Cyberspace is not a legal vacuum, including during armed conflict

Ambassador Gafoor, excellencies, dear colleagues,

The International Committee of the Red Cross (ICRC) is grateful for the opportunity to participate in this informal inter-sessional meeting of the Open-Ended Working Group.

In this brief statement, we will provide some reflections on the three guiding questions proposed by the Chair.

As acknowledged in the annual progress report of this working group, States continue developing ICT capabilities for military purposes, and the use of ICTs in future conflicts is becoming more likely.^[1]

We share this concern, and we would underscore that the use of ICTs in armed conflicts has – in fact – been a reality for several years, posing a real risk of harm to civilians, civilian infrastructure, and societies.

In several recent armed conflicts, cyber operations have been conducted alongside traditional, physical means of warfare. There can be no doubt that these operations are subject to the long-standing rules and principles of international humanitarian law (IHL).

Cyberspace is not a legal vacuum, including during armed conflict.

Nevertheless, States have rightly emphasized the need for further study on how and when IHL applies to the use of ICTs during armed conflicts. In our view, discussion among States is needed to provide further clarity on whether common understandings of IHL provide sufficient protection for humans and societies against cyber operations.

To answer your first question, Mr. Chair, we therefore consider it essential for IHL to be included in the future work of this group, on the basis of focused, non-politicized, and inclusive exchanges.

This brings us to how this area of international law could be examined to move towards greater convergence.

In our view, a workable starting point would be to focus on the established international legal principles of distinction, proportionality, necessity and humanity.

In order to foster such discussions and to support the work of States in this group, the ICRC intends to publish short notes on how and when these principles apply in the cyber context. These notes will build on the position paper that we submitted to the OEWG and the GGE in 2019. ^[2]

At the same time, the four principles reflect only a small part of international humanitarian law. IHL contains, among others, important rules on precautionary measures to protect the civilian population,^[3] on the imperative to protect medical facilities and on safeguarding humanitarian relief operations. Medical and humanitarian actors must be respected and protected, offline and online.

Relatedly, the growing involvement of civilians, civilian companies, and civilian infrastructure in cyber operations and other digital activities during armed conflict exposes them to harm, and risks undermining the principle of distinction. To address these concerns, due consideration should be given to how IHL, and international law more generally, limits the engagement of civilians in such activities.

Common understandings on these points are within reach of this group, and – to answer your second question, Mr. Chair – would in our view go a long way towards clarifying the regulation of States' conduct in cyberspace. In addition, such deliberations will help determine whether IHL affords sufficient protection against the risks raised by cyber operations during armed conflicts or whether it needs further strengthening.

Finally, a few words on increasing States' capacity on international law and the use of ICTs – the third question for this session.

At the ICRC, we engage in a number of legal capacity-building projects. Let us highlight two that may be of particular relevance in this context.

The first one is a series of regional consultations that we organize in partnership with States to enable dedicated exchanges among government experts on a regional basis concerning the limits that IHL imposes on cyber operations during armed conflict.

We are especially grateful to Estonia, Indonesia, and Mexico, for having partnered with us in this work thus far in – respectively – the regions of Central and Eastern Europe, Asia and Pacific, and Latin America.^[4] The ICRC stands ready to partner with additional States to organize such consultations.

The second project we offer is the Cyber Law Toolkit, which the ICRC has developed in partnership with private and public institutions from around the world.^[5]

Among many other features, the Toolkit offers a systematic collection of over 30 States' national positions on how international law applies to cyber operations and provides a function through which all views on a particular subject can be seen together.

These national views – and particularly the convergences among them – can and should inform discussions in this group on how and when international law, including IHL, applies in the use of ICTs.

Thank you.

^[1] OEWG, Annual Progress Report, 2022, para. 9.

^[2] ICRC, International Humanitarian Law and Cyber Operations during Armed Conflicts, November 2019.

^[3] See also ICRC, Avoiding Civilian Harm from Military Cyber Operations during Armed Conflicts, June 2021.

^[4] For reports of these consultations, see ICRC, Regional state consultations on international humanitarian law and cyber operations during armed conflicts.

^[5] See Cyber Law Toolkit.