International Law: Cyber Warfare And Its Legal Complexities

The use of cyber operations as a means of warfare in armed conflicts poses a real risk of harm to civilians. As such, the international community has recognised that international humanitarian law (IHL) applies to cyber operations during wartime. IHL, also referred to as the laws of war or the law of armed conflict, governs the conduct of hostilities and aims to protect civilians. While the exact scope and manner in which IHL applies to cyber operations is still a subject of debate, it is clear that cyber operations are not occurring in a legal vacuum.

How does international humanitarian law protect civilians, civilian infrastructure, and civilian data from cyber harm?

The use of cyber operations as a means of warfare in armed conflicts poses a serious risk of harm to civilians, civilian infrastructure, and civilian data. International humanitarian law (IHL) is the principal body of law that governs the use of cyber and information operations in war. It is designed to apply to all forms of warfare and all kinds of weapons, including those that may be used in the future.

IHL protects civilians, civilian infrastructure, and civilian data from cyber harm through the following means:

• Basic Rules: IHL forbids the targeting of civilians and civilian objects. Indiscriminate weapons and attacks are prohibited, and medical services must be respected and protected.
• Principles: The principles of humanity, military necessity, distinction, proportionality, and precautions apply to all military operations, whether kinetic or cyber.
• Conduct of Hostilities: IHL includes rules on the conduct of hostilities, such as the prohibition on rendering useless objects indispensable to the survival of the population.
• Protection of Civilian Objects: Even if military networks rely on civilian cyber infrastructure, attacks on such infrastructure are prohibited.
• Prohibition on Indiscriminate Attacks: Cyber operations that cause widespread incidental civilian harm violate IHL.
• Protection of Medical Services: Medical services must be respected and protected from cyber attacks.
• Protection of Data: There is disagreement among states on whether civilian data enjoys the same protection as civilian objects.

While IHL provides a framework for protecting civilians, civilian infrastructure, and civilian data from cyber harm, there are still questions that require clarification. For example, it is unclear whether cyber operations that disrupt systems without causing physical damage amount to attacks as defined by humanitarian law.

What are the basic rules of international humanitarian law regarding cyber and information operations?

The basic rules of international humanitarian law (IHL) regarding cyber and information operations are clear: cyber operations during armed conflict are subject to the same restrictions as any other weapon or method of warfare. This means that the targeting of civilians and civilian objects is forbidden, the use of indiscriminate weapons and disproportionate attacks are prohibited, and medical services must be respected and protected.

These rules are essential, as cyber operations can cause significant harm to civilians and civilian infrastructure. For example, healthcare systems are increasingly digitalized and connected, making them vulnerable to cyber-attacks. The same is true for power and water infrastructure. A cyber-attack on these systems could have devastating consequences for civilians, especially in conflict zones where services are already limited.

The International Committee of the Red Cross (ICRC) has emphasized that IHL applies to cyber operations during armed conflict. This is not a new development; States have included rules in IHL treaties that anticipate the development of new means and methods of warfare. The ICRC has also stated that any new rules developed to regulate cyber operations during armed conflict must build upon and strengthen the existing legal framework of IHL.

While the basic rules are clear, there are still some questions that need to be clarified. For instance, there is disagreement among States about whether civilian data enjoys the same protection as civilian objects. Another question is whether cyber operations that disrupt systems without causing physical damage amount to attacks as defined under humanitarian law.

The ICRC has published several papers on the topic of IHL and cyber operations, with the aim of supporting discussions and advancing the conversation on this important and evolving topic.

What are the legal constraints on cyber operations during armed conflicts?

The principal body of law that governs the use of cyber and information operations in war is international humanitarian law (IHL). IHL applies to cyber operations during armed conflicts and only during armed conflicts.

The basic rules of IHL are as follows:

• Targeting civilians and civilian objects is forbidden
• Indiscriminate weapons must not be used
• Indiscriminate and disproportionate attacks are prohibited
• Medical services must be respected and protected

These rules also apply in cyberspace and must be respected. However, there are still some questions that require further clarification. For example, it is unclear whether civilian data enjoys the same protection as civilian objects, and whether cyber operations that disrupt systems without causing physical damage amount to attacks as defined under humanitarian law.

The use of cyber operations as a means or method of warfare in armed conflicts poses a real risk of harm to civilians. It is, therefore, essential to understand how IHL protects civilians, civilian infrastructure, and civilian data against cyber harm.

IHL imposes limits on cyber operations during armed conflicts just as it limits the use of any other weapon, means, and methods of warfare. It is important to note that affirming the applicability of IHL does not legitimize cyber warfare, just as it does not legitimize any other form of warfare.

The regulatory response at the international level has been cautious. Although multilateral discussions related to 'information security' started in 1998, it was not until 2013 that a UN Group of Governmental Experts (GGE) achieved a consensus on the baseline issue that international law is applicable in cyberspace. In 2015, a subsequent GGE noted the established international legal principles, including humanity, necessity, proportionality, and distinction, which apply to the use of information and communications technologies (ICTs) by states.

In conclusion, while IHL provides a framework for governing cyber operations during armed conflicts, there are still areas that require further clarification and consensus-building among states.

What are the legal consequences of a breach of territorial sovereignty?

The International Committee of the Red Cross (ICRC) maintains that international humanitarian law (IHL) governs and limits the use of cyber operations during armed conflicts. IHL applies to cyber operations conducted in the context of an armed conflict, aiming to protect civilians, civilian infrastructure, and data from cyber harm. While IHL does not apply to most daily cyber operations, it is clear that cyber operations during armed conflicts are subject to legal constraints.

The sovereignty of a state is a fundamental concept in international law, encompassing a bundle of rights, including territorial integrity, sovereign equality, and political independence within its territory. A breach of territorial sovereignty occurs when a state exercises its authority in another state's territory without consent, infringing on the exclusive right of the territorial state to exercise its state powers independently. Such violations can have legal consequences and give the affected state the right to take countermeasures.

The specific legal consequences of a breach of territorial sovereignty depend on the nature and impact of the violation. In general, a state that violates another state's territorial sovereignty may be held internationally responsible and liable for reparation. Reparation can take the form of restitution, compensation, or satisfaction (acknowledgment and apology).

In addition, the UN Charter states that all members shall refrain from threatening or using force against the territorial integrity or political independence of any state. This means that international law does not support the use of force by one state to annex the territory of another.

Furthermore, the concept of "sovereignty as a rule" suggests that cyber operations that violate another state's sovereignty may be unlawful, while the "non-intervention principle" considers such operations unfriendly but not necessarily a breach of international law. The application of these principles in the cyber context is subject to debate and interpretation by states.

The determination of whether a cyber operation violates territorial sovereignty can be complex due to the virtual and deterritorialized nature of cyberspace. However, it is generally agreed that a state has the right to exercise sovereign powers over cyber infrastructure within its territorial borders, and violations of this right can have legal consequences.

What are the legal limitations on countermeasures?

In the context of international cyber law, countermeasures refer to actions taken by a state in response to an internationally wrongful act committed by another state. These countermeasures are subject to certain legal limitations and conditions. Here are the key legal limitations on countermeasures:

• Prior Internationally Wrongful Act: An injured state may only take countermeasures if there has been a prior internationally wrongful act by the responsible state. This act must be attributable to the state and amount to a breach of its international obligations.
• Notification and Negotiation: Before taking countermeasures, the injured state must call upon the responsible state to fulfil its obligations arising from the wrongful act. The injured state must also notify the responsible state of its decision to take countermeasures and offer to negotiate, unless urgent countermeasures are necessary to preserve its rights.
• Proportionality: Countermeasures must be commensurate with the injury suffered and the gravity of the prior unlawful act. They should not go beyond what is necessary to induce the responsible state to comply with its international obligations.
• No Use of Force or Violation of Peremptory Norms: Countermeasures must not involve the threat or use of force and must respect peremptory norms of general international law, including obligations for the protection of fundamental human rights and humanitarian principles prohibiting reprisals.
• Temporary Nature: Countermeasures are temporary and must be suspended or terminated if the responsible state complies with its obligations or if the dispute is submitted to a court or tribunal for resolution.
• No Retaliation or Retribution: Countermeasures must be taken to induce compliance and restoration, not as a means of retaliation or retribution against the responsible state.
• Target Only the Responsible State: Countermeasures must be directed solely at the state responsible for the internationally wrongful act and not against third parties.
• No Affecting Diplomatic Relations: Countermeasures must not affect the obligation to refrain from threatening or using force against diplomatic or consular agents, premises, archives, and documents.
• Collective Countermeasures: There is an ongoing debate about whether states that have not been directly injured by an unlawful cyber operation may engage in collective countermeasures to support the injured state. Some states, like Estonia, support this idea, while others, like France, reject it.

These legal limitations aim to ensure that countermeasures are used proportionately and responsibly, balancing the need to enforce international obligations with the potential for escalation and unintended consequences.

Types of Countermeasures

Countermeasures can take various forms, including:

• Cyber Countermeasures: These are countermeasures specifically carried out in the cyber domain, such as cyber operations to disrupt an aggressor state's capabilities or networks.
• Non-Cyber Countermeasures: These are countermeasures that are not cyber-based, such as diplomatic responses, economic sanctions, or traditional military actions.
• Preventive Countermeasures: These are measures taken before the occurrence of a security incident to prevent or mitigate its impact.
• Detective Countermeasures: These are measures designed to detect and respond to security threats or incidents.
• Physical Countermeasures: These involve physical security measures such as locks, fencing, security personnel, and surveillance equipment to prevent unauthorized access to premises or infrastructure.
• Operational Security Countermeasures: These focus on processes and protocols to prevent or reduce the impact of security threats, including emergency response plans and backup systems.
• Financial Countermeasures: These involve monetary controls, audits, and fiscal tracking to protect against financial fraud or infractions.
• Legal Countermeasures: These involve laws and regulations imposing penalties or sanctions on individuals or organizations engaging in adverse cyber activities.

Frequently asked questions