International armed conflict

Definition

International armed conflict

The law of international armed conflict (IAC) applies to any armed confrontation between two or more States, even if one, several, or all of them deny the existence of an armed conflict. Some scholars have suggested that the fighting must be of a certain intensity before international humanitarian law (IHL) comes into effect, but the prevailing view is that any “resort to armed force between States”, however brief or intense, triggers the application of IHL. Furthermore, the law does not prescribe any specific form for the resort to force, so hostilities between the belligerent States may involve any combination of kinetic and cyber operations, or cyber operations alone. It is unclear what effect cyber operations unaccompanied by any use of kinetic force would have to have in order for IHL to apply. Although it seems generally accepted that if cyber operations have similar effects to classic kinetic operations and two or more States are involved, the resulting situation would qualify as an IAC, the law is unsettled on whether cyber operations that merely disrupt the operation of military or civilian infrastructure amount to a resort to armed force for the purposes of IHL. In the cyber context, States often act through non-State intermediaries and proxies. In such situations at the outset of an armed confrontation, the relevant State must exercise a sufficient degree of control over the non-State entity that commences hostilities against another State for the situation to qualify as an IAC. However, the correct legal test to use in this regard is the subject of an ongoing controversy. The prevailing standard for the characterization of an international armed conflict is that of “overall control”, which requires that the State provides some support and that it participates in the organization, co-ordination, or planning of the relevant operations. A separate standard, the “effective control” test, requires that the State must exercise control over the entire course of the operations in question. While there is still disagreement as to whether the “effective control” test is the controlling test for the purposes of attribution under the law of State responsibility, there is consensus that the “overall control” test is the correct one for conflict qualification under IHL. The latter is also confirmed by decades of consistent practice by international criminal tribunals including the ICTY, the ECCC, and the ICC. Publicly available national positions that address this issue include: (2024), (2024), (2023), (2020), (2019), (2021), (2023), (2021).

National positions

African Union (2024)

"48. [...] IHL recognizes two categories of armed conflict: international armed conflicts, in which the parties are States that are engaged in hostilities using armed force, [...]

49. In an international armed conflict, the application of IHL commences whenever armed force is used between States regardless of the intensity of such activities. The application of IHL to an international armed conflict is unaffected by either the absence of a formal declaration of war or by the assessment of the legality, under the applicable rules of the U.N. Charter, of the use of force by the belligerent States. [...]"

Austria (2024)

Key Position
"International armed conflicts (IAC) and non-international armed conflicts (NIAC) may be partially or entirely conducted through cyber activities."

"An international armed conflict (IAC) is characterized by armed hostilities between two or more states. A non-international armed conflict (NIAC) is characterized by protracted armed hostilities between the armed forces of a state and organized non-state armed groups or among such groups. Armed hostilities in the context of an IAC exist whenever there is “resort to armed force between States”. As such, an IAC is, in any case, triggered where cyber activities between states cause physical effects similar to those of kinetic means such as destruction, death or injury."

Example

"Example 1: State A launches a cyber activity against the power grid of state B, which causes the power grid to collapse. The collapse entails foreseeable complications in medical and humanitarian facilities, leading to the death of a significant amount of persons. Example 2: State B conducts a cyber activity against state A to open the floodgates of a water reservoir in state A, and which results in a foreseeable flood causing significant damage to property and civilian casualties in state A. Both above-mentioned examples trigger an IAC."

"A NIAC exists when there are protracted armed hostilities between government authorities and organized armed groups, or between such armed groups, within a state. Thus, to qualify as a NIAC, the violence must reach a level of intensity, and the armed groups must have a minimum degree of organization. Provided these requirements are fulfilled, cyber activities by themselves are sufficient to trigger a NIAC."

Costa Rica (2023)

"42. [...] An international armed conflict comes to existence ‘whenever there is a resort to armed force between States’. In Costa Rica’s view, this includes the use of cyber operations by one State against another State, as long as those operations have effects comparable to classic kinetic operations. For example, a cyber operation by one State designed or expected to cause an industrial facility located in another State to catch fire, resulting in human and material loss, could bring into existence an international armed conflict as defined under Article 2 common to the Geneva Conventions and such cyber operation would be subject to IHL."

Finland (2020)

"International humanitarian law only applies to cyber operations when such operations are part of, or amount to, an armed conflict. Most so far known cyberattacks have not been launched in the context of an armed conflict or met the threshold of armed conflict. At the same time, when cyber means are used in the context of a pre-existing armed conflict, as has been done in many current conflicts, there is no reason to deny the need for the protections that international humanitarian law provides. This includes that cyber means and methods of warfare must be used consistently with the principles of distinction, proportionality and precautions, as well as the specific rules flowing from these principles. When assessing the capacity of cyber means and methods to cause prohibited harm, their foreseeable direct and indirect effects shall be taken into account. Constant care shall be taken to ensure the protection of civilians and civilian objects, including essential civilian infrastructure, civilian services and civilian data.

The unique characteristics of cyberspace, such as interconnectedness and anonymity, may affect how international humanitarian law is interpreted and applied with regard to certain cyber means and methods warfare. The related problems can nevertheless mostly be solved on the basis of existing rules. New technologies do not render the existing rules of international humanitarian law meaningless or necessarily require new legal regulation. Furthermore, while international humanitarian law is lex specialis in an armed conflict, it does not override other areas of international law, such as human rights law, which may continue to apply throughout the conflict."

France (2019)

Cyberoperations that constitute hostilities between two or more States may characterise the existence of international armed conflict (IAC). Likewise, prolonged cyberoperations by government armed forces against one or more armed groups or by several armed groups between themselves may constitute a non-international armed conflict (NIAC), where such groups show a minimum level of organisation and the effects of such operations reach a sufficient threshold of violence. They are generally military operations concurrent with conventional military operations: that is why it is not difficult to categorise an armed conflict situation. While an armed conflict consisting exclusively of digital activities cannot be ruled out in principle, it is based on the capacity of autonomous cyberoperations to reach the threshold of violence required to be categorised as such. Although virtual, cyberoperations still fall within the geographical scope of IHL, insofar as their effects must arise on the territory of the States party to the IAC and on the territory where the NIAC hostilities occur.

Germany (2021)

"Germany reiterates its view that IHL applies to cyber activities in the context of armed conflict. The fact that cyberspace as a domain of warfare was unknown at the time when the core treaties of IHL were drafted does not exempt the conduct of hostilities in cyberspace from the application of IHL. As for any other military operation, IHL applies to cyber operations conducted in the context of an armed conflict independently of its qualification as lawful or unlawful from the perspective of the ius ad bellum.

An international armed conflict – a main prerequisite for the applicability of IHL in a concrete case – is characterized by armed hostilities between States. This may also encompass hostilities that are partially or totally conducted by using cyber means. Germany holds the view that cyber operations of a non-international character, e.g. of armed groups against a State, which reach a sufficient extent, duration, or intensity (as opposed to acts of limited impact) may be considered a non-international armed conflict and thereby also trigger the application of IHL.

At the same time, cyber actions can become part of an ongoing armed conflict. In order to fall within the ambit of IHL, the cyber operation must show a sufficient nexus with the armed conflict, i.e. the cyber operation must be conducted by a party to the conflict against its opponent and must contribute to its military effort.

Cyber operations between a non-State actor and a State alone may provoke a non-international armed conflict. However, this will only seldom be the case due to the level of intensity, impact and extent of hostilities required. Thus, activities such as a large-scale intrusion into foreign cyber systems, significant data theft, the blocking of internet services and the defacing of governmental channels or websites will usually not singularly and in themselves bring about a non-international armed conflict."

"The basic principles governing the conduct of hostilities, including by cyber means, such as the principles of distinction, proportionality, precautions in attack and the prohibition of unnecessary suffering and superfluous injury, apply to cyber attacks in international as well as in non-international armed conflicts."

Ireland (2023)

"30. Cyber operations that have similar effects to physical military operations constituting armed force will bring into existence an international armed conflict if conducted between states, and can bring into existence a non-international armed conflict if the usual criteria are satisfied, namely that the violence has reached the requisite level of intensity and that it is between at least two organised parties."

Japan (2021)

"International humanitarian law is also applicable to cyber operations.

In situations of armed conflict, the methods and means of warfare used by the parties to the conflict are subject to regulations under international humanitarian law. This extends to cyber operations implemented by the parties to the conflict. Several principles under international humanitarian law, including the principle of humanity, necessity, proportionality and distinction, are also applicable to acts in cyberspace. In paragraph 28(d) of the 2015 GGE report, those principles are referred to as "established international legal principles." This reference, considered together with the fact that this report affirms the applicability of existing international law, can be interpreted to affirm the applicability of those principles.

[..] In principle, the existence of an "armed conflict" is a prerequisite for the application of international humanitarian law. Under the Geneva Conventions, there is no particular definition of an "armed conflict," and therefore, whether or not a certain incident constitutes an "armed conflict" needs to be decided on a case-by-case basis, taking into account a number of elements, such as the manner of the actual attack and the intent of each party to the incident, in a comprehensive manner. If the effects of cyber operations are taken into consideration, the conduct of cyber operations alone may reach the threshold of an "armed conflict."

As affirming the applicability of international humanitarian law to cyber operations contributes to the regulation of methods and means of warfare, the argument that doing so will lead to the militarization of cyberspace is groundless.[...] On the other hand, modes of combat in cyberspace are different from those in traditional domains. Therefore, how international humanitarian law regarding, for example, the scope of combatants applies to cyberspace should be further discussed."

Appendixes

See also

• Non-international armed conflict
• International humanitarian law (jus in bello)
• Scenario 13: Cyber operations as a trigger of the law of armed conflict
• Scenario 15: Cyber deception during armed conflict
• Scenario 16: Cyber attacks against ships on the high seas
• Scenario 18: Legal status of cyber operators during armed conflict