Introduction
The use of force in modern warfare has advanced well beyond traditional international law practices, especially regarding the models of force. Modern conflicts are becoming more dependent on unconventional means, sanctioning diverse operations such as hacking and targeted interventions which are blurring the lines between peace and armed warfare.
The Iran-Israel-USA conflict of 2025 is a notable example of contemporary conflicts exceeding the scope of traditional warfare. Cyberattacks, targeted assassinations, and proxy militias are now popular among states. These shifts have placed substantial pressure on the classical interpretation of jus ad bellum, especially the interpretation of Article 51 of the United Nations Charter (“UN Charter”), where the use of force, according to the principle of self-defence, is justified in response to a manifest armed attack. The concern addressed in this article is whether the current legal frameworks in place regarding the use of force are sufficient in addressing these changing realities. It poses critical questions, such as: Will a military response be expected in the event of a cyber operation? What occurs in case these assaults are not one-time events but a pattern of assaults? Does the international legal system have the complexity to identify emerging forms of aggression, or should it be changed?
Within the context of the Iran-Israel-USA triangle, the article argues that principles like normative aggregation and incremental escalation may offer an improved approach to viewing and managing modern conflicts. Such notions enable us to consider whether a series of low-intensity attacks, collectively considered, can invoke the right of self-defence, although individual acts may not fulfil the conventional threshold. In this way, the article critically analyses the boundaries of the jus ad bellum principle and suggests; firstly, to follow the Accumulation of Events Theory, which acknowledges the trend of progressively hostile acts as a cumulative justification for self-defence; and secondly, the adoption of the doctrine of Incremental Escalation, which takes into consideration the effects of minor and frequent attacks that barely harm individuals.
The Iran-Israel-USA triangle
The conflict between Iran, Israel and America shows a transition to new forms of aggression, which are less noticeable. Iran is alleged to direct proxy attacks, cyberattacks and indirect attacks upon Israel and U.S. interests. As an example, Iran uses proxy forces, including the Hezbollah and the Houthis, arming, training and funding them to exercise power and make opponents pay without going into actual warfare themselves. In 2020, Iranian-related hackers tried to take down Israeli water systems. In its turn, Israel has conducted targeted killings and acted against cyber operations, with the U.S. itself not leaving the scene, providing military assistance and pressure. These actions typify a case of the grey zone conflict, with the adverse activities that do not always reach the conventional level of armed attack to pose a threat to the international legal order.
This cycle of escalation has only intensified in recent years. In June 2025, Israeli interest organisations such as “Predatory Sparrow” hacked Sepah Bank and Nobitex cryptocurrency in Iran, claiming to have destroyed the data. Furthermore, pro-Iranian attacks on nuclear and military complexes were observed in June 2025. This multifaceted environment is also visible in the USA’s Operation Midnight Hammer, where, United States struck three major nuclear sites inside Iran. Iran retaliated on June 23, launching a missile attack on U.S. forces stationed at the Al Udeid Air Base in Qatar. This raises questions on the justification of self-defence.
Such concurrent actions, taken in isolation, are not independently severe enough to invoke Article 51 of the UN Charter. This raises a serious question of whether, collectively, they meet the criteria of force in self-defence or not. Cyberattacks also have the nature of leaving little evidence of their existence which can complicate attribution and allow states to act in a grey area. Such operations may also ignore territorial borders: malware implanted in one jurisdiction may disable infrastructure in another jurisdiction, blurring territorial boundaries. Therefore, the secretive nature of cyber and proxy attacks, along with the use of proxies by attackers, provides potential suspects with plausible deniability regarding arrest or prosecution, leading to legal confusion and an increased risk of further acts of aggression. This ongoing trend of deniable and diffuse hostilities continually challenges the limits of international law, which requires a flexible interpretation to maintain global peace and security.
Blurring lines
The use of cyber activities and proxy forces in current hostilities complicates the legal standards that traditionally govern the use of force. In Nicaragua v. the USA, the International Court of Justice (“ICJ”) held that a state can only be held responsible for the actions of non-state actors if it exercises “effective control” over their operations. This threshold is difficult to meet when dealing with loosely affiliated militias, covert cyber operations, or ideologically driven groups. In The Prosecutor v. Tadić, the Appeals Chamber suggested that the requisite ‘degree of control may … vary according to the factual circumstances of each case’.
Iran’s support for Hezbollah, the Houthis, and other cyber units raises questions about whether Iran’s actions can be linked to involvement with proxy groups. Although Iran might not directly control every attack, providing resources, funding, and training suggests a larger indirect involvement. Experts have proposed applying the “overall control” criterion (used in Tadić), which recognises that attribution standards are lower in cases involving organised armed gangs. As the line between state and non-state conduct blurs, therefore, the law must reconsider attribution methods in the grey areas of cyber warfare and proxy conflicts to ensure accountability without undermining the standards of jus ad bellum.
Towards a New Self-Defence Paradigm: Normative Aggregation and Incremental Escalation
Modern warfare has attempted to redefine the concept of self-defence. In the past, the right to self-defence has only been invoked whenever we have had a single identifiable armed attack. However, in the new environment of grey-zone war, that level is no longer enough to deal with the character of the dangers encountered. Hybrid warfare tactics have evolved strategically, often deniable and destabilising in their effect. The emerging type of warfare requires a more sophisticated doctrinal perspective; a prism that embraces normative aggregation or incremental self-defence mechanisms and adopts the reasoning of progressive increase.
Normative Aggregation
Normative Aggregation is when normative weights of the two claims, neither of which standing alone is sufficient to establish liability, would be aggregated, and the combined weight of the two claims would establish liability. Under international law this theory is referred to as ‘Accumulation of Events Theory’ or Nadelstichtaktik. It substantiates as while one of the attacks by itself would be insufficient to meet the gravity threshold of an armed attack, the accumulation of more minor attacks potentially could. The essence of this approach is also asserted by various scholars like Yoram Dinstein and Christian Gray who point out how subsequent pin-prick attacks can in aggregate constitute an armed attack under Article 51 of the U.N. Charter and how to determine state responsibility, often necessitates examining the course of conduct, and not discrete acts. The U.N. Resolution of 2002 further reflects the idea of Accumulation of Events Theory.
The state does not have to wait until a devastating individual assault takes place to mobilise Article 51. Instead, a state can recognise the combination of hostile actions that would not rise to the level of armed attack on its own as an armed attack, for instance, the USA’s drone strike killing Qaseem Soleimani was justified as a response to an escalating series of armed attacks. It is also in tandem with the collective self-defence, which allows states to defend their allies when they are experiencing aggression by a common enemy.
Incremental escalation
Escalation, when discussing international conflict, can be defined as successive, visible, and significant increases over time in the vertical, horizontal, and political dimensions of a dispute. It implies that aggressive acts cannot be considered individually but as components of a systematic effort that does not entail a desire to face legal effects and, at the same time, the realisation of strategic debilitation of an adversary. The repeated use of low-intensity force targeting core sovereign interests such as military infrastructure, digital sovereignty, or a maritime commercial route highlights a deliberate escalation that warrants a proportionate legal response.
The intersection
Although these two doctrines differ, they overlap considerably in their response to sustained hybrid aggression. The new Israeli-Iran-USA rivalry is an example of both these policies in practice. When Iran seems to have interfered with the Iron Dome of Israel over the internet in March 2025, and other subsequent attacks, these are more than a tactical nuisance. These are indicators of a deliberate hybrid war conflict. While such individual actions may be inadequate to warrant wholesale retaliation, the frequency and net effect of the actions may cause it to lead to that.
In that respect, Israel can use the ‘accumulation of events’ self-defence to declare Iran a de facto armed attack, as it repeatedly attacked Israeli sovereignty, both via cyberspace and kinetically. Similarly, the United States can invoke collective self-defence on behalf of Israeli interests, particularly when there is an attack using drones and rockets by Iran-backed militias. Simultaneously, the gradual increase in proxy and cyberattacks on U.S. properties in Syria, Iraq, and the Gulf also gives it a legal and strategic right to proportional retaliation even without a declaration of war.
Furthermore, in a normative perspective, doctrines such as the Accumulation of Events favour the progressive evolution of international law to rise to hybrid threat challenges. It is just like the definition of aggression had to change. The definition of aggression adopted by the General Assembly (UNGA Res. 3314, 1974) did not simply restate existing law; it was adopted because, in earlier formulations of the concept of aggression, legal thought recognized only direct means of aggression and conventional military invasions, and could not capture indirect but hostile means of aggression. By generalizing the concept, international law was being receptive to the manner in which force was being utilized in practice. These doctrines induce a legal innovation that can be used to inspire state behaviour, opinion of ICJ and discussions at UNSC, thus rendering international law relevant in the face of contemporary wars.
The critics can counter the above view with the argument that defining the term armed attack in a wider way will jeopardise the prohibition on the use of force. Yet there is a riskier danger of legal frameworks going paralysed as it is unable to adjust themselves. By remaining oblivious to this new nature of the use of threats, international law would only run the risk of inviting state and non-state actors to weaponise the grey zone at complete impunity.
Conclusion
The Iran-Israel-USA triangle highlights the growing gap between the emerging threat of war and the static contours of jus ad bellum. Cyber sabotage, proxy wars, and drone strikes are rarely isolated or obvious; they are long-term, plausibly deniable, and tactically proportionate responses operating below the threshold of traditional armed attack. As a result, the moral framework intended to limit the use of force no longer functions effectively and fails to reflect new realities.
In an attempt to fill this normative gap, this article suggests a bilateral solution which broadly substantiates ‘Accumulation of Events’ theory and Doctrine of ‘Incremental Escalation’. These models allow calibrated responses that satisfy the need and proportion and adapt to new forms of conflict.
But the real question persists: will the international law remain credible when it entirely disavows violence in its present-day form? As long as no effort is made to take hybrid threats seriously and not to treat them as fringe phenomena, the law runs a danger of becoming irrelevant, rendering its ability to provide protection and legitimacy where they are most needed. The reaffirmed jus ad bellum with consideration of continuity, complexity and concealment is not just a choice but will become an inescapable development. The future does not lie with a weakening of legal criteria, but with a struggle to hold the hard questions of attribution, threshold and response. This critical discussion is needed in the future, and it has to start now.
Anshika Gupta and Pulak Bisen are third-year students at Rajiv Gandhi National University of Law, Punjab.
Picture Credit: Richard Fleming
Jindal Forum for International and Economic Laws 