‘ Restating the Law “ As It Is ” ’ 1 : On the Tallinn Manual and the Use of Force in Cyberspace

The recently published ‘Tallinn Manual on the International Law Applicable to Cyber Warfare’ arguably constitutes the concluding piece of a debate on the (in)applicability of the prohibition on the use of force in cyberspace. It acknowledges a framework developed by Michael Schmitt, who suggested the use of particular criteria to assess whether force has been used. This article concludes that the foundations for the suggested solutions are unsure and that, contrary to the Manual’s stated goal, it adds to the existing ambiguity rather than clarifies the law on cyberattacks. “this law is real and must be applied”


Introduction
These past twenty years have witnessed a growing body of legal writing on cyberwar. 3The notion that cyberspace might play a role in international security gained prominence after the 1991 Gulf War 4 -the first war in which "personal computers permeated all layers of command and all functions of combat operations"5 -which led to "a watershed in military thinking about cyberwar". 6In the almost complete absence of State practice and opinio juris international legal scholars played a significant role in drawing up the legal framework applicable to this "fifth domain of warfare" 7 -inter alia with regard to the jus ad bellum. 8The legal debate arguably recently culminated in the 'Tallinn Manual on the International Law Applicable to Cyber Warfare' 9 (hereafter Manual) instigated by NATO's Cooperative Cyber Defence Centre of Excellence and created by an International Group of Experts. 10 The Manual purports to "[bring] some degree of clarity to the complex legal issues surrounding cyber operations" 11 by applying both jus ad bellum and jus in bello to war in cyberspace. 12omposed by "distinguished international law practitioners and scholars" 13 it has been claimed to reflect "teachings of the most highly qualified publicists" 14 -an explicit reference to the sources of international law. 15Whether justly made or not, the aggregate of this claim, the stature of the Manual as well as its possible impact provides sufficient reason to consider it more closely.
The publication of the Tallinn Manual is preceded by a debate that started in the mid-1990s; one that took flight after Michael Schmitt published his 'Thoughts on a Normative Framework' in 1999. 16In this article he presented six criteria that could be applied to a cyberattack to establish whether it constitutes a violation of the prohibition on the use of force.His framework is brought to the fore by the 2013 Manual's 'Rule 11' and the accompanying Commentary on Article 2(4) of the UN Charter.This particular part of the Manual suggests that a set of criteria could be applied "to assess the likelihood that States will characterize a cyber operation as a use of force" 17 when it does not result in death and destruction -in which case it would most certainly violate Article 2(4). 18 is obvious that a 'use of force' is a legal qualification.Not only does it constitute an internationally wrongful act entailing the international responsibility of the State, 19 it furthermore allows the victim State to take countermeasures against the perpetrator. 20Any criteria to establish whether force has actually been used are likewise presumably legal ones.Therefore it is rather surprising in this respect to find that the Manual not only presents the criteria as "merely factors that influence States making use of force assessments; they are not formal legal criteria" 21 but moreover claims that the Manual "is a restatement of the law, it does not make law". 22This professed intent to restate existing law rather than proscribe new law is repeated several times, both within and outside the Manual. 23Suggesting the use of (allegedly) non-legal criteria when making 'use of force assessments' is, however, somewhat at odds with claiming that the Manual applies "the law as it is". 24Though the Manual only "[takes] notice" 25 of the approach originally developed by Schmitt the substantiation of these criteria in this Manual on 'the international law applicable to cyber warfare' remains unclear.In other words, the question is how these criteria should be viewed in relation to the claims made about the nature of the Manual.This article considers the four possible ways of viewing the status of the criteria 26 : first, they represent already existing law; second, the criteria are legal factors States should be taking into consideration; third, the Manual creates new law by proposing the criteria; and finally, the criteria constitute political rather than legal tools.Close analysis reveals that none of these views renders a satisfactory appreciation of the relation between the criteria and the Manual.This is all the more striking given that the Manual aims to provide "some degree of clarity to the complex legal issues" 27 for a "community of nations…concerned about [the] normative ambiguity [surrounding cyber operations]". 28This article concludes that instead of providing this clarity the Manual renders a framework strewn with uncertainty, ultimately maintaining rather than resolving, 'normative ambiguity'.
In order to develop this argument this article explores both the Manual itself as well as previous writing by Michael Schmitt, a choice that is based on the fact that the Manual refers and bears a close resemblance to his work on Article 2(4) and cyberattacks.Taking Schmitt's work into account therefore serves to broaden our understanding of the Manual.Moreover, a presentation on the Manual given by Michael Schmitt -director of the International Group of Experts behind the Tallinn Manual -at the 4 th CCDCOE conference in Tallinn in 2012 has been used to more fully comprehend the ambition of the Manual's drafters.
The following section outlines what the problem is exactly when applying Article 2(4) to cyberattacks and proceeds in section II by presenting the Manual's suggestion for solving it.This section moreover looks into the background of this particular framework by considering earlier work by Michael Schmitt.The third section then focuses on the foundation for the criteria in international law.It argues that the Manual's claim of 'restating the law as it is' cannot be upheld with regard to the criteria and consequently considers alternative views.The fourth and final section provides a discussion of the conclusions drawn in this article as well as a reconsideration of the debate on the (in)applicability of Article 2(4) to cyberattacks.I. Article 2(4), the Nature of Cyberwar and "translation problems" 29 Article 2(4) of the UN Charter (in)famously proscribes that "[a]ll Members shall refrain in their international relations from the threat or use of force against the territorial integrity or political independence of any state, or in any other manner inconsistent with the Purposes of the United Nations". 30The Charter allows for two exceptions to this prohibition, namely the right to self-defence in case of an armed attack as well as the use of force authorised by the UN Security Council. 31The question is how the prohibition on the use of force applies in cyberspace, mainly with regard to two issues. 32First, as Article 2(4) only applies between States, the problem is how to deal with cyberattacks by non-state actors -that is, if the attack can be attributed in the first place. 33Uses of force by non-state actors traditionally have been held to be subjected to law enforcement 34 and the debate on the exercise of the right to selfdefence against armed attacks by non-state actors is unresolved. 35Through cyberspace a single hacker can create damage at levels previously mainly the preserve of States 36 and, somewhat paradoxically, this asymmetry has created a level "playing field" 37 between adversaries.Furthermore, the nature and origin of the threat are oftentimes unknown: "[t]he 'enemy' becomes a faceless and remote entity, a great unknown that is almost impossible to track." 38s Stephen Neff points out it is precisely "the nature of the enemy [that serves] to distinguish war from…law enforcement". 39Anonymity in cyberspace therefore not only leads to issues of attribution and doubts as to the "nature of the attack" 40 , it also contributes to insecurity as to the appropriate legal framework. 41Sean Kanuck even argues that "cyberspace…is…nearly impervious to regulation" 42 as war in this 'fifth domain' presents a "[change] of kind, not just of degree". 43condly -and the focus of the present article -a key question is what 'force' in cyberspace means exactly. 44Drafted in 1945 the Charter logically did not take into account the possibility that future attacks might be conducted through codes and viruses, 45 though there does appear to be some scholarly reconciliation to the idea that the Charter does apply to war in cyberspace (see below). 46Arguably somewhat more problematic given the interpretive history of the prohibition is the fact that cyberattacks can be both destructive as well as disturbing to daily routines 47 : cyberattacks can derail trains and steer airplanes off-course, but they can also lead to disturbances such as a temporary interruption in online banking services. 48Moreover, there is "a much wider warspace" 49 as the vulnerability of modern societies increases with their dependence on technological infrastructures. 50e uneasy fit between a conventional application of Article 2(4) and cyberattacks has led legal scholars to provide different answers to the question whether the existing jus ad bellum is at all applicable and if so, how. 51Some scholars answer this question in the negative and claim that the nature of cyberattacks as described above and the inadequacy of existing legal instruments to deal with them necessitates the conclusion of a "cyber-treaty". 52Others, however, take a "law-by-analogy approach" 53 and consider cyberwar as a new yet adaptable phenomenon that can be incorporated into the current regulatory framework on the use of force.This approach has three variants, two of which shall be shortly discussed. 54The third, instrument-based approach is left out of the discussion as "most scholars have rejected [it] as dangerously outdated". 55It is therefore irrelevant for the current overview of mainstream approaches.
Under the effects-based approach, a cyberattack constitutes a use of force when its effects exceed a threshold level of severity. 56Broadly speaking, when the effects of a cyberattack are comparable to those caused by conventional means it constitutes a use of force. 57The problem with this approach is that it leaves no "logical basis" 58 to exclude that which has traditionally always been excluded from the prohibition on the use of force: economic coercion.The fact is that economic sanctions potentially wreak havoc on a larger scale than 'conventional' use of force; the sanctions against Iraq in the early 1990s being one of the most prominent examples. 59An effects-based approach 60 to a use of force would therefore lead to the logical inclusion of economic coercion -something States have resisted for years. 61is is not the only issue, however.Given the dependency of societies on cyberspace and other networks, attacks are potentially more disruptive than destructive. 62Widespread chaos due to network malfunctions might equally threaten the 'territorial integrity or political independence' of the State.This in turn has led to the "target-based approach" under which every attack on a state's critical national infrastructure is considered a use of force. 63A similar argument that has been put forward against the effects-based approach applies here, however: extending the scope of the prohibition to any attack on critical infrastructures, regardless of its effects, risks eroding the prohibition to include even the most minor hostile acts. 64It seems that cyberattacks can hardly be considered in relation to Article 2(4) without simultaneously calling into question other 'use of force-categories'. 65spite these shortcomings, the 'law-by-analogy approach' is likewise adopted by the Manual.The following section outlines the framework it suggests for the application of Article 2(4), followed by a critical review in section three.

II. The Tallinn Manual
The experts involved in the drafting of the Manual "[were] unanimous in [their] estimation that both the jus ad bellum and jus in bello apply to cyber operations". 66With regard to Article 2(4), the starting point is the Nuclear Weapons Opinion of the International Court of Justice (ICJ) in which the Court argued inter alia that the prohibition on the use of force "[applies] to any use of force, regardless of the weapons employed". 67According to the Expert Group, as a rule of customary law this facilitates the application of the prohibition to attacks in cyberspace. 68Furthermore, in the Commentary to Rule 11 -"Definition of use of force" 69 the Experts employ 'scale and effects', as promulgated by the ICJ in its Nicaragua ruling 70 , as a standard for armed attacks, considering it "to be an equally useful approach when distinguishing acts that qualify as uses of force from those that do not". 71As such, any cyberattack that leads to damage to or destruction of life and/or property amounts to a violation of the prohibition on the use of force. 72However, the Expert Group concedes that this standard is only useful in those cases where a violation of the prohibition is obvioussomewhat irreverently the 'most-likely cases'.Not every cyberattack lends itself so easily to consideration under Article 2(4). 73In order to regulate this grey area, the authors of the Manual suggest eight criteria that could be applied to any concrete cyberattack in order to establish whether the prohibition has been violated.Of the eight criteria -severity, immediacy, directness, invasiveness, measurability of effects, military character, State involvement and presumptive legality 74 -severity is considered by the Experts to be the most important one. 75In line with the adopted scale and effects-standard any cyberattack that causes damage and/or destruction is probably a use of force, regardless of the 'match' with other criteria. 76The Manual emphasises that "[these] are not formal legal criteria" 77 but "that they are merely factors that influence States making use of force assessments". 78It furthermore adds that "in the absence of a conclusive definitional threshold [for a use of force], States contemplating cyber operations, or that are the target thereof, must be highly sensitive to the international community's probable assessment of whether the operations violate the prohibition on the use of force". 79In other words, the list of criteria is indicative of a 'use of force assessment' only, and is not exhaustive: other factors might be taken into account appertaining to the situation at hand. 80e framework acknowledged in the Manual was first expounded by Michael Schmitt in 1999. 81The starting point of his analysis is a reconstruction of the tension between Article 2(4) and cyberattacks as a problem of instruments and effects.To this end he restates the Charter's aims: to promote "international peace and security" through the prohibition on the use of force. 82"At least since the promulgation of the Charter", Schmitt claims, "this use of force paradigm has been instrument-based." 83The reason for this is a practical one, because even though the Charter's main concern is with the consequences of the use of force, these are "extraordinarily difficult to quantify or qualify….ina normatively practical manner". 84So even though ideally 'force' would have referred to those measures producing a threshold level of death and destruction this allows for too much room for manoeuvring when deciding whether the prohibition has been violated. 85Therefore, a "shortcut" 86 is used by considering the means with which the state measure has been executed. 87Schmitt distinguishes between political, economic and armed coercion, where the latter poses the greatest threat to international peace and security and is therefore the only means prohibited by Article 2(4). 88his is a reliable tool as long as instruments and effects largely coincide; in other words as long as the most serious consequences are caused by military means. 89Cyberattacks cut through this 'congruence' as their effects can be both minor as well as very serious. 90In other words, means and effects no longer concur.The solution lies in finding the common denominators between those consequences traditionally only caused by armed force but now potentially produced by cyberattacks as well.Schmitt's proposal is the one that is brought to the fore by the Manual: the application of a set of criteria to cyberattacks to establish whether Article 2(4) has been breached.Schmitt presented six criteria against the Manual's eight as "underlying factors driving the existing classifications" 91 ; State involvement and military character are both absent from the framework proposed by Schmitt.Considered as a seventh factor Schmitt argued that "assessing State responsibility…is a practical challenge, not a normative one" 92 ; though after excluding it from the framework in 1999 he added it in a later restatement of his work. 93Military character was added in the Tallinn Manual. 94

III. On 'Restating the Law "As It Is"'
This specific part of the critique brings us to the relation between the Manual's proposed framework and its claim that the Manual itself is a "restatement of the law". 98Starting point of the analysis is to go back to what it is these criteria are supposed to do.As stated above, the supposed difficulty lies in those acts that do not result in death and destruction. 99The question is what to do with the marginal cases: hence, the criteria.They serve to distinguish between acts constituting a use of force and those that do not rise to that particular level.In other words, the aim is to facilitate a legal assessment of concrete cases that might present themselves to States.As stated in the Introduction, the issue is how we should view the relation between the criteria and the claims made about the nature of the Manual.There are four ways of assessing this relation. 100First, by reiterating the criteria, the Manual might indeed apply existing law to the use of force in cyberspace.It does so by referring to relevant sources, such as State practice and opinio juris or treaty law.A second option is that, instead, the Manual argues the criteria are how Article 2(4) should be translated into cyberspace; in that case the Manual would be making suggestions for the direction the law should take.As a third option, by introducing the criteria the Manual is involved in creating new law.Explicit references to one Ziolkowski points out that the 'level of directness' between an attack with chemical and biological weapons is likewise weak, yet the use of these weapons "will very likely always be considered "use of [armed] force"" (Ziolkowski, p. 304).Furthermore, causation is not a legal element and thus cannot be part of a legal analysis (ibid.).Another argument is made by Silver, who states that this criterion comes down to an analysis of the level of death and destruction caused, and is therefore likewise similar to the use of armed force (Silver, p. 90).Ziolkowski argues that the 'invasiveness' of a cyberattack might likewise only be exposed gradually; furthermore, it is open to abuse if the standard used is the extent to which national interests have been infringed (Ziolkowski, p. 304).Cyberattacks and conventional uses of force are both invasive; a cyberattack requires, by whatever means, trespass into another state's territory (Silver, p. 90).Ziolkowski points out that effects might be hidden from view by the private sector; moreover cyberattacks often cause "secondary [and] tertiary…effects" (Ziolkowski, p. 305) which are harder to quantify.This puts the practical use of 'measurability' into question.Silver rejects this criterion outright as he foresees no difficulties in assessing the effects of a cyberattack (Silver, p. 90).'Presumptive legality' proves to be a logically fallacy as a criterion: "it cannot be decided whether a particular act is indeed legal under the ius ad bellum by the simultaneous assertion or indication of its legality at the same time" (Ziolkowski, p. 305; though she aims the critique at the original 'presumptive legitimacy').A similar point is made by Barkham, pp.85-86.What is more, legitimacy constitutes a political or intuitive judgment, rather than a legal one (Ziolkowski, p. 305).The Tallinn Manual changed the original 'legitimacy' to 'legality' (Tallinn Manual 2013, supra note 9, Commentary to Rule 11, para.9, p. 51).Silver furthermore points out that cyberattacks are in any case "presumptively illegal" under domestic laws (Silver, p. 90).Finally, the difficulty with 'State responsibility' lies in the fact that none of the available legal mechanisms is unproblematic (Ziolkowski, pp.306-307).Though Silver, like Ziolkowski, argues that "all that is left is severity" (Silver, p, 90, emphasis in original removed), he proposes a treaty to regulate cyberattacks, see also fn144 of this article.Barkham highlights that employing just this criterion leads to overinclusion, see Barkham of the sources of international law would then be made to suggest that this is indeed the case.Finally, the Manual could be doing none of the above -neither applying existing law, nor making suggestions for what it ought to be, nor creating it.It might simply suggest what States could take into consideration when making these 'use of force assessments'.The following pages will discuss these four options in turn.
If the criteria, as a first option, reflect existing international law, the Manual would have had to refer to one of the sources of international law.These include treaties, customary law, general principles and "judicial decisions and the teachings of the most highly qualified publicists". 101The criteria are supposedly founded in a reconstruction of the Charter framework -as a treaty being one of the sources of international law.As stated in section II, the validity of the criteria is based on the idea that the criteria represent "the underlying factors driving [motivating] the existing classifications" 102 in the UN Charter; they duplicate the existing framework and thereby highlight the similarities between 'traditional' uses of force and cyberattacks.In terms of the Schmitt framework, these factors represent the existing delineation between what used to be a rather one-dimensional distinction between armed coercion and other coercive means.To clarify, it is worthwhile to quote Schmitt somewhat more extensively: "…reference to the instrument-based shorthand facilitates greater internal consistency and predictability within the pre-existing framework for inter-state coercion.It allows determinations on the inclusivity of the use of force to more closely approximate the current system than analysis based solely on consequentiality would allow.As a result, subscription by the international community is more likely, and application should prove less disruptive and controversial.This is not to say that greater focus on core objectives, on consequentiality in its pure form, is not to be sought.It is only a recognition that until the international community casts off its current cognitive approach, community values are, for practical reasons, best advanced in terms of that which is familiar and widely accepted." 103e above citation suggests that the list of criteria does not consist of arbitrarily assembled factors, rather, they 'best advance community values' and as such they honour "the balance of the current framework". 104e claim that the criteria emerge from the underlying Charter-based distinctions between armed and other types of coercion would render support for the notion that the Manual applies existing law.In Schmitt's own words, the criteria are "an interpretive dilation of the use of force standard". 105In the Manual, however, only two criteria -military character and presumptive legality -contain references to one of the sources listed above. 106No reference is made to the UN Charter as the basis for the criteria, as Schmitt originally suggested.The question is why this substantiation in international law is limited to just these two criteria as this creates ambiguity as to their nature.Why not apply a similar method to the other six?And why is there no mention of the foundation for the criteria in the UN Charter?As an alternative, the reference to the criteria as being part of the deliberations of States might give rise to the suggestion that this is State practice.This is not the position taken up in the Manual, however: it refers to the criteria as something "States are likely to consider"107 ; similarly, "States may look to [other factors]". 108No attempt is made to abstract from these considerations to more generic State practice or opinio juris. 109Though this is in line with Schmitt's later writings -in which the criteria evolved from that which 'best advances community values' to "a number of factors that would likely influence assessments by States as to whether particular cyber operations amounted to a use of force" 110 -this leaves unresolved the question of the substantiation of the criteria in existing international law. 111at is more, the 'Schmitt framework' relies on a very particular reconstruction of the Charter.This reconstruction centres around the assumption that the Charter's main concern is with the consequences of deleterious actions but that such a standard would be too difficult to use in practice.The question is whether this is an accurate reading of the Charter and what it is based on. 112A completely opposite reading is likewise possible: Sean Kanuck argues that "[t]he primary concern [of, inter alia, Article 2(4)] is the nature of the assault, not its ramifications.Except under a very liberal reading of those terms, many of the elements of information warfare would escape interdiction under these principles of international law". 113Such doubts as to the origins of the criteria calls into question whether they do in fact accurately reflect existing distinctions between armed coercion and other measures. 114th regard to this first option -that the criteria reflect existing international law -it is clear that even if one accepts Schmitt's reconstruction of the Charter's existing classifications, this particular substantiation in existing (treaty) law is lost in the Manual, nor does the Manual provide a substantiation in any of the other sources of international law.
As an alternative second option, the Manual could be making claims about what the law should look like.The argument would then be that, though not currently law, the criteria should become law by means of -for example -custom or treaty.However, this is not the attitude of the Manual.Rather than suggesting that States should take them into consideration the criteria are "[factors] States are likely to consider and place great weight on". 115It is difficult to think of a formulation further removed from proscribing particular standards to States.The Manual simply states that it "took notice" 116 of the framework developed by Schmitt, which serves to "assess the likelihood that States will characterize a cyber operation as a use of force". 117It appears to be a factual description or, perhaps, an "intuitive approach" 118 to 'use of force assessments'.This second possible appreciation of the criteria can therefore be ruled out.
If the Manual, as a third option, had suggested that the criteria create new law it would, again, have had to refer to one of the sources of international law.The work of the Group of Experts could be labelled as 'teachings of the most highly qualified publicists' and indeed is referred to as such by Schmitt himself. 119This particular source, however, serves "as subsidiary means for the determination of rules of law" 120 -these teachings are supposed to help clarify the law, not create it.This is emphasised by Schmitt, who when presenting the Manual declared that "there is no effort to progressively develop the law". 121In other words, there is no claim to law creation.This rejection of the third option brings us to the fourth and final one, the possibility that the criteria amount to something completely different -simply political criteria for example.This seems to be the position taken up in the Manual itself.As indicated above the criteria are described as something 'States are likely to consider', "not exhaustive" 122 and the likelihood of them being taken into consideration as "[dependent] on the attendant circumstances". 123This suggests that the criteria, though not fully interchangeable, are subject to change and not set in stone.As Kessler and Werner put it, the criteria "are quite radically relativized". 124econdly, the criteria are, in the words of Schmitt, "predictive tools, not normative standards" 125 -in the words of the Manual, "they are not formal legal criteria". 126The criteria are "merely factors" 127 States take into consideration when a cyberattack occurs.These arguments serve to emphasise that the criteria constitute political rather than legal tools: they serve the choices of States rather than constitute legal guidelines for decision makers.
Though this fourth and final appreciation, in which the criteria are neither legal nor normative, seems to be the most likely one, two arguments can be brought against this conclusion.First, the application of a set of criteria underlying any legal standard has a legal effect.As argued above, a use of force entails the international responsibility of the perpetrator.Article 28 of the Articles on State Responsibility states that "[t]he international responsibility of a State which is entailed by an internationally wrongful act…involves legal consequences…" 128 These consequences include reparation for injuries and possibly countermeasures taken by the victim State. 129To apply the criteria is in fact to come to a judgment of a certain State act and to form a legal assessment of whether the prohibition on the use of force has been violated.The claim that they are merely political (or another set of non-legal) criteria, therefore, cannot be upheld.assessment they cannot but be of a normative nature themselves.In this respect Schmitt's initial argument to exclude 'State responsibility' from the criteria is telling.After arguing that armed coercion is usually the prerogative of States he claims that "[h]owever, this is an issue of assessing State responsibility, not lawfulness.It is a practical challenge, not a normative one". 132By virtue of it being a 'practical' rather than a 'normative' issue, State responsibility is excluded from the analysis.This last reading is confirmed by other scholars.Daniel Silver, for example, praised Schmitt for his "impressive effort to delineate a principled basis for identifying those cases of [computer network attacks] that [sufficiently [resemble] armed force]". 133Jason Barkham describes the reasoning behind the criteria as that they "[preserve] better consistency between evaluating computer attacks and traditional attacks". 134As a final example, Katharina Ziolkowski is warned by Schmitt himself of "[attributing] rather more normative significance to [the criteria] than I do". 135sponding to this particular reading of his work Schmitt attributes this differing analysis to his adherence to the New Haven School, where "law…often reflects policy choices that are shaped to achieve particular values.This explains my readiness to identify influences on legal assessments that are not strictly legal in nature". 136This amounts to a conflation of 'is' and 'ought' 137 , however, a loss of the prescriptive value of law.The outcome of a 'use of force assessment' becomes entirely unpredictable as it is dependent on those factors States might consider relevant at that particular moment. 138If the standards that make up a legal categoryin this case, the use of force -are somewhat arbitrary or even entirely political in nature it is hard to see how this is still law.This is not the same as saying that States might label (or refrain from labelling) a particular incident a use of force for political reasons -the relevant issue is what underlies the legal qualification.

IV. Discussion
None of the four options discussed on the preceding pages results in a satisfactory appreciation of the criteria as acknowledged by the Manual.What is left is a framework strewn with ambiguity.The Manual's claim that it "examines the norms resident in the jus ad bellum" 139 should in all likelihood be revisited as the notion that it merely 'channels' existing law onto the cyberplane is insufficient to come to a full appreciation of the nature of the framework it 'takes notice of'.In this particular debate the 'teachings of the most highly qualified publicists' as 'subsidiary means for the determination of rules of law' might be more significant than in other debates.Considering, it is difficult to maintain that the interpretative endeavour of the Manual, more notable in light of the almost complete absence of State practice and opinio juris, really amounts to no more than mere law application.This conclusion should come as no surprise.Debate on the (in)applicability of international law in general and Article 2(4) in particular is rife. 140To illustrate, Dieter Fleck comes to the exact opposite evaluation of the Manual's success in applying existing law: "[t]he particular , i.a.pp.59, 94-95.Schmitt replied to Ziolkowski's critique; see M.N.Schmitt, 'The 'Use of Force' in Cyberspace: A Reply to Dr Ziolkowski', in C. Czosseck, R. Ottis & K. Ziolkowski (eds.)2012 4th International Conference on Cyber Conflict: Proceedings, Tallinn: NATO CCD COE Publications 2012 (Schmitt 2012b), pp.311-317.96 A different kind of critique is aimed at the nature of the analysis: application of the criteria requires the victim state to appraise the attack when it has already passed, which few States will be willing to do.See Barkham 2001, supra note 32, p. 86.Hathaway et al. argue that the criteria are too comprehensive to be of "sufficient guidance" (Hathaway et al., p. 848) to those in power facing cyberattacks.See Hathaway et al. 2012, supra note 3, pp.847-848.97 Kessler & Werner 2013, supra note 13. 98 CyCon 2012, Michael Schmitt, supra note 1, at 3:12.99 Tallinn Manual 2013, supra note 9, Commentary to Rule 11, para.8, p. 48; Schmitt 1999, supra note 16, p. 18. 100 See fn26.