Cyber Operations against Critical Financial Infrastructure: a Non-Destructive Armed Attack?

Abstract

The article is devoted to the issue of the use of force in self-defense against cyber operations aimed at financial and banking infrastructure that cause only economic (non-material) damage. The article deals with the relationship between the described type of cyber operation and economic coercion, presenting the conclusion that these are different acts, which are subject to a different regime of international law regulation. Attention is also paid to the analytical approaches that can be used to bring cyber operations under the regime of the regulation of the use of force. The main contribution of the article is to capture the evolution of the scholarly debate and state practice in relation to non-destructive cyber operations in the period after the publication of Tallinn Manual 2.0 (post-2017), concluding that even non-destructive cyber operations (including cyber operations against critical financial infrastructure) can fulfil the characteristics of both use of force and armed attack, based on newly available sources, in particular official national positions on the application of international law in cyberspace published by states.