Self-defence in cyberspace

Is self-defence against a cyber attack permitted? What about a cyber counter-attack against a conventional or cyber attack? Under Article 51 UN Charter self-defence is permitted ‘if an armed attack occurs’. Many scholars agree that a cyber attack amounts to an ‘armed attack’ when it causes harm or damage approximately comparable to a ‘kinetic’ or conventional attack and in particular when it hits ‘critical infrastructures’. Also in cyberspace, when permitted, individual or collective self-de¬fence has to meet the requirements of necessity, proportionality and immediacy. Two further major problems linked with self-defence against cyber attacks discussed in this chapter relate to the permissibility of anticipatory self-defence and self-defence against non-state actors or against the breach by a state of its duty of prevention of cross-border harmful private acts. The chapter concludes with some scepticism about the ‘use of force’ and analogy-based approaches in the literature suggesting that the law enforcement paradigm and non-forcible responses are preferable to the escalating militarization of cyberspace and noting that even when self-defence is permitted in cyberspace the necessity requirement demands of states to abide by a continuing obligation to implement passive and active electronic defences. In any case the prevailing approach serves, in addition to trying to identify reasonable rules, a twofold purpose, that is, deterring possible attacks and promoting the rules which could possibly govern major cyber attacks at the moment when they occur so as to have at that very moment the international community ‘prepared’ to share the view that the attack is indeed ‘equivalent’ to a kinetic attack which justifies a kinetic response.