Not Illegal: The SolarWinds Incident and International Law

Abstract

In 2021, the United States and other governments formally blamed Russia for a wide-ranging hacking campaign that breached the update process for SolarWinds Orion network monitoring software and used that access to compromise numerous government agencies, companies, and other entities. Despite denouncing Russia’s cyberespionage and imposing sanctions, the United States did not call Russia’s actions illegal as a matter of international law—and for good reason. Based on the publicly available facts, this article argues that the SolarWinds incident likely did not run afoul of international law as it currently stands. The article considers the prohibitions on the use of force and intervention, emerging rules with respect to cyber operations and violations of sovereignty and due diligence, and international human rights law, and it concludes with some reflections on the role of states and scholars in decisions about whether to close gaps in international law.

Keywords: cyber, cyberespionage, SolarWinds, use of force, intervention, sovereignty, due diligence, human rights