Contrary to popular view, cyberattacks alone are rarely exercises of constitutional war powers—and they might never be. They are often instead best understood as exercises of other powers pertaining to nonwar military, foreign affairs, intelligence, and foreign commerce, for example. Although this more fine-grained, fact-specific conception of cyberattacks leaves room for broad executive leeway in some contexts, it also contains a strong constitutional basis for legislative regulation of cyber operations.
