Cyberwarfare's Legal Grey Zone: Breaking International Law?

Cyber warfare is a growing concern for governments and organisations, with the International Criminal Court (ICC) recently announcing that it will investigate and prosecute cybercrimes that violate existing international law. This raises the question of whether cyber warfare breaks international law, and if so, how it can be regulated and addressed. The answer is complex and multifaceted, involving the interpretation of international laws and conventions, the role of state and non-state actors, and the challenges of enforcing ethical conduct in the digital domain.

Is releasing a computer virus a use of force?

The question of whether releasing a computer virus constitutes a use of force is a complex one and depends on various factors.

Firstly, it's important to understand that a computer virus is a type of malware that replicates itself by modifying and infecting other computer programs. It can cause significant economic damage, disrupt critical infrastructure, and compromise sensitive information.

When considering the use of force, international humanitarian law (IHL) comes into play. IHL applies to cyber operations conducted during armed conflicts and aims to protect civilians and civilian objects from harm. The International Court of Justice has affirmed that IHL limits cyber operations during armed conflicts, just as it does for any other weapon or means of warfare.

In the context of an armed conflict, a cyber operation by a state may constitute a use of force if it rises to the level of an "attack" under IHL. This determination considers the effects of the operation, its nature and scope, and its connection to the conflict. Additionally, the principle of sovereignty plays a crucial role, and states have asserted that cyber operations generating physical effects in another state's territory violate sovereignty.

The Tallinn Manual 2.0, a comprehensive study on the international law applicable to cyber operations, provides further insights. It expands the analysis to include peacetime state activities in cyberspace and addresses intersecting legal regimes. While the manual reflects the views of individuals rather than states, it serves as a valuable resource for understanding the complexities of this issue.

In conclusion, determining whether releasing a computer virus constitutes a use of force depends on the specific context, the effects of the virus, and the applicable international laws and principles, such as IHL and sovereignty. Further developments in state practice and opinio juris will also shape our understanding of this evolving topic.

Does IHL apply to cyber operations during armed conflict?

The use of cyber operations during armed conflict is governed by international humanitarian law (IHL). IHL, also referred to as the laws of war or the law of armed conflict, applies to cyber operations that are conducted in the context of an armed conflict. This means that IHL limits cyber operations during armed conflicts in the same way it limits the use of any other weapon, means, or methods of warfare.

The International Court of Justice shares this view, and it has been acknowledged by the United Nations' Group of Governmental Experts (GGE) in 2015. The GGE affirmed that the established legal principles governing armed conflict, including humanity, necessity, proportionality, and distinction, apply to state actions in cyberspace.

However, it is important to note that IHL only applies in situations of armed conflict. Determining when IHL applies is legally distinct from the question of which conduct amounts to a prohibited 'threat or use of force' or an 'armed attack' under the UN Charter. Situations in which IHL applies are either armed conflicts between states or armed conflicts between states and non-state armed groups, or between such groups.

While IHL applies to cyber operations during armed conflicts, there are still questions and ambiguities surrounding its application in the cyber domain. For example, it is unclear whether a cyber operation can trigger the application of IHL. There is also disagreement among states and experts on whether civilian data enjoys the same protection as civilian objects under IHL.

Despite these ongoing debates, the consensus is that cyber operations during armed conflicts do not occur in a legal vacuum. IHL imposes limits on cyber operations, and states must comply with its rules and principles, including humanity, military necessity, distinction, proportionality, and precautions.

Is civilian data protected under international law?

The protection of civilian data under international law is a complex issue that has been the subject of much debate and discussion in recent years. While the concept of "civilian objects" is well-established in international humanitarian law (IHL), it is unclear whether civilian data, which is unique to cyberspace, enjoys the same level of protection. Some scholars argue that data should be considered an "object" under IHL, while others disagree. This ambiguity has significant implications for the legality of offensive operations in the cyber domain.

IHL, also known as the laws of war or the law of armed conflict, applies to military cyber operations during armed conflicts. It provides protections for civilians and civilian objects, prohibiting attacks on non-military targets and imposing rules such as proportionality and distinction. The applicability of IHL to cyber operations is generally accepted, but the specific question of whether civilian data is protected as a civilian object remains unresolved.

The interpretation of the term "object" under IHL is crucial to determining the legal status of civilian data. Some scholars argue that data should be considered an object because it is a crucial element in the use and functioning of cyber technologies. However, others contend that data does not meet the definition of an object, which is typically understood to refer to material or tangible things. The ordinary meaning of the term "object" in its context in IHL connotes something that is visible and tangible, excluding computer data.

The debate over the legal status of civilian data has practical implications for warfare, both cyber and kinetic. If data is considered an object, it would be protected from direct attack under IHL. It would also need to be considered in proportionality analyses and could trigger obligations regarding precautions in an attack. On the other hand, if data is not considered an object, it may not be afforded the same level of protection as civilian objects under IHL.

The lack of consensus among states on the legal status of civilian data complicates the issue. Very few states have publicly provided their position on whether data constitutes an "object," and there is no apparent trend in their responses. Some states, such as Norway, France, and Germany, consider data to be objects, while others, like Denmark and Chile, do not. The paucity of official statements and the absence of a clear trend make it challenging to determine the customary international law on this matter.

In conclusion, the protection of civilian data under international law remains uncertain. While IHL applies to cyber operations during armed conflicts, the specific question of whether civilian data is protected as a civilian object is still under discussion. The interpretation of the term "object" and the lack of consensus among states contribute to the ambiguity surrounding the legal status of civilian data. Further developments in international law and state practice may provide clarity in the future.

What constitutes a prohibited intervention?

The obligation of non-intervention, a norm of customary international law, prohibits States from intervening coercively in the internal or external affairs of other States. Prohibited intervention was authoritatively defined by the International Court of Justice in the judgment on the merits in the 1986 Nicaragua v United States case.

A prohibited intervention must bear on matters in which each State is permitted, by the principle of State sovereignty, to decide freely. This includes both internal affairs (such as the choice of a political, economic, social, and cultural system or the conduct of national elections) and external affairs (such as the formulation of foreign policy or recognition of states and membership of international organisations).

The act must be coercive in nature. There is no generally accepted definition of "coercion" in international law. Under the first approach, an act is coercive if it is specifically designed to compel the victim State to change its behaviour with respect to a matter within its domaine reservé. Under the second approach, it is sufficient for an act to effectively deprive the target State of its ability to control or govern matters within its domaine reservé.

The element of coercion also entails the requirement of intent. While coercion is evident in the case of an intervention involving the use of force, it is less clear with respect to non-forcible forms of interference. Some States support the approach that intervention may take various forms, such as economic and political coercion.

Finally, there has to be a causal nexus between the coercive act and the effect on the internal or external affairs of the target State. The prohibition of intervention applies between States, and thus it is not applicable to the activities of non-State groups, unless their conduct can be attributed to a State under the rules on attribution under international law.

Can cyberwarfare amount to a war crime?

The International Criminal Court (ICC) describes cyberwarfare as "the conduct of a cyber operation by military means to achieve military objectives". Cyber-attacks, like conventional military attacks, cause damage indirectly through the "alteration or destruction of data". The far-reaching effects of cyber-attacks may be equivalent, if not greater, than some conventional "kinetic" military operations.

The ICC has jurisdiction over four main international crimes: genocide, war crimes, crimes against humanity, and crimes of aggression. Cyber activities are not currently recognized as international crimes, but those that occur within armed conflict as a form of warfare may be prosecuted by the ICC.

The Rome Statute (RS) that established the ICC was written broadly, without reference to the means used to accomplish the goal of the rule. For example, international humanitarian law (IHL) criminalizes "direct attacks against civilian objects", but does not specify what method must be used to accomplish this. Therefore, the statute provides room for multiple means beyond conventional kinetic warfare, such as "cyber weapons and their associated systems".

The question of whether cyberwarfare can amount to a war crime is up for debate. Those in favour of establishing cyberwarfare as a crime argue that the effects of cyber attacks used in armed conflict situations, combined with traditional means of conflict, can reach the gravity requirement set forth by RS Article 17. They further argue that cyber threats require a "whole-of-society" response and that prosecuting cyberwarfare through the ICC may be able to "deter offenders", mitigate ambiguity by enforcing relevant law, and set an example for states to prosecute cyberwarfare under their own laws.

On the other hand, those opposed to establishing cyber as an international crime argue that many cyber threats have historically not met the gravity threshold that RS Article 17 requires. They argue that "kinetic warfare (such as bombs and missiles) is incomparably greater than what cyber capabilities may have caused thus far".

While there is no clear consensus on whether cyberwarfare can amount to a war crime, the current atmosphere of today's military operations makes it clear that international law and the bodies that administer it, like the ICC, need to start shifting their focus to the virtual world of human rights violations, including cyberwarfare.

Frequently asked questions