When does a cyber attack count as an act of war?

In the third quarter of 2022, the UAE’s Cyber Security Council disclosed that their systems had successfully thwarted a series of sophisticated and coordinated cyber attacks targeting various sectors including aviation, energy, education, and digital infrastructure. These attempts included efforts to breach digital systems, infiltrate operational accounts and data, as well as phish and exploit users to gain entry into the affected environments.

Luckily, the intrusions were contained before the attackers could achieve their objectives or disrupt the continuity of vital services. This was the third such campaign to be publicly disclosed in 2022.

The UAE’s Cyber Security Council’s announcement did not reveal the identity of the party responsible for these cyber attacks, which may be due to the legal complexities surrounding state-sponsored cyber warfare. This lack of transparency raises several questions regarding international law and the response to such attacks.

The United Nations Charter, established after World War II, prohibits states from resorting to force against another country's independence and territory. This principle is enshrined in Article 2(4) of the Charter, which has been recognized as customary international law and cannot be waived by any state. Subsequent legal interpretations have distinguished between different forms of coercion, such as economic pressure, sanctions, propaganda, and political manipulation, which are not considered "force" under international law.

The court has ruled that an "armed attack" is the only form of harmful action that may justify a retaliatory response as a means of self-defense. This hierarchy of threats includes violations of a country's sovereignty, unlawful interference, use of force, and the ultimate category of an "armed attack," which is the only form serious enough to warrant a military response.

Cyber attacks that cause significant physical destruction, resulting in deaths or severe damage to infrastructure, such as the Stuxnet virus or the 2015 cyber attacks that caused power outages in Ukraine, fall under this category. However, most cyber attacks, such as espionage, data theft, ransomware against banks, and disinformation campaigns, do not rise to the level of "force" as defined by international law.

While there is a clear framework for understanding when cyber attacks constitute a use of force under international law, the main challenge lies in enforcement. The International Court of Justice has emphasized the need for clear evidence linking an attack to a state, which is difficult to prove in an environment characterized by anonymity, proxy networks, and criminal intermediaries.

As a result, the response to cyber attacks largely relies on counter-measures and international law enforcement cooperation rather than military retaliation.