In 2018, United States Cyber Command announced a new operational concept to "defend forward" against other states whose cyber operations against the United States have been hostile, but short of an armed attack. Defend Forward supports the U.S. strategy of persistent engagement, which recognizes the need to continuously engage to inhibit incessant adversarial cyber operations against the United States. Although the public Defend Forward description was short on details, it consists of three general components: (1) positioning to degrade cyber operations; (2) warning to gather information about threats and inform defenses; and (3) influencing adversaries to discourage them from deploying cyber operations against the United States. In the year since the announcement of the Defend Forward concept, there has been vital debate about whether the United States should defend forward. This paper examines a related but distinct question: Could the United States defend forward under international law, and if so, what limits does the law impose? This paper concludes that international law provides the United States with significant leeway to position itself to degrade adversaries' cyber operations, gather information about cyber threats, and discourage other states from acting against the United States in cyberspace. Although international law imposes vital limits on operational concepts such as Defend Forward, there is a significant gap between those boundaries and how the United States has defended against cyber aggression short of armed conflict.
