THE LEGALITY OF CYBER WARFARE

By Anivarth Parthasarathy

We live in a world in which war no longer requires bombs or boots on the ground. Today, countries can disable a country’s power grid, disrupt critical government systems, and even cause physical damage to infrastructure– with only a keyboard. As the use of cyber warfare becomes prominent in international conflicts, the legal world faces a massive challenge: How do we define and prosecute war crimes in cyberspace? 

THE CURRENT ISSUE AT STAKE 

Cyber warfare has evolved to become one of the most dangerous and crucial tools that a government can possess. Cyber-attacks on a country can severely impact all aspects of the nation, disrupting its government, economy, and can cause billions of dollars in damage. A series of cyber-attacks on Ukraine and other European countries by Russia in 2022 caused an estimated $10 billion in damage. Even in its elementary stages, cyber warfare has quickly proved to be one of the most powerful and feared weapons in a nation’s artillery. As the use of cyber-attacks continues to grow, so will its implications and severity. 

However, the current international law falls behind on the regulation of cyber warfare. How do we draw the line on something that does not physically exist? How do we draw the line on something that we do not completely understand? 

NAVIGATING THE LEGAL LANDSCAPE 

Current international laws, such as the Geneva Conventions, were written in a time of physical warfare. Their key goals were to protect civilians, infrastructure, and military personnel. But cyber-attacks don’t drop missiles or troops; they drop code– something just as deadly if not worse.  

Cyber warfare could qualify as war crimes under international humanitarian law (IHL). The issue is that cyber-attacks often lack physical destruction, and this results in serious legal ambiguity. Under IHL, a war crime is defined as a “serious violations of international humanitarian law”. This often requires a connection to an armed conflict, endangerment of protected civilians, or even a violation of traditional values and morals.  

Cyber-attacks complicate each of these. How do we connect a cyber-attack to an armed conflict? A simple proxy or VPN could be utilized to mask one’s identity and connection. How can we measure endangerment of civilians when there is no physical threat or casualties? How could we measure the use of technology against a country to traditional morals built on physical warfare?  

Without a proper way to regulate and enforce international humanitarian law on cyber warfare, the issue only continues to grow and increase in severity. 

WHAT’S NEXT? 

The legal world is slowly catching up. Three editions of the Tallinn Manual have been published, analyzing how international humanitarian law can be applied to cyber conflicts. The project was written at the NATO Cooperative Cyber Defense Centre of Excellence and involves studies and opinions of various legal experts and researchers who are slowly deciphering the way to regulate and enforce international law to the digital world.  

The International Criminal Court has also announced that it will begin to investigate and prosecute cyber-attacks that breach existing international laws. Beginning with the devastating cyber-attack on Ukraine in 2022, the ICC plans to expand and strictly enforce international law to cyber warfare. 

FINAL THOUGHTS 

A digital battlefield is no longer a story of science fiction; it’s already here. But while cyber weapons continue to evolve and grow in power and severity, our laws remain the same, targeting an era of physical warfare. Unless international powers effectively address this issue and set a means of enforcing cyber-attacks, we risk entering an age where digital war crimes can be committed without consequence—because they were never properly defined. 
 
 
 
 

CITATIONS 

Andy Greenberg, The International Criminal Court will now prosecute Cyberwar Crimes Wired (2023), https://www.wired.com/story/icc-cyberwar-crimes/ (last visited May 14, 2025).  

Geneva conventions, Wikipedia (2025), https://en.wikipedia.org/wiki/Geneva_Conventions#:~:text=The%201949%20conventions%20have%20been%20modified%20with,the%20Adoption%20of%20an%20Additional%20Distinctive%20Emblem. (last visited May 14, 2025).  

Hybrid warfare: How cyber warfare is transforming international relations, Sia Partners - Global Management Consulting Firm (2025), https://www.sia-partners.com/en/insights/publications/hybrid-warfare-how-cyber-warfare-transforming-international-relations#:~:text=DDoS%20attacks%20have%20emerged%20as,trust%2C%20and%20destabilizing%20the%20economy. (last visited May 14, 2025).  

Institutdelors, https://institutdelors.eu/wp-content/uploads/dlm_uploads/2022/03/PB_220301_Cybersecurite_Barichella_FR.pdf (last visited May 15, 2025).  

Rule 156. Definition of War Crimes, IHL Databases, https://ihl-databases.icrc.org/en/customary-ihl/v1/rule156 (last visited May 14, 2025).  

Tallinn manual, Wikipedia (2025), https://en.wikipedia.org/wiki/Tallinn_Manual (last visited May 14, 2025).