2. A Question of Data

Most discussions regarding military objectives and cyber operations come up against the question of whether data per se can constitute a military objective.Footnote ⁸ Indeed, this question underlies the argument of most of this article; at the outset, however, it is important to clarify terminology. Whereas most discussions of this nature tend to treat data as a single entity, the author finds it useful to make a distinction throughout between different types of data: content-level and operational-level data. Content-level data – such as the text of this article, or the contents of medical databases, library catalogues and the like – is largely excluded from the ambit of this article. That is not to suggest that content-level data may never be protected under international humanitarian law, but the data sets that would be the subject of the most concern are already covered by the specific protections granted, for example, to medical records and material, and cultural property (for demographic data and archives).

Operational-level data – also known as logical-level data or, more commonly, program data – is essentially the ‘soul of the machine’. It is this type of data that gives hardware its functionality and ability to perform the tasks we require. Operating systems, software applications and SCADA systemsFootnote ⁹ are all examples of operational level-data. To avoid confusion, throughout this article operational-level data will simply be referred to as ‘code’.

From a conceptual point of view, making a distinction between these two types of data is important because of the different types of harm that are likely to result from damage, destruction or neutralisation of each type. As a general rule, destruction of operational-level data or code will result in loss of functionality of the system, whereas similar destruction of content-level data will leave the system intact, albeit with corrupted or missing data.Footnote ¹⁰ Although there is very little state practice in the area, the way in which states have tended to conduct and react to low-level cyber operations to date tends to suggest that loss of content-level data is viewed differently from operations which involve loss of functionality of the system. While the majority of the authors of the Tallinn Manual were of the opinion that data should not be considered an object (see the discussion at Section 3 below on materiality), a minority of the experts involved in drafting the Tallinn Manual considered that, for the purposes of targeting, data per se should be regarded as an object.Footnote ¹¹ Their grounds for objecting to the exclusion of data from the notion of an ‘object’ was that failure to do so would mean that loss or deletion of extremely valuable and important civilian datasets could escape the reach of the law of armed conflict.Footnote ¹² While these concerns are not without merit, given the difference in how states have thus far treated attacks on content-level data as distinct from code, the present author considers that including all data within this scope may be too broad. Such an expansive inclusion would take the definition of a military objective too far from its purpose in identifying the legitimate targets of attacks and military operations. The comments of the minority are indicative of the difficulties created by failing to distinguish between two different types of data and adopting an overly broad definition of data such as that adopted by the Tallinn Manual. The glossary of the Manual refers to data as ‘the basic elements that can be processed or produced by a computer’; it thus incorporates both content-level and operational-level data. The author considers that the conflation of these types of data creates unnecessary difficulties in interpretation which may be usefully resolved by regarding each type separately.Footnote ¹³

3. Materiality of Objectives: The Requirement of ‘Objectness’

One of the problematic aspects of the Tallinn Manual is an apparent inconsistency in the approach adopted by the group in dealing with some of the underlying concepts of cyber warfare. In this instance it is the treatment of intangibility in the object requirement of the definition of military objectives. The opening clause of Article 52, ‘in so far as objects are concerned’ (emphasis added), caused the majority of the international group of experts to consider that the term ‘object’ required the particular item to be something ‘visible or tangible’, as suggested by the text of the ICRC Commentary to the Additional Protocols.Footnote ¹⁴ Thus, for the purposes of the Manual, only the hardware components of cyber infrastructure (such as servers, routers and sensors), computers and computer systems may constitute objects and therefore military objectives. Interestingly, the Manual makes no distinction between virtual and physical cyber infrastructure in the black-letter rule, merely listing it as something that may be included in the definition of a military objective. It is only in the Commentary to the rule that the discussion surrounding the object requirement of the definition makes clear that the majority of the Tallinn group considered that it must include ‘visible and tangible’ physical components rather than merely lines of code.

It is notable that the references provided by the ICRC Commentary when discussing the meaning of the term ‘object’ (or, in the French text, ‘biens’) are merely to the dictionary definitions of the term rather than to any specific discussions that occurred in either the working committees or the Diplomatic Conference regarding the matter.Footnote ¹⁵ It is indisputable that the dictionary definitions of both the English and French terms, as referred to in the ICRC Commentary, refer to material things that are perceivable by the senses. The present author considers it clear from the text of the Commentary that the definitional point about the term ‘object’ was being made merely to distinguish the term as a ‘thing’ from its use in the sense of ‘aim or purpose’ (for example, of a military operation) rather than to specifically exclude intangible objects from the definition.Footnote ¹⁶ Thus any computer program, database, system or virtual network could still qualify as a legitimate target if it meets the two-part definition set out in Article 52(2), regardless of whether it has a tangible component or exists purely as lines of code.Footnote ¹⁷ The author stands by this interpretation; however, the fact that the majority of the group behind the Tallinn Manual reached a different conclusion makes it worth revisiting the criterion in more depth. The first point of note is that while it may lack materiality, code is certainly perceivable by the senses and by sight, in particular, and may hence be considered visible. It is thus the relevance of the materiality or tangibility of the object that is in question with regard to the definition of military objective.

The rules contained in the Tallinn Manual are intended to reflect customary international law. However, given the fact that the accepted customary international law definition of a military objective is based on the treaty definition set out in Article 52(2) of Additional Protocol I, one must look at how that term is defined to determine what was intended to be included.

The English version of the ICRC Commentary is derived from the French original, published in 1986. As a historical side note, it is worth remembering that this is the year in which TCP/IP protocols were standardised (allowing considerably more networks to connect with one another), two years before the first internet-based attack, and three years before the invention of the world wide web.Footnote ¹⁸ It is self-evident that the 1977 Additional Protocols and their ICRC Commentary could not possibly have contemplated the incredible changes the internet revolution would have on society (and the corresponding development of the law regulating it) and the sheer number of things that would operate on the basis of underlying computer code, nor would they have envisaged the current trend towards virtualisation which separates software and hardware even further.Footnote ¹⁹

Treaty terms must be interpreted in good faith and in accordance with their ordinary meaning in their context and in the light of their object and purpose.Footnote ²⁰ While, at the time of drafting in 1977, it is likely that this limited objects to material items in an attempt to exclude such ‘objectives’ as civilian morale and, in the wake of the Second World War, aerial bombing campaigns, code is by no means such an amorphous concept. As noted above, code is patently visible, although it may lack tangibility in the sense of being able to be touched or having a physical presence outside the electromagnetic spectrum.Footnote ²¹ Throughout the whole body of laws of armed conflict there is an underlying dichotomy not only between civilian and military in terms of distinction but also between the treatment of people and the treatment of things. It is this second underlying dichotomy that this debate taps into – regardless of its intangibility, code is nevertheless a thing. It does not equate with the somewhat notional targets of civilian morale, a population's willingness to fight, or the even less specific ‘victory’ – all of which formed the historical backdrop to the attempts to define military objectives which culminated in the definition adopted in the Additional Protocol.

Further, and perhaps most importantly, requiring tangibility in today's world leads to a manifestly unreasonable result. To take a practical example, weapons, weapons systems and military matériel are perhaps the epitome of a legitimate military objective. Malware that is designed specifically to cause death, injury, destruction or damage is indisputably a weapon.Footnote ²² Examples include Stuxnet-type code, which is intended to cause physical destruction,Footnote ²³ or even viruses such as Wiper, which destroyed the functionality of computer systems without destroying any physical components.Footnote ²⁴ However, by excluding intangible objects such as code from the interpretation of the definition offered by the majority of the Tallinn group, neither of these cyber weapons would constitute a legitimate military objective. It cannot be correct that one can have a weapon that is made entirely from code that does not constitute a military objective.

As the definition of civilian objects is provided in a negative form – that is, civilian objects are all things that are not military objectivesFootnote ²⁵ – we are left with two main alternatives. Either a piece of code such as Stuxnet is a civilian object or, given that the problem is with the term ‘object’ itself, it is not covered by the definition of military objectives at all. Given that the object and purpose of both the principle of distinction and of the Additional Protocol itselfFootnote ²⁶ is to provide effective protection for civilians and civilian objects while enabling parties to an armed conflict to conduct effective military operations, either of those alternatives produces a manifestly unreasonable result. In order to conduct efficient military operations against cyber targets while minimising the harm to civilians and civilian objects, it will sometimes be necessary to conduct attacks against code rather than the physical infrastructure on which it rests. Any modern interpretation of the law should reflect this necessity and allow for that to happen.

An alternative reading rests on the wording of the opening sentence of Article 52(2): attacks shall be strictly limited to military objectives. While the second sentence of the definition of military objectives is limited to objects by the phrase ‘[i]n so far as objects are concerned’, the first sentence contains no such limitation.Footnote ²⁷ Yoram Dinstein argues that it is through this distinction that the definition can be viewed as including enemy combatants.Footnote ²⁸ It is tempting to make a similar argument for those intangible items such as code, for which it is argued that they do not fulfil the materiality requirement of the definition. In that manner the general rule contained in the first sentence is not constrained by the more specific definition contained in the second. While Dinstein's argument is compelling when considering people as military objectives and therefore legitimate objects of attack, applying this reasoning to intangible objects in order to avoid the definitional problem under discussion is problematic. It does not sit easily with the underlying dichotomy within the law between people and things. In addition, the fact that the tangibility requirement merely comes from an interpretation contained in the text of the 1986 Commentary than from a specific discussion in the Diplomatic Conference merely adds to the present author's conclusion that in relation to cyber operations the term ‘objects’ must be interpreted to include intangible things such as code.

4. Qualification of Objectives: Nature, Location, Purpose or Use

The definition also requires that, in order to qualify as a military objective, an object must, by its nature, location, purpose or use, make an effective contribution to military action.

Those objects which by their nature make an effective contribution to military action include all objects which have an intrinsically military character. With respect to cyber operations, this category would include all weapons, weapons systems and matériel, sensor arrays, battlefield devices, military networks and databases, military command and control systems, communications systems and any other digital device purposely built to military specifications.Footnote ³⁶ It would also include those objects directly used by the armed forces: weapons, equipment, transport, fortifications, depots, buildings occupied by armed forces, staff headquarters and communications centres.Footnote ³⁷

A civilian object will become a military objective through use when it is used for military purposes. Classic examples include military use of civilian transport, airfields or the use of buildings to house military personnel or supplies. The cyber infrastructure that serves those objects will similarly become a military objective when used for military purposes. In an age of dual-use infrastructure, in which large amounts of military traffic and communications are sent across civilian networks, this becomes particularly problematic and exposes vast amounts of that infrastructure to attack. Social media sites, such as Facebook and Twitter, may also become open to attack where they are used to organise and coordinate military operations.Footnote ³⁸ However, given the specificity requirement outlined above – to refine the target so as to minimise harm to civilians – only those sectors of the structures that are actually used should be targeted. Such objects regain their civilian status once they are no longer used for military purposes.

An object will qualify as a military objective through the purpose criterion where the intended future use of the object is military. Intention is notoriously difficult to assess, however, and parties must take care in determining the actual intentions of the opposing forces rather than the potential use of a particular object (for example, a piece of cyber infrastructure) and establishing that a civilian object is intended for military use.

The criterion of location was introduced without explanation into the definition of military objective in Article 52(2) by Working Group III. However, during the Diplomatic Conference several states made comments to the effect that the amendment recognised their position that a specific area of land might qualify as a military objective (independently of its nature or use) where, because of its location, its total or partial destruction, capture or neutralisation, in the circumstances ruling at the time, offers a definite military advantage.Footnote ³⁹ The ICRC Commentary to the Article goes on to explain that a site might have special importance for military operations because it is a site that must be seized or because it is important to prevent the enemy from seizing it, or otherwise because it is a matter of forcing the enemy to retreat from it.Footnote ⁴⁰ Such land areas generally qualify because of a specific geographical feature, such as a mountain pass. Physical cyber examples are not easy to come by given the distributed nature of networks, which are specifically designed with efficiency and redundancy in mind.Footnote ⁴¹ However, in terms of geographical location, a civilian WIFI network located in an area in which an enemy is operating may enable the enemy to piggy-back communications on the signal, for example. Denying the enemy use of the network may give a direct and concrete advantage to the attacking forces.Footnote ⁴²

A more interesting question is whether an object may qualify as a military objective through its network location rather than its location in physical space.Footnote ⁴³ As noted, the classic example of a military objective is the mountain pass or defile; another would be a trail through swamp or jungle.Footnote ⁴⁴ Cyber infrastructural equivalents of such geographical features may include internet kill switches, undersea cable landing points or primary nodes of a state's internal telecommunications networks, each of which would make an effective contribution to military action. Similarly, the recent revelations regarding NSA and GCHQ data collection have brought into public awareness the strategic importance of certain internet switches which have allowed the intelligence agencies to access all data travelling across them. Denying particular data routes to military traffic by neutralising particular network nodes, thus forcing the traffic over less secure or monitored switches, would provide a definite military advantage. Subject always to the principle of proportionality, there is no reason why a particular node's network location should not form the basis for attacks on such targets by analogy, although in practice it is likely that such strategic objects would qualify also through purpose or use.

Finally, while accepting the customary status of the definition of military objective in Article 52(2), the United States has adopted a broader definition of the effective contribution to military action requirement to include those items which make an ‘effective contribution to the enemy's war fighting or war sustaining capability’.Footnote ⁴⁵ Thus, according to this interpretation ‘economic objects of the enemy that indirectly but effectively support and sustain the enemy's war-fighting capability may also be attacked’.Footnote ⁴⁶ Such an approach moves the lawful targets of attack away from the close nexus with military action that is required by the definition contained in Article 52(2). Taken to its logical extreme, under such an interpretation not only the political command and control structures become targetable, but a vast array of civilian activity, including those that merely contribute to the economy through taxes, could be construed as indirectly supporting or sustaining the war effort. It is notable that the majority of the Tallinn Manual group also came to this conclusion, finding that the connection between war-sustaining activities and military action was too remote.Footnote ⁴⁷

Regardless of how an object makes its effective contribution to military action – whether it qualifies through its nature, location, purpose or use – it must also meet the second arm of the definition to be considered a legitimate military objective. The total or partial destruction, capture or neutralisation of the object must offer a definite military advantage in the circumstances ruling at the time. It is widely accepted that the military advantage may be determined from the attack as a whole and not from isolated parts;Footnote ⁴⁸ thus a particular cyber operation may form part of a broader operation and be measured accordingly.

5. Specificity of Objectives: Code, Component, System, Network

The above discussion on materiality is linked with a second aspect brought to the fore by the specific ability of cyber operations to target increasingly smaller parts of a system in order to achieve the desired military outcome. The precision of such specific operations raises questions about the appropriate scope of the definition within the cyber context and the precise level at which the military objective should be defined – code, component, system or network level. Clearly each situation will be highly dependent on the type of objective to be attacked and the desired outcome of the operation. This section will explore some of the different ways in which an objective might be defined and examine whether the principle of proportionality and the requirement to take precautions in attack can offer insights into the appropriate level of specificity required in defining the military objective.

Although not a problem exclusive to cyber operations, the level of specificity of the definition is of particular relevance in cyber operations because of the high level of interdependence between civilian and military cyber infrastructure. The majority of modern militaries, particularly in an age of defence budget cuts, do not construct their own completely separate cyber infrastructure. Instead they rely primarily on the cables, routers, switches and satellites (as well as the firmware and software that run them) that are used for civilian communications.Footnote ⁴⁹ While the term ‘dual use’ is a useful descriptor of those systems and infrastructure that have both civilian and military uses, it is not a term that appears in the law of armed conflict. The negative definition of civilian objects (that is, all objects that are not military objectives) ensures that the classification of objects is binary – either something is a military objective or it is a civilian object. Once something qualifies as a military objective – either through its nature, location, purpose or use, and its destruction, damage or neutralisation provides a military advantage – it remains targetable for the entire time that it meets that definition. Further, it becomes a legitimate target of attack in its entirety (except where separable parts remain civilian – for instance, different buildings of a hospital).Footnote ⁵⁰ Any remaining effect on civilian functions that the object may retain must be taken into account during the proportionality assessment and the requirement to take precautions in attack, rather than qualification under the principle of distinction. However, the amount of civilian function that is to be assessed depends on the level at which the object is defined. Consider, for example, a particular dual-use system or network which includes a switch that contains altered code designed to copy and possibly amend data passing over the network for military purposes. If the military objective is defined at the system or network level, any civilian traffic or data that exists purely within the system or network becomes irrelevant to the calculation (as it forms part of the military objective and is therefore no longer civilian). If, however, the military objective is defined at the component (switch) or code (malware) level, the civilian traffic or data within the rest of the system or network remains outside the definition of the military objective and thus remains a civilian object which must be taken into account. Thus a question remains as to whether there is an obligation to define a military objective in its most minimal form? If so, in ‘defining down’, how far must one drill?

A traditional reading would suggest not. However, the requirements to take all feasible precautions in selecting both the means and method of attackFootnote ⁵¹ and also the choice of target where more than one is available for a similar military advantage will constrain states from launching attacks against targets that will cause excessive harm to civilians.Footnote ⁵² While these are features of the proportionality principle, in this case they appear to be inextricably linked to the definition of the military objective and the appropriate scope or specificity of the target selected. Where it is possible to identify the military objective as a distinct piece of code (for example, a virtual machine running inside a broader system), which will give a similar military advantage, Article 57(3) of Additional Protocol I requires the attacker to choose the objective that will result in the least danger to civilian lives and to civilian objects. Thus, in an age of dual-use infrastructure, the obligation on states to select targets that will cause the least harm to civilians will require states to reduce the harm to the civilian population through the operation of the obligation to take all feasible precautions in attack and select the target that will cause the least damage to civilians or civilian objects – that is, by defining the target at the minimum level possible: code, rather than network.

Is there thus a similar obligation when conducting reconnaissance on adversary computer systems to carve out and identify the particular aspects or sections of a system that will deliver the military advantage? There is a legitimate concern that the realities of military operations will not lend themselves to fine-tuning the military objective to such a specific level. However, the obligation arises only in the circumstances ‘when a choice is possible’,Footnote ⁵³ thus providing a measure of discretion to attacking forces based on the underlying system and the purpose of the operation. Further, any state that is conducting cyber attacks must be capable of conducting sufficient network reconnaissance to meet its other obligations under the laws of armed conflict; it should therefore have the means or capacity to determine the most efficient method of inflicting the necessary damage while minimising civilian harm. It is far better to send a piece of malware similar to the Wiper algorithm against a cyber weapon such as StuxnetFootnote ⁵⁴ or a listening post such as Duqu or Flame (or weapon, had either of their latent attack-code components been activated) than to cause physical damage to the hardware.Footnote ⁵⁵ This is particularly true where the targeted code is sitting on virtual infrastructure that can be migrated to an alternative in an instant or where the hardware or infrastructure that is affected is something that the state intends to utilise in the future.

Thus, in the same way that states with the ability to use smart munitions with a smaller payload have a corresponding obligation to select their military objectives with more specificity, and in such a way that ‘target area’ bombing is now almost entirely prohibited on the ground of being indiscriminate,Footnote ⁵⁶ so too will states that possess the ability to define military objectives at a more specific level be required to do so through the operation of the principle of proportionality and the requirement to take all feasible measures in precaution in order to avoid, and in any event to minimise, harm to civilians. Thus the definition of military objectives must be sufficiently broad to cover both. It should be remembered, however, that systems, nodes,Footnote ⁵⁷ components and code must still all qualify as military objectives (or not) on their own merits. It must also be recalled that the military advantage to be gained may also be part of a wider attack – for example, against a communication centre node which requires the neutralisation of multiple objectives to achieve the desired outcome.

Some guidance on the required specificity may also be found in Article 51(5)(a) of Additional Protocol I, which prohibits treating separate and distinct military objectives as a single objective as a form of indiscriminate attack – that is, the prohibition against target-area bombing.Footnote ⁵⁸ This rule is recognised as a norm of customary international law in both international and non-international armed conflicts,Footnote ⁵⁹ and also applies in the cyber context. The Tallinn Manual group was prepared to find that this rule would be breached when individual military (physical) components could have been attacked separately,Footnote ⁶⁰ a conclusion with which the present author agrees, albeit one that should be extended to code and virtual infrastructure as well. As noted in the previous section, the fact that the relevant separate and distinct portion of the system consists of code should not relieve the state of its obligations.

There will be instances where particular code, whether it consists of virtual infrastructure or a particular piece of software, forming part of the military matériel of the adversary is discovered as part of an otherwise civilian object. A subsequent cyber operation to destroy the code would also cause destruction of some functionality of the remaining civilian host system (and thus meet the requirements of an attack). Yet it seems disingenuous to suggest that the attack is directed against the host system (even though it would qualify as a military objective through its dual use), where it is, in fact, more properly viewed as collateral damage in the attack against the military object embedded within. The Tallinn Manual approach to such a problem merely moves the alleged object of the attack to the nearest physical component or the recipient of the physical effect.Footnote ⁶¹

Similarly there will be other instances where a physical component or the wider system is the appropriate minimum-level military objective; these will depend entirely on the system that is the target of the attack. For an attack like Stuxnet, specifying a particular component of the system to be attacked makes sense. In that case, the attack targeted switches that control the rotors which determine the spin rate of the uranium enrichment centrifuges in order to cause physical damage. However, once one starts attacking virtual infrastructure, it becomes more problematic: components may be a physical part of a device, or a small piece of code.Footnote ⁶² In other cases the wider system will be the appropriate targetFootnote ⁶³ – for example, the Blue Force tracking system or particular command and control systems.Footnote ⁶⁴

There is no doubt that in some cases an entire network will become a legitimate military objective: command and control networks of the armed forces, communication networks and defence department networks are all classic examples of networks that meet the definition and could all be attacked in their entirety. However, with the high percentage of military communications and traffic that also travel over civilian networks,Footnote ⁶⁵ there is a very real threat that those networks will also be targeted as (legitimate) military objectives based on their dual use. The large amount of redundancy built into network design, particularly those interconnected networks such as the internet, makes it impossible to know with any certainly which routes any military data packets will take. Similarly, from a practical perspective, it is nearly impossible to determine in real time which are military packets and which are civilian; thus the entire network may become a military objective. As the Tallinn Manual notes, an analogy may be drawn with a road network. It is suggested that while this analogy is apt (or, indeed, comparisons with rail networks), state practice in relation to Article 57(3) on the choice of targets has shown belligerents choosing to attack a smaller part of the network in order to achieve the same military advantage.Footnote ⁶⁶ For example, instead of neutralising the rail network by targeting railway stations, small but crucial switches away from civilian population centres were selected; a similar approach should be adopted with regard to communication or computer networks. Where the military use of the network can be isolated by attacking a particular internet switch, the military advantage will be achieved by considering the switch as the appropriate objective.