After trying to establish a regulatory context under which cyber warfare operations can be prohibited, a permitting framework for the conduct of cyber attacks will be sought for, namely under one of the exceptions to the customary rule of the non-use of force: self-defence.
This section will deal with the relationship between cyber warfare operations and self-defence, as this is regulated by article 51 of the UN Charter. Two are the main questions that arise. First, does a cyber attack amount to the level of an armed attack, as article 51 dictates for the lawful right of self-defence to arise? Secondly, should an armed attack occur –whether cyber or kinetic– can the right of self-defence be manifested in the form of a(nother) (sic) cyber attack?
Nevertheless, can the opposite happen? Is a cyber attack permitted within the context of the lawful self-defence?
Once again, this analysis stumbles upon the legal obstacles presented supra, when trying to examine the legality of a cyber warfare operation. It cannot be definitely concluded whether or not a cyber attack is permitted under the prohibitory context of the non-use of force doctrine.
However, on the case that a cyber attack is indeed permitted, what rules should govern cyber warfare operations when those are conducted as lawful self-defence?
The confirmed-as-customary-law Caroline set of rules should also be applied to cyber warfare operations.
There has to be ‘a necessity of self-defence, instant, overwhelming, leaving no choice of means, and no moment for deliberation’, coupled with the fact that the action taken, ‘justified by the necessity of self-defence, must be limited by that necessity and kept clearly within it.’
Lastly, another question is raised regarding the highly contentious issue of anticipatory self-defence. Can a state conduct a concerted cyber attack to another state that is allegedly planning an attack? And vice-versa, does the mere ‘possession’ of a highly expert group of hackers amount to an ‘imminent attack’ so that another state can raise the Bush doctrine of pre-emptive self-defence?
Y Dinstein in MN Schmitt, Computer Network Attack and the Use of Force in International Law :Thoughts on Normative Framework – : US Air Force Academy, 1999, at 100The rules developed at the Caroline incident as applicable to any act of self-defence were confirmed by the ICJ as being part of customary law in two separate cases: Nicaragua, para. 194 and Nuclear Advisory Opinion, para. 41.
Letter of Daniel Webster to Lord Ashburton, note of April 24,1841, available at ‘The Avalon Project at Yale Law School: The Webster-Ashburton Treaty and The Caroline Case’, at , see further e.g. RY Jennings ‘The Caroline and McLeod Cases’ (1938) 32 AJIL 82–99
See Petras. Use of Force in Response to Cyber-Attack on Commercial Space Systems – Reexamining Self-Defense in Outer Space at 1245