The law of neutrality applies only during international armed conflict. It is based on Hague Conventions V and XIII and customary international law. The International Group of Experts unanimously agreed that the law of neutrality applied to cyber operations.

‘Neutral State’ denotes a State that is not a party to the international armed conflict in question. For the purposes of this Manual, ‘neutral cyber infrastructure’ means public or private cyber infrastructure that is located within neutral territory (including civilian cyber infrastructure owned by a party to the conflict or nationals of that party) or that has the nationality of a neutral State (and is located outside belligerent territory). ‘Neutral territory’ comprises the land territory of neutral States, as well as waters subject to their territorial sovereignty (internal waters, territorial sea and, where applicable, archipelagic waters) and the airspace above those areas.

The law of neutrality regulates the relationship between the parties to an international armed conflict on the one hand and States that are not party to the conflict on the other. Its key purposes are to (i) protect neutral States and their citizens against the conflict’s harmful effects; (ii) safeguard neutral rights, such as engaging in commerce on the high seas; and (iii) protect parties to the conflict against action or inaction on the part of neutral States that benefits their enemy. The global distribution of cyber assets and activities, as well as global dependency on cyber infrastructure, means that cyber operations of the parties to a conflict can easily affect private or public neutral cyber infrastructure.