Contrary to popular view, cyberattacks alone are rarely exercises of constitutional war powers – and they might never be. They are often instead best understood as exercises of other powers pertaining to nonwar military, foreign affairs, intelligence, and foreign commerce, for example. Although this more fine-grained, fact-specific conception of cyberattacks leaves room for broad executive leeway in some contexts, it also contains a strong constitutional basis for legislative regulation of cyber operations.
Matthew C. Waxman,
Cyberattacks and the Constitution,
The Hoover Institution Working Group on National Security, Technology & Law, Aegis Series Paper No. 2007; Columbia Public Law Research Paper No. 14-675
Available at: https://scholarship.law.columbia.edu/faculty_scholarship/2725