Is a Cyber Attack a Use of Force Under International Law?
Is a cyber attack a use of force (formerly termed an act of war) under international law? Prof. Duncan Hollis, an expert in the field of international law and cybersecurity, explores the nuances of cyber attacks under the laws of war. According to Prof. Hollis, a case such as the attack in the SolarWinds operation attributed to Russian military intelligence would be unlikely to be deemed a use of force since the primary purpose was intelligence gathering, not causing harm. However, cyber operations with broader impact, such as disabling power grids or impacting water filtration facilities for extended periods, could be seen as a "use of force". The deciding factor lies in the sustained damage and disruption caused, not just the cyber intrusion.
Under international law, the term "use of force" is principally derived from the United Nations Charter, specifically Article 2(4) which states: "All Members shall refrain in their international relations from the threat or use of force against the territorial integrity or political independence of any state, or in any other manner inconsistent with the Purposes of the United Nations."
The precise definition of "use of force" in this context has been a matter of some debate. However, traditionally, it has referred to kinetic military actions - i.e., physical violence or armed attacks. In the 1986 case of Nicaragua v. United States, the International Court of Justice (ICJ) provided some clarification, suggesting that a use of force must involve some level of gravity. It distinguished between the most serious forms of the use of force (those constituting an "armed attack") and other less grave forms. However, with the rise of new forms of non-kinetic attacks, such as cyber-attacks, the interpretation of "use of force" is expanding and evolving.
