Cyber Conflict and the Transformation of International Order: Questions of Power in the Digital Age

by

Mariam Bregvadze
CyJurII Theorist
Date of Submission: 15 October 2026

 PDF Available

Abstract

Research on cyber conflict frequently asks which rules of international law govern state operations in cyberspace and whether particular incidents cross the thresholds of the use of force or an armed attack. This article examines the political conditions under which such rules and associated norms constrain conduct. It proposes that the durability of a cyber norm decreases as the operational value of the ambiguity it would eliminate increases, relative to the expected costs of non-compliance. Three indicators are identified independently of norm outcomes: the maintenance of proxy ecosystems; states’ official submissions in United Nations processes; and the availability of acknowledged means of achieving comparable operational effects. A structured comparison examines operations against Ukraine’s electricity grid in 2015 and 2016, NotPetya in 2017, the 2015 United States–China understanding on commercially motivated cyber espionage, and UN norm-development processes culminating in the July 2025 Open-ended Working Group report. The article proposes an extension of Nye’s deterrence framework that takes the state–proxy relationship as its unit of analysis and examines the tension between control and deniability. It also distinguishes successful attribution from effective enforcement and sustained deterrence. The cases suggest that the central constraint may lie less in identifying perpetrators than in establishing consequences sufficient to alter their incentives. The 2025 settlement illustrates a further possibility: institutional consolidation can coexist with limited substantive agreement. These findings support a testable research agenda rather than a conclusive causal demonstration.

Keywords: cyber conflict; international norms; attribution; cyber proxies; deterrence; Open-ended Working Group; international order

 Introduction

Legal debates on cyber conflict often concentrate on which norm applies, whether a particular operation violates international law, or whether it reaches the threshold of an “armed attack.” These questions are undoubtedly important, but they do not fully explain state behaviour. Cyber conflict is, above all, a political phenomenon. It reveals the distribution of power among states, the fragility of the international order, and the ways in which the very concepts of “conflict” and “war” change as they move from physical space into digital space. To examine cyber conflict as an indicator of the transformation of the international system, this article proposes a political and theoretical framework that complements legal analysis. The framework developed here advances a unified, testable proposition: the durability of a cyber norm decreases as the operational value of the ambiguity it would eliminate increases, relative to the expected costs of non-compliance.

Scope Cases and Observable Indicators

The proposition is formulated in causal terms and therefore requires an explanation of how its central variable can be identified independently of the outcome it seeks to explain. Without such an explanation, the argument would collapse into circular reasoning: the value of ambiguity would be inferred from the failure of a norm, and the failure of the norm would then itself be explained by the value of ambiguity. Three indicators are proposed here, each of which can be observed before and independently of the assessment of the norm’s effectiveness.

The first indicator is the maintenance of a proxy ecosystem. A state that supports formally independent actors capable of conducting operations on its behalf incurs coordination costs, control risks and counterintelligence exposure. Deniability may help explain its willingness to accept these costs, although access to expertise, flexibility and reduced expenditure provide alternative explanations. The second indicator is the content of official submissions in UN processes. These submissions reveal preferences about legal constraint, but they may also reflect diplomatic bargaining, capacity limitations or principled legal disagreement. The third indicator is whether a comparable operational effect can be achieved through acknowledged means. Where attribution would substantially reduce an operation’s expected benefit, ambiguity may be integral to the capability. Where acknowledgement would leave that benefit largely intact, ambiguity is more plausibly an additional advantage. None of these indicators is conclusive in isolation; their evidential value depends on triangulation and consideration of competing explanations.

The argument proceeds through a structured comparison of four cases selected to demonstrate different outcomes on the dependent variable: the operations against Ukraine’s electricity grid in 2015 and 2016; the 2017 NotPetya incident; the 2015 US–China agreement concerning commercially motivated cyber espionage; and the UN norm-development processes from 2013 through the conclusion of the Open-ended Working Group in 2025. The third case represents a case of norm consolidation followed by erosion and is included because a framework that explains only failure explains very little. The fourth case, particularly its final phase, offers a third and distinct outcome: institutional consolidation accompanied by limited substantive convergence, which is examined in detail below.

 The Distribution of Power

Structural realism treats international politics as an anarchic system in which states seek security under conditions of uncertainty. Cyberspace may appear to disrupt this logic because some capabilities have relatively low entry costs. Actors without the resources to build a fleet or a nuclear arsenal can acquire tools that disrupt services, steal information or impose economic costs. It does not follow, however, that all strategically significant cyber capabilities are inexpensive or widely accessible.

This proposition, however, immediately requires qualification, since it is contested in the scholarly literature. Lindsay and Slayton argue that cyberspace does not level the playing field so much as reproduce existing hierarchies: strategically significant capabilities require continuous intelligence collection, the development of persistent access, and target-specific engineering work that well-resourced organizations are better placed to sustain. Maschmeyer goes further and demonstrates that the operational requirements of speed, intensity and control conflict with one another, with the result that cyber operations often produce less strategic effect than their reputation would suggest. Valeriano and Maness, drawing on a database of interactions among rival states, reach a similar conclusion from the opposite direction: observable behaviour is characterized far more by restraint than by the escalation dynamics anticipated by the early literature.

The disagreement is partly explained by differences in the operations under examination. Some denial-of-service attacks, data theft and information operations have relatively low entry costs; reliable access to hardened systems and precisely controlled physical effects can require substantial resources. The resulting distribution of power is better described as stratification than equalisation. Advanced capabilities remain concentrated, while a wider range of state and non-state actors can impose consequential costs. This complicates the relationship between an actor’s ability to inflict harm and its ability to withstand retaliation without displacing the importance of material and organizational resources.

If technical knowledge and organizational capacity shape cyber power, its measurement must account for them. Nye distinguishes four mechanisms of deterrence and dissuasion: punishment, denial, entanglement and normative taboos. This framework is productive, but its application becomes more complicated when operations involve criminal groups, ideological collectives or commercial contractors. Such actors may possess vulnerable assets and depend on wider networks, yet their exposure and incentives need not match those of a sponsoring state. Extending the framework therefore requires attention to the relationships through which capabilities are organized  and directed.

The Politics of Attribution

Attribution combines technical investigation, intelligence assessment and political judgement; it operates through degrees of confidence rather than certainty. Its difficulty should therefore be distinguished from the difficulty of responding once responsibility has been assessed. States may exploit plausible deniability by delegating operations to actors whose links to public authorities are concealed or contested. The degree of direction varies, so a proxy relationship should not automatically be treated as proof of state control or legal attribution. Such arrangements can intensify the security dilemma: targets may struggle to distinguish defensive preparation from offensive access, or a principal’s instructions from a proxy’s initiative.

The proposed extension takes the state–proxy relationship as the unit of analysis. A principal that exercises tighter control over targeting and execution may reduce operational deviation, but closer coordination can also create evidence linking the operation to the state. Greater autonomy may strengthen deniability while increasing the risk of unauthorised action, mission drift or wider effects. This is a contingent trade-off, not an invariant law: organizational design and compartmentalisation may mitigate both risks. Punishment must address the different vulnerabilities of principal and proxy; denial must disrupt their combined operational chain; entanglement must be assessed across both actors; and normative pressure may affect each unevenly. The public cases examined here illustrate these difficulties but do not directly measure the degree of proxy control.

Deterrence depends on communicating threats, commitments and the conditions under which consequences will follow. Perfect knowledge of an attacker’s identity or intentions is unnecessary, but uncertainty can weaken the credibility or precision of a response. It can also encourage operations designed to impose costs while reducing the likelihood of direct military retaliation. The relevant question is therefore how much confidence a target requires to act, and what costs it is prepared to accept.

The operations against Ukraine’s electricity grid in December 2015 and December 2016 illustrate the difficulty of inferring intent from observed effects. Both interrupted electricity supplies; the 2020 US indictment subsequently alleged the involvement of officers of GRU Unit 74455. The shorter disruption in 2016 permits at least two interpretations. The outage may have reflected deliberate restraint, or technical limitations may have prevented more extensive damage. Analysis of CRASHOVERRIDE identified functionality directed at protective relays, while a 2019 reassessment explored the possibility that disabling protection could have facilitated equipment damage during restoration. These accounts do not conclusively establish the intended outcome. They do, however, distinguish moderation by design from moderation caused by operational failure.

The uncertainty is analytically significant, but it cannot establish that the operation was deliberately kept below a legal threshold. Ukraine was not a NATO member, and collective defence, the use of force and an armed attack are distinct questions. Nor can the public record establish that the target possessed no better intelligence than outside analysts. The narrower conclusion is that visible effects alone may reveal too little to distinguish a calibrated signal from an unsuccessful attempt at greater disruption. Ambiguity can therefore concern the meaning of an operation as well as its authorship.

 NotPetya demonstrates the risks of effects spreading beyond an operation’s apparent initial focus. The malware spread internationally after distribution through compromised Ukrainian accounting software, causing extensive disruption. The US indictment recorded nearly US$1 billion in losses to three identified victims alone. This wider impact is consistent with inadequate containment, but it does not by itself prove an unintended loss of control: indiscriminate propagation or accepted collateral damage remain possible explanations. The attribution record is clearer. In February 2018, the United Kingdom and other governments publicly attributed the operation to the Russian military; the United States later charged six named GRU officers. These were governmental assessments and criminal allegations, not judicial findings establishing the guilt of the accused.

The case therefore cannot be reduced to a failure of identification. Public attribution was followed by measures including criminal charges, so it would be inaccurate to describe enforcement as absent. The narrower difficulty is whether these measures imposed costs sufficient to change subsequent conduct. Attribution, enforcement and deterrent effect are separate outcomes: success at the first stage does not establish success at the others. The case supports investigation of the credibility and expected costs of enforcement rather than a categorical conclusion that identification is easy or that enforcement invariably fails.

Norm Development under Deliberate Ambiguity

Liberal institutionalism explains cooperation partly through repeated interaction and institutions that reduce transaction costs and stabilise expectations. In cyberspace, the UN Group of Governmental Experts (GGE) and Open-ended Working Group (OEWG) have generated an evolving framework. The 2013 GGE affirmed the applicability of international law, including the UN Charter, and the 2015 report articulated eleven voluntary, non-binding norms of responsible state behaviour. The 2017 GGE failed to adopt a consensus report amid disagreements over the application of international law. In 2021, the GGE and OEWG again reached consensus, reaffirming earlier agreements and advancing discussion of their application. Binding international law and voluntary norms must remain analytically distinct, even where the latter reinforce existing legal obligations.

This record suggests that agreement on general principles can coexist with disagreement about their application. It does not establish that all resistance reflects a desire to preserve operational freedom. States may also differ over the risks of legitimising conflict, the relationship between existing rules and new instruments, or the resources needed to implement commitments. Nevertheless, deliberate under-specification is a plausible explanation where detailed national positions exist but negotiated language remains general. Accepting the applicability of international humanitarian law regulates conduct during armed conflict; it does not authorise resort to force or determine whether a particular operation is lawful under the UN Charter.

The 2025 Agreement

The OEWG’s conclusion in July 2025 permits comparison between institutional agreement and substantive legal convergence. Its final report was adopted by consensus on 11 July and endorsed a single permanent mechanism for future dialogue. The General Assembly subsequently established the Global Mechanism, whose organizational session took place on 30 and 31 March 2026. This represents institutional consolidation. The extent of substantive progress on international law is more contested and requires comparison of the agreed text with earlier proposals.

Mačák identifies a narrowing of the international-law provisions during negotiations. Much of the final section restates earlier agreements, while its acknowledgement that operations below the use-of-force

threshold may contravene other international-law principles leaves the relevant circumstances unspecified. An earlier draft included a scale-and-effects formulation for assessing whether an ICT operation constitutes a use of force; this did not survive in the final text. Proposals for a dedicated thematic group on international law were also omitted. These changes support a distinction between agreement to continue discussion and agreement on more specific legal tests. They do not render the existing rules legally empty or deprive the new mechanism of a substantive mandate.

The limited convergence cannot readily be explained by a complete absence of developed legal thinking. Before the final session, states had published numerous national positions, while the African Union and European Union had adopted regional positions in 2024. The International Conference of the Red Cross and Red Crescent also adopted a resolution in October 2024 addressing civilian protection against ICT activities during armed conflict. These developments demonstrate substantial engagement outside the negotiated report. Their existence, however, does not establish agreement across the full UN membership. The stronger inference is that legal elaboration had advanced further in some national, regional and humanitarian forums than in the consensus language available to the OEWG.

Consensus decision-making allowed objections to narrow the range of acceptable formulations. One important division concerned whether existing law provided a sufficient framework or whether an additional binding instrument was needed. These positions did not exhaust the range of state preferences, and neither position necessarily establishes an intention to obstruct legal clarification. The settlement is nevertheless consistent with the article’s proposition: participants could agree on a permanent institution while preserving disagreement over consequential applications of law. The outcome is thus institutional consolidation accompanied by limited substantive convergence, rather than either complete normative failure or an institution required to define nothing. Demonstrating that operational incentives caused particular deletions would require closer examination of state submissions and successive negotiating drafts.

The Limits of the Argument

An explanatory framework must account for instances of apparent consolidation as well as failure. In September 2015, the United States and China announced a common understanding against conducting or knowingly supporting cyber-enabled theft of intellectual property for commercial advantage. The G20 endorsed a corresponding commitment in November. FireEye’s 2016 report documented a decline in observed activity by suspected China-based groups, beginning before the bilateral understanding. This is consistent with a period of behavioural restraint, but the chronology prevents attribution of the decline to the agreement alone. Commercial reporting captures only observed intrusions and may not distinguish reduced activity from changes in targeting, organization or concealment. The case therefore provides qualified evidence of consolidation rather than proof of a single causal mechanism.

Two features may explain the contrast. First, the immediate value of commercially useful information can survive public attribution, making uncertainty about authorship less integral to the benefit than in some coercive operations. Secrecy about access and collection nevertheless remains important, so the value of ambiguity should not be assumed to be uniformly low. Secondly, US policy had signalled potential costs through the 2014 indictment of five People’s Liberation Army officers and the creation of a cyber-related sanctions authority in April 2015. The 2015 announcement also explicitly retained enforcement options. Together, these measures provide a plausible basis for studying whether credible consequences changed the relative value of continued conduct.

The subsequent record complicates any claim of durable compliance. A December 2018 US indictment alleged that contractors associated with China’s Ministry of State Security had conducted intrusion campaigns continuing into 2018. The allegations indicate continued attribution and conduct potentially inconsistent with the commitment, although they are not convictions or a complete measure of state activity. The deterioration in wider US–China relations provides relevant context, but coincidence does not establish that economic conflict caused renewed espionage. The case remains consistent with a change in the relative costs and benefits of restraint; it also requires testing against organizational reform, altered collection priorities and changes in visibility.

Norm Entrepreneurship

Tallinn Manual 2.0 is a non-binding expert analysis of international law applicable to cyber operations. Its aim is to restate existing law, and its conclusions do not constitute an official position of NATO or its member states. Its use in legal argument nevertheless illustrates how expert interpretation can influence debate without a negotiated intergovernmental instrument. The Tallinn Manual 3.0 project and the OEWG’s recommendation that states continue publishing national positions show that interpretive work also occurs outside consensus negotiations. Such work can clarify disagreements and support later convergence, although neither an expert restatement nor a unilateral declaration alone establishes a universally accepted rule.

Finnemore and Sikkink’s norm life-cycle model distinguishes emergence, cascade and internalisation. Applied cautiously, it helps explain why some cyber norms achieve wide rhetorical endorsement without consistent implementation. It would be too broad to conclude that cyber norms as a whole remain at the emergence stage: the 2015 UN norms and the commitment against commercially motivated theft have already diffused internationally. The more precise question is why diffusion sometimes fails to produce stable expectations, implementation or compliance, particularly where operational incentives favour interpretive flexibility.

Finnemore and Hollis emphasize the processes through which cybersecurity norms are constructed, including the roles of participants, institutions and social context. Their approach supports attention to how operational interests shape negotiation, without assuming that ambiguity is always deliberately engineered. Constructivist theory further treats interests and norms as mutually constitutive rather than assuming that norms merely express fixed preferences. The resulting question is how legal interpretation, institutional practice and strategic incentives interact to produce either change or persistent disagreement.

Why International Cyber Law Needs Political Science

Legal analysis of cyber conflict establishes the applicable rules and evaluates conduct against them. Political science helps explain incentives, institutional outcomes and patterns of compliance. The three strands developed here—the distribution of capabilities, the politics of attribution and the development of norms—suggest that these inquiries should be pursued together. In cyberspace, the capacity to inflict harm, the ability to identify a perpetrator and the willingness to impose consequences need not coincide. Their separation affects the conditions under which commitments become practically constraining.

NotPetya illustrates the distinction. Governments publicly identified an alleged perpetrator and pursued enforcement measures; the difficult question is whether those measures produced sufficient deterrent effect. The case does not justify treating enforcement as absent or assuming that attribution is equally feasible in every operation.

The initial proposition can therefore be refined as follows: other things being equal, cyber norms are less likely to constrain conduct durably where the operational benefits of the ambiguity they would remove exceed the expected benefits of compliance and costs of violation. The 2015 US–China understanding suggests that credible consequences may alter this calculation. The cases establish the plausibility of this relationship, rather than demonstrating that it explains every instance of non-compliance.

This refinement creates a risk of circularity if expected costs are inferred retrospectively from compliance. The operational value of ambiguity and the credibility of enforcement should therefore be measured separately before the outcome is assessed. Proxy arrangements, official positions and the availability of acknowledged alternatives provide indicators of the former; announced measures, implementation records and the target’s exposure provide evidence relevant to the latter. The proposition concerns their relative weight, but this does not make the variables interchangeable or eliminate the need to test competing explanations.

A stronger test would specify the expected direction of change before examining outcomes. Durable consolidation despite persistently high benefits from ambiguity and low expected costs of violation would challenge the proposition. Persistent failure where ambiguity offers little operational benefit, compliance offers substantial gains and violations attract credible costs would also count against it. For the new UN mechanism, substantive convergence on international humanitarian law without a corresponding change in these incentives would weaken the explanation. Such assessments must also consider changes in preferences through learning or socialization. A broader test requires consistent coding of national positions, proxy relationships, operational effects, enforcement measures and compliance over time. This article supplies a framework for that inquiry rather than claiming to complete it.

International cyber law benefits from dialogue between lawyers and political scientists. Legal analysis can identify an obligation and establish its breach; interdisciplinary inquiry can help explain why states comply, contest interpretations or accept the costs of violation. The research agenda must therefore examine both the content of proposed norms and the incentives governing their operation. The practical significance of clearer legal commitments depends partly on whether institutions and enforcement can make compliance more valuable than the operational freedom those commitments would restrict.

Bibliography

Borghard ED and Lonergan SW, ‘Can States Calculate the Risks of Using Cyber Proxies?’ (2016) 60 Orbis 395.

Buchanan B, The Cybersecurity Dilemma: Hacking, Trust and Fear between Nations (OUP 2017).

Dragos, CRASHOVERRIDE: Reassessing the 2016 Ukraine Electric Power Event as a Protection-Focused Attack (2019) <https://www.dragos.com/wp-content/uploads/CRASHOVERRIDE.pdf> accessed 15 October 2026.

Egloff FJ, Semi-State Actors in Cybersecurity (OUP 2022).

Executive Order 13694, ‘Blocking the Property of Certain Persons Engaging in Significant Malicious Cyber-Enabled Activities’ (1 April 2015) 80 Fed Reg 18077.

Finnemore M and Hollis DB, ‘Constructing Norms for Global Cybersecurity’ (2016) 110 American Journal of International Law 425.

Finnemore M and Sikkink K, ‘International Norm Dynamics and Political Change’ (1998) 52 International Organization 887.

FireEye iSIGHT Intelligence, Red Line Drawn: China Recalculates Its Use of Cyber Espionage (FireEye 2016).

Fischerkeller MP and Harknett RJ, ‘Persistent Engagement, Agreed Competition, and Cyberspace Interaction Dynamics and Escalation’ (2019) The Cyber Defense Review (Special Edition) 267.

Fischerkeller MP, Goldman EO and Harknett RJ, Cyber Persistence Theory: Redefining National Security in Cyberspace (OUP 2022).

Foreign and Commonwealth Office, ‘Foreign Office Minister Condemns Russia for NotPetya Attacks’ (15 February 2018) <https://www.gov.uk/government/news/foreign-office-minister-condemns-russia-for-notpetya-attacks> accessed 15 October 2026.

G20, G20 Leaders’ Communiqué Antalya Summit (15–16 November 2015) para 26.

Global Mechanism, ‘Provisional Agenda and Annotations’ (19 March 2026) UN Doc A/AC.304/2026/1.

Healey J, Beyond Attribution: Seeking National Responsibility in Cyberspace (Atlantic Council 2012).

International Conference of the Red Cross and Red Crescent, ‘Protecting Civilians and Other Protected Persons and Objects against the Potential Human Cost of ICT Activities during Armed Conflict’ (October 2024) Resolution 2, 34IC/24/R2.

Jervis R, ‘Cooperation under the Security Dilemma’ (1978) 30 World Politics 167.

Kello L, The Virtual Weapon and International Order (Yale University Press 2017).

Keohane RO, After Hegemony: Cooperation and Discord in the World Political Economy (Princeton University Press 1984).

Lindsay JR, ‘Stuxnet and the Limits of Cyber Warfare’ (2013) 22 Security Studies 365.

Maschmeyer L, ‘The Subversive Trilemma: Why Cyber Operations Fall Short of Expectations’ (2021) 46(2) International Security 51.

Maurer T, Cyber Mercenaries: The State, Hackers, and Power (CUP 2018).

Mačák K, ‘A Missed Opportunity: An International Law Perspective on the Final OEWG Report’ (EJIL: Talk!, 22 July 2025) <https://www.ejiltalk.org/a-missed-opportunity-an-international-law-perspective-on-the-final-oewg-report/> accessed 15 October 2026.

Ministry of Foreign Affairs of Japan, ‘United Nations Global Mechanism Establishment Meeting on Cybersecurity’ <https://www.mofa.go.jp/press/release/pressite_000001_02230.html> accessed 15 October 2026.

Ministère des Armées, Droit international appliqué aux opérations dans le cyberespace (République française 2019).

NATO Cooperative Cyber Defence Centre of Excellence, ‘The Tallinn Manual’ <https://ccdcoe.org/research/tallinn-manual/> accessed 15 October 2026.

Nye JS Jr, ‘Deterrence and Dissuasion in Cyberspace’ (2017) 41(3) International Security 44.

OEWG, ‘Final Substantive Report’ (10 March 2021) UN Doc A/AC.290/2021/CRP.2.

Rid T and Buchanan B, ‘Attributing Cyber Attacks’ (2015) 38 Journal of Strategic Studies 4.

Schelling TC, Arms and Influence (Yale University Press 1966).

Schmitt MN (ed), Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations (CUP 2017).

Segal A, The Hacked World Order: How Nations Fight, Trade, Maneuver, and Manipulate in the Digital Age (PublicAffairs 2016).

Slayton R, ‘What Is the Cyber Offense-Defense Balance? Conceptions, Causes, and Assessment’ (2017) 41(3) International Security 72.

UNGA Res 80/16 (1 December 2025) UN Doc A/RES/80/16.

UNGA, ‘Final Report of the Open-Ended Working Group on Security of and in the Use of Information and Communications Technologies 2021–2025’ (24 July 2025) UN Doc A/80/257.

UNGA, ‘Report of the Group of Governmental Experts on Advancing Responsible State Behaviour in Cyberspace in the Context of International Security’ (14 July 2021) UN Doc A/76/135.

UNGA, ‘Report of the Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security’ (22 July 2015) UN Doc A/70/174, para 13.

UNGA, ‘Report of the Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security’ (24 June 2013) UN Doc A/68/98, para 19.

US Department of Justice, ‘Six Russian GRU Officers Charged in Connection with Worldwide Deployment of Destructive Malware and Other Disruptive Actions in Cyberspace’ (19 October 2020) <https://www.justice.gov/archives/opa/pr/six-russian-gru-officers-charged-connection-worldwide-deployment-destructive-malware-and> accessed 15 October 2026.

US Department of Justice, ‘Two Chinese Hackers Associated with the Ministry of State Security Charged with Global Computer Intrusion Campaigns Targeting Intellectual Property and Confidential Business Information’ (20 December 2018) <https://www.justice.gov/archives/opa/pr/two-chinese-hackers-associated-ministry-state-security-charged-global-computer-intrusion> accessed 15 October 2026.

US Department of Justice, ‘U.S. Charges Five Chinese Military Hackers for Cyber Espionage against U.S. Corporations and a Labor Organization for Commercial Advantage’ (19 May 2014).

Valeriano B and Maness RC, Cyber War versus Cyber Realities: Cyber Conflict in the International System (OUP 2015).

Waltz KN, Theory of International Politics (Addison-Wesley 1979).

Wendt A, Social Theory of International Politics (CUP 1999).

White House, ‘Remarks by President Obama and President Xi of the People’s Republic of China in Joint Press Conference’ (25 September 2015) <https://obamawhitehouse.archives.gov/the-press-office/2015/09/25/remarks-president-obama-and-president-xi-peoples-republic-china-joint> accessed 15 October 2026.

Wright J, ‘Cyber and International Law in the 21st Century’ (Attorney General’s Office, 23 May 2018) <https://www.gov.uk/government/speeches/cyber-and-international-law-in-the-21st-century> accessed 15 October 2026.