Abstract

Does it seem that with each reported state cyberattack, there comes an announcement of discovery, an attribution to one of a handful of usual suspects, some threatening language suggesting imminent retribution, and then nothing more? Increased incidence of cyberattack makes its occurrence seem simultaneously rampant in terms of publicity and minimal in terms of threat of war. If rampant, how can repeated deployment by the same actors carry no punitive consequences? How is such audaciousness tolerated? For some, a cyberattack by a state is an act of war. Its prevalence suggests there must be a void somewhere that facilitates its use without consequence. Others think state cyberattack is like other internet novelties: digital malfeasance, amounting to a nuisance that naturally follows from a digital‐based existence, particularly since non‐state actors are typically involved. Yet, state‐on‐state hostilities are historically perilous on a vast scale, and there is a multilateral system for regulating the use of force in the context of war. Acts of war, even when seeming minimal in impact, are not by‐products of a digital fad, and cyberattack is now described as far more than ‘nuisance’. If anywhere, the place for clarity on hostile state cyberoperations use should be accounted for in International Humanitarian Law. Yet, in its present form, it is ambiguous if not silent on the subject, suggesting that cyberattack currently presents an advantage to perpetrating states. Does this void or these ambiguities make cyberattacks more legally advantageous to states than traditional, kinetic weaponry? I examine whether existing IHL is sufficiently adaptable to state cyberoperations through a mixed legal and theoretical approach and conclude that they do.