The basic rules on cyber and information operations are straightforward: targeting civilians and civilian objects is forbidden; indiscriminate weapons must not be used; indiscriminate and disproportionate attacks are prohibited; medical services must be respected and protected.

International Laws for Cyberwarfare

The advent of cyberwarfare has introduced new challenges for international law. While there is no single comprehensive treaty dedicated exclusively to cyberwarfare, existing international legal frameworks, including the UN Charter, customary international law, and various conventions, are applied to regulate state behavior in cyberspace. Additionally, emerging norms and guidelines, such as the Tallinn Manual, help clarify how international law applies to cyber operations.

1. Key Principles of International Law Applicable to Cyberwarfare

1. Sovereignty
   • States have sovereignty over their digital infrastructure and cyberspace within their jurisdiction.
   • Any unauthorized cyber operation that interferes with a state’s internal affairs or compromises its infrastructure may violate this principle.

2. Prohibition of the Use of Force (Article 2(4) of the UN Charter)

   • Cyber operations equivalent to armed attacks—causing death, destruction, or significant disruption—may constitute a prohibited use of force.
   • Example: A cyberattack disabling critical infrastructure, such as power grids, may be treated as a breach of this principle.
3. Non-Intervention
   • States must not intervene in the internal or external affairs of another state.
   • Cyber operations aimed at influencing elections or destabilizing governments could violate this rule.
4. Self-Defense (Article 51 of the UN Charter)
   • States have the right to self-defense if a cyber operation rises to the level of an armed attack.
   • This includes proportional responses, which may involve kinetic or cyber countermeasures.

5. International Humanitarian Law (IHL)

   • During armed conflicts, IHL principles such as distinction, proportionality, and necessity apply to cyber operations.
   • States must distinguish between civilian and military targets in cyberspace and avoid excessive harm to civilian infrastructure.
6. Due Diligence
   • States are obligated to ensure that their territory is not used to launch cyber operations against other states.
   • Failure to prevent such activities could result in state responsibility.