Harnessing volunteers in cybersecurity and defence under international law

This paper examines the legal risks and policy considerations surrounding the involvement of civilians in cyber defence under international law. From the Estonian Defence League’s cyber unit to Ukraine’s IT Army, to a US pilot project to establish a civilian cybersecurity reserve, states are increasingly seeking to harness volunteers in cybersecurity and defence. Volunteer cyber forces can engage in various activities ranging from education, cybersecurity support, countering misinformation and disinformation, open-source intelligence, and offensive cyber operations. However, the activities of volunteer cyber forces, how the forces are organized, and the involvement of civilians raise a number of issues under international law. These include the circumstances in which their activities violate international law; whether the state can be held responsible for any such violations; and the risks to civilians involved in such activities.