Cyber Attacks as Armed Attacks? : The Right of Self-Defence When a Cyber Attack Occurs

This thesis examined the relationship between cyber operations and armed attacks to determine when the right of self-defence is triggered by cyber operations. The research question for this thesis was under what circumstances a cyber operation is considered a cyber attack and what kind of self-defence the targeted victim State can use. The thesis concluded that it is not the weaponry used, but the scale and effects of an operation that determines whether it amounts to an armed attack or not. Thus, cyber operations can be amount to armed attacks i.e., cyber attacks if the scale and effects caused by the operations are severe enough. However, the thesis concluded that there are certain challenges regarding the determination of the severity threshold of operations through cyberspace that do not exist for operations of kinetic nature. Specifically regarding whether cyber operations that cause disruption of critical infrastructure can amount to a cyber attack. The thesis concluded that it is unclear whether these kinds of effects can be comparable to the effects caused by traditional military force. However, cyber operations that result in mere economic damages do not reach the scale and effects needed to amount to cyber attacks. The thesis concluded that an imminent threat of a cyber attack triggers the right of self-defence. The meaning of imminence is ‘the last possible window of opportunity’ to repel the cyber attack, as this meaning coheres with the purpose of being able to resort to force in self-defence against an attack that has yet occurred. The issue of responsibility of non-State actors was addressed in the thesis. The essay demonstrated that the questions regarding non-State actors are even more relevant for operations carried out in cyberspace. It was concluded that although the high threshold of attribution becomes even more challenging in cyberspace, the threshold is necessary in order to maintain international peace and security. Regarding independent non-State actors, it was concluded that State practice has shown acceptance of resorting to force against non-State actors without attribution to the territorial State. To balance opposed interests, this thesis concluded that the doctrine of unwilling and unable should be followed when a victim State considers resorting to force against a non-State actor. Regarding the principles of necessity and proportionality, this thesis could conclude that the means used against a cyber attack, whether kinetic or cyber, are not vital to determine whether the self-defence used is legal or not. Instead, force used in self-defence used must be a means of last resort and cannot exceed the force needed to repel the attack.