Nation-State Cyber Operations Legal Considerations


cyber defense
nation-state cyber operations
prohibition of the use of force

How to Cite

Małecka, A. (2021). Nation-State Cyber Operations Legal Considerations. Safety & Defense, 7(3), 99-108.


States use cyberspace as one of the platforms for pursuing national interests, also in the context of armed conflict. Due to their inherent purpose, certain principles of international law also apply to the activities of entities (state and non-state) in cyberspace. The main research problem was defined as the following question: under what conditions could the terms in international law be used to describe the events in Estonia in 2007 that imply the possibility of eventual responses or demands by victim parties consistent with international standards? In the article, the events in Estonia in 2007 were compared to existing methods of cyber warfare. The main research methods that were used to achieve the essential objective were: analysis of legal documents and critical analysis of the literature on the subject. The analysis is interdisciplinary in nature and will be particularly useful to researchers of international political and/or military relations and those interested in aspects of international security.


BBC News. (2007, May 17). The Cyber Raiders Hitting Estonia.

Buchan, R. (2012). Cyber Attacks: Unlawful Uses of Force or Prohibited Interventions? Journal of Conflict and Security Law, 17(2), 212–227.

Chung, J. J. (2018). Nation-states and their cyber operations in planting of malware in other countries: Is it legal under international law? University of Pittsburgh Law Review, 80(1), 33–67.

Clark, J. R. (2019). Russia’s Indirect Grand Strategy. Orbis – A Journal of World Affairs, 63(2), 225–39.

Davis, J. (2007, August 21). Hackers Take Down the Most Wired Country in Europe. Wired.

Desouza, K. C., Ahmad, A., Naseer, H., & Sharma, M. (2020). Weaponizing information systems for political disruption: The Actor, Lever, Effects, and Response Taxonomy (ALERT). Computers & Security, 88.

Estonian Foreign Intelligence Service. (2018). International Security and Estonia 2018.

Goldsmith, J. (2013). How Cyber Changes the Laws of War. The European Journal of International Law, 24(1), 129–138.

Government Office of Estonia. (2007, May 1). Declaration of the Minister of Foreign Affairs of the Republic of Estonia. Government Communication Unit, Government Office of Estonia.

Haataja, S. (2017). The 2007 cyber attacks against Estonia and international law on the use of force: an informational approach. Journal Law, Innovation and Technology, 9(2), 159–189.

Herzog, S. (2011). Revisiting the Estonian Cyber Attacks: Digital Threats and Multinational Responses. Journal of Strategic Security, 4(2), 49-60.

Kaldor, M. H. (2012). New & old wars: organized violence in a global era. Stanford University Press.

Koh, H. H. (2012). International Law in Cyberspace. Harvard International Law Journal, 54, 1–12.

Kostyuk, N., & Zhukov, Y., M. (2019). Invisible Digital Front: Can Cyber Attacks Shape Battlefield Events? Journal of Conflict Resolution, 63(2), 317–347.

Legality of the Threat or Use of Nuclear Weapons, Advisory Opinion, I.C.J. Rep. 1996.,ICJ,4b2913d62.html

NATO Strategic Communications Centre of Excellence. (2017). Hybrid Threats: 2007 cyber attacks on Estonia. attacks-estonia

Nicaragua v. United States of America, I.C.J. Rep. 14 (1986).,ICJ,4023a44d2.html

Ottis, R. (2008). Analysis of the 2007 Cyber Attacks Against Estonia from the Information Warfare Perspective. Cooperative Cyber Defence Centre of Excellence.

Pettersson, T., & Öberg, M. (2020). Organized violence, 1989–2019. Journal of Peace Research, 57(4), 597–613.

Prosecutor v. Dusko Tadic aka "Dule", Case No. IT-94-1 Int. Crim. Trib. for the For-mer Yugoslavia (1995).,ICTY,47fdfb520.html

Protocol Additional to the Geneva Conventions of August 12 1949, and relating to the Protection of Victims of International Armed Conflicts (Protocol I), June 8, 1977.

Rid, T. (2012). Cyber War Will Not Take Place. Journal of Strategic Studies, 35(1), 5–32.

Rid, T., & Buchanan, B. (2015). Attributing Cyber Attacks. Journal of Strategic Studies, 38(1–2), 4–37.

Schmitt, M. N. (1999). Computer Network Attack and the Use of Force in International Law: Thoughts on a Normative Framework. The Columbia Journal of Transnational Law, 37(3), XV.

Schmitt, M. N. (2011). Cyber Operations and the Jus Ad Bellum Revisited. Villanova Law Review, 56(3), 569-606.

Schmitt, M. N. (2012a). 'Attack' as a Term of Art in International Law: The Cyber Operations Context.

Schmitt, M. N. (2012b). Classification of Cyber Conflict. Journal of Conflict and Security Law, 17(2), 245-260.

Schmitt, M. N. (Ed.). (2017). Tallinn Manual (2.0) on the international law applicable to cyber operations, second edition, prepared by the International Group of Experts at the Invitation of the NATO. Cambridge University Press.

Tikk, E., Kaska, K., & Vihul, L. (2010). International Cyber Incidents: Legal Considerations. Cooperative Cyber Defence Centre of Excellence.

U.N. Charter art. 2, para. 4.

U.N. Charter art. 51.

Verizon Communications, Inc. (2020). The Verizon Business 2020 Data Breach Investigations Report.

Creative Commons License

This work is licensed under a Creative Commons Attribution 4.0 International License.