Cyber, space & emerging domains of international law
How international law governs cyberspace and outer space: sovereignty, the Tallinn Manuals, the Outer Space Treaty regime, and contested emerging domains.
The cyber domain and the problem of application
International law was not drafted for cyberspace, yet states agree it applies. The 2013 and 2015 reports of the UN Group of Governmental Experts (GGE) on Developments in the Field of Information and Telecommunications, endorsed by the General Assembly, affirmed that the UN Charter applies in its entirety to cyber operations, including Article 2(4) (prohibition on the use of force) and Article 51 (self-defence). The 2021 GGE report and the parallel Open-Ended Working Group (OEWG, established by Resolution 73/27 in 2018) reaffirmed this and elaborated eleven voluntary norms of responsible state behaviour.
Sovereignty, due diligence and attribution
The principal scholarly synthesis is the Tallinn Manual 2.0 (2017), produced by experts convened by NATO's Cooperative Cyber Defence Centre of Excellence (CCDCOE). It is not binding law but distils existing rules. Rule 4 holds that a state must not conduct cyber operations that violate the sovereignty of another state; whether sovereignty is itself a primary rule or merely a principle remains contested (the United Kingdom argued in 2018, via Attorney-General Jeremy Wright, that there is no standalone rule of sovereignty in cyberspace, while France in 2019 took the opposite view).
The due diligence principle, rooted in the Corfu Channel case (ICJ, 1949), requires a state not to knowingly allow its territory to be used for acts contrary to the rights of other states. Attribution is governed by the Articles on State Responsibility (ILC, 2001): conduct of non-state hackers is attributable only where the state exercises 'effective control' (Nicaragua, 1986; Bosnian Genocide, 2007). Cyber attribution is therefore both a technical and a legal problem.
When does a cyber operation cross thresholds?
A cyber operation amounts to a use of force when its scale and effects are comparable to a kinetic attack (the Nicaragua 'scale and effects' test). The 2010 Stuxnet operation against Iranian centrifuges at Natanz is the textbook candidate for a cyber operation producing physical damage. An armed attack triggering Article 51 self-defence requires a higher threshold still. Below the use-of-force line, hostile cyber operations may breach the non-intervention principle (Nicaragua, 1986) where they coerce a state in matters within its domaine réservé — election interference being the paradigm. During an armed conflict, international humanitarian law applies: the principles of distinction, proportionality and precautions bind cyber operations (Tallinn Manual 2.0, Rules 92–134), as the ICRC has affirmed.
