As nation-states increasingly deploy offensive cyber operations alongside or instead of conventional military force, questions around international humanitarian law become crucial. Attacks targeting energy grids, water supplies, and banking networks can cause civilian harm comparable to kinetic bombardments.
International law does not have a single, comprehensive treaty governing cyber warfare. Instead, existing rules—especially the UN Charter, international humanitarian law and rules on state responsibility—are applied to cyber operations. The difficult part is often deciding what a particular operation did, who is legally responsible, and whether its effects cross a legal threshold.
The UN Charter prohibits states from using force against another state, except in limited circumstances such as self-defence. Whether a cyber operation amounts to a use of force depends largely on its scale and effects. An operation that causes deaths, physical destruction or severe damage may be treated more like a conventional attack than one that disrupts a website temporarily. A sufficiently grave use of force may qualify as an armed attack, potentially allowing the victim state to act in self-defence, subject to necessity and proportionality.
Even below that threshold, an operation could violate a state’s sovereignty or the rule against coercive intervention in its domestic affairs. How sovereignty applies to cyber operations—and which effects are enough to breach it—remains disputed among states.
Power grids, hospitals, water systems and communications networks are often described as critical infrastructure, but international law does not give every such system a blanket immunity from attack in peacetime. The legal analysis depends on the rules that apply, the operation’s effects and the system’s role.
If an armed conflict exists, international humanitarian law applies to cyber operations just as it does to other methods of warfare. Parties must distinguish civilians and civilian objects from military objectives, and attacks must comply with proportionality and precautions. A civilian network does not automatically become a military objective because armed forces use it; nor does military use remove the duty to assess expected civilian harm. Disabling a service without physically destroying equipment can still raise serious legal questions if it causes foreseeable harm to civilians.
Technical evidence may point to infrastructure or tools used in an operation, but identifying those tools is not the same as legally attributing the conduct to a state. State responsibility depends on the facts and the applicable attribution rules. A state’s response may include lawful retorsion—unfriendly but otherwise lawful measures—or, if legal requirements are met, countermeasures intended to induce the responsible state to comply. Countermeasures have limits: they must be proportionate and cannot involve force.
The UN Charter and humanitarian law provide the core legal framework, but many questions remain contested. The Tallinn Manual offers expert analysis of how existing law might apply; it is not a treaty and does not bind states. In practice, the legal assessment turns on the operation’s effects, the evidence linking it to a state, and whether an armed conflict is underway.
