When Code Becomes Combat: When do Cyberattacks Qualify as Armed Attacks?
What happens when a country can damage another nation’s infrastructure without sending a single soldier across a border? In the digital age, global conflicts increasingly occur through cyber operations rather than through traditional weapons. Governments can disrupt power grids, interfere with financial systems, or sabotage nuclear facilities using code instead of missiles. These developments raise an important legal question: when does a cyberattack become serious enough to count as an armed attack under international law?
Traditionally, international law viewed armed attacks as physical acts, such as invasions or bombings. However, cyber operations challenge this definition because they can cause damage without traditional weapons. In the growing confrontation involving the United States, Israel, and Iran, cyber activity has become part of the broader conflict. Experts report that cyberattacks often increase during periods of military escalation, sometimes targeting critical infrastructure or civilian companies. Because cyber operations can cause serious disruption without traditional weapons, international law must determine when these attacks cross the line and become an act of war. A cyberattack should be formally considered an armed attack when its scale and effects resemble those of a conventional military force, especially when it threatens public safety.
The rules governing the use of force between countries largely come from the United Nations Charter. Article 2(4) prohibits states from using force against other countries, while Article 51 allows a state to act in self-defense if it is the victim of an armed attack. When these rules were written, policymakers imagined traditional warfare involving physical weapons. As such, these articles fail to account for modernized, digital combat.
Cyber operations complicate this system. Instead of bombing a facility, a state might disrupt a country’s power grid, communication networks, or transportation systems. These attacks may not immediately destroy a nation, but they can still invoke widespread chaos and economic damage. Recent conflicts show how cyber operations are now integrated into military strategies. During escalating tensions between Israel and Iran, cyberattacks have increased dramatically, with reports showing large spikes in attacks targeting Israeli networks after military strikes. These incidents demonstrate that cyberspace has become another battlefield where governments attempt to weaken their opponents without direct physical confrontation.
The ongoing tensions between the United States, Israel, and Iran illustrate how cyber operations can accompany traditional warfare. Governments and hacker groups connected to these nations have carried out cyber operations targeting infrastructure, companies, and communication systems. One Iranian attack disrupted systems at the American medical device company Stryker, serving as an example of how cyberattacks can reach civilians by targeting their industries. Although many of these attacks involve data breaches rather than physical destruction, experts worry that they could eventually affect the nation as a whole. Cyber operations have also been used offensively by Israel and its allies. In some cases, hackers linked to Israel accessed Iranian digital systems such as traffic cameras and mobile applications, using them to gather intelligence or spread political messages. Despite the seriousness of these incidents, governments rarely label them as armed attacks. Declaring a cyber operation as an armed attack could legally justify military retaliation, which could potentially escalate the conflict further.
To determine when a cyber attack becomes an armed attack, international law should focus on three factors: scale, effects, and attribution.
First, the scale of the attack matters. Minor cyber incidents, such as hacking websites or briefly disrupting networks, should not be treated as acts of war. However, attacks that shut down national infrastructure or cause widespread economic damage could reach the threshold of armed conflict. Second, the effects of the attack are crucial to ensuring safety. If a cyber operation causes physical destruction or threatens people’s lives, it should clearly be treated as a deliberate armed attack. For example, disabling hospitals or major power systems could have consequences similar to destroying those buildings altogether. Lastly, attribution must be unambiguous. Cyberattacks are often difficult to trace, and governments must be confident about who carried them out before responding with military force. Without reliable attribution, retaliation could lead to unnecessary conflict. Using these criteria would allow international law to adapt to modern technology while still retaining limits on the use of force.
Cyber warfare has become an important part of international conflict. The current tensions involving the United States, Iran, and Israel show how digital operations can accompany military action and affect both governments and civilians. Not every cyberattack should be treated as an act of war. However, when a cyber operation causes destruction or disruption comparable to a traditional military strike, it should qualify as an armed attack under international law. As cyber warfare continues to evolve, establishing clear legal standards will be essential for maintaining stability.
Bibliography
Klepper, David. 2026. “Iran-Linked Hackers Take Aim at U.S. And Other Targets, Raising Risk of Cyberattacks during War.” PBS News. March 12, 2026. https://www.pbs.org/newshour/amp/world/iran-linked-hackers-take-aim-at-u-s-and-other-targets-raising-risk-of-cyberattacks-during-war.
Kuhu Badgi, and Lauryn Williams. 2026. “How Will Cyber Warfare Shape the U.S.-Israel Conflict with Iran?” Csis.org. 2026. https://www.csis.org/analysis/how-will-cyber-warfare-shape-us-israel-conflict-iran.
Lalljee, Jason, and Sam Sabin. 2026. “Hackers Join U.S. And Israel’s Fight with Iran.” Axios. March 11, 2026. https://www.axios.com/2026/03/11/iran-war-trump-israel-ai-cyberattack.