CyCon 2025: responding to ransomware within the boundaries of international law

Conference item

This paper explores the interaction between state obligations under international law and the domestic measures taken by states to counter the ransomware threat. On the one hand, states are required to take a proactive approach by taking steps to protect against ransomware operations. On the other hand, their freedom to take action against ransomware actors and related harms is not unlimited – obligations under international law, such as those emanating from state sovereignty, constrain state action in important ways. Understanding the boundaries of action compliant with international law is essential: a balance must be struck between pursuing effective ransomware responses and ensuring compliance with international law. Maintaining trust in the international legal system is contingent upon clearly signalled and honoured state commitments to international law – its substance, institutions and processes.

Authors: van Benthem, TJ; Radu, R

• Publication status: Published
• Peer review status: Peer reviewed
• Publisher: IEEE
• Host title: 2025 17th International Conference on Cyber Conflict: The Next Step (CyCon)
• Pages: 75-90
• Place of publication: Tallinn, Estonia
• Publication date: 2025-05-12
• Acceptance date: 2025-05-12
• Event title: 17th International Conference on Cyber Conflict: The Next Step (CyCON 2025)
• Event location: Tallinn, Estonia
• Event website: https://ccdcoe.org/cycon/
• Event start date: 2025-05-27
• Event end date: 2025-05-30
• DOI: 10.23919/cycon65856.2025.11103585
• EISBN: 9789916978993
• ISBN: 9789916978986
• Language: English
• Keywords: international law; offensive cyber operations; positive obligations; ransomware; resilience-building