8
apply if immediate action is needed to enforce the rights of the injured State and to prevent
further damage.
The response to a wrongful cyber operation may be in kind (but not necessarily, as per relevant
international law), on the condition that the response is commensurate with the harm suffered
and is limited to the purpose of ensuring compliance with breached obligations, thus taking into
account the seriousness of the initial violation and the rights in question. In any case,
countermeasures must not amount to a threat, or use, of force and must be consistent with other
peremptory norms, as well as with human rights and humanitarian law.
III. Cyber Operations and the Use of Force
a) Cyber operations and Article 2(4) of the UN Charter
There is no established definition or threshold of hostile cyber operations falling within the
scope of the prohibition of the ‘use of force’ in the sense of article 2(4) of the UN Charter. Such
assessment will be determined on a case-by-case basis depending on the consequences of any
given cyber operation.
Italy considers a cyber operation conducted by a State against another State as a use of force,
when its scale and effects are comparable to those of a conventional use of force, resulting in
physical damage of property, human injury or loss of life.
While it is generally accepted that cyber operations resulting in material damage can constitute
a use of force, we consider the qualification of cyber operations which merely cause loss of
functionality a controversial one. The inclusion of such operations in the scope of the
prohibition of the use of force, however, could be justified if one considers that, because of the
reliance of modern societies on computers, computer systems and networks, cyber technologies
have enabled States to cause the interruption of essential services without the need of physical
damage.