# Collateral Damage from Offensive Cyber Operations-- A Systematic Literature Review
## 5 Discussion
### Legal Responses to Cyberattacks in Theory and Practice  
The 2007 Estonian cyberattacks and the 2010 Stuxnet attack accelerated the creation of the first version of the Tallinn Manual. It was aimed at describing the application of the laws of war to cyberwarfare, i.e., when cyberattacks rise above the use of force threshold defined by Article 2(4) of the UN Charter [34]. The absence of such attacks informed the second version of the Manual, which broadened its scope to address attacks below this threshold [37]. The original precept of the Manual that \"cyber warfare is warfare\" can correspond to some real-world conditions, such as the 2022 invasion of Ukraine. On the day of the invasion, kinetic warfare was combined with denial-of-service attacks on government agencies, but also with a malicious update disabling Viasat satellite modems in civilian use. As a result, multiple Ukrainian government agencies moved their digital services to US-owned cloud services in NATO-affiliated countries [76]. This digital exodus has proved effective in protecting them from the most overt and easily attributable cyberattacks, but exploratory and clandestine operations by state-backed actors continue, with Microsoft listing attacks by 14 such actors in 2024 [104].  
While the Viasat attack and the Notpetya ransomware attacks directly targeted civilians for military gain, the 2010 Bangladesh Bank cyber robbery and the 2017 WannaCryransomware attacks on urban critical infrastructure, which have been formally attributed to North Korea, do not fit neatly into the conventional understanding of the interstate use of force. Nevertheless, local governments are under constant cyberattack [95]. In general, the legal publications reviewed have not addressed these grey-zone attacks [30], and, in practice, these attacks have so far been met with diplomacy (e.g., sanctions) rather than with legal challenges or missiles. The continuing gap between legal understanding and reality has not gone unnoticed. NATO CCDCOE is developing the Tallinn Manual 3.0 under a five-year project running from 2021 to 2026. While this program should consider the callous disregard of civilian harm displayed in the cyberattacks in the Ukraine conflict, it is not clear that a NATO program is the right forum to address state-backed cybercrime against banks and civilian targets for purely financial gain. In the absence of a specific treaty on conduct in cyberspace, as called for in [46], a separate organization should be integrated into the Tallinn 3.0 process and take a coordinating role when considering below-threshold attacks of a strongly suspected interstate nature. Although these attacks are crimes and could be within the remit of INTERPOL or the United Nations Office of Drugs and Crime (UNODC), it has become common practice to see cyber conflict resolution take the form of sanctions and diplomacy [105]. Reflecting this reality, the UN has established an Open-Ended Working Group on information and communication technologies [106]. This working group is already tasked with investigating responsible state behavior in cyberspace and could add a much-needed component of norms and diplomacy to the Tallinn process.