Nations must clarify the law of cyberspace to tackle online threats and warfare

Governments around the world must clarify their legal position in cyberspace so more can be done to tackle online threats and warfare, an expert has said.

Cyber threats pose a growing risk to our societies by spreading misinformation, disrupting critical services and undermining trust in democratic institutions. Since most rules of international law were developed in the pre-digital age, it is far from clear how these rules apply to mitigate cyber threats.

Professor Aurel Sari, from the University of Exeter Law School, participated in an annual meeting of senior legal advisers at the Council of Europe, where he outlined the “difficult choices” facing governments.

He noted that cyberspace is not a legal vacuum, yet there is no agreement about how key rules and principles of international law apply in this domain.

Professor Sari said: “Since international law is made by states, it is ultimately for governments to clarify how the existing rules of international law apply in cyberspace. Many governments have already taken important steps to this end, while others should be encouraged to follow these examples and publicly share their national position.”

Professor Sari was as a special guest of the Council of Europe’s Committee of Legal Advisors on Public International Law in Strasbourg. The meeting was attended by legal advisors to more than fifty states and international organizations.

Discussing the cyber dimension of the ongoing conflict in Ukraine, Professor Sari noted that Ukraine has been targeted by hundreds of cyber-attacks since the start of Russia’s full-scale invasion in February 2022. While the impact of these attacks on the course of the conflict has been limited, at least some have been carried out to complement conventional military action by Russian forces, bringing them within the scope of the rules of international law governing the conduct of hostilities. The conflict has also seen the widespread involvement of cyber volunteers and ‘hacktivists’, raising questions as to whether these persons have lost their status and protections as civilians.

Professor Sari also observed that cyber support from other nations is not compatible with traditional conceptions of neutrality if they directly supported Ukraine’s military operations. Other forms of support provided to Ukraine through cyber means, for example the sharing of military intelligence, may also be incompatible with the traditional requirements of neutrality.

To mitigate the risks presented by cyber threats, several nations now adopt a more expansive understanding of the relevant rules of international law. Some countries have taken the position that cyber operations which severely disrupt the functioning of the state, including its economy, could amount to a use of force even where these operations do not cause physical damage.

Professor Sari said: “While cyber operations pose a multitude of legal challenges, we should be careful not to overestimate their novelty and distinctness. Agreeing on clear legal standards and fostering legal certainty is vitally important, but this alone does not guarantee compliance. Where compliance is not forthcoming, and in the absence of effective enforcement mechanisms, States will continue to turn to measures of self-help.”