Scenario 29: Cyber operations against water and water infrastructure

Two States are involved in an international armed conflict. One of them launches two cyber operations against the other State’s water infrastructure, impacting the quality of the water and affecting that State’s armed forces, the civilian population, and civilian objects. This scenario analyses the application of the principles on conduct of hostilities to these operations, as well as the special protection of certain objects, including water and water facilities, under international humanitarian law.

Scenario

Keywords

Attack (international humanitarian law), conduct of hostilities, international humanitarian law, military objectives, precautions, objects indispensable to the survival of the civilian population, water infrastructure, natural environment.

Facts

[F1] State A’s population is highly concentrated in its capital located around Lake X, which supplies water to 90% of the population, including households and irrigation works, through its main drinking water treatment and supply plants. The main wastewater (sewage) treatment plant for both residential and industrial waste, releases safe levels of treated water directly to River Y, which is an affluent of Lake X. The State has systematically received warnings from its National Cyber Security Agency on the necessary updates to the software used by the plants since several vulnerabilities were evidenced and some attempted intrusions were detected. The Agency recommended the implementation of an air-gapped (isolated from the internet) network for the control and operation systems of the plants. However, sufficient budget has not been allocated to such projects, even when available.

[F2] After years of a tense relationship between State A and its neighboring State B, armed hostilities dramatically escalated by both conventional and cyber means.

[F3] State B launched a cyber operation (incident 1) against the drinking water treatment installation, main source of drinking water for the civilian population in the capital, but which also provides water to camps where State A soldiers live and train through the same infrastructure and network. The State managed to access remotely the supervisory control and data acquisition (SCADA) systems of the plant and took control of the chlorine valves, while introducing malware which kept the sensors showing normal values to the controllers in order to hide the operation.

[F4] As a result, harmful proportions of chlorine were released into the drinking water source for several days and were only detected once the first intoxicated patients arrived at the hospital. The cyber operation was then detected and countered, but had in the meantime resulted in several deaths, including two soldiers from State A’s army, thousands of intoxications and damage to a substantial part of the crops near the capital. This also resulted in unprecedented rates of civilian population fleeing the capital due to safe water shortages and the acute sanitary situation.

[F5] Some weeks after the incident, State B launched another cyber operation (incident 2) targeting the wastewater treatment plant SCADA systems. The operation aimed to directly affect the military camps located by River Y, near the discharge of the plant, from which State A’s army was directly using and drinking water after incident 1.

[F6] As a result of this cyber operation, the facility’s treatment procedures were shut down, the water quality sensors disabled, and authorized personnel locked out of the compromised system. Unsafe water – containing sewage and industrial waste – was thus discharged in large amounts into River Y for a period of 3 weeks until State A managed to regain control over the systems. The operation resulted in several members of State A’s armed forces being hospitalized with severe gastrointestinal diseases and exacerbated the water insecurity in State A, since Lake X became highly contaminated thereafter.

Examples

• Israel’s water facilities attack (2020)
• Cyber incident against water treatment plant in San Francisco Bay Area (2021)
• Cyber incident against water utility in Pennsylvania (2023)

Legal analysis

For a general overview of the structure of analysis in this section, see Note on the structure of articles.

[L1] This scenario analyses the application of international humanitarian law (IHL) to cyber operations against water infrastructure in the context of an international armed conflict (IAC), causing harm to the civilian population. It addresses whether the operations qualify as attacks, legal issues related to the conduct of hostilities (including the special protection afforded by IHL to objects indispensable to the survival of the civilian population), and the protection of the natural environment in armed conflict.

Application of international humanitarian law and conflict qualification

International armed conflict

The law of international armed conflict (IAC) applies to any armed confrontation between two or more States, even if one, several, or all of them deny the existence of an armed conflict. Some scholars have suggested that the fighting must be of a certain intensity before international humanitarian law (IHL) comes into effect, but the prevailing view is that any “resort to armed force between States”, however brief or intense, triggers the application of IHL. Furthermore, the law does not prescribe any specific form for the resort to force, so hostilities between the belligerent States may involve any combination of kinetic and cyber operations, or cyber operations alone. It is unclear what effect cyber operations unaccompanied by any use of kinetic force would have to have in order for IHL to apply. Although it seems generally accepted that if cyber operations have similar effects to classic kinetic operations and two or more States are involved, the resulting situation would qualify as an IAC, the law is unsettled on whether cyber operations that merely disrupt the operation of military or civilian infrastructure amount to a resort to armed force for the purposes of IHL. In the cyber context, States often act through non-State intermediaries and proxies. In such situations at the outset of an armed confrontation, the relevant State must exercise a sufficient degree of control over the non-State entity that commences hostilities against another State for the situation to qualify as an IAC. However, the correct legal test to use in this regard is the subject of an ongoing controversy. The prevailing standard for the characterization of an international armed conflict is that of “overall control”, which requires that the State provides some support and that it participates in the organization, co-ordination, or planning of the relevant operations. A separate standard, the “effective control” test, requires that the State must exercise control over the entire course of the operations in question. While there is still disagreement as to whether the “effective control” test is the controlling test for the purposes of attribution under the law of State responsibility, there is consensus that the “overall control” test is the correct one for conflict qualification under IHL. The latter is also confirmed by decades of consistent practice by international criminal tribunals including the ICTY, the ECCC, and the ICC. Publicly available national positions that address this issue include: (2024), (2023), (2020), (2019), (2021), (2023), (2021).

[L2] In the present scenario, there is an ongoing IAC between State A and State B, since there are armed confrontations between the two States, conducted both by conventional and cyber means.

[L3] IHL applies to situations of armed conflict and governs all conduct of the parties to the conflict that has a sufficient nexus to the conflict, including cyber operations. Although there have been different interpretations of the requisite nexus, in the present scenario it is clear that both operations against State A’s water installations attributable to State B were conducted in furtherance of the hostilities between the two States and thus fall under the IHL legal framework, including all applicable treaty and customary IHL.

Obligations of State B

The notion of ‘attack’ under international humanitarian law

The notion of ‘attack’ under international humanitarian law

The question of whether an operation amounts to an ‘attack’ as defined in international humanitarian law (IHL) is essential for the application of many of the rules deriving from the principles of distinction, proportionality and precaution. While some IHL rules impose limits on any military (cyber) operation, the rules specifically applicable to ‘attacks’ afford significant protection to civilians and civilian objects in times of armed conflict. Article 49 of Additional Protocol I defines ‘attacks’ as ‘acts of violence against the adversary, whether in offence or in defence’. Viewed as ‘combat action’, they are understood to denote violence directed against military forces of an opposing party. Arguments that a subjective element of purpose or motive to cause harm are inherent in the notion of attack have not found wide support. The notion of violence in this definition can refer to either the means of warfare or their effects, meaning that an operation causing violent effects can qualify as an attack even if the means used to bring about those effects are not violent as such. Accordingly, it is widely accepted that cyber operations that can be reasonably expected to cause injury or death to persons or damage or destruction to objects constitute attacks under IHL. There has been limited discussion over the contours of the reasonable foreseeability of harm standard for the purposes of defining attacks. In the assessment of what constitutes the ‘reasonably expected’ effects of an operation that have to be considered, some States, including Denmark, Finland, New Zealand, Norway, Switzerland, or the United States, have clarified that this includes harm due to the foreseeable direct and indirect (or reverberating) effects of an attack. An indirect or reverberating effect would include, for example, the death of patients in intensive-care units caused by a cyber operation on an electricity network that results in cutting off a hospital’s electricity supply – a view shared by the ICRC. Care must be exercised in considering the extent to which understandings of reasonable foreseeability for the purposes of other rules of IHL can be deemed relevant in the interpretation of ‘attack’. At present, different views exist on the interpretation of what constitutes ‘damage’ for assessing whether an operations amounts to an ‘attack’. One view, taken by some States including Denmark, Israel, and Peru, is that only physical damage is relevant in the assessment of what constitutes an attack under IHL. Other States have interpreted the notion of ‘attack’ wider. States including Bolivia, Ecuador, France, Germany, Guatemala, Japan, and New Zealand consider that cyber operations may qualify as an ‘attack’ without causing physical damage if they disable the functionality of the target. For its part, the ICRC interprets the notion of ‘attack’ as including a loss of functionality. In its view, ‘an operation designed to disable a computer or a computer network constitutes an attack under IHL, whether the object is disabled through kinetic or cyber means’. Publicly available national positions that address this issue include: (2020), (2021), (2022), (2023), (2023), (2019), (2021), (2023), (2020), (2021), (2021), (2019), (2020), (2021), (2023), (2022), (2021), (2021), (2016), (2021).

[L4] The cyber operations launched by State B were clearly expected to cause reasonably foreseeable harm and therefore qualified as attacks. This holds true even if the method used to cause such effects, i.e., the manipulation of the SCADA control systems, was not violent as such. By altering the levels of chlorine to dangerous levels in the drinking water used by the households in State A for their daily lives (incident 1), the operation could have been reasonably expected to cause injury and even death to people, as well as damage to civilian objects. This is equally the case with respect to the discharge of unsafe water into the main source of water of the military camp (incident 2) which resulted in the injury of several members of State A’s armed forces as well as damage to the natural environment.

[L5] As both operations could have been reasonably expected to cause physical damage in the form of injury to people and damage to civilian objects, they constituted attacks under IHL even applying the more restrictive threshold adopted by some States and part of the doctrine. Therefore, both incidents are subject to the IHL rules applicable to ‘attacks’, as discussed below.

[L6] Moreover, some States have specifically affirmed that cyber operations can qualify as attacks if they render inoperable or undermine the functioning of a State’s critical infrastructure needed for the provision of basic services, such as water.

Principle of distinction: Military objectives

Military objectives

The principle of distinction, one of the foundational precepts of IHL, requires that the parties to an armed conflict must at all times distinguish between civilian objects and military objectives and may, accordingly, only direct their operations against military objectives. The customary definition of military objectives is found in Article 52(2) of Additional Protocol I: In so far as objects are concerned, military objectives are limited to those objects which by their nature, location, purpose or use make an effective contribution to military action and whose total or partial destruction, capture or neutralization, in the circumstances ruling at the time, offers a definite military advantage. Thus, to qualify as a military objective, an object must cumulatively meet the two criteria set forth in the abovementioned rule, which must be determined on a case-by-case basis. In case of doubt as to whether an object that is normally dedicated to civilian purposes is being used to make an effective contribution to military action, it must be presumed to remain protected as a civilian object. The formal scope of application of the Protocol is limited to international armed conflicts (IACs). However, an identical definition of military objectives is found in treaties applicable in non-international armed conflicts (NIACs). Moreover, certain non-party States to the Protocol accept the customary nature of the definition. Accordingly, the ICRC has characterized the definition of military objectives as a norm of customary international humanitarian law applicable in both IACs and NIACs. Relevant rules of IHL apply to kinetic operations as well as to cyber operations. However, the application of those rules in specific circumstances may pose novel challenges. This is because the rules governing targeting developed with physical operations in mind, and it is not always clear what their application to cyber operations entails. For example, there is some disagreement on what types of acts amount to “attacks” in the context of cyber operations, in particular when the operation in question is limited to the manipulation of data. Nevertheless, even those operations that might not qualify as “attacks” under IHL may still only be directed against military objectives, as required by the principle of distinction. Further, due to the interconnectedness of civilian and military networks as well as in-built redundancies, it may be challenging to apply the definition of military objectives to those parts of cyber infrastructure that simultaneously serve civilian and military purposes (also referred to as “dual-use objects”). Publicly available national positions that address this issue include: (2023), (2019), (2021), (2012).

[L7] Water infrastructure, including the industrial control systems supporting it, normally qualifies as a civilian object. IHL prohibits attacks on civilian objects, including civilian infrastructure, unless the object in question has become a military objective. It is therefore necessary to assess if the targeted facilities qualified as military objectives under IHL at the moment of the attack.

[L8] In the case of incident 1, the drinking water installation was providing safe drinking water for both the civilian population in the capital of State A, as well as the military camps of State A forces. The use of the installation for military purposes, i.e., for the sustenance of the military camp, may be considered to make an effective contribution to military action by its use. The fact that the same infrastructure is simultaneously used for civilian purposes, and is thus a so-called “dual-use” object, does not affect this conclusion, as long as the two cumulative conditions for a civilian object to become a military objective are met. However, this does not mean that the impact of the operation on the civilian use would not need to be addressed in the proportionality and precautions assessments (on which see paras L12–L22 below). It is submitted that taking control over the cyber infrastructure falls under the notion of “capture” in the words of Article 52(2) AP I, since State B seized the object, maintaining control over its functions and denying its use to the adversary. The ‘capture’ of the water infrastructure did provide a definite military advantage in those circumstances, by harming State A’s armed forces, preventing the military camps from access to safe drinking water, and thus weakening the fighting ability of enemy armed forces. The drinking water facility did therefore qualify as a military objective.

[L9] In addition, under IHL, the use of indiscriminate means or methods of warfare, including those employing means or methods of warfare the effects of which cannot be limited and thus are of a nature to strike both military objectives and civilians or civilian objects without distinction, are prohibited as constituting indiscriminate attacks. In the present scenario, the method of ‘poisoning’ the drinking water by means of altering the normal parameters of the water installation, has an indiscriminate character, since it cannot be limited to the military objective, including the water facility, but affects all the accessible drinking water thus harming civilians without distinction and may be expected to cause disproportionate harm to civilians. Therefore, it can be concluded that given the nature of the installation object of the attack (i.e., its preponderant civilian use alongside its military one) and the method employed, the operation constituted an indiscriminate attack and thus was in violation of IHL.

[L10] Regarding incident 2, it should be first analyzed if the wastewater treatment facility constituted a military objective. As in the previous case, the installation was civilian in nature. Although its neutralization did provide a definite military advantage by harming the members of State A’s armed forces and preventing them from using the source of natural water, it is not clear whether its use, location or purpose made an effective contribution to military action per se. It could be argued that since the occurrence of incident 1, the armed forces (as well as the civilian population) had to resort to the natural water provided by the water stream. This water remained usable because of the functioning of the wastewater treatment plant and thus its use became a concrete contribution to military action at the moment of the attack. However, the contribution was, in view of this author, too indirect to qualify the installation as a military objective. The service ensured by the wastewater treatment facility was not providing water directly to the military, but it was preventing raw water from being contaminated. The armed forces directly made use of the raw water. Thus, in this case there was no direct but only an indirect connection with the installations, in contrast to the water treatment plant in incident 1, to which the military camp was directly connected through the pipeline providing drinking water. In addition, it is worth noting that in case of doubt regarding an object normally dedicated to civilian purposes, it must be presumed to remain protected as a civilian object, particularly should Additional Protocol I be applicable.

[L11] Overall, even if the object was considered a military objective at the moment of the attack, State B had to respect the prohibition of indiscriminate attacks. This includes the prohibition of employing methods of combat the effects of which cannot be limited as required by IHL, which was hardly complied with in the present scenario, and the principle of proportionality (on which see paras L12–L19 below).

Proportionality

Proportionality

The principle of proportionality prohibits attacks ‘which may be expected to cause incidental loss of civilian life, injury to civilians, damage to civilian objects, or a combination thereof, which would be excessive in relation to the concrete and direct military advantage anticipated’. The principle of proportionality is codified in Articles 51(5)(b) and 57(2)(a)(iii)(b) of the 1977 Additional Protocol I and reflects customary international law. The nature of the principle makes it relevant only to attacks directed at military objectives or persons who are lawful targets, where incidental civilian loss of life, injury, damage to civilian objects, or a combination thereof, is expected. These three types of harms are commonly referred to as ‘incidental civilian harm’. The principle of proportionality is ex ante in nature, as it demands a balancing of the expected civilian harm and the anticipated military advantage. A proportionality assessment must therefore be made in advance of an attack and cannot be judged based on hindsight. The assessment must be made on the basis of a ‘reasonable military commander’s’ assessment of the information which is reasonably available from all sources at the relevant time. The decision must be made in good faith. The ICRC has expressed the view that all direct and indirect incidental civilian harm that is foreseeably caused by the attack must be taken into consideration in the proportionality assessment. Direct harm relates to consequences that are directly and immediately caused by a cyber attack. All other harms are considered indirect harms; sometimes referred to as the ‘reverberating’ effects of an attack. For example, if it is reasonably expected that a cyber attack against a power grid will cause deaths in a hospital emergency ward due to a lack of power, those deaths must be part of the proportionality assessment. While one military manual claims the assessment of incidental civilian harm is generally understood to be limited to immediate or direct harm, most of them do not limit the assessment in this way and a number of manuals and other relevant official State documents expressly require the consideration of indirect effects. When considering what constitutes ‘damage’ to civilian objects, some have argued that the damage does not have to be physical, but may include loss or deprivation of functionality. However, Tallinn Manual experts agreed that damage must go beyond inconvenience, irritation, stress, or fear since these consequences do not amount to incidental loss of civilian life, injury to civilians, or damage to civilian objects. Finally, when different types of incidental civilian harm are anticipated, the harms must be assessed in combination, and not in isolation of each other. The ‘concrete and direct’ military advantage that is assessed is that which is ‘substantial and relatively close’. Conversely, ‘advantages which are hardly perceptible and those which would only appear in the long term should be disregarded’. Among others, the expected military advantage to be assessed cannot be merely speculative. Additionally, advantages that are solely political, psychological, economic, financial, social, or moral in nature do not constitute ‘military advantage’ under the principle of proportionality. When ratifying Additional Protocol I, a number of States explained that they consider the military advantage from an attack to refer to the ‘advantage anticipated from the attack as a whole and not only from isolated or particular parts of an attack’. When assessing whether the incidental civilian harm will be excessive to the attack’s anticipated concrete and direct military advantage, determining ‘excessiveness’ entails a subjective assessment that allows for a ‘fairly broad margin of judgement’. At the same time, the determination of excessiveness also has an objective element since it ‘must be based on that of the “reasonable commander”’. Publicly available national positions that address this issue include: (2024), (2023).

[L12] As affirmed in the previous section, it can be stated that incident 1 was directed at a military objective. Besides the conclusion that the attack would be contrary to IHL by employing indiscriminate methods, the expected incidental civilian harm caused by such a method would also be of particular relevance to the present analysis.

[L13] The fact that the object was also used for civilian purposes, that is, the provision of drinking water to the civilian population of State A’s capital, implied that the operation should have been reasonably expected to result in incidental civilian harm, including civilian loss of life and/or injury and damage of civilian objects, and raised specific questions regarding the principle of proportionality. For such assessment, all the reasonably foreseeable direct and indirect or reverberating effects on the civilian population caused by targeting the installation must be considered and appropriately weighed.

[L14] The expected civilian harm to the civilian population of State B’s first operation included the harmful effects to the health of the inhabitants of State A’s capital by means of intoxication by unhealthy levels of chlorine in the consumed water and the possible loss of life.

[L15] The same would hold true in case incident 2 was not already considered to have violated the principle of distinction (see paras L10–L11 above). The expected incidental harm by the foreseeable contamination of Lake X by means of the sewage and industrial waste carried in by its affluent river, would include the injury to the same population that after incident 1 turned to seek water directly from the source, exposing them to the health impacts of such contaminated water, including grave waterborne diseases.

[L16] The ICRC has argued that “[w]hile displacement is not expressly mentioned in the principles of proportionality and precautions as a relevant type of civilian harm”, the expected displacement of civilians when incidentally damaging their livelihoods, “will affect the weight to be given to that damage”. In the present scenario, the expected water insecurity and foreseeable civilian displacement triggered in State A by incident 1, and cumulatively by incident 2, should be also appropriately weighed when assessing the civilian damage in combination with the other types of civilian harm.

[L17] Further, attacks against water infrastructure by conventional or cyber means, especially certain types such as wastewater treatment plants, can cause significant damage to the natural environment. They may have reserves of toxic industrial chemicals, which can have significant adverse effects on the environment if released, including the contamination of surface and groundwaters, and degradation of the soil. This also entails grave risk to the health and livelihoods of the civilian population, and the poisoning of the flora and fauna having an impact on the ecosystem. As will be further explained below (see paras L30–L31), besides having a special protection, the natural environment is protected under the general principles of IHL governing civilian objects. Thus, damage to the natural environment must also be weighed as incidental civilian harm within the proportionality assessment. It should have been reasonably expected that the large amounts of toxic substances released to Lake X and River Y (an affluent of Lake X), including chlorine (incident 1) and sewage and industrial waste (incident 2), would result in the contamination of the water resources and surrounding ecosystems, on top of the harm caused to the civilian population using those resources for their living.

[L18] For its part, the reasonable concrete and direct military advantage anticipated from incident 1 would comprise harming soldiers of State A’s armed forces from the military camps provisioned by the targeted water installation, including injuries and/or loss of life, and prevent them from using the water pipeline as a source of safe drinking water for the military camp. Regarding incident 2, in addition to harming the members of State A’s armed forces, the attack would also imply the absence of water resources to provide for the livelihood of the armed forces in the military camps near Lake X. As a result, the camps would most likely be moved to another location.

[L19] Having assessed the expected incidental civilian harm and the concrete and direct military advantage anticipated, it is necessary to determine whether the harm would be excessive. While a definite conclusion could only be drawn based on more detailed factual circumstances, it may be argued that the expected harm to the civilian population would be prima facie excessive in both individual incidents and thus in violation of the proportionality rule. This conclusion is based particularly on the expected widespread effects of the attack. Notably, 90% of the population living in the capital were users of the drinking water provided by the affected water infrastructure (incident 1), and subsequently the civilian population is supplied directly from the raw water resources (incident 2) and thus exposed to the direct and indirect effects of the attacks. This, added to the harm caused to the natural environment, that should also be appropriately weighed in the proportionality assessment. This would be arguably justified by the harm caused to soldiers from the camps supplied by the same water sources, and the likely relocation of the camps. Ultimately, however, the answer would have to be measured against the standard of a reasonable military commander based on the circumstances ruling at the time of the attack.

Precautions in attack

Obligations to take precautions in attack

The obligations to take precautions in attack (also referred to as “active precautions”) are most fully codified in Article 57 of Additional Protocol I. This article mandates the taking of a wide variety of measures from target verification and the giving of effective advance warnings through the choice of means and methods of warfare and choice of military objectives to cancellation or suspension of attacks where it becomes apparent that the attack’s target is not a military one or is subject to special protection, or that the attack may be disproportionate. In the interpretation of these precautionary measures, care must be taken to determine what exactly is required of those involved in planning, deciding upon, and executing attacks. The standards vary. For instance, some precautionary measures operate within a ‘feasibility’ standard, while others, such as effective advance warnings, must be taken ‘unless circumstances do not permit’. There is no specifically prescribed method through which these obligations ought to be discharged. Feasibility, a standard that appears frequently in Article 57, is a contextual standard, and it depends on the presence of a range of factors in the circumstances prevailing at the time. In this regard, ‘feasible’ is understood as ‘that which is practicable or practically possible, taking into account all circumstances prevailing at the time, including humanitarian and military considerations’. Importantly, the standard of feasibility is capable of accommodating a range of considerations, and it evolves through time and with the acquisition of experience. While the protection of the civilian population and civilian objects in times of conflict is a challenging task in any domain, cyberspace adds its own layer of complexity. A primary reason for this is the interconnectivity of networks and the risks of escalation and unintended consequences. Thus, in conducting attacks in cyberspace, parties to conflict should consider suitable and feasible cyber-specific precautions such as impact assessments on the connectivity of military and civilian networks and on secondary effects of attacks or the identification of cyber networks and infrastructure that are serving specially protected objects.

[L20] For the purposes of this analysis it will be assumed that the two cyber operations would have complied with the principle of distinction, otherwise the operations would already be in violation of IHL. Both incident 1 and incident 2 entailed a very high risk for the civilian population and civilian objects, including the natural environment. State B was obliged to take constant care to spare the civilian population, civilians, and civilian objects in the conduct of its military operations. In the absence of a feasible possibility of segregating the military use of the facilities from the civilian ones during the attack, the consequent expected civilian harm shall be constantly assessed in the conduct of the cyber operation within the principle of precautions. In the assessment of incidental civilian harm, the reasonably foreseeable direct and indirect (or reverberating) effects of the attack against the systems must be considered. In this regard, the assessment should include the injury to the civilian population, but also the shortage of drinking water and starvation, its effects on the provision of other essential services such as health services and resulting disease outbreaks, shortage of safe water for irrigation of foodstuff, educational services, the expected displacement and the effects on the natural environment as will be analyzed below (see paras L30–L31).

[L21] In the present case, it could be argued that State B did not comply with its obligations to take precautions in attack. First, although further information would be needed on the available means and methods for State B to conduct the military cyber operation, it presumably did not take all feasible precautions in the choice of means and methods, nor refrained from launching the attacks, to avoid or minimize the expected incidental loss and injury of civilians and damage of civilian objects. To the contrary, it was conducted using indiscriminate methods the effects of which cannot be limited as required by IHL, and causing disproportionate incidental civilian harm, an IHL prohibition reinforced by the principle of precautions.

[L22] Further, no advance warnings were given to the civilian population in either of the attacks to avoid or minimize the incidental harm caused by the contaminated water, even though it was clear that they would necessarily be adversely affected by its release. However, it should be recalled that advance warnings must only be given ‘unless circumstances do not permit’. In this regard, the feasibility of the warnings, including whether the element of surprise was essential to the success of the operations, should be also considered under this rule. Moreover, the operations were only detected after the first casualties reached the hospital, and only thwarted by State A. Thus, State B did not cancel or suspend the cyber operations when it became apparent, not only that the objectives were subject to special protection under IHL (see para L24 below), but also when the excessive effects over the civilian population and objects became apparent. This would indeed be the case of incident 2 as a subsequent incident after the effects of the first attack became apparent.

Objects indispensable to the survival of the civilian population

Objects indispensable to the survival of the civilian population

Besides constituting civilian objects, objects indispensable to the survival of the civilian population enjoy a special protection under IHL applicable in both international and non-international armed conflicts (IACs and NIACs, respectively). As a corollary of the prohibition of starvation of the civilian population as a method of warfare, the rule prohibits to attack, destroy, remove, and render useless objects indispensable to the survival of the civilian population. This rule is considered to reflect customary IHL. This protection has also been affirmed in the national positions of several States including Costa Rica, the Czech Republic, France, and Norway. These specially protected objects include, although are not limited to, foodstuffs, agricultural areas for their production, crops, livestock, drinking water installations and supplies, and irrigation works. The enumeration provided by the IHL rules is merely illustrative and should be interpreted in the wider sense to cover the means of existence of the populations, including both objects of sustenance and those contributing to their production. The prohibition covers a broader range of operations which are designed or can be expected to disable or render these objects useless, irrespective of them qualifying as attacks and beyond their destruction. As interpreted by the ICRC, it covers all possibilities, including the pollution of water reservoirs by chemical or other agents and the destruction of crops by defoliants, in offence or defense. Additional Protocol I applicable to IACs refers to the purpose of denying these objects of their sustenance value regardless of the motive, i.e., whether to starve the civilian population or to cause their movement. It is controversial whether the same interpretation applies to NIACs, since part of the doctrine has argued that Additional Protocol II prohibits the abovementioned acts only when undertaken with the purpose of starvation of civilian population. IHL applicable to IACs provides for two exceptions to the rule: (i) in case the sustenance is solely for members of the adversary forces; or (ii) when they are used in direct support of military action, provided that the actions shall not in any event be expected to cause starvation or force the movement of the civilian population. It is doubtful, however, whether these exceptions also apply to non-international armed conflicts, since they are not provided under Additional Protocol II and there is no practice supporting it under Customary IHL. Some stakeholders have in any case urged States parties to IACs to refrain from carrying harmful acts under any circumstances, even if the conditions of the exceptions are met. In any case, the obligations of proportionality and precautions must be fully respected even if the operation falls within the exceptions. The prohibition also applies when the attack against such objects or their destruction, removal or rendering useless is done by means of cyber operations. It has been claimed that although the Internet cannot be considered such an object, cyber infrastructure indispensable to its function and operation, could also qualify within the specially protected objects. This rule extends beyond the notion of cyber “attacks” and applies to any cyber operation designed to deny the sustenance value to objects indispensable to the survival of the civilian population. The protection of these objects must be understood as extending to deleting or otherwise tampering with data needed for their functioning, in a manner that renders useless objects indispensable to the survival of the civilian population. Thus, within this framework whether data constitutes an object or not is immaterial. Publicly available national positions that address this issue include: (2023), (2024), (2019), (2021).

*Although the assessment of whether the objects in question enjoyed a special protection under IHL would ordinarily be done before the assessment of the principles of proportionality and precautions, it is included here in the present scenario for clarity purposes.

[L23] In addition to the previous analysis, water and water infrastructure, as objects indispensable to the survival of the civilian population, benefit from a special protection under IHL and thus additional restrictions apply to the operations targeting them. Therefore, even if the attacks had been lawful under IHL under the general principles, the cyber operations should be analyzed under the special protection regime, which adds a layer of protection to certain objects.

[L24] Both the drinking water facility (incident 1) as well as the water treatment plant (incident 2) of State A clearly fall under the special protection of objects indispensable to the survival of the civilian population under IHL. They are protected as installations securing access to quality water supply, indispensable to the subsistence of the population.

[L25] The prohibition under IHL covers all acts denying the sustenance value of these objects, including the pollution of water reservoirs by chemical or other agents, limiting the provision of water supplies and putting the quality of drinking water for the population at risk. These effects were clearly expected from attacking and rendering the installations useless and thus (i) introducing unhealthy concentrations of chlorine to the household water supplies, as well as (ii) polluting the water stream (River Y) as well as Lake X and arguably the soil, with sewage and industrial waste, as a result.

[L26] The cyber operations were indeed conducted by State B with the purpose of denying these objects of their sustenance value to the adverse party, i.e., State A.

[L27] Considering that the incidents took place during, and had a nexus with, an IAC between States A and B, should Additional Protocol I be applicable, it remains to be addressed whether any of the exceptions apply to the present situation. Regarding the first exception, it is clear from the facts that the targeted water facilities were not only used for the sustenance solely of the armed forces of State A, as both were key installations for the provision of safe drinking water to the civilian population surrounding Lake X. In any case, it has been affirmed that this exception is “undoubtedly concerned with foodstuffs and the agricultural areas producing them, crops, livestock and supplies of drinking water, but not with installations for drinking water or irrigation works”, since they are hardly likely to be used solely for the benefit of armed forces.

[L28] Regarding the second exception, at least in incident 1 the facilities were being used for the sustenance of State A’s armed forces by providing water to its military camps, and thus could be arguably understood as providing direct support of military action. However, it has been argued by some that this does not seem sufficient reason for depriving these objects from its special protection. Further, the operations were clearly expected to leave the civilian population with (at least) inadequate water as to reduce the civilian population to starvation or force its movement. The operations must have been expected to cause the pollution of the main water supply of State A’s capital, a source indispensable for its survival.

[L29] In conclusion, both cyber attacks constituted unlawful operations under IHL in violation of the special protection afforded to objects indispensable to the survival of the civilian population.

Protection of the natural environment in armed conflict

Protection of the natural environment in armed conflict

The natural environment is protected during armed conflict under IHL by both specific and general rules. To begin with, specific IHL rules provide that it is prohibited to use methods or means of warfare which are intended or may be expected to cause widespread, long-term, and severe damage to the natural environment. It is worth noting that the customary nature of this rule has been contested, as well as its application to both international and non-international armed conflicts. Moreover, it is prohibited to use the destruction of the natural environment as a weapon of warfare. Further, due regard must be given to the protection and preservation of the natural environment in warfare. In addition, under the Convention on the Prohibition of Military or Any Other Hostile Use of Environmental Modification Techniques (ENMOD), the military or any other hostile use of environmental modification techniques having widespread, long-lasting, or severe effects as the means of destruction, damage or injury to any other State Party is prohibited. The three criteria of “widespread, long-lasting or severe” under this Convention are alternative rather than cumulative and their threshold has been interpreted to be rather lower than the one established in Additional Protocol I. It is worth noting that contemporary knowledge of the effects of harming the natural environment must be considered to address the degree of damage. Moreover, the natural environment is protected under the general principles of IHL governing civilian objects, unless parts of it become a military objective. Therefore, all the principles governing the conduct of hostilities, such as distinction, proportionality, and precautions fully apply to the natural environment. The protection of the natural environment under IHL also applies to cyber operations and their effects. Publicly available national positions that address this issue include: (2019), and (2021).

[L30] Water resources, including drinking water, are clearly protected under IHL also as part of the natural environment. Regarding the specific prohibition of employing cyber means or methods of warfare which are intended or may be expected to cause widespread, long-term, and severe damage to the natural environment, this would apply even if the water infrastructure become military objectives by their use. Both incidents 1 and 2 were expected to cause significant damage to the natural environment, including the severe contamination of at least Lake X and parts of River Y, and arguably parts of the surrounding ecosystem. However, it is not clear from the facts if the damage meets the very high threshold as provided by the cumulative criteria established in Articles 35(3) and 55 of Additional Protocol I, should it be applicable, including damage for a period of decades. Therefore, no conclusive assessment could be done regarding the violation of this absolute prohibition under IHL.

[L31] However, the natural environment including the water resources, is a civilian object unless it becomes itself a military objective. As such, environmental damage caused by the release of harmful substances, including the contamination and degradation of water supplies, the soil and the ecosystem as a whole, should be duly considered within the incidental civilian harm when applying the principles of the conduct of hostilities to the attacks against the targeted water facilities, in particular within the proportionality assessment (see para L17 above).

Conclusion

[L32] To conclude, State B’s cyber operations against State A’s water infrastructure fall within the scope of IHL applicable to IACs and were not in compliance with the applicable rules governing the conduct of hostilities, including the principles of distinction, proportionality and precautions, in addition to qualifying as violations of the prohibition to attack, destroy, remove or render useless objects indispensable to the survival of the civilian population.

Obligations of State A

Precautions against the effects of attacks

Obligations to take precautions against the effects of attacks

In addition to obligations to take precautions in attack, IHL requires parties to take precautions against the effects of attacks (also referred to as “passive precautions”). According to Article 58 of Additional Protocol I, ‘The Parties to the conflict shall, to the maximum extent feasible: a) [...] endeavour to remove the civilian population, individual civilians and civilian objects under their control from the vicinity of military objectives; b) avoid locating military objectives within or near densely populated areas; c) take the other necessary precautions to protect the civilian population, individual civilians and civilian objects under their control against the dangers resulting from military operations.’ These specific measures require defending forces to protect the civilian population and civilian objects under their control. They are cast in relative terms, as they incorporate a standard of feasibility. A type of conduct, rather than a result, is what lies at the heart of these precautionary obligations. In cyberspace, these precautionary measures can take the form of, for example, building strong cyber resilience cultures at a societal level, segregating civilian and military cyber networks and infrastructure, using antivirus software, or setting up systems for the detection of cyber vulnerabilities.

[L33] State A had an obligation to adopt feasible precautionary measures to protect the civilian population and civilian objects under its control from the danger resulting from military operations, including cyber operations. While taking measures such as segregating civilian and military uses of water infrastructure may be less feasible in practice, applicable measures can include implementing strong cyber security defense measures and resilience of essential services’ cyber infrastructure to reduce cyber vulnerabilities and thus the risk of civilian harm.

[L34] In the present scenario, State A was systematically warned about the exposure of its water infrastructure to several cyber vulnerabilities but disregarded the implementation of precautionary measures that could have enhanced the protection and resilience of the infrastructure itself and thus of the civilian population and civilian objects relying on such essential service from the effects of the attacks, such as updating the software of the plants or segregating them from the internet.

[L35] Therefore, State A prima facie failed to take all feasible precautions, even in the knowledge of existing vulnerabilities within the water infrastructure’s systems, to protect to the maximum extent feasible the civilian population and civilian objects under its control, in contravention of its obligations under treaty (assuming that Additional Protocol I was applicable) and customary IHL.

Checklist

• Did the operations have a nexus with an armed conflict?
• Did the operations qualify as “attacks” under IHL?
• Were the targeted objects military objectives under IHL?
• Did the operations comply with the principle of proportionality under IHL? Was environmental damage appropriately weighed within the proportionality assessment?
• Did the attacker adopt feasible precautions in order to avoid or minimize civilian harm?
• Did the defender take feasible precautions to protect the civilian population under its control against the danger resulting from military operations?
• Did the special protection that IHL affords to objects indispensable to the survival of the civilian population apply to the operations under analysis?
• Were the rules on the protection of the natural environment applicable to the operations and if so, were they complied with?

Appendixes

See also

• Scenario 13: Cyber operations as a trigger of the law of armed conflict
• Scenario 22: Cyber methods of warfare
• International armed conflict
• Attack (international humanitarian law)
• Military objectives
• Means and methods of cyber warfare
• Objects indispensable to the survival of the civilian population

Bibliography and further reading

• Laurent Gisel, Tilman Rodenhäuser and Knut Dörmann, “Twenty years on: International humanitarian law and the protection of civilians against the effects of cyber operations during armed conflicts”, (2022) 102 (913) International Review of the Red Cross
• Sergio Caltagirone, “Industrial cyber attacks: a humanitarian crisis in the making” (Humanitarian Law & Policy, 3 December 2019)
• Eirini Giorgou and Abby Zeith, “When the lights go out: the protection of energy infrastructure in armed conflict” (Humanitarian Law & Policy, 20 April 2023)
• Geneva Water Hub, The Geneva List of Principles on the Protection of Water Infrastructure, Geneva (2019)
• ICRC, The principle of distinction under IHL, Cyber Operations during Armed Conflict Series, Geneva (March 2023)
• ICRC, The Principle of Proportionality, Cyber Operations during Armed Conflict Series, Geneva (March 2023)
• Marco Roscini, Cyber Operations and the Use of Force in International Law (Oxford University Press 2014)
• Mara Tignino, “The regulation of crimes against water in armed conflicts and other situations of violence”, (2023) 105(923) International Review of the Red Cross
• ICRC, Avoiding Civilian Harm from Military Cyber Operations During Armed Conflicts, Report of Expert meeting held from 21-22 January 2020, ICRC, Geneva (May 2021)

Contributions

• Scenario by: Dominique Steinbrecher
• Analysis by: Dominique Steinbrecher
• Reviewed by: Tadesse Kebebew, Chris O'Meara and Mara Tignino

Previous: Scenario 28: Extraterritorial incidental civilian cyber harm