Cyberwar Has No Declaration, So When Is a Hack an Act of War

If a foreign power sent a bomber over a power plant, nobody in Washington would need a seminar to decide what it was. If the same power sent a few thousand lines of code that did the same job, we would convene a working group, commission a white paper and ask whether "attribution" was "sufficiently mature." The bomb is a bomb. The code is a conversation starter. That gap is the subject of this post, and it is a dangerous one.

Here is the claim. America's enemies are probing for the gap between a nuisance and an act of war, and our refusal to draw that line in public is an invitation to keep probing. A great power should say, in advance and in plain words, what it will treat as an armed attack in cyberspace and what it will do about it. Vagueness feels sophisticated. It is actually how deterrence dies.

Define the terms first

Three terms do all the work in this debate, and most arguments about "cyberwar" go wrong because the speakers use them interchangeably.

Use of force. Article 2(4) of the United Nations Charter requires members to refrain "from the threat or use of force against the territorial integrity or political independence of any state." That is the baseline prohibition. It applies to states, and it does not define "force."

Armed attack. Article 51 preserves "the inherent right of individual or collective self-defence if an armed attack occurs against a Member of the United Nations." The right of self-defence, including the right to respond with force, is triggered by an armed attack, not by every use of force. In its 1986 judgment in Nicaragua v. United States, the International Court of Justice distinguished the "most grave" forms of the use of force, which amount to armed attack, from less grave ones. So there is a ladder: coercion below force, force below armed attack, and armed attack at the top.

Cyber operation. Everything from stealing a spreadsheet to switching off a grid. The category is so wide that it is nearly useless until you ask what the operation did.

Now the problem is visible. The Charter was written in 1945, for tanks, bombers and battleships. Its trigger is "armed attack," and the whole structure of lawful response hangs on how that phrase is read. When the weapon is a string of code, the text gives us no purchase.

The strongest case for staying vague

Fairness demands that we state the other side at its best. The argument for ambiguity has three premises, and serious people make it.

One, cyber capabilities are new and fast-moving, and any line drawn today will be obsolete tomorrow. Two, a published threshold becomes a roadmap: an adversary will calibrate every operation to sit just beneath it. Three, ambiguity preserves our own freedom to operate, because we conduct cyber operations too, and a rule that binds our enemies would bind us.

Each of these points has real weight. The third deserves the most respect, because it is honest: the United States is not a bystander here. But the argument fails for a plain reason. Ambiguity only helps the side that is not already being tested. We are the most connected society on earth, and our hospitals, pipelines, payment systems and water plants run on networks. An adversary who knows our line is invisible has every reason to walk right up to it, and then a little past it, and then a little past that, because nothing in the record says what happens when he does. A threshold that can be gamed is still better than no threshold, because the second one guarantees the gaming.

What the law, such as it is, actually says

In 2013 a group of international legal experts, convened by the NATO Cooperative Cyber Defence Centre of Excellence in Tallinn, Estonia, published the Tallinn Manual on the International Law Applicable to Cyber Warfare. A second edition followed in 2017, extending the analysis to peacetime cyber operations. Two points matter.

First, the Manual is not a treaty and binds no one. It is the considered opinion of experts, and states have not signed it. It is nonetheless the most-cited attempt at an answer.

Second, its core reasoning is the "scale and effects" test. A cyber operation can amount to a use of force, and to an armed attack, if its scale and effects are comparable to those of a conventional kinetic operation that would so qualify. The test does not ask whether the weapon was a missile or a keystroke. It asks about consequences: death, injury, destruction of property, and serious damage to critical systems. A worm that physically destroys industrial machinery is, on this reasoning, closer to a bomb than to a burglar. A campaign of stolen files, however damaging to a company's pride, is espionage, and espionage has always been a crime under domestic law and a shrug under international law.

That is a decent starting framework. It is also precisely where the argument lives, because "comparable scale and effects" leaves open nearly every hard case. Does a month-long outage of a regional power grid count? A hospital network held hostage? Interference with a stock exchange? A denial-of-service attack that knocks a country offline? Reasonable lawyers can answer differently, and adversaries read the disagreement as permission.

The record: what actually happened

History supplies the cases, and it is instructive that none of them produced a clear response.

In the spring of 2007, Estonia, one of the most wired countries in Europe, suffered weeks of distributed denial-of-service attacks that hit government, bank and media websites. It was widely attributed to Russian-linked actors, though the Russian government denied responsibility. Estonia was a NATO member, and the alliance's treaty speaks of an armed attack against one being an attack against all. NATO did not invoke it. The NATO cyber defence centre in Tallinn was established the following year, 2008, and the Manual that carries the city's name grew out of its work. The attackers learned that you can hit a NATO member's digital life and receive a seminar in return.

In June 2010 security researchers identified a piece of malware that came to be called Stuxnet. It was aimed at industrial control systems, and it was reported to have damaged uranium-enrichment centrifuges at Natanz in Iran. In 2012 the New York Times reported that the operation was a joint American and Israeli effort that began under President George W. Bush and continued under President Obama. Neither government publicly acknowledged it in those terms. Hold that thought, because it is the most important fact in the whole debate: the most consequential cyber operation in history was an American project that the American government would not own. If we cannot say aloud what we did, we cannot easily say what an equivalent act against us would be.

In December 2015 a cyberattack was reported to have cut power to part of Ukraine's grid, leaving customers in the dark in winter. Ukrainian authorities and private security researchers blamed Russia, and in 2020 the Justice Department indicted Russian military intelligence officers over it. In 2017 the NotPetya malware, which the American and British governments publicly attributed to Russian military intelligence, spread far beyond its Ukrainian targets and caused damage to firms around the world. Both were acts that, had they been done with explosives, would have prompted a very different conversation. Both were met largely with statements, sanctions and indictments.

I would not call that a policy. It is a pattern: act below the line, because nobody has told you where the line is.

Where the United States stands

Our government has not been idle. In June 2009 Defense Secretary Robert Gates ordered the creation of United States Cyber Command, which was put under the commander of the National Security Agency at Fort Meade, Maryland. It reached initial operating capability in 2010. In 2018 it was elevated to a full unified combatant command, no longer a sub-unified command under Strategic Command. That means a single commander answers for fighting in this domain, which is a sign the Pentagon takes it seriously as a theatre of war.

The official position, repeated across administrations of both parties, is that existing international law applies in cyberspace, including the law of armed conflict and the right of self-defence. That sounds clear. It is not, because the same statements stop short of a threshold. The United States has said it will respond to a cyber operation that causes effects equivalent to an armed attack, and has said it may respond to others with means of its own choosing. Which cases are which remains an open question for the reader to guess.

Let me say what a citizen should find strange about this. The President is Commander in Chief under Article II. Congress holds the power "To declare War" under Article I, Section 8, Clause 11, and the power to fund and regulate the armed forces. In a conventional war, the Constitution makes the lines visible: a declaration, an authorization, a budget. Cyber conflict slides along a spectrum below all of that. It can wound a country badly with no Congress, no vote and no announcement, and our own law has not decided who answers for it. The last declared wars, those of 1942, were declared against nations that sent fleets. We have not yet decided what the Founders' text means when the fleet is a botnet. See also Commander in Chief Means Less Than Presidents Claim and More Than Critics Say on how far the Commander in Chief power reaches without Congress.

The numbered case for announced thresholds

Here is the argument in order.

1. Deterrence is communication. An adversary is deterred only if he knows what will be punished and believes we will punish it. A secret red line deters nobody. The point of a red line is that the other side can see it. See Deterrence Fails When an Enemy Thinks You Will Not Pay the Price for the general rule.
2. We already do this elsewhere. The United States has long said, in doctrine, that a nuclear attack on it or its allies would meet a response of its choosing. Nobody calls that a roadmap for aggressors. It is the reason it works. The same logic applies to attacks that cripple a hospital system or a grid.
3. A threshold can be consequence-based, not technology-based. We do not need to list exploits. We need to say that an operation causing death, serious physical destruction, or the sustained loss of critical national functions will be treated as an armed attack, whatever its method, and that the response need not be in cyberspace. A line drawn at effects does not go stale when the code changes.
4. Clarity keeps the lower rungs honest. Below the threshold, say which acts bring sanctions, indictments, expulsions and counter-operations. A ladder with every rung labelled makes escalation predictable, and predictable escalation is the only kind a democracy can manage.
5. Constitutional order demands it. If a cyberattack can be a casus belli, Congress and the public are entitled to know the criteria in advance. Letting the executive decide case by case, after the fact, in classified rooms, is exactly the arrangement that the Founders' separation of powers exists to prevent. See Sixty Words Passed in 2001 Still Carry America's Wars, and That Is a Problem for how open-ended authorizations drift.

The best objection, answered

The best objection is the roadmap point, and it deserves a straight answer rather than a dismissal. If we say that destruction of critical systems is an armed attack, will adversaries not simply stop just short?

Yes, some will. That is not a defect. It is the whole function of a line. Every deterrent works this way: the adversary adjusts his behavior to stay below it. A thief who stays out of the bank because the alarm exists has been deterred. We do not tear out alarms because burglars know where they are.

And here is what happens below the line. The adversary who stays beneath the threshold must now operate in the region of espionage and nuisance, where our counter-measures, sanctions and prosecutions are more proportionate and our public more patient. We move the fight from the territory where he can hurt us worst into the territory where we can punish him cheaply. That is a trade any strategist should take.

The second objection, that our own operations would be constrained, is partly right and mostly beside the point. If the rule is "we treat destructive attacks on civilian infrastructure as armed attacks," then we accept that we would be held to the same standard. A country that confident in its own restraint ought to say so. And it would be easy to carve out what we do on legitimate military targets in time of war, which the law of armed conflict already permits. The question is not whether we may ever use cyber tools. It is whether we will tell the world what we will not tolerate.

Why this matters at the kitchen table

Picture a family in a mid-sized American city. Their water comes from a municipal plant, their electricity from a regional grid, their mortgage payment from a bank's servers, their mother's dialysis from a hospital's networked scheduling system. None of that requires a soldier to be near. A determined state could damage all of it from a desk thousands of miles away.

Their question is not "is this technically an armed attack under Article 51?" Their question is: who is going to stop it, and what happens to the people who did it? The answer today is a shrug dressed as a policy. We spend more than any nation on earth on defense, and we have yet to say publicly which cyber acts will cross the line that the military exists to defend. That is an odd thing to buy at such cost.

Conservatives should care about this as an institutional matter, too. We believe government's first duty is the common defense. We believe that rules should be known in advance, that power should be accountable, and that the people's representatives ought to say what the nation will fight over. Cyberspace tests all three principles at once. For related reading on the Pentagon's own accounting problems, see The Pentagon Has Never Passed an Audit, and Conservatives Should Mind, and for the other great domain where the rules are unsettled, see Space Became a Battlefield in 2007, and the Space Force Is the Answer.

A modest agenda

None of this requires a treaty, which would take a decade and bind our enemies no more than the last one. It requires four things the executive and Congress can do alone.

• Publish a declaratory policy. A short, public statement of the effects, such as loss of life or sustained disabling of critical systems, that the United States will treat as an armed attack, and a statement that the response may be of any kind.
• Tie it to Congress. Require the executive to report to the relevant committees on any cyber operation it treats as an act of war, and on any it declines to, so that the legislature sees the pattern.
• Name the culprit faster. Attribution is difficult, but it is also a decision. When the evidence suffices, say so, with the evidence the law allows, and do it within weeks rather than years.
• Harden what a line would protect. A threshold is a bluff if the water plant has a default password. Defense and deterrence reinforce each other.

None of it is exotic. It is the same discipline the nation has applied to every other form of attack, and it ends with the same result: the enemy knows what we mean.

The case in brief

1. The law of self-defence turns on "armed attack" (UN Charter, Article 51), and nobody, including our own government, has said publicly when a cyber operation meets that standard.
2. The most-cited framework, the Tallinn Manual, tests scale and effects, but it leaves the hard cases open, and adversaries have exploited that for two decades.
3. Estonia in 2007, Stuxnet reported in 2010, Ukraine in 2015 and NotPetya in 2017 each passed without a clear response, which taught aggressors where the soft ground lies.
4. Announced, consequence-based thresholds strengthen deterrence, sort the lower rungs of response, and keep the question of war inside the constitutional order.
5. A threshold that can be gamed beats none, because secrecy about our line does not protect us. It only keeps us from enforcing it.

What you can do: read Article I, Section 8, Clause 11 of the Constitution, then write your House member and senators asking whether Congress has defined what cyber acts it would treat as war.