Lex Lata comes with a Date; or, What Follows from Referring to the “Tallinn Rules”

Our goal is to say, “what is the law, right now”? It was June 2012, that was the date. In June 2012, “what is the law today?” ¹

At first sight, the question that Dan Efrony and Yuval Shany ask in their article, A Rule Book on the Shelf?, makes sense. If a group of lawyers writes a legal manual for state legal advisors, the logical follow-up question would indeed be, do they use it? Do these “black-letter rules,”² as the Manual itself terms them, actually “provid[e] international law advice”³ to states operating in cyberspace? Given the Manual's own claim that its “effort [is] to examine how extant legal norms apply” to cyber warfare,⁴ one may indeed wonder whether states have used the Manual as intended—as a manual.

However, to ask whether states have “accepted,” “follow,” “reject,” or “maintain a ‘wait and see’ approach toward the Tallinn Rules”⁵ does suppose that these are, in fact, rules. Though the authors remain notably quiet on what they think the status of the Tallinn Manual is, exactly, the repeated reference to the “Tallinn Rules,” the word “Rule Book” in the article's title, and even the capitalization of the word itself—“Rules”⁶—all suggest that the authors consider the Manual to be at the very least “a normative point of reference.”⁷ I don't question the correctness of that assumption. The point of this essay is not to assess whether the Manual “got the law right,” or to point out that the experts are “really” doing lex ferenda rather than lex lata.⁸ I do argue, however, that the authors’ quiet acquiescence to what the Manual itself says it is becomes problematic when one considers the dictates of the Manual as a form. What I mean to say is that the Manual must claim, for reasons I will go into below, that it restates lex lata. This dictate of the form not only provokes the kind of research question that Efrony and Shany ask, but it also goes a very long way in predetermining their answers.

In order to show why this is the case, I will first ask what is implied in the Manual as a form for international legal writing. The second part of the essay then discusses the way Efrony and Shany themselves refer to the Manual. Their failure to question the Manual's form is problematic the moment we realize what follows from the claims the Tallinn Manual makes about what it is (for). This also means that the answer to their research question seems in some ways inevitable. In conclusion, perhaps we could even say that, however paradoxical it may seem, the demands of the Manual as a form preordain its own desuetude.

The Form of the Tallinn Manual

First, there is something to be said about the manual as a form. As Wouter Werner points out, an international law manual is not quite the same as a manual one would use when buying a new dishwasher or microwave.⁹ In the first place, international law manuals such as the Tallinn Manual (but also, for example, the San Remo and Harvard Manuals) themselves are the product—which is also how the Tallinn Manuals’ director refers to them.¹⁰ Whereas “[c]onsumer product manuals contain instructions on how to use something else,” the “product” in the case of the Tallinn Manual is the Manual itself.¹¹ Secondly, the rules listed in international law manuals are not simply “instructions” for “proper use.”¹² Instead, the claim is that these are “normative requirements” on the behavior of states when they engage in “armed conflicts at sea,” “air and missile warfare,” or, in the case of the Tallinn Manuals, cyber operations.¹³

So the word “manual” as it features in the title of these international law manuals may be a misnomer compared to its normal linguistic use, but it is safe to say that the Tallinn Manual's drafters do intend it to be consulted by a very specific audience. The Manual itself says it is intended for “users,”¹⁴ which it identifies as, for example, state legal advisors.¹⁵ Importantly, this choice determines the scope of the law it deals with. Note how Michael Schmitt, the Manual's director, describes the Manual as “a restatement of the law. It does not make law. There is no effort to progressively develop the law.”¹⁶ Elsewhere, he similarly states how the group of experts was “slave to lex [lata]” and how the experts “wanted to maintain fidelity to the law as we believe states would interpret it on that date.”¹⁷ The date referred to in the presentation from which this quote is taken is June 2012.¹⁸ A similar thing happens in the Introduction to the second Manual, published in 2017: there, the experts write how “[t]his Manual is meant to be a reflection of the law as it existed at the point of the Manual's adoption … in June 2016.”¹⁹ In short, lex lata comes with a date.

There is a very good reason for this. Based on the form adopted by the Tallinn Manual, this strong emphasis on lex lata makes sense. The experts have to lay claim to applying “the law as it is”²⁰ to ensure the Manual is useful for its “customers.”²¹ If you are a state legal advisor who must draft a memorandum for your secretary of state, lex ferenda doesn't get you anywhere: what you want to know is what the current state of the law is.²² (Interestingly, the claim that the legal obligations outlined in the Manual basically reflect what states are already subject to also helps to understate the novelty of the attempt: in this way the experts can claim that the black-letter rules are really nothing new, that these are simply the rules that states were already bound by.²³) In other words, the need to give lex lata has everything to do with the manual as a “legal” form. Form dictates substance.²⁴

The Notion of a “Rule Book”

From the above it follows that Efrony and Shany's reference to the Tallinn Manual as a “Rule Book” is not that strange. They simply go along with what the Tallinn Manual claims that it is, referring to it as a “comprehensive regulatory scheme,” an “attempt … to adapt existing law to new circumstances” and “to extend the law by way of interpretation and analogy.”²⁵ They cannot frame their own inquiry in terms of “compliance”—that would elevate the Manual to a primary source, which is impossible given Article 38(1) of the Statute of the ICJ. Yet the verbs they use to describe states’ responses to the Manual only just fall short of this: they scrutinize whether states “follow” and “accept” (or not) the Tallinn Rules, “and whether their reactions [are] compatible with” what is outlined in the Manual.²⁶ Their elaborate case studies are designed to test “whether [states] have referred to their legal rights and obligations under international law, as reflected in the Tallinn Rules”²⁷; they want to “[explore] whether lex lata as identified by the international group of experts coincides with the ways in which states actually conduct themselves.”²⁸ A similar ambivalence is reflected in the choice of case studies. Excluded from its scope are cyber operations that took place before 2013, the date of publication of the first Tallinn Manual. At first sight this makes sense, as their question is to what extent states “follow” the Manual. Yet, if we adopt the Manual's logic that it simply restates customary law, and that there is “no effort to progressively develop the law,” there is no reason why cyber operations executed before 2013 should be excluded from the cases analyzed.²⁹ What states “follow,” if we go along with the Manual's autonarrative, is not the Manual, but existing law predating the Manual.³⁰

Based on these case studies, the authors conclude that there is a “gap”³¹ between the rules given by the Manual and states’ legal responses to cyberattacks. The authors state that “the Tallinn Rules, which attempted to flesh out an existing regulatory framework, have been challenged as unfit to fully address the risks of cyberoperations, oblivious to important state interests, and non-reflective of the views held by all states.”³²

Yet on closer scrutiny we may wonder whether the questions asked by Efrony and Shany, as well as their conclusions, weren't somewhat inevitable from the outset. The premise of the Manual—that it states the law as it is—prompts questions such as whether states think so, too,³³ and whether in their actual behavior, purportedly measured by means of these case studies, they “invoke” or “rely on”³⁴ the Tallinn Manual. All this is due to the “manual” as a form. Moreover, to connect the substance of the law so firmly to a specific date almost necessitates taking into account the possibility of change. In another presentation on the first Tallinn Manual, its director says the following:

I will tell you, that I am a firm believer that this body of law will evolve, it will evolve quickly through state practice, because some of the Rules that we came up with that we say are the law, we believe they're the law, states are not going to be willing to accept … Armed attack is a good example. I am absolutely convinced that if the United States were to suffer a massive cyberattack that caused no damage or injury but massively disrupted our way of life, we would consider that an armed attack. I'm absolutely convinced.³⁵

The fact that lex lata comes with a date means that any deviance between state behavior and the Tallinn Manual can be countered by the experts by either claiming the law has changed (“we were right at the time”), or by referring to the greater legal leeway provided in the commentary to the black-letter rules. Their claims can only be fundamentally undermined the moment states start to say existing international law doesn't apply to cyberspace. But this also highlights the risk involved in framing one's efforts so very firmly as lex lata. From the claim to lex lata it also follows—as Efrony and Shany's article shows—that any “gap” between the “Tallinn Rules” and how states “legally” operate in cyberspace will raise questions such as whether the Tallinn group “got the law right”;³⁶ whether states are willing to allow for regulation of their cyberspace activities in the first place; whether cyberspace is simply too complex or “virtual” to be regulated; or whether the Manual is falling into disuse.³⁷ These are precisely the issues raised by Efrony and Shany; the questions they ask in their piece are exactly what may be expected following the Manual's claims to lex lata which, in turn, follow from the form chosen.

Conclusion

To ask whether the Tallinn Manual is doomed to desuetude skips the more fundamental question of how we came to speak of a “Rule Book” in the first place. We could instead go back to the beginning and ask how academic scrutiny of the Manual's use by states may result from adopting, without question, the way it is positioned by its drafters. The answer to the title of Efrony and Shany's article—A Rule Book on the Shelf?—may be largely dictated by the choice for a “manual” as a form. In other words, we may wonder whether a “Rule Book” such as the Tallinn Manual—precisely because of its form—may not run the risk of, indeed, lying on the shelf.