Russia's invasion of Ukraine has put to the test theories about how cyberattacks fit into conventional war. Contrary to many expectations, cyber operations appear to have played only a limited role in the initial stages of the invasion, prompting competing theories and rampant speculation about why. Although written while the conflict continues, this essay considers how either of two broad explanations for the limited role of cyberattacks to date—that Russia's attempted cyberattacks were thwarted or that Russia chose not to deploy them widely—challenges conventional wisdom about cybersecurity. The essay concludes by suggesting that one lesson international lawyers should draw from the current conflict is the urgent need to clarify and enforce international rules not just for the rare high-end destructive or widely disruptive cyber operations, but also for lower-level operations that have proven more consistently problematic, both in Ukraine and elsewhere. Clarifying such rules could help to manage escalation risk now and in the future, even if such rules—like the most venerable international law prohibitions that Russia's invasion has violated—do not necessarily restrain behavior directly.

Attribution of state-sponsored cyberattacks can be difficult, but the significant uptick in attributions in recent years shows that attribution is far from impossible. After several years of only sporadic attributions, Western governments in 2017 began attributing cyberattacks to other governments more frequently and in a more coordinated fashion. But nongovernment actors have more consistently attributed harmful cyber activity to state actors. Although not without risks, these nongovernmental attributions play an important role in the cybersecurity ecosystem. They are often faster and more detailed than governmental attributions, and they fill gaps where governments choose not to attribute. Companies and think tanks have recently proposed centralizing attribution of state-sponsored cyberattacks in a new international entity. Such an institution would require significant start-up time and resources to establish efficacy and credibility. In the meantime, the current system of public-private attributions, decentralized and messy though it is, has some underappreciated virtues—ones that counsel in favor of preserving some multiplicity of attributors even alongside any future attribution entity.

When a foreign country's law is relevant to a case in U.S. federal court and the foreign country files an official statement about the meaning of its law, how should U.S. courts treat the foreign government's representations? In Animal Science Products, Inc. v. Hebei Welcome Pharmaceuticals Co., the Supreme Court of the United States held that “[a] federal court should accord respectful consideration to a foreign government's submission, but is not bound to accord conclusive effect to the foreign government's statements.” In so doing, the Supreme Court settled a disagreement between the courts of appeals and reversed an opinion of the Second Circuit that had given conclusive effect to the Chinese government's representations about its domestic law. Animal Science Products provides important guidance to federal courts faced with increasingly frequent filings by foreign governments, but it leaves unresolved significant questions about deference to foreign sovereign amici and preserves existing debates about the nature of “respectful consideration.”