Research and Development in Public Law

Research and Development in Public Law

Contemporary Challenges to the Law of Neutrality: Analyzing the Interaction Between the Law of Neutrality and Cyber Operations Within the Framework of the Tallinn Manual 2.0

Document Type : Original Article

Authors
Kian Biglarbeigi 1
Sattar Azizi 2
1 Ph.D. Candidate in International Law, Faculty of Law and Political Science, University of Tehran, Tehran, Iran.
2 Prof., Department of Law, Faculty of Humanities, Bu-Ali Sina University, Hamedan, Iran.
10.22034/jrpl.2025.2065349.1159
Abstract
War, as the most evident manifestation of the use of force, has been explicitly prohibited following the adoption of the United Nations Charter, pursuant to Article 2(4). Nevertheless, this prohibition has not prevented the occurrence of armed conflicts in the contemporary era, and war remains an undeniable reality of international life. Within this framework, international law, while recognizing the reality of war, has established rights and obligations for both the parties to a conflict and third states that are not directly involved in hostilities. This body of rules is recognized and articulated under the term “law of neutrality.” On the other hand, with the rapid expansion of information technology, states have become increasingly dependent on cyberspace infrastructure. This dependence, while creating new avenues for political, economic, and military interactions, has also paved the way for a new form of conflict known as “cyber warfare”—a form of warfare that fundamentally differs from traditional warfare in both nature and method of execution. However, the lack of specific treaty provisions and the scarcity of customary rules governing cyber operations represent major challenges in contemporary international law. In this regard, the Tallinn Manual 2.0, as one of the most comprehensive scholarly efforts to regulate cyberspace, holds particular significance. This document examines the applicable rules for cyber operations and attempts to outline a legal framework to address emerging challenges in this domain. Chapter 20 of the Manual, through five specific rules, explores the status of cyber operations from the perspective of the law of neutrality and provides notable analytical insights. Accordingly, the central question of this article is: What obligations and limitations govern cyber activities in light of the rules of the law of neutrality? In order to answer this question, the present study, using a descriptive-analytical method and relying on library-based sources, seeks to assess the positions presented in the Tallinn Manual 2.0 in relation to existing rules of the law of neutrality.
Keywords
Cyberspace
Cyber Infrastructure
Law of Neutrality
International Armed Conflict
Tallinn Manual 2.0
Subjects
1.        Additional Protocol Concerning the Criminalization of Acts of a Racist and Xenophobic Nature Committed through Computer System. (2003). Retrieved November 17, 2024 from https://rm.coe.int/168008160f     
2.        Ansari, B. & Asadi, Z. (2025). “The Right to Technology in International Law: From Identification to Realization”. Journal of Research and Development in Public Law, 1 (2), 79-111. doi: 10.22034/jrpl.2025.721658 (In Persian)
3.        Aslani, J., & Ranjbarian, A. H. (2015). “Comparative Review and Analysis of the Notion of CyberAttack in the Light of Doctrine, States Practice andInternational Organizations within International Law”. Legal Research Quarterly (Shahid Beheshti University), 18(71), 257–278. (In Persian)
4.        Battle, P. (2023). Dollar Tree supply chain attack could affect millions of people. MSSP Alert. Retrieved June 16, 2025 from https://www.msspalert.com/news/dollar-tree-supply-chain-attack-could-affect-millions-of-people/
5.        Beigzadeh, E. (2022). International law. Volume 2: Relations of Subjects (1st ed.). Tehran: Mizan Legal Foundation. (In Persian)
6.        Biglarbeigi, K. (2023). Cyber Attacks and Violation of the Principle of Non-Intervention. Master’s thesis, International Law. Supervised by Ebrahim Beigzadeh. Tehran: Shahid Beheshti University, Faculty of Law. Defense date: September 10, 2023. (In Persian)
7.        Biglarbeigi, K., & Azizi, S. (2025). “Conditions and requirements governing cyber operations during military occupation in light of the Tallinn Manual 2.0”. Journal of Law and Political Studies, 5(2), 215–232. [in Persian]
8.        Broeders, D. (2021). “Private active cyber defense and (international) cyber security—pushing the line?”, Journal of Cybersecurity, Vo;. 7, Iss. 1, pp. 1-14.
9.        Buchan, R. (2012). “Cyber Attacks: Unlawful Uses of Force or Prohibited Interventions?”, Journal of Conflict & Security Law, Vol. 17, No. 2 (2012), pp. 211-227.
10.     Cloudflare. (n.d.). Denial-of-service (DoS) attack. Cloudflare Learning Center. Retrieved June 16, 2025 from https://www.cloudflare.com/learning/ddos/glossary/denial-of-service/
11.     Convention (I) for the Amelioration of the Condition of the Wounded and Sick in Armed Forces in the Field. )1949). Geneva, 12 August 1949. Retrieved November 19, 2024 from https://ihl-databases.icrc.org/en/ihl-treaties/gci-1949?activeTab=1949GCs-APs-and-commentaries  
12.     Convention (II) for the Amelioration of the Condition of Wounded, Sick and Shipwrecked Members of Armed Forces at Sea. )1949). Geneva, 12 August 1949. Retrieved November 19, 2024 from https://ihl-databases.icrc.org/en/ihl-treaties/gcii-1949?activeTab=1949GCs-APs-and-commentaries  
13.     Convention (V) respecting the Rights and Duties of Neutral Powers and Persons in Case of War on Land, The Hague, 18 October 1907. Retrieved June 14, 2025 from https://ihl-databases.icrc.org/en/ihl-treaties/hague-conv-v-1907
14.     Convention (XIII) concerning the Rights and Duties of Neutral Powers in Naval War, The Hague, 18 October 1907. Retrieved June 14, 2025 from https://ihl-databases.icrc.org/en/ihl-treaties/hague-conv-xiii-1907
15.     Convention on Cybercrime (Budapest Convention). (2001). Council of Europe.  European Treaty Series – No. 185., Entered into Force on 1 July 2004. Retrieved November 17, 2024 from https://rm.coe.int/1680081561 
16.     Fleck, D. (2016). Humanitarian Law in Armed Conflict (S. G. Zamani & N. Saed, Eds., Trans., 4th ed.). Tehran: The SD Institute of Laaw Research and Study. [in Persian]
17.     Heintschel von Heinegg, W. (2013). “Territorial Sovereignty and Neutrality in Cyberspace”. International Law Studies, Vol. 89. pp.123-156.
18.     Hope, A. (2024). Massive Trello user data leak: Hacker lists 15 million records on a dark web hacking forum. CPO Magazine. Retrieved June 16, 2025 from https://www.cpomagazine.com/cyber-security/massive-trello-user-data-leak-hacker-lists-15-million-records-on-a-dark-web-hacking-forum/
19.     ICJ. (1949). Corfu Channel, United Kingdom of Great Britain and Northern Ireland v. Albania, Judgment, 9 April 1949. Retrieved June 17, 2025 from https://www.icj-cij.org/case/1
20.     ICRC. (2016). Commentary on the First Geneva Convention: Convention (I) for the Amelioration of the Condition of the Wounded and Sick in Armed Forces in the Field 1952. Retrieved February 4, 2025 from https://ihl-databases.icrc.org/en/ihl-treaties/gci-1949
21.     International Committee of the Red Cross (ICRC). (n.d.). Cyber and information operations. ICRC. Retrieved June 16, 2025 from https://www.icrc.org/en/law-and-policy/cyber-and-information-operations
22.     International Group of Experts at the Invitation of the NATO Cooperative Cyber Defence Center of Excellence. (2017). Tallinn Manual 2.0 On The International Law Applicable To Cyber Operation, Cambridge University Press.
23.     International Law Commission. (2001). Draft articles on responsibility of states for internationally wrongful acts, with commentaries. United Nations. Retrieved June 15, 2025 from https://legal.un.org/ilc/texts/instruments/english/commentaries/9_6_2001.pdf
24.     Joint Doctrine Manual Law of Armed Conflict: At the operational and tactical levels. Canadian Manual. Retrieved February 6, 2025 from https://www.fichl.org/fileadmin/_migrated/content_uploads/Canadian_LOAC_Manual_2001_English.pdf
25.     Joint Service Regulation of the Law of Armed Conflict. German Manual. Retrieved February 4, 2025 from https://www.bmvg.de/resource/blob/93610/ae27428ce99dfa6bbd8897c269e7d214/b-02-02-10-download-manual-law-of-armed-conflict-data.pdf
26.     Kovacs, E. (2024). Johnson Controls ransomware attack: Data theft confirmed, cost exceeds $27 million. SecurityWeek. Retrieved June 16, 2025 from https://www.securityweek.com/johnson-controls-ransomware-attacks-data-theft-confirmed-cost-exceeds-27-million/
27.     Law of Manual. DoD Manual. Retrieved February 6, 2025 from https://media.defense.gov/2023/Jul/31/2003271432/-1/-1/0/DOD-LAW-OF-WAR-MANUAL-JUNE-2015-UPDATED-JULY%202023.PDF
28.     Libicki, M. C., (2009). Cyberdeterrence and cyberwar, RAND Corporation.
29.     Liivoja, R., & McCormack, T. (2013). Law in Virtual Battlespace: The Tallinn Manual and the jus in bello. Yearbook of International Humanitarian Law, Vol. 15. Asser Press
30.     Margulies, P. (2015). “Sovereignty and Cyber Attacks: Technology's Challenge to the Law of State Responsibility”, Melbourne Journal of International Law, Vol. 14, pp. 1-24.
31.     PCIJ, (1927). The Case of the S.S. Lotus, France v. Turkey, Judgment, 7 September 1927. Retrieved June 14, 2025 from https://www.icj-cij.org/sites/default/files/permanent-court-of-international-justice/serie_A/A_10/30_Lotus_Arret.pdf
32.     PCIJ. (1932). Free Zones of Upper Savoy and the District of Gex, France vs. Switzerland, Judgment, 7 June 1932. Retrieved June 17, 2025 from https://jusmundi.com/en/document/decision/en-free-zones-of-upper-savoy-and-the-district-of-gex-judgment-tuesday-7th-june-1932
33.     Permanent Court of Arbitration. (1928). Island of Palmas, USA v. Netherlands, Award, Hague, 4 April 1928. Retrieved June 18, 2025 from https://pcacases.com/web/sendAttach/714
34.     Program on Humanitarian Policy and Conflict Research (HPCR) at Harvard University. (2013). Manual on international law applicable to air and missile warfare (AMW Manual) (Yoram Dinstein, B. Demeyere & C. Bruderlein, Eds.). Cambridge University Press. Retrieved June 14, 2025 from https://cdn.ca9.uscourts.gov/datastore/library/2013/09/06/Flores_Manual.pdf
35.     Proofpoint. (n.d). Cyber attack. Proofpoint Threat Reference. Retrieved June 16, 2025 from https://www.proofpoint.com/uk/threat-reference/cyber-attack
36.     Protocol Additional to the Geneva Conventions of 12 August 1949, and relating to the Protection of Victims of International Armed Conflicts (Protocol 1). (1977). Retrieved November 14, 2024 from https://www.un.org/en/genocideprevention/documents/atrocity-crimes/Doc.34_AP-I-EN.pdf 
37.     Rogers, A. P. V., & Malherbe, P. (2008). Model Manual on the Law of Armed Conflict for Armed Forces (K.N. Humanitarian Law Committee, Trans.). Tehran: Amir Kabir Publishing Institute. (In Persian)
38.     Roscini, M. (2014). Cyber Operations and the Use of Force in International Law. Oxford University Press.
39.     San Remo Manual on International Law Applicable to Armed Conflicts at Sea. (12 June 1994). International Institute of Humanitarian Law. Retrieved June 14, 2025 from https://ihl-databases.icrc.org/en/ihl-treaties/san-remo-manual-1994
40.     Sang, I. (2016). “Cyber-Attacks and the Exploitable Imperfections of International Law”, Strathmore Law Journal, Vol. 2, No. 1. pp. 205-211.
41.     Shayegan, F. (2016). “Application of the Law of neutrality in cyberspace”. Public Law Studies Quarterly, 46(2), 337–357. [in Persian]
42.     The Hague Rules of Air Warfare. (1923). Retrieved June 14, 2025 from http://lawofwar.org/hague_rules_of_air_warfare.htm
43.     The Joint Service Manual of the Law of Armed Conflict. UK Manual. Retrieved February 4, 2025 from https://assets.publishing.service.gov.uk/media/5a7952bfe5274a2acd18bda5/JSP3832004Edition.pdf
44.     Toulas, B. (2024). Hackers mint 1.79 billion crypto tokens from PlayDapp gaming platform. Bleeping Computer. Retrieved June 16, 2025 from https://www.bleepingcomputer.com/news/security/hackers-mint-179-billion-crypto-tokens-from-playdapp-gaming-platform/
45.     Trend Micro. (2024). Mother of all breaches: 26 billion records compromised. Trend Micro Security News. Retrieved June 16, 2025 from https://news.trendmicro.com/2024/01/23/mother-of-all-breaches-26-billion-records-compromised-data-leak/
46.     United Nations. (1945). Charter of the United Nations. Retrieved June 15, 2025 from https://www.un.org/en/about-us/un-charter
47.     Valuch, J., Gábriš, T., & Hamuľák, O. (2017). “Cyber attacks, information attacks, and postmodern warfare”, Baltic Journal of Law & Politics, Vol. 10, Iss. 1, pp. 63-89.
48.     Wallace, D., & Visger, M. (2018). “Responding to the Call for a Digital Geneva Convention: An Open Letter to Brad Smith and the Technology Community”. Journal of Law & Cyber Warfare, Vol. 6, No. 2 (Winter 2018), pp. 3-55.
1.        Zamani, S. G. (2025). “Impacts of Technology on Development of Frontiers of International Law”. Journal of Research and Development in Public Law, 1 (2), 319-336. doi: 10.22034/jrpl.2025.721646  (In Persian)
49.     Ziaei Bigdeli, M. R. (2021). International humanitarian law (5th ed.). Tehran: Ganj-e Danesh Publishing, in collaboration with the International Committee of the Red Cross. (In Persian)
50.     Ziaei Bigdeli, M. R. (2021). The Law of War: International Law of Armed Conflicts (7th ed.). Tehran: Allameh Tabataba’i University Press. (In Persian)
Research and Development in Public Law
Volume 2, Issue 4 - Serial Number 4
February 2026
Pages 86-128