Principles of IHL (distinction, proportionality) have direct bearing on cyber operations

Distinguished chair, excellencies, ladies and gentlemen,

The International Committee of the Red Cross (ICRC) is grateful for the opportunity to address the Open-Ended Working Group a second time during this session.

In the first substantive session of this working group, many delegations reaffirmed the precious consensus on international law reached by the group or governmental experts in 2013 and 2015. In the ICRC’s view, the shared view among States that international law applies in the field of information and telecommunications provides a baseline on which this working group should build. 

We would like to stress two points on the subject of international law.

First, in the ICRC’s view, the affirmation that international law applies in cyberspace should be understood as including international humanitarian law, which is part of international law.

From a legal point of view, there should be no concern that restricting cyber operations during armed conflict legitimizes the use of hostile cyber operations or necessarily renders their use lawful. The Charter of the United Nations prohibits the use of force other than in self-defence or when authorized by the Security Council. It requires that international disputes be settled by peaceful means.

The applicability of IHL does not replace or set aside the Charter of the United Nations. Cyber operations that may not be prohibited under IHL may nonetheless violate the prohibition against the use of force and therefore be unlawful under public international law.

This interplay between the Charter and IHL is neither new nor particular to cyberspace. Just as the applicability of IHL does not legitimize the use of force between States through kinetic means, it should not be misunderstood as doing so in cyberspace.

Second, delegations have raised important questions on how IHL applies to cyber operations during armed conflict. As emphasized in the position paper we submitted in November 2019, the ICRC shares the view that further discussions are needed to find a common understanding on how existing IHL rules apply in cyberspace and whether the existing law is adequate and sufficient.[1]

Important steps towards such a common understanding have been taken. In 2015, the Group of Governmental Experts noted the established principles of humanity, necessity, proportionality and distinction, which are fundamental IHL principles.

The primary aim of IHL is indeed to protect the victims of armed conflict and to regulate the conduct of hostilities based on a balance between military necessity and humanity.

The principles of distinction and proportionality have clear and direct bearing on cyber operations during armed conflicts. They protect civilians against the effects of cyber operations.

The principle of distinction requires parties to armed conflicts to distinguish at all times between military objectives and civilian objects.[2] In cyberspace, this means that during armed conflicts, the employment of cyber tools that spread and cause damage indiscriminately is prohibited.

Moreover, the principle of proportionality prohibits attacks which may be expected to cause incidental civilian harm that would be excessive to the anticipated military advantage.[3] A particular risk in cyberspace is that malware, even if used against a military objective, may nevertheless spread and cause large-scale incidental civilian damage. The principle of proportionality obliges parties to an armed conflict to ensure that such incidental damage is not excessive.

Excellencies,

In the coming months, you, States, will work on a joint report. The ICRC calls on you to reaffirm the applicability of international law in the field of information and telecommunications and clarify that this includes IHL – on the understanding that such affirmation neither encourages the militarization of cyberspace nor legitimizes cyber warfare. Moreover, we encourage you to commit to further work to develop a common understanding of how IHL applies to cyber operations during armed conflict.

Thank you.