Caught in the Web: The Right to Self-Defense of Third States
as Victims of Spill-Over Effects from Cyberattacks

Yannick Zerbe

The advent of cyberattacks has reinvigorated the decades-old academic debate about the nature and extent of
the right to self-defense under international law. The debate has mainly focused on the bilateral relationship
of the attacking State and the directly targeted victim State. However, the increasingly indiscriminate nature
of cyberattacks calls for a legal assessment of the right to self-defense of third States that are incidentally
affected by such operations. This article analyses whether the incidental harm of cyberattacks can amount to
an "armed attack" for the purposes of Article 51 of the UN Charter. The discussion centers around the question
whether an attacker’s intent (animus aggressionis) is needed to qualify the incidental effects as an armed attack against a third State. Should standards of recklessness or general intent to harm suffice, defensive actions by third States could theoretically be lawful. The author cautions that while self-defense is crucial, its invocation should not trivialize its exceptionality, ensuring it remains a deterrent against malicious cyber activities.