When does a cyber attack count as an act of war?
Earlier this month, the UAE’s Cyber Security Council announced that its systems had thwarted a series of advanced and organised cyber attacks against the country’s aviation, energy and education sectors. The campaign, the council said, included attempts to breach digital systems and infrastructure, and infiltrate operational accounts and data. There were also efforts to phish and exploit users as…
The UAE's Cyber Security Council recently reported thwarting a series of sophisticated cyber assaults targeting critical sectors such as aviation, energy, and education. These attacks, aimed at breaching digital systems, fortifying operational accounts, and exploiting users, were ultimately contained before any damage could be inflicted.
The incident, which marked the third such event this year, highlighted the complex legal questions surrounding state-sponsored cyber warfare, as there are currently no clear international rules defining such actions. This ambiguity arises because state-sponsored cyber operations operate in a legal grey area, raising questions about whether they constitute "force" under international law, trigger the right to self-defense, and whether existing laws appropriately address them.
These issues trace back to the UN Charter's creation after World War II, which restricted states from using or threatening force against another country's independence and territory. The International Court of Justice confirmed this as binding customary law, and the ICJ ruled that "force" should be confined to "armed attack," excluding other tools like economic pressure or political coercion.
In 1986, the court ruled that the US's support for Nicaraguan rebels constituted "use of force," even without direct military involvement, based on the substance of coercion and the traceability of harm to a state. This hierarchy of threats—from sovereignty violations to unlawful interference, to use of force and finally "armed attack"—provides a framework for understanding cyber attacks' potential to justify retaliation as self-defense.
While most cyber attacks don't reach this threshold, they can still violate sovereignty and be illegal. However, the distinction between unlawful actions and justifiable military responses is crucial. The current framework acknowledges that cyber operations causing significant physical destruction or loss of life could justify a military response, but it remains challenging to prove such actions in the complex, anonymous cyberspace.
Written by urgent.news from The National Business's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
Also reported by 1 other outlet
- When does a cyber attack count as an act of war? thenationalnews.com
