The chapter introduces and explains some terms and concepts that are important for the understanding of the international legal questions with regard to transnational cybersecurity, such as hacking and software vulnerabilities, exploits, phishing, ransomware, or botnets. Furthermore, some basic categories like espionage, cybercrime, or cyberterrorism are laid out in order to distinguish the most prevalent forms of malicious behaviour in cyberspace and to conceptually prepare the subsequent focus on adversarial state conduct in cyberspace.

A growing number of states have started pointing to the customary doctrine of countermeasures as the most feasible unilateral remedy in the case of a malicious cyber operation carried out by an adversarial actor. Thus, the legal requirements of successfully invoking a right to resort to countermeasures are analysed in depth. In particular, the chapter deals with state policies such as 'active cyber defences' and 'hacking back' as reactions to cybersecurity incidents, and their lawfulness as countermeasures. After examining the pervasive problem of attribution in cyberspace, the states' duty to prevent malicious cyber operations emanating from their territory and the standard of due diligence in this regard are investigated. The chapter concludes with considering the invocation of countermeasures for the purpose of guarantees of non-repetition and reparation in the aftermath of a cybersecurity incident.

In light of some of the legal challenges as regards unilateral remedies to cyber operations, in large part, but not only a consequence of the attribution problem, the present study has made an attempt to modestly propose the outlines of a possible special emergency regime for cyberspace. Acknowledging that the difficulty in identifying reasonably quickly the perpetrator of malicious conduct is a function of software code and the original design of the global cyber infrastructures, and thus structural, necessity is likely to become more significant as a circumstance precluding the wrongfulness of protective state conduct. Considering the concept’s shortcomings, a newly established primary rule seems preferable.

This chapter explains how both the attribution problem and the doctrine of necessity as an emergency rule that creates an exception weaken the rule of law in cyberspace. Therefore, necessity is not capable of serving as a stable legal basis for frequently recurring incidents.

Acknowledging the difficulties of reliable and timely attribution in the immediate aftermath of a malicious cyber operation that may prevent states from invoking self-defence or countermeasures as remedies to justify protective conduct, the chapter zooms in on the customary doctrine of necessity as a circumstance precluding the wrongfulness of state conduct that does not require a responsible adversarial party. The requirements of successfully invoking necessity are analysed with regard to perilous cybersecurity incidents. In particular, it is inquired whether necessity can ever be capable of justifying the use of force by the imperilled state in order to prevent or mitigate harm. Finally, the legal consequences of invoking the doctrine are examined.

This chapter analyses the ways in which rules of current international law, based in both treaty and customary law, apply to adversarial state conduct in cyberspace. First, it is examined if and under which circumstances malicious cyber operations can amount to a prohibited use of force pursuant to Article 2(4) of the UN Charter. Both state practice and scholarly literature in this regard are closely scrutinised. Further on, the chapter zooms in on the customary principle of non-intervention and inquires how malicious conduct in cyberspace may be in violation of said principle. In particular, state practice and scholarship are consulted in order to clarify the question of what acts would qualify as 'coercion' within the meaning of the intervention doctrine. Finally, it is asked whether there exists a stand-alone rule of respect for sovereignty in international law, and if so, how a cyber operation could infringe on it.

As serious cybersecurity incidents will likely not remain isolated and rare instances in the foreseeable future, this chapter advocates for a special emergency regime for cyberspace and proposes a number of elements such a treaty should comprise. A particular focus is on the question of ex post facto factual assessment and possibilities for multilateral, neutral, and institutionalised fact-finding mechanisms. Moreover, the question of vulnerabilities equities processes is addressed.