Showing posts with label Tallinn Manual. Show all posts
Showing posts with label Tallinn Manual. Show all posts

Tuesday, September 15, 2026

The Jus ab bellum Dilemma

 This post may be read in continuation with the earlier post 

https://kumar-theloneranger.blogspot.com/2026/09/the-resilience-of-international-law-in.html

The jus/ius ad bellum[1] dilemma in the digital and cognitive theatres represents a critical breakdown in classical just war theory and international law, as traditional framework are inherently ill-equipped to govern non-kinetic, non-physical warfare. Enshrined in Article 2(4) (prohibition on the use of force) and Article 51 (the right of self-defense) of the UN charter, jus ad bellum requires an identifiable state-backed, physical attack across the boundaries of a state to trigger a lawful casus belli. It is generally considered that the prohibition under Article 2(4) applies strictly to military/armed force and does not legally encompass economic blockages, or other coercive measures or cyber operations unless they reach the gravity and scale of a kinetic armed attack. 

Digital and cognitive operations fundamentally exploit the legal grey zones between peace and conflict, rendering these definitions obsolete.

In modern operational theatres non-kinetic warfare represents a challenge as well as a dilemma for the states. For instance, whether Iran could have invoked Article 51 in response to the Stuxnet a malware which was used as a cyber weapon that destroyed roughly 1000 uranium enrichment centrifuges in the Iranian nuclear facility at Natanz  or whether interfering in elections in another state could justify kinetic response by that state.

What constitutes “use of force”

Traditionally, a state could respond with armed force in exercise of the right of self-defense if it was faced with an armed attack. In the digital theatre, this traditional definition is inapplicable. There is legal consensus, (such as those mentioned in the Tallinn Manual) to rely on the “scale and effects” test. (Scale and effect test is the primary legal standard used an international law to determine when a cyber operation arises to the level of an armed attack under Article 51 of the UN charter. First articulated by the international court of justice in the case of Nicaragua versus United States in 1986, this test was later adapted for the digital age by international legal experts in the Tallinn Manual 2.0. Scale refers to the physical magnitude, scope and intensity of the operation. Effects refer to the resulting damage, which must necessarily include physical destruction, injury or death.) If a cyber operation disables a power or transport grid or causes aircraft to crash, it could be classified as an armed attack, though there is no direct kinetic operation involved. However, when an operation causes economic or political injury without any physical destruction or loss of life, it is difficult to state with certainty whether the aggrieved state can resort to measures under Article 51.

Cognitive warfare targets the human mind. Using AI deep fakes, algorithmic amplification, and disinformation an adversary can destabilize a state incite civil strife, or compromise a population’s psyche. These actions being non-kinetic in nature they do not trigger the traditional jus ad bellum definition of force, thereby allowing states to achieve their strategic or military objective with zero kinetic friction.

The Attribution and Anonymity Problem

Jus ad bellum assumes a clearly identifiable, aggressive state.

In the digital and cognitive theatres, operations are heavily shrouded by proxy servers, spoofed, routing autonomous, botnets, and decentralized non-state actors. It is difficult to determine whether a state has been responsible for carrying out a cyber-attack, especially when they are carried out by individuals across the globe. This switched to a problem of accountability. If a state basis, a devastating, cognitive or digital disruption it cannot legally invoke the right to self-defense under article 51 without concrete high threshold attribution. Proving that a foreign government was responsible for the cyber-attack or any non-kinetic operation is legally complex leaving targeted states with very few options for response.

Jus ante bellum – The new layer

Jus ante bellum is an emerging concept in just war theory meaning “justice before war”. It focuses on how states must ethically behave during peace time, specifically, when preparing for potential conflicts, managing structural global issues, or regulating emerging technology like Artificial Intelligence and Lethal Autonomous Weapon Systems.  Jus ante bellum adds a proactive layer before a crisis even starts. Legal scholars like Asaf Lubin and others argue that the traditional framework misses how peace time actions set the stage for future suffering. Excessive stockpiling of offensive weapons, military exercises and defense alliances trigger a sense of insecurity and a security dilemma for other states in the region which may be perceived as offensive threats, inadvertently accelerating the march towards conflict. 

In the final analysis, this insecurity dilemma leaves modern democracies, highly vulnerable: if they respond kinetically to a devastating, cognitive or digital operation, they are at risk of losing the moral high ground and being accused of aggression; if they do not respond, they may succumb to a non-kinetic sub-threshold warfare and defeat.



[1] Ius ad bellum governs whether a state has the legal right to resort to war or force


Sunday, September 13, 2026

The Resilience of International Law in the Digital Domain: Adapting International Frameworks to Cyber Warfare

The march of innovation has always been a double-edged sword. From the explosive power of gunpowder to the invention of aircraft, every paradigm-shifting technology has brought immense opportunities alongside profound, destabilising challenges. Today, digital technology drives global connectivity and economic growth, but it has also birthed a complex landscape of vulnerability. As malicious actors increasingly exploit the digital domain, the international community faces a critical imperative: developing robust defensive capabilities while fiercely preserving the international legal order.

Historically, the chaos of conflict tempted observers to invoke the ancient Roman maxim inter arma enim silent leges—"in times of war the law falls silent." In the modern era, a similar skepticism has emerged, with some arguing that the borderless, rapid, and often anonymous nature of the digital age renders existing legal systems obsolete. However, neither assertion holds true. Just as nations previously established rules to govern conventional conflicts, the international community has firmly recognized that existing international law, including International Humanitarian Law (IHL), applies seamlessly to cyberspace. The law does not fall silent in the digital age; rather, it adapts to ensure that peace, security, and stability are maintained.

The Dual Nature of Digital Innovation

Technology may be neutral, but human intent and purpose defines its impact. The digital revolution has democratised information, streamlined global commerce, and enhanced state governance. Yet, these tightly integrated systems have created an unprecedented opening for asymmetric warfare. A malicious cyber operation can breach geographical borders instantly, allowing state and non-state actors to project power without deploying a single soldier or firing a single bullet.

This environment creates a fragile balance for state defense. To protect their citizens, infrastructure, and economies, states must develop sophisticated digital capabilities. However, because the line between defensive resilience and offensive posturing in cyberspace is often thin, the acquisition of these tools can trigger digital arms races. It is therefore the collective responsibility of the international community to regulate these capabilities, ensuring they are developed and deployed strictly within the bounds of international norms.

Rejecting the Legal Vacuum

The argument that cyberspace is a "Wild West" beyond the reach of international law fundamentally misapprehends the evolutionary nature of law in general and international in particular. Treaties and customary international laws are designed around core principles rather than specific mechanical tools. When states forged the Geneva Conventions and their Additional Protocols, they did not restrict their definitions of warfare to the physical weapons of the mid-20th century.

The rapid weaponisation of cyberspace has shifted the paradigm of national security. As state-sponsored cyber operations increasingly target critical national infrastructure, the long-standing philosophical debate over whether cyberspace is a "lawless wild west" has been decisively resolved.  

As warfare expands into the digital domain (cyber warfare) and the cognitive domain (mind-space, algorithmic perception manipulation, and neuro-weapons), the traditional legal triggers for self-defense begin to break down. 

The Three Core Dilemmas 

1. The Threshold Problem: Use of Force vs. Interference Under the UN Charter, a state can only respond with kinetic military force if it experiences an "armed attack" (Article 51). 

• The Digital Domain: International experts (such as those behind the Tallinn Manual) argue that "use of force" in case of a cyberattack arises only if its scale and effects mirror a physical attack—meaning it causes direct physical death, injury, or tangible destruction. If a hostile nation permanently locks down a state's financial grid or disrupts the power supply or steals its entire intellectual property database it is devastating, yet legally sits in a "grey zone" below the threshold of an armed attack. 

• The Cognitive Domain: Cognitive warfare targets the human mind through AI-driven disinformation, engineered socio-political paralysis, and psychological subversion. Because it targets perception and decision-making without crossing kinetic lines, it is legally classified as "coercive intervention" or an infringement on state sovereignty rather than a use of force, leaving target states without a legal justification to retaliate forcefully. 

The consensus among legal scholars and state frameworks—codified in initiatives like the Tallinn Manual[1]—is that cyber operations triggering physical destruction or severe disruption must be evaluated under established legal concepts. The fundamental pillars of IHL remain fully operational in the digital realm:

Distinction: Belligerents must always distinguish between civilian objects and military objectives. Launching a cyberattack that indiscriminately targets a nation's power grid, water supply, or hospital networks violates this core tenet.

Proportionality: The anticipated civilian harm or disruption caused by a digital strike must not be excessive in relation to the concrete and direct military advantage anticipated.

Military Necessity: Cyber operations must be limited to measures strictly required to achieve a legitimate military objective, prohibiting unnecessary suffering or wanton destruction of digital infrastructure.

Core Policy Challenges & Tallinn Applications

A. Defining Sovereignty and the "Use of Force"

The Challenge: At what point does a state-sponsored hack violate our nation's sovereignty or cross the threshold into an "armed attack" under Article 51 of the UN Charter?

The Tallinn Approach: Under Tallinn 2.0/3.0 rules, a cyber operation violates a state's sovereignty if it interferes with an inherently governmental function (e.g., altering election data) or causes physical damage/injury. 

Policy Direction: Our military rules of engagement must treat cyber disruptions that lead to a "scale and effects" equivalent to a physical attack (e.g., disabling a power grid in winter) as a use of force, justifying defensive countermeasures. 

B. The Attribution Dilemma

The Challenge: Malicious actors mask their tracks using proxy servers, routing chains, or independent hacking collectives, creating a veneer of plausible deniability for hostile states.

The Tallinn Approach: State responsibility is triggered if an operation is conducted by an organ of the state or by non-state actors acting under the direction or control of that state (Rule 15, Tallinn 2.0).

Policy Direction: Establish an "aggregate evidence" standard. When absolute technical proof is missing, diplomatic and defensive responses should rely on a combination of forensic data, behavioral patterns, and geopolitical motives to hold sponsor states accountable. 

C. Applying International Humanitarian Law (IHL) in Cyberspace

The Challenge: Digital weapons can spread unpredictably across global networks, threatening civilian populations.

The Tallinn Approach: Reaffirms the core IHL principles of distinction, proportionality, and precautions in attack. Cyber weapons must target strictly military objectives and must not cause disproportionate civilian harm.

Sovereignty and State Responsibility

Beyond the active theater of armed conflict, general international law governs peacetime cyber interactions. The principle of state sovereignty dictates that a state has exclusive control over the cyber infrastructure located within its territory. Consequently, state-sponsored hacking, intellectual property theft, and electoral interference can constitute unlawful interventions or violations of sovereignty.

Furthermore, the doctrine of state responsibility ensures accountability. If a malicious cyber operation is traced back to a state organ or individuals acting under a state's direction and control, that state is legally responsible for the wrongful act. This framework incentivises governments to police their own digital borders and prevents them from using proxy hacker groups to evade legal consequences.

Conclusion

The digital age has undoubtedly complicated the geometry of global security, turning code into a potential weapon and networks into battlefields. However, new technology does not dissolve old obligations. The international community’s stance is clear: the rule of law is resilient enough to govern the virtual world. By actively applying international humanitarian law and state sovereignty frameworks to cyberspace, nations reject the cynical premise that technological advancement outpaces ethical and legal constraints. Preserving peace and stability in the 21st century relies not on abandoning the law, but on enforcing it with digital precision.


 



[1] While the Manual is non-binding, it serves as the definitive legal benchmark utilized by global legal advisors, military strategists, and policy experts.  

 

Lavender and Habsora - Israel's AI-Assisted Targeting Systems

  In the war in Gaza that began in late 2023, two names appeared repeatedly in investigative reporting about how modern militaries generate ...