Kubo Mačák: I started working on these issues almost fifteen years ago at a time when much of the discussion still felt theoretical. Since then, a great deal has changed. The recent and ongoing conflicts around the world make it clear that the use of ICTs in armed conflict is now part of reality. In fact, I think it is safe to say that every future armed conflict will involve the use of ICTs in one way or another.

This shift matters deeply for the protection of civilians because cyber effects do not stop at the front lines. A disruption aimed at a military objective may spill into essential civilian services, and a tool deployed in one region may spread far beyond the territory of the belligerents.

Now, you have asked about the key trends. I would highlight three broad developments over this past period. First, we have seen a consolidation of the view that IHL applies to cyber operations during armed conflict. A decade ago, that was still contested. Today, we have a near-consensus in the international community on this legal baseline. The recent “digital resolution” of the International Conference of the Red Cross and Red Crescent [International Conference] captures this well.Footnote ³ It says expressly that “IHL rules and principles … serve to protect civilian populations …, including against the risks arising from ICT activities”.Footnote ⁴

Second, States are increasingly willing to express their views on how IHL applies in the cyber context. Thus far, two regional organizations and over thirty States have issued detailed positions, all of which address IHL, among other areas of international law.Footnote ⁵ Importantly, this practice shows that States don’t have to have all the answers ready when issuing a position; several have flagged particular questions and noted that they merit further discussion. This helps keep those issues on the agenda without committing to a specific interpretation.

That said, the third trend is a shift toward more detailed interpretation. Ten years ago, if States expressed their views at all, their statements tended to be brief and high-level. Today, we see national positions that devote several pages to nuanced interpretations of IHL notions such as “armed conflict”, “attack” or “object” in the cyber context. This growing granularity supports more mature dialogue and gives other States a stronger foundation for developing their own views.

Kubo Mačák: With those aforementioned trends in mind, I see three priority issues where States can make further progress. The first has to do with IHL obligations applicable in peacetime. Although IHL is designed for situations of armed conflict, it contains certain rules that apply even in peacetime.Footnote ⁶ In practical terms, this means that States should consider the “cyber dimension” of IHL obligations such as those concerning the dissemination and training of IHL; legal reviews of weapons, means and methods of warfare; and passive precautions to protect civilians against the dangers resulting from military operations.

The second priority is to level the playing field with respect to those issues that are already a key part of international discussions. Some States have developed impressive legal and technical expertise, which is reflected in their detailed national positions. Others have expressed a need for support to engage at the same level. In our consultations with States for the Handbook project, we consistently heard calls for capacity-building – including on IHL. Supporting and participating in such initiatives is key to fostering common understandings.

The third priority relates to artificial intelligence [AI] and its growing influence on the use of ICTs in armed conflict. It’s too early to say whether AI will fundamentally change how wars are fought, but what is clear is that it acts as a catalyst: it can dramatically increase the scale and speed of cyber operations – and with that, the potential harm. Despite this, the impact of AI on IHL and cyber operations has received limited attention. That will need to change.

Mariana Salazar Albornoz: Ensuring that the discussions on the use of ICTs during armed conflict remain centred on the humanitarian purpose of IHL requires focusing on the protection of civilians from the risks posed by digital warfare, rather than solely on technical and military capabilities. It must not be forgotten that the core of IHL is to protect persons who do not, or who have ceased to, participate in hostilities, and to reduce human suffering by restricting certain means and methods of warfare. The ICT resolution adopted at the 34th International Conference captures this focus very well, as it is centred on the protection of civilians against the potential human cost of ICT activities during armed conflict. States should keep this focus in mind in all their actions and discussions.

The legal discussion regarding the applicability of international law to cyber operations is one of the four key pillars of the UN Framework on Responsible State Behaviour in Cyberspace.Footnote ⁷ The publication of detailed national positions on this topic by more than thirty States and two international organizations is, as Kubo mentioned, showing a positive trend towards more detail or granularity. Therefore, when we think about ways to ensure the human-centred approach to this topic, these national positions are a key resource where that approach must be included. As States are increasingly expanding on the specifics of how international law applies in cyberspace, we do see more and more references and positions on the specific protections that IHL affords to civilians regarding the use of ICTs. This is a very good trend that should be continued and strengthened. All States that are in the process of preparing their national position or of updating an existing national position should make sure to include this aspect.

We know that this process regarding how and to what extent international law applies in cyberspace is a lengthy one. It has taken many years, and I am happy to see that States from my region, Latin America, are joining this trend. But it is a slow process, so there are other mechanisms that have come to complement it. Specifically, there are three other pillars of the UN Framework on Responsible State Behaviour in Cyberspace that help shape and frame our understanding of what constitutes responsible behaviour by States in the cyber realm: the eleven UN Norms of Responsible State Behaviour in Cyberspace,Footnote ⁸ the confidence-building measures, and the capacity-building efforts. I’m mentioning this because the human-centred approach should be borne in mind not only in the national positions on international law and cyberspace, but also in these three other pillars.

Regarding capacity-building, I’ve been participating in a few exercises, which I think have been very interesting, where States that are in the process of preparing their national positions have been receiving training from international experts, international organizations and humanitarian institutions. To include information on this human-centred approach to IHL into those trainings in a very detailed manner is a good practice that I would absolutely encourage. Moreover, regional and international consultations and political initiatives such as the Global IHL Initiative play a key role in galvanizing the discussions and awareness on this topic, complementing all these efforts of capacity-building.

Finally, I would like to emphasize the importance of ensuring that all these efforts are complementary and enrich each other, and that they are not duplicative. When I was a member of the Inter-American Juridical Committee, our efforts regarding international law and cyberspace were very cautious to not duplicate what was going on in the United Nations [UN], but rather to help States of the Americas to further their understanding and grasp of this topic in order for them to prepare their national positions to present in the UN Open-Ended Working Group [OEWG]. On one of the topics that Kubo just mentioned, which is the growing influence of AI in the use of ICTs during armed conflicts, I currently see that despite the interconnectedness between these two technologies, currently the discussions on AI are quite separated from the discussions on ICTs’ implications for international peace and security. There are separate fora for each topic, and it comes with a risk of division, because we often don’t see the same people going to both fora. We should eventually try to streamline or combine these discussions when they involve this specific issue of AI use in ICTs during armed conflicts, because in the end, IHL is at very centre of all these discussions.

Mohamed Helal: The African Union [AU] developed the Common African Position because we did not want to be left out of the conversation. There was a concern that for the better part of a decade, there had been a robust conversation among States at the UN, and outside the UN through the national statements that governments had been issuing, on how international law applies to cyber space, but the only African country that had issued a national statement was Kenya. There was therefore a concern in the AU Peace and Security Council that our collective silence may be interpreted as acquiescence to emerging areas of common understanding on some of these issues, whether on sovereignty, the use of force, the prohibition of intervention, rules of attribution, or IHL. This led to a desire to develop a document that would serve as a common platform for the member States of the AU to use in conversations at the UN, including the OEWG, but also to encourage countries to develop their own national positions.

In fact, after the adoption of the common position in February 2024, we’ve had several sessions of the OEWG where African States have come forward with a common statement in the plenary session that references the common position. Various African States individually in their national statements have also referred to it, and I know that several African States are looking into developing their own national positions on the basis of, or drawing from, the common position.

The process to create the Common African Position was a multilateral, collaborative process of the fifty-five member States of the Union. It started off with a mandate from the Peace and Security Council, after which the AU Commission of International Law drafted an initial version that was then submitted to the member States. We went through several stages of developing that text until it was negotiated by the member States in November 2023 and subsequently submitted to the Peace and Security Council, which adopted it in January 2024. It then went to the Assembly, which is the summit-level meeting of the AU.

Building on Mariana’s comments on capacity-building, a key part of this process of developing the Common African Position was a capacity-building programme that was generously funded by Global Affairs Canada and organized in conjunction with Cyber Law International. That was a major part of this process. In addition to negotiating a document that provides a platform for African States to use at the UN and elsewhere, it was also an investment in human capacity and in the institutional capacity of the AU. We had detailed discussions that were held online, in Addis Ababa and in New York for African experts. Almost 200 individuals participated in this capacity-building programme, and I think we’re now seeing some of the fruits of the initiative where I know that several States are starting to build their own national positions.

Mohamed Helal: Ultimately, your question raises two core issues: the first is the definition of “attack”, and the second is whether data is an “object”. On both of those issues, I think States have a choice as to whether these terms should be interpreted narrowly or broadly. The stakes involved in this choice are obvious. In my view, if States interpret these terms narrowly, we decrease the restraints that the law governing the conduct of hostilities places on belligerents and we increase the exposure of civilians to the harmful impacts of armed conflict. Conversely, if States adopt a broad definition of “attack” and a broad understanding of “object”, we would expand the protections afforded to civilians and civilian infrastructure, and place greater restraints on belligerents. To me, these are the choices and the stakes involved in those choices.

Having said that, let me explain further, starting with the concept of attack. As we know, under Article 49(1) of Additional Protocol I to the Geneva Conventions [AP I], an attack is an “act of violence” – but the question is, what is violence? Here, there are broadly two approaches, both of which relate to the effects or the consequences of the conduct in question.

The first approach defines attacks and violence in physical terms. One example is the Tallinn Manual, which defines an attack as conduct that causes “injury or death to persons or damage or destruction to objects”. According to this approach, these effects – namely injury, death, damage or destruction – could be the direct result of the military operation in question or the reasonably foreseeable consequence of that operation. However, in either case, in order to qualify as an “attack” the operation must cause physical effects.

The second approach adopts a broader definition of attack. It argues that a military operation that impairs the functionality of a cyber network could qualify as an attack, even if it does not cause physical damage, either directly or through its foreseeable consequences. However, one core question with this approach is whether there is a threshold of adverse effects on functionality that must be met for an operation to constitute an attack. Some States have defined this threshold in terms of “disabling” a cyber network. One example of this is Austria,Footnote ⁹ while another is Costa Rica,Footnote ¹⁰ which has issued a national position indicating that disabling a computer system or network – whether temporary or permanent, reversible or not – could qualify as an attack. Germany, however, appears to adopt a lower threshold. It has stated that an operation which causes “harmful effects on communication, information or other electronic systems”, or “on the information that is stored, processed or transmitted on these systems”, could amount to an attack.Footnote ¹¹ The operative term is “harmful effects”, which appears to be broader than the term “disable” used by Austria and Costa Rica.

In either case, however, the important point is that we have two approaches to interpreting the term “attack” that is defined in Article 49(1) of AP I. And as I mentioned, the stakes involved relate to the extent of the protection afforded to civilians and civilian objects.

Personally, I’m a proponent of defining the term “attack” broadly. This is consistent with the object and purpose of AP I and is also consistent with an interpretive methodology that reads the terms of each of the provisions of the Protocol not in isolation to each other, but in conjunction with each other. For example, Article 52(2) of AP I defines a military objective as any target the “destruction, capture, or neutralization” of which provides a military advantage. In my view, the term “neutralization”, especially when applied in cyberspace, should encompass non-physical effects.

Nonetheless, while advocating for this broader definition, it is important to avoid adopting an over-inclusive definition. This is a core question that States should consider; for example, what is the line that distinguishes between an attack and disruptive operations that involve a limited interference with communication systems? Moreover, States should consider whether – and to what extent – the limitations that apply to an “attack” are also applicable to “military operations”, which are a broader category of conduct.

Moving to the second part of your question, which relates to whether data is an “object” – again, States have a choice. We can adopt a narrow understanding of the term “object” as it is used in AP I, especially in Article 52, which would limit the concept of a “civilian object” to things that are tangible and visible, thereby excluding data from the protections accorded to “civilian objects” under IHL. Several States have adopted this approach, including Israel and Denmark.Footnote ¹² Conversely, a broad definition would interpret the term “object” to include computer data. Costa Rica and Germany are among the States that have supported this approach,Footnote ¹³ which has also been adopted by various scholars, including Kubo.Footnote ¹⁴

The core argument in favour of this broader interpretation of the term “object” is that it is consistent with the ordinary meaning, and with the object and purpose of AP I. Indeed, the term “object” in Article 52 of AP I should be viewed as a “generic term” that – to use the language of the ICJ in the Navigation Rights case – must be interpreted in a manner which takes into consideration evolution over time, especially that there is nothing in the Protocol to indicate that its drafters intended to limit the term “object” to “tangible and visible” things. Moreover, excluding data from the definition of “object” would lead to the absurd result whereby destroying physical files and records held in civilian government facilities would be unlawful targeting of a civilian object, while targeting the same records that are preserved in digital format would not be prohibited.

It is important to note, however, that not all tampering with civilian data will necessarily constitute an attack. This takes us back to the first issue we discussed, which is that only conduct which qualifies as an attack would be subject to the limitations and restraints found in the law on the conduct of hostilities. Similarly, the collection, processing and even the exfiltration of data generally will not be considered an attack.

However, even during an armed conflict, certain rules of human rights law continue to apply concurrently with IHL. Specifically, in situations where conduct is not closely related to the armed conflict or cannot be justified under the strict limitations of military necessity, human rights law, especially the right to privacy, accords a measure of protection to civilian data, including against tampering with, damaging or exfiltrating private data.

In conclusion, and to reiterate, States have a choice. It’s a choice about interpretation and the application of established rules in a new context. The stakes really are the breadth of protection that we would like to afford to individuals and to civilian objects, and the extent of restraints that should be placed on belligerents when using ICTs in armed conflict.

Mariana Salazar Albornoz: Your question touches on the malicious use of ICTs, undermining the efficacy of specific protections that IHL confers or affords to, for example, medical services, humanitarian activities and certain protected persons or objects, and also on the malicious effects of the spreading of misinformation, disinformation and hate speech. We are seeing with concern that this malicious use of ICTs is occurring in current armed conflicts, with, for example, direct attacks against medical facilities, in flagrant disregard of IHL and with devastating consequences. While in terms of the national State positions there seems to be agreement that medical personnel and medical facilities should be respected at all times, in practice, we are seeing that they are not.

Another example that we have seen occurring in recent years is direct attacks against the data of medical and humanitarian institutions, such as the 2022 data breach and repeated distributed denial-of-service [DDoS] attacks on the International Committee of the Red Cross [ICRC]. The direct kinetic attacks to medical and humanitarian physical facilities mentioned above, as well as the cyber attacks and data breaches, not only affect the functionality of the medical and humanitarian services, but also undermine the credibility of these institutions.

IHL already states that belligerents must respect and protect medical facilities at all times, including the requirement not to unduly interfere with their functioning and to take feasible measures to protect them against harm or interference from private persons. Also, under IHL, humanitarian personnel and objects used for humanitarian operations must be respected and protected, and parties to armed conflicts must allow and facilitate impartial humanitarian activities during armed conflicts, subject to their right of control. It is important that both in national State positions – as they start being more specific – and in implementation measures at the domestic level, States strengthen the legal and policy frameworks to ensure the respect and protection of medical and humanitarian services, personnel and facilities. Elucidating the specific protection of medical data in the national positions of States on the applicability of international law to cyberspace would be a positive step forward.

The obligation also encompasses a prohibition against deleting or tampering with medical data, including both the data necessary for the proper use of medical equipment for tracking medical supplies and personal medical data required for patient treatment. The ICRC’s initiative to develop a digital emblem as a means of identifying the digital infrastructure and data of these organizations and entities entitled to display the distinctive emblems recognized under IHL is also a positive effort. States should go forward as encouraged by the ICT resolution of the 34th International Conference, in the sense of studying possible legal and diplomatic avenues to operationalize the potential use of a digital emblem.Footnote ¹⁵ These considerations could include making sure that existing national legal frameworks on the protection of the distinctive emblems encompass the digital emblem, as well as the ways and means to include the technical and operational aspects of the digital emblem in capacity-building for military personnel and other relevant actors.

As for information and psychological operations, the spreading of harmful information can incite hatred and violence and expose persons deprived of liberty to public curiosity, or can undermine trust in medical services and humanitarian organizations. IHL contains several specific rules that impose limits on spreading information, including through digital means – among them is the rule that civilian and military officials of a party to an armed conflict must not encourage IHL violations, including through digital platforms. We are seeing an increasing use of social media platforms by parties to armed conflicts, and by civilians, to encourage IHL violations. The ICT resolution of the 34th International Conference reaffirms that inciting violations of IHL through digital means is prohibited.

Another established IHL rule is that prisoners of war and other protected persons must be protected against public curiosity. Therefore, public sharing by authorities of data, images and videos of prisoners of war and other persons deprived of their liberty, subject to limited exceptions, would violate this rule. Acts or threats of violence that have the primary purpose of spreading terror among the civilian population are likewise prohibited under IHL, and finally, false information spread by parties to armed conflict to obstruct medical or humanitarian work is also incompatible with the obligations to respect and ensure protection of medical and humanitarian personnel.

In line with what we have been discussing, States should ensure the inclusion of these specific protections in their national legislations and policies, and refer to them in their national positions on international law and cyberspace.

Kubo Mačák: The two issues of the military use of civilian ICT infrastructure and the involvement of civilians in ICT activities are related, in that they both concern the blurring of the lines between civilian and military categories. But at the same time, the two issues are also distinct. The first concerns the military use of civilian ICT infrastructure – in other words, it is a question about objects. The second concerns the involvement of civilians on the digital battlefield, which is a question about persons. Since IHL contains different rules for objects and for persons, it is helpful to look at each of them in turn.

Starting with the military use of civilian infrastructure, the challenge arises from the fact that cyber infrastructure is predominantly civilian in character. Just think of the global internet backbone, data centres, or communication platforms that are built and operated by civilian technology companies. All of this is essentially civilian in nature and, under IHL, civilian objects – including civilian ICT systems – are protected from attack. However, if they are used for military purposes, they may, depending on the circumstances, become military objectives and therefore lose that protection.

Imagine, for example, a satellite internet system that is used by one of the belligerents for military communications, but which is also relied upon by essential civilian services both within and outside the countries affected by conflict. It is important to carefully consider how the IHL rules on the conduct of hostilities apply to cyber operations directed against such systems. Let me highlight at least one open question for each IHL principle you have mentioned.

First, with respect to distinction, the question is how to identify the relevant military objective. If it’s defined too broadly – such as the entire network in question – then the operation might affect many nodes that are otherwise separable and thus go at least against the spirit, if not the letter, of the prohibition against indiscriminate attacks.

Second, proportionality requires an assessment of incidental civilian harm. Here there is some overlap with the debate on loss of functionality that Mohamed referred to earlier. A narrow interpretation that would focus only on physical damage could place disruptions to essential services outside the proportionality assessment even when the humanitarian consequences would be quite significant.

Third, what precautions are belligerents obliged to take before they launch such operations? Since the applicable IHL standard is feasibility, State views on what they consider feasible would be particularly valuable. Illustrative measures could include segmenting military and civilian ICT infrastructure, integrating legal advisers into cyber operational planning, and maintaining meaningful human control over AI-enabled cyber tools.

Turning to the involvement of civilians on the digital battlefield, we see a wide spectrum of possible actors. They may be private individuals, employees of technology companies or members of hacker groups. Their activities might range from allowing their laptop to be used for DDoS attacks, to providing ICT services to the armed forces they sympathize with, to orchestrating sophisticated cyber campaigns against civilian ICT infrastructure on enemy territory. So, the spectrum of this civilian involvement is broad. But let me again try to narrow it down to three legal questions that, in my view, require further attention from States.

First, which of these forms of civilian involvement qualify as direct participation in hostilities? Under IHL, civilians are protected against attack unless and for such time as they take a direct part in hostilities, so how broadly or how narrowly this notion is understood in the cyber context matters a great deal. Certain offensive operations against enemy targets would likely fall within its scope, exposing those involved to serious risks – but even disagreement about classification can place civilians in danger.

The second question concerns the legal implications for States that might be promoting such activities. Several international legal obligations sit uneasily with encouraging or tolerating civilian involvement that may rise to the level of direct participation. These include the duty to exercise constant care to spare civilians from the effects of hostilities, the obligation to respect the right to life of persons under a State’s jurisdiction and the duty to take feasible measures to ensure that children do not directly participate in hostilities. These issues call for further reflection, and it would be helpful for States to express their views on the matter.

The third question is how to foster compliance with IHL when some civilian involvement cannot be entirely avoided. Here, dissemination – as we discussed earlier – is central. Civilians need to understand both the risks that their involvement may entail and the IHL rules that govern their cyber conduct during armed conflict. The recent ICRC summary “Eight Rules for ‘Civilian Hackers’” shows how this can be communicated effectively.Footnote ¹⁶ States also have related responsibilities: they must avoid encouraging behaviour that would violate IHL, prevent such violations where feasible, and prosecute and suppress them if they occur.Footnote ¹⁷

Mariana Salazar Albornoz: Inter-State collaboration has emerged as a good practice: States that have more experience, as well as international organizations, civil society and academia, can assist in the capacity-building efforts to help States that are newly developing their positions on international law in cyberspace, to level the playing field. As Kubo mentioned earlier, States should bear in mind that they do not need to have all the answers in order to publish their national positions: certain topics can be temporarily left out of national positions if more work is needed. Moreover, national positions that have previously been issued and published can be revisited to include more details as the understanding of topics grows, as has already been done by a few States. The publication of national positions is necessary: it is only when a broad majority of States from all regions have published national positions that we can understand the divergences and convergences in how IHL applies to cyber space, and whether any lacunae exist in this regard.

Mohamed Helal: Notwithstanding the political context of some of these conversations and the stakes involved, I would like to emphasize the importance for member States of not making consensus an enemy of progress.

Kubo Mačák: The road ahead begins with acknowledging the progress we have already made. We now have a broad agreement on the legal baseline, a clearer sense of the IHL questions that recur in the cyber context, and a growing understanding of which areas will need more attention, including the role of AI and the obligations applicable in peacetime. What is needed next is to widen the conversation so that as many States as possible can contribute, and then to deepen it through continued work toward more detailed and more granular interpretation.

Dr Kubo Mačák is Professor of International Law at the University of Exeter, United Kingdom. He is the author of Internationalized Armed Conflicts in International Law (Oxford University Press, 2018) and co-author of the Handbook on Developing a National Position on International Law and Cyber Activities: A Practical Guide for States (University of Exeter and NATO Cooperative Cyber Defence Centre of Excellence, 2025), and has published widely in leading journals such as the International and Comparative Law Quarterly, International Review of the Red Cross and Journal of Conflict and Security Law. He serves as the General Editor of the Cyber Law Toolkit, an award-winning online resource on the international law of cyber operations. From 2019 to 2023, he was a Legal Adviser at the International Committee of the Red Cross in Geneva.

Mariana Salazar Albornoz is Adjunct Professor of Public International Law and of International Human Rights, Criminal and Humanitarian Law at IE University in Madrid and at Universidad Iberoamericana in Mexico City. Since 2023, she has been a member of the Board of the United Nations Register of Damages. Between 2019 to 2022 she was a Member of the Inter-American Juridical Committee, serving as Rapporteur on International Law Applicable to Cyberspace and on Privacy and Data Protection. She recently concluded her membership on the Editorial Board of the International Review of the Red Cross (2020–25). Among her previous roles, she was Coordinator of International Law and Director of IHL, ICL and Economic, Social and Cultural Rights at the Mexican Ministry of Foreign Affairs, as well as Regional Manager of the Latin American Internet Association and Associate of the Auschwitz Institute for the Prevention of Genocide and Mass Atrocities.

Mohamed Helal is a Professor of Law at the Moritz College of Law, Ohio State University, and a member of the African Union Commission of International Law, where he served as Special Rapporteur for the Application of International Law in Cyberspace and oversaw the drafting of the Common African Position on the Application of International Law in Cyberspace. He is also a member of the Permanent Court of Arbitration. His scholarly work has appeared in the European Journal of International Law, Global Constitutionalism, Climate Law, the American Journal of International Law, the Harvard National Security Journal, the NYU Journal of International Law and Politics, the Fordham International Law Journal, and the Emory International Law Review.