Get off my cloud: cyber warfare, international humanitarian law, and the protection of civilians

Abstract

Cyber warfare figures prominently on the agenda of policymakers and military leaders around the world. New units to ensure cyber security are created at various levels of government, including in the armed forces. But cyber operations in armed conflict situations could have potentially very serious consequences, in particular when their effect is not limited to the data of the targeted computer system or computer. Indeed, cyber operations are usually intended to have an effect in the ‘real world’. For instance, by tampering with the supporting computer systems, one can manipulate an enemy's air traffic control systems, oil pipeline flow systems, or nuclear plants. The potential humanitarian impact of some cyber operations on the civilian population is enormous. It is therefore important to discuss the rules of international humanitarian law (IHL) that govern such operations because one of the main objectives of this body of law is to protect the civilian population from the effects of warfare. This article seeks to address some of the questions that arise when applying IHL – a body of law that was drafted with traditional kinetic warfare in mind – to cyber technology. The first question is: when is cyber war really war in the sense of ‘armed conflict’? After discussing this question, the article goes on to look at some of the most important rules of IHL governing the conduct of hostilities and the interpretation in the cyber realm of those rules, namely the principles of distinction, proportionality, and precaution. With respect to all of these rules, the cyber realm poses a number of questions that are still open. In particular, the interconnectedness of cyber space poses a challenge to the most fundamental premise of the rules on the conduct of hostilities, namely that civilian and military objects can and must be distinguished at all times. Thus, whether the traditional rules of IHL will provide sufficient protection to civilians from the effects of cyber warfare remains to be seen. Their interpretation will certainly need to take the specificities of cyber space into account. In the absence of better knowledge of the potential effects of cyber warfare, it cannot be excluded that more stringent rules might be necessary.

Changing Notion of Object and Targeting Data Under the Law of Armed Conflict

“…63 Droege looks from a different perspective and states that if a cyber operation which disrupts 'the functioning of objects without physical damage or destruction, even if the disruption is temporary' should be regarded as an 'attack' since, inter alia, there is no difference whether making a civilian object useless by giving it physical damage or not. 64 Although this broader understanding seems sensible when there are some instances in which there is no difference for an attacker to gain the same advantage either by neutralizing or disrupting rather than attacking to military object, the weakness of the argument is that not every cyber operation which contributes to the military position of the belligerent party may be qualified as an attack. 65 Therefore, the determination should be based on whether the intention of the perpetrator is to conduct an attack or operation.…”

The International Review of the Red Cross: Witness to the humanitarian revolution

“…Among the most influential pieces on IHL that we have run, we would mention Sylvain Vité's article on the typology of conflicts, 11 Marco Sassòli and Laura M. Olson's article on the relationship between IHL and human rights law, 12 and Cordula Droege's article on the applicability of IHL to cyber warfare. 13 Not only ICRC staff but also academics and other humanitarian practitioners have published articles that have driven the debate forward. These include Daniel Bar-Tal, Lily Chernyak-Hai, Noa Schori and Ayelet Gundar on perceptions of victimhood in protracted conflicts, 14 Beth Ferris on faith-based and secular humanitarian organizations, 15 and Peter Asaro on autonomous weapon systems.…”

Decoding Article 8 of the International Law Commission’s Articles on State Responsibility: Attribution of Cyber Operations by Non-State Actors

“…Therefore, it is still true that 'the same legal criteria apply [to the cyber domain] as with any other attribution of the conduct of private parties to a state'. 151 Thirdly, it is possible to argue that the Nicaragua test, even if correctly decided at the time, should be seen through the historical prism of its origin, which was far removed from the modern reality of cyber attacks occurring in the virtual world. Accordingly, challenges posed by operations in cyberspace could not have been foreseen by the ICJ, which had completed its deliberations three years before Tim Berners Lee laid groundwork for the future World Wide Web.…”