Attribution of conduct to the state

The question of attribution of an operation to a state could raise particularly difficult questions in cyber space where anonymity is the rule rather than the exception. Yet, as long as the parties cannot be identified as two or more states it is impossible to classify the situation as an international armed conflict. While this is a challenge in factual rather than in legal terms, a way of overcoming the uncertainty in fact would be through legal presumptions. For instance, if a computer network attack originated from the government infrastructure of a particular state, a presumption could be drawn that the operation is attributable to the state – especially in light of the rule of international law that states must not knowingly allow their territory to be used for acts contrary to the rights of other states.Footnote ³⁰ There are, however, two objections to this approach.

First, the existing rules of international law do not support such a presumption. For instance, the Articles on Responsibility of States for Internationally Wrongful Acts of the International Law Commission do not contain rules on presumption of attribution of conduct to a state. Also, the International Court of Justice (ICJ) set a high threshold for attribution of conduct to a state in the context of the right to self-defence. In the Oil Platforms case, it effectively held that the burden of proof rests on the state invoking the right of self-defence:

While this statement was made in the context of the right to self-defence in jus ad bellum, it can be generalized to all factual questions of attribution of conduct to a state. Since it is a presumption about facts, it would be nonsensical to presume facts for one purpose and not for another.

Second, such a presumption would also be too far-reaching in the particular context of cyber warfare. Given the difficulty of shielding computer infrastructure from manipulation and the ease with which one can remotely control a computer and pose under a different identity in cyber space, it would be placing a very high burden on governments to hold them accountable for all operations originating from their computers without any further proof.Footnote ³²

Another more frequently discussed question is the attribution of cyber attacks launched by private parties, such as hacker groups, to the state. Apart from the factual questions raised by the anonymity of cyber operations, the legal rules for attribution of acts of private parties to a state are set out in the Articles on Responsibility of States for Internationally Wrongful Acts.Footnote ³³ In particular, a state is responsible for the conduct of a person or group of persons ‘if the person or group of persons is in fact acting on the instructions of, or under the direction or control of, that State in carrying out the conduct’.Footnote ³⁴ What exactly ‘direction or control’ means in international law will have to be clarified over time. The ICJ requires that for an act of a private party (be it an individual or a member of an organised group) to be imputable to the state the direction or effective control of the state over the operation in the course of which the alleged violations were committed has to be demonstrated, and not only generally in respect of the overall actions taken by the persons or groups of persons having committed the violations.Footnote ³⁵ In the absence of such control over the specific operation it cannot be imputed to the state, even when committed by a group with a high degree of dependency on the state authorities.Footnote ³⁶ In the same vein, the commentary on the Articles on State Responsibility requires that the state direct or control the specific operation and that the conduct be an integral part of that operation.Footnote ³⁷ The ICTY has gone further and argued that where a group, such as an armed opposition group, is organised it is enough that the state authorities exercise ‘overall control’ over such an organised and hierarchically structured group without a need for specific control or direction over individual conduct.Footnote ³⁸ However, the ICTY has also acknowledged that where the controlling state is not the territorial state, ‘more extensive and compelling evidence is required to show that the State is genuinely in control of the units and groups’ – meaning that the state's involvement in the planning of military operations or its coordination role might be more difficult to demonstrate.Footnote ³⁹ The International Law Commission's commentary states: ‘it will be a matter of appreciation in each case whether particular conduct was or was not carried out under the control of a State, to such an extent that the conduct controlled should be attributed to it’.Footnote ⁴⁰ This discussion, however, is not specific to the cyber domain. Once the facts are established, the same legal criteria apply as with any other attribution of the conduct of private parties to a state. The difficulty, here again, will most likely lie in the factual assessment.

Resort to armed force

The second criterion to be fulfilled is that of ‘resort to armed force’ between states.

Before turning to the questions raised by cyber warfare in this respect, it is worth clarifying very briefly that the classification of a conflict as an international armed conflict under IHL (jus in bello) is separate from the question of jus ad bellum. The two are often amalgamated, including in cyber warfare.

Under jus ad bellum, the question is whether and when cyber operations amount to a use of force within the meaning of Article 2(4) of the UN Charter and/or to an armed attack within the meaning of Article 51 of the UN Charter, and under what circumstances they trigger a right to self-defence.Footnote ⁴¹ Whatever the views in this jus ad bellum discussion, it should be recalled that the objects of regulation of jus ad bellum and jus in bello are entirely distinct: while jus ad bellum specifically regulates inter-state relations and the requirements for the lawful resort to force between states, jus in bello regulates the behaviour of parties to the conflict and its object and purpose is to protect the military and civilian victims of war. Thus, an act could constitute a resort to armed force for the purpose of qualifying an international armed conflict, without prejudice to the question whether it also constitutes a use of force within the meaning of Article 2(4) of the UN Charter (though it is likely), let alone an armed attack under Article 51. This differentiation equally applies to cyber operations.

Turning to jus in bello, there is no treaty definition of the meaning of armed force in IHL because it is a jurisprudential criterion. Traditionally, the objective of war is to prevail over the enemy, and in traditional warfare, conflict entails the deployment of military means, leading to military confrontation. Thus, when traditional means or methods of warfare are used – such as bombing, shelling, or the deployment of troops – it is uncontroversial that these amount to armed force. But computer network attacks do not entail the use of such arms.

In the absence of traditional weapons and kinetic force – what can be considered to amount to armed force in the cyber realm?

The first step is to compare the analogous effects of computer network attacks to those of kinetic force. Most commentators are of the view that if a computer network attack is attributable to a state and has the same effects as kinetic resort to force it would trigger an international armed conflict.Footnote ⁴² Indeed, if a computer network attack causes airplanes or trains to collide, resulting in death or injury, or widespread flooding with large-scale consequences, there would be little reason to treat the situation differently from equivalent attacks conducted through kinetic means or methods of warfare.

This parallel is therefore useful for situations in which computer network attacks lead to death or injury, or physical damage or destruction of infrastructure. However, it might be insufficient to capture the whole range of possible effects of cyber operations and the damage that they can cause, which will not necessarily resemble the physical effects of traditional weapons. Cyber operations will frequently be resorted to in order not to physically destroy or damage military or civilian infrastructure, but rather to affect its functioning, for instance by manipulating it, and even to do so without the manipulation being detected. For instance, an electrical grid might be left untouched physically but nonetheless be put out of commission by a computer network attack. Similarly, a country's banking system might be manipulated without any of the infrastructure being damaged physically and without the manipulation of the underlying system even being noticeable for some time. At first sight, even in the absence of traditional military means or of immediate physical destruction, the potential effects of such disruptions – which might be far more extensive or severe than, say, the destruction of a particular building or group of buildings – on the population would speak in favour of considering them a resort to armed force. However, states – even victim states – might seek to avoid an escalation of international confrontations or have other reasons to avoid treating such types of attacks as triggering an armed conflict. It is difficult at this point to infer any legal positions, since states appear to remain mostly silent in the face of cyber attacks.Footnote ⁴³ In the absence of clear state practice there are several possible approaches to this question.

One approach is to consider any hostile cyber operation that affects the functioning of objects as a resort to armed force. The object and purpose of IHL in general, and in particular the absence of a threshold of violence for the existence of an international armed conflict – which is to avoid a gap in protection, particularly the protection of the civilian population from the effects of war – would speak in favour of including such cyber operations in the definition of armed force for the purpose of triggering an armed conflict. Also, considering the importance that states attach to the protection of critical infrastructure in their cyber strategies, it might well be the case that they will consider computer network attacks by another state aimed at incapacitating such infrastructure as the beginning of an armed conflict.Footnote ⁴⁴ Moreover, in the absence of an armed conflict the protective scope of IHL would not govern the situation. Other bodies of law such as jus ad bellum, cyber crime law, space law, or telecommunications law might, of course, apply and provide their own protection. The analysis of their effect is beyond the scope of this article, but all of the other bodies of law would pose their own set of questions. For instance, international human rights law might apply, but would a computer network attack, conducted from the other side of the globe against civilian infrastructure, fulfil the requirement of effective control for the purpose of applicability of human rights law? Also, to what extent would human rights law provide sufficient protection against the disruption of infrastructure the effects of which on the lives of civilians is not necessarily immediately identifiable?

Another approach would be to not focus exclusively on the analogous effects of the cyber operation but to consider a combination of factors that would indicate armed force. These factors would include a certain severity of the consequences of the cyber operation, the means employed, the involvement of the military or other parts of the government in the hostile operation, the nature of the target (military or not), and the duration of the operation. Taking an example outside of the cyber realm, if the chief of staff of a state's armed forces was killed in an air attack by another state this would certainly be considered as amounting to an international armed conflict. However, if he or she was killed by the sending of a poisoned letter would this also be considered in and of itself as amounting to an international armed conflict?Footnote ⁴⁵ What if the target was a civilian? Are the means of destroying infrastructure relevant? For instance, if parts of a nuclear installation were sabotaged by infiltrated foreign agents, would this also amount to a resort to armed force? Does it make a difference whether the target is military or civilian?

In the cyber realm, it is possible, for instance, that states might treat computer network attacks on their military infrastructure differently from those affecting civilian systems. This might not be entirely technically logical because use of force is use of force, whether against a civilian or a military object. But the threshold of harm that states are willing to tolerate might be lower when it comes to operations that are targeted at and degrade their military capability.

Following such an approach, if the computer network attack is only punctual and of short duration, it may be that it will only be considered as armed force if its consequences are of a particular severity. The example of the Stuxnet attack as reported in the press seems to indicate that computer network attacks might – at least for some time – remain isolated hostile acts of one state towards another, without other kinetic operations, particularly if the attacker wishes to remain anonymous, wishes for the attack to remain undetected for some time, or wishes (for political or other reasons) to avoid an escalation of force and further hostilities and armed conflict. If one relied solely on whether a kinetic attack with the same effects amounts to armed force, one might have to come to the conclusion that such an attack constitutes armed force because the Stuxnet virus is reported to have caused the physical destruction of about one thousand IR-1 centrifuges which had to be replaced at the uranium enrichment facility at Natanz.Footnote ⁴⁶ Indeed, if the centrifuges of a nuclear installation were destroyed by bombardment by another state's air force, such an attack would be considered a resort to armed force and trigger an international armed conflict. But because the means of the attack were not kinetic, no other attacks in connection to it were reported and it caused no known damage beyond the centrifuges, it arguably falls short of armed force triggering an international armed conflict.

To sum up, it remains to be seen if and under what conditions states will treat computer network attacks as armed force. The mere manipulation of a banking system or other manipulation of critical infrastructure, even if it leads to serious economic loss, would probably stretch the concept of armed force beyond its object and purpose – the effects are not equivalent to the destruction caused by physical means. But the disruption of such vital infrastructure as electricity or water supply systems, which would inevitably lead to severe hardship for the population if it lasted over a certain period, even if not to death or injury, might well have to be considered as armed force. Although the effects are not equivalent to physical effects, they are precisely the kind of severe consequences from which IHL seeks to protect the civilian population.

It is true that states cannot circumvent their obligations under IHL by their own designation of the act. The application of the law of international armed conflict was divorced from the need for official pronouncements many decades ago in order to avoid cases in which states could deny the protection of this body of rules. This is made clear by common Article 2, as the ICRC Commentary thereto suggests:

Nonetheless, while it is true that in a specific incident, the classification of the conflict does not depend on the position of the states concerned, state practice and opinio juris determine the interpretation of the international law definition of ‘international armed conflicts’.The classification of cyber conflicts will probably be determined in a definite manner only through future state practice.

Organised armed groups

For a group to qualify as an organised armed group that can be a party to a conflict within the meaning of IHL, it needs to have a level of organisation that allows it to carry out sustained acts of warfare and comply with IHL. Indicative elements include the existence of an organisational chart indicating a command structure, the authority to launch operations bringing together different units, the ability to recruit and train new combatants, and the existence of internal rules.Footnote ⁵¹ While the group does not need to have the level of organisation of state armed forces, it must possess a certain level of hierarchy and discipline and the ability to implement the basic obligations of IHL.Footnote ⁵²

With respect to hacker or other similar groups, the question that arises is whether groups that are organised entirely online can constitute armed groups within the meaning of IHL. As Michael Schmitt puts it:

However, the requirement that organised armed groups must have some form of responsible command and the capacity to implement IHL would seem to preclude virtually organised groups from qualifying as organised armed groups; it would be difficult, for instance, to establish an effective system of discipline within such a group in order to ensure respect for IHL.Footnote ⁵⁴ In other words, it is unlikely that groups of hackers or groups that are merely linked by virtual communication would have the organisation or command (and disciplinary) structure required to constitute a party to the conflict.Footnote ⁵⁵

Intensity

Cyber operations conducted in the context of and in relation to an existing non-international armed conflict are governed by IHL. The question that arises, although it may seem futuristic at this point, is whether the required level of intensity for a non-international armed conflict could be reached if cyber means alone are being used (assuming that there are two or more parties to the conflict).

Contrary to the classification of international armed conflicts, there is agreement that a non-international armed conflict only exists if the hostilities reach a certain level of intensity. The ICTY has pointed to a number of indicative factors to be taken into account to assess the intensity of the conflict, such as the collective character of hostilities, the resort to military force, not simply police force, the seriousness of attacks and whether there has been an increase in armed clashes, the spread of clashes over territory and over a period of time, the distribution of weapons among both parties to the conflict, the number of civilians forced to flee from the combat zones, the types of weapons used, in particular the use of heavy weapons, and other military equipment, such as tanks and other heavy vehicles, the extent of destruction and the number of casualties caused by shelling or fighting.Footnote ⁵⁶ Would the necessary intensity threshold be reached by cyber operations alone?

The starting point, again, is to compare the intensity of the consequences to that of kinetic operations. There is no reason why cyber operations cannot have the same violent consequences as kinetic operations, for instance if they were used to open the floodgates of dams, or to cause aircraft or trains to collide. In such circumstances, and if such violence is not merely sporadic, it may meet the threshold for a non-international armed conflict.

However, cyber operations in themselves would not have many of the effects mentioned above as indicators of the intensity of the violence (armed clashes, the deployment of military force, heavy weapons, etc.). It would likely be the consequences of the cyber operations alone that are severe enough to reach the intensity required, such as extensive destruction or disastrous effects on large parts of the population through repeated attacks.

What triggers the rules on the conduct of hostilities: ‘attacks’, ‘military operations’, ‘hostilities’?

As to the first question, the difference in views arises from the general rule on the conduct of hostilities, as formulated in Articles 48 et seq. of Additional Protocol I and largely recognized as customary law. Article 48 of Additional Protocol I requires that:

The subsequent rules on the conduct of hostilities are then mainly formulated as restrictions on attacks more specifically. For instance, Article 51 of Additional Protocol I, after stating, in its first paragraph, that ‘[t]he civilian population and individual civilians shall enjoy general protection against the dangers arising from military operations’, goes on to state that ‘[t]he civilian population as such, as well as individual civilians, shall not be the object of attack’ and that ‘indiscriminate attacks are prohibited’. An attack in violation of the principle of proportionality is defined in Article 51(5)(b) of Additional Protocol I as ‘an attack which may be expected to cause incidental loss of civilian life, injury to civilians, damage to civilian objects, or a combination thereof, which would be excessive in relation to the concrete and direct military advantage anticipated’. Article 51(6) prohibits ‘attacks against the civilian population or civilians by way of reprisals’. Article 52 states that ‘attacks shall be limited strictly to military objectives’. The principle of precaution in Article 57 requires that ‘with respect to attacks’, a number of precautions should be taken. There are many more Articles that use the term ‘attack’ when restricting the rights of belligerents.Footnote ⁶⁰

Thus, the first argument revolves around the question whether the rules on the conduct of hostilities are limited to those acts of hostilities that constitute attacks (as defined in Article 49 of Additional Protocol I) or whether they apply to a broader range of military operations. Broadly speaking, three views have been put forward.

Most commentators are of the opinion that the structure and wording of Additional Protocol I show that, while Article 48 provides a general principle of protection of the civilian population, this general principle is ‘operationalized’ in the subsequent articles. Only those cyber operations that constitute attacks are subject to the principles of distinction, proportionality, and precaution.Footnote ⁶¹ An argument made by Michael Schmitt in this regard is that some military operations can be intentionally directed against civilians, for instance psychological operations – which in his view shows that not all military operations are subject to the principle of distinction.Footnote ⁶²

Nils Melzer considers that the debate on the concept of attack does not provide a satisfactory answer to the question because the rules on the conduct of hostilities do not only apply to attacks strictly speaking, but to other operations, too. In his view:

His view is that cyber operations that are designed to harm the adversary, either by directly causing death, injury, or destruction or by directly adversely affecting military operations or military capacity, must be regarded as hostilities.Footnote ⁶⁴ For instance, cyber operations aiming to disrupt or incapacitate an enemy's computer-controlled radar or weapons systems, logistic supply, or communication networks would qualify as hostilities even if they do not cause physical damage. However, cyber operations conducted for the general purpose of intelligence gathering would not fall under hostilities. As far as the non-destructive incapacitation of civilian objects is concerned, Melzer does not come to a definite conclusion but points to the dilemma between adopting a too restrictive or a too permissive interpretation of the law.Footnote ⁶⁵

Melzer's argument is attractive in that it gives effect to the very object and purpose of the rules on the conduct of hostilities, which is that ‘innocent civilians must be kept outside hostilities as far as possible and enjoy general protection against danger arising from hostilities’.Footnote ⁶⁶ However, it leaves open the most critical question, namely whether operations that disrupt civilian infrastructure without destroying it fall under the concept of hostilities.

Heather Harrison Dinniss argues that the prohibition of targeting civilians and civilian objects is not limited to attacks.Footnote ⁶⁷ Rather, she points to the wording of Article 48 of Additional Protocol I and the first sentences of Articles 51 and 57 to argue that the civilian population must be protected not only against attacks, but also more generally against the effects of military operations. Thus, she submits that the principles of distinction, proportionality, and precaution also apply to computer network attacks that fall within the definition of a military operation. To fall within the definition, ‘the computer network attack must be associated with the use of physical force, but it does not have to result in violent consequences itself’.Footnote ⁶⁸

Despite these arguments in favour of expanding the types of operations to which the rules on the conduct of hostilities must apply, it is clear that states did differentiate in Additional Protocol I between the general principles in the respective chapeaux of the rules of distinction and precaution and the specific rules relating to attacks, and that they found it necessary to define attacks specifically in Article 49 of the Protocol. It is difficult to depart from this dichotomy between military operations and attacks.

Nonetheless, Dinniss's argument makes sense of the fact that Articles 48, 51, and 57 contain general clauses that impose limitations for military operations and not only attacks and the content of which would otherwise be difficult to explain. A systematic interpretation of these clauses means that the chapeaux have a meaningful content and are not superfluous. Also, the argument made by Michael Schmitt that some operations, such as psychological operations, can be directed at civilians, implying that some military operations could be directed at civilians, rests on a misunderstanding of the concept of military operations. Indeed, while it is true that some cyber operations, such as psychological operations, can be directed at the civilian population, this is because they do not fall under military operations or hostilities within the meaning intended by the Protocol's drafters. According to the ICRC Commentary, the term ‘operations’ in Article 48 means military operations and refers to ‘all movements and acts related to hostilities that are undertaken by armed forces’.Footnote ⁶⁹ The term ‘military operations’ in Article 51 is described as ‘all the movements and activities carried out by armed forces related to hostilities’.Footnote ⁷⁰ And in Article 57 it ‘should be understood to mean any movements, manoeuvres and other activities whatsoever carried out by the armed forces with a view to combat’.Footnote ⁷¹ In other words, operations such as propaganda, espionage, or psychological operations will not fall under the concepts of hostilities or military operations and are therefore not governed by the principles of distinction, proportionality, and precaution, even if they are carried out by the armed forces.

Thus, while some of the more specific content of Articles 51 and 57 of Additional Protocol I might address the specificities of attacks, there is a good argument that other military operations cannot be entirely exempt from the obligations of distinction, proportionality, and precaution, since Article 48 and the chapeaux of Articles 51 and 57 would otherwise be superfluous. However, since there is disagreement about this question it is prudent to nonetheless have a closer look at the definition of ‘attack’ and what types of cyber operation fall under it. Indeed, most of the cyber operations in the examples mentioned above fall under the concept of attack and would be prohibited if targeted at civilian infrastructure. Thus, it will be shown that in most of the examples given above the operations amount to attacks, and hence the question whether only ‘attacks’ or also ‘hostilities’ or ‘military operations’ are subject to the rules on the conduct of hostilities is moot.

What is an attack?

As said above, operations in cyber space differ from traditional warfare in that the means and methods of attack do not entail traditional kinetic force, or what is commonly understood as violence. Yet, attacks are defined in Article 49(1) of Additional Protocol I (which reflects customary IHL) as ‘acts of violence against the adversary, whether in offence or in defence’. In the mind of the drafters, this connoted physical violence.

First, it should be recalled that, based on the fact that an attack must be an act of violence, there is broad agreement nowadays that violence does not refer to the means of the attack – which would only encompass kinetic means.Footnote ⁷² Military operations that result in violent consequences constitute attacks. For instance, it is uncontroversial that the use of biological, chemical, or radiological agents would constitute an attack, even though the attack does not involve physical force.Footnote ⁷³ Therefore, it has been accepted for a long time that what defines an attack is not the violence of the means, but the violence of the consequences.Footnote ⁷⁴ Thus, even a data stream passed through cables or satellite could fall under the concept of attack.

The controversy lies on the side of the effects of cyber operations. It turns on those operations that do not cause death or injury to persons or physical destruction or damage to objects as kinetic operations would, but rather disrupt the functioning of objects without causing them physical damage – such as in the examples given above. As these examples show, the consequences of cyber operations do not necessarily have violent effects in that they do not cause physical damage or destruction. In the examples given above the consequences in the physical realm would be at the most indirect: for instance, if the electrical grid is shut down, this may lead to power outages for vital services such as hospitals. In some cases the consequences are limited to the ability to communicate or engage in commercial activities, such as when a banking system is disrupted. Can such operations be considered attacks within the meaning of Article 49 of Additional Protocol I?

Two positions have been put forward with respect to this question. According to Michael Schmitt's earlier writings:

Damage, in this view, only refers to physical damage. Computer network attacks that cause mere inconvenience, or merely temporarily interrupt the functioning of objects, do not constitute attacks unless they cause human suffering. Critically, the mere disruption of the functionality of an object, short of leading to such human suffering or short of resulting in physical damage or the complete and permanent loss of functionality of the targeted object, does not amount to an attack.Footnote ⁷⁶

According to Knut Dörmann, cyber operations can also constitute attacks even if they do not lead to the destruction of the object. This view is predicated on the definition of a military objective in Article 52(2) of Additional Protocol I, which states that a military objective is one ‘… whose total or partial destruction, capture or neutralization, in the circumstances ruling at the time, offers a definite military advantage’. From the term ‘neutralization’ it can be seen that ‘[i]t is irrelevant whether an object is disabled through destruction or in any other way’.Footnote ⁷⁷ Critics answer that the definition of military objectives is not entirely on point because it presupposes an attack in the first place and does not define the attack in itself.Footnote ⁷⁸ This criticism fails to acknowledge that ‘neutralization’ was meant to encompass ‘an attack for the purpose of denying the use of an object to the enemy without necessarily destroying it’.Footnote ⁷⁹ This shows that the drafters had in mind not only attacks that are aimed at destroying or damaging objects, but also attacks for the purpose of denying the use of an object to the enemy without necessarily destroying it. So, for instance, an enemy's air defence system could be neutralized through a cyber operation for a certain duration by interfering with its computer system but without necessarily destroying or damaging its physical infrastructure.Footnote ⁸⁰

More recently, the Tallinn Manual defines a cyber attack as ‘a cyber operation, whether offensive or defensive, that is reasonably expected to cause injury or death to persons or damage or destruction to objects’.Footnote ⁸¹ However, as the commentary shows, experts disagreed as to what exactly was to be understood as ‘damage’ to objects, and whether or what type of impairment of the functioning of an object would fall within its definition.Footnote ⁸²

The weakness of the first opinion is that it is under-inclusive. First, it would not make sense to consider that if a civilian object is rendered useless, regardless of the way in which this was done, it is not damaged. Whether an electrical grid is put out of order by physical damage or interference with the computer system by which it is run cannot be a relevant criterion. A contrary opinion would lead to the conclusion that the destruction of one house by bombing would be an attack, but the disruption of an electrical grid supplying thousands or millions of people would not. Second, reference to the principle of proportionality gives an indication of the incidental effects against which the rules on the conduct of hostilities mean to protect civilians, namely excessive ‘incidental loss of civilian life, injury to civilians, damage to civilian objects’. ‘Damage’ is different from ‘destruction’. It means ‘harm … impairing the value or usefulness of something …’.Footnote ⁸³ Thus, disrupting the functioning of certain systems by interfering with their underlying computer systems can amount to damage insofar as it impairs their usefulness. Third, the view that there must be complete and permanent loss of functionality without physical damage does not make sense in information technology. Since data can always be restored or changed there is no permanent and complete loss of functionality of an object short of physical damage. Thus, an attack must also be understood to encompass such operations that disrupt the functioning of objects without physical damage or destruction, even if the disruption is temporary.

Yet, an overly broad interpretation of the term ‘attack’ would mean that all interferences with civilian computer systems would amount to attacks: the interruption of email or social network communications, of online booking or shopping systems, etc. To equate such disruptions of what are essentially communication systems with attacks would probably go beyond the scope of what was envisaged by the rules on the conduct of hostilities. These rules have traditionally sought to prevent damage to civilian infrastructure that manifests itself in the physical world, not interference with propaganda, communication, or economic life. In today's world, the reliance of civilian life on communication systems blurs these lines, and it is not easy to distinguish between what is ‘mere’ communication and what goes beyond.

Existing IHL norms and their object and purpose provide a number of indications for distinguishing between operations that amount to attacks and those that do not. First, as said above, the concept of ‘attacks’ does not include dissemination of propaganda, embargoes, or other non-physical means of psychological or economic warfare.Footnote ⁸⁴ Cyber operations that are equivalent to espionage, to the dissemination of propaganda, to embargoes, or other non-physical means of psychological or economic warfare will not fall under the definition of ‘attacks’.

Second, IHL does not prohibit blockades or economic sanctions that deliberately target not only the military but also the civilian population and economy. Thus, the term ‘attack’ cannot comprise cyber operations that would be tantamount to economic sanctions. This is not to say that such operations would not have limits under IHL (such as the prohibition of destroying, removing, or rendering useless objects indispensable to the survival of the civilian population or obligations with respect to the passage of humanitarian relief), but, since they do not constitute attacks, there is no prohibition under IHL against directing them at civilians.

Third, the rules on the conduct of hostilities do not intend to prohibit all operations that interfere with civilian communication systems. For instance, not all denial of service operations,Footnote ⁸⁵ such as blocking a television broadcast or a university website, would amount to an attack. Mere interference with propaganda, for instance, will probably also not constitute an attack. The parallel of such operations in the physical world is probably the jamming of radio communications or television broadcasts – which is not considered an attack in the sense of IHL.

To differentiate between those operations that amount to attacks and those that do not, the criterion of inconvenience is sometimes put forward.Footnote ⁸⁶ The argument is inconvenience, such as rationing of food, need not be taken into account for ‘incidental civilian damage’. Therefore, something that causes mere inconvenience cannot amount to and attack. While the criterion of inconvenience is not without its merits, there might be disagreement on what represents inconvenience in terms of interferences with cyber technology and communication. For instance, while it might be possible to agree that the interruption of an online booking system causes mere inconvenience, consensus might be more difficult to achieve around issues such as interference with banking services. It remains to be seen how these interferences will be considered in the future, in particular in state practice.

Summary

In sum, a cyber operation can constitute an attack within the meaning of IHL when it causes death or injury or physical destruction or damage, but also if it interferes with the functioning of an object by disrupting the underlying computer system. Thus, if an air defence system is put out of order by a cyber operation, if a cyber operation disrupts the functioning of an electrical grid, or if the banking system is disabled, this amounts to an attack. However, not all cyber operations directed at disrupting the functioning of infrastructure amount to attacks. Where the operation is not directed at the physical infrastructure relying on the computer system, but essentially at blocking communication, it is more akin to jamming radio signals or television broadcasts – unless it is, of course, part of an attack, such as blocking an air defence system. The difference lies in the fact that in some cases it is the communication function of cyber space alone that is being targeted; in other cases, it is the functioning of the object beyond cyber space in the physical world. While interference with cyber systems that leads to disruption in the physical world constitutes attacks, the question of interference with communication systems such as email systems or the media is not entirely solved.

Dual-use objects in cyberspace

So-called dual-use objects – a term not found as such in IHL provisions – are those that are used for both civilian and military purposes. Due to their use for military purposes, they become military objectives under Article 52(2) of Additional Protocol I and legitimate targets of attack. Examples frequently given are parts of the civilian infrastructure that supply the military for their operations, such as power plants or electrical grids.

According to today's prevailing view, an object cannot be a civilian and a military object at the same time. The moment it is used for military action it becomes a military objective in its entirety (except if separable parts remain civilian – for instance, different buildings of a hospital).Footnote ⁹⁴ As opposed to the ICRC's 1956 proposal, which, outside purely military material and installations, mentioned civilian communication, transport, or industry ‘of fundamental military importance’ or ‘fundamental importance for the conduct of the war’,Footnote ⁹⁵ it is generally considered today that the object becomes a military objective even if its military use is only marginal compared to its civilian use. For instance, if a plant provides a small percentage of fuel used in military operations, even if this is not its main purpose, it becomes a military objective.

The dangers in cyber space are evident: virtually the entire international cyber infrastructure – that is, computers, routers, cables, and satellites – is used for both civilian and military communications.Footnote ⁹⁶ An undersea cable that transports military communications becomes a military objective – with the consequence that (subject to other rules of IHL, namely proportionality) it can not only be the subject of a cyber operation to interrupt the military communication, it could also be destroyed. Similarly, a server containing 5 per cent military data would become a legitimate target. This is particularly important to bear in mind in an era of increased cloud computing, where the users of cloud computing are typically not aware on what servers their data are being stored and what other data are stored on that server. It is reported that approximately 98 per cent of US government communications use civilian-owned and -operated networks.Footnote ⁹⁷

The danger that any part of the cyber infrastructure could be targeted is very real. Indeed, while in certain circumstances states might seek to disable very specific functions of the adversary's military infrastructure, the fact that all of cyber space is used for military operations means that in any armed conflict it will be of important strategic interest to degrade the adversary's communication networks and access to cyber space. This will mean denying the adversary access to critical routes in cyber space, degrading its main routers or access to major communication nodes, not just targeting specific computer systems of the military infrastructure.Footnote ⁹⁸ Unlike in the naturally occurring theatres of war, such as land or airspace, the man-made theatre of cyber space means that the belligerents will not only focus on the travelling weapon but on the routes themselves.Footnote ⁹⁹ For instance, in airspace, only the aircraft qualifies as a military objective; in cyber warfare, however, the physical infrastructures through which the cyber weapons (malicious codes) travel qualify as military objectives.

The humanitarian consequences of this situation are of utmost concern for the protection of the civilian population. In a world in which a large part of civilian infrastructure, civilian communication, finance, economy, and trade rely on international cyber infrastructure it becomes all too easy for parties to conflicts to destroy this infrastructure. There is no need to argue that a banking network is used for military action, or that an electrical grid is dual use. Disabling the major cables, nodes, routers, or satellites that these systems rely on will almost always be justifiable by the fact that these routes are used to transmit military information and therefore qualify as military objectives.

The Tallinn Manual states:

It also mentions the principles of precaution and proportionality, which would have to be respected if the Internet or large portions thereof were targeted. However, while this might seem reassuring at first sight, it leaves the problem that whether or not the Internet in its entirety can be targeted, any of its segments can be targeted if used for military communication and its destruction or neutralization offers a definite military advantage (again subject to proportionality and precautions).

Furthermore, cyber space is resilient in the sense that if information cannot flow through one channel there are multiple routes and alternatives and the information can usually be transmitted through another path. As the Tallinn Manual states:

The consequence of this would be that in some circumstances virtually all parts of the Internet might qualify as a military objective because they are all possible routes for the transmission of military information.

The prevailing wide interpretation of dual-use objects as military objectives is already not without its problems in the physical world.Footnote ¹⁰² In cyber space the consequences could be exacerbated to an extreme point where nothing civilian remains and the basic rule that the civilian population shall enjoy general protection against dangers arising from military operations becomes virtually empty of content, subject only to the principles of proportionality and precaution.

Lastly, if most of the cyber infrastructure around the world is of a dual-use nature and could be considered a military objective, this raises the fundamental question of the geographical limits of the armed conflict. There are truly no borders in cyber space, and computer systems from anywhere can be (remotely) attacked, manipulated, or transformed into means of warfare and military objectives. It must be borne in mind that the consequence would not only be that such computers could be counter-hacked by the targeted computer systems. In theory, as military objectives they could be destroyed through kinetic means. For instance, a botnet could be used to launch an attack destroying an adversary's cyber infrastructure. To conduct such an operation, the party to the conflict launching the attack would remotely control thousands or millions of computers around the world, which would transmit the malware to the target computers. If such a botnet were to lead to all of the millions of computers that it uses throughout the world being defined as military objectives liable to attack, the result would be a sort of total cyber war. The logical consequence, that all these computers around the world become military targets, would be contrary to the foundations of the law of neutrality in international armed conflicts (and mainly with its underlying rationale, which is to spare the third country and its inhabitants from the effects of hostilities) or with the geographical limitations of the battlefield in non-international armed conflicts.Footnote ¹⁰³ In an international armed conflict the law of neutrality would put certain limits on the right of the attacked state to defend itself by attacking infrastructure in neutral territory.Footnote ¹⁰⁴ First, the attacked state must notify the neutral state and give it a reasonable time to terminate the violation; second, the attacked state is allowed to take measures to terminate the violation of neutrality only if that violation constitutes a serious and immediate threat to its security and only if no other feasible and timely alternative exists to respond to the threat. These restrictions are relatively broad, and in order to be truly protective for the civilian population of the neutral state they would presumably have to be narrowly interpreted. In non-international armed conflicts the law of neutrality is not applicable. However, it would completely break open the geographical limits of the battlefield of non-international armed conflicts to consider that the armed conflict takes place anywhere where a computer, cable, or node is used for military action (and would therefore normally constitute a military objective).

In sum, it becomes clear that, in cyber space, the principle of distinction appears to hold little promise for the protection of civilian cyber infrastructure and all the civilian infrastructure that relies on it. In such situations the main legal protection for civilian infrastructure will be the principle of proportionality – which will be addressed below.Footnote ¹⁰⁵

The problem that, in cyber space, most infrastructure is dual use is certainly the most important concern and other legal issues appear less pressing. Some of them will nonetheless be addressed in the following paragraphs.

Corporations that produce information technology used for military action

Since hardware and software are used for much military machinery, information technology (IT) corporations that produce them could be seen as ‘war-supporting military objectives’Footnote ¹⁰⁶ – in parallel with munitions factories. This would likely mean that a number of IT corporations around the world would constitute legitimate targets as many of them probably provide some IT infrastructure for the military.Footnote ¹⁰⁷ Eric Talbot Jensen, for instance, asks whether the Microsoft Corporation would constitute a legitimate target ‘based on the support it provides to the U.S. war effort by facilitating U.S. military operations’. In his view, ‘[t]he fact that the corporation and its headquarters provide a product that the military finds essential to function, as well as customer service to support that product, may provide sufficient facts to conclude that it is a dual use target’, but he doubts whether a definite military advantage would accrue from such an attack.Footnote ¹⁰⁸

The example shows that the parallel with munitions factories should not be overstretched. The relevant criterion of Article 52(2) of Additional Protocol I is that the object must by its use make an effective contribution to military action. First, corporations as such are not physical objects, but legal entities, and so the question would instead be whether any of their locations (that is, buildings) have become military objectives. Second, there is a difference between weapons and IT tools. Weapons are by their nature military objectives, which generic IT systems are not. Thus, one might have to differentiate between factories that actually develop what might be called cyber weapons, that is specific codes/protocols that will be used for a specific computer network attack (so, for instance, the location where a specific virus like Stuxnet is being developed), and those that just provide the military with generic IT supplies, which are not so different from, say, food supplies.Footnote ¹⁰⁹

War-fighting capability or war-sustaining capability?

In cyber warfare, where the temptation to target civilian infrastructure is possibly higher than in traditional warfare, it is important to keep in mind that for a civilian object to become a military objective its contribution to military action must be directed towards the actual war-fighting capabilities of a party to the conflict. If an object merely contributes to the war-sustaining capability of a party to the conflict (its general war effort), it does not qualify as a military objective.

In the US Commander's Handbook on the Law of Naval Operations, the expression ‘makes an effective contribution to military action’ from Article 52(2) of Additional Protocol I has been widened and replaced by ‘effectively contribute to the enemy's war-fighting or war-sustaining capability’.Footnote ¹¹⁰ This position is mainly geared towards economic targets, which may indirectly support or sustain the enemy's military capability.Footnote ¹¹¹ A 1999 assessment of the law by the US Department of Defense's Legal Counsel in respect of cyber operations states:

These approaches overlook the legal restrictions imposed by IHL. Damage to the enemy's civilian economy, research, and development capabilities in themselves is never allowed under IHL, regardless of the perceived military advantage, and regardless of the duration of the conflict. Otherwise, there would be no limits to warfare as virtually the entire economy of a country can be considered to be war-sustaining.Footnote ¹¹³ It is particularly important to recall this in the context of cyber warfare and to point to the potentially devastating consequences of a broad definition of military objectives for the civilian population.

The media and social networks

The Tallinn Manual addresses the thorny question of social networks being used for military purposes:Footnote ¹¹⁴

The qualification of social networks such as Facebook or Twitter as military objectives would pose a number of problems. Indeed such networks contain such vast amounts of data – most of which is entirely unrelated to the specific information that would need to be targeted – that it would appear to be difficult to qualify any such network as one military objective. A further question would be whether it is technically possible to only attack those components that are used for military purposes among the unstructured data of such networks.

An equally difficult question arises with respect to the media. The Tallinn Manual states:

Even if a particular report would make an effective contribution to military action, this should not lead to the conclusion that either the media corporation responsible or the cyber infrastructure transmitting it can be the subject of attack. As far as media corporations are concerned, the potential consequences of accepting their targetability would be momentous. Take an international broadcaster like the BBC. First, the expression ‘contributing to the enemy's operational picture’ is far too broad, is broader than making a direct contribution to the enemy's military action, as required by Article 52(2) of Additional Protocol I. Second, even if the media report contained tactical information, for instance on specific targets, the proposition that the media company could be targeted is highly problematic. Beyond the corporation itself, if all of the cyber infrastructure through which the reports are transmitted were to be considered a military objective, this would mean a large part of the globe's cyber infrastructure – again, as with dual-use objects, bearing in mind that the consequence of considering an object a military objective is that it can also be targeted by kinetic means, implying that the physical location from where and through which the reports are being transmitted – could be damaged or destroyed. Last, as said above, the example of media corporations brings into sharp contrast the problem of the geographical limits of the battlefield. Also, the law of neutrality would impose a number of limits in an international armed conflict on a state's ability to target infrastructure in a neutral state.Footnote ¹¹⁷

The prohibition of indiscriminate attacks and of indiscriminate means and methods of warfare

Indiscriminate attacks are prohibited.Footnote ¹¹⁸ Indiscriminate attacks are those:

• • which are not directed at a specific military objective,

• • which employ a method or means of combat which cannot be directed at a specific military objective, or

• • which employ a method or means of combat the effects of which cannot be limited as required by IHL,

and consequently, in each such case, are of a nature to strike military objectives and civilians or civilian objects without distinction. Parties to a conflict ‘must consequently never use weapons that are incapable of distinguishing between civilian and military targets’.Footnote ¹¹⁹

As said above, the fact that most of cyber space can probably be considered dual use is likely to make it difficult to separate military from civilian infrastructure. However, even where military and civilian infrastructure can still be separated and distinguished, another risk is that attacks will be indiscriminate because of the interconnectedness of cyber space.Footnote ¹²⁰ Cyber space consists of innumerable interwoven computer systems across the world. Even if military computer systems are separate from civilian ones they are often interconnected with commercial, civilian systems and rely on them in whole or in part. Thus, it might well be impossible to launch a cyber attack on military infrastructure and limit the attack or its effects to just that military objective. Viruses and worms are examples of methods of computer network attack that could fall into this category if their effects are not limited by their creators. The use of a worm that replicates itself and cannot be controlled, and might therefore cause considerable damage to civilian infrastructure, would be a violation of IHL.Footnote ¹²¹

This concern has been dismissed by some commentators as exaggerated, particularly based on the fact that, because most cyber operations would only be efficient if they targeted very specific, highly specialized systems, their effects on other computers would not be damaging. The example given is that of the Stuxnet virus, which was very precisely written to be used against the nuclear installations in the Islamic Republic of Iran.Footnote ¹²²

Indeed, if a virus is introduced into a closed military system or written to prevent its spreading into other systems, there might be no risk for outside civilian infrastructure. But it is quite imaginable that a party to a conflict takes no such precautions or develops cyber weapons that have effects on networks that it might not have foreseen. The fact that it is possible to design cyber weapons that are not indiscriminate does not mean that there is not a high potential for indiscriminate attacks. Even the Stuxnet virus – as reported in the media – shows how difficult it is to control the effects of viruses; it is reported that this virus was not intended to infect computers outside the targeted systems of the nuclear installations, yet somehow it replicated itself outside Iran.Footnote ¹²³ While the spread of the virus far beyond the intentions of its creators might not have caused any damage, it shows how difficult it is to control that spread.

There is therefore a twofold burden on the belligerent parties. First, they may not employ cyber weapons that are indiscriminate by nature, such as viruses or worms that replicate without any possibility of controlling them (in parallel to bacteriological weapons, for instance). The use of such weapons should be outlawed during the review of the weapon when it is being developed or acquired – if it can never be employed without striking military and civilian objectives alike, it is incompatible with IHL requirements.Footnote ¹²⁴ Second, at each attack, the belligerent party has to verify whether, in the particular circumstances of the case, the cyber weapon employed can be and is directed at a military target and whether its effects can be controlled within the meaning of IHL.

Precautions in attack

In the conduct of military operations constant care must be taken to spare the civilian population or civilian objects.Footnote ¹³⁴ Particular precautions required by IHL include doing everything feasible to verify that targets are military objectives,Footnote ¹³⁵ and taking all feasible precautions in the choice of means and methods of warfare with a view to avoiding and in any event minimizing incidental civilian casualties and damages to civilian objects.Footnote ¹³⁶ It also requires that parties to the conflict cancel or suspend an attack if it becomes apparent that it will cause excessive ‘collateral damage’.Footnote ¹³⁷

Thus, precautions may entail such obligations as taking measures to gather all available information to verify the target and the potential incidental effects of an attack.Footnote ¹³⁸ In cyber warfare, precautions may include mapping the network of the adversary,Footnote ¹³⁹ which will often be part of the development of computer network attacks in any case if they are specifically designed for a particular target computer system. If the information available is incomplete – as might be the case in cyber space due to its interconnectedness – the scope of the attack might have to be limited to only those targets on which there is sufficient information.Footnote ¹⁴⁰

The principle of precaution might require special technical expertise. The Tallinn Manual states that ‘[g]iven the complexity of cyber operations, the high probability of affecting civilian systems, and the sometimes limited understanding of their nature and effects on the part of those charged with approving cyber operations, mission planners should, where feasible, have technical experts available to assist them in determining whether appropriate precautionary measures have been taken’.Footnote ¹⁴¹ If expertise, and therefore the capacity to evaluate the nature of the target or the incidental civilian loss or damage, is not available, the attacker might have to refrain from the attack.

It is likely, however, that many cyber attacks in defence will be automatic, pre-programmed cyber operations against intrusions from the outside.Footnote ¹⁴² Such ‘hack-backs’ are automatic and simply target the computers from which the intrusion originates; as they are tackling a technical problem, they are not concerned with the civilian or military nature of the computers. In such contexts, and given that such cyber attacks will come from thousands or even millions of computers, states will have to carefully evaluate the lawfulness of such automatic hack-backs in light of the principle of precaution.

From another angle, the principle of precaution could, in some instances, entail an obligation to resort to cyber technology when it is available. Indeed, cyber operations might also cause less incidental damage to civilians or civilian infrastructure than kinetic operations. For instance, it might be less damaging to disrupt certain services used for military and civilian purposes than to destroy infrastructure completely. However, the extent of an obligation to resort to more sophisticated technology – in this case cyber technology – is not entirely settled. Indeed, there is as yet no international consensus that belligerent parties must at all times employ the most precise or the most technologically advanced weapon (the discussion on this issue mainly takes place with respect to precision-guided munitions).Footnote ¹⁴³ Nonetheless, the principle of precaution contains an obligation not only to abide by the principles of distinction and proportionality, but also to do everything feasible to ‘avoid and in any event minimize’ incidental civilian loss or damage. In such cases, the principle of precaution arguably implies that commanders should choose the less harmful means available at the time of the attack to achieve their military aim.Footnote ¹⁴⁴

Precautions against the effects of attacks

The principle of precautions against the effects of attacks requires that the parties to conflicts, among others, ‘to the maximum extent feasible … endeavour to remove the civilian population, individual civilians and civilian objects under their control from the vicinity of military objectives’ and ‘take the other necessary precautions to protect the civilian population, individual civilians and civilian objects under their control against the dangers arising from military operations’.Footnote ¹⁴⁵ This means that states have an obligation to either keep military objects apart from civilians and civilian objects, or (and particularly if this is not feasible) to take other measures to protect civilians and civilian infrastructure from the dangers resulting from military operations.

As the Tallinn Manual states, this may include ‘segregating military from civilian cyber infrastructure; segregating computer systems on which critical civilian infrastructure depends from the Internet; backing up important civilian data elsewhere; making advance arrangements to ensure the timely repair of important computer systems against foreseeable kinds of cyber attack; digitally recording important cultural or spiritual objects to facilitate reconstruction in the event of their destruction during armed conflict; and using antivirus measures to protect civilian systems that might suffer damage or destruction during an attack on military cyber infrastructure’.Footnote ¹⁴⁶

It is indeed frequently advocated that military and civilian networks should be segregated.Footnote ¹⁴⁷ As the legal assessment of the US Department of Defense recommends, ‘where there is a choice, military systems should be kept separate from infrastructures used for essential civilian purposes’.Footnote ¹⁴⁸ However, this is hardly realistic. In the early days of the Internet, construction probably proceeded without consideration for these matters. There exist, of course, closed military networks, and certain highly sensitive civilian infrastructure is also segregated from outside networks. But considering the inherent weakness of the rule on segregating civilian from military objects (Article 58(a) of Additional Protocol I), which only obliges states to endeavour to separate military and civilian objects and only to the maximum extent feasible, it is highly unlikely that it will be interpreted in state practice as entailing an obligation to segregate civilian and military networks. While it might theoretically be feasible to do this, it would be so impractical and costly as to be seen as unfeasible in the sense of Article 58 of Additional Protocol I. Governments would have to create their own computer hardware and software for military use and establish their own military lines of communication, including cables, routers, and satellites, throughout the world.Footnote ¹⁴⁹

In addition, the separation of military from civilian cyber infrastructure rests on the assumption that they are distinct and should be kept distinct. Strictly speaking, Article 58 does not prohibit dual use: it rests on the assumption that there is a differentiation between civilian and military objects, even if some civilian objects are used as military objectives. Already in the physical world, large parts of critical infrastructure are dual use, for example, electrical grids, but also, in many instances, oil pipelines, power plants, and road networks. In cyber space the principle becomes relatively meaningless where the problem is not the co-location of civilian and military infrastructures but the fact that it is one and the same.Footnote ¹⁵⁰

The question, then, is whether Article 58(c) of Additional Protocol I would require that at least some civilian infrastructure (for instance, nuclear power stations, chemical factories, hospitals) is protected against damage in the case of a cyber attack, requiring that states take action to maintain its functionality. For instance, Eric Talbot Jensen recommends that, in order to comply with its obligation under Article 58, the US take a number of measures such as mapping the civilian systems, networks, and industries that will become military objectives, ensure that the private sector is sufficiently protected, establish or maintain hack-back solutions, or create a strategic reserve of Internet capability.Footnote ¹⁵¹ The tendency of numerous countries to protect their critical infrastructure certainly goes in this direction – though it is unlikely that governments conceive of this protection in terms of passive precautions within the meaning of Article 58(c).