Use of force, intervention and cyber operations

As of 1 October 2026.

This subject area concerns the rules governing how States may act towards one another, applied to operations conducted through computer networks and information channels. The starting points are the prohibition of the threat or use of force (Art. 2(4) UN Charter), the right of self-defence against an armed attack (Art. 51), the customary principle of non-intervention and the principle of sovereignty. None of these rules was drafted with cyberspace in mind; their application is developed through judgments of the International Court of Justice, UN consensus reports, national position papers and expert works. Responses to hostile cyber operations below the threshold of force – attribution, countermeasures and sanctions – form a further part of the field.

• Thresholds. Many national positions assess whether a cyber operation is a use of force or an armed attack by its “scale and effects”, a formula taken from the Nicaragua judgment. Whether operations without physical effects can reach these thresholds is not settled.
• Sovereignty. France (2019) and Germany (2021), among others, treat sovereignty as a rule that cyber operations can violate; the United Kingdom stated in 2018 that there is no such rule beyond the prohibition of intervention.
• Coercion. States differ on how the coercion element of prohibited intervention applies to operations targeting elections or to disinformation campaigns.
• Attribution. The degree of control required to attribute the conduct of non-State actors to a State is discussed with reference to the “effective control” test.

• UN Charter – prohibition of force and self-defence.
• Friendly Relations Declaration (1970) – non-intervention.
• ICJ, Nicaragua v. United States (1986) – coercion, “scale and effects”, “effective control”.
• ICJ Advisory Opinion on Nuclear Weapons (1996) – Charter rules apply regardless of the weapon.
• National positions on international law in cyberspace – published State views.
• Germany: constitutional peace provisions and cyber position – 2021 position paper.
• African Union Common Position on international law in cyberspace (2024) – regional position.
• EU cyber sanctions regime (2019) – restrictive measures after cyber-attacks.
• Tallinn Manual 2.0 (2017) – non-binding expert restatement.
• Rome Statute: crime of aggression – individual responsibility.
• Gap: protection of nuclear command, control and communications – no specific instrument.
• Encyclical Magnifica humanitas (2026) – passages on hybrid conflict, cyberspace, attribution and escalation.

• Private actors, liability and insurance – war exclusions and attribution in insurance contracts
• Armed conflict – international humanitarian law
• UN processes and institutions
• Propaganda, disinformation and elections
• Timeline · Glossary