When the first host-to-host message was sent across the ARPANET in October 1969, few could have fully anticipated the degree to which the internet, and now the internet of things, would explode across the globe and revolutionize nearly every facet of public and private life. Nor could anyone have predicted the degree to which it would establish an entirely new realm—cyberspace—through which States could engage in traditional, and not-so-traditional, statecraft and conflict. However, it is now clear that States have fully embraced cyber operations as a means to pursue their national interests and gain low-cost asymmetric advantages over their adversaries. Cyberspace has become a new instrument of statecraft and presents novel and challenging questions about the applicability of existing legal orders. Adversaries are leveraging and exploiting the numerous technical, policy, and legal ambiguities surrounding cyberspace operations to conduct a range of intrusive and increasing aggressive activities. While some of these cyber operations have been conducted as part of ongoing armed conflicts, the vast majority have taken place in the so-called gray zone—the far more uncertain space between war and peace. Also known as gray-zone challenges or gray-zone conflicts, these activities are more accurately understood as actions that are coercive and aggressive in nature and rise above normal, everyday peacetime geo-political competition, yet remain below the threshold of war. This chapter will identify and consider some of the more challenging domestic and international legal issues raised by the conduct of cyber operations in the gray zone between peace and war.