Cyber Warfare And The UN Charter - Rethinking The Use Of Force In The Digital Age
Author: LawSphereX
Category: Technology, Cyber & Privacy
Published:
Updated:
CYBER WARFARE AND THE UN CHARTER: RETHINKING
THE USE OF FORCE IN THE DIGITAL AGE Mr. Swaraj Jitendra Kadam, B.A. LL.B., Bharati Vidyapeeth's Yashwantrao Chavan Law College, Karad
ABSTRACT
The increased use of cyberspace as a place for conflict has created major issues for international law. Unlike traditional armed force, cyber actions frequently take place without physical harm, but they can still severely damage key infrastructure, upset government operations, and put people in danger. The UN Charter, 1945, is still the main structure that controls the ban on force and the right to self-defense under Articles 2(4) & Article 51. But, how it relates to cyber warfare is still not clear. This paper looks at if major cyber attacks can be seen as a use of force or even as an armed attack as defined by the Charter. It studies how state actions, rulings from the International Court of Justice, and academic work like the Tallinn Manual have tried to explain these rules based on current cyber threats. Issues like the Stuxnet incident and Russian cyber actions against Ukraine, are used to show the unclear differences between spying, coercion, and warfare. The paper also looks into the problems of figuring out who is responsible, making sure responses are appropriate, and collective self-defense in cyberspace. It also considers the small role the UN Security Council has in dealing with cyber conflicts. In the end, it claims that though the Charter offers a basic legal structure, its lack of clarity could harm international peace and security in the digital age. The conclusion says that either a reliable reinterpretation of current rules or negotiating a specific international cyber law tool is needed to make sure there is clarity and responsibility in this changing area. Keywords: Cyber Attacks, UN Charter, Digital, International Law, Cyberspace
1 INTRODUCTION
Cyberspace is now a key place for global communication and conflict in the twenty-first century. Countries use cyber abilities to protect themselves and to attack others. This makes it hard to know if an action is spying, sabotage, or war. Attacks on important systems, like power plants and banks, show that cyber actions can be as bad as normal war. Because of this, legal experts must think about if current laws can handle these new dangers. The United Nations Charter, created in 1945 after World War II, is the main law for countries about using force. Article 2(4) says countries cannot use force against each other. Article 51 says countries can defend themselves if they are attacked. These rules were made for normal war, but it is not clear if they apply to cyber actions. Because cyberspace is not mentioned, it is hard to know if cyber attacks that do not cause physical harm count as “force” or “armed attacks” under the Charter. Cyber events, such as Stuxnet against Iran, the 2007 attacks on Estonia, and alleged Russian actions against Ukraine, show how damaging digital war can be. Still, there is no agreement if these actions allow a country to defend itself. The Tallinn Manual 2.0, a study by NATO, gives useful advice, but it is not a real law. The International Court of Justice (ICJ) has talked about what “use of force” and “armed attack” mean in cases like Nicaragua v. United States, but it has not looked at cyber issues directly. This paper will study how the UN Charter applies to cyber war, focusing on Articles 2(4) and 51. It will ask if cyber attacks that do not destroy things can still be seen as illegal uses of force, and when they might allow a country to defend itself. The paper will also look at how to identify attackers, how to make sure responses are fair, and what role the United Nations Security Council has in cyber threats. By looking at what countries do, what the ICJ has said, and what experts think, this paper wants to define the unclear legal issues and suggest how to fix them. The main question is whether the UN Charter, which was made for normal war, can control cyber conflicts, or if we need a new law. The answer will greatly change how we keep peace and security in the digital world.
2 THE UN CHARTER FRAMEWORK ON THE USE OF FORCE
2.1. Article 2(4) - The Prohibition of Force:-
Article 2(4) of the UN Charter States the fundamental principles of international law. It prohibition of the use of force against the territorial integrity or political independence of any state. Drafted in the immediate aftermath of the Second World War, this provision was intended to outlaw aggressive war and to secure the maintenance of peace by outlawing coercion through military means. The International Court of Justice (ICJ), in cases such as Nicaragua v. United States (1986), has emphasised that this prohibition is both broad and customary in nature, binding upon all states. The difficulty, however, lies in determining whether “force” must necessarily involve military or kinetic action. Traditionally, the understanding was confined to armed force involving physical violence. The modern interpretations, questions whether economic coercion, political interference, and now cyber operations fall within the ambit of Article 2(4). The drafting history of the Charter can give a clarity as the cyber warfare was unimaginable in 1945. Thus, states and scholars have turned to analogical reasoning and case law to fill this gap.
2.2. Article 51 - The Right to Self-Defense :-
Article 51 of the Charter says that nothing in the Charter shall impair the inherent right of individual or collective self-defense in the event of an armed attack. The provision recognises that states may use force unilaterally to defend themselves until the Security Council takes necessary measures to restore peace. The ICJ, in the Nicaragua case has distinguished between the “use of force” and “armed attack,” by stating that not every use of force qualifies as an armed attack justifying selfdefense. Only grave uses of force such as large-scale invasions and;or bombings, trigger Article
51. This distinction is critical for cyber warfare, while some cyber operations may disrupt
networks or steal data (use of force), others, like disabling hospitals or power grids, could arguably rise to the level of armed attacks.
2.3. Role of the UN Security Council :-
The Charter envisages the Security Council as the primary body responsible for maintaining international peace and security (Articles 24 and 39). In theory, cyber attacks threatening peace should fall within its mandate. However, political divisions among permanent members often result in inaction. For example, despite growing recognition of cyber security as a global issue, the Council has adopted only limited resolutions, often framed in terms of counter-terrorism rather than interstate cyber conflicts. The Council’s limited role creates a vacuum and states are left to interpret Articles 2(4) and 51 themselves, potentially leading to unilateral and inconsistent responses. This lack of authoritative guidance further complicates the development of customary law in cyberspace.
2.4. Jurisprudence of the ICJ :-
Although the ICJ has not yet dealt directly with cyber warfare, its jurisprudence on the use of force provides a useful foundation. In Nuclear Weapons Advisory Opinion (1996), the Court reaffirmed that any use of force, regardless of weapon, must comply with the principles of necessity and proportionality. Similarly, in Oil Platforms (2003), the Court stressed the importance of proving both the scale and effect of an attack to justify self-defense. These precedents suggest that the Court would likely adopt a functional approach to cyber warfare, if the consequences of a cyber operation are equivalent to those of a conventional armed attack, then it could trigger the application of Article 51. However, without explicit judicial recognition, uncertainty remains.
3. CYBER WARFARE AND THE
CHALLENGE
OF CLASSIFICATION :
3.1 Defining Cyber Warfare :-
Unlike older armed conflicts, there’s no accepted definition of cyber warfare. Generally, it means hostile actions done through digital methods by countries or groups backed by countries. The goal is to hurt another country’s power, security, or systems. Experts usually say it's different from normal cybercrime or spying, which usually involves private people or reasons that aren't related to countries. Cyber warfare usually involves political actions that countries do. This lack of a clear legal definition makes it hard to use the UN Charter. For example, is shutting down a country’s banking system just a problem or a type of “force”? Is stealing military secrets spying (legal under worldwide law) or getting ready for war? These questions show the unclear area of what defines cyber warfare.
3.2 Spectrum of Cyber Operations :-
Cyber activities happen in a wide range - i. Low-level actions : changing websites, spreading wrong information. ii. Mid-level operations : cyber espionage, stealing data, messing with elections. iii. High-level operations : turning off important systems (power, airports, hospitals), destroying military setups. Only the last type might be seen as “use of force” under Article 2(4). But, the differences aren't clear. Messing with a financial system at the right time might hurt a country more than a small missile attack.
3.3 The Attribution Problem :-
Another big problem is attribution which means knowing which country is behind a cyber attack. Cyber actions are often done through others, fake online trails, or servers in other countries. International law says a country has to be responsible before actions can be taken against it. But, it’s hard to prove who's behind an attack, so countries don't want to respond with military actions. They fear about the things will get worse if they don't have clear proof. For example, during the 2007 cyber attacks on Estonia, which many thought were from Russia, Estonia had trouble proving Russia was directly responsible, which limited what it could legally do. Also, the US said Russia was linked to the Solar Winds hack (2020), but it was treated as spying, not war, partly because who was behind it was still questioned.
3.4 Case Studies :-
(a) Stuxnet (2010) - The Stuxnet worm, which some say was created by the US and Israel, attacked Iranian nuclear equipment, causing physical damage to Iran’s Natanz plant. Experts argue if this was a “use of force.” No one died, but it caused destruction like sabotage. Many think it was the first real act of cyber warfare by a country. (b) Georgia (2008) and Ukraine (2014, 2022) - In these conflicts, cyber actions happened with normal military actions. Russian hackers stopped communications, messed up government websites, and attacked power systems in Ukraine. These actions showed how modern conflict is mixed, with cyber attacks used with physical attacks. The question is if cyber actions alone, without bombs or soldiers, would be seen as force under the Charter. (c) Solar Winds Attack (2020) - This complicated hack got into US government and business networks, taking lots of data. Even though it was big, it was seen as spying instead of a “use of force” because it didn't cause direct physical harm. This shows how hard it is to make legal rules in cyberspace: stealing lots of data can hurt national security but doesn't easily fit into Article 2(4)’s rules.
3.5 Espionage, Crime, or Warfare ?
In the past, world law allows spying, even if countries don't like it. Cyber spying is often seen as unfriendly but legal. But, cybercrime, like ransomware attacks or stealing private data, is usually blamed on people who aren't part of a country and is controlled by local or regional rules (like the Budapest Convention on Cybercrime). Cyber warfare, though, involves actions led by countries to meet goals through force. Because these types aren't clearly different, it's hard for countries to know when an action is “force” under Article 2(4).
3.6 Emerging Scholarly and State Views :-
The Tallinn Manual 2.0 says cyber actions that cause death, injury, or big destruction of property should be seen as force. Some experts say the seriousness and size of the results, not how they're done, should decide how they're classified. Countries like the US and UK believe strong cyber attacks can be armed attacks under Article 51, but Russia and China don't agree, and prefer to focus on power and information control.
4 ARTICLE 2(4) AND CYBER ACTIONS
4.1 Defining Force in the Digital Age :-
Article 2(4) of the UN Charter is central to international law, as it forbids using force against a state's territorial integrity or political independence. Traditionally, this rule applied to physical, military actions. Now that cyberspace is a battle space, it's hard to say if this rule applies to actions without bombs or soldiers. The main question is whether cyber actions using code— not weapons—count as a use of force under Article 2(4). Examples could include shutting down a country's power, controlling air traffic, or putting bad code into military systems. Legal and policy minds disagree on this. Some think force should only mean actions causing physical harm. Others want a wider, results-based view. They say if a cyber action has the same impact as a military attack, it's a use of force, no matter the tool. The International Court of Justice (ICJ) seems to agree, focusing on results over tools (see the Nuclear Weapons Advisory Opinion, 1996).
4.2 The Spectrum of Cyber Harm
From Bits to Bricks :- We can look at cyber actions by whether they cause physical damage or just digital issues - i. Physical Harm : Cyber actions causing physical damage are easy to classify. Stuxnet, which hurt Iranian nuclear centrifuges, is a good example. Because it caused physical destruction, it's seen as a use of force. ii. Non-Physical Disruption : It gets tricky with cyber actions that don't cause physical harm but could destabilize a country. This could include shutting down a country's banks or election systems, or hurting its communications. These actions might not break things or hurt people, but they can have big political and economic effects. Consider the 2007 cyber attacks on Estonia, which stopped banking and government services. They were disruptive but caused no physical damage. Were these attacks a use of force under Article 2(4)? The Tallinn Manual 2.0, a study on international law in cyberspace, says cyber actions with serious consequences can be a use of force, even without physical damage. This might include actions that greatly reduce important infrastructure. But this is debated, with states disagreeing on what counts as a use of force in cyberspace.
4.3 Economic Coercion and Political Interference Through Cyber Means :-
Article 2(4) bans using force against a state’s political independence, not just its territory. So, could cyber actions that affect a state's elections be a use of force? The alleged Russian meddling in the 2016 US elections has caused discussion on whether manipulating elections through cyber means breaks Article 2(4). International law usually sees economic coercion and political interference as outside the use of force, though they may break the rule of non-intervention. Some say defining force too broadly could limit states' actions. But because election manipulation through cyberspace is serious, some experts think certain cyber actions should be a use of force, especially when they hurt a state's political independence.
4.4 The Tallinn Manual and Scholarly Views :-
The Tallinn Manual 2.0 (2017) helps us understand how international law applies to cyber actions. Experts wrote it, and it's seen as the best study on the topic, even though it's nonbinding. The manual says - - Cyber actions causing death, injury, or major physical damage are clearly a use of force. - Cyber actions causing major non-physical effects, like economic collapse, can also be a use of force, depending on how bad the results are and the actor's intent. - Data theft or propaganda usually isn't a use of force. The Tallinn Manual has shaped the debate on international law in cyberspace. Some states, like the US and UK, cite it to say serious cyber attacks can be a use of force. Others, like Russia and China, take a stricter view, focusing on sovereignty and information security.
4.5 Diverse State Positions on Cyber Warfare :-
States disagree on when a cyber action is a use of force under international law - - United States : The US thinks some cyber actions can be a use of force or even an armed attack if their effects are very bad. - United Kingdom : The UK agrees, saying cyber actions can give a state the right to selfdefense under Article 51 of the UN Charter. - Russia & China : Russia and China want a smaller view of use of force and don't want to call cyber attacks military action. They care about information sovereignty and want treaties to control information in cyberspace. - India : India's view is still forming. It sees cyber security as important but hasn't, if it thinks cyber attacks should be a use of force under the UN Charter. India likes to talk about cyber security in groups like the UN Open-Ended Working Group (OEWG) instead of making its own rules. - European Union / NATO : NATO says cyber attacks can trigger collective defense under Article 5 of the NATO treaty. This means NATO members generally think cyber actions can be a use of force in some cases.
4.6 Gauging the Line - Defining the Cyber Force Threshold :-
Because there's no agreement on when a cyber action becomes a use of force, it's a big issue in international law. But some things are often used to decide: i. Severity of Consequences : How much harm did the cyber action cause? ii. Directness : Did the cyber action directly cause the harm, or were other things involved? iii. Military Nature : Did the cyber action look like a military attack in its goals? Using these ideas, Stuxnet would likely be a use of force because of the physical damage. Something like the Solar Winds spying, which mainly stole data, probably wouldn't be.
5 ARTICLE 51 AND THE RIGHT TO SELF-DEFENSE
5.1. Armed Attack in the UN Charter :-
Article 51 of the UN Charter says that countries have the right to defend themselves if they are attacked. A key question is whether computer attacks can count as an armed attack. In the Nicaragua v. United States (1986) case, the ICJ said there's a difference between just using force and an actual armed attack. Only an armed attack justifies self-defense. In the Oil Platforms (2003) case, the court wanted to see proof of how big and bad an event was before calling it an armed attack.
So, according to the ICJ, not all computer operations that involve using force are serious enough to be called an armed attack. The problem is that some computer attacks don't destroy anything physically but still badly hurt a country's security. If a country's air defense system is shut down by a computer attack, it could be as bad as if it were physically destroyed. Should this be seen as an armed attack?
5.2. Criteria of Necessity, Proportionality, and Immediacy :-
If a computer operation is considered an armed attack, any response needs to follow international law : Necessity : A computer or military response has to be the only way to stop the attack. Proportionality : The response has to be in proportion to the damage done. It would be against the law to respond to someone changing a website with missile strikes. Immediacy : Self-defense needs to happen quickly. Computer attacks raise questions about when they are noticed. Can a country still take action weeks or months later? These rules are hard to follow in computer space because it takes time to find out who is behind attacks, and it's not always easy to measure what a proportional response would be.
5.3. Examples of Self-Defense Claims in Cyberspace :-
United States : In 2011, the US said it has the right to respond to computer attacks with anything, including military force. This is a broad way of understanding Article 51. NATO (2014 onwards) : NATO has said that computer attacks could trigger a collective defense. This means if one member is seriously attacked by computer, all members might respond with military force. Israel : Israel said it used military strikes in self-defense after computer attacks that were supposedly started by people connected to Hamas. This shows they are willing to use Article
51 in computer space.
Iran (after Stuxnet) : Iran said that Stuxnet violated its rights but didn't actually use Article 51.
This shows they didn't want to make things worse.
5.4. Collective Self-Defense in Cyberspace :-
Article 51 also talks about collective self-defense. Computer incidents create special problems here - NATO's view that computer attacks could be armed attacks makes collective defense more important. However, it's hard to figure out who is behind attacks as a group. All allies need to be sure about where the attack came from and how bad it was before using Article 5. In 2017, NATO said that computer operations are just as important as land, sea, and air operations. This means computer attacks could cause the alliance to respond.
5.5. Preventive and Anticipatory Self-Defense :-
It's controversial whether countries can respond to computer attacks before they actually happen. Because computer operations are so fast, some say it's not practical to wait until the damage is already done. The Caroline case (1837) said that anticipatory self-defense is okay only if the threat is instant, overwhelming, leaving no choice of means, and no moment for deliberation.” If we use this in computer space, if intelligence shows that a computer attack on a power grid is about to happen, should a country be allowed to stop the threat before it happens? The US has sometimes said that taking computer measures in advance is okay, but this is still debated under international law. Some worry that it could be used as an excuse for aggression.
5.6. State Practice and Diverging Views :-
Broad Views (US, UK, NATO) : Computer attacks can be seen as armed attacks if they are as damaging as physical force. Narrow Views (Russia, China) : They want to define things narrowly because they worry that broad ideas could justify Western countries interfering. They think information sovereignty is important and want treaties about information security instead of self-defense rights.
Neutral/Changing Views (India, many developing countries) : They are careful about calling computer attacks armed attacks. India, for example, is okay with talking about it in UN meetings but hasn't said if it would use Article 51 for computer operations.
5.7. Evaluating the Adequacy of Article 51 :-
Because there's no agreement, it's hard to know what to expect under international law. Some key problems are: i. Unclear Threshold : When does disrupting services become an armed attack? ii. Figuring Out Who Did It : If there's no clear evidence, using self-defense could make things worse. iii. Proportionality in Computer Space : What is a legal and proportional way to respond to a computer attack? Computer countermeasures? Physical retaliation? iv. Collective Defense : Alliances like NATO need to agree on what the thresholds are, but this isn't accepted everywhere.
6 ROLE OF THE UN SECURITY COUNCIL AND STATE PRACTICE
6.1. Mandate of the UN Security Council :-
The UN Charter gives the Security Council (UNSC) the main job of keeping international peace and security (Article 24). Article 39 says the UNSC can decide if there's a threat to peace, a breach of peace, or an act of aggression. Based on this, it can suggest or decide on what actions to take, like sanctions or military force. Big cyber operations that could destabilize a country or area should fit into this system. The UNSC has been careful when dealing with cyber issues. It usually doesn't call cyber attacks threats to peace. This is because there's no clear definition of what counts as a cyber attack and the five permanent members (P5) don't agree on this. This is different from how it deals with terrorism and nuclear weapons, where it has made stronger rules.
6.2. UNSC Engagement with Cyber Threats :-
The Council hasn't made specific rules about state-sponsored cyber warfare, but it has dealt with cyber security in other ways - i. Resolution 2341 (2017) : This said we need to protect important infrastructure from terrorist threats, including cyber ones. ii. Counter-terrorism resolutions (e.g., 1373, 2178) : These told countries to make stronger laws against terrorists using cyberspace. Still, they didn't deal with cyber conflicts between countries. iii. Thematic discussions (2017, 2021, 2022) : During these meetings, Council members saw that cyber activities could lead to conflict, but they couldn't agree on what to do about it. This shows that the Council doesn't want to use its power in cyberspace unless the P5 all agree.
6.3. Political Divisions among Permanent Members :-
- United States, UK, France : These countries mostly think big cyber attacks should be seen as threats to peace. They say Articles 2(4) and 51 apply to cyberspace. - Russia and China : These countries don't think so. They worry that this could be used as an excuse for Western countries to interfere. They think cyber issues should be about information security and want international agreements that focus on controlling information. These disagreements stop the UNSC from making rules about cyber warfare.
6.4. State Practice Outside the UNSC :-
Since the UNSC isn't taking strong action, what individual countries do is becoming important in shaping international law: - United States : Its 2011 cyberspace policy says countries have the right to defend themselves against cyber attacks. But, in reality (e.g., Solar Winds, 2020), the U.S. often prefers sanctions to using Article 51. - NATO/EU : NATO has said cyberspace is a place where operations can happen (2016) and that cyber attacks could trigger collective defense. The EU has put cyber sanctions on Russia, China, and North Korea.
- Russia and China : These countries want UN agreements that focus on controlling and preventing information warfare. They don't think cyber attacks are acts of armed aggression under Article 51. - India : It takes part in things like the UN OEWG and says we need international cooperation against cybercrime. India hasn't officially said cyber operations are a reason for self-defense. It knows the dangers of cyber warfare though.
6.5. Fragmentation and Risks of Divergence :-
Disagreements between big powers are creating confusion - Western countries (US, UK, NATO allies) want the UN Charter to apply to cyberspace. Russia and China want new rules about controlling information. Many countries, including India, are being careful. They want to protect themselves from cyber threats, but also worry about powerful countries interfering. This division leads to two risks - i. Over-expansion : Small incidents could be seen as big crises, leading to responses that are too strong. ii. Under-inclusion : Big cyber attacks might not be covered by international law.
6.6. Security Council’s Missed Opportunity :-
The UNSC's lack of action is causing problems. Since the Council isn't leading, countries will come up with their own ideas about what Articles 2(4) and 51 mean, which could cause disagreements. One country's claim of self-defense in cyberspace could be seen as aggression by another. To make things more stable, the UNSC could - i. Make it clear that big cyber attacks on important infrastructure can be threats to peace. ii. Create ways to figure out who is behind cyber incidents, to reduce disputes. iii. Encourage cooperation on things like sanctions and helping victims.
Until the Security Council takes action, cyber law will keep being shaped by what countries do and by non-state efforts like the Tallinn Manual, instead of by the UN itself.
7 EVOLVING STRATEGIES AND FUTURE DIRECTIONS
7.1. The Tallinn Manual 2.0 and Its Relevance :-
The Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations (2017) is still the most quoted non-binding study in this area. A group of experts working with the NATO Cooperative Cyber Defence Centre put it together. It looks at how current international law applies to cyberspace. i. Main points - International law, including the UN Charter, is relevant to cyber actions. Cyber actions that lead to death, injury, or damage to property are clearly a use of force. Big non-physical results (like long-term shut down of power grids or air traffic control) might be seen as force, depending on how bad they are and what the intent was. Not all cyber break-ins (like spying or stealing data) are covered by Article 2(4). ii. Limits - It mainly shows Western legal thinking. It is not binding, so countries do not have to follow it. Russia, China, and some others disagree with its authority and want broader input. But, the Tallinn Manual is used in state actions, academic talk, and even military rules.
7.2 The UN Group of Governmental Experts (GGE) :-
The UN has set up several GGEs (2004, 2013, 2015, 2017, 2021) to study cyber security -
2013 Report
It was first to say that international law, including the UN Charter, is relevant to cyberspace.
2015 Report
It stressed state power, non-interference, and the need to be careful. It also listed voluntary rules for how countries should act.
2017 GGE
It could not agree because of disagreements on if the Charter’s self-defense rules (Article 51) apply to cyber attacks.
2021 GGE
It restated that international law is relevant but was unclear on what things mean.
The GGE shows the disagreement in politics: Western countries want to apply the Charter directly, while Russia and China would rather have new legal structures.
7.3 The UN Open-Ended Working Group (OEWG) :-
The OEWG, unlike the limited GGE, includes all UN members and has turned into a key place for discussion - Its 2021 report said that international law is relevant in cyberspace. It stressed steps to build trust, working together, and helping developing countries grow their skills. It did not set clear lines for use of force or armed attack, showing a lack of agreement. The OEWG keeps working to grow common understanding instead of binding law.
7.4 Is a Binding Cyber Treaty Needed?
People are talking more about if the world needs a special international cyber war treaty. i. Arguments for it - The UN Charter was written in 1945, before cyber risks existed. Unclear areas cause instability and the risk of things getting worse. A treaty could explain clear lines, how to assign responsibility, and rules for accountability. ii. Arguments against it - It would be hard to get agreement from big powers (US, Russia, China, EU). Fast tech changes might make treaty rules old fast. There is a risk of weak rules that do little to control behavior. For now, there is no binding treaty. Instead, soft law and state actions are what matters most.
7.5 Rewording the UN Charter for Cyberspace :-
Another way is to rework the Charter’s rules based on cyber risks, instead of writing new law. Article 2(4) could be read to include cyber actions that cause big problems, even without physical harm. Article 51 could be used when cyber attacks have results like armed attacks. The Security Council could, over time, create binding rules through what it does. This slow way avoids treaty problems but leaves many things unclear.
7.6. Ideas for Changes and the Way Forward :-
i. Be clear on lines : Countries should agree that cyber actions causing widespread, strategic damage (to infrastructure, defense, or public safety) are a use of force. ii. Responsibility systems : Set up separate, global cyber responsibility groups to lower arguments. iii. Trust-building steps : Grow working together through regional groups (like ASEAN, SCO, EU). iv. Skill-building : Help developing countries with cyber defense to avoid unfairness in how things are enforced. v. Mix ways : Combine reworking the UN Charter with slowly creating a special cyber treaty.
7.7 Future View :-
Cyber rules will likely come from many places - Customary international law will grow from what countries do. The UN will keep talking through the OEWG and future GGEs. Regional and group-based structures (NATO, EU, SCO) will try out rules. Academic work like the Tallinn Manual will shape agreement in thought. The challenge is to make sure this mix does not cause separation but slowly comes together into accepted rules.
8 CONCLUSION
The advance of cyber warfare has created fresh issues for the existing international legal system, which is based on the UN Charter. Articles 2(4) and 51, created in 1945 for traditional armed conflict, are still key when we talk about the use of force and the right to self-defense. But when we try to use these rules in cyberspace, things get unclear. Cyber actions that cause big problems without physical harm show the limits of a system that was first made for physical warfare. The International Court of Justice's past decisions, like in the Nicaragua and Oil Platforms cases, give helpful advice by focusing on scale, impact, and whether the response is appropriate. But they don't directly talk about the special parts of cyber actions, like harm that isn't physical, problems with figuring out who did it, and delays in finding it. What countries actually do is also varied. The United States, the United Kingdom, and NATO think very bad cyber attacks could be seen as armed attacks, but Russia and China disagree, stressing their control over their own affairs and information. India and other growing countries are careful, wanting a wider agreement among many countries. The Security Council, even though it's very important, hasn't made things clearer, mostly because the main countries can't agree. Because of this, legal progress in this area has come more from unofficial rules, like the Tallinn Manual, and non-binding UN work like the GGE and OEWG, instead of official agreements between countries.
Looking ahead, there are two options. One is to work out a special cyber treaty, but that's not likely to happen soon because of political issues. The other is to slowly change how we read the Charter based on what's happening in cyber, supported by what countries do, advice from experts, and ways to work together to find out who's behind attacks and build skills. In the end, the UN Charter is still able to handle new dangers, but we need to change how we read its rules to make sure they still matter. If things aren't clearer, there's a real risk of countries reacting to cyber incidents in ways that don't match or are just done by themselves, which could make things worse and more unstable. The job for the world community is to bridge the differences in beliefs, get agreement, and change the Charter's rules so they still do what they're supposed to: keep peace and security in the world in a digital time.
REFERENCE :
A. International Court of Justice (ICJ) Cases
1. Military and Paramilitary Activities in and against Nicaragua (Nicaragua v. United States of
America), Judgment, 1986 I.C.J. 14 (June 27).
2. Oil Platforms (Islamic Republic of Iran v. United States of America), Judgment, 2003 I.C.J.
161 (Nov. 6).
3. Legality of the Threat or Use of Nuclear Weapons, Advisory Opinion, 1996 I.C.J. 226 (July
8).
4. Armed Activities on the Territory of the Congo (Democratic Republic of the Congo v.
Uganda), Judgment, 2005 I.C.J. 168 (Dec. 19). B. United Nations Documents
5. U.N. Charter arts. 2(4), 39, 51.
6. G.A. Res. 68/243, Developments in the Field of Information and Telecommunications in the
Context of International Security (Dec. 27, 2013).
7. G.A. Res. 70/237, Report of the Group of Governmental Experts on Developments in the
Field of Information and Telecommunications in the Context of International Security (Dec. 23, 2015).
8. G.A. Res. 75/240, Advancing Responsible State Behaviour in Cyberspace in the Context of
International Security (Dec. 31, 2020).
9. S.C. Res. 2341, U.N. Doc. S/RES/2341 (Feb. 13, 2017).
C. National / Regional Policy Documents
10 White House, International Strategy for Cyberspace
Prosperity, Security, and Openness in a Networked World (May 2011).
11. North Atlantic Treaty Organization [NATO], Cyber Defence Pledge (Warsaw Summit, July
2016).
12. European Union, Council Decision (CFSP) 2019/797, Concerning Restrictive Measures
Against Cyber-Attacks Threatening the Union or its Member States, 2019 O.J. (L 129) 13. D. Scholarly Works / Soft Law
13. TALLINN MANUAL 2.0 ON THE INTERNATIONAL LAW APPLICABLE TO CYBER
OPERATIONS (Michael N. Schmitt ed., Cambridge Univ. Press 2017).
14. Kristen E. Eichensehr, The Law & Politics of Cyber attack Attribution, 67 UCLA L. REV.
520 (2020).
15. Michael N. Schmitt, “Grey Zones” in the International Law of Cyberspace, 42 YALE J.
INT’L L. ONLINE 1 (2017).