Cyberattacks and the Use of Force

When does a cyberattack become a use of force under international law, and what may a state do in response? States now agree that international law applies in cyberspace. They still disagree about how it applies.

In this TalksOnLaw interview, recorded in March 2022 in the first weeks of Russia's full-scale invasion of Ukraine, Joel Cohen speaks with Duncan Hollis, Laura H. Carnell Professor of Law at Temple University Beasley School of Law and a former attorney-adviser at the State Department. Hollis explains how cyber operations work, the debates over applying international law to them, the line between a use of force and an armed attack, Estonia and the Tallinn Manual, proxies and attribution, influence operations, and countermeasures.

Lead Time, Spillover, and the Cyber Arsenal

Serious cyber operations can take months or years to prepare, Hollis explains: gaining access, mapping a network, then deploying exploits. States that follow the rule of law tend to act with care and target narrowly, unlike the 2017 NotPetya and WannaCry malware, which caused billions of dollars in damage worldwide. Tools can be turned against their makers. EternalBlue, leaked NSA software, was repurposed by criminals, and operations can spill back onto a state's own population. Computer scientists sort threats by the "CIA triad": losses of confidentiality (espionage and data breaches), integrity (making a system do something other than intended, such as moving decimal places in bank records), and availability (ransomware and distributed denial of service attacks). For national security lawyers, he notes, the indirect effects often matter most.

Rules of the Road and Three Kinds of Dispute

John Perry Barlow's declaration of cyberspace's independence from government is now a cautionary tale; states, China with its "great cyber wall" among them, have asserted control. In 1998 Russia asked the UN to negotiate rules for the information environment, with an eye, Hollis says, to regulating speech. Only in 2013 did states agree that existing international law applies. Since then the fight has been over how. Hollis sorts the disputes with three images. Sartre stands for existential debates over whether whole bodies of law apply; China long resisted applying international humanitarian law, until a consensus report said it might. Baby carriages recall H.L.A. Hart and Lon Fuller's "no vehicles in the park" debate: states accept the ban on force but disagree on what it covers. Horses refer to Judge Frank Easterbrook's "law of the horse" and Larry Lessig's reply that cyberspace is different. A fourth problem, the "sound of silence," is that covert operations leave little visible practice.

Treaties, Custom, and the Budapest Convention

International law has no global police force or court, so enforcement is largely horizontal, more like peers in a community steering one another. Its main sources are treaties and customary international law, which arises from consistent state practice followed out of a sense of legal obligation. The United States, for example, is not party to the UN Convention on the Law of the Sea but accepts its 12-mile territorial sea as custom. The one cyber treaty Hollis identifies is the Council of Europe's Budapest Convention, which addresses cybercrime and was negotiated to exclude conduct a state authorizes. That leaves custom, which is hard to identify when state practice is hidden. Some would presume general rules apply until states say otherwise; others would build the law from observed practice.

Stuxnet and the Gray Zone

Hollis calls the Stuxnet worm the seminal moment. In an operation attributed to the United States and Israel, which have never admitted it, malware manipulated the controllers of centrifuges at Iran's Natanz facility, spinning them to destruction while telling operators all was well. Reaching a system not connected to the internet was hard, reportedly through thumb drives, and the worm spread to Siemens systems worldwide, though it stayed dormant outside Natanz. Stuxnet showed that cyber means could damage physical things. States have since built cyber forces; U.S. Cyber Command then had more than 6,000 personnel. Most activity has stayed in a gray zone, such as the 2015 attack, attributed to Russia, that cut power in parts of Ukraine for about six hours. No "digital Pearl Harbor" has come, and nothing in cyber, he said then, approached the horrors of the war in Ukraine.

Use of Force, Armed Attack, and War

Article 2(4) of the UN Charter bars the use of force except in self-defense or with Security Council approval. Written with World War II in mind, the idea has grown to cover non-kinetic means such as chemical and biological weapons. In cyberspace the main approach looks to effects: if the effects are like those of a kinetic use of force, the operation is one. States rarely label specific operations, but the Tallinn Manual experts considered Stuxnet a use of force. Clear lines matter because one state's espionage may look like force to another. "War" largely left the legal vocabulary after the 1928 Kellogg-Briand Pact; Russia calls its invasion a "special military operation." What matters is the armed attack that triggers self-defense. The United States treats any use of force as an armed attack, a minority view; most states require greater scale and effects. A victim of an armed attack need not answer cyber with cyber.

Estonia, NATO, and the Tallinn Manual

If Stuxnet showed cyber's physical potential, Estonia in 2007 showed that cyberspace would be contested between states. As Tallinn prepared to move a Soviet war memorial, a massive denial of service attack took government, bank, and university websites offline for weeks. Estonia blamed Russia, which denied it and refused to help. Estonia asked whether NATO's Article 5, invoked after September 11, applied. NATO said no, since there were no deaths or physical destruction, but it set up a center of excellence in Tallinn, which hosts the annual CyCon conference, where Hollis has spoken. The center funded independent experts who produced the Tallinn Manual 1.0 and 2.0, a book of several hundred pages. It has become a reference point, Hollis says, but it is not binding: it is neither a treaty nor custom.

Proxies and Due Diligence

Many states act through proxies, for capacity or deniability, and Russia, Hollis says, has green-lighted criminal hacking so long as it is aimed abroad. A state is responsible for its organs and agents. For private actors, the International Court of Justice requires "effective control," a standard from Nicaragua's case over U.S. support for the Contras, rather than the broader "overall control" test of the Yugoslavia tribunal. Funding, or even supplying malware, may not be enough, and foreign ministries know where the lines are. Another path is due diligence: a state should not allow its territory to be used to violate other states' rights. After the Colonial Pipeline ransomware shutdown, traced to criminals in Russia, President Biden pressed President Putin to act. Hollis separates a duty to act from the contested "unwilling or unable" theory, noting that Russia used similar logic as a thin veil for invading Ukraine.

Attribution and False Flags

The internet, which grew from the government's ARPANET, was not designed for attribution, and operations can be routed through many "stepping stones." Early on, some thought cyber threats had to be handled like hurricanes, through defense alone. In 1998's Solar Sunrise, the Defense Department suspected Iraq, but the intruders were three teenagers. Attribution has since improved. A handful of states and large tech companies, especially cloud providers, see enough traffic to recognize patterns, and governments combine forensics with human and other intelligence. False flags remain a worry: an attack that shut down French broadcaster TV5Monde, made to look like the work of Middle Eastern terrorists, was later attributed to Russia. States now name one another, as President Obama did over the Sony Pictures hack, and increasingly join in collective accusations.

Influence Operations

Influence operations descend from psychological operations; they aim at the minds of a public or its decision-makers rather than at things. Experts focused on catastrophic attacks, Hollis says, missed the "death by a thousand cuts" of disinformation, as when Russia's Internet Research Agency used fake social media personas to deepen polarization around the 2016 U.S. election. During COVID, governments encouraged vaccine hesitancy abroad and at home. A government that promotes a harmful false cure may violate its own people's rights to life, health, and health information. Abroad, the duty of non-intervention turns on coercion, but the best influence operation leaves targets believing they chose freely. Hollis finds international law "not up to the task" and suggests regulating form rather than content: governments should have to identify themselves when they speak.

Countermeasures and a Hopeful Close

In practice, Hollis observes, Iran answered Stuxnet not with international law but by hacking U.S. banks, and Russian troll farm workers got text messages from the U.S. government suggesting they "think about [their] travel plans." International law's horizontal answer is countermeasures: a proportionate, otherwise unlawful act in response to another state's wrongful act, as in trade disputes. Armed reprisals were abandoned after the world wars, and the International Law Commission's work on state responsibility frames the modern rule. Countermeasures must respect human rights. Whether they can be collective is contested. Estonia supports collective countermeasures, as with collective self-defense; France warns they would be escalatory. Hollis closes with cautious hope. States rallied to the rule of law over Ukraine and declared hospitals off-limits, and he hopes the world can move from normalizing cyber insecurity to normalizing cybersecurity.

What to Know Now

The legal framework Hollis describes still governs, and his point about lead time has gained weight. As of October 2026 the war in Ukraine continues, with cyber operations alongside, not in place of, kinetic force. An attack on Viasat's KA-SAT satellite network on February 24, 2022, disrupted service in Ukraine and elsewhere in Europe; the EU, the UK, the United States, and others attributed it to Russia that May. An April 2022 attempt to cut Ukrainian power with Industroyer2 malware was foiled. In 2024 U.S. and allied agencies warned that China-linked Volt Typhoon actors were pre-positioning in critical infrastructure networks for possible disruption in a crisis, and in 2025 the FBI said the Salt Typhoon espionage campaign had reached more than 80 countries. China denies the allegations.

At the UN, a working group's July 2025 final report created a permanent Global Mechanism on ICT security, which held its first substantive session in July 2026. The UN Convention against Cybercrime, adopted in December 2024, had 95 signatories and 3 parties as of October 6, 2026, and is not yet in force; it needs 40. It covers criminal cooperation, not state operations, and the United States has not signed. The Budapest Convention now has 83 parties. The silence Hollis described has partly lifted: SIPRI counts 35 published national positions, plus common positions from the African Union and the EU in 2024, which tie a use of force to scale and effects. States remain split on collective countermeasures, and Tallinn Manual 3.0 is still in progress.

U.S. policy has grown more assertive. The March 2026 Cyber Strategy for America commits to the "full suite" of defensive and offensive cyber operations and says responses will not be confined to cyberspace. A companion executive order calls for diplomatic pressure, including possible sanctions, on countries that fail to act against cybercriminals, an echo of the due diligence debate. NATO allies have said a cyberattack could trigger Article 5 case by case. Hollis co-convenes the Oxford Process, whose expert statements address health care, elections, information operations, and ransomware.