Cyber Operations and International Law explores some pertinent questions with regard to the application of international law to the use of cyberspace for offensive operations. The book was written by François Delerue, a research fellow in cyber defense and international law at the Institute for Strategic Research based in Paris. Delerue's work dates back before the publication of this important book, and includes an extensive body of scholarship on various international law matters arising out of cyberspace.

Cyber Operations and International Law is a compelling, logical, and important book that touches on all of the critical international law topics while asking difficult questions. It surveys topics of attribution, substantive international law, and countermeasures, while also being cognizant of the trends, techniques, actors, methods, and novel effects demonstrated by the growing frequency of transborder cyber operations. Delerue offers a granular and persuasive analysis of existing international law in the context of cyber operations while acknowledging the grim reality that “international law does not constitute a panacea” and that “[t]here are several situations in which international law leaves the State victim of cyber operations helpless” (p. 496).

The book is divided into three parts. It starts with an Introduction, which makes the case that international law matters in cyberspace. Part I focuses on attribution, Part II addresses the lawfulness of cyber operations under international law, and Part III covers the remedies against cyber operations. Throughout its many chapters, the book also reveals broader themes that deserve some focus, which this review will address.

In the Introduction, Delerue sets the stage for the main three themes that appear throughout the book: attribution, lawfulness, and remedies. Delerue asks the preliminary question of whether international law applies to cyberspace. This portion of the book is truly thought-provoking, involving a fundamental inquiry into the nature of cyberspace as a technical and legal domain. Delerue concludes that “cyberspace does not constitute a fifth domain” because it is “not really an environment” (p. 11). In addition, Delerue asserts that cyberspace is interrelated to other, physical domains, namely land, sea, air, and space, and therefore cannot be considered a separate domain. While there is a great deal of philosophical debate to be had on the nature of cyberspace as a domain, Delerue's approach to cyberspace as a nondomain has no bearing on the applicability of international law to it. As he correctly observes, “it seems unquestionable” that international law applies to cyberspace (p. 13). The Introduction then briefly addresses the UN Group of Governmental Experts (UNGGE) process, which brought together experts from various nations to draft rules on responsible state conduct in cyberspace, as well as some key technical terminology.

The book then proceeds to a thorough analysis of the rules and principles of attribution, the legality and illegality of cyber operations, and remedies in response to cyber operations. Delerue takes a somewhat siloed approach, in which different areas of international law are thoroughly introduced, applied, and evaluated separate from other areas that receive the same treatment elsewhere in the book. This structure makes logical sense, as it touches on different topics pertaining to international law and cyber operations.

Primarily, there are three overarching themes that appear throughout the book, in different variations: thresholds, control, and change. These themes are recurring topics for international law and cyberspace, primarily due to the latter's novel, nonterritorial, and remote nature, as well as competing geopolitical and ideological approaches that undermine any consensus on these issues.

Many areas of international law incorporate a set of thresholds. When an act meets a certain level of severity, harm, coercion, or damage, it is treated as internationally wrongful. Examples of such thresholds are numerous, including use of force for Article 2(4) of the UN Charter; armed attack for Article 51 of the UN Charter; harm to territorial sovereignty; coercion for nonintervention; and damage for failure to exercise due diligence.

On the one hand, these thresholds are general because harm, coercion, and damage are all illegitimate, no matter the how they are achieved. On the other hand, our understanding of these thresholds remains fixed, despite technological changes that constantly change our reality, and any new negative effects may not be fully reflected by these thresholds. If any changes to these concepts occur, they take place sporadically and slowly. This is a noteworthy shortcoming of these thresholds. Often, our understanding of what harms are illegitimate in cyberspace is a result of the analogization to the physical world, where unlawful harms are to a large extent physical. However, cyberspace creates a new set of nonphysical harm, most of which are not severe enough to trigger any international responsibility, and some of which can be devastating, destabilizing, and disruptive. Scholars like Rebecca Crootof observed that analogies “restrict our ability to think imaginatively”Footnote ¹ and that new technologies are unlikely to be identical to older technologies. The same applies in the cyber operations context.

One of the first thresholds introduced in Cyber Operations and International Law is harm in the context of sovereignty. The harm conundrum appears initially in Chapter 5, which explores cyber operations that are internationally wrongful. While there is no specific international prohibition on cyber operations as a whole, separate international law norms and principles may restrict the use of cyber operations in particular situations. One prominent example is sovereignty. A violation of sovereignty, whether through cyberspace or not, is an internationally wrongful act. However, there is a fundamental disagreement on the requisite level of harm to establish a sovereignty violation (p. 215). One view, supported by the Tallinn Manual 2.0,Footnote ² is that there needs to be physical damage, loss of functionality, or infringement upon territorial integrity (p. 216). Brian Egan seems to have articulated a similar view,Footnote ³ conditioning the wrongfulness of a cyber operation on the existence of a physical harm (p. 250). Herein lies the problem. Cyber operations, due to their unterritorial nature, are unlikely to infringe on territorial integrity; however, they may occasionally cause physical damage or loss of functionality.

Delerue takes issue with the Tallinn Manual 2.0 approach to physical harm as a requirement for a violation of sovereignty, and for good reason (p. 217). The Tallinn Manual seems to overly rely on physical and tangible consequences as a prerequisite for wrongfulness in cyberspace, which is counterintuitive in a context where cyber operations rarely produce these effects, but can nonetheless be devastating on an informational level. In the noncyber world, a violation of sovereignty does not have to cause physical effects, as Delerue's analysis of the jurisprudence shows. At the same time, Delerue's characterization of cyberspace as a nondomain in the book's Introduction may undermine his argument that we have to use the same logic in cyberspace that applies in the land, sea, air, and space domains. This is to say that sovereignty in cyberspace may look different than sovereignty over territory, if only for the reason that the internet is an inherently open system with borderless protocols, without clear physical boundaries that sovereignty often relies on. Delerue highlights the difficulty with the physical harm approach by recognizing the DNC Hack,Footnote ⁴ in which Russian GRU agents are believed to have released tens of thousands of sensitive DNC emails on WikiLeaks, as a cyber operation that has likely crossed the requisite threshold despite not causing any physical effects.

Turning to the nonintervention principle, Delerue observes an overlap with the logic of territorial sovereignty (p. 232). However, nonintervention is broader. It seeks to prohibit coercive interference by one state against “the ability of another to freely decide its internal organisation and government” (p. 248). While there are many important points of discussion in this context, one aspect that is worthy of further analysis is the element of coercion. Interference is wrongful when it uses methods of coercion (p. 235). While certain cyber operations are unambiguously coercive, there is a subset of cyber operations that are harmful and disruptive yet fall below the legal threshold of coercion. However, we do not have a clear or robust understanding of these actions. Some harmful cyber operations, such as certain operations designed for election interference, would be considered as below the threshold of coercion, a threshold largely designed for the noncyber world. This is particularly disconcerting given that interference is much easier in cyberspace than in other domains (p. 495).

Finally, the same conceptual ambiguity with regard to harm and coercion appears in the use of force context. Here, Delerue observes that Article 2(4) of the UN Charter defines the prohibition of the use of force or the threat to use force in a way that is “sufficiently flexible to take into account cyber operations,” yet the “notion of force . . . is still disputed and debated” (p. 284). If a cyber operation reaches the level of “force,” it is in violation of Article 2(4), and if such force reaches the level of an “armed attack,” it could give rise to the right to self-defense under Article 51 of the UN Charter. This creates threshold-related difficulties that are illustrated in earlier chapter in the book: that some cyber operations would necessarily be left out of the scope of existing principles, like nonintervention and sovereignty.

Delerue thoughtfully responds to these concerns. First, he makes a lex lata argument: Article 2(4) covers some forms of coercion, such as armed coercion, though economic and diplomatic are excluded from that scope. On the other hand, Delerue later acknowledges that “it no longer seems accurate to limit the prohibition on the use or threat of force to armed force” (p. 287). Granted, the use of force analysis would depend on which approach one subscribes to—consequence-based (pp. 289–90), instrument-based (p. 289), or target-based (p. 288)—however, this does not entirely respond to the novel effects of cyber operations, which may be so harmful as to justify stretching Article 2(4) to cover those instances. Delerue aptly articulates this concern by asking if “it would not be more appropriate to develop a new tailor-made approach for cyber operations” (p. 290). At the same time, today's geopolitical climate may prove unwilling to change this consensus. I discuss the change theme later in this review.

The second recurring theme in Cyber Operations and International Law is that of control. Certain international law obligations apply whenever there is a certain degree of control exercised by the state in question—for example, human rights law. State responsibility also uses notions of control in cases where there is a nexus between a state and a nonstate actor violating international law. Control was largely developed in a physical world, where its metrics include military presence, exercise of jurisdiction, and more. Translating these concepts control as-is into cyberspace can lead to impunity as control is difficult to establish through cyberspace due to its inability to fulfill the requisite physical standards.

As part of the larger topic of attribution, Part I of Cyber Operations and International Law also explores state responsibility for cyber operations (p. 111). This is an exercise in attributing a cyber operation to a state using the rules and principles on state responsibility, primarily derived from the International Law Commission (ILC) Draft Articles on the Responsibility of States for International Wrongful Acts.Footnote ⁵ The easy cases involve a state acting directly through its organs or entities empowered to exercise governmental authority. The more burdensome cases concern individuals or nonstate groups whose actions could be somehow linked to a state. States who exercise effective controlFootnote ⁶ (as defined by the International Court of Justice) or overall controlFootnote ⁷ (as defined by the International Criminal Tribunal for the former Yugoslavia) over a nonstate group, are likely to be held accountable for the actions of that group since the latter is “acting on the instructions of, or under the direction or control of, that State in carrying out the conduct” (p. 139; ILC Draft Articles, Article 8).

Both effective control and overall control are unattainable and unrealistic in the cyberspace context, as the “degree of control necessary to encourage non-state actors to conduct cyber operations can . . . be particularly low” (p. 149). Both standards seek some nexus between the state and non-state actor, whereas cyber operations can be carried out by the non-state actor without such nexus. The irrelevance of both standards of control to the realities of nonstate cyber operations is likely to lead to impunity and deniability which is already rampant in today's world. The dichotomy of control/no-control is further exacerbated by the indistinguishable nature of state-sponsored cyber operations from cybercrime (p. 122). The reality is that we do not currently have a clear control standard for cyber operations, and there would nonetheless be a tension between a lower threshold and a threshold that is too low (p. 149).

The book touches on an overlapping issue of control when it turns to the topic of extraterritoriality of human rights obligations. Thus far, international human rights law's extraterritoriality models have been focused on spatial or personal control (p. 263), disregarding the virtual, remote, and instantaneous nature of cyberspace. The nature of these control standards is similar to the logic behind “effective control” and “overall control.” The same debate as to the relevance of these control standards in cyberspace has taken place in recent years, where commentators have argued for the recognition of a “virtual control” standard to address the physical nature of existing extraterritoriality, which are ill-fitting for cyberspace.Footnote ⁸

While control appears in different contexts within international law, it presents a deeper conceptual gap. International law does not currently have a clear methodology for attribution of nonstate cyber operations to a state in all situations below that of effective or overall control, and international law does not have an adapted version of a human rights extraterritoriality standard for cyber operations that interfere with human rights abroad. This contributes to a sense of lawlessness in certain situations, where states that are culpable are rarely held to account. More work on modernizing control will be needed to address these trends in cyberspace.

The challenges identified by the themes of thresholds and control suggest that international law needs to change, or rather adapt, to the unique characteristics and plethora of new phenomena that cyberspace presents. International law can change through the creation of new customary international law, new treaties, and new interpretations of existing legal frameworks. Yet some of these challenges make any such change less likely. Whether international law changes or adapts to cyber operations is an open-ended question. There are multiple factors and dimensions that affect the likelihood of such change or adaptation. Keeping the existing status quo would not address a substantial subset of cyber operations that do not quite fit our existing thresholds and control standards.

The formation of new customary international law perspective requires uniform, and near-universal state practice that is followed as opinio juris. Cyber operations are difficult to categorize as state practice if we cannot ascertain that there was indeed a state behind a given operation. As Delerue and many others suggest, attribution in cyberspace is tricky due to the architecture of the internet and the ability of adversaries to use different tools to mask their identities and tracks. Attribution is a multidimensional concept, as it involves technical, factual, and legal aspects (p. 51), with a certain degree of overlap between them. Part I, Chapter 2 of the book is excellent in laying out the technical aspects of attribution, namely the differences between a serial number, media access control (MAC) address, and an internet protocol (IP) address. As has been the case in recent years, attribution that is solely reliant on IP addresses is incomplete in the sense that IP addresses can be manipulated (known as “spoofing”) (p. 67). The chapter then follows with examples of past cyber operations and their attribution challenges, such as the DNC Hack, Stuxnet,Footnote ⁹ and the cyber-attacks on EstoniaFootnote ¹⁰ (pp. 72–85).

Delerue next addresses the general concept of evidence in international law. This topic could merit its own book, as the evidentiary challenges pertaining to cyberspace are particularly perplexing. This is perhaps where the irrelevance of the characterization of cyberspace as a domain or nondomain is best illustrated. Delerue aptly concludes that states are reluctant to reveal evidence to the public because it will both expose the means and methods of that state as well as any exploitable vulnerabilities (p. 108). This is unlike in other domains, where states are more transparent about their findings for activities taking place in land, sea, air, and space.

There is perhaps a more fundamental point to be made here, which is that the secrecy surrounding the evidence and state practice in relation to cyber operations hinders the development of customary international law. Customary international law presupposes public, uniform, widespread state practice out of sense of legal obligation, the likelihood of which for cyber operations appears distant given the evidentiary challenges the Delerue lays out. All in all, while new customary international law is possible at some point in the future, it is unlikely to arise where there is lack of transparency that is so emblematic of cyberspace.

New treaties and new interpretations of existing international law may also be possible in theory, but implausible in practice. The failure of the UNGGE in 2017 reveals the deep disagreements on some basic tenets of international law, such as self-defense and countermeasures (p. 15).

There are, however, other processes which may offer some change and adaptation to international law applicable to cyber operations. Delerue identifies the Global Commission on the Stability of CyberspaceFootnote ¹¹ (p. 23), as well as some corporate-sponsored frameworks and institutions, such as Microsoft's Digital Geneva Convention proposalFootnote ¹² (p. 24). Delerue considers Microsoft's efforts to be “both timely and welcome” (p. 27), especially given the shortcomings of the state-centered approach.

Yet, there should be some caution in delegating the international lawmaking task to private entities, in particular where such entities own vast portions of the internet's infrastructure and may not fully consider the rights and needs of ordinary internet users. Noteworthy in this context is the CyberPeace Institute,Footnote ¹³ a multistakeholder organization that seeks to protect users from cyber-attacks, and by doing so, may promote certain norms of behavior in cyberspace and the evidence required for new customary international law. While private organizations are not per se participants in the development of customary international law, given their control of vast portions of the internet infrastructure they may nonetheless create a certain reality which state have no choice but to abide by. It remains to be seen what tensions will arise if more private technology corporations permeate this space, especially in terms of accountability, transparency, due process, fairness, human rights, and more.

This review identifies thresholds, control, and change as the recurring and overarching themes of Cyber Operations and International Law. However, these themes are by no means a summary of the depth and thoroughness of the book, which informs the reader in every single chapter of the various layers and dimensions of both cyber operations as a technical phenomenon, and international law as it applies today and as it ought to apply if it is to fully capture the complexity and dangers arising from cyber operations. In doing so, François Delerue successfully accomplishes the heroic task of untangling both the technology and law surrounding cyber operations in a book that will undoubtedly serve as a leading foundation for further scholarly activity in this space.