Editing Scenario 13: Cyber operations as a trigger of the law of armed conflict

Jump to navigation Jump to search

Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 9: Line 9:
   
 
=== Facts ===
 
=== Facts ===
'''[F1]''' Relations between States A and B have been strained for a long time, stemming primarily from State A’s longstanding unfavourable treatment of a minority group M that lives in that State’s territory. The members of the minority M share their ethnicity with the dominant ethnic group in State B. Recently, individuals belonging to minority M formed an armed faction X with a highly active cyber wing. State B does not hide its support for the newly formed armed faction. In particular, State B gradually extends the following forms of support to the armed group:
+
Relations between States A and B have been strained for a long time, stemming primarily from State A’s longstanding unfavourable treatment of a minority group M that lives in that State’s territory. The members of the minority M share their ethnicity with the dominant ethnic group in State B. Recently, individuals belonging to minority M formed an armed faction X with a highly active cyber wing. State B does not hide its support for the newly formed armed faction. In particular, State B gradually extends the following forms of support to the armed group:
 
<ol>
 
<ol>
 
<li>State B provides the armed group with significant financial assistance, which the group uses to establish and maintain its cyber wing ('''incident 1''');</li>
 
<li>State B provides the armed group with significant financial assistance, which the group uses to establish and maintain its cyber wing ('''incident 1''');</li>
Line 18: Line 18:
 
<li> Opening the floodgates of several dams in State A, which results in significant material damage and the deaths of several individuals ('''incident 3b''').</li>
 
<li> Opening the floodgates of several dams in State A, which results in significant material damage and the deaths of several individuals ('''incident 3b''').</li>
 
</ol>
 
</ol>
</ol>'''[F2]''' The series of cyber attacks conducted by the group bring about considerable chaos and panic across State A. Soon after, fighting erupts between State A’s armed forces and the armed group.
+
</ol>The series of cyber attacks conducted by the group bring about considerable chaos and panic across State A. Soon after, fighting erupts between State A’s armed forces and the armed group.
   
 
=== Examples ===
 
=== Examples ===
Line 27: Line 27:
 
''For a general overview of the structure of analysis in this section, see [[Note on the structure of articles]].''
 
''For a general overview of the structure of analysis in this section, see [[Note on the structure of articles]].''
   
'''[L1]''' The law of armed conflict (also referred to as international humanitarian law, IHL) applies in all situations of armed conflict, either international armed conflict (IAC) or non-international armed conflict (NIAC). The characterization of a situation as either an IAC or a NIAC is a distinct legal test based on the objective facts and remains unaffected by the subjective views of the belligerent parties.<ref>See <i>[http://www.icty.org/x/cases/milutinovic/tjug/en/jud090226-e1of4.pdf Prosecutor v Milutinović et al]</i> (Trial Judgment) IT-05-87-T (26 February 2009) [125] (“The existence of an armed conflict does not depend upon the views of the parties to the conflict.”); see further T Ferraro and L Cameron, ‘Article 2: Application of the Convention’, in ICRC (ed), <i>[https://doi.org/10.1017/9781316755709 Commentary on the First Geneva Convention]</i> (CUP 2016) 76–77 [211]–[212]. </ref> The analysis in this scenario first considers whether an IAC exists between States A and B as a result of any of the incidents detailed in the scenario. In the alternative, it then considers whether the situation should be considered as a NIAC between State A and armed group X.
+
The law of armed conflict (also referred to as international humanitarian law, IHL) applies in all situations of armed conflict, either international armed conflict (IAC) or non-international armed conflict (NIAC). The characterization of a situation as either an IAC or a NIAC is a distinct legal test based on the objective facts and remains unaffected by the subjective views of the belligerent parties.<ref>See <i>[http://www.icty.org/x/cases/milutinovic/tjug/en/jud090226-e1of4.pdf Prosecutor v Milutinović et al]</i> (Trial Judgment) IT-05-87-T (26 February 2009) [125] (“The existence of an armed conflict does not depend upon the views of the parties to the conflict.”); see further T Ferraro and L Cameron, ‘Article 2: Application of the Convention’, in ICRC (ed), <i>[https://doi.org/10.1017/9781316755709 Commentary on the First Geneva Convention]</i> (CUP 2016) 76–77 [211]–[212]. </ref> The analysis in this scenario first considers whether an IAC exists between States A and B as a result of any of the incidents detailed in the scenario. In the alternative, it then considers whether the situation should be considered as a NIAC between State A and armed group X.
   
 
=== Characterization as an international armed conflict ===
 
=== Characterization as an international armed conflict ===
 
{{#lst:International armed conflict|Definition}}
 
{{#lst:International armed conflict|Definition}}
'''[L2]''' In the present scenario, incidents 1 and 2 do not amount to a resort to armed force. They are both best seen as preparatory vis-à-vis the events that follow, but in and of themselves, neither of them has the potential to trigger the law of IAC.
+
In the present scenario, incidents 1 and 2 do not amount to a resort to armed force. They are both best seen as preparatory vis-à-vis the events that follow, but in and of themselves, neither of them has the potential to trigger the law of IAC.
   
'''[L3]''' Incident 3a (reversible attack against the power grid) resulted only in a temporary disruption of the operation of infrastructure on State A’s territory (though it would be necessary to determine if death, injury or physical destruction was a foreseeable consequence of the cyber operation to reach a full conclusion). As such, it is doubtful if, under the present state of the law, this incident could have triggered the application of IHL.<ref>Tristan Ferraro and Lindsey Cameron, ‘Article 2: Application of the Convention’, in ICRC (ed), <i>[https://doi.org/10.1017/9781316755709 Commentary on the First Geneva Convention]</i> (CUP 2016) 92 [256].</ref>
+
Incident 3a (reversible attack against the power grid) resulted only in a temporary disruption of the operation of infrastructure on State A’s territory (though it would be necessary to determine if death, injury or physical destruction was a foreseeable consequence of the cyber operation to reach a full conclusion). As such, it is doubtful if, under the present state of the law, this incident could have triggered the application of IHL.<ref>Tristan Ferraro and Lindsey Cameron, ‘Article 2: Application of the Convention’, in ICRC (ed), <i>[https://doi.org/10.1017/9781316755709 Commentary on the First Geneva Convention]</i> (CUP 2016) 92 [256].</ref>
   
'''[L4]''' By contrast, incident 3b (cyber attack against several dams) occasioned considerable physical damage and the deaths of several individuals, which indeed were all foreseeable consequences of this kind of cyber operation. The fact that the operation was conducted by a group under the guidance of State B’s civilian intelligence agency and not its military forces does not make any difference in this regard.<ref>[https://doi.org/10.1017/9781316822524 Tallinn Manual 2.0], commentary to rule 82, para 14 (“To be ‘armed’, a conflict need not involve the employment of the armed forces. Nor is the involvement of the armed forces determinative. For example, should entities such as civilian intelligence agencies engage in cyber operations otherwise meeting the armed criterion …, an armed conflict may be triggered.”).</ref> On that basis, the effects of incident 3b can be described as comparable to those of classic kinetic operations, which would be sufficient for the purposes of applicability of IHL as long as there was a sufficient level of State involvement. This issue is considered in the following paragraph.
+
By contrast, incident 3b (cyber attack against several dams) occasioned considerable physical damage and the deaths of several individuals, which indeed were all foreseeable consequences of this kind of cyber operation. The fact that the operation was conducted by a group under the guidance of State B’s civilian intelligence agency and not its military forces does not make any difference in this regard.<ref>[https://doi.org/10.1017/9781316822524 Tallinn Manual 2.0], commentary to rule 82, para 14 (“To be ‘armed’, a conflict need not involve the employment of the armed forces. Nor is the involvement of the armed forces determinative. For example, should entities such as civilian intelligence agencies engage in cyber operations otherwise meeting the armed criterion …, an armed conflict may be triggered.”).</ref> On that basis, the effects of incident 3b can be described as comparable to those of classic kinetic operations, which would be sufficient for the purposes of applicability of IHL as long as there was a sufficient level of State involvement. This issue is considered in the following paragraph.
   
'''[L5]''' There is no doubt that State B has extended its support to armed group X throughout the relevant events. This has taken the form of financial support (incident 1), training and equipping (incident 2), and operational guidance and co-ordination (incidents 3a and 3b). The first two forms of support would not suffice for either of the tests of “effective control”<ref>See <i>Military and Paramilitary Activities in and against Nicaragua (Nicaragua v US)</i> (Merits) [1986] [https://www.icj-cij.org/files/case-related/70/070-19860627-JUD-01-00-EN.pdf ICJ Rep 14], para 115 (considering that the State’s role must go beyond “financing, organizing, training, supplying and equipping” of the armed group).</ref> and “overall control”.<ref>See [http://www.icty.org/x/cases/tadic/acjug/en/tad-aj990715e.pdf <i>Prosecutor v Tadić</i> (Appeal Judgment) IT-94-1-A] (15 July 1999) [137] (noting that the State’s role must go beyond “financing, training and equipping or providing operational support” to the armed group).</ref> However, in combination with State B’s participation in the co-ordination of the cyber operation qualifying as a resort to armed force, the level of State B’s involvement would reach that required by the “overall control” test.<ref>[http://www.icty.org/x/cases/prlic/tjug/en/130529-1.pdf <i>Prosecutor v Prlić et al</i> (Trial Judgment) IT-04-74-T] (29 May 2013), [86(a)] (considering that coordinating or providing assistance in the overall planning of military activities suffices for the purposes of the overall control test)</ref> By contrast, the higher test of “effective control” would remain unmet on the facts of this scenario.<ref>Cf. <i>Military and Paramilitary Activities in and against Nicaragua (Nicaragua v US)</i> (Merits) [1986] [https://www.icj-cij.org/files/case-related/70/070-19860627-JUD-01-00-EN.pdf ICJ Rep 14], para 115 (considering the State would have to have “directed or enforced” the operation in question for the purposes of the effective control test).</ref>
+
There is no doubt that State B has extended its support to armed group X throughout the relevant events. This has taken the form of financial support (incident 1), training and equipping (incident 2), and operational guidance and co-ordination (incidents 3a and 3b). The first two forms of support would not suffice for either of the tests of “effective control”<ref>See <i>Military and Paramilitary Activities in and against Nicaragua (Nicaragua v US)</i> (Merits) [1986] [https://www.icj-cij.org/files/case-related/70/070-19860627-JUD-01-00-EN.pdf ICJ Rep 14], para 115 (considering that the State’s role must go beyond “financing, organizing, training, supplying and equipping” of the armed group).</ref> and “overall control”.<ref>See [http://www.icty.org/x/cases/tadic/acjug/en/tad-aj990715e.pdf <i>Prosecutor v Tadić</i> (Appeal Judgment) IT-94-1-A] (15 July 1999) [137] (noting that the State’s role must go beyond “financing, training and equipping or providing operational support” to the armed group).</ref> However, in combination with State B’s participation in the co-ordination of the cyber operation qualifying as a resort to armed force, the level of State B’s involvement would reach that required by the “overall control” test.<ref>[http://www.icty.org/x/cases/prlic/tjug/en/130529-1.pdf <i>Prosecutor v Prlić et al</i> (Trial Judgment) IT-04-74-T] (29 May 2013), [86(a)] (considering that coordinating or providing assistance in the overall planning of military activities suffices for the purposes of the overall control test)</ref> By contrast, the higher test of “effective control” would remain unmet on the facts of this scenario.<ref>Cf. <i>Military and Paramilitary Activities in and against Nicaragua (Nicaragua v US)</i> (Merits) [1986] [https://www.icj-cij.org/files/case-related/70/070-19860627-JUD-01-00-EN.pdf ICJ Rep 14], para 115 (considering the State would have to have “directed or enforced” the operation in question for the purposes of the effective control test).</ref>
   
'''[L6]''' In summary, there was an IAC between States A and B as of the moment when armed group X, acting under the overall control of State B, launched the cyber operation against the dams in State A. The continuation of hostilities by kinetic means does not alter this conclusion in any way.
+
In summary, there was an IAC between States A and B as of the moment when armed group X, acting under the overall control of State B, launched the cyber operation against the dams in State A. The continuation of hostilities by kinetic means does not alter this conclusion in any way.
   
 
=== Characterization as a non-international armed conflict ===
 
=== Characterization as a non-international armed conflict ===
'''[L7]''' <i>The engagement between group X and State A may also, or separately, qualify as a NIAC,<ref>See further [http://www.oxfordscholarship.com/view/10.1093/oso/9780198819868.001.0001/oso-9780198819868 Kubo Mačák, <i>Internationalization of Armed Conflicts in International Law</i>] (OUP 2018) 87–104.</ref> based on the fulfilment of the requisite criteria of organization and intensity (analysed in the present section).</i>
+
<i>The engagement between group X and State A may also, or separately, qualify as a NIAC,<ref>See further [http://www.oxfordscholarship.com/view/10.1093/oso/9780198819868.001.0001/oso-9780198819868 Kubo Mačák, <i>Internationalization of Armed Conflicts in International Law</i>] (OUP 2018) 87–104.</ref> based on the fulfilment of the requisite criteria of organization and intensity (analysed in the present section).</i>
 
{{#lst:Non-international armed conflict|Definition}}
 
{{#lst:Non-international armed conflict|Definition}}
   
'''[L8]''' Group X appears to have sufficient organization, given that it was capable of carrying out sustained military operations of both kinetic and cyber nature,<ref>[https://doi.org/10.1017/9781316822524 Tallinn Manual 2.0], commentary to rule 83, para. 11.</ref> although more details would be needed in practice before making a conclusive determination.<ref>Cf. [https://doi.org/10.1017/9781316822524 Tallinn Manual 2.0], commentary to rule 83, para 11 (“Whether or not a given group is organised must be determined on a case-by-case basis.”).</ref> Note, however, that the organizational threshold is not particularly high, and the extent of organization certainly does not need to reach the level of organization of State armed forces.<ref>Cordula Droege, ‘[https://www.icrc.org/en/download/file/13738/irrc-886-droege.pdf Get Off My Cloud: Cyber Warfare, International Humanitarian Law, and the Protection of Civilians]’ (2012) 94 IRRC 533, 550.</ref>
+
Group X appears to have sufficient organization, given that it was capable of carrying out sustained military operations of both kinetic and cyber nature,<ref>[https://doi.org/10.1017/9781316822524 Tallinn Manual 2.0], commentary to rule 83, para. 11.</ref> although more details would be needed in practice before making a conclusive determination.<ref>Cf. [https://doi.org/10.1017/9781316822524 Tallinn Manual 2.0], commentary to rule 83, para 11 (“Whether or not a given group is organised must be determined on a case-by-case basis.”).</ref> Note, however, that the organizational threshold is not particularly high, and the extent of organization certainly does not need to reach the level of organization of State armed forces.<ref>Cordula Droege, ‘[https://www.icrc.org/en/download/file/13738/irrc-886-droege.pdf Get Off My Cloud: Cyber Warfare, International Humanitarian Law, and the Protection of Civilians]’ (2012) 94 IRRC 533, 550.</ref>
   
'''[L9]''' The threshold for intensity is relatively high and would certainly not be met by any of incidents 1–3a, given that the impact of these incidents was not similar to that of kinetic attacks.<ref>Lindsey Cameron et al, ‘Article 3: Conflicts Not of an International Character’ in ICRC (ed), <i>[https://doi.org/10.1017/9781316755709 Commentary on the First Geneva Convention]</i> (CUP 2016) 159 [437].</ref> In contrast, incident 3b, which resulted in the opening of floodgates of dams and then led to fighting that required the engagement of State A’s armed forces, would likely fulfil the requirement of intensity in the present case.<ref>Cf. Dietrich Schindler, ‘The Different Types of Armed Conflicts According to the Geneva Conventions and Protocols’ (1979) 163 RdC 117, 146–47 (arguing that the criterion of intensity is met whenever “the government is compelled to employ its armed forces against the insurgents instead of mere police forces”).</ref>
+
The threshold for intensity is relatively high and would certainly not be met by any of incidents 1–3a, given that the impact of these incidents was not similar to that of kinetic attacks.<ref>Lindsey Cameron et al, ‘Article 3: Conflicts Not of an International Character’ in ICRC (ed), <i>[https://doi.org/10.1017/9781316755709 Commentary on the First Geneva Convention]</i> (CUP 2016) 159 [437].</ref> In contrast, incident 3b, which resulted in the opening of floodgates of dams and then led to fighting that required the engagement of State A’s armed forces, would likely fulfil the requirement of intensity in the present case.<ref>Cf. Dietrich Schindler, ‘The Different Types of Armed Conflicts According to the Geneva Conventions and Protocols’ (1979) 163 RdC 117, 146–47 (arguing that the criterion of intensity is met whenever “the government is compelled to employ its armed forces against the insurgents instead of mere police forces”).</ref>
   
'''[L10]''' In sum, to the extent that armed group X maintains its operational autonomy and the overall control test is not met by State B, the armed confrontation between the group and State A qualified as a NIAC from the moment when the governmental armed forces responded by force against armed group X. Therefore, the law of NIAC would only be triggered as a result of State A’s response to the cyber operation in question.
+
In sum, to the extent that armed group X maintains its operational autonomy and the overall control test is not met by State B, the armed confrontation between the group and State A qualified as a NIAC from the moment when the governmental armed forces responded by force against armed group X. Therefore, the law of NIAC would only be triggered as a result of State A’s response to the cyber operation in question.
   
 
== Checklist ==
 
== Checklist ==

Please note that all contributions to International cyber law: interactive toolkit are considered to be released under the Creative Commons Attribution-ShareAlike 4.0 International (CC BY-SA 4.0) (see International cyber law: interactive toolkit:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

Cancel Editing help (opens in new window)