The extent to which cyber-attacks are subject to the rules of international law regulating military operations

Abstract

Cyberattacks pose one of the most significant challenges facing the contemporary international legal system. They can cause devastating effects comparable in severity to those of conventional military operations, by targeting vital infrastructure, disrupting essential services, or affecting states' defense systems. This development has sparked widespread debate about the extent to which these attacks are subject to the rules of international law regulating warfare. From the perspective of the United Nations Charter, the question arises as to whether a cyberattack can be considered a use of force or an armed attack. This question depends on the nature of its consequences. Legal trends tend to treat it as an armed attack if it results in human losses or significant material destruction. In cases of armed conflict, the rules of international humanitarian law remain in effect, applying fundamental principles such as the prohibition on targeting civilians, the observance of proportionality, military necessity, and the protection of civilian objects. However, the practical challenge lies in the difficulty of assigning responsibility to states, and the non-material nature of some attacks, which raises questions about the possibility of subjecting them to the same traditional rules. In the absence of a legal framework specific to cyberspace, the international community tends to rely on existing rules while attempting to develop more precise interpretations, as demonstrated by the Tallinn Manual, an important reference in this field. Thus, it can be argued that cyberattacks are, in principle, subject to the rules of international law, but the real challenge lies in their practical adaptation and international consensus.