Main Page

__NONUMBEREDHEADINGS__

Welcome to the Cyber Law Toolkit, an interactive online resource on international law and cyber operations.

About the project

The Cyber Law Toolkit is a dynamic interactive web-based resource for legal professionals who work with matters at the intersection of international law and cyber operations. The Toolkit may be explored and utilized in a number of different ways. At its core, it presently consists of 19 hypothetical scenarios. Each scenario contains a description of cyber incidents inspired by real-world examples, accompanied by detailed legal analysis. The aim of the analysis is to examine the applicability of international law to the scenarios and the issues they raise. You can see all scenarios in the box immediately below – just click on any of them to follow the relevant analysis. In addition, you may want to explore the Toolkit by looking for keywords you’re interested in; by viewing its overall article structure; by browsing through the national positions on international law in cyberspace; or by reading about individual real-world examples that serve as the basis of the Toolkit scenarios. Finally, you may want to use the search function in the top right corner of this page to look for specific words across all of the Toolkit content.

Cyber law scenarios

S01 Election interference	S02 Political espionage	S03 Power grid	S04 International organization
S05 Criminal investigation	S06 Enabling State	S07 Hacking tools	S08 Certificate authority
S09 Economic espionage	S10 Cyber weapons	S11 Surveillance tools	S12 Computer data
S13 Armed conflict	S14 Ransomware campaign	S15 Cyber deception	S16 High seas
S17 Collective responses	S18 Cyber operators	S19 Hate speech

Featured incident

On 2 March 2021, Microsoft issued a statement about multiple zero-day exploits in its Exchange Server email software and urged customers to update their systems using a patch released at the same time. Nevertheless, malicious cyber activities escalated, resulting in more than 250,000 affected customers globally (including governments as well as the private sector) and involving at least 10 APT groups. The original campaign was attributed by Microsoft to ‘Hafnium’, described as a State-sponsored group operating out of China. The hackers used the exploits to gain access to victim organisations’ email systems and to install malware allowing them to maintain long-term access to files, inboxes, and stored credentials. Scenario 02 of the Toolkit analyses cyber espionage against government departments; economic cyber espionage is discussed in Scenario 09.

Behind the scenes

The project is supported by the following six partner institutions: the Czech National Cyber and Information Security Agency (NÚKIB), the International Committee of the Red Cross (ICRC), the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE), the University of Exeter, United Kingdom, the U.S. Naval War College, United States, and Wuhan University, China. The core of the project team consists of Dr Kubo Mačák (ICRC) – General Editor; Mr Tomáš Minárik (NÚKIB) – Managing Editor; and Ms Taťána Jančárková (CCDCOE) – Scenario Editor. The pilot year of the project (2018/19) was supported through the UK ESRC IAA Project Co-Creation scheme. The individual scenarios and the Toolkit as such have been reviewed by a team of over 30 peer reviewers. The Toolkit was formally launched on 28 May 2019 in Tallinn, Estonia; its Chinese launch took place on 2 November 2019 in Wuhan, China; it received its first general annual update on 2 October 2020; and it remains continuously updated. For questions about the project including media enquiries, please contact us at cyberlaw@exeter.ac.uk.

Other resources

• FAQ – Frequently asked questions about the project and the Toolkit.
• All articles – Updated list of all substantive articles in the Toolkit. In a printed book, this would be the table of contents.
• Keywords – Overview of all keywords used across the Toolkit content. Serves the same purpose as an index would in a printed book.
• Legal concepts – Overview of all legal concepts from different branches of international law used across the Toolkit content.
• Examples – List of real-world incidents that have inspired the analysis in the Toolkit.
• National positions – List of publicly available national positions on the application of international law to cyber operations.
• Glossary – Glossary of the technical terms used in the Toolkit.
• Short form citation – Abbreviated references for the most commonly used citations in the Toolkit.
• Bibliography – Bibliography of resources used in the creation and development of the Toolkit.
• People – List of all people involved in the project (including scenario authors, peer reviewers, research assistants...).

Prior to the US midterm elections in 2018, the US Cyber Command implemented a new preventive strategy in order to protect the elections from foreign interference. According to the media reports, the strategy was aimed at preventing Russian individuals from engaging in concerted disinformation campaigns. The targeted individuals were informed that their work and online conduct would be surveilled by the US authorities. However, the US officials did not disclose the number of individuals they had contacted nor the method of transferring the warning to the operators concerned. Scenario 01 of the Toolkit analyses whether specific forms of electoral interference abroad violate rules of international law and scenario 06 considers whether the victim State may engage in countermeasures against an enabling State.

</option> <option>

In early May 2019, hostilities flared up again in the context of the armed conflict between Israel and Palestine. According to news reports, hundreds of rockets were fired on Israel, while the Israel Defense Forces (IDF) answered with artillery and airstrikes. Remarkably, the Israeli response included also a kinetic attack allegedly aimed at countering a hostile cyber operation conducted by Hamas. In particular, the IDF announced on Twitter that it had “thwarted an attempted Hamas cyber offensive” and subsequently conducted an air strike against the Hamas Cyber Headquarters. The announcement has sparked a debate whether this operation sets a legal precedent from the perspective of international law. Within the Toolkit, Scenario 03 considers when a cyber operation may qualify as a use of force under international law and Scenario 12 analyses aspects of the law of targeting with respect to cyber operations.

</option> <option>

In September 2019, Huawei released a media statement accusing the US government of “disrupting” Huawei’s business operations with “every tool at its disposal” including the launch of “cyber attacks to infiltrate Huawei's intranet and internal information systems”. The accusation came three days after a Wall Street Journal article which had reported about the US Department of Justice investigations into Huawei for alleged technology theft. In the Toolkit, Scenario 09 assesses the lawfulness of economic cyber espionage under international law. In addition, Scenario 05 considers the legal limits to the exercise of law enforcement by one State in response to malicious cyber operations from another.

</option> <option>

In October 2019, the UK’s National Cyber Security Centre (NCSC) and the US National Security Agency (NSA) issued a report on the activities of the hacker group Turla, suspected to be based in Russia. The report claimed that two malicious tools – previously identified as being used by Turla – were Iranian in origin. Allegedly, Turla was now using these tools independently to exploit them for its own intelligence aims. While the report acknowledged the difficulties of attributing cyber operations, it claimed that Turla had had access to Iranian tools and thus had most likely compromised Iran’s operational as well as command-and-control infrastructure. The tools have allegedly been used for espionage against foreign governments, most likely in the Middle East. Within the Toolkit, scenario 02 considers the legality of cyber espionage against government departments and scenario 07 considers the leak of State-developed hacking tools and their subsequent repurposing by malicious actors.

</option> <option>

On 20 June 2019, the US Cyber Command launched multiple cyber attacks disabling computer systems that controlled Iran’s rocket launchers and wiping out a critical database of Iran’s Islamic Revolutionary Guard Corps. The attacks were reportedly a direct response to earlier attacks against oil tankers in the Persian Gulf and the downing of an American surveillance drone after it had allegedly entered Iran’s airspace. Iran has denied all responsibility for the tanker attacks. The cyber attacks were conducted the same day that President Trump called off a military strike against Iran and were reportedly intended to remain below the threshold of armed conflict. The Toolkit considers whether specific cyber operations amount to uses of force in scenario 03 and scenario 14. Moreover, scenario 13 examines when cyber operations may trigger the application of international humanitarian law.

</option> END OF REMOVED INCIDENTS -->