Automatic Cyber Defence and the Laws of War

Automatic cyber defence describes computer operations to neutralise a cyber-attack. Once a system detects that is under cyber-attack, it automatically launches offensive cyber operations that pursue the attacker back to its own network with the objective of rescuing stolen data or disabling or destroying the computer hardware and software that is responsible for hosting and distributing the attacking code. The aim of this article is to examine the legality of automatic cyber defence under the law regulating the use of force in international law (jus ad bellum) and under international humanitarian law (jus in bello). Thus, the first part of this article examines automatic cyber defence in the context of the jus ad bellum by considering the legal requirements of an armed attack, necessity and proportionality. In the second part, it examines the jus in bello aspects of automatic cyber defence and in particular whether it triggers an international or non-international armed conflict and, if so, whether it can comply with the principles of distinction and proportionality.