Why is the legal status of civilian participants in cyberattacks unclear under the laws of armed conflict?

The legal status of civilian participants in cyberattacks is unclear under the laws of armed conflict and the Geneva Conventions primarily due to the unique nature of cyberspace.1

The low cost of entry and the accessibility of cyber tools allow individuals to easily participate in attacks against state agencies or other targets, often motivated by nationalist fervor rather than direct military orders. Because these participants are not traditional soldiers, it is difficult to distinguish them from civilian noncombatants. Furthermore, the anonymity inherent in cyberspace—where attackers can mask their identity, location, and motive—makes it challenging for states to determine if an individual is acting as a combatant or a private actor. This ambiguity complicates the ability of nations to apply existing international legal frameworks, which were designed for conventional warfare, to the decentralized and often untraceable reality of modern cyber operations.1