View source for Scenario 25: Cyber disruption of humanitarian assistance

[[File:Scn25.JPG|thumb|© ICRC]]

A State involved in an international armed conflict hacks into the systems of an impartial humanitarian organization. It uses the information obtained to identify civilians and members of a paramilitary force belonging to a specific ethnic group in order to arrest or kill them. In addition, the attack compromises the perception of neutrality, impartiality and independence of the humanitarian organization and it results in restrictions on access for the organization and security incidents affecting its staff. The scenario explores whether the cyber operation constitutes an unlawful interference with the provision of humanitarian aid and violates the obligation to respect and to protect persons and objects used for humanitarian relief operations under international humanitarian law.

==Scenario==

===Keywords===
Surveillance, humanitarian assistance, international humanitarian law, computer data, targeting.

===Facts===
'''[F1]''' Neutrality International (NI), an impartial international humanitarian organization, offers a range of humanitarian services digitally, directly to populations affected by armed conflicts across the world. These services – provided on a secure digital platform – include storing peoples’ important and sensitive documents, assisting family reunification, providing digital cash vouchers, and sharing information about when and where aid distributions are taking place. 

'''[F2]''' State A, predominantly of ethnicity X, is engaged in an international armed conflict with State B, whose population is predominantly of ethnicity Y. NI is present and conducts its humanitarian activities in both States A and B, with the consent of both States.

'''[F3]''' Many citizens of State A who are of the minority ethnicity Y have lost contact with their families in State B and seek help from NI to search for their relatives. State A government authorities believe that their citizens of ethnicity Y who have contacts in State B are supporters of State B, and try to identify, capture and interrogate them to have information that may be helpful to suppress any opposition.  

'''[F4]''' Security services of State A hack into NI’s platform and exfiltrate a list of all people in border areas who have activated a “tracing request” to restore links with family members across the border via that platform. 

'''[F5]''' The following day State A’s forces commence arrests of people identified in the hack of NI who are present on State A’s territory. With regard to people identified in State B, they launch targeted strikes against those belonging to State B paramilitary forces and raids to capture others. Among State B’s forces, a rumour starts to spread according to which NI provided the list to State A and cooperated with State A’s intelligence services. State B’s forces freeze all of NI’s humanitarian operations in State B. A team of NI staff who were conducting a humanitarian assessment in a remote area on the territory of State B is arrested by State B paramilitary forces. One NI staff is killed.

===Examples===
*[https://www.teiss.co.uk/united-nations-data-breach/ UN data breach (2019)]
*[https://citizenlab.ca/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/ Surveillance of Civil Society Groups/Ahmed Mansoor (2016)]

==Legal analysis==
''For a general overview of the structure of analysis in this section, see [[Note on the structure of articles]].''

'''[L1]''' The legal analysis of the present scenario examines whether a cyber operation aimed at exfiltrating data from the systems of an impartial humanitarian organization in the context of an international armed conflict, which is subsequently used to target individuals, can constitute an unlawful interference with humanitarian relief operations and violate the obligation to respect and to protect persons and objects used for humanitarian relief operations under international humanitarian law. 

'''[L2]''' This scenario does not consider the question whether the operation in question may qualify as an attack against NI under international humanitarian law. Neither does it consider whether the operation in question may violate the privileges and immunities of the international humanitarian organization or whether it violates the sovereignty of a host State of the organization, such as the State where the servers of the organization are located.

===Disruption of humanitarian activities===
{{#lst:Humanitarian relief operations|Definition}}

'''[L3]''' The operation against NI’s platform is, on the face of it, an information gathering operation aimed to exfiltrate confidential information. A (digital) information gathering operation, as such, and is generally considered not prohibited under IHL as long as it does ‘not violate specific law of war rules’.<ref>United States Department of Defense, ''[https://dod.defense.gov/Portals/1/Documents/pubs/DoD&#x20;Law&#x20;of&#x20;War&#x20;Manual&#x20;-&#x20;June&#x20;2015&#x20;Updated&#x20;Dec&#x20;2016.pdf?ver=2016-12-13-172036-190 Law of War Manual]'' (2016) para 5.26.2; [https://doi.org/10.1017/9781316822524 Tallinn Manual 2.0], commentary to Rule 89, para 5.</ref>

'''[L4]''' Thus, the main question to address under this section is whether State A has violated its IHL obligations with regard to the operations and protection of NI as an impartial humanitarian organization. Specifically, has State A interfered unduly with impartial efforts to provide humanitarian assistance? Were humanitarian relief personnel or consignments not respected or protected by virtue of the authorities hacking into the systems of the humanitarian organization and using exfiltrated data to further their military operations? 

'''[L5]''' According to the facts provided, NI’s activities qualify as impartial humanitarian activities as understood under IHL. The services provided via NI’s platform include humanitarian relief activities, such as providing digital cash vouchers and sharing information about when and where aid distributions are taking place, and humanitarian protection activities, such as storing peoples’ important and sensitive documents on a secure platform and assisting family reunification. These services are humanitarian in nature and, based on the facts given, offered according to needs, as required by the principle of impartiality.

'''[L6]''' When an impartial humanitarian organization is the target of an information gathering operation, it cannot be ignored that its humanitarian work and safety of its staff and belongings are dependent on the trust that parties to an armed conflict and other actors have in it. Trust depends, in particular, on the perception these actors have of the organization’s neutrality, impartiality, and independence, and on a shared understanding that the information the organization collects is used exclusively for humanitarian purposes. Certain international humanitarian organizations indeed base their own security on this aspect.<ref>See, eg, Massimo Marelli, ‘[https://international-review.icrc.org/sites/default/files/reviews-pdf/2021-03/hacking-humanitarians-cyber-security-strategy-international-humanitarian-organizations-913.pdf Hacking humanitarians: Defining the cyber perimeter and developing a cyber security strategy for international humanitarian organizations in digital transformation]’ (2020) 102 (913) International Review of the Red Cross 367.</ref> Another key pillar of the security for such organizations is the political, operational and cultural acceptance by parties to the conflict and affected populations as a neutral, impartial and humanitarian actor.<ref>Philippe Dind, ‘[https://www.icrc.org/en/doc/assets/files/other/secure02_dind.pdf Security in ICRC Field Operations]’ in ''Secure 02'' (Finnish Red Cross 2002) 22; IFRC, ‘[https://ifrcstaysafe.org/ Stay Safe - the International Federation Guide to a Safer Mission]’ (2010) 16–17.</ref> Reference to this has been made by the international community on different occasions and in different fora.<ref>See, eg, 37th International Conference of Data Protection and Privacy Commissioners, ‘[http://globalprivacyassembly.org/wp-content/uploads/2015/02/Resolution-on-Privacy-and-International-Humanitarian-Action.pdf Resolution on Privacy and International Humanitarian Action]’ (27 October 2015) para 5 of the Explanatory Statement; 33rd International Conference of the Red Cross and Red Crescent, ‘[https://rcrcconference.org/app/uploads/2019/12/33IC-R4-RFL-_CLEAN_ADOPTED_en.pdf Res 4: Restoring Family Links While Respecting Privacy, Including as It Relates to Personal Data Protection]’ (2019) preambular para 8 and operative paras 8–11; Swiss Confederation, ‘[https://www.eda.admin.ch/dam/mission-new-york/en/speeches-to-the-un/2020/20200826-new-york-POC-GoF&#x20;PoC&#x20;statement_E.pdf Cyber-Attacks Against Critical Infrastructure]’, statement at the Security Council on behalf of: Australia, Austria, Belgium, Brazil, Canada, Dominican Republic, France, Germany, Indonesia, Ireland, Italy, Ivory Coast, Kuwait, Japan, Liechtenstein, Luxembourg, Netherlands, Norway, Poland, Portugal, Sweden, United Kingdom, Ukraine, Uruguay and Switzerland (26 August 2020).</ref>

'''[L7]''' State A is obliged not to conduct cyber operations that interfere unduly with NI’s impartial efforts to provide humanitarian relief. This prohibition addresses a broader set of cyber operations than those amounting to attacks; it prohibits ‘cyber operations to frustrate or prevent legitimate and impartial relief efforts’.<ref>[https://doi.org/10.1017/9781316822524 Tallinn Manual 2.0], Rule 145; commentary to Rule 145, para 6; see also ibid., commentary to Rule 80, para 4.</ref> In the present scenario, the information gathering operation against NI’s platform and the subsequent use of this specific data to arrest and target persons who had benefitted from NI’s tracing services amounts to an undue interference with NI’s humanitarian relief operations because it makes it impossible for NI to continue its humanitarian operations. It is therefore prohibited under IHL.

'''[L8]''' State A’s conduct may also be considered to violate the obligation to respect and protect humanitarian relief personnel. This obligation aims to safeguard humanitarian relief personnel against a wide range of harm to enable their humanitarian work. It includes a positive obligation of belligerents to protect humanitarian relief personnel against harm. In the present scenario, State B’s conduct would violate that obligation because it should be expected that State B’s conduct undermines the trust in NI and may thereby put humanitarian staff in danger.<ref>See Tilman Rodenhäuser, ‘[https://www.ejiltalk.org/hacking-humanitarians-ihl-and-the-protection-of-humanitarian-organizations-against-cyber-operations/ Hacking Humanitarians? IHL and the protection of humanitarian organizations against cyber operations]’, ''EJIL:Talk!'' (16 March 2020).</ref>

==Checklist==
*Disruption of humanitarian assistance
**Is an organization engaging in activities furthering the purposes of alleviating human suffering and to protect life and health and to ensure respect for the human being, without discrimination?
**Does the cyber operation interfere unduly with the functioning or delivery of humanitarian relief?
**Does the cyber operation violate the obligation to respect and to protect humanitarian relief consignments or personnel?

==Appendixes==

===See also===
*[[Scenario 04: A State’s failure to assist an international organization]]
*[[Scenario 12: Cyber operations against computer data]]
*[[Scenario 13: Cyber operations as a trigger of the law of armed conflict]]
*[[Scenario 20: Cyber operations against medical facilities]]
*[[International humanitarian law (jus in bello)|International humanitarian law]]
*[[Military objectives]]

===Notes and references===
<references />

===Bibliography and further reading===

* Laurent Gisel, Tilman Rodenhauser and Knut Doermann, ‘[https://international-review.icrc.org/articles/twenty-years-ihl-effects-of-cyber-operations-during-armed-conflicts-913 Twenty years on: International humanitarian law and the protection of civilians against the effects of cyber operations during armed conflicts]’ (2020) 102 (913) International Review of the Red Cross 287. 
* ICRC, ‘[http://www.icrc.org/en/download/file/108983/icrc_ihl-and-cyber-operations-during-armed-conflicts.pdf International Humanitarian Law and Cyber Operations during Armed Conflicts: ICRC Position Paper]’ (November 2019). 
* Massimo Marelli, ‘[https://international-review.icrc.org/sites/default/files/reviews-pdf/2021-03/hacking-humanitarians-cyber-security-strategy-international-humanitarian-organizations-913.pdf Hacking humanitarians: Defining the cyber perimeter and developing a cyber security strategy for international humanitarian organizations in digital transformation]’ (2020) 102 (913) International Review of the Red Cross 367.
* Tilman Rodenhäuser, ‘[https://www.ejiltalk.org/hacking-humanitarians-ihl-and-the-protection-of-humanitarian-organizations-against-cyber-operations/ Hacking Humanitarians? IHL and the protection of humanitarian organizations against cyber operations]’, ''EJIL:Talk!'' (16 March 2020).
* Michael Schmitt (ed), ''[https://doi.org/10.1017/9781316822524 Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations]'' (CUP 2017). 

===Contributions===
* Scenario by: [[People#Scenario_authors|Massimo Marelli]] & [[People#Scenario_authors|Tilman Rodenhäuser]]
* Analysis by: [[People#Scenario_authors|Massimo Marelli]] & [[People#Scenario_authors|Tilman Rodenhäuser]]
* Reviewed by: [[People#Peer_reviewers|Russell Buchan]]; [[People#Peer_reviewers|Tristan Ferraro]]; [[People#Peer_reviewers|Laurent Gisel]]; [[People#Peer_reviewers|Tsvetelina van Benthem]]

{| class="wikitable"
|+
|Previous: [[Scenario 24: Internet blockage]]
|Next: [[Scenario 26: Export licensing of intrusion tools]]
|}

[[Category:Scenario]]
[[Category:Surveillance]]
[[Category:Humanitarian assistance]]
[[Category:International humanitarian law]]
[[Category:Computer data]]
[[Category:Targeting]]