Can Human Rights as formulated under the European Convention on Human Rights apply to a cyber-attack?

(1)

University of Amsterdam

Can Human Rights as formulated under

the European Convention on Human

Rights apply to a cyber-attack?

Student Name: Thomas Garwood Master Track: Public International Law

Word Count 14,298

Supervised by: dhr. prof. dr. Jean d'Aspremont

(2)

Abstract

The extraterritorial application of the European Convention on Human Rights has developed in a way that has attracted much criticism however the European Court of Human Rights has always been able to cover itself by largely making decisions which are uncontroversial in their result as well as tailoring their decisions in such a way that the principles are difficult to apply to other cases and can easily be ignored in the future if necessary. It is also noted that the Court has been assisted in this approach by always being presented with cases which share numerous characteristics, thus the case law has developed in a way which requires these characteristics as essential. In order to provide a different lens through which to view the adequacy of the current approach of the Court towards the extraterritorial application of the Convention it was considered necessary to find an example which does not share these common characteristics and can cause violations of the Convention.

The example chosen is that of a cyber-attack, more specifically a cyber-attack conducted by one state against another which kills people in the targeted state. This is a breach of Article 2, the right to life. Chapter 2 outlines the framework for the extraterritorial application of the Convention and identifies the problems in the case law. Chapter 3 then attempts to apply two different cyber-attacks to the framework. The conclusion reached is that the Convention cannot apply as the tests to meet the requirement of jurisdiction are have been developed in an inflexible way and the significantly different characteristics posed by a cyber-attack means that the task of reconciling the two is more akin to solving one crossword with the questions from another. Chapter 4 then seeks to identify a more appropriate way for the Court to approach the extraterritorial application of the Convention in order for it to be more versatile and be able to adapt to new problems. Here, the Bankovic decision is identified as the central problem to the progression of the law as its erroneous interpretation of the object and purpose of the Convention has been treated as correct and never challenged meaning that the case law has developed against an incorrect rhetoric which has resulted in the flawed approach of the Court. Therefore it is argued that the Bankovic decision needs to be overruled in its entirety before the Court can adopt an approach which is guided by the object and purpose of the Convention. The approach advocated in this thesis is one based on a cause and effect notion of jurisdiction which it is argued represents a more appropriate interpretation of the object and purpose of the Convention. It is believed that a cyber-attack can present a polarising moment in the extraterritorial application of the Convention as the unique nature of the problem will demonstrate the corners cut by the Court thus far and force a reassessment of the principles which guide their decisions.

(4)

Introduction

The object of this thesis is to apply a developing phenomenon – that of cyber-attacks – to the pre-existing framework of the European Convention on Human Rights (ECHR or the

Convention). A difficulty of undertaking this task is that there has been very little written connecting the two, thus in order to begin the dialogue to bring the areas together and identify broader problems of applicability the approach of this thesis is to address one way in which a cyber-attack could be used to raise questions of human rights applicability. The sole focus of the thesis will be to consider the application of the Convention to cyber-attacks which are conducted by one state and targeted against another state, where the effects of the attack occur. This type of cyber-attack will be assessed using the case law of the European Court of Human Rights (ECtHR or the Court) on the extraterritorial application of the Convention. Questions concerning the extraterritorial application of the Convention have increased rapidly over the past few decades. Article 1 of the Convention states that it is to apply to people “within the jurisdiction”1_{of the Contracting Parties. Thus, the Courts interpretation of the} term jurisdiction has led to the extraterritorial application of the Convention. The position from the case law is that jurisdiction is a primarily territorial notion and that it can apply extraterritorially only in exceptional circumstances2_{. Broadly speaking the Court has}

developed two different approaches to what it considers to be exceptional circumstances. The first approach requires effective overall control over an area and will be referred to in this thesis as the spatial test and the second approach requires state agent authority and control over persons which will be referred to as a personal approach. This thesis will only go so far as to understand whether the unique characteristics of a cyber-attack are compatible with the term jurisdiction and considers the question of whether the Convention articles can apply to specific substantive articles as beyond its scope.

It is necessary to outline some caveats which clarify the limits of this thesis and to

demonstrate an appreciation of other factors which will play an important role if such a case ever comes before the Court. First is that this thesis will hypothesise that the cyber-attack was coordinated and carried out by a state and not a non-state actor. Secondly, the numerous and technical problems associated with attributing the cyber-attack to a state is also not

considered but it is acknowledged that with cyber-attacks this causes a great number of difficulties and may act as a significant hindrance to a case coming before the Court. A final caveat is that the interrelationship between international human rights law and international humanitarian law will not be considered. This relationship often entails a softening of human rights obligations when humanitarian law applies or it can result in an irresolvable norm conflict, once again this is a complex and technical area which presupposes a state of armed conflict when the cyber-attack takes place. This separation is also considered necessary as the 1 Council of Europe, European Convention for the Protection of Human Rights and

Fundamental Freedoms, as amended by Protocols Nos. 11 and 14, 4 November 1950, ETS 5, Article 1.

2 Bankovic and Others v. Belgium and Others [GC] (dec.), App. No. 52207/99, 12 December 2001, para 59.

(5)

two areas of law have very different objectives, human rights law focuses on the rights of individuals which is only a part of what humanitarian law regulates. The reasons for making these decisions are all similar, the most basic objective of this thesis is to conduct an analysis into whether the ECHR can apply to a cyber-attack and it is considered that this thesis will be of most use in its purest form; meaning whether or not it can apply free from all other

problems which will arise in reality.

Chapter 1: Cyber-attack

It is appreciated that the idea of a cyber-attack which infringes human rights can be

considered farfetched. However, the purpose of this chapter is to explore what is meant by a cyber-attack to give a clearer understanding of how one could occur with the result of making this proposition seem much more realistic. In doing so this chapter will also highlight certain characteristics of a cyber-attack which pose significant difficulties to human rights. This will be achieved by adopting two examples which will be applied throughout this thesis.

To choose the correct terminology here is a delicate issue, both in terms of how to adequately define the cyber-attack this thesis will cover but then also to reconcile this with the existing definitions of such terms in human rights literature and the connotations connected. As previously identified the cyber-attack hypothesised will be considered against the Courts case law on the extraterritorial application of the Convention, therefore is the most appropriate definition an extraterritorial cyber-attack? It certainly aligns itself more conveniently to being applied to the Court’s case law and at least in a literal sense it provides an accurate

description: a state is acting outside of its own territory. However, defining this cyber-attack is terms of territory implies that the location of specific events is connected to the

classification of the cyber-attack. This is a dangerous claim to make as it is entirely possible that other countries may be involved, for example an attack on a facility in one country can only be achieved by infiltrating the server located in another country. To bring the notion of territory into this has the potential to overcomplicate matters significantly.

An alternative approach is to consider it a cyber-attack which is outside the jurisdiction of a state. This seems reasonable until it is analysed with Article 1 of the Convention which states that it applies to persons “within the jurisdiction”, there will then be two different definitions of jurisdiction running throughout the thesis. These definitions will be in conflict as one will be stating that the cyber-attack is outside of the jurisdiction whereas in order for the

Convention to be applicable the persons affected will need to be within the jurisdiction of the state. This would be vastly confusing and a wholly unrealistic way to proceed.

A third option would be to consider the cyber-attack as an act with transboundary effects however this terminology implies a connection to a different form of extraterritoriality; cases where an act committed in the territorial state produces extraterritorial effects. Cyber-attacks can be conducted from anywhere, to accept this conception would then create an arbitrary

(6)

distinction on human rights applicability based on where the process began. Furthermore, Milanovic considers that in the related context of cyber privacy that this is not “a sound way of conceptualising the application of human rights treaties since in every case one can draw some kind of causal link between a territorial act and extraterritorial consequences.” Skogly raises another issue with ‘transboundary’ which also applies to ‘transnational’ and

‘transborder’ which is that they all imply a close geographical relationship.3_{Following this}

she reasons that extraterritorial whilst not ideal is preferable as it applies equally to “a neighbouring country or a country thousands of miles away”.4_{This seems far more}

appropriate for a cyber-attack which is geographically unbound. Upon weighing all factors the same conclusion as Skogly has been reached and the most appropriate term is considered to be extraterritorial cyber-attack.

1.1 What is a cyber-attack?

In the entire field of cyber operations there is precious little in the way of binding documents to give a solid footing to work from, therefore a universally accepted definition of a cyber-attack does not exist. Perhaps the most authoritative definition of a cyber-cyber-attack is from the Tallinn Manual – a non-binding document produced by an international committee of experts – and is the first of its type to attempt a set of principles for cyber operations. A caveat to be noted before accepting this definition is that the Tallinn Manual is formulated in the context of armed conflicts and thus is a document designed to be applicable in International

Humanitarian Law (IHL). Furthermore the two regimes operate differently and different questions are relevant for each, however, this does not vitiate the usefulness of the inquiry as the problems identified in the commentary to the Tallinn Manual are the same as those that arise in the context of extraterritorial application of human rights.

The Tallinn Manual defines a cyber-attack as “a cyber operation, whether offensive or defensive, that is reasonably expected to cause injury or death to persons or destruction to objects”5_{. This definition is limited in itself. However, a definition of a cyber-attack is not} strictly necessary in human rights, as Fidler notes “all weapons can be used in illegal ways or for illegitimate purposes, so human rights attention is not, generally speaking, technologically dependent; rather it focuses on the nature of the attack and its consequences.”6_Therefore what is more pertinent is how a cyber-attack can produce illegal consequences.

3 Sigrun Skogly, Beyond National Borders: States’ Human Rights Obligations in International Cooperation (Antwerp: Intersentia, 2006) 5.

4 Ibid

5 Michael. N. Schmitt (gen. ed.), Tallinn Manual on the International Law Applicable to Cyber Warfare, Cambridge: Cambridge University Press 2013. 106.

6 David Fidler, 'Cyberattacks and International Human Rights Law', Weapons under International Human Rights Law (1st edn, Cambridge University Press 2014). 305.

(7)

Examples of cyber-attacks have been somewhat rare, although the ones that have occurred have provided a valuable insight into the potentially severe effects as well as the potential for these attacks to grow in frequency. One example is known by the name Stuxnet, whereby a computer worm was used to target gas centrifuges used in Iran’s uranium enrichment program. Specifically it could target the software which controlled the speed of the

centrifuges. By manipulating this the Stuxnet worm caused up to 1000 centrifuges to break.7 Harold Koh, the former legal adviser of the department of state in America has previously listed three examples of a cyber-attack which the US would consider as a use of force. There are: 1. Operations that trigger a nuclear plant meltdown, 2. Operations that open a dam above a populated area causing destruction and 3. Operations that disable air traffic control resulting in airplane crashes.8_{Of course, none of these have occurred and are extreme examples of the} potential uses for cyber-attacks but Koh clearly identifies these as possible and all would have significant human rights implications were they to occur. They further demonstrate the versatility and unprecedented range of possibilities for a cyber-attack.

1.2 Problems posed by an extraterritorial cyber-attack

Cyber-attacks have many different characteristics to a conventional kinetic attack (such as firing a gun) which means that reconciling the two is not straightforward. A first difficulty arising from the specific characteristics of a cyber-attack is that “[t]he payloads…are non-lethal as a technological matter because computer code cannot operate against human physiology in any direct way”.9_{However, “[c]omputer code can start mechanical processes} that could result in kinetic damage or electronic disruption to machines that run software, which could then harm people directly or indirectly.”10

A unique feature of a cyber-attack is that it attaches to a pre-existing and potentially vastly interconnected framework and thus once a cyber-attack is launched against one part of this framework the effects may spread over an area far greater than the targeted cyber system. Such an effect can be possible with a kinetic attack, for example by launching an airstrike on a power plant which then causes a blackout in the surrounding area, however a cyber-attack can do more than just cause a blackout, it can actually manipulate and take control without damaging the framework which produces far greater possibilities for harm. Once again this was also identified in the Tallinn Manual and once again they came to a relatively

straightforward conclusion that “[t]he word cause in this Rule is not limited to effects on the targeted cyber system. Rather, it encompasses any reasonably foreseeable consequential

7 Andrew C. Foltz, ‘Stuxnet, schmitt analysis, and the cyber “use of force” debate’, Jt Force Q, 67 (2012), pp. 40–49. 44

8 Harold Koh, 'International Law In Cyberspace' (U.S. Department of State, 2012)

http://www.state.gov/s/l/releases/remarks/197924.html accessed 17 April 2016 9 Supra note 6, 304.

(8)

damage, destruction, injury or death”11_{, as “[n]o rationale exists for arriving at a different} conclusion in the cyber context.”12_{It must be recalled that the Tallinn Manual operates in} IHL and different considerations will apply in HRL, meaning that this conclusion may not be reached so simply.

1.3 Two hypothetical examples

As previously stated, in order to understand whether and how human rights can be applicable to an extraterritorial cyber-attack two examples will be adopted which will be applied to the existing law on extraterritorial application.

The first example is similar to the Stuxnet example above, however, here it is hypothesised that the damage to the centrifuges were so severe that they became unstable and caused an explosion, killing people in the facility. This example is also similar to one put forward in the Tallinn Manual which suggested “a cyber operation that alters the running of a SCADA [supervisory control and data acquisition] system controlling an electrical grid and results in a fire.”13_{This could also conceivably result in the loss of life. An example based around these} facts was chosen as it is the most straightforward example that could occur, the loss of life is as direct as possible to the cyber-attack and it occurs at the same place as the cyber-attack is targeted.

The second example was suggested by Fidler and he suggested a cyber-attack in which “disrupted internet service leads to death of patient’s dependent on medical services linked to the Internet in violation of the rights to life and health.”14_{The purpose of adopting this}

example is to demonstrate the versatility of a cyber-attack compared to a conventional attack with direct kinetic effects. In doing so it shows how the effects of a cyber-attack are not restricted to the immediate vicinity of where the cyber-attack is targeted and will present greater difficulties than the first example when applying it to the existing law.

Chapter 2: The law on the extraterritorial application of

human rights

This chapter will take a step back from the specifics of cyber-attacks and will introduce and understand the current law on the extraterritorial application of the ECHR in order to apply it to an extraterritorial cyber-attack in Chapter 3. At the time of drafting, extraterritorial

application of the Convention was not foreseen, and arguably would have been met with 11 Michael. N. Schmitt (gen. ed.), Tallinn Manual on the International Law Applicable to Cyber Warfare, Cambridge: Cambridge University Press 2013. 107.

12 Ibid 107. 13 Ibid, 107.

(9)

astonishment.15_{This can mean any of a number of things, to some it indicates that}

extraterritorial application was not intended as the convention was not intended to “cure all the planets ill’s”,16_{such a view is frequently grounded in the classic fear of opening the} floodgates which would in turn over burden the Court and render the convention void of any effectiveness. Cohen-Jonathan believes that the concern about the case load of the Court affected the decision in Bankovic and the Court decided to not get involved with “’remote’ conflicts that are politically sensitive”.17_{Others reject this detached approach, instead putting} faith in the universality of human rights, the arbitrary fact of where the wrong occurred should not prevent a contracting party from escaping responsibility and of course it cannot cure all the planets ill’s but why not try? This could even be considered a microcosm of the entire debate, constantly torn between universality and effectiveness.18

As there is no explicit reference to the extraterritorial application in the convention, its development has been teased out by interpretation. Article 1 states that “The High

Contracting Parties shall secure to everyone within their jurisdiction the rights and freedoms defined in Section I of this Convention”.19_{The term jurisdiction is the premise of}

extraterritorial application and is the reason the law has been able to develop as it has. The position of the case law is that jurisdiction is “primarily territorial”20_{and can apply}

extraterritorially only in exceptional circumstances21_{, two of which have been identified by} the Court and will be considered below.

The Courts interpretation of jurisdiction has attracted much debate. Da Costa noted that NGO’s have suggested that there is “nothing intrinsically justifying extraterritorial

jurisdiction as exceptional”.22_{Furthermore, da Costa herself expresses doubt over this stance} as if the trend of states to act extraterritorially increases then surely the ‘exceptional

character’ will be lost23_{. Besson disagrees on this point arguing that “the notion of}

extraterritoriality itself implies that the territorial application of human rights is the principle, but that there can be exceptions”.24_{However it is argued that Besson is merely identifying the} 15 Ed Bates, The Evolution of the European Convention on Human Rights, Oxford: Oxford University Press, 2010, 111.

16 European Court of Human Rights, Annual Report 2001. Registry of the European Court of Human Rights Strasbourg, 2002,

http://www.echr.coe.int/Documents/Annual_report_2001_ENG.pdf 23/24.

17 Fons Coomans and Menno Kamminga , Extraterritorial Application Of Human Rights Treaties (Intersentia 2004) 116.

18 Marko Milanovic, Extraterritorial Application of Human Rights Treaties (Oxford University Press 2011) 55.

19 Supra note 1. 20 Supra note 2. 21 Ibid, 61.

22 Karen da Costa, The Extraterritorial Application of Selected Human Rights Treaties (Martinus Nijhoff Publishers 2012). 198.

23 Ibid.

24 Samantha Besson (2012). The Extraterritoriality of the European Convention on Human Rights: Why Human Rights Depend on Jurisdiction and What Jurisdiction Amounts to. Leiden

(10)

same problem noted in Chapter 1 that it is necessary to categorise the concept in order to contribute to its development but words carry connotations which cannot be avoided.

On what is the correct interpretation of jurisdiction Besson considers that “jurisdiction is best understood as de facto political and legal authority”,25_{which crucially “amounts to more than} the mere exercise of coercion or power”.26_{This view is not shared by Cassese, who argued} that in the context of the International Covenant on Civil and Political Rights jurisdiction stretched to include “any exercise of power, however limited in time”.27_{Similarly, Roxstrom} opines that jurisdiction is most often understood in international law “in a de jure sense, denoting a right under international law to act”.28_{When the very foundations of the basis for} the extraterritorial applicability of the Convention is disputed, it is no wonder that such disputes run throughout this area of law.

2.1 Effective overall control of an area - the spatial approach

The first exceptional circumstance was first formulated in the Loizidou case in which the Court affirmed that the responsibility of a contracting party may arise, following military action “whether lawful or unlawful [and] it exercises effective control of an area outside its national territory.”29_{This notion of jurisdiction is commonly referred to as a spatial approach} and fits most naturally with the jurisdiction exercised by a state in its own territory and is the most common way of approaching extraterritorial application. However, this test is not without its flaws as will be demonstrated fully later in this chapter.

2.11 What is an ‘area’?

In the context of Loizidou – the case the test was formulated – the area is an uncontroversial aspect of the consideration as Turkey occupied around one third of the island which is a substantial piece of territory. Difficulties arise when the area gets smaller and it becomes more artificial to class it as an area for the purpose of this test. This demonstrates the potential for arbitrary and intolerable outcomes, take the example of CIA black sites. These are buildings or compounds located outside the United States of America where CIA agents take abducted terror suspects for interrogation. Of course, the US is not a party to the ECHR but it is entirely plausible that some of the contracting parties conduct similar operations. Is it Journal of International Law, 25, pp 857-884, 862.

25 Ibid, 864. 26 Ibid, 865.

27 Antonio Cassese, International Law (2nd edn, Oxford University Press 2001). 362-3 28 Erik Roxstrom, Mark Gibney and Teerhe Einarsen, 'The NATO Bombing Case (Bankovic Et Al. V. Belgium Et Al.) And The Limits Of Western Human Rights Protection' (2005) 23 Boston University International Law Journal. 55-136, 68.

29 Loizidou v. Turkey, App. No. 15318/89, Judgment (preliminary objections), 23 February 1995, para 62.

(11)

possible to claim that a building can constitute an area? Al-Saadoon opened the door to this possibility by holding that the United Kingdom had control “over the premises in question”.30 Premises holds completely different connotations to area. Premises implies some form of building or buildings. This reference to premises has not been tested since Al-Saadoon and we are left without any functional criteria to understand the limits of an area.

2.12 How can control be overall and effective?

As clearly stated in the Loizidou case, the exercise of effective control over a territory can be lawful or unlawful, meaning that the effective control can occur with or without state consent. This could hardly have been different, to require the effective control to be lawful would effectively invite abuse and allow states to act extraterritorially with near human rights impunity.

The Courts interpretation of effective overall control has been less than consistent. In

Loizidou it was made clear that overall need not mean the state acting extraterritorially needs to exert the same level of control as it does over its own territory. The Court held that “it is not necessary to determine whether…Turkey actually exercises detailed control over the policies and actions of the authorities of the TRNC”.31_{The requirement of overall entails an} interesting effect, in Cyprus v Turkey the Court held that having overall control not only entailed responsibility for the acts of its own soldiers or officials but “must also be engaged by virtue of the acts of the local administration which survives by virtue of Turkish military and other support”.32_{Simply put, once a contracting party establishes effective overall control} over another states territory, that territory is assimilated to its own and is thus responsible for acts which occur on that territory.

The control must also be effective. In broad terms this means a contracting party must be in a position to actually exert its control on the area. As mentioned above, in Loizidou this was not difficult to prove with thousands of troops on the ground and the formal controlling power of Cyprus being little more than its puppet.33_{Effective has not always been so easy to} prove, in Bankovic the Court held that airstrikes alone were not sufficient. Furthermore, the Court in this case made the test even more stringent by requiring the exercise of “all or some of the public powers normally to be exercised by that Government”.34_{This sets a very high} threshold and leaves a great deal of space below this in which states can exert lethal power in another state – as happened in Bankovic – and escape responsibility. The most troubling and restrictive aspect of the Bankovic judgment was its holding that the Convention could only apply within the legal space (or espace juridique) of the contracting states meaning that

30 Al-Saadoon and Mufdhi v. United Kingdom (dec.), App. No. 61498/08, 3 July 2009, para 88.

31 Supra note 29, para 56

32 Cyprus v. Turkey (dec.), App. Nos 6780/74 and 6950/75, 26 May 1975. 77. 33 Supra note 18, p137.

(12)

extraterritorial application only extends to the territory of the other contracting parties and no further.

This overly restrictive approach was realised by the Court in following cases and they have subsequently backtracked. The first case to soften the Bankovic judgment was Issa & Others v Moldova.35_{Although the required control was not found in this case they relaxed Bankovic} in a number of ways. The Court were willing to accept a much shorter period of time for the effective overall control to take place, in Issa the period was six weeks whereas in the

Northern Cyprus cases the period was three months. Also, in Issa the area was much smaller, in fact it was only a village yet this was not a problem for the Court. Finally, the Court seemingly ignored the espace juridique holding from Bankovic, the acts in Issa took place in Iraq but this was not considered as an impediment to finding the requisite level of control.36 Ilascu & Others v Moldova & Russia was the next case to consider the spatial test and went even further than Issa. The Court found Russia responsible for acts in Moldova and set the standard for effective control as requiring the Moldovan Republic of Transdniestria to remain “under the effective authority, or at the very least under the decisive influence, of the Russian Federation, and in any event that it survives by virtue of the military, economic, financial and political support given to it by the Russian Federation”.37_{The Court itself acknowledges that} decisive influence amounts to a lesser requirement than effective authority, as phrased above. It is therefore even further detached from the requirement of exercising public powers from Bankovic.

In contrast to the cases above which have attempted to soften the stringency of Bankovic the Medvedyev v France case has recently added to the stringency by holding the case as

authority for the fact that no instantaneous act can satisfy the Loizidou criteria.38_{It justified} this claim by considering it the same as calling for cause and effect jurisdiction, which the Court in Bankovic rejected.

2.2 Authority and control over persons – the personal approach

As identified in the previous section, as a conceptual test the spatial test works but its boundaries of application are vague which can act to undermine its utility. Where this has threatened to occur in cases the Court has turned to a personal conception of jurisdiction. The existence of these two tests contributes significantly to the unclear and confused

jurisprudence. In its broadest sense, the personal approach applies whenever a state has such

35 Issa v. Turkey, App. No. 31821/96, Judgment, 16 November 2004, 36 Supra note 22, 176.

37 Ilascu and others v. Moldova and Russia [GC], App. No. 48787/99, Judgment, 8 July 2004, 392.

38 Medvedyev and Others v. France [GC], App. No. 3394/03, Judgment, 29 March 2010. Para 64.

(13)

control over a person to substantially violate their rights. In the case law this test has been formulated as state agent authority and control over persons.

The use of a personal test actually precedes Loizidou. In Cyprus v Turkey in 1975 the European Commission of Human Rights found Turkey responsible for actions in Cyprus for the reason that “such agents remain under the state’s jurisdiction when abroad and they bring persons and property within this particular “jurisdiction” to the extent that they exercise authority over them”.39_{Although this clearly adopts a notion of personal jurisdiction, it} adopts a confusing one as it intimates that the jurisdiction exists before the act takes place and portrays agents of a state as walking areas of jurisdiction. Despite this, it is “undeniable…that in the view of the Commission, a Contracting State’s negative obligation to respect the rights set forth in the Convention applies whenever and wherever a Contracting State asserts power or authority over a person or his/her property”.40

Bankovic emphatically rejected the use of the personal test. This rejection was grounded in the belief that it is not possible to restrict the application of the personal test, consequently, the Court were of the view that the claim to a personal test amounted to a claim that anyone “adversely affected by an act attributable to a Contracting State…is thereby brought within the jurisdiction of that State”.41_{Therefore they were unable to accept the application of a} personal test in any form.

As previously identified, the Bankovic decision was strict and one which subsequent decisions somewhat distanced themselves from. This is also true in relation to the personal test. Once again it was the Issa case which did this first. Here the Court considered that “accountability in such situations stems from the fact that Article 1 of the Convention cannot be interpreted so as to allow a State party to perpetrate violations of the Convention on the territory of another State, which it could not perpetrate on its own territory.”42_{This is not only} a radically different decision to Bankovic but also represents a completely different

conception of the function of human rights, whereas Bankovic grounded its decision in effectiveness Issa makes a distinct plea to universality. The decisions are completely

irreconcilable and in order to justify this decision the Court in Issa turned to decisions of the Human Rights Committee (HRC) and the quote above from Issa was taken from the HRC decisions in Lopez Burgos v Uruguay43_{and Celiberti v Uruguay.}44

Numerous subsequent cases have cited and approved Issa. One such example was Pad and Others v Turkey; this case demonstrates the very real possibility of arbitrary decisions

resulting from the spatial test. In Pad Iranian nationals were killed by a Turkish helicopter but

39 Supra note 32, 136. 40 Supra note 28, 136. 41 Supra note 2, para 75. 42 Supra note 35, para 71.

43 Lopez Burgos v. Uruguay, Communication No. R.12/52, UN Doc. Supp. No. 40 (A/36/40) at 176 (1981).

44 Celiberti de Casariego v. Uruguay, Communication No. 56/1979, UN Doc. CCPR/C/OP/1 at 92 (1984).

(14)

it was not contested where the killing actually took place. The Court did not consider this an obstacle, holding that “it is not required to determine the exact location of the impugned events.”45_{Another example is Isaak and Others v Turkey. In this case an individual had been} beaten to death in a UN buffer zone and it was not clear who had actually killed him as he was attacked by up to 20 individuals. Miltner argues that this case contributes to the “ever-expanding array of exceptions to the territorial principle.”46_{Further, she considers that the} Court could not fully endorse the personal approach as it could not be stated with certainty that the death was caused by state agents. Therefore Miltner argues that this has reduced the authority and control test “to a new, less rigorous test requiring only indirect control over persons.”47_{Overall the authority and control exercised in Isaak is not that great yet the Court} still found jurisdiction, pulling even further from the Bankovic judgment.

2.3 Most recent developments

The most unusual feature of the conflicting judgments in the section above is that none of them acknowledge any conflict with Bankovic and it is a common approach of the Court to paint a harmonious picture with the case law such as in the Grand Chamber judgment in Al-Skeini.48_{Consequently the case law can be used to justify “everything and the opposite of} everything”.49_{This contributes to confusing the case law even further and has resulted in a} more recent trend that appears to conflate the two tests. Such an approach is – at least in principle – accepted by Besson who sees that “the personal and territorial types of jurisdiction should be seen as complementary and not as alternatives”50_{but also considers that “state} jurisdiction is always personal.”51_{This was evidenced in Al-Saadoon in which British House} of Lords identified Bankovic as the leading authority, following this the ECtHR appeared to adopt the same approach and consequently felt precluded from adopting a personal approach outright but instead mixed the tests together.52_{To Da Costa it was remarkable that the Court} did not approach a personal test from the start53_{but the result of the confused case law is that} every position is defensible so there are numerous ‘correct’ ways of interpreting the case law. The Al-Skeini case progressed through the English courts to the European courts and by the time it reached the Grand Chamber its decision was eagerly awaited in the hope it would 45 Pad and Others v. Turkey (dec.), App. No. 60167/00, 28 June 2007. Paras 53-54

46 Barbara Miltner, 'Broadening The Scope Of Extraterritorial Application Of The European Convention On Human Rights?' (2007) 2 European Human Rights Law Review.172-182. 173.

47 Ibid, 181.

48 Marko Milanovic, 'Al-Skeini And Al-Jedda In Strasbourg' (2012) 23 The European Journal of International Law. 121-139. 127.

49 Al-Skeini and Others v. United Kingdom, Application no. 55721/07, Council of Europe: European Court of Human Rights, 7 July 2011. Concurring opinion of Judge Bonello page 79, para 7.

50 Supra note 24, 875. 51 Ibid, 875.

52 Supra note 30, 202. 53 Ibid, 202.

(15)

clarify the many uncertainties in the case law. The case arose from the British involvement in the Iraq war and concerned six Iraqi civilians, five of whom were killed by British troops on patrol in Basra and the sixth was arrested and taken to a detention facility where he was killed.54_{In the English courts there were significantly different approaches, however the} House of Lords identified Bankovic as the leading authority and subsequently adopted a strict approach and led to the finding that British forces in Basra did not have effective control. The sixth applicant however, was within British jurisdiction, the HoL considered the detention facility to have a special status, similarly to an embassy.55

One of the most significant things done by the Grand Chamber was to put the espace

juridique from Bankovic to rest; finally, “buried under a thick layer of wisdom”.56_{Aside from} this, the Court finds an interesting way of trying to blunt the Bankovic decision and reconcile it with the personal approach. The Court achieves this as during its discussion of the personal approach a reference to the exercise of public powers is included. As Milanovic notes, this is actually referring to a spatial test57_{and using the same terminology as Bankovic. The Court} then proceeds to say that “what is decisive in such cases is the exercise of physical power and control over the person in question”.58_{Thus the Court have found a way to blunt the holding} in Bankovic but only by conflating the approaches and in doing so have adopted an approach which maintains that Bankovic was correct in its outcome.

This decision can also be used as the authority which clarified the extent of the obligations under each of the approaches and in doing so overruled another aspect of Bankovic. In Bankovic it was held that the Convention rights cannot be “divided and tailored”.59_In Al-Skeini is was held that in cases where the State exercises control and authority over an individual “the State is under an obligation under Article 1 to secure to that individual the rights and freedoms under Section 1 of the Convention that are relevant to the situation of that individual. In this sense, therefore, the Convention rights can be ‘divided and tailored’”.60 As Szydlo rightly observes, “it thus follows that…a Convention state is not obliged to do the impossible…but rather that it should be held accountable for those convention rights that it is able to secure in the situation in question”.61

In Al-Skeini this approach meant that the Court came to a very different outcome to the HoL. The Court applied a personal model to the killing of all applicants but only because of the exceptional circumstances in which the UK exercised “some of the public powers normally to 54 Supra note 49, paras 34-71

55 R (on the application of Al-Skeini and others) v Secretary of State for Defence [2007] UKHL 26, [2008] AC 153. para. 97 (per Lord Carswell), para. 132 (per Lord Brown). 56 Paolo Ronchi, 'The Borders Of Human Rights' (2012) 128 Law Quarterly Review.20-23, 22.

57 Supra note 48, 128. 58 Supra note 49, 136. 59 Supra note 2, para 75. 60 Supra note 49, 137.

61 Marek Szydlo, 'Extra-Territorial Application Of The European Convention On Human Rights After Al-Skeini And Al-Jedda' (2012) 12 International Criminal Law Review. 271-291. 290.

(16)

be exercised by a sovereign government”.62_{Consequently the Court held that all of the six} applicants fell within the jurisdiction of the UK. Thus, Al-Skeini was somewhat of a disappointment, it papered over the cracks with regard to its acknowledgement of the problems in the case law and attempted a reformulation which maintains the incompatibility with Issa and Pad. However it is the closest case to overruling Bankovic and it is at least now evident that the espace juridique is now explicitly overruled.

In spite of the slight disappointment left by the Al-Skeini judgment, it added to the undeniable trend of the Court taking an increasingly more expansive approach to finding jurisdiction.

Chapter 3: Applying the tests

This chapter will apply the complexities identified in the characteristics of a cyber-attack from Chapter 1 to the current case law for the extraterritorial application of the ECHR from Chapter 2 to find out whether the ECHR would be applicable to an extraterritorial cyber-attack. As explained in Chapter 1 this will be done by applying two different examples of cyber-attacks. To recall, the first example was based on an extension of the Stuxnet example and hypothesises that the damage to the centrifuges were more severe, making them unstable and leading to an explosion, killing people at the facility. The second example, was a cyber-attack in which “disrupted internet service leads to death of patients dependent on medical services linked to the Internet in violation of the rights to life and health”63_{. The first, and} potentially pivotal difference between a cyber-attack and the examples presented so far in the case law is that with a cyber-attack there is no physical presence by the state committing the attack in the state where the attack is targeted. As a consequence of this, the tests have been designed and developed in a way which perceives physical presence as the only way such a violation of human rights could occur extraterritorially. This is unsurprising, as has been shown few cyber-attacks have actually occurred and of those that have none have infringed human rights, but nonetheless it is a possibility, and one which will grow in a world in which the use of technology is rising rapidly.

3.1 Applying to example 1

In order for the ECHR to be applicable jurisdiction, as understood under Article 1 ECHR must be found. Jurisdiction remains primarily territorial, of course the examples hypothesised are both extraterritorial so the situation must be exceptional in order for jurisdiction to be found. These exceptional ways are achieved either by demonstrating effective overall control over territory or by having state agent authority and control over persons.

62 Supra note 55, 149. 63 Supra note 6, 308.

(17)

3.11 Spatial test

The approach taken in Chapter 2.1 will be taken here to apply the spatial test to the first example. In example 1 the attack is targeted to a uranium enrichment facility, the facility will likely be sizeable, but is it big enough to constitute an area? As identified in Chapter 2.11 what is an area is left very uncertain. However, Al-Saadoon has opened the door to premises being an area and was happy to consider a prison an area for the purposes of this test.64_In following this approach if presented with this question, the Court would likely consider the facility to be an area for the purposes of this test.

More difficult is whether this facility can be under effective overall control by a cyber-attack. As shown above, an unusual characteristic of a cyber-attack is that it entails no physical presence. The only example where there is no physical presence, and thus the most similar to a cyber-attack is Bankovic in which the Court were very reticent to accept the personal model of jurisdiction or that an airstrike could meet the threshold for jurisdiction. This is a

significant hurdle which will need to be overcome in order for the Convention to apply to a cyber-attack.

The other examples we have seen in the case law have largely involved military presence in another state and exercising their power over a certain area by setting up checkpoints,

conducting patrols and exercising governmental functions, amongst other things. Whereas an airstrike and also a cyber-attack require none of this lengthy establishment of control. Control in this sense would need to be established instantaneously. The Medvedyev case is clear on this point and held that the convention “excluded situations, however, where—as in the Banković case—what was at issue was an instantaneous extraterritorial act”.65

In Al-Skeini it was demonstrated how ingrained physical presence is into the notion of effective control. The Court observed that “in determining whether effective control exists, the Court will primarily have reference to the strength of the State’s military presence in the area”.66_{Other indicators which the Court will also consider are “the extent to which its} military, economic and political support for the local subordinate administration provides it with influence and control over the region”.67_{The problem here is not simply that these} considerations do not apply to an extraterritorial cyber-attack, applying these considerations to an extraterritorial cyber-attack is like trying to complete one crossword with the questions from another. This gap cannot be improved by a generous dose of playful interpretation. This conclusion cannot be seen as surprising; it merely illustrates that a cyber-attack represents a radical departure from how operations in which human rights can be infringed

extraterritorially are usually conducted.

64 Supra note 30, 88.

65 Medvedyev and Others v. France [GC], App.No. 3394/03, Judgment, 29March 2010, para64.

66 Supra note 49, 139. 67 Ibid, 139.

(18)

3.12 Personal test

The personal test is frequently used to compensate for the strictures of the spatial test. However it has numerous problems of its own. Furthermore it suffers the same pitfall as the spatial test and that is the requirement of physical presence. Although referred to in this thesis as a personal test the actual requirement is stricter. What is required here is state agent authority and control. Clearly even from the name alone the implied requirement is for physical presence. Once again the cases have all included this so the requirements have been formulated accordingly. In relation to this test the Court in Al-Skeini was even more clear on what was required, “what is decisive in such cases is the exercise of physical power and control over the person in question”.68

Interestingly, in Jaloud v Netherlands, the most recent authority on extraterritorial application the Court restated significant sections of the Al-Skeini excerpt word for word,69_{clearly seeing} that no change in their approach was warranted. Milanovic identifies that the necessary implication of Bankovic is that “the power to kill alone [can] not constitute ‘authority and control”.70_{However as he rightly argues, is the power to kill a person not a very clear} exercise of physical power over an individual?71_{And furthermore, why should the means of} killing that person, as long as it results from a state act, impact on the outcome? It seems wholly arbitrary to distinguish on this fact, especially when the methods of killing people without – as the court see it – physical control such as through an airstrike, drone strike or a cyber-attack have a much greater possibility to be indiscriminate in their use, which surely warrants a greater deterrence on their use.

This was softened in Al-Skeini however the Court maintain the distinction in the way the killing occurred. To Milanovic, this part of the Al-Skeini judgment means that “while the ability to kill is ‘authority and control’ over the individual if the state has public powers, killing is not authority and control if the state is merely firing missiles from an aircraft”.72 Based on the shared characteristics between an airstrike and a cyber-attack there is no reason to see that the Court would treat it the same as it does airstrikes, meaning that there is no exercise of public powers and thus, the ability to kill is not authority and control.

Consequently the ECHR would not apply to an airstrike under the personal model of jurisdiction.

3.2 Applying to example 2

The second example has been included as it is more complex than the first and shows the versatility of a cyber-attack. Even though the conclusion reached above is that human rights

68 Ibid, 136

69 Jaloud v The Netherlands[GC], no. 47708/08, 20 November 2014, 133-137 70 Supra note 48, 123.

71 Ibid, 129. 72 Ibid, 130.

(19)

under the ECHR will not be applicable to the first example it does not vitiate the purpose of including and discussing this second example. This thesis is written from a perspective that the ECHR should apply to extraterritorial cyber-attacks and that includes the full range of cyber-attacks. Thus, in showing the versatility of cyber-attacks this second example will demonstrate the difficulties the Court will face in adopting an approach that is capable of encompassing the full range of cyber-attacks.

3.21 Spatial test

The spatial test is pushed to extremes by this example. Firstly, the area which will be the target of the cyber-attack represents potentially a fraction of the area affected. Once the internet exchange is targeted and compromised the effects will be broad and immediate, comparable to an electricity exchange failing plunging a large part of the surrounding area into darkness. The affected area will be larger here than in the first example, deciding if something is an area is a factual consideration, and factually speaking the area affected is large enough to be considered an area for this test. Once again, the serious difficulties arise when it is asked if this area is under the effective overall control by a state through this cyber-attack. Here, there are two distinct areas where different types of control are present. There is the internet exchange where the cyber-attack is targeted and the area which feels the effects of the attack. The internet exchange poses the same questions as the uranium enrichment facility in example one in which it was concluded that effective overall control could not be found.

The affected area beyond the internet exchange stretches the meaning of control. The control exerted by the cyber-attack is control over one specific function which then causes a

multitude of consequences. This understanding of control is even further from that in the cases. The control must be overall and effective thus precluding an understanding which attaches to controlling one specific function. These are the additional problems which face the application of the spatial test compared to the first example. The problems identified by the first example such as the requirement of physical presence, the time and intensity of the effective overall control will apply equally here and prevent the ECHR from applying. Despite both examples are unable to fit into the tests used by the Court to establish extraterritorial jurisdiction the first example is closer to fitting the spatial test. If the

requirement of effective overall control is changed by adopting a less strict requirement for physical presence, thus if the Bankovic decision and the preclusion of instantaneous acts in Medvedyev were both overruled the first example could fit the spatial model somewhat naturally. However the second example would perhaps need to remove the requirement of overall entirely and then the understanding of the entire phrase would alter significantly. This example proves that although for some cyber-attacks square pegs could be squeezed into round holes the versatility of cyber-attacks means that such an approach would not work across the board. Consequently, if the Court are required to confront this issue in the future in order to deal with it effectively a vastly different approach will be required.

(20)

3.22 Personal test

As discussed in the application of the personal test to the first example, the current case law requires state agent authority and control in order to find extraterritorial jurisdiction. This consideration is confused by the distinction concerning whether the ability to kill constitutes state agent authority and control. This question is dependent on whether the state which committed the attack is exercising public powers. This is a requirement that once again is fundamentally incompatible with a cyber-attack. Requiring the exercise of public powers necessarily requires a lengthy period of time to gain a sufficient level of control in order to exercise these public powers. A cyber-attack by being instantaneous in its nature is precluded from achieving this requirement, thus the power to kill cannot be considered to amount to control for the purposes of this test and human rights under the ECHR will not be able to apply to the second example of an extraterritorial cyber-attack.

3.3 Alternative approaches

The aim of Chapter 2 was to provide an unbiased and reasonable reflection of the case law as the Court has created it. This was considered necessary as it is the most appropriate way in which to achieve the object of this thesis, to predict how the Court would receive such a question, however it is not contended that this reflects the entire landscape of the law on the extraterritorial application of the Convention. In fact a significant amount of disquiet exists in the literature on almost every aspect of extraterritorial application, this has culminated in numerous commentators proffering new approaches, some of these will now be considered in order to understand whether these new approaches can encapsulate the complexities of an extraterritorial cyber-attack.

One of the aforementioned approaches has been suggested by Hugh King who advocates an approach to jurisdiction which “reflects both the usual meaning of the term at public

international law, and a particular factual relationship between state and individual”.73

Suggested pre Al-Skeini in 2009 this understanding of jurisdiction can be interpreted as an attempt to keep in line with the Bankovic decision as much as possible as the Court claimed to identify the term jurisdiction from the “standpoint of public international law”74_{. Whilst}

this first part is an attempt to appease Bankovic – as the leading authority –, the second is an acknowledgment of Bankovic’s stringency and acts as a safety net to reduce the likelihood of unconscionable results. It has already been seen above that Bankovic offers no

encouragement to the application of the Convention to an extraterritorial cyber-attack so the

73 Hugh King, 'The Extraterritorial Human Rights Obligations of States' (2009) 9 Human Rights Law Review, 521-556. 522.

(21)

question is whether the particular factual relationship between state and individual that King suggests can encapsulate a cyber-attack.

Curiously, when elaborating on his meaning of jurisdiction based on a factual relationship King soon explains that “this factual relationship should be based on a particular cause and effect notion”.75_{The very same cause and effect notion of jurisdiction that was vehemently}

rejected in Bankovic. Thus King appears to be trying to have his cake and eat it too. He is upholding Bankovic as an authority whilst in the next breath acting in direct contradiction with it. A proposition the Court would likely struggle to accept. This point aside, a cause and effect notion is certainly more flexible and is free from the pitfall of requiring physical presence. King contends that this notion will apply to “persons who are directly affected by their unlawful acts abroad within [the State’s] jurisdiction”.76

Rick Lawson has suggested another approach and believes that a more appropriate way to think of jurisdiction is that it arises “if there is a direct and immediate link between the extraterritorial conduct of a state and the alleged violation of an individual’s rights”.77_{To give}

merit to his claim Lawson uses the example of the Xhavara case in which Italy brought Albanian refugees on a ship in the high seas into its jurisdiction when an Italian war vessel caused the ship to sink.78_{Lawson claims “there was an obvious causal connection”.}79_If

Lawson considers that a causal connection is necessary, this has potential to raise significant difficulties when applied to a cyber-attack. It will be recalled that a cyber-attack always contains a non-lethal payload but can however begin a mechanical process which could result in kinetic damage. Therefore any human rights violation resulting from a cyber-attack will have events in between, potentially stretching the causality and making it difficult to prove, especially in cases such as example 2 where the death would be very far detached from the cyber-attack. This observation would apply equally to King’s approach as he considers a direct effect to be necessary and will suffer the same evidentiary problems as establishing a causal link. The fact that Lawson’s test requires the link to be immediate is a departure from the current approach seen in Bankovic and Medvedyev and would help human rights to apply to a cyber-attack. The approaches suggested by King and Lawson will both contain

significant evidentiary issues, however they are both free from the entrenched view of the Court that physical presence is necessary so both are more versatile and ready to adapt to new challenges such as a cyber-attack.

Numerous commentators have suggested an approach which separates the positive and negative obligations in the Convention. For example, the right to life in Article 2 contains the negative obligation for States to refrain from using lethal force against individuals as well as a positive obligation to take reasonable measures to prevent individuals being killed by non-75 Supra note 73, 551.

76 Ibid, 522.

77 Rick Lawson, 'Life After Bankovic: On The Extraterritorial Application Of The European Convention On Human Rights', Extraterritorial Application of Human Rights Treaties (1st edn, Intersentia 2004). 104.

78 Ibid, 104. 79 Ibid, 104.

(22)

state actors or by other means. This distinction is often justified by a view that states ought to have a higher duty to respect negative obligations. This view has been put forward by

Roxstrom, Gibney and Einarsen in a joint article80_{but also more recently and more}

prominently by Marko Milanovic,81_{whose articulation of this approach will be appraised.}

Milanovic’s conception of this approach is that positive obligations to protect or secure human rights are to be conceived of territorially, as de facto effective overall control over an area. However, the negative obligation to respect human rights would be territorially

unbound82_{and not subject to any jurisdiction threshold.}83

When applied to the extraterritorial cyber-attack from examples 1 and 2 the application of the Convention is much more straightforward. In both examples the negative obligation in Article 2 is being violated, which is territorially unbound, thus no jurisdiction threshold arises and the extraterritorial cyber-attacks in question would be considered on their merits. The footing for Milanovic’s assertion that negative obligations would not be subject to any jurisdiction threshold is very unclear. He reaches this assertion by considering negative obligations to be applicable implicitly, relying primarily on the Bosnian Genocide case which held that an explicit reference was not necessary and must be implied as it would be

“paradoxical if States were thus under an obligation to prevent…but were not forbidden to commit such acts”.84_{Milanovic then considers that “there is no reason why it should depend}

on the same jurisdictional threshold of application as the positive obligation to secure or ensure.”85_{Whilst this is true it rests on a great deal of uncertainty as the Court may choose to}

impose a jurisdiction threshold and it may further be a stretch for the Court to adopt this approach as it has relatively little textual support.

Whilst these other approaches are frequently proposed and the judges of the Court will certainly be aware of the disquiet in the literature they are unlikely to gain enough momentum to influence the judges to change the approach of the Court. This is why this chapter attempted to best predict the outcome of the two examples using the Courts judgments. The conclusion reached in Chapters 3.1 and 3.2 is that the ECHR cannot – without reformulation – be used to cover the effects of an extraterritorial cyber-attack. However, the Court has made a lot of moves over the course of its judgments in this area. This has led Milanovic to the belief that “trying to exploit the many contradictions in the Court’s case law on extraterritoriality to deny the applicability of the Convention in this case or that will in most circumstances end in defeat”.86_{This stance is informed by the gradual} 80 Supra note 28, 72.

81 Supra note 18, 209. 82 Supra note 18, 210.

83 Marko Milanovic, 'Foreign Surveillance And Human Rights, Part 3: Models Of

Extraterritorial Application' (EJIL: Talk!, 2013) http://www.ejiltalk.org/foreign-surveillance-and-human-rights-part-3-models-of-extraterritorial-application/ accessed 13 April 2016. 84 Application of the Convention on the Prevention and Punishment of the Crime of Genocide, Judgment, 27 February 2007, para. 166

85 Supra note 18, 213.

86 Marko Milanovic, 'The Bottom Line Of Jaloud' (EJIL: Talk!, 2014)

(23)

expansive approach of the Court and thus a pull towards universality. The articulation of Milanovic also implies that the Court struggles to accurately articulate when the ECHR ought to apply extraterritorially but which has an internal, unarticulated morality which prevents the gaps and inconsistencies in its case law being exposed. This approach is safe for the Court, it can amend the scope of the extraterritorial application without criticising its previous case law but it leaves the Courts future judgments unpredictable and an understanding of the case law largely pointless. Even though the tests are not formulated in a way which is remotely coherent to the challenges posed by an extraterritorial cyber-attack the Courts inner morality may kick in and they decide, in line with Issa that they cannot “allow a State party to

perpetrate violations of the Convention on the territory of another State, which it could not perpetrate on its own territory”.87_{As explained above this option would only be open to a} cyber-attack more similar to example one than two. The conclusion to this chapter must be that by following the judgments of the Court to the best of our ability, the Convention will not apply to an extraterritorial cyber-attack. However, this is not to say that the Court will definitely decide any potential case this way as they are not against amending their approach where their unarticulated morality kicks in but the conclusion above is the most reasonable one to make.

Chapter 4: What next for the extraterritorial application of

the ECHR?

The previous chapter exposed the flaws in the current approach of the Court when adapting to new challenges. These flaws will be exposed further to prove the approach of the Court as inadequate and identify that a change in approach is needed. This chapter then identifies Bankovic as the central problem as, in particular it precludes the application of an extra territorial cyber-attack to the ECHR but also but more generally it set the case-law on a restrictive path which over fifteen years later still influences the case law. Finally the chapter will advocate a new approach to jurisdiction.

4.1 Change

The previous chapter was an ultimately futile and thankless exercise but was crucial in order to understand the criticisms of this area of law – which are prevalent in the literature – but in a new context. Criticism is never far away from the law on the extraterritorial application of the ECHR, it has “enshrined everything and the opposite of everything”,88_{such has been} evident from the hugely conflicted case law. Lord Rodger has further lamented over the case law stating that “the judgments and decisions of the European Court do not speak with one voice”.89_{The Court appears to be having an internal conflict, it cannot definitively decide} 87 Supra note 35, para 71

88 Supra note 49, Concurring opinion of Judge Bonello page 79, para 7. 89 Supra note 55, para 67.

(24)

how human rights should be implemented extraterritorially. Consequently, we are left with “judgments based on a need-to-decide basis, patchwork case law at best”.90_{The Court,} acutely aware of this internal conflict has consistently approached the cases with those very specific set of facts in mind, thus they can decide the case at hand in the way they desire fully aware that the principles relied upon will fail to apply coherently to other cases meaning that they can easily distinguish those cases if they wish. Just one example of this was seen in Chapter 2.11, when formulating the Loizidou test including the term area was uncontroversial however the limit of this term is unclear and has presented numerous difficulties when trying to apply this test.

Never before has the law on the extraterritorial application of the ECHR been presented with such a potentially polarising moment, a point at which the approach of the Court is seen in the cold light of day for what it is, a “patchwork case law at best”91_{whose judgments are} “based on a need-to-decide basis”.92_{An extraterritorial cyber-attack presents this potentially} polarising moment as it would represent a wholly inconceivable conundrum, one which is inapplicable to the current law. As this author sees it, this polarising moment presents three opportunities for how the Court could approach an extraterritorial cyber-attack. Firstly, they find a way to reject its application, however, if as feared the rise in extraterritorial

involvement and technology coincide to make extraterritorial cyber-attacks more common this approach may at best merely buy the Court time before the problem has to be confronted head on. The second option is to try and square an extraterritorial cyber-attack with the current case law. This possibility has been identified above and it is considered that such an approach may work for some of the more straightforward cyber-attacks (example 1), but when presented with the full versatility of cyber-attacks such an approach would falter in the face of this versatility and would fail to encapsulate the full range of possibilities resulting in the Court constantly playing catch up to gradually broaden its scope. The fear is that this would create even further contradictions and unpredictability which would undermine the Courts authority. The final option would certainly be the bold choice and would be to take this opportunity to realise the failings of the current approach, learn from the mistakes and adopt a position which is grounded in and guided by the aims and objectives of the

Convention.

4.2 Bankovic revisited

This thesis identifies Bankovic as a central problem in the case law on the extraterritorial application of the ECHR which prevents the possibility of an extraterritorial cyber-attack from triggering human rights responsibility. The reason for this is the shared characteristics between an airstrike and a cyber-attack, crucially the fact that both of them require no physical presence by the state conducting the attack in the targeted state. Bankovic rejected 90 Supra note 49, Concurring opinion of Judge Bonello page 79, para 5.

91 Ibid 92 Ibid.

(25)

that an airstrike could raise the required level of control to satisfy the Loizidou test and flat out rejected the use of a personal conception of jurisdiction. Whilst the stringent nature of the Bankovic judgment has been blunted significantly in later cases and a personal model of jurisdiction is now frequently used the Al-Skeini judgment has upheld a crucial aspect of the Bankovic judgment from the cyber-attack perspective. The effect of the Al-Skeini judgment is that the ability to kill (in our example by a cyber-attack) is authority and control but only where the state exercises public powers. As a result of their similarities, if confronted with an extraterritorial cyber-attack the Court will likely assimilate an airstrike to a cyber-attack and thus the ECHR will not apply. Therefore, in order for the ECHR to apply to an extraterritorial cyber-attack in this way it will be necessary for the Court to overrule Bankovic.

Bankovic is also a central problem for what it represents more generally. It immediately became the leading judgment, its adoption of a stringent approach meant that the

development of the law centred around how to decide in line with Bankovic or how to safely avoid applying Bankovic. This has led to a rupture between the case law and the object and purpose of the Convention as Bankovic, in its position as the leading authority has

consequently been indirectly considered the correct reflection of the object and purpose of the Convention without any challenge.

The Convention is a human rights instrument and what connects all human rights instruments is the belief that all human beings possess an inherent dignity93_{and therefore possess certain} rights qua human beings. The messages from Bankovic that the Convention is only to apply in the espace juridique, that jurisdiction is essentially territorial and that an airstrike

conducted by Contracting States which takes place in another state does not invoke their responsibility are completely at odds with the belief that connects human rights treaties. Article 31 of the Vienna Convention on the Law of Treaties requires that “A treaty shall be interpreted in good faith in accordance with the ordinary meaning to be given to the terms of the treaty in their context and in the light of its object and purpose.”94_{In order to assess the} object and purpose of the convention, Article 31 allows context to be drawn from the text, preamble and the annexes of the treaty. The text of the treaty gives little away and the inclusion of terms such as “within the jurisdiction” cause problems in interpretation which require the object and purpose to be considered. The preamble however does provide some insight. It refers to the work of the Universal Declaration of Human Rights, noting its

objective of securing the “universal and effective recognition”95_{of human rights and proceeds} to consider the governments of European countries to be “likeminded” and consider the Convention as an early step to achieve the collective enforcement of the rights in the

Universal Declaration. If the Convention considers itself to be supporting and implementing the Universal Declaration then it ought to follow logically that the two share the same object

93 Universal Declaration of Human Rights, G.A. Res. 217A, U.N. GAOR, 3rd Sess., Part I, at 71, U.N. Doc A/810 (1948), Article 1.

94 United Nations, Vienna Convention on the Law of Treaties, 23 May 1969, United Nations, Treaty Series, vol. 1155, p. 331. Article 31

Can Human Rights as formulated under the European Convention on Human Rights apply to a cyber-attack?