Russian Federation: Conference on information security, cyber-warfare and international law

An international conference on cyber security, the humanitarian consequences of cyber wars and the application of international humanitarian law took place in Moscow recently. The event was organized by the ICRC's Moscow delegation and the Information Security Institute of M.V. Lomonosov Moscow State University.

The rapid development of information technology and the introduction of computer systems into virtually all areas of our lives have broadened the notion of a combat zone and have given rise to new means and methods of warfare. Pascal Cuttat, heads the ICRC's regional delegation in Moscow. Opening the conference, he warned that "Technologies that were science fiction yesterday may tomorrow cause unprecedented disasters, paralyse the health system of a country or disable its infrastruture, by destroying computer networks in the course of a cyber war." The ICRC is concerned about the very grave consequences such scenarios would have for civilians. In response, the organization regularly brings together international legal experts to discuss the application of IHL to cyberspace, plus restrictions on the means and methods of cyber-warfare.

ICRC legal adviser Laurent Gisel reiterated the ICRC's message that "during an armed conflict, parties must refrain from harming civilians and civilian objects, regardless of whether they're using kinetic weapons or cyber operations."

Such terms as "cyber attack," "cyber operation" or "computer network attack" have no agreed international definitions. Many of today's "cyber attacks" consist of illicit data gathering or crimes related to computer technologies, and are not regulated by international humanitarian law. Using computers to harm or kill the enemy in the course of armed conflict may be classified as cyber-warfare, according to Gisel. The existing rules of IHL cover any new weapons, means or methods of warfare, including cyber capabilities.

Mr Gisel noted that there are difficulties in applying IHL to this new type of hostilities. Cyber attacks can be anonymous, making it impossible to identify the attacker. In addition, the armed forces and civilians share data communication networks and facilities, making it extremely difficult to target military objectives without affecting civilian systems.

Discussion participants raised such questions as what would constitute proof of a cyber attack, how one could establish a link between a cyber attack and the damage caused, and whether espionage in cyberspace amounted to the use of force.

Presentations by international experts including Georgetown University's Catherine Lotrionte, representatives of the Russian ministries of foreign affairs and defence, plus many others, provided an opportunity for participants to discuss approaches to ensuring international information security and the terminology used. Proceedings also included a detailed presentation of the Tallinn manual on the international law applicable to cyber-warfare.

Despite differences of opinion, many participants noted the need for such events as this conference, in neutral settings, in order to achieve convergence of positions and develop common approaches to the application of international law to cyberspace.