Hostname: page-component-76fb5796d-2lccl Total loading time: 0 Render date: 2024-04-26T15:51:20.393Z Has data issue: false hasContentIssue false
  • English
  • Français

International humanitarian law and cyber operations during armed conflicts

ICRC position paper submitted to the Open-Ended Working Group on Developments in the Field of Information and Telecommunications in the Context of International Security and the Group of Governmental Experts on Advancing Responsible State Behaviour in Cyberspace in the Context of International Security, November 2019

Published online by Cambridge University Press:  18 March 2021

Get access Rights & Permissions [Opens in a new window]

Executive summary

  • • Cyber operations have become a reality in contemporary armed conflict. The International Committee of the Red Cross (ICRC) is concerned by the potential human cost arising from the increasing use of cyber operations during armed conflicts.

  • • In the ICRC's view, international humanitarian law (IHL) limits cyber operations during armed conflicts just as it limits the use of any other weapon, means or method of warfare in an armed conflict, whether new or old.

  • • Affirming the applicability of IHL does not legitimize cyber warfare, just as it does not legitimize any other form of warfare. Any use of force by States – cyber or kinetic – remains governed by the Charter of the United Nations and the relevant rules of customary international law, in particular the prohibition against the use of force. International disputes must be settled by peaceful means, in cyberspace as in all other domains.

  • • It is now critical for the international community to affirm the applicability of international humanitarian law to the use of cyber operations during armed conflicts. The ICRC also calls for discussions among governmental and other experts on how existing IHL rules apply and whether the existing law is adequate and sufficient. In this respect, the ICRC welcomes the intergovernmental discussions currently taking place in the framework of two United Nations General Assembly mandated processes.

  • • Events of recent years have shown that cyber operations, whether during or outside armed conflict, can disrupt the operation of critical civilian infrastructure and hamper the delivery of essential services to the population. In the context of armed conflicts, civilian infrastructure is protected against cyber attacks by existing IHL principles and rules, in particular the principles of distinction, proportionality and precautions in attack. IHL also affords special protection to hospitals and objects indispensable to the survival of the civilian population, among others.

  • • During armed conflicts, the employment of cyber tools that spread and cause damage indiscriminately is prohibited. From a technological perspective, some cyber tools can be designed and used to target and harm only specific objects and to not spread or cause harm indiscriminately. However, the interconnectivity that characterizes cyberspace means that whatever has an interface with the Internet can be targeted from anywhere in the world and that a cyber attack on a specific system may have repercussions on various other systems. As a result, there is a real risk that cyber tools are not designed or used – either deliberately or by mistake – in compliance with IHL.

  • • States’ interpretation of existing IHL rules will determine the extent to which IHL protects against the effects of cyber operations. In particular, States should take clear positions about their commitment to interpret IHL so as to preserve civilian infrastructure from significant disruption and to protect civilian data. The availability of such positions will also influence the assessment of whether the existing rules are adequate or whether new rules may be needed. If States see a need to develop new rules, they should build on and strengthen the existing legal framework – including IHL.

Type
Reports and documents
Information
International Review of the Red Cross , Volume 102 , Issue 913: Digital technologies and war , April 2020 , pp. 481 - 492
Copyright
Copyright © icrc 2021

Access options

Get access to the full version of this content by using one of the access options below. (Log in options will check for institutional or personal access. Content may require purchase if you do not have access.)

References

1 In this position paper, the term “cyber operations during armed conflicts” is used to describe operations against a computer, a computer system or network, or another connected device, through a data stream, when used as a means or method of warfare in the context of an armed conflict. Cyber operations rely on information and communication technologies.

2 UNGA Res. 73/27, “Developments in the Field of Information and Telecommunications in the Context of International Security”, UN Doc. A/RES/73/27, 5 December 2018, op. para. 5; UNGA Res. 73/266, “Advancing Responsible State Behaviour in Cyberspace in the Context of International Security”, UN Doc. A/RES/73/266, 22 December 2018, op. para. 3.

3 See ICRC, The Potential Human Cost of Cyber Operations, Geneva, 2019, available at: www.icrc.org/en/download/file/96008/the-potential-human-cost-of-cyber-operations.pdf.

4 ICRC, International Humanitarian Law and the Challenges of Contemporary Armed Conflicts, 31IC/11/5.1.2, Geneva, 2011 (ICRC Challenges Report 2011), pp. 36–37, available at: www.icrc.org/en/doc/assets/files/red-cross-crescent-movement/31st-international-conference/31-int-conference-ihl-challenges-report-11-5-1-2-en.pdf; ICRC, International Humanitarian Law and the Challenges of Contemporary Armed Conflicts, 32IC/15/11, Geneva, 2015 (ICRC Challenges Report 2015), p. 40, available at: www.icrc.org/en/download/file/15061/32ic-report-on-ihl-and-challenges-of-armed-conflicts.pdf; ICRC, International Humanitarian Law and the Challenges of Contemporary Armed Conflicts, 33IC/19/9.7, Geneva, 2019 (ICRC Challenges Report 2019), p. 18, available at: https://rcrcconference.org/app/uploads/2019/10/33IC-IHL-Challenges-report_EN.pdf.

5 International Court of Justice, Legality of the Threat or Use of Nuclear Weapons, Advisory Opinion, 8 July 1996 (Nuclear Weapons Advisory Opinion), para. 86.

6 See Protocol Additional (I) to the Geneva Conventions of 12 August 1949, and relating to the Protection of Victims of International Armed Conflicts, 1125 UNTS 3, 8 June 1977 (entered into force 7 December 1978) (AP I), Art. 1(2); Hague Convention (II) with respect to the Laws and Customs of War on Land and Its Annex: Regulations concerning the Laws and Customs of War on Land, The Hague, 29 July 1899 (entered into force 4 September 1900), preambular para. 9; Hague Convention (IV) respecting the Laws and Customs of War on Land and Its Annex: Regulations concerning the Laws and Customs of War on Land, The Hague, 18 October 1907 (entered into force 26 January 1910), preambular para. 8.

7 See, among others, Jean-Marie Henckaerts and Louise Doswald-Beck (eds), Customary International Humanitarian Law, Vol. 1: Rules, Cambridge University Press, Cambridge, 2005 (ICRC Customary Law Study), Rules 70, 71, available at: https://ihl-databases.icrc.org/customary-ihl/eng/docs/v1. See also AP I, Art. 36.

8 AP I, Art. 48; ICRC Customary Law Study, above note 7, Rules 1, 7; Nuclear Weapons Advisory Opinion, above note 5, para. 78.

9 ICRC Customary Law Study, above note 7, Rule 71.

10 AP I, Arts 48, 51, 52; ICRC Customary Law Study, above note 7, Rules 1, 7.

11 AP I, Art. 51(2); ICRC Customary Law Study, above note 7, Rule 2.

12 AP I, Art. 51(4); ICRC Customary Law Study, above note 7, Rules 11, 12. Indiscriminate attacks are those: (a) which are not directed at a specific military objective; (b) which employ a method or means of combat which cannot be directed at a specific military objective; or (c) which employ a method or means of combat the effects of which cannot be limited as required by international humanitarian law; and consequently, in each such case, are of a nature to strike military objectives and civilians or civilian objects without distinction.

13 AP I, Arts 51(5)(b), 57; ICRC Customary Law Study, above note 7, Rule 14.

14 AP I, Art. 57; ICRC Customary Law Study, above note 7, Rules 15–21.

15 AP I, Art. 54; Protocol Additional (II) to the Geneva Conventions of 12 August 1949, and relating to the Protection of Victims of Non-International Armed Conflicts, 1125 UNTS 609, 8 June 1977 (entered into force 7 December 1978) (AP II), Art. 14; ICRC Customary Law Study, above note 7, Rule 54.

16 See, for instance, Geneva Convention (I) for the Amelioration of the Condition of the Wounded and Sick in Armed forces in the Field of 12 August 1949, 75 UNTS 31 (entered into force 21 October 1950), Art. 19; Geneva Convention (II) for the Amelioration of the Condition of Wounded, Sick and Shipwrecked Members of the Armed Forces at Sea of 12 August 1949, 75 UNTS 85 (entered into force 21 October 1950), Art. 12; Geneva Convention (IV) relative to the Protection of Civilian Persons in Time of War of 12 August 1949, 75 UNTS 287 (entered into force 21 October 1950), Art. 18; AP I, Art. 12; AP II, Art. 11; ICRC Customary Law Study, above note 7, Rules 25, 28, 29.

17 AP I, Art. 58; ICRC Customary Law Study, above note 7, Rules 22, 24.

18 ICRC Challenges Report 2015, above note 4, p. 43.

19 See AP I, Art. 52(2); ICRC Customary Law Study, above note 7, Rule 8: “In so far as objects are concerned, military objectives are limited to those objects which by their nature, location, purpose or use make an effective contribution to military action and whose partial or total destruction, capture or neutralization, in the circumstances ruling at the time, offers a definite military advantage.” For more details on the limits to cyber infrastructure becoming a military objective under IHL, see ICRC Challenges Report 2015, above note 4, p. 42.

20 See ICRC, The Principle of Proportionality in the Rules Governing the Conduct of Hostilities under International Humanitarian Law, Geneva, 2018, pp. 37–40, available at: www.icrc.org/en/download/file/79184/4358_002_expert_meeting_report_web_1.pdf.

21 See text in relation to above notes 16 and 15. With regard to the latter, they must not be attacked, destroyed, removed or rendered useless.

22 The notion of attack under IHL, defined in Article 49 of AP I, is different from and should not be confused with the notion of “armed attack” under Article 51 of the UN Charter, which belongs to the realm of jus ad bellum. To affirm that a specific cyber operation, or a type of cyber operations, amounts to an attack under IHL does not necessarily mean that it would qualify as an armed attack under the UN Charter.

23 For rules that apply specifically to attacks, see text in relation to above notes 10–14.

24 See ICRC Challenges Report 2011, above note 4, p. 37; ICRC Challenges Report 2015, above note 4, pp. 41–42.

25 See above note 16.

26 See text in relation to above notes 10–15.

27 ICRC Challenges Report 2015, above note 4, p. 43; ICRC Challenges Report 2019, above note 4, p. 21.

28 ICRC Challenges Report 2011, above note 4, p. 37; ICRC Challenges Report 2019, above note 4, p. 20.

29 See ICRC Customary Law Study, above note 7, Rule 149. See also International Law Commission, Responsibility of States for Internationally Wrongful Acts, 2001, in particular Arts 4–11.

30 See ICRC Challenges Report 2019, above note 4, pp. 28–29; ICRC, A Guide to the Legal Review of New Weapons, Means and Methods of Warfare: Measures to Implement Article 36 of Additional Protocol I of 1977, Geneva, 2006, p. 4; AP I, Art. 36.