"The Prohibition of the Use of Force and Cyber Operations"

My research investigates what characterises "uses of force" in violation of Article 2(4) UN Charter conducted by cyber means. Read in context, the prohibition of the use of force in Article 2(4) is directed exclusively at armed, rather than political or economic force. However, no source specifies the meaning of the attribute "armed".

States and scholars appeared to assume that one would intuitively recognise armed force when one saw it, associating it with conventional military weapons. For most of the post-Charter era, this assumption went unchallenged, with no notable debates surrounding the seemingly intuitive understanding of armed force. It was only following the emergence of cyber technologies that such debates emerged; when both the modalities and targets of operations consist of mere information on computers, it is simply less obvious whether "armed force" was used.

The term "cyber operations" can be understood broadly as encompassing "operations against or via a ... computer system through a data stream" (ICRC, 2011). In practice, this may entail the penetration of a computer network to insert software to manipulate the targeted system. This is illustrated by the "Stuxnet" incident, where a piece of malware infiltrated into the industrial control system network at an Iranian nuclear facility destroyed large numbers of uranium enrichment centrifuges (Lindsay, 2013).

Similar attacks may be directed at life support equipment in hospitals (Macak, 2020) or critical national infrastructure (Roscini, 2012), possibly resulting in human injury and death. In other words, cyber operations may clearly entail destructive effects similar to conventional "armed force".

However, it remains unclear which cyber operations will constitute armed force within Article 2(4). One particular difficulty in identifying cyber uses of force is that the jus ad bellum does not distinguish uses of armed force by their effects; a use of force may occur even where no violent effects arise whatsoever. For instance, the 1974 UN Definition of Aggression describes the mere non-consensual presence of troops on foreign territory or a naval blockade as "uses of armed force".

Put differently, States can be found to have used "armed force" even if not a single shot was fired and none of the effects often associated with armed force, such as death or destruction of property, arose. Rather, the mere fact that one State "pointed its guns" at another State suffices to establish a potential violation of Article 2(4).

Where conventional weapons and troops are deployed, it was usually obvious when a State was "pointing its guns". Consequently, debates in the jus ad bellum focused mostly on other issues, such as the minimum gravity characterising uses of force. By contrast, the question of what counts as "armed force", conceptually bringing State conduct within the ambit of the "use of force", continues to receive little to no attention in the literature.

In the cyber context, however, it is precisely this question which comes to the fore, because it is unclear what counts as armed force, particularly in the absence of any manifest effects. Overall, the cyber context raises fundamental questions, as of yet un-answered in the academic literature, about the concept of "uses of force" more generally.

My research addresses these questions by adopting the standard international law doctrinal method, which centres more specifically on a treaty interpretive exercise of Article 2(4) UN Charter, drawing on a variety of sources such as State practice and caselaw. As a preliminary step to this analysis, I dedicated the first chapter of my thesis, drafted over the course of the first year of my studies, towards outlining why this research is relevant particularly for States.

In brief, this research helps to define the boundaries of lawful State conduct in cyber space which are currently unclear, but which entail heavy legal and political consequences for States th