Cyber warfare: IHL provides an additional layer of protection

Statement delivered by Véronique Christory, senior arms control adviser for the International Committee of the Red Cross to the "Open-ended working group on developments in the field of information and telecommunications in the context of international security" - New York, 10 September 2019

 The International Committee of the Red Cross (ICRC) is grateful for the opportunity to address the first substantive session of the "Open-ended working group on developments in the field of information and telecommunications in the context of international security".

As we all know, technological developments offer tremendous opportunities for humanity. But they also entail risks.

In today's armed conflicts, cyber operations are being used as a means or method of warfare. A few States have publicly acknowledged their use, and an increasing number of States are developing military cyber capabilities, whether for offensive or defensive purposes.

The ICRC monitors technological developments that could be used as means and methods of warfare and assesses the risks and challenges they generate from technical, humanitarian, military and legal perspectives. Last year, the ICRC invited experts from around the world to meet to develop a realistic assessment of the potential human cost of cyber operations. The report of this expert meeting is available online.

The cyber attacks we are seeing today generate significant economic costs, but most are not part of an armed conflict and have fortunately not caused major harm to people. However, sophisticated attacks have succeeded in disrupting the provision of essential services to the civilian population. The health-care sector appears to be particularly vulnerable to cyber attacks. Other critical civilian infrastructure, including electricity, water and sanitation systems, have also been affected. These attacks are reportedly becoming more frequent, and their severity is increasing more rapidly than anticipated.

In the ICRC's view, there is no question that cyber operations during armed conflicts are regulated by international humanitarian law – IHL – just like any other weapon or means or methods of warfare used by a belligerent in a conflict, whether new or old.

By asserting that IHL applies, we are not encouraging the militarization of cyberspace and not legitimizing cyber warfare. Any use of force by States – cyber or kinetic – remains governed by the UN Charter, in particular the prohibition against the use of force. International disputes must be settled by peaceful means, in cyber space as in all other domains.

What IHL provides is an additional layer of protection against the effects of hostilities. For example, under IHL belligerents must respect and protect medical facilities and personnel at all times. Accordingly, cyber attacks against the health-care sector during armed conflict would in most cases violate IHL. Likewise, civilians and civilian objects, and objects indispensable to the survival of the civilian population enjoy specific protection under the IHL principles of distinction, proportionality and precaution. Critical civilian infrastructure is therefore afforded strong protection against the effects of cyber attacks during armed conflicts.

However, cyber operations raise a number of issues regarding the interpretation of IHL. For example, only cyber operations that amount to attacks as defined in IHL are subject to the prohibition against direct attacks at civilian objects and indiscriminate and disproportionate attacks. However, the notion of cyber attack has not been fully settled under IHL. In our view, the full scope of legal protection will be afforded under key IHL rules only if States recognize that cyber operations that impair the functionality of objects are subject to the rules governing attacks under IHL.

The unique characteristics of cyberspace raise questions about the interpretation of IHL rules that States must urgently address. Affirming that IHL applies in cyber space and discussing its interpretation does not imply that new rules might not be useful or even needed. But if new rules are developed, they should build upon and strengthen existing law.

The ICRC therefore welcomes the renewed efforts of the international community, including through this open-ended working group, to study how international law applies to the use of information and communications technologies by States with a view to promoting common understandings. The ICRC stands ready to lend its expertise to such discussions.