Legitimate defense and the legitimacy of the use of force in response to cyber attacks: Navigating the gray area of soft law

Cyber warfare is a type of conflict that replaces traditional warfare, which has emerged with developing technologies today. It is important to keep cyber weapons under control because they are different from traditional weapons and have the capacity to attack the critical infrastructures of states. Since cyber attacks have great effects on states, the issue of whether they should be considered as armed attacks or not creates great debate. This situation has brought about major changes in terms of establishing legal rules regarding cyber attacks both nationally and internationally. While the Tallinn Manual and the Budapest Convention are international agreements, the NIS Directive (Network and Information Security Directive) and the Cyber Act include the legal rules formed within the borders of the European Union. These agreements regarding cyberspace have become part of soft law. Cyber attacks have a place in international relations. States may have difficulty evaluating this issue within the scope of hard law. However, there are examples in international relations where soft law practices can evolve into hard law. The purpose of this study is to examine whether states have the right to self-defense and use force based on Article 51 of the United Nations Charter when faced with a cyber attack, and whether soft law rules are effective in creating legislation on cyber attacks, using a qualitative method.