Cyber Operations falling under "Attack" in IHL

Introduction

The increasing use of cyber operations during international armed conflict encapsulates the ever-evolving nature of the concept of warfare.¹ This development raises a number of concerns in today’s increasingly cyber-dependent societies, in which malicious cyber activities threaten to cause significant disruption to societies and harm to people.² States such as the United Kingdom (UK), the United States of America (USA) and Australia have publicly disclosed their use of cyber operations in their conflict against ISIS.³ In addition, cyber operations have affected other countries involved in armed conflict, such as Georgia in 2008, Ukraine in 2015-2017 and Saudi Arabia in 2017.⁴ These incidents show an increase in cyber operations and evidence that the means of warfare are evolving, with almost 100 states having developed cyber military capabilities.⁵

This paper examines the meaning of “attack” under international humanitarian law (IHL), and whether cyber operations fall under the definition. There is a relative degree of consensus that cyber operations that cause injury or harm to objects or civilians constitute an attack; however, when it comes to other forms of harm, expert viewpoints differ. This paper suggests an effects-based approach, in which the effect and scale of a cyber operation can be used as criteria to decide what constitutes an attack. Those cyber actions that do not constitute an attack under the Protocol Additional to the Geneva Conventions of 12 August 1949 and Relating to The Protection of Victims of International Armed Conflicts, 1977⁶ (hereinafter referred to as “API”) can protect civilians from harm under other IHL rules, such as military operations and necessity.

This paper first examines the concept of cyberspace and its potential regulation under IHL’s general principles. It then explores the term “attack” under IHL as well as the fundamental concepts of distinction and proportionality. The final section analyses the difficulties in interpreting the term “attack” in the context of cyber operations as well as how the guiding principles of IHL, such as the rules of proportionality and distinction, apply.

Definition of Cyber Space

The term cyberspace was coined by William Gibson in his 1984 book, Neuromancer,⁷ as an “interdependent network of information technology infrastructures, and includes the Internet, telecommunications networks, computer systems, and embedded processors and controllers in critical industries.”⁸ The term “cyberspace” refers to the virtual computer world and, more specifically, an electronic medium that facilitates online communication.⁹ Cyberspace is a domain in which people share information, interact with one another, participate in discussions or social media platforms, and take part in various kinds of other activities.¹⁰

Cyber Warfare: Does International Humanitarian Law Apply?

Whether IHL applies to cyber operations during armed conflict remains a matter of debate. While debate persists, according to the ICRC, there is no doubt that cyber activities during armed conflicts, or cyber warfare, are governed by IHL, just as any weapon, means, or method of warfare, used by a belligerent in armed conflict. The fact that cyber operations rely on new and constantly evolving technology does not exclude the application of IHL to the use of such technologies as means or methods of warfare.¹¹

Certain IHL norms are designed to anticipate the development of new means and methods of warfare and presumed that IHL would apply to them. An important and more recent IHL rule in this respect is enshrined in Article 36 of the API, which states that in the study, development, acquisition, and adoption of a new weapon, means, or method of warfare, High Contracting Parties must determine if their new weapon, means, or method of warfare would be prohibited by this Protocol or other international law.¹² This assumption is based on the obligation that IHL applies to the new means and methods of warfare, which include methods of warfare relying on technology.¹³ This was affirmed by the International Court of Justice in its Advisory Opinion on the Legality of the Threat or Use of Nuclear Weapons, where it held that established principles and rules of humanitarian law applicable in armed conflict apply “to all forms of warfare and to all kinds of weapons”, including “those of the future”, which in this case would include cyber operations.¹⁴

The increasingly shared view of states and international organisations is that IHL applies in cyberspace and restricts its application in cyberspace. According to the UN Group of Governmental Experts Report 2013 and 2015, “international law, particularly the UN Charter, is applicable in the context of information and communication technology,” a conclusion confirmed by the UN General Assembly.¹⁵ Similarly, the European Union and NATO have accepted the application of IHL to cyber operations, and the Paris Call for Trust and Security in Cyberspace (supported by seventy-eight states as of April 2020) has reaffirmed the applicability of IHL to cyber operations during armed conflict as well.¹⁶ In the Paris Call, states have expressed their opposition to the militarisation of cyberspace and concerns about the legitimisation of military cyber operations.¹⁷ However, IHL sets limits on the conduct of hostilities when states or non-state parties decide to resort to cyber operations during an armed conflict. In such cases, IHL would be applicable, and the principles of distinction, proportionality, and military necessity would need to be respected.¹⁸

Attacks under International Humanitarian Law

In IHL, the term ‘attack’ refers to a particular category of military operations. It is defined in Article 49 of API as “acts of violence against the adversary, whether in offence or in defence.”¹⁹ An attack is an operatively key threshold in IHL because many of its core restrictions apply to acts qualifying as such.²⁰ Attacks are not ipso facto illegal or contrary to IHL; rather, IHL defines certain situations in which attacks can be carried out in a manner that allows a belligerent party to achieve a military advantage within its limitations.

One must keep in mind that the term attack comes into operation once the armed conflict has commenced. Under IHL, attacks can only be conducted during hostilities. ‘Combat action’ refers to a host of activities against the adversary, either in offence or defence, and the concept of ‘attacks’ falls within this ambit. The distinction between ‘combat action’ and ‘attack’ is that combat action’ does not require the use of violence, such as deploying troops and artillery batteries in strategic locations.²¹

The word ‘attack’ refers to the application of physical force by a belligerent Party against its adversary. Thus, the concept of ‘attacks’ does not cover non-physical means of psychological or economic warfare such as the dissemination of propaganda and embargoes.²² This distinction is important when determining whether cyber operations constitute ‘attacks’ for the subsequent application of IHL.

The Principles Governing the Notion of Attack under IHL

API sets out cardinal principles that a belligerent Party must bear in mind when conducting an attack. The first is the principle of distinction. This principle states that parties at all times distinguish between the civilian population and combatants and between civilian objects and military objectives and accordingly direct their operations only against military objectives except if they participate in direct hostilities.²³ A military objective must have two components: an effective contribution to military action and a definite military advantage.²⁴

The second important rule is the rule of proportionality, which serves to minimise the collateral damage to civilian life during the conduct of an attack. This rule applies only when a military objective is the object of attack and where incidental damage is foreseeable. Thus, a proportionality assessment requires the balancing of the military advantage expected to be gained from the destruction, capture or neutralization of a military objective, and the foreseen incidental damage harm to civilians and civilian objects caused by the military intervention.²⁵ The rule states that anticipated incidental loss of human life and damage to civilian objects should not exceed the military advantage expected from destruction of military objective.²⁶

Cyber Operations as Attack under IHL

Determining whether cyber operations fall under the definition of an attack under IHL is a complex issue. Cyber operations involve the use of digital techniques to disrupt or compromise computer systems, networks, or infrastructure.²⁷ The applicability of IHL to cyber operations is a topic of ongoing debate and has not been definitively settled. The term ‘attack’ has been given different interpretations by the experts, the ICRC, and the states.

The majority view is that cyber operations that may cause death, injury to persons, or damage to objects are considered attacks, as per the definition under Article 49 API.²⁸ It is well known that the concept of violence in this definition can refer to either the means of warfare and their effects, noting that an operation that has a violent effect can be an attack even if the means used to cause these effects themselves are not violent.²⁹ Based on this understanding, the Tallinn Manual, an academic study on the application of international to the cyberspace, has suggested that “a cyber-attack is a cyber operation, whether offensive or defensive, that is reasonably expected to cause injury or death to persons or damage or destruction to objects.”³⁰ The definition of “attack” adopted in the Norwegian and New Zealand military manuals mirrors the definition adopted in the Tallinn Manual 2.0.³¹ It is widely accepted by states, the ICRC, and experts on this issue that at least cyber operations that cause death, injury, or physical damage constitute attacks under IHL. Some states expressly include harm resulting from the foreseeable indirect (or reverberating) effects of an attack, and this is the view of the ICRC as well.³² For example, this could be the case if a cyberattack on the electricity supply to a hospital killed patients in an intensive care unit.³³

Experts have different views on whether a cyber operation that disable an object without physically harming it constitutes an attack under IHL.³⁴ There were elaborate discussions on this during the drafting of the Tallinn Manual. A wide majority of experts held that a cyber operation constitutes an attack if it is expected to interfere with the functionality of an object that requires the replacement of physical components.³⁵

In contrast, some experts are of the view that cyber operations will be considered an attack if the restoration of functionality requires the reinstallation of the operating system or of particular data. Thus, the attack is identified by the need for the adversary to take action in order to restore the infrastructure or system (equipment repair, part replacement, network reinstallation, etc.).³⁶ This view is shared by Chile, which states that if the results of an operation require affected states to “take steps to repair or restore affected infrastructure and computer systems,” the operation qualifies as an attack.³⁷

The ICRC’s view on this subject matter is that any operation that is designed to disable a computer or computer network during an armed conflict amounts to an attack defined in IHL, whether or not the object is disabled through destruction or some other way.³⁸ Because the definition of military objectives in Article 52(2) AP I refers to those objectives whose “neutralization” as a result of a possible attack would give the other Party a military advantage, the concept of “attack” under Article 49 AP I should be understood to include activities intended to impair the functioning of objects despite not causing physical damage or destruction. An overly restrictive understanding of the concept of attack may undermine the object and purpose of the rules for the conduct of hostilities aimed at ensuring the protection of civilians and civilian goods from the effects of hostilities.³⁹

The effect of a certain cyber activity can be used as a criterion to assess whether it is a cyber operation. The scope of the term ‘attack’ is often determined by the consequences of an operation as opposed to its nature. This criterion is based on the opinions of experts in the Tallinn Manual.⁴⁰ In the Nicaragua v U.S. judgement, the International Court of Justice stated that the scale and effects of an attack must be weighed when evaluating whether certain actions constitute an armed attack, which would constitute a violation of Article 2(4) of the UN Charter’s prohibition on the use of force.⁴¹ Similarly, the Tallinn Manual experts concluded that there is no reason to exclude cyber operations from the scope of acts that may constitute a use of force if the scale and consequences of the operation in question are comparable to those of non-cyber operations that would qualify as such.⁴² Though they may be carried out through non-kinetic means, cyber operations can have violent consequences. For example, a cyber operation that alters the running of a SCADA system controlling an electrical grid and results in a fire qualifies.⁴³

On the other hand, other cyber operations may not have physical or violent effects, but may result in interference of functionality, which, as discussed above, may qualify as damage if restoration of functionality requires the replacement of physical components. Thus, a cyber operation that targets an electricity grid’s computer-based control system, which would require the replacement of certain components or the entire system, would qualify as an attack.⁴⁴ In another situation, if the effect of a cyber operation is such that it disables an object and the effect is such that it loses its operability,⁴⁵ then under the above-mentioned criteria, it will amount to an attack. As a result, the effect-based criterion can be utilised to determine whether a certain cyber operation constitutes an attack.

Depending on the effects of the operation, any operation against the data may constitute an attack. If data is deleted or manipulated in a way that is intended or expected to cause death or injury to a person, or damage to (by disabling) a physical object, the operation will qualify as an attack, regardless of whether the data itself constitutes an object of attack for the purposes of IHL. If the effect of a cyber operation is such that it aims to tamper with or delete data, it may have the indirect effect of destroying the object in question on which said data is stored, such as a local server.⁴⁶ Thus, the consequence-based approach indicates that a data breach would be considered an attack because its effect would cause harm to the object regardless of whether it falls under the concept of an object.

The Principles of IHL Governing the Cyber Space

In the context of cyber operations, the principle of distinction can be applied by ensuring that cyberattacks are directed only at legitimate military objectives or combatants, rather than indiscriminately targeting civilian infrastructure or non-military systems. However, civilians may be at risk due to the interconnectedness of cyberspace, which is where the precautionary principle comes into operation.

The principle of distinction prohibits indiscriminate attacks, including attacks using cyber means and methods of warfare. An indiscriminate attack is a type of attack that fails to differentiate between civilians or civilian objects, and combatants and military objectives. For example, malware that exploits vulnerabilities in civilian and military systems, self-propagates and are released into open networks would be considered an indiscriminate attack. Similarly, certain cyber operations may be aimed at military objectives, but once released, are likely to spread uncontrollably and are expected to cause disproportionate harm to civilians.⁴⁷

In its position paper, the ICRC has suggested a few steps that can be taken to ensure that the principle of distinction is respected. From a technological perspective, cyber tools can be programmed and used to target and harm only specific objects and not spread harm indiscriminately. Faced with these risks, those planning or conducting cyber operations must take all feasible steps to ensure that the target is a military objective to remain within the prescribed limits of IHL.⁴⁸

With regards to the principle of proportionality, one must bear in mind that the harm in cyber operations may be different from more traditional kinetic operations. For example, a cyber operation could incidentally disable civilian objects without physically damaging them, but the effects may be more widespread due to the interconnectedness of cyberspace. Thus, proportionality assessments even more important in the cyberspace due to this inherent interconnectedness and subsequent difficult of separating civilian and military data, particluarly on public servers, or where encryption protection is easily bypassed.

The assessment of incidental civilian harm includes harm from the foreseeable direct and indirect effects of cyber operations. Direct harm in this context means effects that are directly and immediately caused by a cyberattack, for example, damage to the targeted systems. Indirect harm, also referred to as ‘reverberating effects’, covers all other consequences that may foreseeably result from the cyberattack in question. The need to consider incidental harm raises the question of whether the accidental loss of functionality of civilian computers, systems, or networks also needs to be considered in order to apply this principle of proportionality. According to the ICRC, all types of damage associated with protecting civilian objects from direct attack must be considered, even if such objects are disabled. The incidental civilian harm must be compared with the direct and concrete military advantage. Assessing the expected incidental civilian harm of any cyber operation is critical, and it is critical that the harm to the civilian population is minimised or reduced in dual systems.⁴⁹

Conclusion

Ultimately, this article attempts to identify ways in which cyber warfare can be regulated under IHL, while also highlighting areas that need further work. Currently, there is no universally accepted consensus on when a cyber operation constitutes an attack under IHL. States and legal experts continue to grapple with the challenges of applying traditional legal frameworks, such as IHL, to the rapidly evolving field of cyber warfare. Nevertheless, efforts are underway to clarify the applicability of IHL to cyber operations, which will lead to the development of consolidated legally-binding norms regulating cyberspace.

To this end, states should recognise that international humanitarian law applies to cyberwarfare, engage in discussion and reflect on how international humanitarian law should be applied, and consider its application during armed conflict. Some scholars believe that perhaps a new Convention would provide much-needed clarity in this field.⁵⁰ Finding a common understanding of cyberwarfare is therefore crucial to effectively protecting civilians from the direct and intentional effects of cyber operations. It will be necessary to determine whether the challenges posed by such cyber operations are being given due consideration by existing rules and principles of IHL.

Aisha Ayub

Aisha Ayub holds an LLB (Hons) from the University of London and an LLM in International Law from SOAS. She is a human rights lawyer, activist and researcher.

Cyber Operations falling under “Attack” in IHL