International Law and Cyber Threats from Non-State Actors

Abstract

Within the realm of law applicable to and governing cyber activity, a host of legal regimes are relevant, including, most notably, domestic criminal law, national security law, and international law. The nature of today’s globalized and interconnected world combined with the extensive reliance on technology, computer systems and internet connectivity also means that non-state actors, whether individuals or groups of some kind, can have a significant impact through cyber activity. At the same time, the complexity of cyber operations – in terms of characterizing the nature of the operations, identifying the main players, and developing appropriate options in response – opens up an equally complex legal environment for analyzing the parameters of and framework for such responses. This legal environment includes the law of armed conflict (LOAC), the law governing the resort to force (jus ad bellum), and human rights law, along with national security law and domestic criminal law. Cyber operations can be used both within armed conflict and in the absence of armed conflict, which is – of course – part of the complex nature of the legal inquiry.

This article focuses on the international legal framework that governs defense against cyber threats from non-state actors, specifically LOAC and the law governing the resort to force. In doing so, it will identify both essential paradigms for understanding options for response to cyber threats from non-state actors and key challenges in those paradigms. The first section addresses jus ad bellum – the law governing the resort to force – and how it applies to and provides guidance for state responses to cyber actions by non-state actors. The second section analyzes when and how LOAC applies to non-state cyber acts and examines some of the specific challenges cyber acts pose for such analysis. Finally, in the third section, this article highlights broader cross-cutting issues, such as the challenges of multiple overlapping legal paradigms and the role and power of rhetoric in exploring how states can and do respond to cyber threats from non-state actors.

Keywords: cyber, law of war, law of armed conflict, international humanitarian law, non-state actor, self-defense, United Nations Charter, non-international armed conflict