Cyber and information operations and international humanitarian law
Today, the use of cyber operations during wartime is a reality. While only a few states have publicly acknowledged using such operations, an increasing number of states are developing military cyber capabilities. Cyber operations are likely to increase in future.
The international community recognizes that, just as any other means or method of warfare, cyber operations may seriously affect civilian infrastructure and have devastating humanitarian consequences.
There is a real risk that cyber tools – either deliberately or by mistake – will have significant, broad effects on critical civilian infrastructure, such as essential industries, telecommunications and transport, governmental, and financial systems.
Cyber operations carried out over recent years – primarily outside armed conflicts – have shown that malware can spread instantly around the globe and affect civilian infrastructure and essential services.
The increasing use of military cyber capabilities and the related humanitarian concerns underscore how important it is to reach a shared understanding of the legal constraints that apply to cyber operations during armed conflicts.
The principal body of law that governs the use of cyber operations in war is international humanitarian law (IHL). States have codified its rules in such ways that they apply – in the words of the International Court of Justice – to all forms of warfare and to all kinds of weapons, including those of the future.
The basic rules are straightforward: targeting civilians and civilian objects is forbidden; indiscriminate weapons must not be used; indiscriminate and disproportionate attacks are prohibited; medical services must be respected and protected. These and many other rules also apply in cyberspace.
Other questions still need of further clarification. These include, for instance, whether civilian data enjoy the same protection as civilian objects, and whether cyber operations that disrupt systems without causing physical damage amount to attacks as defined under humanitarian law.
We welcome the increasing international attention to cyber operations’ potential human cost and applicable international law. Societies are rapidly digitizing. It is critical that humanitarian law be interpreted and applied in a way that protects not just physical objects but the digital infrastructure that people rely on in every aspect of their lives.