'Hacking Back' by States and the Uneasy Place of Necessity within the Rule of Law

Abstract

The article deals with necessity as one of the circumstances precluding wrongfulness under customary international law and how, in view of the protracted problem of timely attribution in cyberspace, it will likely gain relevance when states are forced to defend against malicious cyber operations threatening important assets such as critical infrastructures. While the necessity doctrine seems fit for purpose in principle, the article argues that it lacks granularity, as it has rarely been tested on the international plane. More importantly, like all norms that invoke an exception to the normal function of the law in an emergency situation, necessity is problematic from an international rule-of-law point of view. Taking these pitfalls into account, the article proposes some general principles for a possible special emergency regime for cyberspace that could put cyber necessity on a normatively more stable footing.

Keywords: cybersecurity, necessity, international law, rule of law, state of emergency, circumstance precluding wrongfulness, cyberattack, cyber operation

JEL Classification: K33