The issue is all but unimportant for Estonia and Estonians: The single best-known Estonian foreign policy artefact may well be a prominent collective exposition of how international law should be applied to cyber operations – the Tallinn Manual [1] . This ground-breaking international scholarship delivered to the world from, as the book’s name says, Tallinn, is part of Estonia’s international image.

In layman terms, this heavy legal text lists the do’s and do-not’s for military operators equipped with screens and keyboards. How far can they go without violating another state’s sovereignty? Where runs the fault line of an illegal intervention in cyberspace? What does and what does not, constitute use of force in the ICT environment? And, consequently, what are lawful responses to cyber operations that cross those thresholds? The Manual is a fine and valuable contribution to international legal practice and scholarship. The national pride over this work has been marked with the Order of the Cross of Terra Mariana from President Kersti Kaljulaid to Michael N. Schmitt, the editor-general of the Manual.

Although the Manual is not Estonia’s formal position on international law, it is the clearest signal currently out there on our priorities. President Kaljulaid’s (2019) statement on international law in cyberspace also remains preoccupied with violation thresholds and responses.

Now, is the world with clear rules for cyber operations what Estonia aspires towards? Or would Estonia’s cyber Shangri-La be a world without operations in cyberspace, and instead, informational self-determination and international tolerance online? Can Estonia’s views on the UN Charter and general public international law be one in cyberspace and the other in “real” space? For a while, they likely can – in the cyber bubble, we may start reading the UN Charter from Article 2(4) on and debate ad infinitum what does (and what does not) constitute use of force in cyberspace. And in other situations, we may still open it on the first page and do our best to never have to read beyond Article 2(3) and the obligation of friendly settlement of international disputes. In a long run, it is doubtful whether a state can read the same instrument differently online than it is read offline, and whether full exercise of human rights and freedoms is possible in a state engaged in global cyber conflict.

As there are rumors about a third edition of the Tallinn Manual underway, now is a good time for Estonia strategically shape her international cyber policy posture in the context of international law and cyber operations – and there is more than one way to go about it.

Estonia could rest on her laurels and let the third edition of the Tallinn Manual add to her status as a go-to country on international law and cyber operations. A well-developed product line, the next Manual would likely capture further nuance and common ground on the legal parameters of operating in cyberspace, which makes the product useful for American and Estonian cyber operators alike. This way, the next Manual would not change much for Estonia as a landmark holder – the Manual will forever be associated with the Sprat Town.

However, ten years ago, when the Manual was first conceptualized and the project launched, this work was expected (and ordered) to fill a significant void. After Russia-associated cyber-attacks against Estonia in 2007 and Georgia in 2008, there was a genuine question whether international law can, in fact, be applied to cyberspace at all. In 2020, other issues are of essence. The question is no longer whether international law can be applied in cyberspace, but how to apply it. As this concern is way wider than operational interests, Estonia should be concerned with the spotlight cast on the Manual. Not only is it world-known but it is becoming a household name in the discussion on how international law applies in cyberspace. And in any common sense, this conversation should not start from how to conduct operations. It should start from how to avoid ever being exposed to cyber-attacks and their consequences.

For the vast majority of the world, international law is not about the “hard issues” of breach thresholds and countermeasures. For most countries, and in most instances, international law is regarded as the guarantee of sustainable development, societal and economic progress and applied through cooperation, peaceful settlement and human rights. For most countries, international law is about abstaining from all those thresholds, let alone responses to their violations. This is where there is a real void is in the international community in 2020.

An ambitious approach for Estonia would be to invest in wider legal excellence and an even stronger footprint on international law as it applies in and out of cyberspace. Decisively and credibly taking up the issue of international law beyond the scope of the Tallinn Manual would be the move of a grand state – a move to put the Tallinn Manual in perspective and demonstrate that Estonia is not only able to host a group of operational lawyers but able to convene and broker a good faith conversation of international law that serves wider interests than those of the most developed cyber powers. That is, to return Estonian online views of international law to where they have traditionally been offline. Beyond scoring another attention point in world politics, this move would make a true small country statement about international law: that international rules and standards of behavior are not to be pawned for contingent strong national interests and after (and outside) every current competition, there are normalcies of international law that guarantee international peace, stability and security.

A less ambitious but perhaps timely move would be a deep review of the Estonian stance in the light of what matters most – do Estonians care about the current void in the international community? Would they approve spending capital on a very special cross-Atlantic relationship? Are they willing to accept lesser rights and freedoms over heavier security guarantees? How can Estonia build an existence online that it can justify and sustain from the Narva to Nootamaa and from Vaindloo to Karisöödi?  

Stakes and tensions on how international law will be applied in cyberspace remain high: it has been observed that cyber conflict is a way for the nuclear powers to settle their scores without fearing the engagement breaking into an all-out war. If so, the question of how international law applies in cyberspace easily becomes the question of how international law applies everywhere. As there are no special international rules or standards for states conduct online, the emphasis we put on state behavior in cyberspace gradually becomes the reading we put on age-old rules and principles of international law. The further we tolerate and promote exceptions to those in cyberspace, the more we risk tolerance for low-intensity conflict and state-on-state bullying becoming a possible reading of the UN Charter in any international affairs.

Whatever Estonia’s next moves will be on international law in cyberspace, they should be formed with due appreciation of how will our reding of international law support what Estonia is seeking to achieve in cyberspace and what do we want Estonia to be for Estonians and the projected 10 million e-residents.

[1] Schmitt, M. (2017). Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations (2nd ed.). Cambridge: Cambridge University Press. doi:10.1017/9781316822524

The Article was published in Edasi.org in December 2020.