Proxy Countermeasures in International Law

Introduction 

In the last few years, the term ‘collective countermeasures’ has at times been used to refer to two conceptually distinct claims. It has continued to be used to refer to the idea that a State other than an injured State, in the sense of Article 48 of the ILC Articles on State Responsibility, may take countermeasures against a State that has violated an erga omnes obligation. But as we note in our recent article in AJIL on collaboration in the taking of countermeasures, it has also been used or taken to refer to a rather different situation: the idea that a third State may take a countermeasure against a wrongdoing State at the request and on behalf of an injured State, where the prior breach affects an obligation that is owed bilaterally between the injured and wrongdoing State.

Two examples may illustrate the difference between the two scenarios. An illustration of the first – and more familiar – situation is Russia’s aggression against Ukraine. The prohibition of force entails an erga omnes obligation, such that all States in the international community have an interest in compliance with this obligation in accordance with Article 48 of the ILC Articles. In this scenario, all other States of the international community would be entitled to take ‘collective countermeasures’ against Russia. While there remains uncertainty as to the legality of such action in international law, the scenario and its parameters are well understood. An illustration of the second may be the following hypothetical scenario. Russia engages in a cyber operation against Estonia, in violation of Estonia’s territorial sovereignty. The obligation to respect territorial sovereignty is not generally understood as one owed erga omnes, and would as such be owed bilaterally between Estonia and Russia. On some views, which we will discuss in this post, Estonia would be permitted to ask the United States, a State which is neither injured by the breach nor has a legal interest in compliance with the relevant obligation, to take a countermeasure against Russia on its behalf (that is, a measure that would violate the US’s own obligations towards Russia).

The idea that a State that is injured by a breach of international law may request another (third) State to take countermeasures on its behalf against the wrongdoing State is a novel proposition. It is one that has arisen, in particular, in the cyber context in the last few years, and is perhaps best articulated in Costa Rica’s statement on the application of international law in cyber-space in 2023:

countermeasures may be taken by the injured State, i.e., the State specifically affected by the breach, as well as third States in response to violations of obligations of an erga omnes nature or upon request by the injured State. (emphasis added).

While the proposal has arisen in the specialised context of cyber-space, it is not difficult to imagine other contexts in which this possibility may be relevant: a State that is injured by the breach of, for example, a treaty on cooperation in criminal matters might request an ally to freeze assets of the wrongdoing State on its behalf.

So far, the views of States on the matter have remained limited and mixed. France rejects all ‘collective countermeasures’, so presumably it would deny the possibility of proxy countermeasures as well. Austria, in the most recent position paper on international law in cyber-space, also seems to deny this possibility – if only by implication. By both limiting its views on ‘collective countermeasures’ to the erga omnes context, and asserting that ‘[c]yber activities would rarely breach such an obligation’, Austria seems to be excluding the possibility that third States may take countermeasures at the request and on behalf of States injured by malicious cyber-operations.

In this post, we address this novel scenario. We note, first, that its novelty is sometimes obscured by the general use of the term collective countermeasures to capture the familiar scenario of a State other than the injured State in the sense of Article 48 ASR taking countermeasures as well as this novel scenario arising in relation to a bilateral obligation. Instead, we propose the use of the term ‘proxy countermeasures’ to capture this possibility. Second, we argue that proxy countermeasures are not currently permitted by international law. And third, to the extent that States wish to expand the situations in which they may collaborate in responding to wrongdoing of other States, we raise some alternative possibilities.

A Novel Scenario – Proxy Countermeasures and Existing Terminology

The possibility that an injured State may call upon a third State to take countermeasures against its wrongdoer (outside the erga omnes context) has only rarely been entertained in the literature. It was raised by Theodore Woolsey in the late 1880s (p 20), and then again by Ellery Stowell in the 1920s (pp 46-47). In more recent times, the possibility was most clearly articulated and defended by Elisabeth Zoller in the late 1980s, on policy grounds (pp 114-115). Michael Akehurst’s 1970 article on Reprisals by Third States, essentially advocated for countermeasures in situations akin to the violation of erga omnes obligations. The ILC does not appear to have contemplated this possibility at all during its work on State responsibility and – as we will say shortly – there is no State practice in support of it either.

The radical novelty of this claim is obscured by the use of the term ‘collective countermeasures’, which has become prevalent in the cyber-literature to refer to a range of situations of collaboration in the taking of countermeasures (eg, Kosseff and Schmitt & Watts, Haataja also noting the novelty of the claim). This term is being used to refer both to situations where the obligation breached is an obligation erga omnes – and thus there is a State other than the injured State in the sense of Article 48 ASR – as well as the situation under discussion in this piece in relation to a bilateral obligation. Moreover, the legal and policy implications of the two situations are quite different. It is for this reason that we think a different label may be needed to refer to this more novel claim relating to a bilateral obligation – we propose to use the term ‘proxy countermeasures’. (At the same time, in the interests of clarity, we adopt the term ‘countermeasures in the general interest’ or ‘general interest countermeasures’ to refer to countermeasures by States other than an injured State in response to violations of erga omnes obligations.)

The Lack of Basis for Proxy Countermeasures

In our view, proxy countermeasures are not currently permitted in international law. Aside from certain legal positions of States on the application of international law to cyber-space (the value and weight of which as State practice or opinio juris may be difficult to assess), the idea of proxy countermeasures is not supported by practice or by the work of the ILC. It also cannot be sustained by analogy to notions of collective self-defence or cooperation with private entities in the taking of countermeasures, or by other legal doctrines presently recognized in international law.

First, there is no basis in the practice of States for this claim. In our article, we review two plausible instances of practice: the first relating to the Tehran Hostages Crisis and the second concerning looted Albanian gold and the enforcement of a judgment of the ICJ. We suggest that these instances do not support a claim to proxy countermeasures: to the extent that States not injured by the breach took, or discussed, any measures inconsistent with the rights of the wrongdoing State, they did so on the basis of the collective character of the interests involved.

Second, the ILC did discuss the idea of countermeasures being taken ‘at the request and behalf of’ an injured State (see e.g. here), and the idea remains in the Commentary to Article 54 ASR. However, without exception, this discussion took place within the framework of erga omnes (partes) obligations and, in particular, in the context of setting out rules regulating countermeasures taken by States other than an injured State (in the sense of Article 48 ASR). At no point did the ILC consider that a State injured by the breach of a bilateral obligation owed to it directly could request a third State to take a countermeasure against the responsible State on its behalf.

Third, while the cyber-literature and practice sometimes use the term ‘collective countermeasures’ to parallel the notion of ‘collective self-defence’, the right of collective self-defence cannot provide a compelling analogy in this context. This is because, as the ILC noted, collective self-defence may be rationalised on the basis of the erga omnes character of the prohibition of force. States are each (individually) entitled to act in ‘collective’ self-defence by Article 51 UN Charter, a right which is underpinned by the legal interest they possess in compliance with the prohibition of force. In this context, the requirement of ‘request’ acts to limit the right of collective self-defence of States, and not – as would be the case with proxy countermeasures – to create that right. Moreover, analogies can also not be drawn to situations where a State requests a private entity (such as a technology company) to take the measure on its behalf: the private entity would likely have no relevant obligations of its own under international law, and its actions would be attributable (under Articles 5 or 8 ASR) to the requesting State. In other words, it would be the requesting State itself acting for the purposes of international law.

Fourth, we do not believe that there are other legal doctrines or rules – such as agency or the vesting of powers – that could plausibly be relied upon to ground the permissibility of proxy countermeasures. Under the doctrine of agency, the conduct of the agent is treated by the legal order as the conduct of the principal. So if State C (in our example above) were to take a countermeasure on behalf of B, this would be considered an act of B and not of C. However, it is not clear that there is a general law of agency in international law. Writing in the 1940s, Sereni considered that there were instances of practice in this respect and that no State had objected to these sorts of relations in principle. However, he noted that in order to have legal effects against third parties, such agency arrangements required notification to, and some form of recognition by, that third party. For present purposes, State A would need to be notified, and recognise or accept, that State C was acting on behalf of State B. This would be unlikely in the conflictual context of countermeasures.

As to the vesting of powers, the question here is whether State B could transfer its right to take countermeasures to State C. In legal terms, it would not be the case, as in the previous paragraph in relation to agency, that the conduct of State C is treated as that of State B, but rather that the justification would be transferred from B to C. Here, some care is needed. It is true that legal orders recognise a variety of doctrines pursuant to which one party can transfer or vest a right or power in another. However, the question here is much more specific – and concerns the putative transfer of a defence such that State C has a justification for infringing its own obligations vis-à-vis State A. Put in this narrower way, it is hard to find any support in even roughly analogous situations in domestic law. Although a full survey of all domestic orders is not possible, it is doubtful that in contract law, for instance, such a possibility would exist. It would entail that, absent specific agreement to the contrary, a breach of a contractual obligation owed by X to Y, which might justify some remedial action by Y, could entitle Z not to comply with its own, independent, obligations to X just because Y requests that they not comply.

The endorsement of this broad notion of ‘collective countermeasures’, as including what we call ‘proxy countermeasures’, is often grounded on considerations of policy and fairness. It points, in particular, to the imbalances of technical or material capability between States, and the intuition that stronger States should be able to come to the aid of weaker States. This is, too, the concern generally voiced in the literature in support of cooperation in the field of countermeasures. This is certainly an understandable aim, and it may drive the development of a doctrine of proxy countermeasures either as a specific response mechanism in cyber-space or as a general development of the law of international responsibility.

This said, any such development will need to attend to the exact legal mechanism by which the action of the requested State becomes lawful – whether through some notion of agency, vesting, or the transfer of a justification. Moreover, especially if intended as a development of the general law of countermeasures, it would also need to provide robust safeguards against abuse. An expansion of the pool of States entitled to take countermeasures may also lead to increased resort to them, and to the aggravation of disputes. Besides, it will be key to guard against abuse of this ‘new’ entitlement by powerful States. Although a request would be required, it would still be for these States to decide when to act on that request, and thus to decide which violations of the rights of smaller States they would like to see enforced. Writing in 2002 on what he called solidarity measures, Koskenniemi argued that given there is no suggestion of a duty to act in these circumstances—unlike in respect of a domestic police force—powerful States could thus create ‘a world order of their liking by choosing between violations they enforce and violations they do not, as well as deciding on the manner and intensity of their reaction’ (at 344). Koskenniemi’s point applies with as much force to the question of proxy countermeasures.

Conclusion – Another Approach

There is no doubt that the policy concern behind the proposed development of proxy countermeasures is an important one. To the extent that States do wish to develop the law in this direction, there may be a better approach to achieve the same result. It would require, essentially, two combined steps. First, it would require the classification of certain obligations as erga omnes (for example, those regularly infringed by malicious cyber-operations such as territorial sovereignty and non-intervention). Second, it would require clarification of the permissibility of general interest countermeasures in international law. In this way, a State victim of a malicious cyber-operation may still be able to call upon their allies to take countermeasures against its wrongdoer. Such an approach would cohere with the basic structure of the law of responsibility (on standing), and with the existing general framework for the implementation of State responsibility.