Cyber Attacks and International Law

A cyber attack represents a novel weapon that has the potential to alter the way state and non-state actors conduct modern war. The unique nature of the threat and the ability for cyberwar practitioners to inflict injury, death, and physical destruction via cyberspace strains traditional definitions of the use of force. In this article, cyber attacks conducted by non-state actors will be discussed only for the purpose of determining when they can be attributed to a state. The main question is whether a cyber attack is an action below the threshold of the use of force, or a use of force, or a use of force amounting to an armed attack. This article has concluded that cyber force, can be qualified as a use of “armed” force in the sense of Article 2 para.4. On the other hand, only large scale cyber attacks on critical infrastructures that result in significant physical damage or human losses comparable to those of an armed attack with conventional weapons would entitle the victim state to invoke self-defense under Article 51of the UN charter. Self-defense would also be possible against a cyber attack that does not reach the threshold of an armed attack but which prepares an imminent armed attack with conventional weapons.