Cyber espionage, sabotage, cyberwarfare: how they differ

Three questions instead of one word

To name an operation in cyberspace, three questions need answering. Did someone want information, or damage? Was the damage physical? And did it happen during an armed conflict? The answers decide which law applies – domestic criminal law, general international law or the law of war.^2,6

The International Committee of the Red Cross puts it plainly: international humanitarian law does not regulate cyber operations that fall outside a situation of armed conflict. Cyber espionage and cyber crime worry businesses and governments, but – as the ICRC writes – although the technical protective measures may be similar, the law governing these operations is not.²

The proposed terms published by Poland’s National Security Bureau (BBN) in 2020 describe cyberwarfare as a destructive – disruptive or damaging – cyber conflict with political aims, waged between states. Theft of data without destruction does not meet this definition.⁷

Cyber espionage: take, don’t break

Cyber espionage means obtaining other people’s information through networks and systems: its target is confidentiality, not the functioning of the system (see confidentiality, integrity, availability). EU documents often describe the perpetrators of such operations as APT groups – APT10 is one example.^6,8

The main academic reference point is the Tallinn Manual 2.0 – a work by nineteen international law experts under Michael Schmitt, whose process was led by the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE) in Tallinn, published by Cambridge University Press in 2017. It is an updated and considerably expanded second edition of the 2013 manual. The CCDCOE stresses that the Manual represents the views of its authors, not of NATO.¹

According to the Tallinn Manual 2.0, peacetime cyber espionage by states does not per se violate international law, although the method by which it is carried out might. A majority of the experts held that the mere fact that an operation is espionage does not make it lawful; a minority saw espionage as an exception to other prohibitions. Such operations are usually prohibited under the domestic law of the target state.⁶

Poland is a case in point. Since 1 October 2023, Article 130(3) of the Criminal Code has penalised, among others, anyone who, in order to pass to a foreign intelligence service information whose disclosure may harm Poland, enters an IT system to obtain it – the penalty is six months to eight years’ imprisonment (see espionage).⁵

An example from an EU document: according to the Council of the EU, “Operation Cloud Hopper”, attributed to APT10, targeted information systems of multinational companies on six continents and gained unauthorised access to commercially sensitive data, resulting in significant economic loss.⁸

Sabotage: break, switch off, destroy

Sabotage in cyberspace is action intended to cause harm: blocking a system, destroying data, switching off equipment. The Polish Criminal Code treats it far more severely than espionage. For subversion or sabotage committed as part of, or on behalf of, a foreign intelligence service, Article 130(7) provides for at least ten years or life imprisonment, and even preparations carry six months to eight years (§ 8).⁵

The EU sanctions regime of 2019 covers both kinds of activity. Council Decision 2019/797 counts as cyber-attacks, among other things, access to information systems and data interception, but also information system interference – hindering or interrupting a system’s functioning – and data interference: deleting, damaging, altering or suppressing data (Art. 1(3) and Art. 2).⁴

A textbook case of sabotage is NotPetya in June 2017. According to the Council of the EU, it rendered data inaccessible in a number of companies in the Union, and the UK government attributed it to the Russian military. The Council links the same GRU unit, GTsST, to the attacks on a Ukrainian power grid in the winter of 2015 and 2016, which resulted in parts of it being switched off.^8,9

Restraint in such activity is also a UN political norm. In its report of 22 July 2015 (A/70/174), the Group of Governmental Experts recommended that states should not conduct or knowingly support ICT activity, contrary to their obligations under international law, that intentionally damages critical infrastructure.¹⁰

Cyber attack in the sense of the law of war

In the law of armed conflict, “attack” has a narrow meaning. The Tallinn Manual (Rule 30 of the 2013 edition) defines a cyber attack as a cyber operation, whether offensive or defensive, that is reasonably expected to cause injury or death to persons or damage or destruction to objects. According to the Manual, injury also includes serious illness and severe mental suffering.¹¹

The ICRC points out that humanitarian law applies to cyber operations that amount to, or are conducted in the context of, an armed conflict. The key question is therefore when a cyber operation takes place in the course of an armed conflict.²

A frequently cited example is Stuxnet, aimed at the centrifuges of Iran’s Natanz uranium enrichment facility. Marco Roscini writes that, had it been carried out during an armed conflict, it would have qualified as an attack. He notes, however, that it is still not confirmed whether Stuxnet destroyed any centrifuges: Iran denied significant damage, and the IAEA reported that Iran stopped feeding uranium into thousands of centrifuges, though it is unclear whether this was due to Stuxnet or to technical malfunctions. Roscini refers only to the states “allegedly” responsible, without naming them.¹¹

NATO: when a cyber attack is an armed attack

At the Wales Summit in 2014, NATO Allies recognised cyber defence as part of the Alliance’s core task of collective defence and affirmed that international law applies in cyberspace. At the Warsaw Summit in 2016 they recognised cyberspace as a domain of operations, just like air, land and sea.¹²

Since 2014 NATO has held that a cyber attack could be grounds to invoke Article 5 of the Washington Treaty. The 2021 policy adds that, in certain circumstances, significant malicious cumulative cyber activities might also be considered an armed attack.³

In 2015 the UN Group of Governmental Experts stated that international law, and in particular the UN Charter, is applicable to the use of ICTs by states, and noted the inherent right of states to take measures consistent with international law and as recognised in the Charter, while recognising the need for further study of the matter.¹⁰

Why the distinction matters

The name determines the response. Espionage is usually prohibited by the domestic law of the target state, so the response is often a criminal trial. For cyber-attacks with a significant effect – whether espionage or sabotage – the EU imposes sanctions, as in its 2020 decision. The law of war comes into play only when an operation is part of an armed conflict.^2,6,8

Each of these responses first requires identifying the perpetrator. The 2015 UN report warns that the indication that an ICT activity was launched from or otherwise originates in a state’s territory may be insufficient in itself to attribute it to that state. How states go about it is the subject of our article Attribution: how states name the perpetrators of cyber attacks and of the map Attributing a cyber attack.¹⁰