Anticipatory and preemptive self-defense in cyberspace: The challenge of imminence

As the potential for disastrous consequences from cyber threats increases in prevalence, the speed which such cyber threats can occur presents new challenges to understandings of self-defense. This paper first examines the cyber threats nations could face. It next looks at existing concepts of self-defense with particular focus on anticipatory and preemptive self-defense, and then moves to a review of the underlying criteria which govern the right to resort to such actions. As will be shown, definitions for anticipatory and preemptive self-defense are less useful than an understanding of the actual criteria that must be met to justify their use. These criteria include necessity and proportionality, and for anticipatory and preemptive actions, imminence. The paper will turn this review to the cyber context, first examining how cyber operations are conducted, and then applying the self-defense criteria to the cyber domain. As will be shown, the most critical legal challenge in this analysis will be the determination of an imminent threat. Imminence in the cyber domain must not be tied to a strict temporal analysis, but should accommodate a broader window of opportunity approach, which in turn must give consideration to the likelihood that a victim State may not always know the intent of an adversary who implants malicious malware on the victim State´s critical infrastructure. Using a hypothetical case, the paper will evaluate potential decision making for a State facing a potential cyber threat. In conclusion, the paper will show that an understanding of the process for determining a right to anticipatory or preemptive self-defense must be considered by a cyber actor conducting cyber operations on a potential adversary´s systems to help ensure such actors do not inadvertently give their adversary a reasonable basis to determine that an attack is imminent.