Self-Defence 27. The customary international law right to self-defence is acknowledged in Article 51 of the UN Charter, which states: “Nothing in the present Charter shall impair the inherent right of individual or collective self-defence if an armed attack occurs against a Member of the United Nations, until the Security Council has taken measures necessary to maintain international peace and security.” States can invoke the right to self-defence in response to an “armed attack”. Not every threat or use of force within the meaning of Article 2(4) of the Charter will amount to an armed attack and it is necessary to consider scale and effects.20 28. A cyber-operation that by virtue of its scale and effects reaches the threshold of an armed attack would permit the exercise of self-defence in accordance with Article 51 and customary international law. Due to the nature of a cyber-operation, it seems that only in exceptional circumstances could it reach the threshold of “armed attack”. To reach this threshold, the scale and effects of a cyber-operation must correspond to an armed attack involving a physical use of force. It is conceivable that this need not necessitate physical damage, where for example loss or impairment of functionality to ICT infrastructure is inflicted on such a scale and with such effects that it is comparable to a conventional armed attack. International Humanitarian Law 29. International humanitarian law (IHL) applies in situations of armed conflict (international or non-international). Cyber operations that take place in the context of, or themselves amount to, an armed conflict are regulated by IHL, including the principles of humanity, necessity, proportionality and distinction. States, through the GGE, have acknowledged the relevance of these key IHL principles to the use of ICTs by states.21 30. Cyber operations that have similar effects to physical military operations constituting armed force will bring into existence an international armed conflict if conducted between states, and can bring into existence a non-international armed conflict if the usual criteria are satisfied, namely that the violence has reached the requisite level of intensity and that it is between at least two organised parties. 31. The concept of an “attack” in IHL encompasses cyber operations expected to cause death, injury or physical damage. In Ireland’s view it also extends to cyber operations expected to cause loss of functionality to networks or electronic systems. To interpret the term otherwise would mean that a cyber-operation that is directed at making a civilian network (such as electricity, banking, or communications) dysfunctional, or is expected 20 Military and Paramilitary Activities in and against Nicaragua (Nicaragua v United States of America) Merits Judgment, ICJ Reports 1986. 21 A/70/174 Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security, Report (22 July 2015), [28(d)].