Classic warfare has some rules:

(..) UN Security Council Resolution 2286. This important document condems attacks against medical facilities, personnel and patients in crisis situations.(..)

This rather old article (2013) argues that cyber warfare regulations are far from being as clear:

The systematic crash of the computer systems of banks and TV broadcasters in South Korea — reportedly the result of an attack that was widely speculated to have been launched by North Korea — raises questions about what international laws, if any, govern the new and unexplored area of cyberwarfare.

"The answer is there's nothing and there's everything," said Michael Schmitt, professor and chairman of the international law department at the U.S. Naval War College.

As cyber warfare seems to grow (which is an expected effect of growing processing / networking power), I am wondering if there are any international rules related to the specifics of cybernetic warfare.

Question: Does cyber warfare have rules similar to those existing for classic warfare?

  • Cyberwarfare is a term mostly used by people who don't know what it actually means. You would never see somebody hack a tank to pieces albeit it would be possible to initiate events that could be classified "war crimes" , like faking information which ultimatively brings down a passenger airplane or cutting civilians off the powergrid. As you see, there is no classic definition of what counts as cyberwarfare in the first place, all these actions could be characterized simoultaniously as terrorism and electronic warfare. So no, Cyberwarfare has no rules since it has no clear definition
    – clockw0rk
    Commented Sep 9, 2022 at 11:46

1 Answer 1


The answer is complicated. To begin cyber warfare and classical warfare are separate ideas.

Classical warfare is the word given for military engagements that government takes usually under a declaration of war or military engagement authorized by congress.

Cyber warfare is the term used for when a country uses a state-backed entity to commit an unauthorized attack (hack) on another government's computer or on computers within the that government's jurisdiction. There has yet to be a "cyber war", but many countries do engage in cyber warfare such as Russia, Iran, and North Korea attacking other countries. So a cyber attack as of right now is not taken as an act of war nor does it merit the definition of war.

In relation to the UN Security Council Resolution 2286, that mostly protects people from armed conflicts. Here is where it gets interesting the UN Council resolutions says that equipment for medical services is also protected. This was written in to protect things like ambulances from military attacks. But in theory if a cyber attack was committed where the attacker used an Internet of Things (IoT)-type attack and made all of the medical devices unusable then maybe under that specific scenario it could be considered a violation under the UN Resolution 2286.

There has yet to be any major hack to kill people, but there are many vulnerability pointed out by cyber security experts that may. It is possible that an attack to devices or an attack that results in someone getting killed would violate the UN Security Council Resolution 2286.

  • +1 for separate ideas. The goals of the two are (thus far) quite different. Few, if any, state actors use CW to cause casualties, mostly opting for information gathering, economic disruption, or sabotage of infrastructure or military assets. Civilian casualties are usually only sought by terrorist organizations or individuals, not states (at least, not recognized ones). While this might change, such a shift would likely come along with the commencement of conventional warfare, where CW tactics would then likely be covered under existing rules of engagement (being simply a weapon in an arsenal)
    – cpcodes
    Commented May 30, 2019 at 16:28
  • A common form of cyberwarfare is to influence elections in foreign countries through misinformation, selective information and campaign support. Several countries are doing this, and it is difficult to regulate.
    – A Fog
    Commented Jun 14, 2019 at 11:33
  • the first act in cyberwarfare is probably taking over DNS servers (likely by regular troops). Bonuspoints if you manage to capture a backbone or similar hub. This way you can cut off connections between your territory and the opponent. You can dismiss information and communication between two countries. This is done even in civil form, f.e. when Germany tried to "block" illegal streaming pages. So it's easy to imagine that this would be a main target for any regular and "psyops" forces
    – clockw0rk
    Commented Sep 9, 2022 at 11:51
  • It likely depends on the state of war in which you're in. The operations @AFog mentions are taking place in a cold-war. In a hot war we saw DDOS attacks and malware infections. These operations most likely have little to no effect. Which gain do you have by shutting down the other country's gouvermental page? It's just an apache stack while you would use a giant botnet or big serverfarm which could be used for more sophisticated operations like finding somebody'S account password which would go completely unnoticed. Many things in Cyberwarfare are just for propaganda and spreading chaos
    – clockw0rk
    Commented Sep 9, 2022 at 12:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .