Tallinn Manual 1.0 – A Primer

By Shalini S

The Tallinn Manual[1], is an elaborate, academic body of work that examines the applicability of international law to cyber conflicts.  The Manual was prepared by an International Group of Experts (a group of independent international law scholars and practitioners) at the invitation of the NATO Cooperative Cyber Defence Centre of Excellence. The Centre tasked the group of experts with producing a ‘manual on the law governing cyber warfare’.

Object of Creation

Presumably, the basis for curating such a manual is a common understanding amongst scholars that international law as it exists, does undeniably apply to cyberspace.[2]  However, efforts must be directed towards determining precisely how it applies, a view also endorsed by UN Group of Government Experts (UNGGE) in the field of IT.[3] Recognizing cyberspace as a viable battlefield (with states developing cyber offensive capabilities), also presumes that computer network attacks may be governed by International Humanitarian Law in the same manner that traditional weapons are regulated.[4]

The primary objective of the authors of the manual was to identify laws of armed conflict that apply to cyberspace and delineate the limits and modalities of its application. The manual which is designed as a reference tools for policymakers to build on, principally focuses on jus ad bellum[5] and jus in bello in cyberspace.[6] The book is divided into black-letter rules, products of consensus and unanimity among the authors. It also contains accompanying commentary that indicate the rules’ legal basis, applicability in international and non-international armed conflicts, and normative content. Outlined also, are conflicting or differing positions among the Experts as to the rules’ scope or interpretation.[7]

The manual examines the proper conduct of hostilities in cyberspace to minimize unnecessary harm by assessing below-mentioned critical areas:[8]

“1. What constitutes direct participation in hostilities, thereby delineating what civilians can (and cannot do) with respect to military cyber operations;

  1. What types of cyber events can constitute “attacks,” including those affecting computer functionality;
  2. How the principle of neutrality applies to cyber operations;
  3. Whether and how entities deserving special protections under the LOAC, e.g., the Red Cross, must identify themselves in cyberspace;
  4. How to treat non-state actor cyber operations and incidents.”

While the manual itself only offers guidelines to append analogies from established international law principles to cyber conflicts, it has sometimes been understood (in the absence of an overriding caveat to the contrary effect) to encourage hostile or military use of information and communications technology – an invitation to cyber war.[9]


The definition of cyber-attack as laid down in the manual has often been criticized for its narrow understanding.[10] While this is attributable to the high threshold to be met by an act to constitute ‘armed conflict’ in international law,[11] the manual fails to clarify the implications of attacks that cause consequential harm, impair functionality without causing physical damage and target physical infrastructure that relies on computer systems.[12] Questions abound on the relationship between cyber warfare operations and lawful self defence.[13] Understandably, scholars opine that cyber warfare poses unique challenges to contemporary jus ad bellum– the body of law governing legitimate use of force.[14] It is also difficult to ‘attribute’ wrongful acts commissioned by states in the existing framework of international law.[15] Uncertainty over applicability of decisions of landmark cases such as the Nicaragua case[16] that decided issues of attribution and state responsibility, to cyberspace is also a cause for concern.[17]

Further, the absence of an international cyberspace law or a cyber security treaty is the most evident limitation on achieving international regulation in cyber space. Consequently, the Tallinn manual which is a non-binding body of personal opinions has been criticized for being premature and undesirable when no universally acceptable cyber security norms exist.[18] Despite the criticism leveled against it, academic collaboration akin to the one that resulted in the publication of the Tallinn Manual is necessary alongside policy deliberations to consider the exact application of international law to conflicts in cyberspace.

Way Forward

The Tallinn Manual 1.0 attempted to “delineate the threshold dividing cyber war from cybercrime and formalize international rules of engagement in cyber space”.[19] It did so by laying down 95 ‘black-letter rules’, focused on codifying principles applicable to cyber-attacks that qualified as armed conflict, an effort that needs to be continued.  Thus, the second iteration to the Tallinn Manual, the Tallinn Manual 2.0, aims to explore peacetime principles[20] such as sovereignty, jurisdiction, state responsibility and intervention in the context of borderless cyberspace.

With the International Court of Justice confirming[21] that use of force provisions in the UN charter apply regardless of the weapon used,[22] customary international law assumes a prominent position in construction of a safer cyber landscape and must be deliberately studied. The NATO Cooperative Cyber Defence Centre of Excellence has in the past, specifically requested cooperation from India to counter growing cyber threats.[23] India must be invested in building international cyber security cooperation and participate in any future negotiations that seek to formulate cyber warfare regulations.

Read more:

  1. What constitutes “attack” in the cyberspace: http://www.itu.int/dms_pub/itu-s/opb/gen/S-GEN-WFS.02-1-2014-PDF-E.pdf (Page 35-37)
  2. Contextualizing Tallinn Manual’s definition of “attack”: http://www.studentpulse.com/articles/775/the-law-of-attack-in-cyberspace-considering-the-tallinn-manuals-definition-of-attack-in-the-digital-battlespace
  3. US policy on cyber warfare (though not related to the manual, makes for an informative read on how States employ International Law in cyberspace): http://www.state.gov/s/l/releases/remarks/197924.htm

[1] Michael N Schmitt, Tallinn Manual on the International Law Applicable to Cyber Warfare (Cambridge University Press) (2013)

[2] Jacques Hartmann, The Law of Armed Conflict: International Humanitarian Law in War, 80 Nordic Journal of International Law 121-123 (2011)

[3]International Telecommunication Union & World Federation of Scientists, The Quest For Cyber Confidence (2014), http://www.itu.int/dms_pub/itu-s/opb/gen/S-GEN-WFS.02-1-2014-PDF-E.pdf (last visited Aug 24, 2015)

[4] Knut Dörmann, Computer network attack and International Humanitarian Law, Cambridge Review of International Affairs (2001)

[5] The law governing the use of force comprises of the 1899 and 1907 Hague Conventions, the 4 Geneva Conventions supplemented by Additional Protocols of 1977, as well as customary law and State practice

[6]EJIL: Talk! – The Tallinn Manual on the International Law applicable to Cyber Warfare Ejiltalk.org, http://www.ejiltalk.org/the-tallinn-manual-on-the-international-law-applicable-to-cyber-warfare/ (last visited Aug 24, 2015)


[8]A Call to Cyber Norms Discussions at the Harvard-MIT–University of Toronto Cyber Norms Workshops, 2O11 and 2O12, https://www.americanbar.org/content/dam/aba/uncategorized/GAO/2015apr14_acalltocybernorms.authcheckdam.pdf (last visited Aug 24, 2015)

[9] Supra N. 3

[10] Incoming: What Is a Cyber Attack? SIGNAL Magazine, http://www.afcea.org/content/?q=incoming-what-cyber-attack (last visited Aug 25, 2015)

[11]Kilovaty, Ido. “Cyber Warfare and the Jus Ad Bellum Challenges: Evaluation in the Light of the Tallinn Manual on the International Law Applicable to Cyber Warfare.” National Security Law Brief 5, no. 1 (2014): 91-124.

[12] Michael J. Norris, The Law of Attack in Cyberspace: Considering the Tallinn Manual’s Definition of ‘Attack’ in the Digital Battlespace, 5 Student Pulse (2013), http://www.studentpulse.com/articles/775/the-law-of-attack-in-cyberspace-considering-the-tallinn-manuals-definition-of-attack-in-the-digital-battlespace (last visited Aug 25, 2015)

[13] Ibid.

[14]Reese Nguyen, Navigating Jus Ad Bellum in the Age of Cyber Warfare, 101 Cal. L. Rev. 1079 (2013). Available at: http://scholarship.law.berkeley.edu/californialawreview/vol101/iss4/4

[15] The Attribution Problem in Cyber Attacks – InfoSec Resources, http://resources.infosecinstitute.com/attribution-problem-in-cyber-attacks/ (last visited Aug 25, 2015)

[16] Case Concerning Military and Paramilitary Activities In and Against Nicaragua (Nicaragua v. United States of America); Merits, International Court of Justice (ICJ), 27 June 1986, available at: http://www.refworld.org/docid/4023a44d2.html [accessed 25 August 2015]

[17] Peter Margulies, Sovereignty and Cyber Attacks: Technology’s Challenge to the Law of State Responsibility, 14 Melbourne Journal of International Law (2013), http://www.austlii.edu.au/au/journals/MelbJIL/2013/16.html (last visited Aug 25, 2015)

[18]Is The Tallinn Manual On The International Law Applicable To International Cyber Warfare Attacks And Defence | Centre Of Excellence For Cyber Security Research And Development In India (CECSRDI) Perry4law.org, http://perry4law.org/cecsrdi/?p=453 (last visited Aug 24, 2015)

[19] D. Fleck, Searching for International Rules Applicable to Cyber Warfare–A Critical First Assessment of the New Tallinn Manual, 18 Journal of Conflict and Security Law 331-351 (2013)

[20]Tallinn 2.0: cyberspace and the law Aspistrategist.org.au, http://www.aspistrategist.org.au/tallinn-2-0-cyberspace-and-the-law/ (last visited Aug 24, 2015)

[21] Legality of the Threat or Use of Nuclear Weapons, Advisory Opinion, I.C.J. Reports 1996, p. 226, International Court of Justice (ICJ), 8 July 1996, available at: http://www.refworld.org/docid/4b2913d62.html [accessed 25 August 2015]

[22] Michael Schmitt, Cyberspace and International Law: Penumbral Mist of Uncertainty, 126 Harvard Law Review (2012)

[23] The Hindustan Times, Help counter cyber threats from China: NATO to India, 2011, http://www.hindustantimes.com/world-news/help-counter-cyber-threats-from-china-nato-to-india/article1-743664.aspx (last visited Aug 24, 2015)

2 thoughts on “Tallinn Manual 1.0 – A Primer

  1. Pingback: Cyber Vandalism – Not an act of war. | Centre for Communication Governance at National Law University, Delhi

  2. Pingback: The road ahead for norms in cyberspace: Moving forward from Tallinn 2.0 | The CCG Blog

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s