Cyber operations as a use of force

Abstract

The provisions on the use of force contained in the UN Charter apply to cyber operations conducted by states against other states even though the rules were adopted well before the advent of cyber technologies. This chapter argues that a cyber operation is a use of armed force when it entails the use of a ‘weapon’ accompanied by a coercive intention. This occurs not only in the case of cyber attacks designed to cause physical damage to property, loss of life or injury of persons, but also of cyber attacks employing capabilities that render ineffective or unusable critical infrastructures so to cause significant disruption of essential services, even when they do not materially damage those infrastructures. Indeed, the increasing digitalization of today’s societies has made it possible to cause considerable harm to states through non-destructive means: physical infrastructures can be incapacitated by affecting their operating systems, with consequent disruption of services but without the need to destroy them. An evolutive interpretation of Article 2(4) should take this into account. On the other hand, cyber exploitation carried out to collect information may be a violation of the sovereignty of the targeted state when it entails an unauthorized intrusion into the cyber infrastructure located on its territory, but not intervention and even less a use of force, as it lacks the coercive element and does not involve the use of a destructive payload capable of resulting in physical damage to property, loss of life, injury of persons, or malfunction of infrastructure.