When does a cyber attack become an act of war? Can a state respond to hacking with missiles? Who is responsible when malware spreads to hospitals? Cyber warfare law and ethics try to answer these questions. The rules are still developing, but there is broad agreement on the basics.
This guide explains the key legal principles, the most important sources and the ethical debates that remain open.
Does international law apply in cyberspace?
Yes. Most states, including through UN expert groups, have agreed that existing international law applies, especially the UN Charter. What remains debated is exactly how it applies to specific operations.
Two bodies of law
| Area | Question | Key rules |
|---|---|---|
| Law on the use of force (jus ad bellum) | When may a state use force? | UN Charter Article 2(4) bans the use of force; Article 51 allows self-defence against an armed attack |
| Law of armed conflict (jus in bello) | How must force be used once a conflict exists? | Distinction, proportionality, precaution, military necessity |
When is a cyber operation a “use of force”?
There is no simple threshold. Experts usually look at the scale and effects. A cyber operation that causes death, injury or significant physical destruction, similar to a bombing, would likely count as a use of force and possibly an armed attack. By contrast, espionage, data theft and most disruptive attacks fall below that line, even when they are harmful.
The law of armed conflict in cyberspace
During an armed conflict, cyber operations must follow the same principles as other military actions:
- Distinction: target only military objectives, not civilians or civilian objects.
- Proportionality: expected civilian harm must not be excessive compared with the military advantage.
- Precaution: take feasible steps to avoid civilian harm, such as limiting malware spread.
- Protection of special objects: hospitals, water systems and similar infrastructure have special protection.
Self-spreading malware, such as NotPetya in 2017, shows how hard it can be to respect distinction and precaution online.
The Tallinn Manual
The Tallinn Manual 2.0 (2017), produced by international legal experts with support from the NATO Cooperative Cyber Defence Centre of Excellence, sets out 154 rules on how international law applies to cyber operations. It is not binding, but governments and lawyers widely use it as a reference.
State responsibility and attribution
States are responsible for cyber operations carried out by their agencies, and sometimes by groups they direct or control. However, proving this takes time and evidence. Many states also accept a due diligence duty: they should not knowingly allow their territory to be used for attacks on others.
Ethical debates
- Civilian infrastructure: most networks are civilian, so even military operations may affect ordinary people.
- Proliferation: cyber weapons can leak and be reused by criminals.
- Private companies: should firms “hack back” against attackers? Most legal systems, including India’s IT Act, make unauthorised access illegal even in response.
- Vulnerability disclosure: governments must decide whether to keep zero-days for operations or disclose them so they can be fixed.
- Accountability: deniable operations make it hard to hold anyone responsible.
What this means for organizations
Companies should not assume legal protection will stop attacks. Instead, they should invest in defence, report incidents to CERT-In as required, and never conduct offensive “hack-back” operations. Read how to combat cyber warfare for practical measures.
Sources
Worried about targeted attacks on your business? Our VAPT services find weaknesses before attackers do, and our OSINT investigations show what is exposed about your organisation online. Contact us for a quote.
