The existing international laws of war, known as the Law of Armed Conflict (LOAC), apply to all operational theatres, including cyberspace. International law distinguishes between two forms of aggression, both of which are impermissible under LOAC: the use of force, and armed attack. Absent an authorisation of force by the UN Security Council, only states under armed attack are legally allowed to deploy military force against another state.
Cyberspace is functionally distinct from land, air, sea and space. This distinction has a number of sources. First, cyberspace is the only man-made domain of warfare: the character of the domain space has been defined, and will continue to be defined, solely by human activity. Second, cyberspace is an intrinsically informational domain: it is used to create, organise, transfer, manipulate, assimilate and disseminate data. Cyberspace, in other words, consists of information and has an intrinsic informational raison d’être. It is a categorical mistake to treat the physical computing assets that sustain cyberspace as the domain of cyberspace itself.
Read the whole Strategic Updatehere.