A wave of distributed denial-of-service (DDoS) and other attacks hit Estonian government, media, and banking websites amid political tensions over the Bronze Soldier monument. The events highlighted how cyber operations can disrupt civilian life without physical violence, pushing scholars and governments to ask when cyber harm might count as a prohibited “use of force” or an “armed attack” under jus ad bellum.
NATO nations formally established the Cooperative Cyber Defence Centre of Excellence (CCDCOE) in Tallinn. The centre became a major hub for cyber exercises, research, and legal-policy work, including projects that later shaped debates on jus ad bellum (when force may be used) and jus in bello (rules during armed conflict).
Stuxnet, discovered in June 2010, demonstrated that malware could sabotage industrial control systems, not just steal data. Because it was designed to make machines malfunction while hiding the manipulation, Stuxnet sharpened legal debates about what cyber effects might qualify as “force” or trigger self-defense, and how to apply targeting and civilian-protection rules if similar tools are used in war.
The first Tallinn Manual was published, offering “black-letter” rules and commentary on how existing international law applies to severe cyber operations, including those linked to armed conflict. While not legally binding, it became a widely used reference for evaluating proportionality, distinction (military vs. civilian targets), and when cyber effects might reach thresholds relevant to self-defense.
A UN Group of Governmental Experts (GGE) consensus report stated that international law applies to state behavior in the use of information and communications technologies. This was a key step for cyber just-war analysis because it tied cyber operations to existing jus ad bellum concepts (like sovereignty and the UN Charter) rather than treating cyberspace as legally “new territory.”
NATO’s Wales Summit Declaration stated that international law, including international humanitarian law and the UN Charter, applies in cyberspace, and that cyber defense is part of NATO’s core task of collective defense. It also noted that a cyberattack could lead to invoking Article 5 on a case-by-case basis, a practical policy development tied directly to jus ad bellum thresholds.
A later UN GGE consensus report set out voluntary, non-binding norms of responsible state behavior, such as protecting critical infrastructure and cooperating on incident response. These norms support just-war thinking by translating broad principles (necessity, precaution, and civilian protection) into practical expectations for day-to-day cyber conduct, including below the level of armed conflict.
At the Warsaw Summit, NATO recognized cyberspace as a “domain of operations,” alongside land, air, and sea. This decision pushed militaries to integrate cyber capabilities into operational planning, and it intensified legal debate about cyber operations that support kinetic campaigns—especially how jus in bello rules on proportionality and precautions apply when cyber effects are uncertain or cascading.
The WannaCry ransomware outbreak disrupted hospitals and other civilian services across many countries. Although it was criminal ransomware, its worm-like spread illustrated a key jus in bello concern: malware can be difficult to confine to intended targets, raising questions about “indiscriminate effects” and what precautions would be required if similar techniques were used in armed conflict.
NotPetya began in Ukraine and spread globally, damaging systems while masquerading as ransomware. The incident became a reference point for analyzing proportionality and foreseeability: even if an operation is aimed at one state, interconnected networks can export harm to civilians and third-country companies, complicating assessments of “excessive” collateral damage under jus in bello.
The Paris Call for Trust and Security in Cyberspace was launched as a voluntary, multi-stakeholder set of principles supported by states, companies, and civil society. It reinforced ideas important to just-war reasoning in cyberspace—such as protecting critical infrastructure and recognizing that private technology firms play major roles in prevention, response, and the practical meaning of restraint.
The UN General Assembly established an Open-Ended Working Group (OEWG) on developments in information and telecommunications in international security, open to all member states. This expanded cyber-norm negotiations beyond small expert groups, helping connect cyber practice to widely shared expectations about sovereignty, non-intervention, and limiting harm to civilians.
The International Committee of the Red Cross published a position paper on international humanitarian law (IHL) and cyber operations during armed conflict. It emphasized the real risks cyber operations pose to civilian infrastructure and urged clearer discussion of how existing rules—like distinction, proportionality, and precautions—apply in cyber contexts where effects may be indirect or delayed.
The U.S. Department of Justice unsealed charges against six officers of Russia’s GRU Unit 74455, alleging involvement in destructive malware operations including NotPetya and attacks on Ukraine’s power grid. Public attributions and legal actions like this reflect an emerging “accountability layer” around cyber conflict, supporting norms against targeting civilian critical infrastructure and shaping deterrence choices under jus ad bellum.
At its final session, the OEWG adopted a consensus report that reinforced a shared framework for responsible state behavior, building on earlier UN norms work. This helped stabilize the baseline claim that states should manage cyber risks to critical infrastructure and cooperate on incidents—ideas that mirror just-war concerns about necessity, restraint, and minimizing civilian harm even outside declared war.
The United States and the European Union announced support for the Paris Call, expanding buy-in for its multi-stakeholder principles. This step mattered for norm-building because it linked major cyber powers more clearly to shared expectations—especially protecting critical infrastructure and promoting responsible behavior—rather than relying only on informal practice or bilateral understandings.
Cyber warfare and emerging jus ad bellum/jus in bello norms (2007–present)