Terminological precision and international cyber law

The recent spate of hostile cyber operations by States, non-State groups affiliated with States, and non-State groups operating on their own has resulted in a cacophony of pronouncements and commentary by political leaders, pundits, journalists, and legal experts. As illustrated by cyber operations such as SolarWinds and the Microsoft Exchange operations attributed to China, much of the discussion reveals a misunderstanding of how international law applies to cyber operations. This misunderstanding can often be traced to misuse of legal terms like attribution, countermeasures, below-the-threshold operations, due diligence, use of force, self-defense, cyberwar (armed conflict), and attack. Frequently, the terminological imprecision leads to confusion over the legal character of hostile cyber operations and the response options that international law allows targeted States. In this post, I offer an abbreviated lexicon of the legal terms that are most frequently misused. It is far from a comprehensive discussion of these terms; Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations (TM 2.0) offers deeper analysis of each, and readers are directed there for a full explanation of them. Instead, my objective here is merely to sensitize readers to the legal content of the terms and highlight certain unsettled legal issues regarding them