A cyber attack originating in one country, routed through servers in a second, targeting infrastructure in a third, and affecting citizens of a fourth presents a jurisdictional puzzle that existing international law was not designed to solve. The UN Charter, the International Law Commission's Articles on State Responsibility, and the Tallinn Manual provide theoretical frameworks for attributing state responsibility for cyber operations—but the practical challenges of attribution (proving who conducted the attack), jurisdiction (determining which courts have authority), and enforcement (compelling compliance with legal obligations) remain formidable.
The result is a governance gap: the most consequential threats to national security, critical infrastructure, and economic stability in the 21st century operate in a legal space that is under-regulated, under-enforced, and under-cooperative. The gap is not primarily technical—the technology for sharing threat intelligence, coordinating incident response, and conducting forensic attribution exists. The gap is legal and political: states are reluctant to share intelligence, disagree on definitions of "cyber attack" versus "cyber espionage," and protect their own offensive capabilities by resisting the development of binding international norms.
State Responsibility
Sakib and Nayeem (2024) examine the extent to which existing legal doctrines apply to cross-border cyberattacks. The growing prevalence of these attacks poses significant challenges to international law, particularly in defining state responsibility.
The paper analyzes how the UN Charter (particularly Article 2(4) on the prohibition of force and Article 51 on self-defense), the ILC's Articles on State Responsibility, and the Tallinn Manual (which applies existing international law to cyber operations) address state-sponsored or state-tolerated cyber attacks. The analysis reveals that while these frameworks provide theoretical coverage, practical application is constrained by: the difficulty of attributing attacks to specific state actors, disagreement about whether cyber operations constitute "use of force" or "armed attack" under the UN Charter, and the absence of binding international cyber norms.
Cross-Border Intelligence Sharing
Pulivarthy (2025) establishes a framework for cross-border Cyber Threat Intelligence (CTI) sharing between India and the UK. Given the constantly changing cyber threat landscape, the framework focuses on how two countries with different legal systems, data protection regimes, and security classifications can share actionable intelligence in real time.
The framework addresses several operational challenges: classification compatibility (matching different national security classification systems), data protection compliance (sharing threat data without violating GDPR or India's DPDPA), timeliness (ensuring that intelligence is shared fast enough to be actionable), and trust (building institutional relationships that enable intelligence sharing between agencies that have historically operated independently).
AI and Cyber Defense
Iqbal, Ansari, and Ismail (2025) explore how AI can enhance cross-border cyber defense. The global cybersecurity environment demands rising importance on cross-border threat intelligence combined with AI systems because these tools help organizations protect against modern cyber threats.
The paper examines how AI can: automate threat detection across distributed networks, analyze attack patterns that span multiple jurisdictions, generate real-time threat intelligence from diverse data sources, and predict emerging attack vectors before they are exploited. But it also notes that AI itself introduces new vulnerabilities: adversarial attacks on AI defense systems, AI-generated social engineering, and the dual-use nature of AI offensive and defensive capabilities.
Cyber-Telecoms Fraud: A Case Study in Cooperation
Wong (2024) examines international cooperation in combating cross-border cyber-telecoms fraud, focusing on the criminal activities of scam operations in Northern Myanmar. The rampant criminal activities have attracted international attention, and in combating such crimes, international cooperation is crucial.
The Myanmar case illustrates both the necessity and the difficulty of international cooperation. The fraud operations are physically located in Myanmar but target victims globally, use telecommunications infrastructure that spans multiple countries, and move proceeds through international financial networks. Effective law enforcement requires cooperation among police, prosecutors, telecommunications regulators, and financial authorities across multiple jurisdictions—cooperation that is technically feasible but institutionally challenging.
Systematic Review
Khan (2025) provides a PRISMA-guided systematic review of cross-border data privacy governance, international legal compliance frameworks, and cyber law enforcement mechanisms. The review examines how organizations navigate the complex web of national cybersecurity and data protection laws when operating across jurisdictions.
The systematic evidence reveals that fragmentation is the dominant characteristic of the international cybersecurity legal landscape: different definitions of "cybercrime," different standards of evidence, different data retention requirements, and different enforcement capabilities create a compliance environment that is complex for law-abiding organizations and exploitable for criminal actors.
Claims and Evidence
<| Claim | Evidence | Verdict |
|---|---|---|
| Existing international law adequately addresses state responsibility for cyber attacks | Sakib & Nayeem (2024): theoretical frameworks exist; practical application is constrained | ⚠️ Uncertain |
| Cross-border threat intelligence sharing is operationally feasible | Pulivarthy (2025): framework demonstrates feasibility for bilateral cooperation | ✅ Supported (bilateral) |
| AI enhances cross-border cyber defense | Iqbal et al. (2025): AI capabilities documented; AI also introduces new vulnerabilities | ⚠️ Uncertain |
| International cooperation effectively combats cross-border cyber crime | Wong (2024): cooperation is necessary but institutionally challenging | ⚠️ Uncertain |
| The international cybersecurity legal landscape is converging | Khan (2025): fragmentation is the dominant characteristic | ❌ Refuted |
Implications
The cybersecurity governance gap will not be closed by technology alone. It requires institutional innovation: bilateral and multilateral agreements that enable real-time intelligence sharing, international standards that harmonize definitions and procedures, capacity building that extends cyber defense capabilities to less-resourced states, and normative development that establishes binding rules for state behavior in cyberspace. The Budapest Convention on Cybercrime provides a foundation, but its reach (primarily European and allied states) and scope (primarily criminal law) are insufficient for the scale of the challenge.