When Does Internet Denial Trigger the Right of Armed Self-Defense?

In 2007, Estonia suffered a crippling distributed denial of service (DDoS) cyber-attack that was traced to Kremlin-backed Russian nationalist groups. As the Estonian government and NATO allies contemplated responses, they grappled with the questions of what countermeasures were permissible under international law. The dominate view declared that, because it inflicted no physical damage, a DDoS attack cannot qualify as an “armed attack” under the U.N. Charter or the North Atlantic Treaty. This prevented Estonia and its allies from being able to legally exercise self-defense against aggressors. However, as critical infrastructure becomes increasingly digitized, the lack of physical damages looses viability as a rationale to categorically exclude all DDoS attacks from constituting armed attacks. This Note draws upon an analogy between Internet denial and naval blockades to argue in favor of treating as armed attacks DDoS attacks that threaten victims’ economic performance or critical infrastructural functions at a level similar to large-scale blockades. States suffering from this sort of DDoS attack may be able to respond in self-defense, provided such measures satisfy principles of necessity and proportionality. Using the Estonia experience as a backdrop, this Note explores methods by which victim states could assess whether a DDoS attack meets the armed attack threshold, and how principles of necessity and proportionality could be applied against disruptive cyber-attacks that are likely launched by non-state actors who may have government backing. The Note ends by comparing the proposed self-defense approach to alternative ways of dealing with DDoS attacks to shows that self-defense best promotes international peace and security.