Scenario 18: Legal status of cyber operators during armed conflict

From International cyber law: interactive toolkit
Jump to navigation Jump to search
Hacker. By TheDigitalArtist, CC-0 Pixabay

During a conventional armed conflict, a State deploys three groups of persons for its cyber operations against an enemy State. A fourth, civilian group, joins the fight and launches cyber operations against the same enemy. The scenario analyses the lawfulness of the lethal targeting of these four different types of cyber operators. It particularly concentrates on the status and functions of the relevant personnel.

Scenario[edit | edit source]

Keywords[edit | edit source]

international humanitarian law, distinction, combatants, civilians, organized armed groups, targeting, direct participation in hostilities

Facts[edit | edit source]

[F1] State A and State B have been engaged in armed hostilities against each other for years.

[F2] While the hostilities are ongoing, State A engages a number of civilian IT-professionals to work for the government. All IT-professionals are pooled in the same building, but they are divided into three groups:

  1. One group, consisting of civilians with former military background, is attached to the army’s cyber unit. All members get uniforms, ranks and are integrated in the military hierarchy. Also, they operate with the military IT (group 1).
  2. The second group is assigned as a computer emergency response team (CERT) to protect the government’s IT-infrastructure and State A’s civilian critical infrastructure against computer security incidents. It is assigned to the ministry of interior. Its members do not wear uniforms or any other emblems of nationality (group 2).
  3. The third group, whose members dress like IT-Hipsters, is assigned to State A’s ministry of traffic and cyber. Their role is to influence the public opinion in the country and in the international community. This group publishes stories on social media and on various news websites. Their main storyline is that State A is the victim of aggressive expansionism while State B is committing war crimes. Besides, this group controls a network of social media bots, which are frequently used to spread fake news related to supposed military movements and tactics of A’s armed forces. This results in operational mistakes on part of State B’s forces (group 3).

[F3] In addition, a nationalist hacker group decided long ago to fight on State A’s side. The group has managed to gain access to advanced technological equipment and it continuously recruits new members that are willing to comply with the orders and the strategic plan of the group’s leadership. The group normally communicates via an encrypted messaging system, but it does occasionally meet in person, too. During the armed confrontation, the group continuously conducts cyber operations of variable intensity against State B. In particular, the group conducts DDoS (Distributed Denial of Service) attacks against media companies in State B, blocking and manipulating some of the news. Also, the group deploys a Software-Defined-Radio-system to interfere with State B’s military UAV command and control systems. Thereby, many of State B’s UAVs are misdirected and fall. Two of them crash in a village in State B, causing civilian casualties. The group regularly assumes responsibility for its acts and declares its intention to continue the fighting against State B. However, State A denies any link and any ability to influence this group (group 4).

[F4] Later, group 1 successfully intrudes into the military communication network of State B and reassigns the data transfer directions. This results in a temporary chaos in State B’s coordination of its military operations. The effect lasts for half a day and State B then successfully re-traces the attack to group 1.

[F5] In retaliation, State B decides to launch a conventional air strike against the IT-complex of State A where groups 1–3 are based. Furthermore, it fires cruise missiles on the hideout of group 4.

Examples[edit | edit source]

Legal analysis[edit | edit source]

For a general overview of the structure of analysis in this section, see Note on the structure of articles.

[L1] The scenario raises the question under which circumstances cyber operators become a lawful target under international law and, conversely, when they are protected from attacks. It analyses and discusses the status of persons under international humanitarian law (IHL, also referred to as law of armed conflict). It concludes with a short general assessment of the scenario from the perspective of targeting law.

Existence of an armed conflict[edit | edit source]

International armed conflict[edit | edit source]

International armed conflict
The law of international armed conflict (IAC) applies to any armed confrontation between two or more States,[1] even if one, several, or all of them deny the existence of an armed conflict.[2] Some scholars have suggested that the fighting must be of a certain intensity before international humanitarian law (IHL) comes into effect,[3] but the prevailing view is that any “resort to armed force between States”,[4] however brief or intense, triggers the application of IHL.[5] Furthermore, the law does not prescribe any specific form for the resort to force,[6] so hostilities between the belligerent States may involve any combination of kinetic and cyber operations, or cyber operations alone.[7]

It is unclear what effect cyber operations unaccompanied by any use of kinetic force would have to have in order for IHL to apply. Although it seems generally accepted that if cyber operations have similar effects to classic kinetic operations and two or more States are involved, the resulting situation would qualify as an IAC,[8] the law is unsettled on whether cyber operations that merely disrupt the operation of military or civilian infrastructure amount to a resort to armed force for the purposes of IHL.[9][10]

In the cyber context, States often act through non-State intermediaries and proxies. In such situations at the outset of an armed confrontation, the relevant State must exercise a sufficient degree of control over the non-State entity that commences hostilities against another State for the situation to qualify as an IAC. However, the correct legal test to use in this regard is the subject of an ongoing controversy.[11] The prevailing standard for the characterization of an international armed conflict is that of “overall control”, which requires that the State provides some support and that it participates in the organization, co-ordination, or planning of the relevant operations.[12] A separate standard, the “effective control” test, requires that the State must exercise control over the entire course of the operations in question.[13] While there is still disagreement as to whether the “effective control” test is the controlling test for the purposes of attribution under the law of State responsibility, there is consensus that the “overall control” test is the correct one for conflict qualification under IHL.[14] The latter is also confirmed by decades of consistent practice by international criminal tribunals including the ICTY, the ECCC, and the ICC.[15]

Publicly available national positions that address this issue include: Common position of the African Union (2024) (2024), National position of Costa Rica (2023) (2023), National position of Finland (2020) (2020), National position of France (2019) (2019), National position of Germany (2021) (2021), National position of Ireland (2023) (2023), National position of Japan (2021) (2021).

[L2] States A and B have conducted armed hostilities against each other for years. Thus, the situation qualifies as an international armed conflict, to which IHL applies in accordance with Common Article 2 to the Geneva Conventions.[16] As a consequence, all acts of States A and B with a nexus to that armed conflict are governed by IHL,[17] including any cyber operations.[18]

Non-international armed conflict[edit | edit source]

Non-international armed conflict
The law of non-international armed conflict (NIAC) applies to all armed conflicts not of an international character.[19] As set forth by the ICTY Appeals Chamber in the Tadić case, NIACs are situations of “protracted armed violence between governmental authorities and organized armed groups or between such groups within a State”.[20]

This definition rests on two factors—the intensity of the fighting and the organization of the non-State group.[21] First, the hostilities between the parties must reach a certain level of intensity, which may be indicated by, among other factors, the seriousness and frequency of attacks and military engagements, the extent of destruction, or the deployment of governmental armed forces.[22] Second, the non-State group must have some minimum level of organization, indicators of which may include the presence of a command or leadership structure, the ability to determine a unified military strategy and speak with one voice, the adherence to military discipline, as well as the capability to comply with IHL.[23]

These same criteria of intensity and organization apply in situations involving (or even limited to) cyber operations.[24] However, cyber operations alone will only rarely meet the requisite level of intensity to trigger a NIAC.[25]

Publicly available national positions that address this issue include: Common position of the African Union (2024) (2024), National position of Costa Rica (2023) (2023), National position of Finland (2020) (2020), National position of France (2019) (2019), National position of Germany (2021) (2021), National position of Ireland (2023) (2023), National position of Japan (2021) (2021).

[L3] Group 4 and State B have been involved in a series of confrontations, culminating in a missile strike by State B against the group’s hideout. Group 4 appears to have sufficient organization, given that it had the ability to speak with one voice, access to recruits and the ability to plan and conduct cyber operations that were pre-approved by its leadership. It was not only a purely “virtual” group, because its members did meet in person, although only rarely.[26] With respect to the requirement of intensity, the group’s sustained cyber operations extensively interfered with the military capacity of State B, caused loss of life and destruction of property in that State’s territory, and provoked its missile strike in response. Therefore, the threshold for the applicability of IHL has arguably been crossed and the confrontation between State B and group 4 would qualify as a NIAC.

[L4] The analysis applies the IHL rules on the status of persons to cyber operators. This status is decisive for the question of lawfulness of the attack against the cyber operators and thus for the relevant targeting decisions (see para. L16 below).

Combatancy[edit | edit source]

Combatancy

Combatant and POW statuses are widely considered as closely linked. Thus, Article 4A GC III,[27] which defines the conditions for the acquisition of POW status, is regarded as also implying the conditions for combatant status.[28] These criteria are considered to reflect customary international law.[29] Accordingly, there are two main types of combatants in international armed conflicts:

  • firstly, members of the armed forces of a Party to the conflict,[30] including “members of regular armed forces who profess allegiance to a government or an authority not recognized by the Detaining Power”[31].
  • The second category consists of “[m]embers of other militias and members of other volunteer corps, including those of organised resistance movements, belonging to a Party of the conflict”.[32]

Groups in the latter category, also referred to as irregular armed forces, need to fulfil four collective criteria in order for their members to attain combatant and POW status, i.e.:

  1. be commanded by a person responsible for his or her subordinates,
  2. wear a distinctive emblem or attire that is recognizable at a distance,
  3. carry arms openly, and
  4. conduct operations in accordance with IHL.[33]

In addition to this, they must belong to a Party to the conflict.[34]

The expert opinion is split as to whether members of regular armed forces (i.e., those falling into the first of the two categories mentioned earlier) have to also fulfil these four criteria to obtain combatant status (extensive view), or whether in their case, mere membership suffices for combatant status (mere membership approach).[35]

The conditions for combatant status differ for States parties to AP I. AP I drops the distinction between regular and irregular forces and stipulates that the “armed forces of a Party to a conflict consist of all organized armed forces, groups and units which are under a command responsible to that Party for the conduct of its subordinates”.[36] It adds that such forces “shall be subject to an internal disciplinary system which, inter alia, shall enforce compliance with the rules of international law applicable in armed conflict.”[37] Furthermore, Article 44(3) AP I relaxes the conditions for combatancy in specific circumstances, normally understood as referring to occupied territories and wars of national liberation,[38] and with respect to the obligations to wear a distinctive emblem or attire recognizable at a distance and to carry arms openly.[39] However, the criteria of Article 4A GC III are not deprived of all relevance, even for States parties to AP I. The savings clause of Article 44(6) AP I guarantees that non-fulfilment of the conditions of AP I does not compromise POW and combatant status attained based on Article 4 GC III.[40]

Accordingly, for States parties to AP I, all members of the armed forces of a party to the conflict qualify as combatants, except for medical and religious personnel.[41]

In the cyber context, operators can be directly incorporated into the armed forces in the form of military cyber units; members of such units qualify as combatants under IHL. Where groups of cyber operators maintain a looser association with a Party to the conflict, they must ordinarily meet the four aforementioned conditions in order to qualify for combatant status. However, it is controversial whether cyber operators whose military operations are limited to cyberspace have to comply with the obligations to distinguish themselves with a sign recognizable at a distance and to carry arms openly; and if so, how these duties can be practically realized.[42] If cyber operators are not integrated or assimilated in one of these ways, they retain their civilian status.

Combatant status does not exist in non-international armed conflicts.[43]

Civilians, by contrast, are persons who do “not belong to one of the categories of persons referred to in Article 4A(1), (2), (3) and (6) of the Third Convention and in Article 43” of AP I.[44] Any person who is not a combatant must be considered as a civilian.[45] In case of doubt as to a person’s legal status, AP I prescribes that that person should also be considered to be a civilian.[46] Civilians benefit from a general protection from attack.[47] Only if civilians are directly participating in hostilities, they lose their protection from attack for such time as they do so.[48]

[L5] Under the mere membership approach, members of group 1 qualify as combatants merely for being integrated in the regular armed forces of State A. By contrast, under the extensive view, they would still have to meet the four conditions of Article 4A(2) GC III as well as the belonging requirement. In any event, group 1 fulfils these criteria, subject to one contested qualification noted below. Its members have regular military ranks and are integrated in the military hierarchy. They are under military command. As they wear uniforms, they distinguish themselves from civilians. Given the fact that a characteristic of cyber operations are concealment techniques and the abuse of weaknesses in the enemy’s systems, it is contested whether the criterion to carry arms openly can be fulfilled in general. It is therefore suggested not to apply this criterion too strictly in the cyber context.[49] The requirements of AP I are equally met for group 1. Due to the integration of this group to the army and its duty to comply with commands, it is subject to an internal disciplinary system. Thus, compliance with IHL can be enforced within this group.

[L6] Group 2 is subordinated to the ministry of interior and its members are not assigned to the armed forces. Although the group clearly belongs to State A as a Party to the ongoing armed conflict and eventually could be commanded by a superior, the group does not wear any distinctive emblems nor signs making it recognisable at distance. From an objective perspective, members of the group appear as civilians. The group was also not incorporated into State A’s armed forces as a paramilitary or law enforcement agency through a formal act or notification, as provided for in Article 43(3) AP I.[50] These considerations indicate that State A does not consider group 2 a part of its armed forces.[51] Accordingly, members of group 2 have to be classified as civilians.[52]

[L7] Group 3, as part of the ministry of traffic and cyber, does not belong to the armed forces of State A. As it forms part of the State’s hierarchy, it is likely to be commanded by a person responsible for his or her subordinates. The so-called IT-Hipster dress code could in principle qualify as a distinctive sign under IHL, given that other elements of clothing such as caps, coats or shirts are considered to be acceptable in this regard.[53] However, a particular dress alone does not suffice. Whatever distinctive sign is used, it must identify and characterize the group using it as well as distinguish the said group from civilians.[54] As the dress code in question is neither special for militaries in general nor in any way distinctive from ordinary civilians, this criterion is not fulfilled by group 3. Overall, members of group 3 do not therefore qualify as combatants.[55] Accordingly, its members have to be classified as civilians.

[L8] Group 4 is not affiliated to the government of State A. There appears not to be even a tacit agreement by State A with the group’s activities and the group is clearly not acting on behalf of the government of State A. Also, group 4 does not fulfil the other criteria for an organised armed group defined in Article 4A(2) GC III, such as wearing a distinctive emblem. The members of the group therefore have to be classified as civilians in the IAC between States A and B.[56] However, if a NIAC is ongoing between State B and group 4 (see para. L3 above), members of group 4 with a continuous combat function (CCF) may be targetable for the duration of such membership (see para. L18 below).

Direct participation in hostilities[edit | edit source]

Direct participation in hostilities

Civilians benefit from a general protection from attack.[57] However, this protection is lifted “for such time as they take a direct part in hostilities”.[58] During this period, a civilian who directly participates in hostilities (DPH) may be attacked lawfully.[59] As customary international law,[60] this rule also applies to cyber operations, when these occur during an armed conflict.[61]

Absent a definition, it remains controversial when a conduct qualifies as direct participation[62] and how long this period lasts.[63] According to the ICRC DPH study,[64] a specific act must meet the following criteria to qualify as direct participation in hostilities:

  1. the act must be likely to adversely affect the military operations or military capacity of a party to an armed conflict or, alternatively, to inflict death, injury, or destruction on persons or objects protected against direct attack (threshold of harm), and
  2. there must be a direct causal link between the act and the harm likely to result either from that act, or from a coordinated military operation of which that act constitutes an integral part (direct causation), and
  3. the act must be specifically designed to directly cause the required threshold of harm in support of a party to the conflict and to the detriment of another (belligerent nexus).[65]

These criteria are neutral as to the means and methods of warfare used by the act in question; accordingly, they equally apply to cyber operations.[66] Arguably, “digital” damage is included as long as the cyber operation negatively affects the enemy’s military operations or military capacity.[67] Examples of direct participation in hostilities through cyber means include damaging enemy property or equipment, or the transmission of military information for immediate use by a belligerent.

Additionally, in a NIAC, a person who is a member of an organized armed group (OAG) that is a party to the conflict loses his or her protection if he or she fulfils a continuous combat function (CCF) within the group. This occurs when the (continuous) function of a person in a group is to directly participate in hostilities. It requires lasting integration into the OAG in question.[68] This includes the individuals whose continuous function involves the preparation, execution or command of cyber operations amounting to DPH.[69] Simple membership in a hacker group without any DPH function does not suffice for a CCF,[70] as the DPH criteria are designed to exclude subsidiary support functions within a group.[71]

The CCF concerns the temporal scope of the loss of protection and is function-based.[72] The membership in an OAG starts when the civilian “starts de facto to assume the continuous combat function” and lasts until that function ceases.[73]

Publicly available national positions that address this issue include: National position of France (2019) (2019), National position of Germany (2021) (2021), National position of the United Kingdom (2021) (2021).

[L9] The following paragraphs analyze whether those groups whose members were found to qualify as civilians (i.e., groups 2, 3, and 4: see paras L6–L8 above) could nonetheless be the object of a lawful attack on account of their direct participation in hostilities.

[L10] Members of group 2 are tasked with the protection of State A’s government IT infrastructure and its civilian critical infrastructure. As a CERT, the group fulfils a defensive function without a connection to the ongoing armed conflict. The pure defense of government and civilian IT infrastructure does not adversely affect the military operations or capacity of the adversary. Thus, the activities of members of group 2 do not amount to DPH.

[L11] It is controversial whether members of group 3 directly participate in hostilities. The publication of information on social media and other IT media platforms is not a particular military usage of these media, but rather a common form of civilian journalism. Information operations aim to influence the public and international opinion. Even accepting that the threshold of harm and belligerent nexus criteria could at times be met by such operations, this alone does not suffice as the causal link between the act and the harm would only be indirect.[74] By contrast, if group 3 started to use the means at their disposal to transmit military information for tactical use by State A’s military forces, this conduct would qualify as DPH.[75]

[L12] In addition, the fake news operations of group 3 may conceivably have a direct negative effect on State B’s military operations. Wrong information (fake news), e.g. about the defence of certain objects or the (non-existing) concentration of troops at a certain spot, can influence and mislead military decisions of the enemy on certain military objectives. The operations are conducted frequently, they directly cause harm, and demonstrate a belligerent nexus.[76] Thus, engaging in these information operations by members of group 3 can be seen as direct participation in hostilities. The exact time frame for the participation depends on the actual conduct and may be seen as controversial.[77] In any case, these information operations will only amount to DPH to the extent that they directly affect a specific military operation by State B. For the duration of such activities, members of group 3 may be attacked. By contrast, if these fake news simply foster a propaganda campaign against State B, these acts do not constitute DPH and members of group 3 in charge of them remain protected from attack.[78]

[L13] The legal qualification of the conduct of group 4 depends on the applicable legal framework. If there is no parallel NIAC, in which the group would constitute a belligerent party (on which see para. L3 above), the group’s conduct falls to be determined on the basis of the criteria for direct participation in hostilities[79] applicable in the IAC between States A and B. In this regard, the DDoS attacks on the media companies do not have a nexus to the ongoing armed conflict. Even though they might generate confusion among the population, they are not likely to affect the military operations or capacity of State B as a party to the conflict.[80] Conversely, the SDR-attacks on the UAVs of State B lead to the misdirection of several UAVs and partly result in civilian casualties, damage or destruction of other military equipment. Thus, State B’s citizens and its military matériel are attacked and destroyed, resulting in physical damage.[81] Accordingly, State B’s military operations are directly affected by the cyber operations of group 4. Thus, those members of the group that are committing these acts are directly participating in hostilities and are not protected from attack for their duration.

[L14] However, this analysis must be modified to some degree if a separate NIAC is taking place between State B and group 4 (see para. L3 above). In the context of a NIAC, members of organized armed groups with a continuous combat function are targetable for the duration of such membership.[82] Accordingly, if the situation qualifies as a NIAC, those members of group 4 whose continuous function is to prepare, execute, or command cyber operations such as the SDR attacks on State B’s UAVs, lose protection from attack for as long as they assume that function.[83]

Attacks against persons[edit | edit source]

Attacks against persons

The principle of distinction is one of the fundamental principles of international humanitarian law and has the status of customary international law.[84] It obliges parties to an armed conflict to distinguish at all times between civilians and combatants.[85]

It is prohibited to direct an attack against civilians.[86] Furthermore, intentionally directing attacks against the civilian population or against individual civilians not taking direct part in hostilities qualifies as a war crime.[87] Acts or threats of violence that primarily aim at spreading terror among the civilian population are also prohibited.[88]

According to Article 48 AP I, parties to an armed conflict may “direct their operations only against military objectives”. Attacks may be directed against combatants insofar as they are positively distinguished from civilians and qualify as military objectives.[89] Civilians are protected from attack unless and for such time as they directly participate in hostilities.[90]

The principle of distinction is closely linked to the principle of proportionality.[91] The principle of proportionality prohibits attacks that may be expected to cause incidental injuries, death or destruction to civilians or civilian objects (incidental civilian harm), which would be excessive in relation to the concrete and direct military advantage anticipated.[92] Put differently, belligerents are obliged to refrain from attacks even against those persons who otherwise qualify as military objectives if such attacks are expected to cause disproportionate incidental civilian harm.[93]

Overall, an attack against a person may be lawful if it is directed at a combatant or a civilian directly participating in hostilities, without causing any incidental civilian harm. An attack against such a person, which does result in incidental civilian harm, may additionally be lawful if the expected incidental harm is not excessive in relation to the anticipated military advantage.

Publicly available national positions that address this issue include: Common position of the African Union (2024) (2024), National position of Costa Rica (2023) (2023).

[L15] The IT-specialists belonging to group 1 are not in principle protected from attack, because they qualify as combatants (see para. L5 above). Given that this group uses the building in which they are based for military purposes, in accordance with Article 52(2) AP I the building also qualifies as a military objective through its present use.

[L16] As group 2 are civilians who are not participating in hostilities (see para. L10 above), they are not a lawful target.

[L17] The lawfulness of a separate attack on group 3 is more controversial and would depend on whether the conduct of the group members would constitute direct participation in hostilities (see para. L11-12 above). Those members who do directly participate in hostilities are liable to attack for the duration of such participation, while members who are not DPHing remain protected at all times.

[L18] In the context of an IAC, a conventional attack on group 4 might at first appear unlawful, because the members of the group are civilians. However, due to their hostile attacks against State B’s matériel and the frequency of this conduct, some members of the group are directly participating in hostilities and therefore they lose their protection (see para. L13 above). If a NIAC with group 4 as party to it is in place,[94] then those members of group 4 who have a CCF can be attacked at any time (see paras. L13 and L14 above for details).

[L19] Given that groups 1–3 are all situated in the same building at the same time, any conventional attack against the building would also have to comply with the principle of proportionality. Accordingly, the lawfulness of the attack against the building would depend on whether the incidental harm to civilians present in the building and not considered to be DPHing at the material time was excessive in relation to the military advantage anticipated from the attack.[95]

[L20] Finally, feasible precautions would have to be taken both before and during an attack against groups 1–4. These include issuing warnings to the civilian population if possible and choosing such means and methods of attack that would avoid or at least minimize incidental civilian harm, as per Article 57 AP I.

Checklist[edit | edit source]

  • Conflict qualification
  • Combatancy
    • Is the State in question a State party to Additional Protocol I?
    • Is the State in question a State party to Additional Protocol II?
    • Is the person in question assigned to, integrated in or elsewhere affiliated with the military of a State?
    • Is the person subject to a hierarchical command structure?
    • Does the person wear a uniform or have any other distinctive sign which clearly distinguishes him or her from civilians?
    • Does the person qualify as a civilian?
  • Direct participation in hostilities
    • Does the action by the person support the conduct of hostilities by one party to the conflict?
    • Is this support equivalent to conventional military support to the conduct of hostilities?
  • Attacks against persons
    • If the person in question is located within an object such as a building, does that object qualify as a military objective?
    • If the said object is normally dedicated to civilian purposes, is it presently being used to make an effective contribution to military action?
    • Would attacking the said object offer a definite military advantage ?
    • Would the incidental civilian harm expected to be caused by the attack be excessive in relation to the concrete and direct military advantage anticipated?
    • Have all feasible precautions been taken before and during the attack?

Appendixes[edit | edit source]

See also[edit | edit source]

Notes and references[edit | edit source]

  1. Common Article 2 GC I (stipulating that the Conventions “shall apply to all cases of declared war or of any other armed conflict which may arise between two or more of the High Contracting Parties”).
  2. ICRC (ed), Commentary on the Third Geneva Convention (CUP 2021), commentary on common Article 2, para 246 (‘Even if none of the Parties recognize the existence of a state of war or of an armed conflict, humanitarian law would still apply provided that an armed conflict is in fact in existence.’).
  3. See, eg, Jan K Kleffner, ‘Scope of Application of Humanitarian Law’ in D Fleck (ed), The Handbook of International Humanitarian Law (3rd edn, OUP 2013) 45; ILA Use of Force Committee, Final Report on the Meaning of Armed Conflict in International Law (2010) 32; Gary D. Solis, The Law of Armed Conflict: International Humanitarian Law in War (2nd edn, CUP 2016) 162.
  4. Prosecutor v Tadić (Decision on Jurisdiction) IT-94-1-AR72 (2 October 1995) para 70.
  5. See, eg, Jean S. Pictet (ed) Geneva Convention IV relative to the Protection of Civilian Persons in Time of War: Commentary (ICRC 1958) 20–21; Yves Sandoz, Christophe Swinarski, and Bruno Zimmermann (eds), Commentary on the Additional Protocols of 8 June 1977 to the Geneva Conventions of 12 August 1949 (ICRC 1987) 40; René Provost, International Human Rights and Humanitarian Law (CUP 2002) 250; Jann K Kleffner, ‘Scope of Application of International Humanitarian Law’ in Dieter Fleck (ed), The Handbook of International Humanitarian Law (3rd edn, OUP 2013) 45; Andrew Clapham, ‘Concept of International Armed Conflict’ in Andrew Clapham, Paola Gaeta, and Marco Sassòli (eds), The 1949 Geneva Conventions: A Commentary (OUP 2015) 16 para 38; ICRC (ed), Commentary on the Third Geneva Convention (CUP 2021), commentary on common Article 2, para 251; Noam Zamir, Classification of Conflicts in International Humanitarian Law: The Legal Impact of Foreign Intervention in Civil Wars (Edward Elgar 2017) 53–55; Kubo Mačák, Internationalized Armed Conflicts in International Law (OUP 2018) 15–16.
  6. Cf. Legality of the Threat or Use of Nuclear Weapons Case (Advisory Opinion) [1996] ICJ Rep 226, para 89 (holding that the relevant rules of IHL apply “to all international armed conflict, whatever type of weapons might be used”) (emphasis added).
  7. Tallinn Manual 2.0, commentary to rule 82, para 11.
  8. ICRC (ed), Commentary on the Third Geneva Convention (CUP 2021), commentary on common Article 2, para 288.
  9. ICRC (ed), Commentary on the Third Geneva Convention (CUP 2021), commentary on common Article 2, para 289.
  10. For State views on this matter, see, eg, Finland, ‘International law and cyberspace: Finland’s national positions’ (15 October 2020), 7 (‘International humanitarian law only applies to cyber operations when such operations are part of, or amount to, an armed conflict. Most so far known cyberattacks have not been launched in the context of an armed conflict or have met the threshold of armed conflict.’); French Ministry of the Armies, ‘International Law Applied to Operations in Cyberspace’, 9 September 2019, 12 (‘Cyberoperations that constitute hostilities between two or more States may characterise the existence of international armed conflict (IAC)’); Germany, ‘On the Application of International Law in Cyberspace: Position Paper’ (March 2021), 7 (‘An international armed conflict – a main prerequisite for the applicability of IHL in a concrete case – is characterized by armed hostilities between States. This may also encompass hostilities that are partially or totally conducted by using cyber means.’); Japan, Basic Position of the Government of Japan on International Law Applicable to Cyber Operations (28 May 2021), 7 (‘If the effects of cyber operations are taken into consideration, the conduct of cyber operations alone may reach the threshold of an "armed conflict."’).
  11. See further Kubo Mačák, Internationalized Armed Conflicts in International Law (OUP 2018) 39–47.
  12. Prosecutor v Prlić et al (Trial Judgment) IT-04-74-T (29 May 2013), vol 1, para 86(a).
  13. See Military and Paramilitary Activities in and against Nicaragua (Nicaragua v US) (Merits) [1986] ICJ Rep 14, paras 112–15; see further Kubo Mačák, ‘Decoding Article 8 of the International Law Commission’s Articles on State Responsibility: Attribution of Cyber Operations by Non-State Actors’ (2016) 21 JCSL 405, 421.
  14. Case Concerning the Application of the Convention on the Prevention and Punishment of the Crime of Genocide (Bosnia and Herzegovina v Serbia and Montenegro) (Judgment) [2007] ICJ Rep 43, para 405; but see ICRC (ed), Commentary on the Third Geneva Convention (CUP 2021), commentary on common Article 2, para 304 (arguing that overall control is the controlling test in both contexts).
  15. See Prosecutor v Tadić (Appeal Judgment) IT-94-1-A (15 July 1999) paras 120–121; Prosecutor v Lubanga (Pre-Trial Chamber 1) ICC-01/04-01/06 (29 January 2007) paras 209–211; Case No 001/18-07-2007/ECCC/TC (26 July 2010) para 540.
  16. Common Article 2 to the four Geneva Conventions of 1949; see also Prosecutor v Tadić (Decision on Jurisdiction) IT-94-1-AR72 (2 October 1995) [70] (“an [international] armed conflict exists whenever there is a resort to armed force between States”).
  17. See, eg, Marco Sassòli, International Humanitarian Law: Rules, Controversies, and Solutions to Problems Arising in Warfare (Edward Elgar 2019) 201 (“IHL only governs conduct that has a sufficient nexus to the armed conflict”); Gloria Gaggioli (ed), The Use of Force in Armed Conflicts (ICRC 2013) 4 (“In order to be covered by IHL, the use of force must take place in an armed conflict situation and must have a nexus with the armed conflict.”).
  18. Tallinn Manual 2.0, commentary to Rule 80, para. 5.
  19. Common Article 3 GCs.
  20. Prosecutor v Tadić (Decision on Jurisdiction) IT-94-1-AR72 (2 October 1995) [70].
  21. See also Prosecutor v Tadić (Trial Judgment) IT-94-1-T (7 May 1997) [562] (noting that the two criteria distinguish “an armed conflict from banditry, unorganized and short-lived insurrections, or terrorist activities, which are not subject to international humanitarian law”).
  22. Prosecutor v Boškoski and Tarčulovski (Trial Judgment) IT-04-82-T (10 July 2008) [177].
  23. Prosecutor v Limaj, Bala and Musliu (Trial Judgment) IT-03-66-T (30 November 2005) [129]; Prosecutor v Boškoski and Tarčulovski (Trial Judgment) IT-04-82-T (10 July 2008) [199]–[203].
  24. Cf. L Cameron et al, ‘Article 3: Conflicts Not of an International Character’ in ICRC (ed), Commentary on the First Geneva Convention (CUP 2016) 158 [436] (“In order to determine the existence of a non-international armed conflict involving cyber operations, the same criteria apply as with regard to kinetic violence.”).
  25. Tallinn Manual 2.0, commentary to rule 83, para 7; Yoram Dinstein, Non-International Armed Conflicts in International Law (CUP 2014) 35. For State views affirming this position, see, eg, French Ministry of the Armies, ‘International Law Applied to Operations in Cyberspace’, 9 September 2019, 12; Germany, ‘On the Application of International Law in Cyberspace: Position Paper’ (March 2021), 7.
  26. Tallinn Manual, Commentary to Rule 87, paras 9-10.
  27. GC III, Geneva Convention III, Convention (III) Relative to the Treatment of Prisoners of War, 12 August 1949, 75 UNTS 135
  28. Yves Sandoz, Christophe Swinarski, and Bruno Zimmermann (eds), Commentary on the Additional Protocols of 8 June 1977 to the Geneva Conventions of 12 August 1949 (ICRC 1987) 515 [1677]; Sean Watts, ‘Who Is a Prisoner of War?’ in A Clapham, P Gaeta, and M Sassòli (eds), The 1949 Geneva Conventions: A Commentary (OUP 2015) 890 [2]; Emily Crawford, Identifying the Enemy: Civilian Participation in Armed Conflict (OUP 2015) 17.
  29. ICRC, CIHL Study, Rule 3, 11, 13; Tallinn Manual 2.0, commentary to Rule 87, para. 2.
  30. Art 4A(1) GC III.
  31. Art 4A(3) GC III.
  32. Art 4A(2) GC III; see also Tallinn Manual 2.0, commentary to Rule 87, para. 1-5.
  33. Art 4A(2) GC III; Tallinn Manual 2.0, commentary to Rule 87, para. 5.
  34. Art 4A(2) GC III.
  35. Tallinn Manual 2.0, commentary to Rule 87, para. 5-6; Agreeing e.g.: Mallison/Mallison, Levie, Wedgwood, Schmitt, Ohlin, Corn/Watkin/Williamson; disagreeing: Draper, Goldman/Tittemore, Paust, Wallach, Pfanner, LaBlanc, Watts, Mačák.
  36. Art 43(1) AP I.
  37. Art 43(1) AP I.
  38. Knut Ipsen, ´Combatants and Non-combatants´ in Dieter Fleck (ed.), Handbook of International Humanitarian Law (3rd edn OUP 2013) 90-91.
  39. Ian Henderson, The Contemporary Law of Targeting (Martinus Nijhoff 2009) 83.
  40. Art 44(6) AP I.
  41. ICRC, CIHL Study, Rule 3.
  42. Tallinn Manual 2.0, commentary to Rule 87, para. 11-14; Maurizio D`Urso, ´The Cyber Combatant: a New Status for a New Warrior´ (2015) Philosophy & Technology 28, 475-478.
  43. ICRC, CIHL Study, Rule 3.
  44. Art 50(1) AP I; ICRC, CIHL Study, Rules 5, 17 and 18.
  45. Hans-Peter and Knut Dörmann, ´Protection of Civilian Population´ in Dieter Fleck (ed), Handbook of International Humanitarian Law (3rd edn OUP 2013) 233; ICRC, CIHL Study, Rules 5, 17 and 18.
  46. Art 50(1) AP I.
  47. Art 51(2) AP I; ICRC, CIHL Study, Rules 1, 7 and 25.
  48. Art 51(3) AP I.
  49. Tallinn Manual 2.0, commentary to Rule 87, para. 14.
  50. ICRC, CIHL Study, Rule 4 and 17.
  51. Art. 43 AP I.
  52. Art. 50 (1) AP I.
  53. Jean S Pictet (ed), Geneva Convention III relative to the Treatment of Prisoners of War: Commentary (ICRC 1960) 60.
  54. Yoram Dinstein (ed), The Conduct of Hostilities under the Law of International Armed Conflict (3rd edn, CUP 2016) 52.
  55. Compare: Art. 4 A (1), (2) GC III in connection with Art. 43 AP I.
  56. Art. 50 AP I.
  57. Art. 51 (2) AP I; ICRC, CIHL Study, Rule 1, 7 and 25.
  58. Art. 51 (3) AP I; ICRC, CIHL Study, Rules 6 and 34.
  59. ICRC, Interpretive Guidance on the Notion of Direct Participation in Hostilities under International Humanitarian Law (ICRC 2009)69-73; • Hans-Peter Gasser/ and Knut Dörmann, ´Protection of Civilian Population´ in D Fleck (ed), The Handbook of International Humanitarian Law (3rd edn, OUP 2013) 255-257.
  60. ICRC, CIHL Study, Rule 6.
  61. Tallinn Manual 2.0, Rule 97.
  62. Program on Humanitarian Policy and Conflict Research at Harvard University, Commentary on the HPCR Manual on the International Law Applicable to Air and Missile Warfare (hereinafter AMW Manual) (2009) Rule 28, 119-120; ICRC, Interpretive Guidance on the Notion of Direct Participation in Hostilities under International Humanitarian Law (ICRC 2009) 67; Michael N. Schmitt, ´The Interpretive Guidance on the Notion of Direct Participation in Hostilities: A Critical Analysis´, Harvard National Security Journal (2010) 25.
  63. ICRC, Interpretive Guidance on the Notion of Direct Participation in Hostilities under International Humanitarian Law (ICRC 2009) 41, 65-68; Tassilo Singer, ´Update to Revolving Door 2.0 – the Extension of the Period for Direct Participation in Hostilities Due to Autonomous Cyber Weapons´ in H. Roigas, R. Jakschis, L. Lindström and T. Minarik (eds.), Defending the Core, 9th International Conference on Cyber Conflict 2017 (NATO CCDCOE Publications 2017), 121-133; Bill Boothby, ‘“And for such time as”: The time dimension to direct participation in hostilities’ (2010) 42 International Law and Politics 741.
  64. ICRC, Interpretive Guidance on the Notion of Direct Participation in Hostilities under International Humanitarian Law (ICRC 2009) 46-64.
  65. ICRC, Interpretive Guidance on the Notion of Direct Participation in Hostilities under International Humanitarian Law (ICRC 2009) 46.
  66. Tallinn Manual 2.0, commentary to Rule 97, para. 5.
  67. Tallinn Manual 2.0, commentary to Rule 97, para. 5; see also ICRC, 51; AMW Manual, commentary accompanying Rule 29.
  68. ICRC, Interpretive Guidance on the Notion of Direct Participation in Hostilities under International Humanitarian Law (ICRC 2009) 33-35; Crit.: Michael N. Schmitt, ´The Interpretive Guidance on the Notion of Direct Participation in Hostilities: A Critical Analysis´, Harvard National Security Journal (2010) 21-24.
  69. ICRC, Interpretive Guidance on the Notion of Direct Participation in Hostilities under International Humanitarian Law (ICRC 2009) 34.
  70. ICRC, Interpretive Guidance on the Notion of Direct Participation in Hostilities under International Humanitarian Law (ICRC 2009) 33-35.
  71. Emily Crawford, ´Virtual Battlegrounds: Direct Participation in Cyber Warfare´ ( I/S: A Journal of Law and Policy Vol. 9:1 2013)12; Crit.: Yoram Dinstein (ed), Non-International Armed Conflicts (CUP 2014), 61-62.
  72. ICRC, Interpretive Guidance on the Notion of Direct Participation in Hostilities under International Humanitarian Law (ICRC 2009) 45, 70
  73. ICRC, Interpretive Guidance on the Notion of Direct Participation in Hostilities under International Humanitarian Law (ICRC 2009) 72.
  74. One example of indirect participation and thus no DPH was held in Prosecutor and Strugar (Appeal Judgment) IT-01-42-A (17 July 2008) [177] : “expressing sympathy for the cause of one of the parties to the conflict”; see also: ICRC, ICRC, Interpretive Guidance on the Notion of Direct Participation in Hostilities under International Humanitarian Law (ICRC 2009) 51.
  75. Prosecutor and Strugar (Appeal Judgment) IT-01-42-A (17 July 2008)[177] (“Examples of active or direct participation in hostilities include … transmitting military information for the immediate use of a belligerent”).
  76. See ICRC, Interpretive Guidance on the Notion of Direct Participation in Hostilities under International Humanitarian Law (ICRC 2009)16, 46-64.
  77. See e.g. Singer, 121-133
  78. Compare ICRC, Interpretive Guidance on the Notion of Direct Participation in Hostilities under International Humanitarian Law (ICRC 2009) 55.
  79. ICRC, Interpretive Guidance on the Notion of Direct Participation in Hostilities under International Humanitarian Law (ICRC 2009) 46.
  80. Affirmative concerning DDoS attacks to disrupt (potentially) mil. Networks: Emily Crawford, 'Virtual Battlegrounds: Direct Participation in Cyber Warfare' ( I/S: A Journal of Law and Policy Vol. 9:1 2013)15-16.
  81. Compare, Prosecutor and Strugar (Appeal Judgment) IT-01-42-A (17 July 2008) [177]; Ibid.
  82. ICRC, ICRC, Interpretive Guidance on the Notion of Direct Participation in Hostilities under International Humanitarian Law (ICRC 2009) 33-35.
  83. ICRC, Interpretive Guidance on the Notion of Direct Participation in Hostilities under International Humanitarian Law (ICRC 2009) 70.
  84. ICJ, Legality of the Threat or Use of Nuclear Weapons, ICJ Reports 1996, 226, para. 78-79.
  85. ICRC, CIHL Study, rule 1; Article 48 AP I (“the Parties to the conflict shall at all times distinguish between the civilian population and combatants”).
  86. Art. 48 and 51(2) AP I; Art. 13(2) AP II.
  87. Art. 8(2)(b)(i) and 8(2)(e)(i) Rome Statute of the International Criminal Court
  88. Art. 51(2) AP I; ICRC, CIHL Study, rule 2. See also Tallinn Manual 2.0, rule 98.
  89. Yoram Dinstein (ed), The Conduct of Hostilities under the Law of International Armed Conflict (3rd edn, CUP 2016) 105.
  90. Art. 51(3) AP I.
  91. See, eg, Michael N. Schmitt, ‘Fault Lines in the Law of Attack’ in S Breau and A Jachec-Neale (eds), Testing the Boundaries of International Humanitarian Law (BIICL 2006) 292 (noting that the principle of proportionality derives from the principle of distinction).
  92. Art. 51(5)(b) AP I.
  93. ICRC, The Principle of Proportionality in the Rules Governing the Conduct of Hostilities under International Humanitarian Law (Laurent Gisel ed.) (ICRC 2018) 5.
  94. ICRC, Interpretive Guidance on the Notion of Direct Participation in Hostilities under International Humanitarian Law (ICRC 2009) 33-36; Crit.: Michael N. Schmitt, 'The Interpretive Guidance on the Notion of Direct Participation in Hostilities: A Critical Analysis', Harvard National Security Journal (2010) 21-24.
  95. See for an extensive analysis: Yoram Dinstein (ed), The Conduct of Hostilities under the Law of International Armed Conflict (3rd edn, CUP 2016) 155-164.

Bibliography and further reading[edit | edit source]

  • Russell Buchan, ‘Cyber Warfare and the Status of Anonymous under International Humanitarian Law' (2016) Chinese JIL 741.
  • Emily Crawford, Identifying the Enemy: Civilian Participation in Armed Conflict (OUP 2015).
  • Hans-Peter Gasser and Knut Dörmann, ‘Protection of Civilian Population’ in Dieter Fleck (ed), The Handbook of International Humanitarian Law (3rd edn, OUP 2013).
  • Prosecutor v Boskoski and Tarculovski (Trial Judgment) IT-04-82-T (10 July 2008).
  • Prosecutor and Strugar (Appeal Judgment) IT-01-42-A (17 July 2008).
  • Knut Ipsen, ‘Combatants and Non-Combatants’ in Dieter Fleck (ed), The Handbook of International Humanitarian Law (3rd edn, OUP 2013).
  • ICRC, Interpretive Guidance on the Notion of Direct Participation in Hostilities under International Humanitarian Law (ICRC 2009).
  • Kubo Mačák, ‘Unblurring the lines: military cyber operations and international law’ (2021) 6(3) Journal of Cyber Policy 411.
  • Nils Melzer, ‘Cyber Operations and jus in bello’ in Kerstin Vignard (ed), Confronting Cyberconflict (UNIDIR 2011).
  • John Merriam, ‘Affirmative Target Identification, Operationalizing the Principle of Distinction for U.S. Warfighters’ (2015) 56 Virginia JIL 83.
  • Jody Prescott, ‘Direct Participation in Cyber Hostilities: Terms of Reference for Like-Minded States?’ in Christian Czosseck, Rain Ottis and Katharina Ziolkowski (eds), 4th International Conference on Cyber Conflict (NATO CCD COE 2012).
  • Michael N Schmitt (ed), Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations (CUP 2017).
  • Michael N Schmitt, ‘The Interpretive Guidance on the Notion of Direct Participation in Hostilities: A Critical Analysis’ (2010) 1 Harvard National Security Journal 5.
  • Tassilo Singer, ‘Update to Revolving Door 2.0 – the Extension of the Period for Direct Participation in Hostilities Due to Autonomous Cyber Weapons’ in Henry Rõigas and others (eds), 9th International Conference on Cyber Conflict: Defending the Core (NATO CCD COE 2017).
  • Sean Watts, ‘The Notion of Combatancy in Cyber Warfare’, in Christian Czosseck, Rain Ottis and Katharina Ziolkowski (eds), 4th International Conference on Cyber Conflict (NATO CCD COE 2012).

Contributions[edit | edit source]

Previous: Scenario 17: Collective responses Next: Scenario 19: Hate speech