• E4J University Module Series: Cybercrime

• Module 14: Hacktivism, Terrorism, Espionage, Disinformation Campaigns and Warfare in Cyberspace

• Introduction and learning outcomes

• Key issues

• • Hacktivism
  • Cyberespionage
  • Cyberterrorism
  • Cyberwarfare
  • Information warfare, disinformation and electoral fraud
  • Responses to cyberinterventions as prescribed by international law
  • Conclusion
  • References

• Exercises

• Possible class structure

• Core reading

• Advanced reading

• Student assessment

• Additional teaching tools

•  

• First published in June 2019
  

•  

 

  This module is a resource for lecturers  

 

Cyberwarfare

 

The media, politicians, academics, and practitioners have labeled numerous incidents of cybercrime as a form of "cyberwar" or "cyberwarfare" (Maras, 2014; Maras, 2016). Like other topics discussed in this Module, there is no single, universal definition of cyberwarfare. For the purpose of this Module, cyberwarfare is used to describe cyber acts that compromise and disrupt critical infrastructure systems, which amount to an armed attack (Maras, 2016). An armed attack intentionally causes destructive effects (i.e., death and/or physical injury to living beings and/or destruction of property) (Maras, 2016). Only governments, organs of the state, or state-directed or state-sponsored individuals or groups can engage in cyberwarfare.

Existing legal rules and norms on warfare have been applied to cyberwarfare (see Tallinn Manual on the International Law Applicable to Cyber Warfare, 2013 and Tallinn Manual 2.0 International Law Applicable to Cyber Operations, 2017). Before engaging in cyberwarfare, jus ad bellum (i.e., the right to use force) needs to be established. Here, the reasons for using any form of force must be legitimate and sanctioned by law. One such justified reason is self-defence. Countries can engage in the use of force for self-defence purposes pursuant to Article 51 of the UN Charter of 1945, which holds that:

Nothing in the [UN] … Charter shall impair the inherent right of individual or collective self-defense if an armed attack occurs against a Member of the United Nations, until the Security Council has taken measures necessary to maintain international peace and security. Measures taken by Members in the exercise of this right of self-defense shall be immediately reported to the Security Council and shall not in any way affect the authority and responsibility of the Security Council under the present Charter to take at any time such action as it deems necessary in order to maintain or restore international peace and security.

The right to self-defence serves as one exception to the general prohibition of the use of force against other states prescribed in Article 2(4) of the UN Charter (i.e., "[a]ll Members shall refrain in their international relations from the threat or use of force against the territorial integrity or political independence of any state, or in any other manner inconsistent with the Purposes of the United Nations").

When engaging in cyberwarfare, jus in bello (i.e., the right conduct during war) is required. Here, the cyber acts that amount to a use of force must be: proportionate (both to the threat that justified this response and in light of the potential collateral damage); aimed at minimizing casualties through the adoption of certain precautionary measures; discriminating in its targets (i.e., only the actual target should be subjected to the cyber act); and used only as a last resort, after lesser invasive means have been exhausted and/or ruled out as unfeasible options (Maras, 2016).

 

Next: Information warfare, disinformation and electoral fraud

Back to top