Editing National position of France (2019)

Jump to navigation Jump to search

Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 2: Line 2:
 
This is the position of France on international law applicable to cyber operations. The position,<ref>[https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf Ministry of Defense of France, International Law Applied to Operations in Cyberspace, 9 September 2019]</ref> which has been prepared by the French Ministry of Defense, has been published on 9 September 2019.
 
This is the position of France on international law applicable to cyber operations. The position,<ref>[https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf Ministry of Defense of France, International Law Applied to Operations in Cyberspace, 9 September 2019]</ref> which has been prepared by the French Ministry of Defense, has been published on 9 September 2019.
   
==[[Applicability of international law]]==
+
==Applicability of international law==
<section begin=FR_2019 applicability />
 
 
"For France, compliance with international law is a precondition for the emergence of an appropriate regulation of cyberspace. Faced with an increasingly prevalent and abiding cyber threat, and systems made increasingly vulnerable by digitisation and interconnectivity, the regulation of cyberspace between States and private- and public-sector actors must become a priority in order to re-establish a collective and multilateral order capable of preserving international peace and security".<ref>[https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf Ministry of Defense of France, International Law Applied to Operations in Cyberspace, 9 September 2019], 4. </ref>
 
"For France, compliance with international law is a precondition for the emergence of an appropriate regulation of cyberspace. Faced with an increasingly prevalent and abiding cyber threat, and systems made increasingly vulnerable by digitisation and interconnectivity, the regulation of cyberspace between States and private- and public-sector actors must become a priority in order to re-establish a collective and multilateral order capable of preserving international peace and security".<ref>[https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf Ministry of Defense of France, International Law Applied to Operations in Cyberspace, 9 September 2019], 4. </ref>
   
"France reaffirms the obligation for States to respect international law in cyberspace, including the United Nations Charter, and in particular the principles of the sovereign equality of States, the settlement of international disputes by peaceful means and the requirement for States to refrain in their international relations from the threat or use of force against the integrity or political independence of another State or in any other manner inconsistent with the purposes of the United Nations."<ref>[https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf Ministry of Defense of France, International Law Applied to Operations in Cyberspace, 9 September 2019], 6. </ref> <section end=FR_2019 applicability />
+
"France reaffirms the obligation for States to respect international law in cyberspace, including the United Nations Charter, and in particular the principles of the sovereign equality of States, the settlement of international disputes by peaceful means and the requirement for States to refrain in their international relations from the threat or use of force against the integrity or political independence of another State or in any other manner inconsistent with the purposes of the United Nations."<ref>[https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf Ministry of Defense of France, International Law Applied to Operations in Cyberspace, 9 September 2019], 6. </ref>
   
==[[Sovereignty]]==
+
==Sovereignty==
 
<section begin=FR_2019 sovereignty />
 
<section begin=FR_2019 sovereignty />
 
"<b>Cyberattacks may constitute a violation of sovereignty.</b> The international norms and principles that flow from State sovereignty apply to the use of ICT by States and to their territorial jurisdiction over ICT infrastructure. France exercises its sovereignty over the information systems located on its territory".<ref>[https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf Ministry of Defense of France, International Law Applied to Operations in Cyberspace, 9 September 2019], 6. </ref>
 
"<b>Cyberattacks may constitute a violation of sovereignty.</b> The international norms and principles that flow from State sovereignty apply to the use of ICT by States and to their territorial jurisdiction over ICT infrastructure. France exercises its sovereignty over the information systems located on its territory".<ref>[https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf Ministry of Defense of France, International Law Applied to Operations in Cyberspace, 9 September 2019], 6. </ref>
Line 16: Line 15:
 
"The principle of sovereignty applies to cyberspace. France exercises its sovereignty over the information systems located on its territory. The gravity of a breach of sovereignty will be assessed on a case-by-case basis in accordance with French cyberdefence governance arrangements in order to determine possible responses in compliance with international law".<ref>[https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf Ministry of Defense of France, International Law Applied to Operations in Cyberspace, 9 September 2019], 7. </ref><section end=FR_2019 sovereignty />
 
"The principle of sovereignty applies to cyberspace. France exercises its sovereignty over the information systems located on its territory. The gravity of a breach of sovereignty will be assessed on a case-by-case basis in accordance with French cyberdefence governance arrangements in order to determine possible responses in compliance with international law".<ref>[https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf Ministry of Defense of France, International Law Applied to Operations in Cyberspace, 9 September 2019], 7. </ref><section end=FR_2019 sovereignty />
   
==[[State responsibility]]==
+
==State responsibility==
 
<section begin=FR_2019 state responsibility />
 
<section begin=FR_2019 state responsibility />
 
"A cyberattack is deemed to have been instigated by a State if it has been perpetrated by a State organ, a person or entity exercising elements of governmental authority, or a person or group of persons acting on the instructions of, or under the direction or control of that State."<ref>[https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf Ministry of Defense of France, International Law Applied to Operations in Cyberspace, 9 September 2019], 10. </ref><section end=FR_2019 state responsibility />
 
"A cyberattack is deemed to have been instigated by a State if it has been perpetrated by a State organ, a person or entity exercising elements of governmental authority, or a person or group of persons acting on the instructions of, or under the direction or control of that State."<ref>[https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf Ministry of Defense of France, International Law Applied to Operations in Cyberspace, 9 September 2019], 10. </ref><section end=FR_2019 state responsibility />
   
==[[Attribution]]==
+
==Attribution==
 
<section begin=FR_2019 attribution />
 
<section begin=FR_2019 attribution />
 
<b>"The attribution of a cyberattack having its origin in another State is a national political decision.</b>
 
<b>"The attribution of a cyberattack having its origin in another State is a national political decision.</b>
Line 33: Line 32:
 
The capabilities of the Armed Forces Ministry contribute to the process of characterising cyber-attacks against the French State. The public attribution of a cyberattack against France is a national political decision. Although this power may be exercised in coordination with other States or international organisations, it is prima facie a sovereign prerogative."<ref>[https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf Ministry of Defense of France, International Law Applied to Operations in Cyberspace, 9 September 2019], 10-11. </ref><section end=FR_2019 attribution />
 
The capabilities of the Armed Forces Ministry contribute to the process of characterising cyber-attacks against the French State. The public attribution of a cyberattack against France is a national political decision. Although this power may be exercised in coordination with other States or international organisations, it is prima facie a sovereign prerogative."<ref>[https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf Ministry of Defense of France, International Law Applied to Operations in Cyberspace, 9 September 2019], 10-11. </ref><section end=FR_2019 attribution />
   
==[[Countermeasures]]==
+
==Countermeasures==
 
<section begin=FR_2019 countermeasures />
 
<section begin=FR_2019 countermeasures />
 
"In general, France can respond to cyberattacks by taking counter-measures. In response to a cyberattack that infringes international law (including use of force), France may take counter-measures designed to (i) protect its interests and ensure they are respected and (ii) induce the State responsible to comply with its obligations.
 
"In general, France can respond to cyberattacks by taking counter-measures. In response to a cyberattack that infringes international law (including use of force), France may take counter-measures designed to (i) protect its interests and ensure they are respected and (ii) induce the State responsible to comply with its obligations.
Line 43: Line 42:
 
Lastly, the use of counter-measures requires the State responsible for the cyberattack to comply with its obligations.The victim State may, in certain circumstances, derogate from the obligation to inform the State responsible for the cyberoperation beforehand, where there is a need to protect its rights. The possibility of taking urgent counter-measures is particularly relevant in cyberspace, given the widespread use of concealment procedures and the difficulties of traceability."<ref>[https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf Ministry of Defense of France, International Law Applied to Operations in Cyberspace, 9 September 2019], 7-8. </ref><section end=FR_2019 countermeasures />
 
Lastly, the use of counter-measures requires the State responsible for the cyberattack to comply with its obligations.The victim State may, in certain circumstances, derogate from the obligation to inform the State responsible for the cyberoperation beforehand, where there is a need to protect its rights. The possibility of taking urgent counter-measures is particularly relevant in cyberspace, given the widespread use of concealment procedures and the difficulties of traceability."<ref>[https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf Ministry of Defense of France, International Law Applied to Operations in Cyberspace, 9 September 2019], 7-8. </ref><section end=FR_2019 countermeasures />
   
==[[Prohibition of intervention]]==
+
==Prohibition of intervention==
 
<section begin=FR_2019 prohibition of intervention />
 
<section begin=FR_2019 prohibition of intervention />
 
"Many States are acquiring the capacity to prepare and conduct operations in cyberspace. When carried out to the detriment of the rights of other States, such operations may breach international law. Depending on the extent of their intrusion or their effects, they may violate the principles of sovereignty, non-intervention or even the prohibition of the threat or use of force. States targeted by such cyberattacks are entitled to respond to them within the framework of the options offered by international law. In response to a cyberattack, France may consider diplomatic responses to certain incidents, counter-measures, or even coercive action by the armed forces if an attack constitutes armed aggression."<ref>[https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf Ministry of Defense of France, International Law Applied to Operations in Cyberspace, 9 September 2019], 6. </ref>
 
"Many States are acquiring the capacity to prepare and conduct operations in cyberspace. When carried out to the detriment of the rights of other States, such operations may breach international law. Depending on the extent of their intrusion or their effects, they may violate the principles of sovereignty, non-intervention or even the prohibition of the threat or use of force. States targeted by such cyberattacks are entitled to respond to them within the framework of the options offered by international law. In response to a cyberattack, France may consider diplomatic responses to certain incidents, counter-measures, or even coercive action by the armed forces if an attack constitutes armed aggression."<ref>[https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf Ministry of Defense of France, International Law Applied to Operations in Cyberspace, 9 September 2019], 6. </ref>
Line 49: Line 48:
 
Interference by digital means in the internal or external affairs of France, i.e. interference which causes or may cause harm to France’s political, economic, social and cultural system, may constitute a violation of the principle of non-intervention.<ref>[https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf Ministry of Defense of France, International Law Applied to Operations in Cyberspace, 9 September 2019], 7. </ref><section end=FR_2019 prohibition of intervention />
 
Interference by digital means in the internal or external affairs of France, i.e. interference which causes or may cause harm to France’s political, economic, social and cultural system, may constitute a violation of the principle of non-intervention.<ref>[https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf Ministry of Defense of France, International Law Applied to Operations in Cyberspace, 9 September 2019], 7. </ref><section end=FR_2019 prohibition of intervention />
   
==[[Due diligence]]==
+
==Due diligence==
 
<section begin=FR_2019 due diligence />
 
<section begin=FR_2019 due diligence />
 
"France exercises its sovereignty over the information systems located on its territory. In compliance with the due diligence requirement, it ensures that its territory is not used for internationally wrongful acts using ICTs. This is a customary obligation for States, which must (i) use cyberspace in compliance with international law, and in particular not use proxies to commit acts which, using ICTs, infringe the rights of other States, and (ii) ensure that their territory is not used for such purposes, including by non-state actors."<ref>[https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf Ministry of Defense of France, International Law Applied to Operations in Cyberspace, 9 September 2019], 6. </ref>
 
"France exercises its sovereignty over the information systems located on its territory. In compliance with the due diligence requirement, it ensures that its territory is not used for internationally wrongful acts using ICTs. This is a customary obligation for States, which must (i) use cyberspace in compliance with international law, and in particular not use proxies to commit acts which, using ICTs, infringe the rights of other States, and (ii) ensure that their territory is not used for such purposes, including by non-state actors."<ref>[https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf Ministry of Defense of France, International Law Applied to Operations in Cyberspace, 9 September 2019], 6. </ref>
Line 63: Line 62:
 
"France also does not rule out the option of invoking a state of distress or necessity in order to protect a vital interest against a cyberattack which is below the threshold of armed attack but constitutes a serious and imminent danger. In such cases, the measures taken remain peaceful and do not seriously harm a vital interest of the State concerned. Such measures in response to a cyberattack against France in breach of international law are not taken systematically, but according to a discretionary political decision."<ref>[https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf Ministry of Defense of France, International Law Applied to Operations in Cyberspace, 9 September 2019], 8. </ref><section end=FR_2019 necessity /><section end=FR_2019 distress />
 
"France also does not rule out the option of invoking a state of distress or necessity in order to protect a vital interest against a cyberattack which is below the threshold of armed attack but constitutes a serious and imminent danger. In such cases, the measures taken remain peaceful and do not seriously harm a vital interest of the State concerned. Such measures in response to a cyberattack against France in breach of international law are not taken systematically, but according to a discretionary political decision."<ref>[https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf Ministry of Defense of France, International Law Applied to Operations in Cyberspace, 9 September 2019], 8. </ref><section end=FR_2019 necessity /><section end=FR_2019 distress />
   
==[[Self-defence|Self-defence, armed attack and use of force]]==
+
==Self-defence, armed attack and use of force==
<section begin=FR_2019 self-defence, armed attack and use of force /><section begin=FR_2019 use of force />
+
<section begin=FR_2019 self-defence, armed attack and use of force />
 
"<b>Some cyberoperations may violate the prohibition of the threat or use of force.</b> The most serious violations of sovereignty, especially those that infringe France’s territorial integrity or political independence, may violate the prohibition of the threat or use of force, which applies to any use of force, regardless of the weapons employed. <b>In digital space, crossing the threshold of the use of force depends not on the digital means employed but on the effects of the cyberoperation.</b> A cyberoperation carried out by one State against another State violates the prohibition of the use of force if its effects are similar to those that result from the use of conventional weapons. However, France does not rule out the possibility that a cyberoperation without physical effects may also be characterised as a use of force. In the absence of physical damage, a cyberoperation may be deemed a use of force against the yardstick of several criteria, including the circumstances prevailing at the time of the operation, such as the origin of the operation and the nature of the instigator (military or not), the extent of intrusion, the actual or intended effects of the operation or the nature of the intended target. This is of course not an exhaustive list. For example, penetrating military systems in order to compromise French defence capabilities, or financing or even training individuals to carry out cyberattacks against France, could also be deemed uses of force.
 
"<b>Some cyberoperations may violate the prohibition of the threat or use of force.</b> The most serious violations of sovereignty, especially those that infringe France’s territorial integrity or political independence, may violate the prohibition of the threat or use of force, which applies to any use of force, regardless of the weapons employed. <b>In digital space, crossing the threshold of the use of force depends not on the digital means employed but on the effects of the cyberoperation.</b> A cyberoperation carried out by one State against another State violates the prohibition of the use of force if its effects are similar to those that result from the use of conventional weapons. However, France does not rule out the possibility that a cyberoperation without physical effects may also be characterised as a use of force. In the absence of physical damage, a cyberoperation may be deemed a use of force against the yardstick of several criteria, including the circumstances prevailing at the time of the operation, such as the origin of the operation and the nature of the instigator (military or not), the extent of intrusion, the actual or intended effects of the operation or the nature of the intended target. This is of course not an exhaustive list. For example, penetrating military systems in order to compromise French defence capabilities, or financing or even training individuals to carry out cyberattacks against France, could also be deemed uses of force.
   
 
However, not every use of force is an armed attack within the meaning of Article 51 of the United Nations Charter, especially if its effects are limited or reversible or do not attain a certain level of gravity.
 
However, not every use of force is an armed attack within the meaning of Article 51 of the United Nations Charter, especially if its effects are limited or reversible or do not attain a certain level of gravity.
   
<b>The prohibition of the use of force enshrined in the United Nations Charter applies to cyberspace. Certain cyberoperations may constitute a use of armed force within the meaning of Article 2, para. 4 of the United Nations Charter."</b><ref>[https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf Ministry of Defense of France, International Law Applied to Operations in Cyberspace, 9 September 2019], 7. </ref><section end=FR_2019 use of force />
+
<b>The prohibition of the use of force enshrined in the United Nations Charter applies to cyberspace. Certain cyberoperations may constitute a use of armed force within the meaning of Article 2, para. 4 of the United Nations Charter."</b><ref>[https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf Ministry of Defense of France, International Law Applied to Operations in Cyberspace, 9 September 2019], 7. </ref>
   
 
"In accordance with the case law of the International Court of Justice (ICJ), France distinguishes the gravest forms of the use of force, which constitute an armed attack to which the victim State may respond by individual or collective self-defence, from other less grave forms. Cyberattacks may constitute a grave form of the use of force to which France could respond by self-defence."<ref>[https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf Ministry of Defense of France, International Law Applied to Operations in Cyberspace, 9 September 2019], 8. </ref>
 
"In accordance with the case law of the International Court of Justice (ICJ), France distinguishes the gravest forms of the use of force, which constitute an armed attack to which the victim State may respond by individual or collective self-defence, from other less grave forms. Cyberattacks may constitute a grave form of the use of force to which France could respond by self-defence."<ref>[https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf Ministry of Defense of France, International Law Applied to Operations in Cyberspace, 9 September 2019], 8. </ref>
Line 90: Line 89:
 
Lastly, any response on the grounds of self-defence remains provisional and subordinate. It must be promptly reported to the UNSC and suspended as soon as the Security Council takes the matter in hand, replacing unilateral action with collective measures or, failing that, as soon as it has achieved its purpose, namely to repel or end the armed attack. Other measures, such as counter-measures or referral to the UNSC, may be preferred if they are deemed more appropriate."<ref>[https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf Ministry of Defense of France, International Law Applied to Operations in Cyberspace, 9 September 2019], 9. </ref><section end=FR_2019 self-defence, armed attack and use of force />
 
Lastly, any response on the grounds of self-defence remains provisional and subordinate. It must be promptly reported to the UNSC and suspended as soon as the Security Council takes the matter in hand, replacing unilateral action with collective measures or, failing that, as soon as it has achieved its purpose, namely to repel or end the armed attack. Other measures, such as counter-measures or referral to the UNSC, may be preferred if they are deemed more appropriate."<ref>[https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf Ministry of Defense of France, International Law Applied to Operations in Cyberspace, 9 September 2019], 9. </ref><section end=FR_2019 self-defence, armed attack and use of force />
   
== [[International humanitarian law (jus in bello)|International humanitarian law (''jus in bello'')]] ==
+
== International humanitarian law (''jus in bello'') ==
 
<section begin=FR_2019 IHL />
 
<section begin=FR_2019 IHL />
 
In an armed conflict situation, cyberspace is an area of confrontation in its own right linked to other areas of confrontation. The offensive cyber capability implemented in the theatres of engagement of the French armed forces is controlled by means of a doctrine and a framework for use in accordance with which it is required to comply with international humanitarian law (IHL).<ref>[https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf Ministry of Defense of France, International Law Applied to Operations in Cyberspace, 9 September 2019], 12. </ref><section end=FR_2019 IHL />
 
In an armed conflict situation, cyberspace is an area of confrontation in its own right linked to other areas of confrontation. The offensive cyber capability implemented in the theatres of engagement of the French armed forces is controlled by means of a doctrine and a framework for use in accordance with which it is required to comply with international humanitarian law (IHL).<ref>[https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf Ministry of Defense of France, International Law Applied to Operations in Cyberspace, 9 September 2019], 12. </ref><section end=FR_2019 IHL />
   
 
== Conflict qualification (IAC/NIAC) ==
== [[Attack (international humanitarian law)|Attack (international humanitarian law)]] ==
 
<section begin=FR_2019 Attack (international humanitarian law) />
 
"A cyber weapon is first and foremost a combined resource, given its capacity to support weapons used in the other environments. In this regard, it produces the same intelligence, neutralisation and deception effects as conventional means which are subject to targeting procedures already implemented by the French armed forces in compliance with IHL. Such operations may constitute attacks within the meaning of Article 49 of Additional Protocol I to the Geneva Conventions (AP I) where they cause physical damage or disable a system. However, certain military operations, such as general intelligence-gathering or alteration of the adversary’s influence capabilities, do not constitute an attack, though they are still governed by the relevant provisions of IHL. France integrates the principles of distinction, proportionality and precaution into all offensive cyber warfare operations carried out in an armed conflict situation.”
 
 
“A cyberoperation may constitute an attack within the meaning of international humanitarian law. Any cyberoperation which is carried out in, and in connection with, an armed conflict situation, and constitutes an act of violence, whether offensive or defensive, against another party to the conflict, is an attack within the meaning of Article 49 of AP I to the Geneva Conventions. In an armed conflict situation, the primary purpose of cyber weapons is to produce effects against an adversary system in order to alter the availability, integrity or confidentiality of data. Their effects may be material (e.g. neutralisation of a weapons system) or virtual (e.g. intelligence gathering), temporary, reversible or final. For example, the destruction of adversary military offensive cyber or conventional capabilities by disruption or the creation of major damage is an attack within the meaning of IHL. The same applies to neutralisation actions which damage adversary cyber or conventional military capabilities by destroying ICT equipment or systems or altering or deleting digital data or flows such as to disable a service essential to the operation of such capabilities. Contrary to the definition given by the Tallinn Manual Group of Experts, France does not characterise a cyberattack solely on the basis of material criteria. It considers that a cyberoperation is an attack where the targeted equipment or systems no longer provide the service for which they were implemented, whether temporarily or permanently, reversibly or not. If the effects are temporary and/or reversible, the attack is characterised where action by the adversary is necessary to restore the infrastructure or system (repair of equipment, replacement of a part, reinstallation of a network, etc.). Most cyberoperations carried out by the French armed forces in an armed conflict situation (mainly information-gathering) do not meet the definition of an attack. For example, altering the adversary’s propaganda capabilities, and in particular making an influence site unavailable by saturation or denial of service – which is not prohibited by IHL by analogy with conventional jamming of radio communications or TV broadcasts – cannot be characterised as an attack. However, such operations, in the same way as general information-gathering with the aim of evaluating the adversary’s military capabilities or hacking a system in order to gather data, are still governed by the provisions of IHL applicable to any military operation carried out in an armed conflict situation. Contrary to the Tallinn Manual, France considers that an attack within the meaning of Article 49 of AP I may occur even if there is no human injury or loss of life, or physical damage to goods. Thus, a cyberoperation constitutes an attack if the targeted equipment or systems can no longer provide the service for which they were implemented, including temporarily or reversibly, where action by the adversary is required in order to restore the infrastructure or the system. Most cyberoperations, including offensive cyber warfare operations carried out by France in an armed conflict situation, remain below the attack threshold, since they mostly involve information-gathering and the jamming of the adversary’s influence capabilities. Such operations remain nonetheless governed by the general principles of IHL.”<ref>Ministry of Defense of France, ‘[https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf International Law Applied to Operations in Cyberspace]’, (9 September 2019) 13.</ref><section end=FR_2019 Attack (international humanitarian law) />
 
 
== Conflict qualification (IAC/NIAC)==
 
 
<section begin=FR_2019 conflict qualification/><section begin=FR_2019 IAC /><section begin=FR_2019 NIAC />
 
<section begin=FR_2019 conflict qualification/><section begin=FR_2019 IAC /><section begin=FR_2019 NIAC />
Cyberoperations that constitute hostilities between two or more States may characterise the existence of international armed conflict (IAC). Likewise, prolonged cyberoperations by government armed forces against one or more armed groups or by several armed groups between themselves may constitute a non-international armed conflict (NIAC), where such groups show a minimum level of organisation and the effects of such operations reach a sufficient threshold of violence. They are generally military operations concurrent with conventional military operations: that is why it is not difficult to categorise an armed conflict situation. While an armed conflict consisting exclusively of digital activities cannot be ruled out in principle, it is based on the capacity of autonomous cyberoperations to reach the threshold of violence required to be categorised as such. Although virtual, cyberoperations still fall within the geographical scope of IHL, insofar as their effects must arise on the territory of the States party to the IAC and on the territory where the NIAC hostilities occur.<ref>[https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf Ministry of Defense of France, International Law Applied to Operations in Cyberspace, 9 September 2019], 12.</ref><section end=FR_2019 conflict qualification/><section end=FR_2019 IAC /><section end=FR_2019 NIAC />
+
Cyberoperations that constitute hostilities between two or more States may characterise the existence of international armed conflict (IAC). Likewise, prolonged cyberoperations by government armed forces against one or more armed groups or by several armed groups between themselves may constitute a non-international armed conflict (NIAC), where such groups show a minimum level of organisation and the effects of such operations reach a sufficient threshold of violence. They are generally military operations concurrent with conventional military operations: that is why it is not difficult to categorise an armed conflict situation. While an armed conflict consisting exclusively of digital activities cannot be ruled out in principle, it is based on the capacity of autonomous cyberoperations to reach the threshold of violence required to be categorised as such. Although virtual, cyberoperations still fall within the geographical scope of IHL, insofar as their effects must arise on the territory of the States party to the IAC and on the territory where the NIAC hostilities occur.<ref>[https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf Ministry of Defense of France, International Law Applied to Operations in Cyberspace, 9 September 2019], 12.</ref><section begin=FR conflict qualification/><section end=FR IAC /><section end=FR NIAC />
   
== [[Conduct of hostilities]] ==
+
== Conduct of hostilities ==
 
<section begin=FR_2019 conduct of hostilities />
 
<section begin=FR_2019 conduct of hostilities />
 
"The use of a cyber weapon in an armed conflict situation obeys the principles governing the conduct of hostilities. A cyber weapon, which is governed by IHL, may be used in combination with conventional military resources or in isolation. In support of conventional means, it produces the same intelligence, neutralisation and deception effects as those conventional means, which have long been subject to the targeting procedures used by the French armed forces in compliance with IHL.
 
"The use of a cyber weapon in an armed conflict situation obeys the principles governing the conduct of hostilities. A cyber weapon, which is governed by IHL, may be used in combination with conventional military resources or in isolation. In support of conventional means, it produces the same intelligence, neutralisation and deception effects as those conventional means, which have long been subject to the targeting procedures used by the French armed forces in compliance with IHL.
Line 110: Line 103:
 
The specific nature and complexity of offensive cyber warfare resources demand risk control arrangements just as robust as those applied to conventional operations, taking into account the inherent features of the conduct of operations in cyberspace. In practice, the risks linked to the use of a cyber weapon, especially the immediacy of the action, the duality of targets and the hyperconnectivity of networks, demand a specific digital targeting process spanning all phases of the cyberoperation in order to ensure compliance with the principles of distinction, precaution and proportionality, inter alia in order to minimise potential civilian damage and loss of life. The process involves long and specific planning carried out in close coordination with the planning of operations in the physical sphere."<ref>[https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf Ministry of Defense of France, International Law Applied to Operations in Cyberspace, 9 September 2019], 13.</ref><section end=FR_2019 conduct of hostilities />
 
The specific nature and complexity of offensive cyber warfare resources demand risk control arrangements just as robust as those applied to conventional operations, taking into account the inherent features of the conduct of operations in cyberspace. In practice, the risks linked to the use of a cyber weapon, especially the immediacy of the action, the duality of targets and the hyperconnectivity of networks, demand a specific digital targeting process spanning all phases of the cyberoperation in order to ensure compliance with the principles of distinction, precaution and proportionality, inter alia in order to minimise potential civilian damage and loss of life. The process involves long and specific planning carried out in close coordination with the planning of operations in the physical sphere."<ref>[https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf Ministry of Defense of France, International Law Applied to Operations in Cyberspace, 9 September 2019], 13.</ref><section end=FR_2019 conduct of hostilities />
   
==[[Military objectives]]==
+
== Military objectives==
 
<section begin=FR_2019 military objectives />
 
<section begin=FR_2019 military objectives />
 
"In order to ensure application of the rules governing the conduct of hostilities (distinction, proportionality and precaution, prohibition of superfluous injury and unnecessary suffering), a specific digital targeting process is used for cyberoperations, under the responsibility of the commander-in-chief of the armed forces, with the input, inter alia, of operational staff and specialist operational legal advisers. It cannot be ruled out that a serious breach of these principles arising from a cyberoperation could constitute a war crime within the meaning of the Rome Statute.
 
"In order to ensure application of the rules governing the conduct of hostilities (distinction, proportionality and precaution, prohibition of superfluous injury and unnecessary suffering), a specific digital targeting process is used for cyberoperations, under the responsibility of the commander-in-chief of the armed forces, with the input, inter alia, of operational staff and specialist operational legal advisers. It cannot be ruled out that a serious breach of these principles arising from a cyberoperation could constitute a war crime within the meaning of the Rome Statute.
Line 130: Line 123:
 
ICT infrastructure or a system used for both civilian and military purposes may, after detailed analysis on a case-by-case basis, be deemed a military objective. They may be targeted provided that the principles of proportionality and precaution are respected. Given the hyperconnectivity of systems, commanders exercise vigilance over the action as a whole in order to avoid effects on civilians and civilian objects, or at least keep them to a minimum, in compliance with the principles of precaution and proportionality."<ref>[https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf Ministry of Defense of France, International Law Applied to Operations in Cyberspace, 9 September 2019], 14-15.</ref><section end=FR_2019 military objectives />
 
ICT infrastructure or a system used for both civilian and military purposes may, after detailed analysis on a case-by-case basis, be deemed a military objective. They may be targeted provided that the principles of proportionality and precaution are respected. Given the hyperconnectivity of systems, commanders exercise vigilance over the action as a whole in order to avoid effects on civilians and civilian objects, or at least keep them to a minimum, in compliance with the principles of precaution and proportionality."<ref>[https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf Ministry of Defense of France, International Law Applied to Operations in Cyberspace, 9 September 2019], 14-15.</ref><section end=FR_2019 military objectives />
   
==[[Direct participation in hostilities]]==
+
==Direct participation in hostilities==
 
<section begin=FR_2019 direct participation in hostilities />
 
<section begin=FR_2019 direct participation in hostilities />
 
"Cyber-combatants, especially military personnel assigned to a cyberspace operations command, a group of hackers under State command or members of organised armed groups perpetrating cyberoperations against the adversary may be attacked, unless they are ''hors de combat''.
 
"Cyber-combatants, especially military personnel assigned to a cyberspace operations command, a group of hackers under State command or members of organised armed groups perpetrating cyberoperations against the adversary may be attacked, unless they are ''hors de combat''.
Line 156: Line 149:
 
These precautionary measures in attack are backed up by precautionary measures against the effects of an attack which a State should take in order to protect the civilian population and civilian objects against the dangers resulting from cyberoperations."<ref>[https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf Ministry of Defense of France, International Law Applied to Operations in Cyberspace, 9 September 2019], 15-16. </ref><section end=FR_2019 principle of precaution />
 
These precautionary measures in attack are backed up by precautionary measures against the effects of an attack which a State should take in order to protect the civilian population and civilian objects against the dangers resulting from cyberoperations."<ref>[https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf Ministry of Defense of France, International Law Applied to Operations in Cyberspace, 9 September 2019], 15-16. </ref><section end=FR_2019 principle of precaution />
   
==[[Means and methods of cyber warfare|Means and methods of warfare]]==
+
==Means and methods of warfare==
 
<section begin=FR_2019 means and methods of warfare />
 
<section begin=FR_2019 means and methods of warfare />
 
"Despite the complexity of cyberspace, the framework for cyberoperations carried out in an armed conflict situation is still determined by compliance with the principles of precaution and proportionality. As such, the digital targeting process takes account of a cyber weapon’s direct and indirect effects.
 
"Despite the complexity of cyberspace, the framework for cyberoperations carried out in an armed conflict situation is still determined by compliance with the principles of precaution and proportionality. As such, the digital targeting process takes account of a cyber weapon’s direct and indirect effects.
Line 162: Line 155:
 
Despite the interconnectivity of military and civilian systems, the fact of being able to configure a cyber weapon according to the specifically desired effects of an operation helps to avoid excessive damage in relation to the concrete and direct military advantage anticipated. The non-lethal nature of cyber weapons and the possibility of limiting their effects to a previously identified system contribute to the obligation to choose the means and methods of attack most likely to avoid, or at least reduce to a minimum, any incidental loss of civilian lives, injury to civilians or damage to civilian objects."<ref>[https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf Ministry of Defense of France, International Law Applied to Operations in Cyberspace, 9 September 2019], 16. </ref><section end=FR_2019 means and methods of warfare />
 
Despite the interconnectivity of military and civilian systems, the fact of being able to configure a cyber weapon according to the specifically desired effects of an operation helps to avoid excessive damage in relation to the concrete and direct military advantage anticipated. The non-lethal nature of cyber weapons and the possibility of limiting their effects to a previously identified system contribute to the obligation to choose the means and methods of attack most likely to avoid, or at least reduce to a minimum, any incidental loss of civilian lives, injury to civilians or damage to civilian objects."<ref>[https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf Ministry of Defense of France, International Law Applied to Operations in Cyberspace, 9 September 2019], 16. </ref><section end=FR_2019 means and methods of warfare />
   
==[[Neutrality]]==
+
==Neutrality==
 
<section begin=FR_2019 neutrality />
 
<section begin=FR_2019 neutrality />
 
"Cyberoperations carried out in the context of an international armed conflict, or which trigger such a conflict, are subject to the law of neutrality. As such, the States party to an IAC may neither carry out cyberoperations linked to the conflict from installations situated on the territory of a neutral State or under the exclusive control of a neutral State, nor take control of computer systems of the neutral State in order to carry out such operations. The neutral State must prevent any use by belligerent States of ICT infrastructure situated on its territory or under its exclusive control. However, it is not required to prevent belligerent States from using its ICT networks for communication purposes.
 
"Cyberoperations carried out in the context of an international armed conflict, or which trigger such a conflict, are subject to the law of neutrality. As such, the States party to an IAC may neither carry out cyberoperations linked to the conflict from installations situated on the territory of a neutral State or under the exclusive control of a neutral State, nor take control of computer systems of the neutral State in order to carry out such operations. The neutral State must prevent any use by belligerent States of ICT infrastructure situated on its territory or under its exclusive control. However, it is not required to prevent belligerent States from using its ICT networks for communication purposes.
Please note that all contributions to International cyber law: interactive toolkit are considered to be released under the Creative Commons Attribution-ShareAlike 4.0 International (CC BY-SA 4.0) (see International cyber law: interactive toolkit:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!
Cancel Editing help (opens in new window)