Kristi Raidma

Kristi Raidma is currently working as a development consultant in Armenia. She has a Bachelor's degree in Peace, Conflict and Security and a Masters degree in Security Studies from Aberystwyth University (Wales, UK).

Tallinn Manual 2.0 – the invaluable guide for state action in cyber space

Following the principle set in the first version, Tallinn Manual 2.0 – a document that provides guidance on how the existing international law could be adapted to cyber operations in the most appropriate way – reiterates that cyber activity should not be perceived as happening in a legal vacuum.

Estonia has become one of the forerunners and success stories of introducing digital identity, e-governance and an online voting system. The e-residency programme, which allows foreign citizens living outside of the physical national borders of Estonia to obtain a secure digital identity and benefit from some of the services available, has further increased the interest in Estonia’s digital developments, contributing to Estonia’s image as one of the world’s most digitally advanced countries.

This impressive degree of integration means e-dimension is no longer solely the playfield of the IT sector. As this new dimension is rapidly gaining ground, various topics need to be addressed, including (and perhaps most importantly) security.

In regards to international relations, the role of the state in providing the necessary safeguards for the digital dimension, as well as its responsibility for holding malign actors to account, emerges when the state needs to decide what is the most appropriate way to respond to such acts. The universal ecosystem around the new developments is still lacking and needs to be built to provide the necessary support and integration for smooth technology transfer.

“As there are very few cyber-specific norms in international law, the space for legal interpretation is broad, which in practice can result in states playing by different rules in cyberspace,” Liis Vihul, a senior analyst at the NATO Cooperative Cyber Defence Centre of Excellence in Tallinn and the managing editor of Tallinn Manual 2.0, says. The existing rules that also govern this new space need to be jointly interpreted to bring clarity in understanding what is acceptable state behaviour and what are the potential consequences if the rules are ignored.

154 general rules to be followed

The first edition of the Tallinn Manual was published in 2013 by Cambridge University Press under the auspices of the Tallinn-based NATO Cooperative Cyber Defence Centre of Excellence and mainly concentrated on the severe cyber-attacks which may occur during an armed conflict and might entitle states to respond in self-defence. The newly updated and extended version, Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations, was published in February 2017.

Following the principle set in the first version, Tallinn Manual 2.0 reiterates that international law applies also to cyber operations, and that cyber activity should not be perceived as happening in a legal vacuum.

The second edition builds on the previous version and further expands the spectrum of cyber operations, providing legal analysis also on those cyber incidents that are encountered by states on a day-to-day basis and that do not necessarily qualify as act of war. “The common perception is that it is nearly impossible to identify the perpetrator of a cyber operation, whereas in reality, it depends on the state’s intelligence capabilities and in the recent past, we’ve seen states attribute cyber operations to other states on a number of occasions,” Vihul explains.

The manual is providing guidance on how exactly the existing international law could be adapted to cyber operations in the most appropriate way. To be exact, international experts identified 154 general rules to be followed.

To ensure that the views of state representatives, as the primary beneficiaries of the book were taken into account, an unofficial consultation process was held in The Hague with more than 50 different states from all over the world. According to Vihul, engaging state representatives was particularly important, as states are the primary stakeholders when it comes to international law – the ones who make, implement and enforce it.

Building an international consensus

In cases where the international experts did not manage to reach a consensus, different opinions were included in the commentary to allow the reader to weigh the possible options. This is particularly relevant, as several cyber operations that states are tackling occur in a grey zone. The manual is a significant contribution to these debates, as it sheds light to the areas that need further attention and thus provides the necessary basis for more focused and informed debates among all the relevant stakeholders.

It is not a unique way of consensus building: the Tallinn Manual is an addition to the collection that already consists of the 1880 Oxford Manual – the Laws of War on Land, the 1994 San Remo Manual on International Law Applicable to Armed Conflicts at sea, and the Harvard Program on Humanitarian Policy and Conflict Research’s 2009 Manual on International Law Applicable to Air and Missile Warfare.

In light of this, the new Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations is a significant step forward in creating the regulatory framework for the new reality.

Even though it is not a legally binding document, it is a practical resource for legal advisers on issues that up to now have mostly been tackled on ad hoc and case-by-case basis. “Tallinn Manual 2.0 is an invaluable tool for governmental lawyers responsible for providing legal advice in mainly two situations – first, when their state has become a victim of hostile cyber operations and would like to know its response options, and second, when the state is planning to engage in cyber operations, but needs to ensure that it does so in compliance with international law,” Vihul emphasises.

Contributing to creating a common understanding and building consensus on how to approach different level cyber-attacks will not only help the states make prompt decisions on how to defend themselves, but will also deter those planning to use cyber operations as means to cause harm to another state and its citizens.

I

The cover image is illustrative.

Lindad – how Estonian girls learned to play rugby in Wales

Estonians can do anything if they put their heart and mind to it. Thirteen Estonian girls who learned to play rugby in three months and participated in the Rugby 7s tournament held in Wales are a living example.

Aberystwyth is a small university town situated on the coastline of Wales. There is a growing number of Estonians studying in this multicultural but not so widely known university. As it is almost inevitable in a foreign country, Estonians end up running into each other. Aberystwyth has a small community of my countrymen who honour traditions and come together to celebrate national holidays.

Small nations keen on preserving their traditions

This is something that is also common for the Welsh; they are a small nation very keen on preserving their language and traditions. While living in Aberystwyth it becomes rather clear that rugby has a very important place in the Welsh culture.

Rugby 7s is  annually held in Aberystwyth and it is the highlight of the year. Teams from different parts of the UK gather to Aberystwyth for the first weekend of May to participate in the tournament. This event is extremely popular among students; many continue to return for years after graduation. In 2012, after we had attended two Rugby 7s tournaments as viewers, we decided that Estonian girls are tough enough to compete with the participating teams.

unnamed (15)

Many of the girls can most likely admit that the first time we saw rugby being played it seemed there was not enough money in the world that could make us voluntarily participate. (For those not familiar with the game, it should be mentioned that rugby is often described to be like American football but for real men.)

Brave Estonian girls

In order to register for the tournament at least seven players need to be in the team. It turned out that the fear of not having enough brave Estonian girls was needless – we ended up having 13 members in our team (14 is the maximum). We also had to find a coach who would actually know something about the game and would be ready to train us for free. We were lucky to find not only one but two dedicated volunteers – James and Hugo.

unnamed (9)

The name often used by the Estonian sports teams is Kalev (it is the name of the father of the hero known from the Estonian national epic), so in order to relate to the national nature of the team, we called ourselves Lindad, after the mother of the hero – Linda.

The first practice took place on a small grass ground behind one of the buildings of the university. Both our coaches were there. This also happened to be the first time we held a rugby ball. At first even the basic exercises were confusing, mainly because the ball had to be thrown backwards, not forwards. Our British coaches probably left the first session thinking that their main task is actually to ensure that we are alive in the end of the tournament.

Lindad - Estonian rugby girls

Since the majority of us had never managed to figure out the rules of the game, they made it compulsory for us to watch rugby games. In order to make sure that there was an educational dimension, they joined us and patiently answered all the questions we had.

Despite the bad weather that accompanied us through most of our training sessions we continued to practise. We were motivated by the good company, the dedication of the coaches, team spirit, our national pride and the game itself. As time passed the trainings became more technical.

unnamed (8)

At first we were sure that our secret weapon will be the Estonian language because we could plan our moves during the game without the other team understanding. But as soon as we had our first tackling practice and hence, had to wear mouth guards, we realised that even we do not understand “the planned” moves.

Tournament

Before we knew it was the beginning of May and time for Rugby 7s. The atmosphere in the tournament is addictive. Everyone is in their rugby kits and there is an overall feeling of excitement in the air. Being a participant in the tournament adds so much to the Rugby 7s that it felt like a totally different event compared with the one that we had been to as viewers.

unnamed (19)

We all loved our blue, black and white kits and were very happy to see all our friends and fellow Estonians who had come to support us. We drew Estonian flags on our cheeks and went to play our first game. Since our coaches were participating in the tournament themselves and there were about six or seven games happening at the same time, we had to manage without them. Nonetheless, whenever they could, they watched our games and instructed us and whenever we had the opportunity we went to see them play.

Lindad - Estonian rugby girls

Unfortunately, we also had to encounter the ugly side of rugby when one of our girls hurt her neck in the middle of a game. She had to be put on a stretcher and was taken to the hospital. Fortunately, what first appeared to be a very serious injury ended up being a slight concussion. This, however, did not stop her from taking a taxi back to the rugby fields. She returned to play despite the rejections from the rest of the team. Everyone else got some bruises and bumps that we wore proudly.

Slow to start first, difficult to stop later

Our overall performance in the tournament can be described with the Estonian saying “Algul ei saa vedama, pärast ei saa pidama” ( “slow to start first, difficult to stop later”).

unnamed (5)

Our initial goal was to beat at least one team but by the afternoon of the second day we had qualified for the next round. In the end, we were on the sixth place (from 20 teams). This was way beyond of what any of us dared to dream. Even our coaches, who never stopped believing in us, were surprised of how quickly we managed to pick up the game and how well we ended up playing in the tournament.

unnamed (13)

Those who stayed in Aberystwyth continued to hold the team spirit high. They recruited new Estonians and since James and Hugo left, they found new coaches – Nathan and Matt. They trained and explained the game to the new Lindas. They prepared for and anxiously waited for the next Rugby 7s where once again Lindad managed to offer a competition for the locals.

I

Photos courtesy of Kristi Raidma.

Estonian NGO contributes to the future of young Syrian refugees

Syria has been dominating the headlines of international media channels for quite some time now. It seems the conflict that has been going on for two years has little left to astonish us with. Nonetheless, amid the political debates and discussions on the appropriate international response to the civil war in Syria, the human side of the story has perhaps not always received as much attention as it deserves.

Even though the conflict is mainly perceived as a political issue, it has also evolved into a large-scale humanitarian crisis. As a direct outcome of the civil war, there are currently 4.5 million internally displaced people and two million refugees.

While the end of the conflict does not seem to be in sight, a growing number of people are gathering in “temporary” refugee camps, waiting for a chance to return home. Camps like these can be found in all Syria’s neighbouring countries. The biggest one is situated in Jordan. The number of Syrian refugees who have entered this neighbouring state is more than 500,000. From these Syrians, about 130,000 live in the Za’atri refugee camp, which makes it the fifth largest “city” in Jordan and the second largest camp in the world.

KoolihoovAbout half of the population in this camp is less than 18 years old. These boys and girls left everything they knew in Syria and went to Jordan with a new distorted understanding of life. Life that is full of violence, frustration and hopelessness. In these conditions it is clearly difficult to develop or maintain high ambitions and expectations for the future. One of the indicators of this attitude is the number of children who attend school. Statistics show that from all the registered school-aged refugees only 23% go to school. Even though there is a lot to be concerned about, it is a worrying figure that might cause long-term implications that could last decades after the end of the conflict. Not only will an entire generation grow up with psychological scars, they will also have great difficulties with coping in the job market.

This issue is recognised and UNICEF is cooperating with the Jordan Ministry of Education in order to manage official schools in the camp. This, unfortunately, has not proved to be enough to get the school-aged camp residents to the classrooms. In addition to other international humanitarian agencies operating in the camp, an Estonian NGO called Mondo is working in Za’atri to alleviate the situation of the young Syrian refugees. The project which focuses on the education sector is funded by the Estonian Ministry of Foreign Affairs and implemented in cooperation with Finn Church Aid and Relief International. This project consists of a number of activities that are aiming to empower the youth and benefit the children in Za’atri.

KlassiruumOne of the activities this Estonian NGO is involved in is setting up a computer lab in order to teach young people skills that are valuable in the job market and thus, provide them with knowledge that can have a great impact for their future. Computer literacy is taught as part of extra-curricular activities and all the successful participants will be given a certificate at the end of the course. In addition, computer classes are in high demand in the camp and therefore are a fantastic tool for making teenagers interested in attending school.

Mondo also helps develop learning materials for afterschool catch-up classes that support those Syrian students who are struggling to cope with the Jordanian curriculum. Learning materials are also provided for classes aimed at those children and teenagers who for different reasons have never had an opportunity to go to school and thus have to start from the basics.

One important reason why children do not go to school or, while in school, are not able to pay as much attention as they should, is because of an empty stomach. At the moment Mondo is providing a school snack consisting of an energy bar and a pack of juice for 220 students. Mondo also has initiated a campaign for gathering donations in order to increase the number of children who could benefit from the school lunch.  (For more information about the campaign visit www.muudamaailma.ee)

All these actions hopefully lead to an increasing number of Syrian refugee children who find that attending school is necessary. Only this way can they benefit from education and hence stand a bigger chance for a better future. A better life for them would also mean a brighter future for the region.

I

* Mondo is an Estonian NGO dedicated to organising and delivering humanitarian aid, managing and intermediating development cooperation, public education and development education, and educating its members and the general public on the issues of humanitarian aid and development cooperation.

Tallinn Manual – the international law in cyberspace

In 2007, Estonia faced cyber-attacks that have been widely acknowledged as the world’s first cyber war. At the peak of these attacks, fifty-eight Estonian websites were offline at once, including those of the government, most newspapers and banks.

9781107613775

Even though the attacks were technically rather robust and there was nothing novel about them, their size and length was quite surprising. Politically motivated large-scale assaults brought the attention of the international community to cyber security.

Prior to the incident, cyber-attacks had not been seriously considered as an imminent threat to the state or its citizens. There was no common code of conduct or universal agreement between policy-makers. For example, it was not defined if this kind of an offence would qualify as an attack against a member state of NATO and hence activate collective defence under Article V. It was not even clear if a state could legitimately respond to cyber-attacks.

I

Protecting cyberspace from the enemy

It became understandable that compared with other dimensions of security, cyberspace requires different logic.  To start with, there are no territorial borders that could be followed or secured. It is difficult to draw the lines not only between different states but also between nations and private-sector organisations. This turns the distinction between war and crime into a question of interpretation. It also raises questions about a state’s sovereignty in cyberspace and thus limits its power to conduct security policies.

One of the most important obstacles in cyber security is that it is often almost impossible to find (and prove) the culprit of the attack. If the ”enemy” is unknown then it is very difficult to organise a counterattack. It is also risky to act based on uncertain information. It is very easy for a state to change from being a victim to becoming an offender. Key strategic threat also lies in potential escalatory responses, turning a miscalculation in cyberspace into a full-scale war in the real world.

Looking at contemporary conflicts, it is evident that cyberspace is already becoming one of the theatres of conflict. Technological achievements are an important part of our everyday lives, making a technologically developed state dependent on the functioning of its computer systems. This reflects how vulnerable cyberspace can be when it comes to defending the state from a potential enemy.

It is the complicated nature of the field that obstructs its regulation by concrete laws. At the same time, nations have to be very careful with the measures they apply in the name of security in cyberspace (or how they use cyberspace in the name of state security).

The Tallinn Manual

There are a lot of difficult issues waiting to be solved. The CCD COE (NATO Cooperative Cyber Defence Centre of Excellence) has made one of the first attempts to set some guiding principles in the legal affairs of conflicts in cyberspace — a process which produced the Tallinn Manual. Experts who participated in the making of the Tallinn Manual, believe that the answers are to be found in existing international law. The manual does not focus on cyber security, but rather on how international law regarding warfare can be adapted to conflicts in cyberspace. It is a unique document that does not represent new officially binding rules but rather shows how policy-makers can interpret the law we have today. It is recognised that the distinctive nature of networked technology requires additional work on traditional laws. Nonetheless, it does not require a reinvention of international norms.

Looking at the Tallinn Manual from a cyber-security perspective, it is definitely a relevant foundation for future discussions. It examines in great depth how the requirements of an armed attack that have to be met before self-defence is justified, could be transferred to cyberspace. It also looks for legitimate ways of tackling attacks from criminal groups or individual hackers working in the name of another state. No doubt this is only the beginning and there are many issues that have to be carefully discussed before a common understanding on the code of conduct is reached.

In real world politics, it might be difficult to deter attacked states from responding to the offence.  Hence, it is necessary to adapt international norms of other domains to cyberspace. It also allows us to start making sense of the nature of this new domain and the challenges that it brings.

I

Photos: Wikimedia Commons

Scroll to Top