See Waxman , supra note 21 , at 435 ( postulating that the U.S. government would be reluctant to interfere with their ability to prepare to eliminate hostile systems in advance of full-fledged attacks); Brown & Yung, supra note 30 (theorizing that the United States did not advocate to the UN in a 2015 report for an international norm of refraining from espionage because it would be rejected by countries like China and Russia) .
208 Vienna Convention on the Law of Treaties, May 23 , 1969 , 1155 U.N.T.S. 331 , 335 ; Curtis A. Bradley , Unratified Treaties, Domestic Politics, and the U.S. Constitutio n, 48 HARV . INT'L L. J . 307 , 307 ( 2007 ) ; see Hathaway et al ., supra note 94 , at 864 , 883 (finding that the Convention on Cybercrime is limited because its members, for the most part, are only European countries ).
209 See Vienna Convention on the Law of Treaties , 1155 U.N.T.S. 331 , 335 (providing means of expressing consent to be bound by a treaty); Bradleys,upra note 208, at 307 (noting that nations become bound to a treaty upon ratification or accession);Kilovaty & Mann, supra note 190 (recognizing need for a binding cyber treaty ).
210 Hathaway et al., supra note 94 , at 881; see Kilovaty & Mann, supra note 190 (identifying the United States, Russia, and China as major players in cyber operations).
211 See KENNETH GEERS , STRATEGIC CYBER SECURITY, NATO COOPERATIVE CYBER DEFENCE CENTER OF EXCELLENCE 125 ( 2011 ) (advocating for an international cyber convention similar to the Chemical Weapons Convention (“CWC”)); Kilovaty & Mann,supra note 190 (proposing an international cyber security organization).
212 GEERS, supra note 213, at 123; Kilovaty & Mann,supra note 190; see About OPCW , ORGANISATION FOR THEPROHIBITION OF CHEMICAL WEAPONS , https://www.opcw.org/about-opcw/ [http://perma.cc/7ASB-LMB3] (describing the Organisation for the Prohibition of Chemical Wpe-a ons (“OPCW”)).
213 About OPCW , supra note 212; Organisation for the Prohibition of Chemical Weapons, THE HAGUE , http://www.haguejusticeportal.net/index.php?id=333 [http/:/perma.cc/3FVQ-QWFB] ; The Chemical Weapons Convention (CWC) at a GlancAe,RMS CONTROL ASS'N , https://www.arms control.org/factsheets/cwcglance [http://perma.cc/M72R-337Z] ; see Convention on the Prohibition of