Earlier this month, the UAE’s Cyber Security Council announced that its systems had thwarted a series of advanced and organised cyber attacks against the country’s aviation, energy and education sectors.
The campaign, the council said, included attempts to breach digital systems and infrastructure, and infiltrate operational accounts and data. There were also efforts to phish and exploit users as an entry point into the environments concerned. Thankfully, the intrusions were contained before the attackers could reach their objectives or interrupt the continuity of vital services.
It was the third such campaign made public this year.
Interestingly, while the council identified the sectors attacked in its statement last week, it did not disclose the party responsible – an omission that’s unlikely to have been an oversight because of how legally problematic doing so can be. This is because state-sponsored cyber warfare operates in a legal grey area without clear international rules, and raises a number of questions.
When one state attacks another through a computer network, does that count as “force” under international law? Does such an attack entitle the victim to respond in self-defence? And do our current laws cover this?
These are difficult questions to answer, and to understand why, we need to go back more than 80 years to the creation of the UN Charter – the foundational treaty of the UN.
After the Second World War, the treaty’s drafters took away the right to “resort to force” from individual states and placed it in the hands of the newly constituted Security Council. The key rule – Article 2(4) – says countries must not use or threaten force against another country’s independence and territory. The International Court of Justice thereafter confirmed it is a binding customary law from which no country can opt out.
Subsequent deliberations led to the concept of “force” being confined to “armed attack”, with other tools such as economic pressure, sanctions, propaganda and political coercion being deliberately left out. Thereafter, the ICJ ruled that Article 2(4) applies no matter what means are used to cause harm; in other words, the article is concerned with consequences, not with hardware.
In 1986, the court ruled on a case where the US had recruited, trained, armed, funded and directed rebel forces inside Nicaragua. It said this counted as a use of force, even though it wasn’t a direct military invasion. What mattered was the substance of the coercion and whether the harm could be traced back to a state. This case established a hierarchy of threats: at the bottom are violations of a country’s sovereignty; then unlawful interference; then use of force; and at the very top, “armed attack” – the only kind serious enough to justify retaliation as a means of self-defence.
This hierarchy is exactly what cyberspace requires.
If, for example, an operation attributable to a state opens the floodgates of a dam over an inhabited area, shuts down an electricity grid during winter, damages a reactor or blinds air traffic control, the resulting deaths and the physical destruction are indistinguishable from those produced by a missile. The Stuxnet virus that damaged Iranian centrifuges in 2010 and the 2015 cyber attacks that cut electricity to Ukrainians belong in this top category.
However, most cyber attacks don’t rise to this level. Espionage, data theft, ransomware against banks, disinformation and interference in elections are illegal and violate sovereignty. But they are not force. That distinction cuts both ways: something can be unlawful without justifying a military response.
Is the existing framework sufficient? The rules are largely sound but what’s missing is agreement on how to interpret them, what evidence is needed, and how to enforce them. A UN working group spent five years negotiating and, last July, produced a report that reaffirmed existing rules without adding anything new. A proposed sentence clarifying when a cyber operation amounts to a use of “force” was removed following objections.
The gap, however, is narrower than it looks – more than 100 states have published their views on how international law applies in cyberspace. The dispute isn’t over whether the UN Charter still applies, but whether an entirely new treaty is needed. That disagreement has stalled progress even as real-world practice moves forward anyway.
Some experts argue that because rules enshrined in the charter are broken so often, they cannot really be “law”. But that is akin to saying murder is not illegal because murders happen. Weak enforcement does not mean the rule doesn’t exist.
Only a cyber operation causing death, injury or substantial physical destruction on a scale comparable to a conventional attack could justify a military response. Financial damage, however costly, does not – and neither does hacking into critical systems, as long as it doesn’t cause destruction.
-
Travellers queue at Brussels Airport in Belgium after a cyber attack affected electronic check-in and boarding systems at several major European airports. Reuters -
Brussels Airport said the attack had a 'large impact on the flight schedule' and would cause delays and cancellations. Reuters -
Travellers queue at a check-in area at London Heathrow Airport's Terminal 2. Collins Aerospace, a provider of check-in and boarding systems for several airlines, said 'cyber-related disruption' to its Muse software was causing delays at some airports. Reuters -
Travellers waiting at Heathrow Airport. Customers were warned of delays and advised to check their flight status with their airline before travelling. Reuters -
Flights at Berlin Airport in Germany were also affected by the cyber attack. AP
The bigger problem is proof. Courts require clear evidence linking an attack to a state. In a domain built on anonymity, routed through third countries and executed through proxies and criminal intermediaries, meeting that standard within the short window in which self-defence remains credible is extremely hard. Where an attack can’t be traced to a state, the answer isn’t military response. It includes counter-measures and law enforcement co-operation.
Some states now argue that a sustained campaign of smaller attacks should be added together and treated as a single “armed attack”. No court has endorsed that view, and doing so would provide justification for retaliation – precisely what the charter’s rules were designed to prevent. It is the strict reading of Article 2(4), not the permissive one, that offers the best protection against the strong, and it deserves to be defended in the digital domain as firmly as it has been defended on land and at sea.
What, then, is the way forward – particularly for Arab states such as the UAE that are the target of cyber attacks? The first step would be to publish their own positions on how international law applies in cyberspace. Then they should adopt a shared regional position – as African and European countries have – and press for transparent, independently verifiable ways to prove who is behind an attack.
Amid these efforts, it’s important that the international community does nothing to weaken Article 2(4). For that would amount to accepting something the UN Charter was designed to reject as far back as 1945: that power gives one the right to act without consequence.
