ICRC calls on States to interpret rules to ensure adequate protection for civilians and civilian infrastructure, ICT systems and data

Mr. Chair, Excellencies, Distinguished Delegates,

The International Committee of the Red Cross (ICRC) is grateful for the opportunity to participate in the new Open-Ended Working Group on security of and in the use of information and communications technologies. We hope that this working group will build on the landmark reports adopted by the OEWG and the GGE earlier this year.

As this is the first formal meeting of the OEWG, we would like to make two points to frame the discussion, and then respond to some of the questions that you, Mr Chair, posed to delegations.

Our first point is that discussions on international law in this OEWG should be grounded in, and aim to address, today's reality. Part of this reality is that as societies are digitalizing, so are armed conflicts. Earlier this year, the OEWG and the GGE recognized that "a number of States are developing ICT capabilities for military purposes and that "the use of ICTs in future conflicts between States is becoming more likely".

This development in military capabilities poses new and additional threats to the civilian population. It is today well-known that cyber operations against critical civilian infrastructure have caused significant economic harm, disruption in societies, and tension among States. The final report of the OEWG further recognized that cyber operations against critical infrastructure risk having "potentially devastating humanitarian consequences".

In light of these evolving military capabilities, and the real risk of harm to the civilian population, the OEWG should work towards common understandings of how international law protects humans and societies against harm caused by the use of ICTs during armed conflict.

In this respect, our second point is that this new OEWG should be guided by the important progress achieved in the UN context over the past years.

The ICRC would like to particularly highlight the reference to international humanitarian law in the report of the Group of Governmental Experts, which noted that "international humanitarian law applies only in situations of armed conflict" and recalled "the established international legal principles including, where applicable, the principles of humanity, necessity, proportionality and distinction". Importantly, the group underscored that "recalling these principles by no means legitimizes or encourages conflict".

This development in military capabilities poses new and additional threats to the civilian population. It is today well-known that cyber operations against critical civilian infrastructure have caused significant economic harm, disruption in societies, and tension among States. The final report of the OEWG further recognized that cyber operations against critical infrastructure risk having "potentially devastating humanitarian consequences".

In light of these evolving military capabilities, and the real risk of harm to the civilian population, the OEWG should work towards common understandings of how international law protects humans and societies against harm caused by the use of ICTs during armed conflict.

In this respect, our second point is that this new OEWG should be guided by the important progress achieved in the UN context over the past years. The ICRC would like to particularly highlight the reference to international humanitarian law in the report of the Group of Governmental Experts, which noted that "international humanitarian law applies only in situations of armed conflict" and recalled "the established international legal principles including, where applicable, the principles of humanity, necessity, proportionality and distinction". Importantly, the group underscored that "recalling these principles by no means legitimizes or encourages conflict".

Mr. Chair, you have further asked which specific rules and principles of international law applicable to State use of ICTs merit further study. As emphasized in Ambassador Lauber's summary of the OEWG discussions and in the GGE report, there is a need for further study on "how and when" the principles of international humanitarian law apply to the use of ICTs by States. 

The ICRC fully agrees with this conclusion. In our view, developing common understandings of how and when international humanitarian law applies to cyber operations during armed conflicts, and exchanging practice of how to operationalize these legal limits, is essential to protect the civilian population.

Moreover, understanding the limits that other States respect in their cyber operations can be an important confidence-building measure. In this respect, fundamental IHL rules provide a number of clear red lines. For example,

• Direct attacks against civilian objects are prohibited, including when using cyber means or methods of warfare;
• Indiscriminate attacks are prohibited, including, for example, the employment of cyber tools that spread and cause damage indiscriminately;
• Medical services must be protected and respected, including when carrying out cyber operations.

At the same time, the ICRC recognizes that there are other issues that need further study. While existing rules of IHL are the cornerstone of the protection of civilians, infrastructure, and societies against digital risks, clarification is needed, for instance, on how the notion of civilian objects is to be understood in a digitalized world.

In the study of how and when IHL applies during armed conflicts, the ICRC calls on States to interpret – and apply – existing rules in a manner that ensures adequate and sufficient protection for civilians and civilian infrastructure, ICT systems and data in our ever-increasingly digitalized societies.

Finally, Mr. Chair, you inquired about capacity building needs in the area of international law. The ICT environment is changing at high speed, which makes it challenging for all of us to keep track of technological, legal, policy and military developments.

The ICRC is aiming to contribute to this OEWG with both technical and legal expertise on questions relating to the use of cyber operations during armed conflict, and we are also available to discuss bilaterally with interested delegations or regional groups.

Thank you.