Newly emerging US cyberspace warfighting concepts highlight the need to update US legal doctrine. Concepts adapted to future high-intensity, high-paced armed conflict, including command post dispersal and integration of cyberspace into other targeting domains, present opportunities to refine US understandings of the law of war attack threshold and overlooked rules applicable to destruction and seizure. The advantages of staking out clear and current opinio juris on these and other matters extend beyond providing responsible and consistent operational law advice. Updated and authoritative military cyber legal doctrine will serve the strategic and diplomatic legal interests of the United States and the international legal system as a whole.

Intelligence operations overwhelmingly focus on obtaining secrets (espionage) and the unauthorized disclosure of secrets by a public official in one political community to another (treason). It is generally understood that the principal responsibility of spies is to successfully procure secrets about the enemy. Yet, in this essay, I ask: Are spies and traitors ethically justified in using cyber operations not merely to acquire secrets (cyber espionage) but also to covertly manipulate or falsify information (cyber manipulation) to prevent atrocities? I suggest that using cyber manipulation operations to parry atrocities is pro tanto morally permissible and, on occasion, required.

This article considers the international laws applicable to irresponsible state behaviour in cyberspace through the lens of the problem of election hacking. The rule of sovereignty has taken centre stage in these discussions and is said to be preferred to the non-intervention rule because it evades the problem of coercion. Proponents of the cyber rule of sovereignty contend that there is such a rule; opponents reject the existence of the rule as a matter of existing law. The objective here is to explore the methodologies involved in the identification of the cyber rule of sovereignty under customary international law. The work first frames the debate in the language of regulative and constitutive rules, allowing us to show that a regulative rule of sovereignty can, logically, and necessarily, be deduced from the constitutive rule of sovereignty. The content of the regulative rule can also be deduced from the constitutive rule of sovereignty, but it has a more limited scope than claimed by the proponents of the rule, notably the Tallinn Manual 2.0. The rule of sovereignty prohibits state cyber operations carried out on the territory of the target state and remote cyber operations which involve the exercise of sovereign authority on that territory, e.g., police evidence-gathering operations. The rule of sovereignty does not, however, prohibit other remote, ex situ state cyber operations, even those targeting ICTs used for governmental functions, including the conduct of elections. The rule of sovereignty is not, then, the solution to the problem of election hacking.

How do emerging technologies affect nuclear stability? In this paper, we use a quasi-experimental cyber-nuclear wargame with 580 players to explore three hypotheses about emerging technologies and nuclear stability: (1) technological uncertainty leads to preemption and escalation; (2) technological uncertainty leads to restraint; and (3) technological certainty leads to escalation through aggressive counterforce campaigns. The wargames suggest that uncertainty and fear about cyber vulnerabilities create no immediate incentives for preemptive nuclear use. The greater danger to strategic stability lies in how overconfidence in cyber exploits incentivizes more aggressive counterforce campaigns and, secondarily, how vulnerabilities encourage predelegation or automation. Both of these effects suggest worrisome relationships between cyber exploits and inadvertent nuclear use on one hand and cyber vulnerabilities and accidental nuclear use on the other hand. Together, these findings reveal the complicated relationship between pathways to escalation and strategic stability, highlighting the role that confidence and perhaps-misplaced certainty—versus uncertainty and fear—play in strategic stability.

Military technology has developed rapidly in recent years, and this development challenges existing norms. It has produced countless debates about the application of international humanitarian law (IHL) to areas of war and technology including cyber military operations, military artificial intelligence (including autonomous weapons), the use of drones, and military human enhancement. Despite these rapid progressions, the prospect of creating new treaties to specifically regulate their use by militaries and in armed conflicts is very low. This is largely due to the unequal allocation of military technology among States and the differing interests that result from this inequality. The absence of formal regulation means that State and non-State actors are increasingly embracing informal means of law-making. This is similar to other areas of IHL, such as the regulation of asymmetric conflicts, where norms are contested. In such cases, State and non-State actors employ various informal law-making techniques to advance their normative positions through treaty interpretation and the identification of customary international law.

However, the discussion on military technology differs from other contemporary IHL debates. First, due to the rapid development of such technology and uncertainty about how it will be employed in practice, the interests of the various actors are less clear. Second, there are significant challenges in obtaining accurate information about new military technologies. This makes even the informal law-making path in the context of new technologies more challenging.

This paper explores the dynamics of contemporary international law-making as it relates to the regulation of new military technologies. It identifies the main techniques that are used by the relevant actors and explores the common themes among the various debates over military technology, as well as the potential specific challenges in relation to certain technologies.

Digitalization and new technologies have an increasingly important role in today's humanitarian activities. As humanitarian organizations become more active in and reliant on new and digital technologies, they evolve from being simple bystanders to being fully fledged stakeholders in cyberspace, vulnerable to adverse cyber operations that could impact on their capacity to protect and assist people affected by armed conflict or other situations of violence.

This shift makes it essential for humanitarian organizations to understand and properly map their resulting cyber perimeter. Humanitarian organizations can protect themselves and their activities by devising appropriate cyber strategies for the digital environment. Clearly defining the digital boundaries within which they carry out operations lays the groundwork for humanitarian organizations to develop a strategy to support and protect humanitarian action in the digital environment, channel available resources to where they are most needed, and understand the areas in which their operational dialogue and working modalities need to be adapted for cyberspace.

The purpose of this article is to identify the unique problems facing international humanitarian organizations operating in cyberspace and to suggest ways to address them. More specifically, the article identifies the key elements that an international humanitarian organization should consider in developing a cyber security strategy. Throughout, the International Committee of the Red Cross and its specificities are used as an example to illustrate the problems identified and the possible ways to address them.

At present, most scholarship on the potential for escalation in cyberspace couches analysis in terms of the technological dynamics of the domain for relative power maneuvering. The result has been a conceptualisation of the logic of operation in cyberspace as one of ‘tit-for-tat’ exchanges motivated by attribution problems and limited opportunity for strategic gain. This article argues that this dominant perspective overlooks alternative notions of how cyber tools are used to influence. This, in turn, has largely led scholars to ignore second-order effects – meaning follow-on effects triggered by a more direct outcome of an initial cyber action – on domestic conditions, institutions, and individual stakeholders. This article uses the case of cyber-enabled political warfare targeting the United States in 2016 to show how escalation can occur as a second-order effect of cyber operations. Specifically, the episode led to a re-evaluation of foreign cyber strategy on the part of American defence thinkers that motivated an offensive shift in doctrine by 2018. The episode also directly affected both the political positions taken by important domestic actors and the attitude of parts of the electorate towards interference, both of which have reinforced the commitment of military planners towards assertive cyber actions.

The (re)insurance industry is faced with a growing risk related to the development of information technology (IT). This growth is creating an increasingly digitally interconnected world with more and more dependence being placed on IT systems to manage processes. This is generating opportunities for new insurance products and coverages to directly address the risks that companies face. However, it is also changing the risk landscape of existing classes of business within non-life insurance where there is inherent risk of loss as a result of IT events that cannot be or have not been excluded in policy wordings or are changing the risk profile of traditional risks. This risk of losses to non-cyber classes of business resulting from cyber as a peril that has not been intentionally included (often by not clearly excluding it) is defined as non-affirmative cyber risk, and the level of understanding of this issue and the cyber peril exposure from non-cyber policies varies across the market. In contract wordings, the market has remained relatively “silent” across most lines of business about potential losses resulting from IT-related events, either by not addressing the potential issue or excluding via exclusions. Some classes of business recognise the exposure by use of write-backs. Depending on the line of business, the approach will vary as to how best to turn any “silent” exposure into a known quantity either by robust exclusionary language, pricing or exposure monitoring. This paper proposes a framework to help insurance companies address the issue of non-affirmative cyber risk across their portfolios. Whilst the framework is not intended to be an all-encompassing solution to the issue, it has been developed to help those tasked with addressing the issue to be able to perform a structured analysis of the issue. Each company’s analysis will need to tailor the basis of the framework to fit their structure and underwriting procedures. Ultimately, the framework should be used to help analysts engage with management on this issue so that the risk is understood, and any risk mitigation actions can be taken if required. In the appendix, we present a worked example to illustrate how companies could implement the framework. The example is entirely fictional, is focused on non-life specialty insurance, and is intended only to help demonstrate one possible way in which to apply the framework.

Cybermentoring refers to virtual peer support in which young people themselves are trained as cybermentors and interact with those needing help and advice (cybermentees) online. This article describes the training in, and implementation of, a cross-national cybermentoring scheme, Beatbullying Europe, developed in the United Kingdom. It involved train-the-trainer workshops for partners and life mentors in six European countries (Italy, Spain, Portugal, Romania, Poland and the Czech Republic) in 2013–2014, followed by training sessions for pupil cybermentors aged 11–16 years. Although BeatBullying went into liquidation in November 2014, the project was largely completed. We (1) report an evaluation of the training of the life mentors and mentors, via questionnaire survey; and (2) discuss findings about the implementation of the scheme and its potential at a cross-national level, via partner interviews during and at the end of the project. The training was found to be highly rated in all respects, and in all six countries involved. The overall consensus from the data available is that there was a positive impact for the schools and professionals involved; some challenges encountered are discussed. The BeatBullying Europe project, despite being unfinished, was promising, and a similar approach deserves further support and evaluation in the future.

The technical and legal challenges of attribution in cyberspace prevent the meaningful operation of the international law framework of State responsibility. Despite the anticipation surrounding its publication, the Tallinn Manual 2.0 went no further than its predecessor in offering a cogent legal solution to this problem. Instead, the Manual confined its analysis of attribution to the well-known provisions of the International Law Commission's Articles on State Responsibility. This article departs from the Tallinn Manual 2.0 in arguing that the due diligence principle offers a preferable and appropriate standard of attribution in cyberspace.

The Great War ushered in a new era of long-distance combat. For the first time, weapons with a very long range were massively deployed, in previously unheard-of places: under the sea and in the air. Stealth fighting also included espionage and propaganda, now orchestrated on a global scale. In reaction to the carnage in the trenches, a degree of moral rehabilitation came to be conferred on the weapons initially associated with a “cowards’ war”. This in turn encouraged experimentation with the new, unmanned technology that would lead to the first prototypes of guided munitions and drones.

This article presents the case for a progressive interpretation of the notion of military objectives in international humanitarian law (IHL), bringing computer data within the scope of this concept. The advent of cyber military operations has presented a dilemma as to the proper understanding of data in IHL. The emerging orthodoxy, represented by the 2013 Tallinn Manual on the International Law Applicable to Cyber Warfare, advances the argument that the intangible nature of data renders it ineligible to be an object for the purposes of the rules on targeting in IHL. This article, on the contrary, argues that because of its susceptibility to alteration and destruction, the better view is that data is an object within the meaning of this term under IHL and thus it may qualify as a military objective. The article supports this conclusion by means of a textual, systematic and teleological interpretation of the definition of military objectives found in treaty and customary law. The upshot of the analysis presented here is that data that does not meet the criteria for qualification as a military objective must be considered a civilian object, with profound implications for the protection of civilian datasets in times of armed conflict.

This article responds to the two articles published in this journal that criticise the approach taken by the International Group of Experts (IGE) who prepared the Tallinn Manual on the International Law Applicable to Cyber Warfare. Their authors took issue with the approach of the majority of the IGE over the question of whether data qualifies as an ‘object’ under international humanitarian law such that, for instance, cyber operations that target civilian data violate the prohibition on attacking civilian objects. The majority of the experts took the position that the law had not advanced that far and that pre-existing law could not be definitively interpreted to encompass data within the meaning of ‘objects’. In this article, the Director of the Tallinn Manual Project responds to the authors' criticism of the majority view by explaining and clarifying its reasoning.