Protection of Critical Infrastructure Against Cyber Attacks: An International Law Perspective

Abstract

Critical infrastructure (CI) plays an essential role in a state’s functioning. From power grids, telephone networks, medical supply centres, transit systems, and financial institutions to emergency response systems, all are essential for the effective operation of businesses and service delivery, alongside catalysing economic growth and investment. However, the advent of the internet has integrated most of the state’s critical infrastructure with digital technologies, which makes it vulnerable to cyberattacks in interstate conflicts. In view of this, this research is centred on the question of the extent to which International Law accords protection to CI. The paper specifically addresses two sub-questions: (1) How are cyberattacks against CI, not resulting in direct physical destruction, regulated under international law? (2) Whether offensive cyber capabilities can be a legitimate deterrence mechanism under International Law. This research is grounded in the international legal framework governing inter-state conduct, including the principle of sovereignty, non-intervention, and prohibition of the use of force. The study uses doctrinal research methodology and relies on international treaty and customary law, decisions of the International Court of Justice, and academic writings to reach its findings. The study finds that whether a non-destructive cyberattack against CI constitutes a violation of international law or not is a question to be assessed on a case-by-case basis. The determination of the lawfulness of cyber response depends upon considerations like necessity and state attribution.