Editing Scenario 10: Legal review of cyber weapons

State A develops new malware capable of physical destruction of enemy military equipment. However, if released, it is also expected to result in the temporary impairment of the use of civilian cyber infrastructure through which it may spread in order to reach its target. This scenario considers State obligations to conduct a weapons review with respect to cyber capabilities of this kind already in peacetime, well before they may actually be deployed in time of armed conflict. In particular, it examines whether such malware constitutes a weapon that is inherently indiscriminate and therefore prohibited by IHL.

== Scenario ==

=== Keywords ===
Cyber weapons; weapons review; methods and means of warfare; targeted threat

=== Facts ===
State A develops new sophisticated malware designed to weaken the military capacity of its adversaries in times of armed conflict. The software is capable of replicating itself through cyber infrastructure. Once installed in a host system, the malware assesses it for the presence of a specific programmable logic controller (PLC) used by several States for the purposes of automated maintenance of military equipment. If it does not detect this specific PLC in a given host system, it attempts to further spread through any connected networks and then it shuts itself down in that particular host system. However, if the detection is positive, the malware uses a vulnerability in the PLC to slightly alter the maintenance process. The effect of this alteration is that instead of servicing the equipment in question, the maintenance machines damage it and thus render it unusable. Tests in controlled environment show that whenever the malware is installed in a host system, it causes it to significantly slow down for a short period of time. However, it is not expected to cause physical damage unless the target PLC is detected in a specific host system.

=== Similar real-world incidents ===
N/A

== Legal analysis ==
{{#lst:Legal review of cyber weapons|Definition}}
In the present scenario, the malware developed by State A would qualify as a “cyber weapon” due to its ability to produce physical destruction, which is an effect that qualifies as “violence against the adversary”.<ref>Art 49(1) AP I.</ref> State A would accordingly be under a duty to ensure that the use of this malware complies with its international obligations. This is so irrespective of whether State A is currently involved in any armed conflict or not. If State A has ratified Additional Protocol I, its duties would additionally extend to conducting a formal legal review, which would include the assessment of the malware’s compliance with all applicable rules of international law.

There is no indication that the malware’s employment would cause any injury to persons, thus rendering inapplicable the rules on superfluous injury or unnecessary suffering. By contrast, the fact that the malware does not distinguish between civilian and military infrastructure in order to reach its intended target raises questions of its compatibility with the prohibition of inherently indiscriminate means of warfare.

A weapon is considered indiscriminate by nature if it either cannot be directed at a specific military objective,<ref>Art 51(4)(b) AP I.</ref> or if its effects cannot be limited as required by IHL and it is thus of a nature to strike military objectives and civilian objects without distinction.<ref>Art 51(4)(c) AP I.</ref> State A’s malware appears to pass the first condition given that it is specifically designed to target the PLCs controlling military equipment, which would normally qualify as a military objective under IHL.<ref>See Art 52(2) AP I (“In so far as objects are concerned, military objectives are limited to those objects which by their nature, location, purpose or use make an effective contribution to military action and whose total or partial destruction, capture or neutralization, in the circumstances ruling at the time, offers a definite military of advantage.”).</ref>
 
However, with respect to the second condition, it is clear that the effects of the malware are not limited solely to the intended military objective and, moreover, that these effects are not wholly under State A’s control. Once released, the malware can spread through civilian infrastructure and can be expected to temporarily impair the ordinary use of infected civilian host systems. Accordingly, State A must assess whether the safeguards built in the malware are sufficient to prevent reverberating harmful effects going beyond the control of the attacker.<ref>Cf. Tallinn Manual 2.0, commentary to rule 105, para. 4 (noting that malware that would inevitably and harmfully spread into civilian networks in a manner beyond the control of the attacker would violate this prohibition).</ref>

In this regard, States may consider including in the malware a “kill switch” which, if activated, immediately stops the malware from spreading further. The presence of an effective “kill switch” ensures that the attacker is capable of limiting the effects of the malware in particular circumstances. Accordingly, the malware would not qualify as an inherently indiscriminate cyber weapon.<ref>Cf. also Tallinn Manual 2.0, commentary to rule 105, para. 4 (“To the extent the effects of the means or method of warfare can be limited in particular circumstances, it does not violate [this prohibition].”).</ref> Of course, it would still be capable of being used in an indiscriminate manner, but that is an issue that must be considered in relation to each specific attack rather than during the ex ante legal review.

Overall, the assessment must take into account all relevant circumstances and the reasonable expectations of the deploying State.<ref><!--[ADD REF]--></ref> In this regard, the temporary effects on civilian infrastructure occasioned by the spread of the virus are likely insufficient to indicate the illegality of the malware. This is because mere inconvenience or annoyance is not considered as collateral damage to civilian objects in the proportionality calculus.<ref>Tallinn Manual 2.0, commentary to rule 105, para. 5.</ref> As long as the release and proliferation of the malware is not expected, or should not reasonably be expected, to cause damage to civilian and military systems without distinction, it would thus likely pass the second condition, too.<ref>See also Tallinn Manual 2.0, commentary to rule 105, para. 5 (considering that “Stuxnet-like malware that spreads widely into civilian systems, but only damages specific enemy technical equipment” would not violate this prohibition).</ref>

== Checklist ==
* 

== Appendixes ==

=== See also ===

* ...
* ...

=== Notes and references ===
<references />

=== Bibliography ===
* SM Bellovin, S Landau and HS Lin, ‘Limiting the undesired impact of cyber weapons: technical requirements and policy implications’ (2017) 3(1) Journal of Cybersecurity 59.
* D Blake and J Imburgia, ‘“Bloodless Weapons”? The need to conduct legal review of certain capabilities and the implications of defining them as “weapons”’, (2010) 66 Air Force Law Review 157.
* V Boulanin and M Verbruggen, [https://www.sipri.org/sites/default/files/2017-12/article_36_report_1712.pdf <i>Article 36 Reviews: Dealing with the Challenges Posed by Emerging Technologies</i>] (SIPRI 2017).
* GD Brown and AO Metcalf, ‘[http://jnslp.com/wp-content/uploads/2014/02/Easier-Said-than-Done.pdf Easier Said Than Done: Legal Reviews of Cyber Weapons]’ (2014) 7 Journal of National Security Law & Policy 115.
* MN Schmitt (ed), ''Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations'' (CUP 2017)
* D Wallace, ‘[https://ccdcoe.org/sites/default/files/multimedia/pdf/TP%2011_2018.pdf Cyber Weapon Reviews under International Humanitarian Law: A Critical Analysis]’ (2018) Tallinn Paper No. 11.

=== Further reading ===
Articles giving background on automated applications in the military – i.e. devices/processes that may be hacked:
*A Lowne, ‘[http://archive.cotsjournalonline.com/articles/view/103828 Automated Test Solves Maintenance Issues for Military Vehicles]’ COTS Journal (January 2014)
*Association for Advancing Automation, ‘[https://www.a3automate.org/how-automation-for-military-impacts-industrial-automation/ How Automation for Military Impacts Industrial Automation]’ (undated)


Original text by: Kubo Mačák

Reviewed by: [TBC]