The first cyber attack occurred in the 2008 international armed conflict between Georgia and Russia, and later on cyber attacks were employed during the international and non-international armed conflicts in Afghanistan and Iraq. Since the International Humanitarian Law (IHL) rules appeared and developed previous to cyber attacks, the question is whether international humanitarian law rules apply in this case and if yes, how.
First of all, in order for IHL to apply, an attack is required and according to Additional Protocol I (AP I), attacks are defined in Article 49(1): “‘as acts of violence against the adversary, whether in offence or defense.”[1]
Taking into account that not all or most of the cyber attack do not use acts of violence that produce kinetic effects, the possibility of application of IHL rules is difficult to be assessed in this scenario.
For example, a cyber operation directed at civilian cyber infrastructure that did not cause damage would not probably be barred by the prohibition on attacking civilian objects, due to the fact that such operations did not qualify as an attack. By contrast, a cyber attack that would target the air traffic data and would lead to the crush of a plane could be perceived as fitting the classic meaning of the word “attack”. On the other hand, States have always treated chemical or biological operations, which had already occurred before the drafting of AP I, as attacks, even though they release no kinetic force. So if the kinetic force is not the criterion to establish whether a certain act could qualify as an attack according to art. 49 of AP I, then what is the criterion?
Another issue related to cyber attacks touches the principle of distinction. How can we apply this principle and how can we distinguish between civilians and combatants since the person triggering a cyber attack is usually placed behind a computer, also rendering the line distinguishing between civilian and military targets particularly blurred?
Article 48 of the 1977 Additional Protocol I to the 1949 Geneva Conventions (AP I)[2] sets forth the principle of distinction: “In order to ensure respect for and protection of the civilian population and civilian objects, the Parties to the conflict shall at all times distinguish between the civilian population and combatants and between civilian objects and military objectives and accordingly shall direct their operations only against military objectives.”
Distinction, which has been considered a “cardinal” principle of IHL by the International Court of Justice,[3] is universally acknowledged as a norm of customary law binding on all States during both international and non-international armed conflicts. But how can we apply it to cyber attacks?
How can someone ‘carry arms openly’ in a cyber attack, as the combatants defined by IHL are obliged to act all times. It is acknowledged that failure to do so results in them not only in them losing their combatant privilege should they be captured, but also in their acts being characterized as perfidious.
Furthermore, cyberattacks are sometimes, like in the case of use of biological weapons, ‘incapable of distinguishing between civilian and military targets’. For example, a computer virus, if it can spread uncontrollably from military systems to connected civilian systems, clearly does not respect the principle of distinction.
Cyber attacks thus, make it quite a challenge for the IHL to apply and at this moment there is no clear set of rules to govern all these scenarios.
[1] The term “attack” in IHL must be distinguished from “armed attack” in the jus ad bellum. The latter term refers to the condition preceding the exercise of self- (or collective) defence pursuant to Article 51 of the UN Charter and customary international law.
[2] Protocol Additional to the Geneva Conventions of 12 August 1949, and Relating to the Protection of Victims of International Armed Conflicts, 8 June 1977, 1125 UNTS 3 (entered into force 7 December 1978).
[3] International Court of Justice, Military and Paramilitary Activities in and against Nicaragua (Nicaragua v. United States of America), Judgment, ICJ Reports 1986, para. 78.