The purpose of this chapter is to set forth rules of a general international legal nature detailing the relationship between States, cyber infrastructure, and cyber operations. Section 1 addresses issues relating to State sovereignty, jurisdiction, and control over cyber infrastructure. Section 2 deals with the application of classic public international law rules of State responsibility to cyber operations.

Terminology is essential to an accurate understanding of this chapter. ‘Cyber infrastructure’ refers to the communications, storage, and computing resources upon which information systems operate (Glossary). To the extent States can exercise control over cyber infrastructure, they shoulder certain rights and obligations as a matter of international law. The term ‘cyber operations’ refers to the employment of cyber capabilities with the primary purpose of achieving objectives in or by the use of cyberspace (Glossary). Under international law, States may be responsible for cyber operations that their organs conduct or that are otherwise attributable to them by virtue of the law of State responsibility. The actions of non-State actors may also sometimes be attributed to States.

Except when explicitly noted otherwise, the Rules and Commentary of this chapter apply both in times of peace and in times of armed conflict (whether international or non-international in nature). During an international armed conflict, the law of neutrality also governs the rights and obligations of States with regard to cyber infrastructure and operations (Chapter 7).