Security teams read government attributions, sanctions notices and joint advisories every month, yet few know the legal and diplomatic framework those statements come from. International law already applies to what states do in cyberspace, and since 2015 the UN membership has also agreed a set of voluntary, non-binding norms of responsible state behaviour. This guide explains that framework in practitioner terms: the UN Charter and international humanitarian law, the 11 UN norms, the Tallinn Manual, how state attribution works, and the treaties that govern cybercrime. It is written for threat intelligence analysts, CISOs and policy teams in critical infrastructure who need to read these documents accurately and act on them. Status line: the processes described were checked on official UN, ICRC, Council of Europe, CCDCOE and CISA pages on 27 October 2026; UN processes move, so confirm current status before quoting it.
Key takeaways
- International law applies to cyberspace: the 2021 UN Group of Governmental Experts (GGE) report reaffirms that international law, and in particular the UN Charter, is applicable and essential to peace and stability in the ICT environment.
- The 11 norms are voluntary but agreed: norms 13(a) to 13(k) cover cooperation, attribution, critical infrastructure, supply chain integrity, vulnerability reporting and the protection of CERTs and CSIRTs, and they map directly onto defenders' work.
- Attribution is technical, legal and political: the GGE notes that activity coming from a state's territory is not by itself enough to attribute it to that state, and the UK position states there is no general legal duty to publish the evidence behind an attribution.
- The Tallinn Manual is scholarship, not law: it is a non-legally-binding expert work that is widely cited, so read it as an informed view of how existing law may apply.
- The UN track is now permanent: the Open-ended Working Group (OEWG) 2021 to 2025 adopted its final report in July 2025 and decided to establish a Global Mechanism on developments in the field of ICTs, with an organisational session in March 2026.
Why this matters to defenders
None of this changes how you patch a VPN appliance. It does change how you interpret what governments say, what they expect from operators of critical infrastructure, and what can follow from an incident. Practitioners meet the framework in four places.
- Joint advisories: when CISA, NSA, FBI and partner agencies in Australia, Canada, the UK and New Zealand co-sealed advisory AA24-038A on 7 February 2024, they attributed activity to People's Republic of China state-sponsored actors (Volt Typhoon) and assessed with high confidence that the actors were pre-positioning on IT networks to move to OT systems in a future crisis. That language reflects the norm against damaging critical infrastructure.
- Sanctions and legal consequences: the EU adopted Council Decision (CFSP) 2019/797 on 17 May 2019, creating restrictive measures against cyber-attacks threatening the Union or its Member States. EUR-Lex currently lists the decision as valid until 18 May 2027, so check for renewal.
- Requests for assistance: norms 13(c) and 13(h) expect states to respond to requests about malicious activity from their territory. In practice this flows through national CERTs, which is why your incident reports to the national CSIRT matter beyond your own organisation.
- Threat models: the norms describe what restraint is expected. Activity that crosses them, such as hidden functions planted in the supply chain or attacks on emergency response teams, is a signal about intent, not only capability.
For the operational picture of state conflict in cyberspace, see the Cyber Warfare Guide. This guide covers the legal and normative layer underneath it.
The legal baseline: UN Charter, sovereignty and use of force
Section IV of the 2021 GGE report (A/76/135, transmitted on 14 July 2021) restates the principles all states accepted by consensus. The report lists sovereign equality, peaceful settlement of disputes under Article 33 of the Charter, state sovereignty and jurisdiction over ICT infrastructure on their territory, non-intervention in the internal affairs of other states, and refraining from the threat or use of force. States also published national positions explaining how they read these rules. The UK statement of 3 June 2021 is a useful worked example because it is specific.
| Rule | What it means for cyber operations | Example given in official positions |
|---|---|---|
| Sovereignty | States have jurisdiction over ICT infrastructure in their territory. Whether sovereignty is also a standalone rule that a remote cyber operation can breach is disputed: the UK does not see a separate cyber-specific prohibition beyond non-intervention. | UK statement, 2021 |
| Non-intervention | Prohibits coercive interference in matters within another state's sovereign choice, below the use-of-force threshold. | UK lists manipulating an electoral system to alter results, undermining financial system stability, and targeting essential medical services |
| Use of force (Charter Art. 2(4)) | Cyber conduct can be a use of force if its actual or threatened effects are similar to kinetic conduct. | UK statement, 2021 |
| Armed attack and self-defence (Art. 51) | An operation whose scale and effects are equivalent to a kinetic armed attack can trigger self-defence, subject to necessity and proportionality, by cyber or kinetic means. | Physical destruction, injury and death are the key factors |
| Countermeasures | A state injured by a wrongful act may respond with otherwise unlawful but proportionate measures, which may be cyber measures even when the original wrong was not. | UK does not consider prior notice a legal obligation in all cases, for example after covert intrusions |
| Due diligence | Whether states have a binding duty to stop wrongful acts from their territory is unsettled. | UK treats norm 13(c) as non-binding and says state practice is not yet enough for a customary rule |
Two practical points follow. First, espionage on its own is generally not addressed by a specific prohibition, which is why mass intelligence collection such as the Microsoft Midnight Blizzard breach is usually answered with public attribution and defensive guidance rather than claims of armed attack. Second, positions differ between states, so read each national statement as that state's view rather than settled law.
International humanitarian law in cyber operations
International humanitarian law (IHL) governs conduct during armed conflict. The GGE report notes that IHL applies only in situations of armed conflict, recalls the principles of humanity, necessity, proportionality and distinction, and states that recalling them "by no means legitimizes or encourages" conflict. The UK position adds that a cyber operation is an attack under IHL if its effects are similar to a kinetic attack, and that civilians who carry out cyber attacks lose protection while they take a direct part in hostilities. The ICRC position paper on IHL and cyber operations warns that cyber operations can seriously affect civilian infrastructure and might result in human harm.
In October 2023 two ICRC advisers published eight rules for civilian hackers during armed conflict and four obligations for states. They are a clear statement of what the ICRC considers off limits, and they line up with what defenders care about most.
| ICRC rule for civilian hackers (summary) | Defender relevance |
|---|---|
| 1. No cyber attacks against civilian objects | Most enterprise networks are civilian objects |
| 2. No malware or tools that spread automatically and damage military and civilian objects indiscriminately | Self-propagating wipers are the clearest case of indiscriminate effect |
| 3. When targeting military objectives, avoid or minimise civilian harm; stop if harm may be excessive or effects are not understood | Shared cloud and telecoms infrastructure creates spillover |
| 4. No cyber operations against medical and humanitarian facilities | Hospitals, health suppliers and humanitarian organisations |
| 5. No attacks on objects indispensable to the survival of the population or that can release dangerous forces | Water, irrigation, dams, nuclear and chemical plants |
| 6. No threats of violence to spread terror among civilians | Hack-and-leak and intimidation campaigns |
| 7. No incitement of IHL violations, including sharing technical details to help attacks on civilian targets | Hacktivist channels sharing target lists |
| 8. Comply even if the enemy does not | Reciprocity is not a defence |
The four state obligations are: responsibility for hackers acting on a state's instructions, direction or control; not encouraging violations; due diligence to prevent violations on the state's territory; and prosecuting war crimes. For organisations, the relevant lesson is that hacktivist activity during a conflict may be state-linked, and the legal framework expects states to restrain it, which they often do not.
The 11 UN norms of responsible state behaviour
The norms first agreed in the 2015 GGE report were reaffirmed and given detailed guidance in the 2021 GGE report. The summaries below follow the 2021 text. They bind no one legally, but every UN member state has welcomed the reports, and they are the reference point in diplomatic responses to incidents.
| Norm | Summary | What it means operationally |
|---|---|---|
| 13(a) | Cooperate to increase stability and security and prevent harmful ICT practices | Information-sharing arrangements between states and CERTs |
| 13(b) | In case of incidents, consider all relevant information, including the wider context, attribution challenges and the nature and extent of consequences | Basis for cautious, evidence-led attribution |
| 13(c) | Do not knowingly allow territory to be used for internationally wrongful acts using ICTs | Notified states should acknowledge and make reasonable efforts to assist |
| 13(d) | Cooperate on exchanging information, assisting each other and prosecuting criminal and terrorist use of ICTs | Law enforcement cooperation, takedowns |
| 13(e) | Respect human rights, including freedom of expression, online as offline | Limits on surveillance and internet shutdowns |
| 13(f) | Do not conduct or knowingly support ICT activity contrary to international law that intentionally damages critical infrastructure | The norm most often cited against pre-positioning in utilities |
| 13(g) | Take appropriate measures to protect critical infrastructure from ICT threats | National CI regulation and designation |
| 13(h) | Respond to appropriate requests for assistance from states whose critical infrastructure is attacked | CERT-to-CERT mitigation requests |
| 13(i) | Take reasonable steps to ensure supply chain integrity and prevent malicious ICT tools, techniques and harmful hidden functions | Product security, SBOM and hardware assurance |
| 13(j) | Encourage responsible reporting of ICT vulnerabilities and share information on remedies | Coordinated vulnerability disclosure |
| 13(k) | Do not harm authorised emergency response teams or use them for malicious international activity | CERTs and CSIRTs are protected actors |
The 2021 guidance also highlights health care and medical infrastructure among the sectors to protect, and refers to "the technical infrastructure essential to the general availability or integrity of the Internet" as critical because it serves many states. It recommends national Points of Contact at policy, diplomatic and technical level to manage serious incidents and reduce escalation. Norms 13(i) and 13(j) are where enterprise programmes most directly meet the framework: see the Bug Bounty and Vulnerability Disclosure Guide and the Hardware Trojans and Chip Supply Chain Guide.
The UN processes: GGEs, OEWGs and the Global Mechanism
The framework above came out of a series of UN bodies. Knowing which body produced a document tells you how much weight it carries.
| Process | Membership | Key output and status |
|---|---|---|
| Groups of Governmental Experts (six since 2004) | Limited, selected states | Four consensus substantive reports, each building on the last; the sixth (2019 to 2021) produced A/76/135 |
| OEWG 2019 to 2021 | All member states, with consultations with industry, civil society and academia | Established by resolution 73/27 (December 2018); consensus report A/75/816 in March 2021 |
| OEWG 2021 to 2025 | All member states | Established by resolution 75/240 of 31 December 2020; eleventh and final substantive session 7 to 11 July 2025; final report adopted July 2025 |
| Programme of Action proposal | All member states | First resolution A/RES/77/37 in 2022; Secretary-General report A/78/76 |
| Global Mechanism on developments in the field of ICTs in the context of international security | All member states | Decided in the OEWG final report; UN General Assembly resolution establishing it in November 2025; organisational session March 2026 |
The Global Mechanism is described by UNIDIR as a permanent platform for dialogue on state use of ICTs, covering information sharing, good practice, capacity building and implementation of agreed measures. Its detailed working methods were still being settled when this guide was checked, so treat any description of its structure as provisional.
The Tallinn Manual and how to read it
The Tallinn Manual is produced by an international group of experts under the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE) in Tallinn and published by Cambridge University Press. The first edition (2013) focused on the most severe operations, those involving the use of force and armed conflict. Tallinn Manual 2.0 (2017) extended the analysis to operations below those thresholds, which is where most real state activity sits. CCDCOE describes it as a non-legally-binding scholarly work that does not represent the position of any state or organisation, including CCDCOE itself. A Tallinn Manual 3.0 project was launched in 2021 as a five-year effort.
- Use it for: structured analysis of how sovereignty, due diligence, state responsibility and IHL may apply, and the range of expert views where they disagree.
- Do not use it as: a statement of what any government will do. Compare it with national positions such as the UK statement, which on sovereignty takes a narrower view than the majority of the Tallinn experts.
- Cite carefully: say "the Tallinn Manual 2.0 experts considered" rather than "international law says".
State attribution in practice
Attribution has two meanings, and confusing them causes most of the misreadings. The UK statement separates legal attribution (whether a wrongful act is the responsibility of a state under the rules on state responsibility) from non-legal attribution (identifying the hostile actor). States are responsible for acts of persons acting on their instructions, direction or control, and the GGE report says states should not use proxies for wrongful ICT acts. The GGE also says accusations should be substantiated and that origin from a state's territory is not by itself sufficient. Public attribution is a policy decision, and there is no general legal duty to publish the underlying evidence.
| Statement type | Who issues it | What it tells you | How to use it |
|---|---|---|---|
| Vendor actor naming | Security companies | Technical clustering of activity under a vendor name | Map names across vendors; see the Cyber Threat Attribution Guide |
| Joint cybersecurity advisory | Government agencies, often several countries | Attribution to a state-sponsored actor plus TTPs and mitigations | Highest-value input: act on mitigations and hunt for listed behaviours |
| Political attribution statement | Foreign ministries, coalitions of states | A state is held responsible, often referencing the UN norms | Informs geopolitical risk and sector targeting |
| Sanctions listing | EU Council, national governments | Named persons or entities face restrictive measures | Compliance screening; legal advice on dealings with listed parties |
| Criminal indictment | Prosecutors | Evidence-based allegations against individuals | Detailed technical narrative, often the richest public evidence |
For your own programme, the same discipline applies at a smaller scale: you rarely need legal attribution to defend, but you do need confidence statements, source grading and a record of what evidence supports each judgement. The Threat Intelligence Guide covers the production side.
Cybercrime treaties: Budapest and the UN Convention
Norms and the law of state responsibility cover states. Criminal acts by individuals are handled through criminal law and mutual legal assistance.
- Council of Europe Convention on Cybercrime (Budapest Convention, ETS No. 185): the long-standing multilateral cybercrime treaty, open to non-European states, with two additional protocols. Check the Council of Europe treaty office for the current list of parties.
- United Nations Convention against Cybercrime: adopted by the General Assembly on 24 December 2024 and opened for signature at a ceremony in Hanoi, Viet Nam, on 25 October 2025. It remains open for signature at UN Headquarters until 31 December 2026 and enters into force once 40 states have become parties. At the date checked, UNODC directed readers to the UN Treaty Collection for current signature and ratification status.
For organisations, these treaties shape how quickly law enforcement can obtain evidence across borders, including subscriber data and preserved logs, which in turn affects how long you should retain evidence after an incident.
Where identity fits
State operations that raise questions under the norms usually run on stolen identities. Advisory AA24-038A states that Volt Typhoon "primarily relies on valid credentials for persistence", obtained administrator credentials from edge devices, and repeatedly extracted the Active Directory database. Protecting privileged and machine identities in critical infrastructure is therefore the most direct way an operator supports norm 13(g). See the China State Cyber Operations Guide for actor detail.
Framework mapping
| Framework | Reference | Link to this topic |
|---|---|---|
| NIST CSF 2.0 | GV.OC-03 | Legal, regulatory and contractual requirements, including sanctions and cross-border evidence rules, are understood and managed |
| NIST CSF 2.0 | ID.RA-02, ID.RA-03 | Threat intelligence from government advisories is received; state threats are identified and recorded |
| NIST CSF 2.0 | RS.CO-03 | Information shared with external stakeholders such as the national CSIRT |
| NIST SP 800-53 Rev. 5 | PM-16, SI-5, IR-6 | Threat awareness programme, security alerts and advisories, incident reporting |
| NIST SP 800-53 Rev. 5 | SR-3 | Supply chain controls, the enterprise side of norm 13(i) |
Measuring how well you use this framework
- Advisory time to action: days from a joint government advisory to completed mitigations on affected assets.
- Hunt coverage: share of listed behaviours from state-actor advisories hunted for within 30 days.
- Reporting rate: share of qualifying incidents reported to the national CSIRT within the agreed time.
- Attribution hygiene: share of intelligence reports that state source and confidence for every attribution claim.
Common failure patterns
- Treating norms as law: briefing a board that a state "broke international law" when it acted against a voluntary norm. Separate the two in every report.
- Quoting the Tallinn Manual as the law: it is an expert view, and some states reject parts of it.
- Equating IP geolocation with state responsibility: the GGE explicitly says origin from a territory is not enough, and proxies and compromised infrastructure are common.
- Ignoring pre-positioning advisories because "it is only espionage": AA24-038A says Volt Typhoon targeting was not consistent with traditional espionage and pointed to disruption in a crisis.
- Not reporting to the national CERT: norm-based assistance and diplomatic responses depend on states having incident data, much of which only operators hold.
- Quoting stale status: UN processes, sanctions decisions and treaty ratifications change; a status line without a date misleads.
Practitioner checklist
- Keep a dated reference list of the 2021 GGE norms, the OEWG final report and your own government's national position on international law in cyberspace.
- Route joint government advisories into intelligence intake with a named owner and a deadline to act on mitigations.
- In intelligence reports, separate vendor naming, government attribution and legal responsibility, with confidence levels.
- Screen suppliers and payments against cyber sanctions listings where your legal team advises it.
- Agree with legal counsel when and how incidents are reported to the national CSIRT and law enforcement, including evidence retention periods.
- Prioritise privileged and machine identity controls on systems that are critical infrastructure, since state actors rely on valid credentials.
- Run a tabletop on a state-linked disruptive incident that includes government liaison and public statements.
- Recheck the status of the Global Mechanism, the UN Convention against Cybercrime and EU sanctions at least every six months.
Standards and references
- United Nations: Report of the Group of Governmental Experts on Advancing Responsible State Behaviour in Cyberspace (A/76/135)
- UN Office for Disarmament Affairs: Developments in the field of ICTs in the context of international security
- UNIDIR: Insights into the Global Mechanism on ICT security
- ICRC: International humanitarian law and cyber operations during armed conflicts
- ICRC Humanitarian Law and Policy Blog: 8 rules for civilian hackers during war, and 4 obligations for states to restrain them
- UK FCDO: Application of international law to states' conduct in cyberspace
- NATO CCDCOE: The Tallinn Manual
- UNODC: United Nations Convention against Cybercrime
Related NHI Mgmt Group resources: Cyber Warfare Guide · Cyber Threat Attribution Guide · Threat Intelligence Guide · China State Cyber Operations Guide. This guide summarises international law and UN norms on state behaviour in cyberspace and is not legal advice.