View source for Scenario 10: Legal review of cyber weapons

[[File:Cyberweapon.jpg|thumb|© Reeh. Licensed from Shutterstock.]]
State A develops new malware capable of physical destruction of enemy military equipment. However, if released, it is also expected to result in the temporary impairment of the use of civilian cyber infrastructure through which it may spread in order to reach its target. This scenario considers State obligations to conduct a weapons review with respect to cyber capabilities of this kind potentially already in peacetime, well before they may actually be deployed in time of armed conflict. In particular, it examines whether such malware constitutes a weapon that is inherently indiscriminate and therefore prohibited by IHL. 

== Scenario ==

=== Keywords ===
Article 36, cyber weapons, indiscriminate attack, international humanitarian law, malware, methods and means of warfare, weapons review, Stuxnet 

=== Facts ===
'''[F1]''' State A develops new sophisticated malware designed to weaken the military capacity of its adversaries in times of armed conflict. The software is capable of replicating itself through cyber infrastructure.

'''[F2]''' Once installed in a host system, the malware assesses it for the presence of a specific [[Glossary#PLC|programmable logic controller (PLC)]] used by several States for the purposes of automated maintenance of military equipment. If it does not detect this specific PLC in a given host system, it attempts to further spread through any connected networks and then it shuts itself down in that particular host system. However, if the detection is positive, the malware uses a vulnerability in the PLC to slightly alter the maintenance process.

'''[F3]''' The effect of this alteration is that instead of servicing the equipment in question, the maintenance machines damage it and thus render it unusable. Tests in controlled environment show that whenever the malware is installed in a host system, it causes it to significantly slow down for a short period of time. However, it is not expected to cause physical damage unless the target PLC is detected in a specific host system.

=== Examples ===
* [[Industroyer – Crash Override (2016)]]
* [[Stuxnet (2010)]]
* [[Use of malware to track and target Ukrainian artillery units (2014-2016)]]

== Legal analysis ==
''For a general overview of the structure of analysis in this section, see [[Note on the structure of articles]].''

'''[L1]''' The analysis in this scenario examines State obligations to conduct a legal review with respect to cyber capabilities they may develop or acquire. In the first place, it considers whether malware capable of physical destruction qualifies as a weapon, means or method of warfare. This is especially significant because classifying a capability as a weapon, means or method of warfare means that its employment must comply with the relevant rules of IHL. The analysis then focusses on the question whether such malware would be considered as inherently indiscriminate and therefore prohibited by IHL. 
{{#lst:Legal review of cyber weapons|Definition}}
'''[L2]''' In the present scenario, the malware developed by State A would qualify as a “cyber weapon” due to its ability to produce physical destruction, which is an effect that qualifies as “violence against the adversary”.<ref>Art 49(1) [https://ihl-databases.icrc.org/applic/ihl/ihl.nsf/Treaty.xsp?documentId=D9E6B6264D7723C3C12563CD002D6CE4&action=openDocument AP I].</ref> State A would accordingly be under a duty to ensure that the use of this malware complies with its international obligations. This is so irrespective of whether State A is currently involved in any armed conflict or not. If State A has ratified Additional Protocol I, its duties would additionally extend to conducting a legal review to determine if the employment of the malware would be in compliance with all applicable rules of international law.

'''[L3]''' There is no indication that the malware’s employment would cause any injury to persons, thus rendering inapplicable the rules on superfluous injury or unnecessary suffering.<ref>Although it is unusual for cyber capabilities to implicate the prohibition of superfluous injury or unnecessary suffering, it is not wholly inconceivable. Cf. [https://doi.org/10.1017/9781316822524 Tallinn Manual 2.0], commentary to rule 104, para 6 (proposing, in this regard, the example of remotely taking control of a target’s pacemaker device to stop his “heart and then reviving him multiple times before finally killing him”).</ref> 

'''[L4]''' By contrast, the fact that the malware is not designed to distinguish between civilian and military infrastructure while en route to its intended target raises questions of its compatibility with the prohibition of inherently indiscriminate means and methods of warfare. A weapon is inherently indiscriminate if it is of a nature to strike military objectives and civilian objects without distinction, because it either (1) cannot be directed at a specific military objective,<ref>Art 51(4)(b) [https://ihl-databases.icrc.org/applic/ihl/ihl.nsf/Treaty.xsp?documentId=D9E6B6264D7723C3C12563CD002D6CE4&action=openDocument AP I].</ref> or (2) its effects cannot be limited as required by IHL.<ref>Art 51(4)(c) [https://ihl-databases.icrc.org/applic/ihl/ihl.nsf/Treaty.xsp?documentId=D9E6B6264D7723C3C12563CD002D6CE4&action=openDocument AP I].</ref> 

'''[L5]''' State A’s malware appears not to fall into the first category given that it is specifically designed to target the PLCs controlling military equipment, which would normally qualify as a military objective under IHL.<ref>See Art 52(2) [https://ihl-databases.icrc.org/applic/ihl/ihl.nsf/Treaty.xsp?documentId=D9E6B6264D7723C3C12563CD002D6CE4&action=openDocument AP I] (“In so far as objects are concerned, military objectives are limited to those objects which by their nature, location, purpose or use make an effective contribution to military action and whose total or partial destruction, capture or neutralization, in the circumstances ruling at the time, offers a definite military of advantage.”).</ref>
 
'''[L6]''' However, with respect to the second category, it is material that the effects of the malware are not limited solely to the intended military objective and, moreover, that these effects are not wholly under State A’s control. Once released, the malware can spread through civilian infrastructure and can be expected to temporarily impair the ordinary use of infected civilian host systems. Accordingly, State A must assess the extent of the effects on the civilian cyber infrastructure caused by the malware if it was used in a normal way, as anticipated at the time of the evaluation.<ref>Yves Sandoz, Christophe Swinarski and Bruno Zimmermann (eds), [https://ihl-databases.icrc.org/applic/ihl/ihl.nsf/Comment.xsp?action=openDocument&documentId=73ED2A33F274494CC12563CD00430247 ''Commentary on the Additional Protocols of 8 June 1977 to the Geneva Conventions of 12 August 1949''] (ICRC 1987) 423 para 1466.</ref> Overall, the assessment must take into account all relevant circumstances and the reasonable expectations of the deploying State.<ref>[https://doi.org/10.1017/9781316822524 Tallinn Manual 2.0], commentary to rule 104, para 5.</ref>

'''[L7]''' What is crucial is whether these effects would, if considered on their own, amount to attacks against the affected cyber infrastructure. As long as they do not exceed mere inconvenience or annoyance to the users, from the perspective of IHL they would remain below the threshold of attack.<ref>See Humanitarian Policy and Conflict Research, [https://doi.org/10.1017/CBO9781139525275 ''Manual on International Law Applicable to Air and Missile Warfare''] (CUP 2013) rule 1(e), commentary para 7 (‘the term “attack” does not encompass [cyber operations] that result in an inconvenience’); Michael N Schmitt, [https://www.icrc.org/en/doc/assets/files/other/365_400_schmitt.pdf ‘Wired Warfare: Computer Network Attack and ''Jus in Bello''’] (2002) 84 IRRC 365, 377 (arguing that “inconvenience, harassment or mere diminishment in quality of life” does not qualify as a violent consequence that would bring an act within the ambit of “attack” under IHL); Cordula Droege, [https://doi.org/10.1017/S1816383113000246 ‘Get Off My Cloud: Cyber Warfare, International Humanitarian Law, and the Protection of Civilians’] (2012) 94 IRRC 533, 560 (acknowledging the merits of the argument according to which a cyber operation that causes mere inconvenience cannot amount to an attack).</ref> Consequently, the normal and expected use of the weapon would not involve attacks against civilian objects, and therefore the weapon would not be of a nature to strike military objectives and civilian objects without distinction.<ref>See also [https://doi.org/10.1017/9781316822524 Tallinn Manual 2.0], commentary to rule 105, para 5 (considering that “Stuxnet-like malware that spreads widely into civilian systems, but only damages specific enemy technical equipment” would not violate this prohibition).</ref> By contrast, if the spread of the malware would inevitably cause harm exceeding the threshold of attack in the civilian networks through which it propagates, it would violate this prohibition.<ref>[https://doi.org/10.1017/9781316822524 Tallinn Manual 2.0], commentary to rule 105, para 4.</ref> 

'''[L8]''' In addition, the State should assess the effectiveness of safeguards built into the malware that would enable it to control its spread once deployed. For example, the malware could be designed to include a “[[Glossary#Kill switch|kill switch]]” which, if activated, immediately stops the malware from spreading further. The presence of an effective “kill switch” ensures that the attacker remains capable of limiting the effects of the malware in particular circumstances if the need arises—for instance, if the malware starts spreading in a way that was not anticipated by its authors. In other words, such a safeguard will enable the attacker to limit the indiscriminate effects of the cyber weapon in case it malfunctions or operates in an unexpected manner.<ref>See also ICRC, [https://shop.icrc.org/avoiding-civilian-harm-from-military-cyber-operations-during-armed-conflicts-icrc-expert-meeting-21-22-january-2020-geneva-pdf-en ''Avoiding Civilian Harm from Military Cyber Operations during Armed Conflicts''] (ICRC 2021) 30 (recommending the use of kill switches in the development of military cyber capabilities to reduce the risk of civilian harm posed by such capabilities).</ref> Its presence may further bolster the conclusion that the malware developed by State A is not indiscriminate by nature.<ref>Cf. also [https://doi.org/10.1017/9781316822524 Tallinn Manual 2.0], commentary to rule 105, para 4 (“To the extent the effects of the means or method of warfare can be limited in particular circumstances, it does not violate [this prohibition].”).</ref> 

== Checklist ==
* Is the State in question a State party to Additional Protocol I?
* Does the malware qualify as a weapon under IHL?
* Does the malware violate any specific international law prohibition on its use?
* Is the malware capable of causing injury to persons? If so, is it of a nature to cause superfluous injury or unnecessary suffering?
* Is the malware by nature indiscriminate?
* What is the probability that the target PLC would be accidentally discovered in a non-military host system?
* Does the malware contain a “kill switch” which, if activated, would stop the malware from spreading further?

== Appendixes ==

=== See also ===
* [[Scenario 12: Cyber operations against computer data]]
* [[Scenario 13: Cyber operations as a trigger of the law of armed conflict]]
* [[Scenario 22: Cyber methods of warfare]]

=== Notes and references ===
<references />

=== Bibliography ===
* Steven Bellovin, Susan Landau and Herbert Lin, ‘[https://academic.oup.com/cybersecurity/article/3/1/59/3097802 Limiting the Undesired Impact of Cyber Weapons: Technical Requirements and Policy Implications]’ (2017) 3(1) Journal of Cybersecurity 59.
* Jeffrey T Biller and Michael N Schmitt, ‘[https://digital-commons.usnwc.edu/cgi/viewcontent.cgi?article=2462&context=ils Classification of Cyber Capabilities and Operations as Weapons, Means, or Methods of Warfare]’ (2019) 95 Int’l L Stud 179.
* Duncan Blake and Joseph Imburgia, ‘[https://ssrn.com/abstract=1850831 “Bloodless Weapons”? The Need to Conduct Legal Review of Certain Capabilities and the Implications of Defining Them as “Weapons”]’, (2010) 66 Air Force Law Review 157.
* William H Boothby, ''Weapons and the Law of Armed Conflict'' (OUP 2016).    
* Vincent Boulanin and Maaike Verbruggen, [https://www.sipri.org/sites/default/files/2017-12/article_36_report_1712.pdf <i>Article 36 Reviews: Dealing with the Challenges Posed by Emerging Technologies</i>] (SIPRI 2017).
* Gary Brown and Andrew Metcalf, ‘[http://jnslp.com/wp-content/uploads/2014/02/Easier-Said-than-Done.pdf Easier Said Than Done: Legal Reviews of Cyber Weapons]’ (2014) 7 Journal of National Security Law & Policy 115.
* Robin Geiss, ‘The Obligation to Respect and to Ensure Respect for the Conventions’ in Andrew Clapham, Paola Gaeta and Marco Sassòli (eds), ''The 1949 Geneva Conventions: A Commentary'' (OUP 2015).
* ICRC, [https://e-brief.icrc.org/wp-content/uploads/2016/09/12-A-Guide-to-the-Legal-Review-of-New-Weapons.pdf ''A Guide to the Legal Review of New Weapons, Means and Methods of Warfare: Measures to Implement Article 36 of Additional Protocol I of 1977''] (Kathleen Lawand ed.) (ICRC 2006).
* Michael N Schmitt (ed), ''[https://doi.org/10.1017/9781316822524 Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations]'' (CUP 2017).
* David Wallace, ‘[https://ccdcoe.org/uploads/2018/10/TP-11_2018.pdf Cyber Weapon Reviews under International Humanitarian Law: A Critical Analysis]’ (2018) Tallinn Paper No. 11.

<!-- NOTES ON FURTHER SOURCES/BACKGROUND 
=== Further reading ===
Articles giving background on automated applications in the military – i.e. devices/processes that may be hacked:
*A Lowne, ‘[http://archive.cotsjournalonline.com/articles/view/103828 Automated Test Solves Maintenance Issues for Military Vehicles]’ COTS Journal (January 2014)
*Association for Advancing Automation, ‘[https://www.a3automate.org/how-automation-for-military-impacts-industrial-automation/ How Automation for Military Impacts Industrial Automation]’ (undated)

-->

=== Contributions ===
* Scenario by: [[People#Editorial_board|Kubo Mačák]]
* Analysis by: [[People#Editorial_board|Kubo Mačák]]
* Reviewed by: [[People#Peer_reviewers|Jakub Harašta]]; [[People#Peer_reviewers|David Wallace]]; [[People#Peer_reviewers|Wen Zhou]]

{| class="wikitable"
|+
|Previous: [[Scenario 09: Economic cyber espionage|Scenario 09: Economic espionage]]
|Next: [[Scenario 11: Sale of surveillance tools in defiance of international sanctions|Scenario 11: Surveillance tools]]
|}
[[Category:Article 36]]
[[Category:Cyber weapons]]
[[Category:Indiscriminate attack]]
[[Category:International humanitarian law]]
[[Category:Malware]]
[[Category:Methods and means of warfare]]
[[Category:Stuxnet]]
[[Category:Weapons review]]
[[Category:Legal review of cyber weapons]]
[[Category:Scenario]]