Cyber Governance and the Recoding of International Law

Think for a moment: which rules form the core of international law’s operating system? Before attempting an answer, it is worth pausing to consider what an operating system is in the first place. In computing, an operating system is the foundational layer of software that renders all other functions intelligible and executable. It allocates resources, provides essential protocols for communication, and sets the permissions that govern what actions different users can perform. In this sense, the operating system provides the logic and architecture that underpins all computational activity.Footnote ¹

To ask what constitutes the operating system of international law is to ask: what are the foundational structures that allow international law to function as a coherent order? Which doctrines govern how states interact and how legal rules are created and enforced? And under what conditions is legal meaning generated and applied across the international system?

One could start with the familiar first-order content. These include your classic prohibitions: the prohibition on the threat or use of force; the prohibition on coercive intervention; the prohibitions on genocide, crimes against humanity, war crimes, piracy, torture, enforced disappearance, slavery, the slave trade, human trafficking, and terrorism. Next are the foundational principles that animate and shape the legal order: the principle of self-determination; the principle of the sovereign equality of states; the principle of good faith in the performance of legal obligations; the principle of territorial integrity; and the principle of non-discrimination. Then follow the essential obligations that structure legal relations across domains: the obligation of pacta sunt servanda; the obligation to cooperate in accordance with the Charter of the United Nations; the obligation to resolve disputes peacefully; the obligation to respect diplomatic and consular inviolability and immunities; the obligation to protect the environment; and the dual obligations to respect and to ensure the protection of fundamental human rights and the rules of international humanitarian law. Finally there are inherent rights: the right to individual and collective self-defense; the right to conclude treaties and join international organizations; the right to claim and administer maritime zones and airspace; the right to exercise jurisdiction over territory and persons; the right to confer nationality and grant or withhold recognition.

But international law, like an operating system, also rests on a deeper layer of secondary rules—rules about how rules come into being, how they change, how they are identified and interpreted, and how they are enforced. These include the law of sources: which covers source identification and source interpretation, and can be found in the law of treaties, the law of custom, the law of unilateral declarations, and the law of general principles. It also includes rules for conflict resolution when sources inevitably clash (like the intertemporality rule, or the principle that lex specialis derogat legi generali). Another category of relevant rules are those encompassed in the law of standing, enforcement, and remedies: the doctrine of erga omnes; the doctrine of jus cogens; the doctrine of intervention before international courts; the law of attribution; the law of countermeasures; the law of due diligence; and the law of affirmative defenses (more commonly known as “circumstances precluding wrongfulness”). Finally, we may include the emerging law of evidence: procedural doctrines of inference, presumption, estoppel, and acquiesce; rules on the admissibility and weight of evidence before judicial bodies; and rules concerning the burden and standard of proof.

Together, this complex web of primary and secondary rules constitutes international law’s operating system. Like any such system, it requires technicians to manage, debug, and occasionally reprogram it. In international law, that role falls to practitioners (judges, private counsel, government legal advisors, civil society lawyers) and academics. They are the system’s developers and maintainers, tasked with preserving coherence while enabling responsiveness to new tasks and demands. They form what Oscar Schachter once called “The Invisible College of International Lawyers.”Footnote ²

And yet members of the College, have often treated cyber law as an esoteric and siloed domain—a specialized niche reserved for technologists and national security experts concerned with ransomware, denial-of-service attacks, or zero-day exploits. That perception is a mistake. Cyber is not a compartmentalized subfield. It is a destabilizing force—a generator of legal glitches that expose structural vulnerabilities within international law’s operating system further disrupting its core architecture.

At the level of primary rules, cyber operations are steadily redrawing the contours of longstanding prohibitions, principles, obligations, and rights within international law:

• Cyberattacks on critical infrastructure during peacetime test the definitional boundary of the prohibition on the use of force, particularly where physical kinetic harms are absent.

• Disinformation campaigns targeting electoral processes engage the doctrine of non-intervention, pressing on the distinction between coercive and non-coercive interference within the domaine réservé of states.

• The ubiquity of cyber espionage erodes the principles of territorial integrity and political independence by questioning whether non-consensual intrusions into communication networks located in foreign territory could ever rise to the level of a sovereignty violation.

• Transnational digital surveillance programs push the outer limits of the doctrine of extraterritoriality in the application of international human rights law, since the surveilling state lacks effective control over both the territory and person being surveilled.

• The rise of cyber-enabled international crimes, including coordinated ransomware operations and online incitement to Genocide, is forcing a doctrinal reconsideration of the material and contextual elements of crimes under the Rome Statute.

• Indigenous and marginalized communities are asserting claims to digital self-determination, demanding legal recognition of cultural autonomy, data sovereignty, and control over identity in cyberspace, in ways that force a reexamination of the values inherent in such concepts as peoplehood and indigeneity.

• Transborder cyber forensic investigations conducted without host state consent test the limits of the prohibition on extraterritorial enforcement jurisdiction, particularly where digital evidence is exfiltrated directly from foreign servers.

At the level of secondary rules, cyber operations are recoding how international law is sourced, interpreted, applied, and enforced:

• As cyber operations are routinely conducted covertly and cloaked in layers of plausible deniability, serious questions arise as to whether such practice can meaningfully contribute to the formation of customary international law.

• The growing reliance of states on cyber proxies, including private cybersecurity firms, IT militias, and digital mercenaries, is reshaping the contours of attribution under the law of state responsibility and blurring the threshold between state conduct and non-state action performed on its behalf.

• The expanding use of open-source intelligence, cyber forensic tools, and information obtained through leaks or by hackers introduces acute tensions within evidentiary doctrines, particularly with respect to authenticity and admissibility, chain of custody, and thresholds for probative reliability.

• The proliferation of interpretive authorities on the international law applicable in cyberspace—including the Tallinn Manual, the various processes at the United Nations, and emerging national and regional legal positions—offers a crucial case study for rule formation and interpretation in international law.

• The coexistence of the newly adopted UN Cybercrime Convention and the earlier Budapest Convention, particularly when situated within broader human rights regimes, raises difficult questions about treaty fragmentation and the challenge of ensuring normative coherence and interpretive harmony across overlapping legal frameworks.

• The use of sanctions, indictments, or coordinated cross-border cyber enforcement operations, such as botnet takedowns and cryptocurrency asset seizures invite renewed attention to the role of self-help in international law, including in the context of individual and collective countermeasures.

• The turn to private infrastructure and anonymized networks by cyber criminals operating from within a state’s territory, raises difficult questions about the scope and nature of due diligence obligations of states to prevent foreseeable transboundary harm to other states.

Modern cyber operations have thus exposed the limitations, vulnerabilities, ambiguities, and gaps in international law’s operating system. As Mohamed Helal has aptly observed, this debate brings with it a “systemic effect on international law” and is not some “techie conversation”:Footnote ³

This crucial insight was the animating premise of our panel at the 119th Annual Meeting of the American Society of International Law. By bringing together voices from government, the private sector, the humanitarian sphere, and academia, we sought to underscore the extent to which cyber governance is no longer a fringe international legal issue but a central site of legal transformation of relevance to all international lawyers. As cyber operations continue to reconfigure the terrain of global interaction, they call upon international lawyers to revisit foundational assumptions and confront latent contradictions in the system we steward. What is at stake is not merely the regulation of a novel domain, but the recalibration of international law’s internal architecture. We are forced to once again think about international law’s authority, its coherence, and its capacity to govern in an age defined by opacity and diffusion. We hope those who attended the panel left not only with this sense of urgency, but also with a renewed sense of purpose.