It seems to me that some of the common practices that are referred to as “active” cyber operations are modern-day equivalents of things such as wearing the enemy's uniform, the kinds of things that we've tried to prohibit specifically in international conventions. I know that misuse of uniforms was prohibited in The Hague convention of 1907.
Within our NATO partnerships, have there been any activities you're aware of—and I know that it's not necessarily in your mandate—to try to draw some very specific lines around what would be acceptable in the use of active cyber operations?