Wars Without WeaponsThe law struggles to catch up with cyber conflict

A hacker can shut down a hospital without firing a shot. International law still struggles to say whether that counts as an attack, who did it, and what the victim may do back.

For most of history, war was easy to recognise. Armies wore uniforms, crossed borders and left wreckage behind. Cyber conflict breaks every one of those cues. There is no weapon to photograph, no soldier to identify, and often no border crossed in any sense a court would recognise.

A 2025 open-access paper in the China Quarterly of International Strategic Studies sets out why the law has struggled to keep up. Khoirunnisa and colleagues argue the core obstacle is definitional: nations cannot regulate a threat they cannot agree on. This piece takes their argument, tests it, and brings it up to date with what has happened since.

In brief

• The problem: There is no agreed legal definition of a "cyber threat" or of when a hack becomes an act of war.
• The blocker: Attribution. A state can only lawfully respond in self-defence if it can prove who attacked it.
• The divide: China and Russia push cyber sovereignty (state control of national networks). Western states push an open internet. Consensus stalls between them.
• What's new since the paper: The UN now has a permanent cyber forum (from March 2026) and its first cybercrime treaty (signed in Hanoi, October 2025). Neither settles the war question.
• The evidence gap: Western agencies have since published detailed, named attributions of Chinese state hacking of critical infrastructure. That is far stronger than the paper's "has been accused".

Warfare without weapons

Cyber conflict differs from conventional war on four counts, the authors argue.

The damage is not merely virtual. The Stuxnet worm, discovered in 2010 and widely attributed to the US and Israel, physically wrecked uranium-enrichment centrifuges at Iran's Natanz facility. In 2017, WannaCry ransomware disrupted hospitals across the UK's National Health Service.

The paper's sharpest point is that cyber attacks routinely hit civilian systems: power grids, hospitals, banks. That blurs the line between military and civilian targets that the laws of war depend on.

When does a hack become an act of war?

Only when its effects match those of a conventional weapon. Under the UN Charter, Article 2(4) bans the use of force, and Article 51 allows self-defence against an "armed attack". A cyber operation qualifies only if it causes comparable death or destruction.

Most hostile cyber activity sits on the lower rungs. That is the uncomfortable gap the paper identifies. The International Court of Justice set a high evidence bar for armed attack in Nicaragua v. United States (1986). Most hacks fall below it, however damaging.

The Tallinn Manual 2.0, written by international law experts, is the most detailed guide to applying these rules in cyberspace. But it is not binding, and China has never endorsed it.

The attribution problem

Self-defence is only lawful against a known attacker, and cyber attackers work hard not to be known. Operations are routed through hijacked home routers and servers in third countries. State agencies blend in with criminal gangs, or hire them.

That creates two legal gaps the paper highlights:

• No proof, no response. A state that cannot prove responsibility to a high standard risks breaking the law itself if it hits back.
• No combatants. The laws of war expect fighters to carry arms openly and wear insignia. A contractor typing commands from an office block meets neither test, so their legal status is murky.

Attribution is not impossible, though. It is slow, expensive and political. As the next sections show, governments have become far more willing to name names.

Two visions of the internet

The deepest obstacle is not technical but philosophical. The great powers disagree about what cyberspace is.

China's Great Firewall is the clearest expression of the sovereignty model. The paper notes the tension this creates. Beijing defends strict control of its own networks, while being accused of offensive operations inside other states' networks.

The divide also shapes the attribution fight. When Western agencies named the Volt Typhoon group as Chinese, China's national computer virus emergency centre (CVERC) issued a series of reports in 2024 calling it a US disinformation campaign. Security firm Trellix said one report misused its research to support conclusions its work did not show. Attribution, in short, is contested as a matter of policy.

What the paper missed, and what has happened since

The law has moved, but around the edges. The UN now has a permanent cyber forum and a cybercrime treaty. Neither answers the question at the heart of the paper: when does a hack become war?

The last two rows matter most for the paper's argument. Its China claims rest on "has been accused". Since 2024, allied governments have published named, technically detailed attributions. Pre-positioning to disrupt power and water in a future crisis is closer to preparing an armed attack than to spying.

AI: shield and sword

The paper's main recommendation is to use artificial intelligence for defence. It calls the catch the "AI conundrum": the same tools that spot intrusions faster also help attackers move faster.

• As a shield, AI can sift huge volumes of network logs and flag anomalies that human analysts would miss.
• As a sword, it lowers the skill needed to write convincing phishing, find weak points, and adapt malware.

The argument is sound but thin. The paper names no defensive programme, gives no figures, and does not engage with how AI changes attribution. That last point matters most. If AI agents can act at speed and scale with little human direction, the question "which state did this?" may become even harder to answer.

Weighing the evidence

The paper is a useful primer, but its evidence is weaker than its conclusions. It is a desk-based legal review: no new data, interviews or case analysis.

Context worth knowing: the authors are Indonesian, and the journal is published by the China Institute of International Studies, a think tank under China's foreign ministry. That may explain the cautious wording on China. It does not by itself undermine the legal analysis.

What it means for Australia

International law will not protect your network in time. Treaties take years; state actors are already inside. ASD says the APT40 tradecraft it documented is regularly observed against Australian networks. Its Volt Typhoon guidance warns Australian critical infrastructure could be vulnerable to the same activity.

Three practical takeaways:

1. Patch the edge first. Both APT40 and Volt Typhoon entered through internet-facing devices: VPNs, remote-login appliances and old routers. ASD's Essential Eight is the baseline.
2. Assume blended threats. State actors hide in criminal traffic and hijacked home and office devices. Detect behaviour, not just known bad addresses.
3. Watch the treaty track. The Hanoi Convention needs 40 ratifications to take effect. How states, Australia included, weigh its data-sharing powers against human-rights safeguards will shape cross-border investigations.

The paper is right that the world needs a shared definition of cyber conflict. On current evidence, it will not get one soon. Until then, resilience at home does more than rules abroad.