Scenario 15: Cyber deception during armed conflict

From International cyber law: interactive toolkit
Jump to navigation Jump to search
(C) 3dfactory, Shutterstock.

Two States are involved in an armed conflict. In order to facilitate the launch of a major military offensive, one of the States engages in several cyber deception operations against the other State. The analysis in this scenario considers whether the operations comply with the relevant rules of international humanitarian law, including the prohibition of perfidy and the prohibition on improper use of internationally recognized emblems, signs, and signals.

1 Scenario[edit | edit source]

1.1 Keywords[edit | edit source]

International armed conflict, international humanitarian law, methods and means of warfare, misuse of indicators, perfidy, ruses of war

1.2 Facts[edit | edit source]

[F1] States A and B are involved in ongoing armed hostilities involving the use of kinetic as well as cyber operations. State A is preparing to launch a major military offensive against State B in region R, which is currently under the control of State B’s forces led by commander X. In order to distract and weaken the enemy, State A’s cyber command engages in several discrete deception operations against State B.

[F2] State A’s operatives set up a complex layered set of fake digital platforms built to lure State B’s cyber operatives to attempt to penetrate State A’s secure military networks (incident 1). Although the systems look authentic, they are entirely separate from State A’s actual networks. State B’s cyber command spends a considerable amount of time and resources trying to compromise the fake systems. Every time State B’s operatives gain access to a layer of the deceptive platform, they are led to another authentic-appearing environment, losing more time. In the meantime, State B’s cyber command fails to effectively defend against simultaneous hostile cyber operations launched by State A, which are detailed below.

[F3] State A discovers that commander X is a diabetic patient who uses a type of insulin pump that allows a healthcare provider to deliver the commander’s insulin doses through a wireless communications system (i.e., a remote control). State A’s cyber operatives hack into the pump’s communications system, take over the remote control by using malware that authenticates itself as a legitimate third-party medical provider with insulin dosage permissions, and administer an overdose of insulin to commander X, which leads to X’s death (incident 2). As a result, the operation accomplishes its main goal of killing the commander.

[F4] State A hacks into the online systems used by the International Committee of the Red Cross (ICRC) to run a humanitarian assistance mobile app called “e-Red Cross” and relied on by persons affected by the armed conflict in region R. State A’s operatives then send a message through the app to all users, which falsely claims that the ICRC will distribute humanitarian aid next to the only bridge connecting two sides of a major river in region R (incident 3). The operation accomplishes its intended purpose, which was to facilitate State A’s forces to attack State B’s forces. Due to the hack, thousands of civilians obstruct the bridge, preventing State B’s forces from being able to cross the river for several hours, thereby making it impossible for State B to send reinforcements to defend against State A’s deadly attack on State B’s forces on the other side of the river.

[F5] Finally, State A’s armed forces use artillery to begin an operation to take control of a small town that State B currently controls and is using as a location for a forward operating base. Knowing that State B would likely call in close air support to supress State A’s ground assault, State A hacked into State B’s force tracking system prior to the operation. As State A advances on the small town, State A manipulates the data on State B’s system to swap the two States’ indicators, thus making State B’s forces to appear to be State A’s forces, and vice versa (incident 4). When State B’s forward air controller calls in air support, the controller provides the pilots with accurate information regarding the position of State A’s advancing troops. But the conflicting information that the pilots receive from the hacked force tracking system make the pilots suspend the attack in accordance with their rules of engagement. As a result, State B fails to supress both State A’s artillery and commando’s manoeuvring into the town, resulting in significant casualties among State B’s forces.

1.3 Examples[edit | edit source]

2 Legal analysis[edit | edit source]

For a general overview of the structure of analysis in this section, see Note on the structure of articles.

[L1] The analysis in this scenario begins by establishing that a situation of an international armed conflict exists between States A and B and that, accordingly, international humanitarian law (IHL) applies to the relevant incidents. On that basis, the analysis then considers whether any of the incidents constitutes, first, a violation of the prohibition of perfidy; and, second, a violation of the prohibition on improper use of internationally recognized emblems, signs, and signals.

2.1 Application of IHL[edit | edit source]

International armed conflict
International armed conflict.svg
The law of international armed conflict (IAC) applies to any any armed confrontation between two or more States.[1] No matter how short-lived or minor, any hostilities between the armed forces of two States constitute an international armed conflict, even if one or both states deny the existence of armed conflict.[2] Some scholars have suggested that the fighting must be of a certain intensity before international humanitarian law (IHL) comes into effect,[3] but the prevailing view is that any “resort to armed force between States”,[4] however brief or intense, triggers the application of IHL.[5] Furthermore, the law does not prescribe any specific form for the resort to force,[6] so hostilities between the belligerent States may involve any combination of kinetic and cyber operations, or cyber operations alone.[7]

It is unclear what effect cyber operations unaccompanied by any use of kinetic force would have to have in order for IHL to apply. Although it is generally accepted that if cyber operations have similar effects to classic kinetic operations and two or more State actors are involved, the resulting situation would qualify as an IAC,[8] the law is unsettled on whether cyber operations that merely disrupt the operation of military or civilian infrastructure amount to a resort to armed force for the purposes of IHL.[9]

In the cyber context, States often act through non-State intermediaries and proxies. In such situations at the outset of an armed confrontation, the relevant State must exercise a sufficient degree of control over the non-State entity that commences hostilities against another State for the situation to qualify as an IAC. However, the correct legal test to use in this regard is the subject of an ongoing controversy.[10] The prevailing standard for the characterization of an international armed conflict is that of “overall control”, which requires that the State provides some support and that it participates in the organization, co-ordination, or planning of the relevant operations.[11] A separate standard, the “effective control” test, requires that the State must exercise control over the entire course of the operations in question.[12] While there is still disagreement as to whether the “effective control” test is the controlling test for the purposes of attribution under the law of State responsibility, there is consensus that the “overall control” test is the correct one for conflict qualification under IHL.[13] The latter is also confirmed by decades of consistent practice by international criminal tribunals including the ICTY, the ECCC, and the ICC.[14]

[L2] In the present scenario, the existence of ongoing armed hostilities between States A and B necessitates the qualification of the situation as an international armed conflict between those States. As a consequence, all acts of the belligerent parties with a nexus to that armed conflict are governed by IHL.[15]

2.2 Perfidy and ruses of war[edit | edit source]

Perfidy and ruses of war
Perfidy+ruses-of-war.svg
The prohibition of perfidy, as defined in AP I, covers the killing, injuring or capturing of an adversary by resort to acts inviting the confidence of an adversary to lead him to believe that he is entitled to, or is obliged to accord, protection under the rules of international law applicable in armed conflict, with intent to betray that confidence.[16] Although the prohibition is generally understood to exist also under customary international law, not all of its elements are universally considered to have crystallized into custom. In particular, opinions diverge on whether the customary prohibition covers capturing enemy personnel: for example, the US takes the narrower view that it does not,[17] while the ICRC has taken the opposite broader view.[18]

Accordingly, in order for a cyber operation to qualify as prohibited perfidy under customary international law, it must simultaneously meet the following four conditions:

  1. The operation must relate to a protection enjoyed by a particular person, object or activity, that is specifically provided for in IHL (i.e., protection afforded on the basis of moral considerations, or norms of other bodies of law does not suffice);[19]
  2. The operation must invite the confidence of the adversary that he or she is entitled to, or must accord, protection under IHL;[20]
  3. The perpetrator must intentionally betray the confidence of the adversary;[21]
  4. The act must result in the prohibited effect of the adversary’s death or injury (or for the proponents of the broader view above, capture).[22] Cyber operations, the effect of which only occurs in cyberspace or is limited to damaging or destroying material property, are not covered by the prohibition.[23]

The prohibition of perfidy applies in both international and non-international armed conflicts.[24]

Cyber operations which rely on deception to mislead the adversary, but which do not infringe any rule of IHL nor do they invite the confidence of the adversary with respect to protection under IHL, qualify as lawful ruses of war.[25] Ruses of war are considered a permissible method of warfare and include the use of camouflage, decoys, mock operations, and misinformation.[26]

[L3] The deception employed in incident 1 involves State A setting up fake digital platforms to dissimulate its real military systems and networks with the purpose of luring the enemy into spending time and resources to penetrate the fake platforms. This is a decoy technique commonly referred to as a “honeynet”.[27] When assessed against the conditions that make up the prohibition of perfidy, State A’s conduct did not implicate any specific protection under IHL (condition 1); in fact, the fake systems were ostensibly of a military nature and as such they would not be subject to protection under IHL even if they were real. Rather, State A’s use of fake digital platforms qualified as a ruse that made lawful use of decoys, mock operations, and misinformation in cyberspace.[28] Accordingly, incident 1 did not violate the prohibition of perfidy.

[L4] IHL affords special status to medical services and facilities, namely that they must be respected and protected at all times and must not be the object of attack.[29] In incident 2, State A’s cyber operators feigned the role of a third-party medical service provider with the purpose of killing an enemy commander. When assessed against the conditions of perfidy, State A has thus used the protected status of a medical provider (condition 1) and, as a result of its actions, an adversary combatant was deprived of his life (condition 4). It is less clear, however, whether this operation has implicated the adversary’s confidence (relevant for conditions 2 and 3). Crucially, no human judgment was involved on the side of State A’s adversary (whether that of commander X himself or of any other person belonging to State B), and thus, strictly speaking, no human was in fact deceived by the operation. Accordingly, the legal qualification of this incident depends on the scope of the notion of confidence for the purposes of IHL. In this regard, some experts are of the view that gaining the confidence of an enemy’s computer system suffices to breach the prohibition.[30] On that view, the operation would have invited and betrayed the confidence of the adversary’s insulin pump communications system and, consequently, the incident would have amounted to a violation of the prohibition of perfidy. By contrast, others consider that the notion of confidence requires human involvement.[31] According to that view, the operation cannot be said to have implicated the adversary’s confidence and, as such, the incident would not have amounted to prohibited perfidy.

[L5] Incident 3 involves State A’s use of an “e-Red Cross” humanitarian mobile app to convince civilians to obstruct State B’s forces from crossing a bridge. The operation intentionally interferes with State B’s ability to send reinforcements to defend against State A’s attack. The resulting deaths and injuries suffered by State B—which were the purpose of the operation and which would not have occurred but for the operation itself—therefore arguably meet the requisite criteria for harm (condition 4). However, the “e-Red Cross” communication did not invite or betray the confidence of an adversary (conditions 2 and 3)—at most, it might have invited and betrayed the confidence of the civilian population. Incident 3 is therefore missing some of the required elements of perfidy and, as such, it would not constitute a breach of the prohibition of perfidy. Nevertheless, the incident raises issues with respect to the misuse of established indicators (see paras L8–L9 below) and it could also be assessed against other applicable rules of IHL.[32]

[L6] Incident 4 invinvolves State A using digital misrepresentations of both States’ armed forces in an electronic force tracking system to favour State A’s offensive military operation by impeding State B’s military response. When assessing the conditions for perfidy, it would have to be established that State A intentionally invited and betrayed the confidence of its adversary (conditions 2 and 3) related to a rule under IHL that would provide for protection (condition 1) with the purpose of causing casualties to State B’s armed forces (condition 4). While IHL prohibits making belligerent use of the enemy’s “emblems of nationality”, which include flags, military emblems, insignia and uniforms,[33] IHL does not provide armed forces with a legal protection against fratricide.[34] Incident 4 therefore does not involve the invitation or betrayal of an adversary’s confidence that would have arisen from a protection provided for in IHL and, as such, does not amount to a prohibited form of perfidy. As discussed below (see paras L10–L14), it can be debated whether the use of a digital representation of the enemy amounts to the use of the enemy’s “emblems of nationality”.[35]

2.3 Misuse of established indicators[edit | edit source]

Misuse of established indicators
Misuse-of-established-indicators.svg
Under IHL, parties to an armed conflict are prohibited to make improper use of internationally recognized emblems, signs, and signals, including the distinctive emblem of the red cross or red crescent, the white flag of truce, the protective emblem of cultural property, and the distinctive emblem of the United Nations (UN).[36] Internationally recognized distress signals such as those established by the International Telecommunications Union and the International Civil Aviation Organization are also included in the scope of this prohibition.[37]

Improper use in this context means any use other than that for which these emblems, signs, and signals were intended.[38] For instance, the purpose of the white flag of truce is to communicate an intent to negotiate; therefore, any other use, such as to gain a military advantage over the enemy, would be improper and unlawful.[39] In relation to the distinctive emblem of the UN, improper use refers to any use unauthorized by the UN.[40] The object and purpose of the prohibitions of improper use is to preserve the trust that these indicators inspire.[41]

The relevant rules are absolute in nature, which means that any improper use is forbidden, not merely conduct that is covered by the prohibition of perfidy.[42]

IHL also prohibits the improper use of the emblems of nationality of the enemy during an international armed conflict.[43] In this regard, the exact meaning of “improper use” is unsettled in international law. It is generally accepted that it is forbidden to employ these emblems during combat,[44] although opinion is divided as to whether that covers also the preparatory stages of attacks,[45] or only attacks as such.[46] It is also unsettled whether the prohibition applies to non-international armed conflicts.[47]

In addition, during an international armed conflict, it is prohibited to make use of the emblems of nationality of States not party to the conflict.[48] This final prohibition is broader than others discussed in this box in that it makes any such use unlawful, not merely “improper use”.[49] Similar to the prohibition on the improper use of the emblems of nationality of the enemy, it is unsettled whether the prohibition on the use of the emblems of nationality of States not party to the conflict applies also to non-international armed conflicts.[50]

For the purposes of the two last-mentioned prohibitions, the notion of “emblems of nationality” refers to visual objects that indicate a connection to a State, such as flags, military emblems, insignia or uniforms.[51]

[L7] There is no indication of any possible misuse of established indicators or markings in incidents 1 and 2. The deception employed in incident 1 involves the dissimulation of State A’s own systems and networks, but not those of the enemy or of any third party that could benefit from the protection of its emblems, insignia, or other indicators. In incident 2, no dissimulation or other use of protective or established indicators takes place at all, with the deception employed being focussed instead on tampering with the insulin pump’s communications system.

[L8] In incident 3, State A in effect impersonated the ICRC through the unauthorized use of the ICRC’s custom mobile app “e-Red Cross”. Misuse of any of the ICRC’s symbols or their imitations in the physical space is expressly prohibited by IHL.[52] However, it is less clear whether this prohibition extends to cyber operations that falsely convey their origin as coming from or being affiliated with the ICRC, or that simulate, portray or graphically represent the ICRC’s symbols in the digital space.[53]

[L9] In the present case, it is significant that the app’s name contained the words “Red Cross”, which are subject to express protection under IHL and may not be employed in any way that IHL does not permit.[54] By seizing control over the app’s messaging function, the attackers became, even if only for a limited time, the effective operators of the mobile app. For the duration of the incident, they were therefore employing the designation “Red Cross” in a manner inconsistent with the law.[55] In addition, as the operation was designed to spread false information in the guise of the ICRC, it risked undermining confidence in the ICRC’s neutrality, mission, activities, and the associated protective indicators.[56] As such, it was inconsistent with the object and purpose of the prohibition of improper use.[57] Accordingly, by hacking into the “e-Red Cross” app and using it in an unauthorized manner, State A has violated its obligations under IHL.

[L10] Incident 4 implicates the prohibition of the improper use of enemy’s emblems of nationality during an international armed conflict. Crucially, it is not clear whether the digital representations of a State’s armed forces in an electronic force tracking system qualify as that State’s “emblems of nationality”. Apart from the word “emblems” itself, the relevant treaty text refers to “flags”, “insignia” and “uniforms”.[58]

[L11] On the narrower of two possible interpretations of the relevant text, the terms used should be understood as “concrete visual objects” only.[59] For example, under this view, the prohibition would not apply to “the adversary’s codes, passwords and countersigns”.[60] It has been said that this is because using the enemy’s signals is something that military forces should expect and be on guard against.[61] State A’s cyber operation in this incident did not engage any concrete visual objects; instead, it involved the manipulation of data in order to render false information to State B. Under this narrower interpretation, the interference with the enemy’s force tracking system in this incident would thus fall outside the scope of the prohibition.

[L12] By contrast, a broader interpretation of the notion of “emblems” includes electronic representations of identifiers that appear at the human interface level.[62] It is recalled that the prohibition of improper use serves a central purpose of facilitating the distinction between the conflict parties.[63] From this perspective, graphical symbols in digital applications that are commonly understood as representing one of the States involved in an international armed conflict should be seen as serving the purpose of distinguishing that State’s forces from those of the enemy.[64] As such, they would qualify as “emblems of nationality” for the purposes of the prohibition discussed.

[L13] Provided that this interpretation of “emblems of nationality” is adopted, it remains to be seen whether the tampering with the force tracking system to swap the two States’ indicators falls within the temporal scope of the prohibition. In this regard, there is disagreement whether the customary prohibition of improper use extends beyond the instances of attack.[65] However, for States parties to AP I, the prohibition expressly covers improper use designed “to shield, favour, protect or impede military operations”.[66]

[L14] The interference with the force tracking system was undoubtedly designed to assist State A’s advancement on the small town and, as such, it would fall within the temporal scope of the formulation in AP I.[67] Moreover, the hack against the force tracking system persisted throughout State A’s attack against the small town, as evident from the fact that State B’s pilots decided to suspend their counterattack because of the conflicting information received from the hacked system while the original attack was already underway. Accordingly, under the broader interpretation of the rule, the cyber operation conducted by State A would qualify as a violation of the prohibition of improper use of enemy’s emblems of nationality also under customary IHL.

3 Checklist[edit | edit source]

  • Applicability of IHL:
  • Prohibition of perfidy:
    • Does the cyber operation relate to a protection specifically provided for in IHL?
    • Does the cyber operation invite the confidence of the adversary with respect to protection under IHL?
    • Did the perpetrator intentionally betray that confidence?
    • Did the cyber operation result in the adversary’s death, injury, or capture?
  • Misuse of established indicators:
    • Does the cyber operation make use of one of the internationally recognized emblems, signs, and signals (e.g. the distinctive emblem of the red cross or red crescent, the white flag of truce, the protective emblem of cultural property, or the distinctive emblem of the United Nations)?
    • Does the cyber operation engage in any use of such indicators other than that for which they were intended?
    • Does the cyber operation make use of one of the emblems of nationality (e.g. flags, military emblems, insignia or uniforms) of the enemy or of States not party to the armed conflict?
    • With respect to the emblems of nationality of the enemy, does the cyber operation employ these emblems during combat?

4 Appendixes[edit | edit source]

4.1 See also[edit | edit source]

4.2 Notes and references[edit | edit source]

  1. Common Article 2 GC I (stipulating that the Conventions “shall apply to all cases of declared war or of any other armed conflict which may arise between two or more of the High Contracting Parties”).
  2. JS Pictet (ed), Geneva Convention III relative to the Treatment of Prisoners of War: Commentary (ICRC 1960) 23.
  3. See, eg, Jan K Kleffner, ‘Scope of Application of Humanitarian Law’ in D Fleck (ed), The Handbook of International Humanitarian Law (3rd edn, OUP 2013) 45; ILA Use of Force Committee, Final Report on the Meaning of Armed Conflict in International Law (2010) 32; Gary D. Solis, The Law of Armed Conflict: International Humanitarian Law in War (2nd edn, CUP 2016) 162.
  4. Prosecutor v Tadić (Decision on Jurisdiction) IT-94-1-AR72 (2 October 1995) [70].
  5. See, eg, Jean S. Pictet (ed) Geneva Convention IV relative to the Protection of Civilian Persons in Time of War: Commentary (ICRC 1958) 20–21; Yves Sandoz, Christophe Swinarski, and Bruno Zimmermann (eds), Commentary on the Additional Protocols of 8 June 1977 to the Geneva Conventions of 12 August 1949 (ICRC 1987) 40; René Provost, International Human Rights and Humanitarian Law (CUP 2002) 250; Jann K Kleffner, ‘Scope of Application of International Humanitarian Law’ in Dieter Fleck (ed), The Handbook of International Humanitarian Law (3rd edn, OUP 2013) 45; Andrew Clapham, ‘Concept of International Armed Conflict’ in Andrew Clapham, Paola Gaeta, and Marco Sassòli (eds), The 1949 Geneva Conventions: A Commentary (OUP 2015) 16 [38]; Tristan Ferraro and Lindsey Cameron, ‘Article 2: Application of the Convention’, in ICRC (ed), Commentary on the First Geneva Convention (CUP 2016) 79 [218]; Noam Zamir, Classification of Conflicts in International Humanitarian Law: The Legal Impact of Foreign Intervention in Civil Wars (Edward Elgar 2017) 53–55; Kubo Mačák, Internationalized Armed Conflicts in International Law (OUP 2018) 15–16.
  6. Cf. Legality of the Threat or Use of Nuclear Weapons Case (Advisory Opinion) [1996] ICJ Rep 226, para 89 (holding that the relevant rules of IHL apply “to all international armed conflict, whatever type of weapons might be used”) (emphasis added).
  7. Tallinn Manual 2.0, commentary to rule 82, para 11.
  8. Tristan Ferraro and Lindsey Cameron, ‘Article 2: Application of the Convention’, in ICRC (ed), Commentary on the First Geneva Convention (CUP 2016) 92, para 255.
  9. Tristan Ferraro and Lindsey Cameron, ‘Article 2: Application of the Convention’, in ICRC (ed), Commentary on the First Geneva Convention (CUP 2016) 92, para 256.
  10. See further Kubo Mačák, Internationalized Armed Conflicts in International Law (OUP 2018) 39–47.
  11. Prosecutor v Prlić et al (Trial Judgment) IT-04-74-T (29 May 2013), vol 1, para. 86(a).
  12. See Military and Paramilitary Activities in and against Nicaragua (Nicaragua v US) (Merits) [1986] ICJ Rep 14, paras 112–15; see further Kubo Mačák, ‘Decoding Article 8 of the International Law Commission’s Articles on State Responsibility: Attribution of Cyber Operations by Non-State Actors’ (2016) 21 JCSL 405, 421.
  13. Case Concerning the Application of the Convention on the Prevention and Punishment of the Crime of Genocide (Bosnia and Herzegovina v Serbia and Montenegro) (Judgment) [2007] ICJ Rep 43, para 405; ; but see Tristan Ferraro and Lindsey Cameron, ‘Article 2: Application of the Convention’, in ICRC (ed), Commentary on the First Geneva Convention (CUP 2016) 99 [271] (arguing that overall control is the controlling test in both contexts).
  14. See Prosecutor v Tadić (Appeal Judgment) IT-94-1-A (15 July 1999) [120]–[121]; Prosecutor v Lubanga (Pre-Trial Chamber 1) ICC-01/04-01/06 (29 January 2007) [209]–[211]; Case No 001/18-07-2007/ECCC/TC (26 July 2010) [540].
  15. See, eg, Marco Sassòli, International Humanitarian Law: Rules, Controversies, and Solutions to Problems Arising in Warfare (Edward Elgar 2019) 201 (“IHL only governs conduct that has a sufficient nexus to the armed conflict”); Gloria Gaggioli (ed), The Use of Force in Armed Conflicts (ICRC 2013) 4 (“In order to be covered by IHL, the use of force must take place in an armed conflict situation and must have a nexus with the armed conflict.”).
  16. Art 37(1) AP I.
  17. US DoD Law of War Manual, para 5.22.2 (“It may not be prohibited to invite the confidence of the adversary that he or she is obligated to accord protection under the law of war, for certain purposes (e.g., to facilitate … capturing enemy personnel … )”).
  18. ICRC CIHL Study, rule 65.
  19. Waldemar A Solf, ‘Article 37: Prohibition of Perfidy’ in Bothe et al (eds), New Rules for Victims of Armed Conflicts (Brill 1982) 235–36; ICRC CIHL Study, commentary to rule 65, at 224 (“the definition of perfidy provides that the confidence of an adversary be based on a situation which requires protection under international humanitarian law”) (emphasis added).
  20. Yves Sandoz, Christophe Swinarski and Bruno Zimmermann (eds), Commentary on the Additional Protocols of 8 June 1977 to the Geneva Conventions of 12 August 1949 (ICRC 1987) 435 para 1500; ICRC CIHL Study, commentary to rule 65, at 223 (“The essence of perfidy is … the invitation to obtain and then breach the adversary’s confidence”) (emphasis added).
  21. See, eg, Elements of Crime to the Rome Statue, Art 8(2)(b)(xi) and Art 8(2)(e)(ix) (war crime of treacherously killing or wounding); Yves Sandoz, Christophe Swinarski and Bruno Zimmermann (eds), Commentary on the Additional Protocols of 8 June 1977 to the Geneva Conventions of 12 August 1949 (ICRC 1987) 435 para 1500; ICRC CIHL Study, commentary to rule 65, at 223 (“The essence of perfidy is … the invitation to obtain and then breach the adversary’s confidence”) (emphasis added).
  22. Compare US DoD Law of War Manual, para 5.22.2 (“It is prohibited to use perfidy to kill or wound the enemy.”) with ICRC CIHL Study, commentary to rule 65, at 225 (“killing, injuring or capturing by resort to perfidy is illegal under customary international law”).
  23. Cf. Waldemar A Solf, ‘Article 37: Prohibition of Perfidy’ in Bothe et al (eds), New Rules for Victims of Armed Conflicts (Brill 1982) 234 (“sabotage or the destruction of property as such, through the use of perfidious deception is not prohibited by this article”); Humanitarian Policy and Conflict Research, Manual on International Law Applicable to Air and Missile Warfare (CUP 2013) rule 111(a), commentary para 7 (“A clear example of perfidious action which is not prohibited as ‘perfidy’ under customary international law or under AP/I, is the destruction of property”); Tallinn Manual 2.0, rule 122, commentary para 10 (“The perfidy Rule does not extend to perfidious acts that result in damage or destruction of property.”).
  24. ICRC CIHL Study, rule 65; Humanitarian Policy and Conflict Research, Manual on International Law Applicable to Air and Missile Warfare (CUP 2013) rule 111(a), commentary para 11; Tallinn Manual 2.0, rule 122, commentary para 1; see also Rome Statute, Article 8(2)(e)(ix) (providing that “killing or wounding treacherously a combatant adversary” constitutes a war crime in non-international armed conflicts).
  25. Art 37(2) AP I; ICRC CIHL Study, rule 57. See also Art 24 Hague Regulations (“Ruses of war … are considered permissible.”).
  26. Art 37(2) AP I; ICRC CIHL Study, rule 57.
  27. See, eg, Tallinn Manual 2.0, rule 123, commentary para 2(3).
  28. See Art 37(2) AP I; ICRC CIHL Study, rule 57.
  29. See, eg, Arts 12 and 15 AP I; ICRC CIHL Study, rule 25. See also Tallinn Manual 2.0, rule 131. See also Kubo Mačák, Laurent Gisel and Tilman Rodenhäuser, ‘Cyber Attacks against Hospitals and the COVID-19 Pandemic: How Strong are International Law Protections?’, Just Security (27 March 2020) (arguing that this legal protection extends to harm that may be caused to medical infrastructure through cyber operations).
  30. See Tallinn Manual 2.0, rule 122, commentary para 9 (“the confidence referred to in this Rule encompasses that of a cyber system”).
  31. See Tallinn Manual 2.0, rule 122, commentary para 9 (“the notion of confidence presupposes human involvement”); Sean K Price, ‘Perfidy in Cyberspace: The Requirement for Human Confidence’ Harvard National Security Journal Online (21 February 2020) 2 (“confidence, as that term is used in the rule against perfidy, means human trust”).
  32. See, e.g., ICRC CIHL Study, rule 31 (obligation to respect and protect humanitarian relief personnel); ICRC CIHL Study, rule 97 (prohibiting the use of human shields); see also Tilman Rodenhäuser, ‘Hacking Humanitarians? IHL and the protection of humanitarian organizations against cyber operations’ EJIL Talk! (16 March 2020).
  33. Art 23(f) Hague Regulations; Art 39(2) AP I; ICRC CIHL Study, rule 62.
  34. IHL’s rules on conduct of hostilities generally regulate how opposing parties treat one another and how they treat civilians, but do not specifically address how a party treats its own members. See Alan Backstrom and Ian Henderson, ‘New capabilities in warfare: an overview of contemporary technological developments and the associated legal and engineering issues in Article 36 weapons reviews’ (2012) 94 International Review of the Red Cross 483, 488 fn 18 (“Issues such as fratricide are not, strictly speaking, a concern of international humanitarian law.”)
  35. Art 39(2) AP I.
  36. Art 38(1)–(2) AP I; ICRC CIHL Study, rules 58–61.
  37. Waldemar A Solf, ‘Article 38: Recognized Emblems’ in Bothe et al (eds), New Rules for Victims of Armed Conflicts (Brill 1982) 242.
  38. ICRC CIHL Study, vol I, 207, 209, 213.
  39. ICRC CIHL Study, vol I, 207.
  40. Art 38(2) AP I.
  41. cf. Yves Sandoz, Christophe Swinarski and Bruno Zimmermann (eds), Commentary on the Additional Protocols of 8 June 1977 to the Geneva Conventions of 12 August 1949 (ICRC 1987) 133 para 396 (noting that the system of protection is based on trust); ICRC (ed), Commentary on the First Geneva Convention (CUP 2016) 912 para 2581 (“strict control over who may wear the emblem is designed to ensure trust in the emblem”).
  42. Yves Sandoz, Christophe Swinarski and Bruno Zimmermann (eds), Commentary on the Additional Protocols of 8 June 1977 to the Geneva Conventions of 12 August 1949 (ICRC 1987) 448, para 1532.
  43. Art 23(f) Hague Regulations; Art 39(2) AP I; ICRC CIHL Study, rule 62.
  44. Waldemar A Solf, ‘Article 39: Emblems of Nationality’ in Bothe et al (eds), New Rules for Victims of Armed Conflicts (Brill 1982) 244; US DoD Law of War Manual, para 5.23.1.
  45. See, eg, Yves Sandoz, Christophe Swinarski and Bruno Zimmermann (eds), Commentary on the Additional Protocols of 8 June 1977 to the Geneva Conventions of 12 August 1949 (ICRC 1987) 466–467 paras 1574–1575; see also Humanitarian Policy and Conflict Research, Manual on International Law Applicable to Air and Missile Warfare (CUP 2013) rule 112(c), commentary para 4 (noting that some experts took the position that any use of enemy uniform for deception purposes is improper, whether before or after an attack).
  46. See, eg, Switzerland, Official Records of the Diplomatic Conference on the Reaffirmation and Development of International Humanitarian Law Applicable in Armed Conflicts, Geneva (1974–1977) (Federal Political Department 1978) vol XIV, CDDH/III/SR.29, 273–274 para 16 (United States) (“Attempting to regulate activities beyond the infliction of violence, namely an attack, was unnecessary regulation and went beyond the provisions of existing law.”) (emphasis added); Canada, Joint Doctrine Manual: Law of Armed Conflict (2003), para 607(2) (limiting the scope of the prohibition to “while engaging in attacks” and reserving the right to use enemy emblems of nationality to shield, favour, protect or impede military operations); see also Tallinn Manual 2.0, rule 126, commentary para 2 (considering that the extension of the prohibition beyond engagement in attack is not considered to form part of customary international law).
  47. ICRC CIHL Study, commentary to rule 62, at 214 (considering it arguable that the rule should also apply in non-international armed conflicts when the parties to the conflict do in fact wear uniforms); Tallinn Manual 2.0, rule 126, commentary para 1 (considering that the rule applies in both international and non-international armed conflict).
  48. Art 39(1) AP I; ICRC CIHL Study, rule 63.
  49. Humanitarian Policy and Conflict Research, Manual on International Law Applicable to Air and Missile Warfare (CUP 2013) rule 112(d), commentary para 2.
  50. Tallinn Manual 2.0, rule 127, commentary para 2 (noting that the question is unsettled). Compare ICRC CIHL Study, vol I, 219 (considering it arguable that the prohibition applies to non-international armed conflicts as a matter of customary law) with Humanitarian Policy and Conflict Research, Manual on International Law Applicable to Air and Missile Warfare (CUP 2013) rule 112(d), commentary para 3 (considering that the prohibition “does not apply in non-international armed conflict, since there is no neutrality in the legal sense”).
  51. Waldemar A Solf, ‘Article 39: Emblems of Nationality’ in Bothe et al (eds), New Rules for Victims of Armed Conflicts (Brill 1982) 246.
  52. Arts 44(1) and 53(1) GC I; Art 38(1) AP I; ICRC CIHL Study, rule 59.
  53. Tallinn Manual 2.0, rule 124, commentary paras 5–7.
  54. Art 44(1) GC I (“the words ‘Red Cross’ … may not be employed, either in time of peace or in time of war, except to indicate or to protect the medical units and establishments, the personnel and material protected by the present Convention and other Conventions dealing with similar matters”).
  55. See also Jeffrey Biller, ‘The Misuse of Protected Indicators in Cyberspace: Defending a Core Aspect of International Humanitarian Law’ in Henry Rõigas et al (eds), Defending the Core (CCD COE 2017) 111 (arguing that employing the words “Red Cross” “in a more formal manner, such as [in] an email signature block, letterhead to an attachment, or another manner formally indicating an official Red Cross document” indicates a violation of Art 44(1) GC I).
  56. cf. ICRC, Study on the Use of the Emblems (ICRC 2011) 17 (“There can be no doubt that misuse of the emblem, whenever committed, creates confusion and distrust in the minds of the public in general, and in the parties to an armed conflict in particular. This undermines confidence in the components of the Movement, and threatens their access to victims and even their own security”).
  57. cf. Yves Sandoz, Christophe Swinarski and Bruno Zimmermann (eds), Commentary on the Additional Protocols of 8 June 1977 to the Geneva Conventions of 12 August 1949 (ICRC 1987) 133 para 396 (noting that the system of protection is based on trust); ICRC (ed), Commentary on the First Geneva Convention (CUP 2016) 912 para 2581 (“strict control over who may wear the emblem is designed to ensure trust in the emblem”).
  58. Art 23(f) Hague Regulations; Art 39(2) AP I.
  59. Waldemar A Solf, ‘Article 39: Emblems of Nationality’ in Bothe et al (eds), New Rules for Victims of Armed Conflicts (Brill 1982) 246; Tallinn Manual 2.0, rule 126, commentary para 2; but see Yves Sandoz, Christophe Swinarski and Bruno Zimmermann (eds), Commentary on the Additional Protocols of 8 June 1977 to the Geneva Conventions of 12 August 1949 (ICRC 1987) 468 para 1578 (using the formulation “visible signs”, without insisting on their materiality).
  60. Waldemar A Solf, ‘Article 39: Emblems of Nationality’ in Bothe et al (eds), New Rules for Victims of Armed Conflicts (Brill 1982) 246; see also UK Manual, para 5.17.2; US DoD Law of War Manual, para 5.23.1.5.
  61. US DoD Law of War Manual, para 5.23.1.5.
  62. See, eg, Jeffrey Biller, ‘The Misuse of Protected Indicators in Cyberspace: Defending a Core Aspect of International Humanitarian Law’ in Henry Rõigas et al (eds), Defending the Core (CCD COE 2017) 117.
  63. Switzerland, Official Records of the Diplomatic Conference on the Reaffirmation and Development of International Humanitarian Law Applicable in Armed Conflicts, Geneva (1974–1977) (Federal Political Department 1978) vol XIV, CDDH/III/SR.29, 272, para 10 (ICRC) (“uniforms and emblems of nationality served two purposes: distinguishing allies from enemies, and military personnel from civilians”).
  64. cf. Jeffrey Biller, ‘The Misuse of Protected Indicators in Cyberspace: Defending a Core Aspect of International Humanitarian Law’ in Henry Rõigas et al (eds), Defending the Core (CCD COE 2017) 117 (“commonly understood identifiers that appear at the human interface level, such as web and e-mail domain names, graphical symbols, and formal representations such as signature blocks in e-mails and electronic documents appear to qualify as military emblems”) (emphasis added).
  65. See, e.g., ICRC CIHL Study, vol I, 216; US DoD Law of War Manual, paras 5.23.1.3 and 5.23.3; Tallinn Manual 2.0, rule 126, commentary para 2; but see Humanitarian Policy and Conflict Research, Manual on International Law Applicable to Air and Missile Warfare (CUP 2013) rule 112(c), commentary para 4 (noting that some experts considered any use of enemy uniform for deception purposes, even before or after an attack, as improper under customary international law).
  66. Art 39(2) AP I.
  67. Yves Sandoz, Christophe Swinarski and Bruno Zimmermann (eds), Commentary on the Additional Protocols of 8 June 1977 to the Geneva Conventions of 12 August 1949 (ICRC 1987) 467 [1575] (“The prohibition formulated in Article 39 … includes the preparatory stage to the attack”); see also Waldemar A Solf, ‘Article 39: Emblems of Nationality’ in Bothe et al (eds), New Rules for Victims of Armed Conflicts (Brill 1982) 245 (noting that under the AP I formula, it would “probably” be prohibited to use enemy indicators “as a disguise during any military operation preparatory to an attack”).

4.3 Bibliography and further reading[edit | edit source]

4.4 Contributions[edit | edit source]

Previous: Scenario 14: Ransomware campaign Next: Scenario 16: High seas