Impact case study database

1. Creating a new legal framework for cyber operations. By identifying areas of consensus, the Tallinn Manual 2.0 established a legal framework governing cyber operations where none had existed before. The Manual sets out, for example, what legitimate measures or countermeasures a state may take in relation to hostile cyber operations on a range of areas that are critical to the functioning of democracies and economies, from conducting remote law enforcement searches of data, to election meddling and how attacks may be conducted in cyberspace during wartime.

2. The Tallinn Manual rules have been quickly adopted by states to guide cyber operations. The legal framework established by consensus in Tallinn 2.0 has been adopted by multiple states globally as publicly available legal policies to guide cyber operations. Examples include the UK (other than on sovereignty) [5.2], the Netherlands in July 2019 [5.3], France in September 2019 [5.4] and the US in March 2020 [5.5].

Schmitt twice briefed the North Atlantic Council on cyber conflict and the law at the invitation of the NATO Secretary-General. The resulting Rules of Engagement are classified; however, the Legal Adviser to NATO confirmed that “NATO’s work on cyber operations would not be the same without Professor Schmitt. This is the greatest statement of impact that I can imagine for an academic researcher” [5.7].

Tallinn Manual 2.0 also directly impacts operational cyber practices during warfare. The German and New Zealand law of armed conflict manuals, which govern their military operations on the virtual battlefield, refer directly to the Manual [5.6, 5.10]. Every rule set out is drawn from the Tallinn Manual, including those prohibiting cyber operations that affect medical care or the functionality of civilian computers.

The Legal Director of NATO confirms that the Manual has been transformative in the development of law and practice in cyber law: “it is almost impossible to overstate the impact that [Schmitt’s] work on the Tallinn Manuals has had on the approach of NATO Allies and partners to the international law governing cyberspace. First, Professor Schmitt helped set the boundaries of the debate in a way that gave Allies the space and structure to begin their own thinking about these issues. Second, the positions that Professor Schmitt took, even where not adopted by Allies, helped spur States to be more explicit about their views of how international law applies to cyberspace. Major policy statements by States including Australia, France, The Netherlands, and the United Kingdom can be directly attributed to Professor Schmitt’s advocacy work. This kind of impact is massive” [5.7].

Similarly, the CEO of Cyber Law International noted “It is extremely rare for an international law textbook to have such a far-reaching effect on the legal policies of nation states” [5.8].

3. Facilitating implementation of the framework and compliance with international law through training for those approving and conducting cyber operations. Government legal advisers across the world now use Tallinn 2.0 on a daily basis to identify cyber operations that clearly do not violate international law and those that unambiguously do, as well as those operations about which legal uncertainty persists. This allows States to craft lawful operations, publicly condemn those that are not and assess legal-political risks associated with cyber operations of unsettled legality.

Schmitt has played a critical role in ensuring that those charged with approving or conducting cyber operations understand and comply with the legal framework set out in Tallin 2.0. As of March 2020, about 800 governmental officials have attended 25 training courses held across four continents [5.8].

In 2018, Schmitt trained all NATO generals and admirals assigned to Headquarters on cyber law. The Tallinn based program included training on targets that cannot be the object of cyber-attacks during armed conflict, including civil defence facilities and civilian food and water supplies. [5.7]

4. Improving the cybersecurity of individual states and thereby protecting populations and economies internationally. The Legal Director of NATO stated that the Manual and Schmitt’s research had directly improved the cybersecurity of NATO members: “Although I am not at liberty to go into the details, these have led to new policy developments that help improve the cybersecurity of our Alliance” [5.7].

It is difficult to overstate the significance of improved cybersecurity in a digitally-dependent world. As the CEO of Cyber Law International noted, the legal policies shaped by Tallinn “do not only exist on paper; on the contrary, they determine the types of cyber operations countries will engage in, the effects they will pursue in cyberspace, and ultimately, how individual users, corporations and societies will be affected by nation state activities in this domain” [5.8]. This is at its starkest with Schmitt’s evidence-based training for generals and admirals, with life and death consequences for civilian populations across continents.

Above all, the Manual has ushered in a new legal regime that has moved cyberspace away from an ungoverned ‘Wild West’. It has extended and enhanced the rule of law internationally and offered greater protection to smaller states dependent upon the protection offered by international law. As the Dutch Minister of Foreign Affairs emphasized, “[t]he Tallinn Manual reduces ambiguity and uncertainty. It reduces malicious actors’ room for manoeuvre. The manual shows that cyberspace is not simply a jungle, where the strong do what they want and the weak suffer what they must” [5.9].