1. Introduction

Energy infrastructure has become a central target in modern hybrid warfare because electricity, natural gas, oil pipelines, refineries, LNG terminals, nuclear facilities, dams, energy-control systems and transmission networks are essential to both civilian life and national security. Unlike conventional warfare, hybrid warfare may combine cyberattacks, physical sabotage, disinformation, economic coercion, supply disruption, espionage, proxy activity and conventional military force.

The energy sector is particularly vulnerable because modern electricity and gas systems are highly interconnected and increasingly dependent upon digital technologies. A hostile actor may therefore attempt to create political or economic pressure without immediately launching a conventional military attack. NATO has identified the combination of cyber campaigns, supply disruption, economic and political influence, and disinformation as important components of hybrid threats to energy security. (NATO)

The legal problem is consequently multidimensional: an attack may simultaneously raise questions of international humanitarian law, the UN Charter, human rights law, cybersecurity law, energy regulation, state responsibility and criminal law.

2. Meaning of Hybrid Warfare in the Energy Sector

Hybrid warfare does not have one universally accepted legal definition. In practical terms, it refers to the coordinated employment of multiple instruments of coercion, often below or alongside the threshold of conventional armed conflict.

In the energy sector, these instruments may include:

Cyberattacks against electricity grids and control systems.

Physical sabotage of pipelines, substations, cables or power plants.

Disruption of fuel supplies or gas deliveries.

Economic coercion through manipulation of energy dependence.

Disinformation concerning shortages, prices or energy security.

Espionage directed at energy operators.

Proxy or covert operations against energy infrastructure.

Military attacks against energy installations.

Manipulation of energy markets to create political pressure.

Attacks on digital infrastructure supporting energy trading and dispatch.

The 2015 Ukrainian electricity-grid incident illustrates the combination of cyber capability and energy disruption: the attack caused a blackout affecting approximately 225,000 people. (Chatham House)

3. Why Energy Infrastructure Is Particularly Vulnerable

A. Interdependence

Electricity systems depend upon telecommunications, fuel supplies, transportation, water systems and digital control networks. A disruption in one sector can therefore cascade into others.

For example:

Cyberattack → electricity outage → water-pumping failure → telecommunications disruption → hospital disruption → economic losses.

Consequently, the legal and security consequences of an attack can extend far beyond the physical facility originally targeted.

B. Digitalisation

Modern power systems increasingly use:

SCADA systems;

industrial control systems;

smart meters;

remote switching;

automated generation control;

cloud-based management;

digital substations; and

interconnected communications networks.

This creates additional attack surfaces.

C. Civilian dependence

Energy infrastructure is frequently dual-use. The same electricity network may supply:

households;

hospitals;

military facilities;

factories;

water-treatment plants;

transportation systems.

This makes the application of the principle of distinction particularly important during armed conflict.

4. Major Hybrid Warfare Risks

4.1 Cyberattacks on Electricity Grids

Cyberattacks can manipulate breakers, interrupt electricity distribution, corrupt data or disable control systems.

The Ukrainian power-grid attacks are particularly important. The December 2015 attack caused outages affecting approximately 225,000 consumers, while subsequent incidents demonstrated that attackers could develop increasingly sophisticated capabilities against industrial control environments. (NATO)

The legal difficulty is that a cyber operation may cause serious loss of functionality without physically destroying equipment.

This creates an important question:

Is disabling an electricity system legally equivalent to physically attacking the infrastructure?

There is no universally settled answer. The Tallinn Manual represents influential expert analysis rather than binding international law. It recognizes that international humanitarian law applies to cyber operations conducted in the context of an armed conflict. (Cambridge University Press)

5. Physical Sabotage

Hybrid operations may involve destruction or damage to:

oil pipelines;

gas pipelines;

electricity transmission towers;

subsea cables;

transformers;

substations;

power plants;

LNG infrastructure;

hydroelectric facilities.

Physical sabotage can be particularly difficult to attribute because perpetrators may use covert actors, proxies or deliberately ambiguous methods.

Where the conduct occurs during an armed conflict, the lawfulness of an attack depends upon principles including:

distinction;

military necessity;

proportionality;

precautions in attack.

6. Energy Supply as an Instrument of Economic Coercion

Hybrid warfare does not necessarily involve destruction.

A state may exploit another state's dependence on:

imported natural gas;

petroleum;

electricity imports;

uranium;

critical minerals;

transmission corridors.

Energy supply can therefore become an instrument of geopolitical pressure.

NATO has specifically described Russian activity involving energy supply disruption, cyberattacks, political and economic influence and disinformation as components of a broader hybrid campaign affecting Ukraine's energy security. (NATO)

The legal classification of such conduct is more complicated than a conventional military attack. A supply interruption may constitute:

a contractual dispute;

unlawful economic coercion;

breach of treaty obligations;

sanctions-related conduct;

or, depending upon circumstances, part of a broader internationally wrongful operation.

The surrounding facts and applicable legal instruments are therefore critical.

7. International Humanitarian Law

Where hybrid operations occur during an international armed conflict, international humanitarian law becomes particularly important.

Principle of Distinction

Parties must distinguish between:

civilian objects and military objectives.

An energy facility does not become a lawful military target merely because it is economically important.

Under the traditional IHL framework, an object must satisfy the requirements for a military objective. A civilian electricity facility may therefore receive protection unless the applicable legal test is satisfied.

Academic analysis of cyber operations against Ukraine's electricity infrastructure has specifically examined whether disabling the grid constitutes an "attack" and whether the grid qualifies as a military objective. (Taylor & Francis Online)

7.1 Principle of Proportionality

Even where an energy installation constitutes a legitimate military objective, an attack remains subject to proportionality.

The anticipated incidental civilian harm must not be excessive in relation to the concrete and direct military advantage anticipated.

This is particularly important because destroying an electricity substation may affect:

hospitals;

water systems;

heating;

food storage;

communications;

residential buildings.

The consequences can therefore extend far beyond the physical location attacked.

8. Installations Indispensable to Civilian Survival

Energy infrastructure may be closely connected with installations indispensable to civilian survival.

Electricity is often necessary for:

hospitals;

drinking-water systems;

sanitation;

heating;

food preservation;

emergency services.

The attacks on Ukrainian electricity infrastructure demonstrate this relationship. UN-related documentation has recorded electricity, heating and water disruptions affecting millions of people, with particularly serious consequences for vulnerable persons and those dependent on electrically powered medical equipment. (ECHR)

This strengthens the argument that energy infrastructure cannot always be treated merely as ordinary industrial property during armed conflict.

9. Nuclear Energy Infrastructure

Nuclear facilities present a particularly serious category of risk.

Attacks or military operations around nuclear facilities may create:

radiation risks;

evacuation requirements;

long-term environmental damage;

transboundary consequences;

threats to civilian life.

The legal framework therefore involves not only IHL but also international nuclear-safety obligations and environmental principles.

The experience surrounding the Zaporizhzhia Nuclear Power Plant demonstrates how military conflict can create extraordinary risks around nuclear infrastructure.

10. Hydroelectric Dams

Large dams are another special category because their destruction can produce catastrophic flooding.

The 2023 breach of the Kakhovka dam in Ukraine illustrates the potential consequences. UN human-rights investigations recorded deaths, injuries, displacement, destruction of homes and difficulties accessing potable water and basic services, while the cause and broader consequences continued to be investigated. (ECHR)

The legal assessment of a dam incident depends heavily upon:

how the breach occurred;

whether it was intentionally caused;

whether the facility constituted a military objective;

anticipated civilian consequences;

precautions taken;

and the applicable treaty and customary rules.

11. Cyberattacks and the UN Charter

A major unresolved question concerns when a cyberattack constitutes a prohibited use of force under Article 2(4) of the UN Charter.

One influential approach considers the scale and effects of a cyber operation.

For example, a cyberattack causing:

destruction of generators;

explosions;

physical equipment damage;

deaths; or

major prolonged infrastructure failure

could more readily be characterized as comparable to conventional uses of force.

Academic analysis notes that states increasingly examine cyber operations through a scale-and-effects approach, although the legal position regarding cyber operations causing only loss of functionality remains unsettled. (OUP Academic)

12. State Responsibility

Where a cyber or physical attack is attributable to a state, the law of state responsibility may become relevant.

Important questions include:

Attribution

Was the operation conducted by:

state armed forces?

intelligence services?

government employees?

a state-controlled entity?

a proxy?

a private hacker acting under state direction or control?

Breach

Did the conduct breach:

the UN Charter?

IHL?

bilateral treaties?

energy agreements?

international environmental obligations?

cybersecurity commitments?

Consequences

An internationally wrongful act may trigger obligations concerning:

cessation;

assurances of non-repetition;

reparation;

compensation;

restitution where appropriate.

Attribution is often one of the hardest problems in hybrid warfare because deliberate ambiguity can be part of the strategy.

13. Human Rights Law

Energy disruptions can also engage human-rights obligations.

Electricity failures may affect:

the right to life;

physical integrity;

health;

housing;

family life;

access to essential services.

The European Court of Human Rights' Ukraine litigation demonstrates the broader relevance of human-rights law to conflict-related destruction and attacks. In Ukraine and the Netherlands v. Russia, decided by the Grand Chamber in July 2025, the Court held Russia responsible for widespread human-rights violations arising from the conflict. (ECHR)

The case was not a standalone judicial ruling specifically determining the legality of a cyberattack against an electricity grid. Its importance lies in demonstrating that conflict-related conduct can generate international human-rights responsibility in addition to IHL questions.

14. Important Case Laws and Legal Authorities

14.1 Ukraine and the Netherlands v. Russia — ECtHR, 2025

The Grand Chamber judgment concerned extensive violations arising from the conflict in Ukraine beginning in 2014 and continuing through Russia's full-scale invasion.

The Court found Russia responsible for widespread human-rights violations. (ECHR)

Relevance

The case demonstrates that state conduct during hybrid and conventional conflict can be examined through international human-rights law, alongside other bodies of international law.

14.2 Georgia v. Russia (II) — ECtHR

This litigation concerning the 2008 Russia-Georgia conflict is significant for understanding the relationship between military operations, occupation, territorial control and human-rights obligations.

Its broader relevance to energy infrastructure is that critical infrastructure located within territory affected by armed conflict may raise both humanitarian-law and human-rights questions.

14.3 Armed Activities on the Territory of the Congo (DRC v. Uganda) — ICJ, 2005

The International Court of Justice considered Uganda's military activities and associated violations of international law.

Relevance to energy infrastructure

Although not an energy-infrastructure case, it is important for the principle that states may incur international responsibility for unlawful conduct during military operations and for violations occurring in territory under their involvement or control.

14.4 Oil Platforms (Iran v. United States) — ICJ, 2003

This is particularly important to energy-law research because it involved attacks on oil platforms.

The ICJ examined whether attacks on Iranian oil platforms could be justified as necessary and proportionate measures of self-defence.

Importance

The case illustrates that energy infrastructure does not exist outside the general rules governing the use of force.

The legality of attacking an energy asset must be assessed through the applicable international-law framework rather than simply through the strategic importance of the facility.

14.5 Ukrainian Power-Grid Cyberattacks

The 2015 Ukrainian power-grid attack is one of the most important real-world examples of cyber operations against energy infrastructure.

The attack caused a blackout affecting approximately 225,000 people. (Chatham House)

The incident is legally significant because it raises questions concerning:

attribution;

sovereignty;

non-intervention;

use of force;

armed attack;

civilian infrastructure;

due diligence;

state responsibility.

However, there has not been a definitive international court judgment establishing a complete legal classification of the 2015 cyberattack.

15. Hybrid Warfare and Critical Infrastructure Protection

Modern energy law therefore increasingly needs to move from a narrow concept of physical security toward resilience regulation.

A comprehensive legal framework should address:

Cybersecurity

Energy operators should have obligations concerning:

vulnerability assessments;

incident reporting;

network segmentation;

backup systems;

access controls;

supply-chain security.

Physical security

Regulation should protect:

substations;

pipelines;

power plants;

transmission corridors;

LNG terminals;

control centres.

Emergency preparedness

Operators should maintain:

black-start capabilities;

emergency generation;

backup communications;

spare transformers;

disaster-recovery plans.

Information sharing

Governments and private operators should establish mechanisms for sharing threat intelligence.

16. Supply-Chain Risks

Hybrid warfare can also exploit energy-sector supply chains.

Examples include compromised:

software;

industrial controllers;

transformers;

communication equipment;

cloud services;

remote-management systems.

A hostile actor may therefore infiltrate an energy system long before an actual attack occurs.

This creates a regulatory need for energy cybersecurity procurement rules, including security requirements for vendors and contractors.

17. Energy Market Manipulation

Hybrid warfare can also operate through markets.

Possible techniques include:

manipulation of supply expectations;

coordinated disinformation;

strategic withholding;

attacks on energy trading platforms;

disruption of commodity logistics;

manipulation of market information.

Such conduct may trigger domestic energy-market and competition law as well as international legal questions.

The legal framework therefore increasingly overlaps among:

Energy Law + Cybersecurity Law + Competition Law + International Law + National Security Law.

18. Attribution as the Central Legal Problem

One of the most difficult issues is attribution.

Suppose an electricity-grid attack is conducted by a private hacker group.

There are several possibilities:

The group acts independently.

The group receives financing from a state.

The group receives intelligence from a state.

The group operates under state instructions.

The group is effectively incorporated into state security structures.

Each possibility can lead to different legal consequences.

Therefore, energy cybersecurity legislation should establish strong requirements for:

logging;

evidence preservation;

incident reporting;

forensic investigation;

cross-border cooperation.

These mechanisms can assist later attribution and legal proceedings.

19. The Role of Tallinn Manual

The Tallinn Manual is an influential expert study concerning the application of international law to cyber operations. It is not a treaty and is not legally binding. (Cambridge University Press)

Its importance lies in providing structured analysis of questions such as:

sovereignty;

use of force;

non-intervention;

self-defence;

IHL;

cyberattacks;

civilian objects.

Tallinn Manual analysis becomes particularly relevant when a cyber operation affects energy infrastructure during an armed conflict.

20. Russia–Ukraine as a Major Case Study

The Russia–Ukraine conflict provides one of the clearest examples of hybrid warfare against energy infrastructure.

The pattern has included:

Cyber operations + physical attacks + energy-supply pressure + infrastructure destruction + information operations.

The 2015 power-grid cyberattack demonstrated the cyber dimension. Later attacks against electricity infrastructure demonstrated how cyber and physical dimensions could exist within a wider conflict environment. NATO has described Ukraine as a prominent example of hybrid pressure involving energy supply disruptions, cyberattacks, political and economic influence and disinformation. (NATO)

During the 2022–23 winter, attacks on electricity-related installations produced extensive civilian consequences, including electricity, heating and water disruptions. (ECHR)

These events demonstrate why energy infrastructure should be treated as a strategic civilian-resilience issue, not merely an industrial-security issue.

21. Legal Challenges for Future Energy Systems

The transition toward:

smart grids;

distributed generation;

battery storage;

hydrogen;

electric vehicles;

digital energy markets;

AI-controlled grids;

virtual power plants

will create additional hybrid-warfare risks.

For example, an attacker could potentially target an aggregated network of distributed resources rather than one large power plant.

This means future energy legislation should address systemic cyber resilience, not simply protection of individual physical assets.

22. Recommended Legal Framework

A comprehensive legal framework for hybrid threats to energy infrastructure should contain at least eight elements:

23. Conclusion

Hybrid warfare creates a fundamental transformation in the legal understanding of energy security. Energy infrastructure can be attacked without conventional military operations through cyber intrusion, sabotage, supply disruption, economic coercion and information operations.

The Ukrainian power-grid attacks demonstrate that cyber operations can have immediate and tangible consequences for civilian electricity supply. (NATO) The subsequent attacks on Ukraine's energy infrastructure demonstrate the potentially enormous humanitarian consequences when digital, physical and military threats converge. (ECHR)

International law already provides important principles—particularly distinction, proportionality, military necessity, protection of civilians, state responsibility and human rights—but significant uncertainty remains concerning cyber operations that disable infrastructure without physically destroying it. The Tallinn Manual provides influential expert analysis, but it does not itself create binding law. (Cambridge University Press)

The emerging legal approach should therefore combine energy regulation, cybersecurity, international humanitarian law, human-rights law and national-security regulation. The central objective should be not only preventing attacks but ensuring that energy systems remain sufficiently resilient to withstand and rapidly recover from hybrid threats.