Scenario 29: Cyber operations against water and water infrastructure

From International cyber law: interactive toolkit
Jump to navigation Jump to search
Rawpixel

Two States are involved in an international armed conflict. One of them launches two cyber operations against the other State’s water infrastructure, impacting the quality of the water and affecting that State’s armed forces, the civilian population, and civilian objects. This scenario analyses the application of the principles on conduct of hostilities to these operations, as well as the special protection of certain objects, including water and water facilities, under international humanitarian law.

Scenario[edit | edit source]

Keywords[edit | edit source]

Attack (international humanitarian law), conduct of hostilities, international humanitarian law, military objectives, precautions, objects indispensable to the survival of the civilian population, water infrastructure, natural environment.

Facts[edit | edit source]

[F1] State A’s population is highly concentrated in its capital located around Lake X, which supplies water to 90% of the population, including households and irrigation works, through its main drinking water treatment and supply plants. The main wastewater (sewage) treatment plant for both residential and industrial waste, releases safe levels of treated water directly to River Y, which is an affluent of Lake X. The State has systematically received warnings from its National Cyber Security Agency on the necessary updates to the software used by the plants since several vulnerabilities were evidenced and some attempted intrusions were detected. The Agency recommended the implementation of an air-gapped (isolated from the internet) network for the control and operation systems of the plants. However, sufficient budget has not been allocated to such projects, even when available.

[F2] After years of a tense relationship between State A and its neighboring State B, armed hostilities dramatically escalated by both conventional and cyber means.

[F3] State B launched a cyber operation (incident 1) against the drinking water treatment installation, main source of drinking water for the civilian population in the capital, but which also provides water to camps where State A soldiers live and train through the same infrastructure and network. The State managed to access remotely the supervisory control and data acquisition (SCADA) systems of the plant and took control of the chlorine valves, while introducing malware which kept the sensors showing normal values to the controllers in order to hide the operation.

[F4] As a result, harmful proportions of chlorine were released into the drinking water source for several days and were only detected once the first intoxicated patients arrived at the hospital. The cyber operation was then detected and countered, but had in the meantime resulted in several deaths, including two soldiers from State A’s army, thousands of intoxications and damage to a substantial part of the crops near the capital. This also resulted in unprecedented rates of civilian population fleeing the capital due to safe water shortages and the acute sanitary situation.

[F5] Some weeks after the incident, State B launched another cyber operation (incident 2) targeting the wastewater treatment plant SCADA systems. The operation aimed to directly affect the military camps located by River Y, near the discharge of the plant, from which State A’s army was directly using and drinking water after incident 1.

[F6] As a result of this cyber operation, the facility’s treatment procedures were shut down, the water quality sensors disabled, and authorized personnel locked out of the compromised system. Unsafe water – containing sewage and industrial waste – was thus discharged in large amounts into River Y for a period of 3 weeks until State A managed to regain control over the systems. The operation resulted in several members of State A’s armed forces being hospitalized with severe gastrointestinal diseases and exacerbated the water insecurity in State A, since Lake X became highly contaminated thereafter.

Examples[edit | edit source]

Legal analysis[edit | edit source]

For a general overview of the structure of analysis in this section, see Note on the structure of articles.

[L1] This scenario analyses the application of international humanitarian law (IHL) to cyber operations against water infrastructure in the context of an international armed conflict (IAC), causing harm to the civilian population. It addresses whether the operations qualify as attacks, legal issues related to the conduct of hostilities (including the special protection afforded by IHL to objects indispensable to the survival of the civilian population), and the protection of the natural environment in armed conflict.

Application of international humanitarian law and conflict qualification[edit | edit source]

International armed conflict
The law of international armed conflict (IAC) applies to any armed confrontation between two or more States,[1] even if one, several, or all of them deny the existence of an armed conflict.[2] Some scholars have suggested that the fighting must be of a certain intensity before international humanitarian law (IHL) comes into effect,[3] but the prevailing view is that any “resort to armed force between States”,[4] however brief or intense, triggers the application of IHL.[5] Furthermore, the law does not prescribe any specific form for the resort to force,[6] so hostilities between the belligerent States may involve any combination of kinetic and cyber operations, or cyber operations alone.[7]

It is unclear what effect cyber operations unaccompanied by any use of kinetic force would have to have in order for IHL to apply. Although it seems generally accepted that if cyber operations have similar effects to classic kinetic operations and two or more States are involved, the resulting situation would qualify as an IAC,[8] the law is unsettled on whether cyber operations that merely disrupt the operation of military or civilian infrastructure amount to a resort to armed force for the purposes of IHL.[9][10]

In the cyber context, States often act through non-State intermediaries and proxies. In such situations at the outset of an armed confrontation, the relevant State must exercise a sufficient degree of control over the non-State entity that commences hostilities against another State for the situation to qualify as an IAC. However, the correct legal test to use in this regard is the subject of an ongoing controversy.[11] The prevailing standard for the characterization of an international armed conflict is that of “overall control”, which requires that the State provides some support and that it participates in the organization, co-ordination, or planning of the relevant operations.[12] A separate standard, the “effective control” test, requires that the State must exercise control over the entire course of the operations in question.[13] While there is still disagreement as to whether the “effective control” test is the controlling test for the purposes of attribution under the law of State responsibility, there is consensus that the “overall control” test is the correct one for conflict qualification under IHL.[14] The latter is also confirmed by decades of consistent practice by international criminal tribunals including the ICTY, the ECCC, and the ICC.[15]

Publicly available national positions that address this issue include: Common position of the African Union (2024) (2024),National position of Austria (2024) (2024), National position of Costa Rica (2023) (2023), National position of Finland (2020) (2020), National position of France (2019) (2019), National position of Germany (2021) (2021), National position of Ireland (2023) (2023), National position of Japan (2021) (2021).

[L2] In the present scenario, there is an ongoing IAC between State A and State B, since there are armed confrontations between the two States, conducted both by conventional and cyber means.

[L3] IHL applies to situations of armed conflict and governs all conduct of the parties to the conflict that has a sufficient nexus to the conflict, including cyber operations.[16] Although there have been different interpretations of the requisite nexus,[17] in the present scenario it is clear that both operations against State A’s water installations attributable to State B were conducted in furtherance of the hostilities between the two States and thus fall under the IHL legal framework, including all applicable treaty and customary IHL.

Obligations of State B[edit | edit source]

The notion of ‘attack’ under international humanitarian law[edit | edit source]

The notion of ‘attack’ under international humanitarian law
The question of whether an operation amounts to an ‘attack’ as defined in international humanitarian law (IHL) is essential for the application of many of the rules deriving from the principles of distinction, proportionality and precaution. While some IHL rules impose limits on any military (cyber) operation, the rules specifically applicable to ‘attacks’ afford significant protection to civilians and civilian objects in times of armed conflict.[18]

Article 49 of Additional Protocol I defines ‘attacks’ as ‘acts of violence against the adversary, whether in offence or in defence’. Viewed as ‘combat action’,[19] they are understood to denote violence directed against military forces of an opposing party.[20] Arguments that a subjective element of purpose or motive to cause harm are inherent in the notion of attack[21] have not found wide support.[22]

The notion of violence in this definition can refer to either the means of warfare or their effects, meaning that an operation causing violent effects can qualify as an attack even if the means used to bring about those effects are not violent as such.[23] Accordingly, it is widely accepted that cyber operations that can be reasonably expected to cause injury or death to persons or damage or destruction to objects constitute attacks under IHL.[24]

There has been limited discussion over the contours of the reasonable foreseeability of harm standard for the purposes of defining attacks.[25] In the assessment of what constitutes the ‘reasonably expected’ effects of an operation that have to be considered, some States, including Denmark, Finland, New Zealand, Norway, Switzerland, or the United States, have clarified that this includes harm due to the foreseeable direct and indirect (or reverberating) effects of an attack.[26] An indirect or reverberating effect would include, for example, the death of patients in intensive-care units caused by a cyber operation on an electricity network that results in cutting off a hospital’s electricity supply – a view shared by the ICRC.[27] Care must be exercised in considering the extent to which understandings of reasonable foreseeability for the purposes of other rules of IHL can be deemed relevant in the interpretation of ‘attack’.

At present, different views exist on the interpretation of what constitutes ‘damage’ for assessing whether an operations amounts to an ‘attack’. One view, taken by some States including Denmark, Israel, and Peru, is that only physical damage is relevant in the assessment of what constitutes an attack under IHL.[28] Other States have interpreted the notion of ‘attack’ wider. States including Austria, Bolivia, Costa Rica, Ecuador, France, Germany, Guatemala, Japan, and New Zealand consider that cyber operations may qualify as an ‘attack’ without causing physical damage if they disable the functionality of the target.[29] For its part, the ICRC interprets the notion of ‘attack’ as including a loss of functionality. In its view, ‘an operation designed to disable a computer or a computer network constitutes an attack under IHL, whether the object is disabled through kinetic or cyber means’.[30]

Publicly available national positions that address this issue include: National position of Australia (2020) (2020), National position of Austria (2024) (2024), National position of Brazil (2021) (2021), National position of Canada (2022) (2022), National position of Costa Rica (2023) (2023), National position of the Czech Republic (2024) (2024), National position of Denmark (2023) (2023), National position of France (2019) (2019), National position of Germany (2021) (2021), National position of Ireland (2023) (2023), National position of Israel (2020) (2020), National position of the Italian Republic (2021) (2021), National position of Japan (2021) (2021), National position of the Netherlands (2019) (2019), National position of New Zealand (2020) (2020), National position of Norway (2021) (2021), National position of Pakistan (2023) (2023), National position of the Kingdom of Sweden (2022) (2022), National position of Switzerland (2021) (2021), National position of the United Kingdom (2021) (2021), National position of the United States of America (2016) (2016), National position of the United States of America (2021) (2021).

[L4] The cyber operations launched by State B were clearly expected to cause reasonably foreseeable harm and therefore qualified as attacks. This holds true even if the method used to cause such effects, i.e., the manipulation of the SCADA control systems, was not violent as such. By altering the levels of chlorine to dangerous levels in the drinking water used by the households in State A for their daily lives (incident 1), the operation could have been reasonably expected to cause injury and even death to people, as well as damage to civilian objects. This is equally the case with respect to the discharge of unsafe water into the main source of water of the military camp (incident 2) which resulted in the injury of several members of State A’s armed forces as well as damage to the natural environment.[31]

[L5] As both operations could have been reasonably expected to cause physical damage in the form of injury to people and damage to civilian objects, they constituted attacks under IHL even applying the more restrictive threshold adopted by some States and part of the doctrine.[32] Therefore, both incidents are subject to the IHL rules applicable to ‘attacks’, as discussed below.

[L6] Moreover, some States have specifically affirmed that cyber operations can qualify as attacks if they render inoperable or undermine the functioning of a State’s critical infrastructure needed for the provision of basic services, such as water.[33]

Principle of distinction: Military objectives[edit | edit source]

Military objectives
The principle of distinction, one of the foundational precepts of IHL, requires that the parties to an armed conflict must at all times distinguish between civilian objects and military objectives and may, accordingly, only direct their operations against military objectives.[34] The customary definition of military objectives is found in Article 52(2) of Additional Protocol I:

In so far as objects are concerned, military objectives are limited to those objects which by their nature, location, purpose or use make an effective contribution to military action and whose total or partial destruction, capture or neutralization, in the circumstances ruling at the time, offers a definite military advantage.

Thus, to qualify as a military objective, an object must cumulatively meet the two criteria set forth in the abovementioned rule, which must be determined on a case-by-case basis.[35] In case of doubt as to whether an object that is normally dedicated to civilian purposes is being used to make an effective contribution to military action, it must be presumed to remain protected as a civilian object.[36]

The formal scope of application of the Protocol is limited to international armed conflicts (IACs).[37] However, an identical definition of military objectives is found in treaties applicable in non-international armed conflicts (NIACs).[38] Moreover, certain non-party States to the Protocol accept the customary nature of the definition.[39] Accordingly, the ICRC has characterized the definition of military objectives as a norm of customary international humanitarian law applicable in both IACs and NIACs.[40]

Relevant rules of IHL apply to kinetic operations as well as to cyber operations.[41] However, the application of those rules in specific circumstances may pose novel challenges. This is because the rules governing targeting developed with physical operations in mind, and it is not always clear what their application to cyber operations entails.[42] For example, there is some disagreement on what types of acts amount to “attacks[43] in the context of cyber operations, in particular when the operation in question is limited to the manipulation of data.[44] Nevertheless, even those operations that might not qualify as “attacks” under IHL may still only be directed against military objectives, as required by the principle of distinction.[45] Further, due to the interconnectedness of civilian and military networks as well as in-built redundancies, it may be challenging to apply the definition of military objectives to those parts of cyber infrastructure that simultaneously serve civilian and military purposes (also referred to as “dual-use objects”).[46]

Publicly available national positions that address this issue include: National position of Austria (2024) (2024), National position of Costa Rica (2023) (2023), National position of the Czech Republic (2024) (2024), National position of France (2019) (2019), National position of Germany (2021) (2021), National position of the United States of America (2012) (2012).

[L7] Water infrastructure, including the industrial control systems supporting it,[47] normally qualifies as a civilian object. IHL prohibits attacks on civilian objects,[48] including civilian infrastructure, unless the object in question has become a military objective.[49] It is therefore necessary to assess if the targeted facilities qualified as military objectives under IHL at the moment of the attack.

[L8] In the case of incident 1, the drinking water installation was providing safe drinking water for both the civilian population in the capital of State A, as well as the military camps of State A forces. The use of the installation for military purposes, i.e., for the sustenance of the military camp, may be considered to make an effective contribution to military action by its use. The fact that the same infrastructure is simultaneously used for civilian purposes, and is thus a so-called “dual-use” object,[50] does not affect this conclusion, as long as the two cumulative conditions for a civilian object to become a military objective are met.[51] However, this does not mean that the impact of the operation on the civilian use would not need to be addressed in the proportionality and precautions assessments (on which see paras L12–L22 below).[52] It is submitted that taking control over the cyber infrastructure falls under the notion of “capture” in the words of Article 52(2) AP I, since State B seized the object, maintaining control over its functions[53] and denying its use to the adversary.[54] The ‘capture’ of the water infrastructure did provide a definite military advantage in those circumstances, by harming State A’s armed forces, preventing the military camps from access to safe drinking water, and thus weakening the fighting ability of enemy armed forces.[55] The drinking water facility did therefore qualify as a military objective.[56]

[L9] In addition, under IHL, the use of indiscriminate means or methods of warfare, including those employing means or methods of warfare[57] the effects of which cannot be limited and thus are of a nature to strike both military objectives and civilians or civilian objects without distinction, are prohibited as constituting indiscriminate attacks.[58] In the present scenario, the method of ‘poisoning’ the drinking water by means of altering the normal parameters of the water installation, has an indiscriminate character, since it cannot be limited to the military objective, including the water facility, but affects all the accessible drinking water thus harming civilians without distinction[59] and may be expected to cause disproportionate harm to civilians.[60] Therefore, it can be concluded that given the nature of the installation object of the attack (i.e., its preponderant civilian use alongside its military one) and the method employed,[61] the operation constituted an indiscriminate attack and thus was in violation of IHL.

[L10] Regarding incident 2, it should be first analyzed if the wastewater treatment facility constituted a military objective. As in the previous case, the installation was civilian in nature. Although its neutralization did provide a definite military advantage by harming the members of State A’s armed forces and preventing them from using the source of natural water, it is not clear whether its use, location or purpose made an effective contribution to military action per se. It could be argued that since the occurrence of incident 1, the armed forces (as well as the civilian population) had to resort to the natural water provided by the water stream. This water remained usable because of the functioning of the wastewater treatment plant and thus its use became a concrete contribution to military action at the moment of the attack. However, the contribution was, in view of this author, too indirect to qualify the installation as a military objective. The service ensured by the wastewater treatment facility was not providing water directly to the military, but it was preventing raw water from being contaminated. The armed forces directly made use of the raw water. Thus, in this case there was no direct but only an indirect connection with the installations, in contrast to the water treatment plant in incident 1, to which the military camp was directly connected through the pipeline providing drinking water. In addition, it is worth noting that in case of doubt regarding an object normally dedicated to civilian purposes, it must be presumed to remain protected as a civilian object, particularly should Additional Protocol I be applicable.[62]

[L11] Overall, even if the object was considered a military objective at the moment of the attack, State B had to respect the prohibition of indiscriminate attacks. This includes the prohibition of employing methods of combat the effects of which cannot be limited as required by IHL,[63] which was hardly complied with in the present scenario, and the principle of proportionality (on which see paras L12–L19 below).[64]

Proportionality[edit | edit source]

Proportionality
The principle of proportionality prohibits attacks ‘which may be expected to cause incidental loss of civilian life, injury to civilians, damage to civilian objects, or a combination thereof, which would be excessive in relation to the concrete and direct military advantage anticipated’.[65] The principle of proportionality is codified in Articles 51(5)(b) and 57(2)(a)(iii)(b) of the 1977 Additional Protocol I and reflects customary international law.[66] The nature of the principle makes it relevant only to attacks directed at military objectives or persons who are lawful targets, where incidental civilian loss of life, injury, damage to civilian objects, or a combination thereof, is expected. These three types of harms are commonly referred to as ‘incidental civilian harm’.[67]

The principle of proportionality is ex ante in nature, as it demands a balancing of the expected civilian harm and the anticipated military advantage. A proportionality assessment must therefore be made in advance of an attack and cannot be judged based on hindsight. The assessment must be made on the basis of a ‘reasonable military commander’s’ assessment of the information which is reasonably available from all sources at the relevant time.[68] The decision must be made in good faith.[69]

The ICRC has expressed the view that all direct and indirect incidental civilian harm that is foreseeably caused by the attack must be taken into consideration in the proportionality assessment.[70] Direct harm relates to consequences that are directly and immediately caused by a cyber attack. All other harms are considered indirect harms; sometimes referred to as the ‘reverberating’ effects of an attack.[71] For example, if it is reasonably expected that a cyber attack against a power grid will cause deaths in a hospital emergency ward due to a lack of power, those deaths must be part of the proportionality assessment. While one military manual claims the assessment of incidental civilian harm is generally understood to be limited to immediate or direct harm,[72] most of them do not limit the assessment in this way and a number of manuals and other relevant official State documents expressly require the consideration of indirect effects.[73]

When considering what constitutes ‘damage’ to civilian objects, some have argued that the damage does not have to be physical, but may include loss or deprivation of functionality.[74] However, Tallinn Manual experts agreed that damage must go beyond inconvenience, irritation, stress, or fear since these consequences do not amount to incidental loss of civilian life, injury to civilians, or damage to civilian objects.[75] Finally, when different types of incidental civilian harm are anticipated, the harms must be assessed in combination, and not in isolation of each other.[76]

The ‘concrete and direct’ military advantage that is assessed is that which is ‘substantial and relatively close’.[77] Conversely, ‘advantages which are hardly perceptible and those which would only appear in the long term should be disregarded’.[78] Among others, the expected military advantage to be assessed cannot be merely speculative.[79] Additionally, advantages that are solely political, psychological, economic, financial, social, or moral in nature do not constitute ‘military advantage’ under the principle of proportionality.[80] When ratifying Additional Protocol I, a number of States explained that they consider the military advantage from an attack to refer to the ‘advantage anticipated from the attack as a whole and not only from isolated or particular parts of an attack’.[81]

When assessing whether the incidental civilian harm will be excessive to the attack’s anticipated concrete and direct military advantage, determining ‘excessiveness’ entails a subjective assessment that allows for a ‘fairly broad margin of judgement’.[82] At the same time, the determination of excessiveness also has an objective element since it ‘must be based on that of the “reasonable commander”’.[83]

Publicly available national positions that address this issue include: Common position of the African Union (2024) (2024), National position of Austria (2024) (2024), National position of Costa Rica (2023) (2023), National position of the Czech Republic (2024) (2024).

[L12] As affirmed in the previous section, it can be stated that incident 1 was directed at a military objective. Besides the conclusion that the attack would be contrary to IHL by employing indiscriminate methods, the expected incidental civilian harm caused by such a method would also be of particular relevance to the present analysis.

[L13] The fact that the object was also used for civilian purposes, that is, the provision of drinking water to the civilian population of State A’s capital, implied that the operation should have been reasonably expected to result in incidental civilian harm,[84] including civilian loss of life and/or injury and damage of civilian objects, and raised specific questions regarding the principle of proportionality.[85] For such assessment, all the reasonably foreseeable direct and indirect or reverberating effects on the civilian population caused by targeting the installation must be considered and appropriately weighed.[86]

[L14] The expected civilian harm to the civilian population of State B’s first operation included the harmful effects to the health of the inhabitants of State A’s capital by means of intoxication by unhealthy levels of chlorine in the consumed water and the possible loss of life.

[L15] The same would hold true in case incident 2 was not already considered to have violated the principle of distinction (see paras L10–L11 above). The expected incidental harm by the foreseeable contamination of Lake X by means of the sewage and industrial waste carried in by its affluent river, would include the injury to the same population that after incident 1 turned to seek water directly from the source, exposing them to the health impacts of such contaminated water, including grave waterborne diseases.

[L16] The ICRC has argued that “[w]hile displacement is not expressly mentioned in the principles of proportionality and precautions as a relevant type of civilian harm”, the expected displacement of civilians when incidentally damaging their livelihoods, “will affect the weight to be given to that damage”.[87] In the present scenario, the expected water insecurity and foreseeable civilian displacement triggered in State A by incident 1, and cumulatively by incident 2, should be also appropriately weighed when assessing the civilian damage in combination with the other types of civilian harm.

[L17] Further, attacks against water infrastructure by conventional or cyber means, especially certain types such as wastewater treatment plants, can cause significant damage to the natural environment. They may have reserves of toxic industrial chemicals, which can have significant adverse effects on the environment if released, including the contamination of surface and groundwaters, and degradation of the soil. This also entails grave risk to the health and livelihoods of the civilian population,[88] and the poisoning of the flora and fauna having an impact on the ecosystem.[89] As will be further explained below (see paras L30–L31), besides having a special protection, the natural environment is protected under the general principles of IHL governing civilian objects. Thus, damage to the natural environment must also be weighed as incidental civilian harm within the proportionality assessment.[90] It should have been reasonably expected that the large amounts of toxic substances released to Lake X and River Y (an affluent of Lake X), including chlorine (incident 1) and sewage and industrial waste (incident 2), would result in the contamination of the water resources and surrounding ecosystems, on top of the harm caused to the civilian population using those resources for their living.

[L18] For its part, the reasonable concrete and direct military advantage anticipated from incident 1 would comprise harming soldiers of State A’s armed forces from the military camps provisioned by the targeted water installation, including injuries and/or loss of life, and prevent them from using the water pipeline as a source of safe drinking water for the military camp. Regarding incident 2, in addition to harming the members of State A’s armed forces, the attack would also imply the absence of water resources to provide for the livelihood of the armed forces in the military camps near Lake X. As a result, the camps would most likely be moved to another location.

[L19] Having assessed the expected incidental civilian harm and the concrete and direct military advantage anticipated, it is necessary to determine whether the harm would be excessive. While a definite conclusion could only be drawn based on more detailed factual circumstances,[91] it may be argued that the expected harm to the civilian population would be prima facie excessive in both individual incidents and thus in violation of the proportionality rule. This conclusion is based particularly on the expected widespread effects of the attack. Notably, 90% of the population living in the capital were users of the drinking water provided by the affected water infrastructure (incident 1), and subsequently the civilian population is supplied directly from the raw water resources (incident 2) and thus exposed to the direct and indirect effects of the attacks. This, added to the harm caused to the natural environment, that should also be appropriately weighed in the proportionality assessment. This would be arguably justified by the harm caused to soldiers from the camps supplied by the same water sources, and the likely relocation of the camps. Ultimately, however, the answer would have to be measured against the standard of a reasonable military commander based on the circumstances ruling at the time of the attack.[92]

Precautions in attack[edit | edit source]

Obligations to take precautions in attack
The obligations to take precautions in attack (also referred to as “active precautions”) are most fully codified in Article 57 of Additional Protocol I. This article mandates the taking of a wide variety of measures from target verification and the giving of effective advance warnings through the choice of means and methods of warfare and choice of military objectives to cancellation or suspension of attacks where it becomes apparent that the attack’s target is not a military one or is subject to special protection, or that the attack may be disproportionate. In the interpretation of these precautionary measures, care must be taken to determine what exactly is required of those involved in planning, deciding upon, and executing attacks. The standards vary. For instance, some precautionary measures operate within a ‘feasibility’ standard, while others, such as effective advance warnings, must be taken ‘unless circumstances do not permit’.[93]

There is no specifically prescribed method through which these obligations ought to be discharged.[94] Feasibility, a standard that appears frequently in Article 57, is a contextual standard, and it depends on the presence of a range of factors in the circumstances prevailing at the time.[95] In this regard, ‘feasible’ is understood as ‘that which is practicable or practically possible, taking into account all circumstances prevailing at the time, including humanitarian and military considerations’.[96] Importantly, the standard of feasibility is capable of accommodating a range of considerations, and it evolves through time and with the acquisition of experience.[97]

While the protection of the civilian population and civilian objects in times of conflict is a challenging task in any domain, cyberspace adds its own layer of complexity. A primary reason for this is the interconnectivity of networks and the risks of escalation and unintended consequences. Thus, in conducting attacks in cyberspace, parties to conflict should consider suitable and feasible cyber-specific precautions such as impact assessments on the connectivity of military and civilian networks and on secondary effects of attacks or the identification of cyber networks and infrastructure that are serving specially protected objects.[98]

[L20] For the purposes of this analysis it will be assumed that the two cyber operations would have complied with the principle of distinction, otherwise the operations would already be in violation of IHL. Both incident 1 and incident 2 entailed a very high risk for the civilian population and civilian objects, including the natural environment. State B was obliged to take constant care to spare the civilian population, civilians, and civilian objects in the conduct of its military operations.[99] In the absence of a feasible possibility of segregating the military use of the facilities from the civilian ones during the attack, the consequent expected civilian harm shall be constantly assessed in the conduct of the cyber operation within the principle of precautions.[100] In the assessment of incidental civilian harm, the reasonably foreseeable direct and indirect (or reverberating) effects of the attack against the systems must be considered.[101] In this regard, the assessment should include the injury to the civilian population, but also the shortage of drinking water and starvation, its effects on the provision of other essential services such as health services and resulting disease outbreaks, shortage of safe water for irrigation of foodstuff, educational services, the expected displacement[102] and the effects on the natural environment as will be analyzed below (see paras L30–L31).

[L21] In the present case, it could be argued that State B did not comply with its obligations to take precautions in attack. First, although further information would be needed on the available means and methods for State B to conduct the military cyber operation, it presumably did not take all feasible precautions in the choice of means and methods, nor refrained from launching the attacks, to avoid or minimize the expected incidental loss and injury of civilians and damage of civilian objects. To the contrary, it was conducted using indiscriminate methods the effects of which cannot be limited as required by IHL, and causing disproportionate incidental civilian harm, an IHL prohibition reinforced by the principle of precautions.[103]

[L22] Further, no advance warnings were given to the civilian population in either of the attacks to avoid or minimize the incidental harm caused by the contaminated water, even though it was clear that they would necessarily be adversely affected by its release. However, it should be recalled that advance warnings must only be given ‘unless circumstances do not permit’. In this regard, the feasibility of the warnings, including whether the element of surprise was essential to the success of the operations, should be also considered under this rule.[104] Moreover, the operations were only detected after the first casualties reached the hospital, and only thwarted by State A. Thus, State B did not cancel or suspend the cyber operations when it became apparent, not only that the objectives were subject to special protection under IHL (see para L24 below), but also when the excessive effects over the civilian population and objects became apparent.[105] This would indeed be the case of incident 2 as a subsequent incident after the effects of the first attack became apparent.

Objects indispensable to the survival of the civilian population[edit | edit source]

Objects indispensable to the survival of the civilian population
Besides constituting civilian objects, objects indispensable to the survival of the civilian population enjoy a special protection under IHL applicable in both international and non-international armed conflicts (IACs and NIACs, respectively).[106] As a corollary of the prohibition of starvation of the civilian population as a method of warfare,[107] the rule prohibits to attack, destroy, remove, and render useless objects indispensable to the survival of the civilian population. This rule is considered to reflect customary IHL.[108] This protection has also been affirmed in the national positions of several States including Costa Rica,[109] the Czech Republic,[110] France,[111] and Norway.[112]

These specially protected objects include, although are not limited to, foodstuffs, agricultural areas for their production, crops, livestock, drinking water installations and supplies, and irrigation works. The enumeration provided by the IHL rules is merely illustrative and should be interpreted in the wider sense to cover the means of existence of the populations,[113] including both objects of sustenance and those contributing to their production.[114]

The prohibition covers a broader range of operations which are designed or can be expected to disable or render these objects useless, irrespective of them qualifying as attacks and beyond their destruction.[115] As interpreted by the ICRC, it covers all possibilities, including the pollution of water reservoirs by chemical or other agents and the destruction of crops by defoliants, in offence or defense.[116]

Additional Protocol I applicable to IACs refers to the purpose of denying these objects of their sustenance value regardless of the motive, i.e., whether to starve the civilian population or to cause their movement. It is controversial whether the same interpretation applies to NIACs, since part of the doctrine has argued that Additional Protocol II prohibits the abovementioned acts only when undertaken with the purpose of starvation of civilian population.[117]

IHL applicable to IACs provides for two exceptions to the rule: (i) in case the sustenance is solely for members of the adversary forces; or (ii) when they are used in direct support of military action, provided that the actions shall not in any event be expected to cause starvation or force the movement of the civilian population. It is doubtful, however, whether these exceptions also apply to non-international armed conflicts, since they are not provided under Additional Protocol II and there is no practice supporting it under Customary IHL.[118] Some stakeholders have in any case urged States parties to IACs to refrain from carrying harmful acts under any circumstances, even if the conditions of the exceptions are met.[119] In any case, the obligations of proportionality and precautions must be fully respected even if the operation falls within the exceptions.

The prohibition also applies when the attack against such objects or their destruction, removal or rendering useless is done by means of cyber operations.[120] It has been claimed that although the Internet cannot be considered such an object, cyber infrastructure indispensable to its function and operation, could also qualify within the specially protected objects.[121] This rule extends beyond the notion of cyber “attacks” and applies to any cyber operation designed to deny the sustenance value to objects indispensable to the survival of the civilian population.[122] The protection of these objects must be understood as extending to deleting or otherwise tampering with data needed for their functioning, in a manner that renders useless objects indispensable to the survival of the civilian population.[123] Thus, within this framework whether data constitutes an object or not is immaterial.[124]

Publicly available national positions that address this issue include: National position of Costa Rica (2023) (2023), National position of the Czech Republic (2024) (2024), National position of France (2019) (2019), National position of Norway (2021) (2021).

*Although the assessment of whether the objects in question enjoyed a special protection under IHL would ordinarily be done before the assessment of the principles of proportionality and precautions, it is included here in the present scenario for clarity purposes.

[L23] In addition to the previous analysis, water and water infrastructure, as objects indispensable to the survival of the civilian population, benefit from a special protection under IHL and thus additional restrictions apply to the operations targeting them. Therefore, even if the attacks had been lawful under IHL under the general principles, the cyber operations should be analyzed under the special protection regime, which adds a layer of protection to certain objects.

[L24] Both the drinking water facility (incident 1) as well as the water treatment plant (incident 2) of State A clearly fall under the special protection of objects indispensable to the survival of the civilian population under IHL.[125] They are protected as installations securing access to quality water supply, indispensable to the subsistence of the population.[126]

[L25] The prohibition under IHL covers all acts denying the sustenance value of these objects, including the pollution of water reservoirs by chemical or other agents,[127] limiting the provision of water supplies and putting the quality of drinking water for the population at risk.[128] These effects were clearly expected from attacking and rendering the installations useless and thus (i) introducing unhealthy concentrations of chlorine to the household water supplies, as well as (ii) polluting the water stream (River Y) as well as Lake X and arguably the soil, with sewage and industrial waste, as a result.

[L26] The cyber operations were indeed conducted by State B with the purpose of denying these objects of their sustenance value to the adverse party, i.e., State A.

[L27] Considering that the incidents took place during, and had a nexus with, an IAC between States A and B, should Additional Protocol I be applicable, it remains to be addressed whether any of the exceptions apply to the present situation. Regarding the first exception, it is clear from the facts that the targeted water facilities were not only used for the sustenance solely of the armed forces of State A, as both were key installations for the provision of safe drinking water to the civilian population surrounding Lake X. In any case, it has been affirmed that this exception is “undoubtedly concerned with foodstuffs and the agricultural areas producing them, crops, livestock and supplies of drinking water, but not with installations for drinking water or irrigation works”,[129] since they are hardly likely to be used solely for the benefit of armed forces.[130]

[L28] Regarding the second exception, at least in incident 1 the facilities were being used for the sustenance of State A’s armed forces by providing water to its military camps, and thus could be arguably understood as providing direct support of military action. However, it has been argued by some that this does not seem sufficient reason for depriving these objects from its special protection.[131] Further, the operations were clearly expected to leave the civilian population with (at least) inadequate water as to reduce the civilian population to starvation or force its movement.[132] The operations must have been expected to cause the pollution of the main water supply of State A’s capital, a source indispensable for its survival.

[L29] In conclusion, both cyber attacks constituted unlawful operations under IHL in violation of the special protection afforded to objects indispensable to the survival of the civilian population.

Protection of the natural environment in armed conflict[edit | edit source]

Protection of the natural environment in armed conflict
The natural environment is protected during armed conflict under IHL by both specific and general rules. To begin with, specific IHL rules provide that it is prohibited to use methods or means of warfare which are intended or may be expected to cause widespread, long-term, and severe damage to the natural environment.[133] It is worth noting that the customary nature of this rule has been contested, as well as its application to both international and non-international armed conflicts.[134] Moreover, it is prohibited to use the destruction of the natural environment as a weapon of warfare.[135] Further, due regard must be given to the protection and preservation of the natural environment in warfare.[136]

In addition, under the Convention on the Prohibition of Military or Any Other Hostile Use of Environmental Modification Techniques (ENMOD), the military or any other hostile use of environmental modification techniques having widespread, long-lasting, or severe effects as the means of destruction, damage or injury to any other State Party is prohibited. The three criteria of “widespread, long-lasting or severe” under this Convention are alternative rather than cumulative and their threshold has been interpreted to be rather lower than the one established in Additional Protocol I.[137] It is worth noting that contemporary knowledge of the effects of harming the natural environment must be considered to address the degree of damage.[138]

Moreover, the natural environment is protected under the general principles of IHL governing civilian objects,[139] unless parts of it become a military objective. Therefore, all the principles governing the conduct of hostilities, such as distinction, proportionality, and precautions fully apply to the natural environment.[140]

The protection of the natural environment under IHL also applies to cyber operations and their effects.[141]

Publicly available national positions that address this issue include: National position of France (2019) (2019), and National position of Switzerland (2021) (2021).

[L30] Water resources, including drinking water, are clearly protected under IHL also as part of the natural environment.[142] Regarding the specific prohibition of employing cyber means or methods of warfare which are intended or may be expected to cause widespread, long-term, and severe damage to the natural environment, this would apply even if the water infrastructure become military objectives by their use.[143] Both incidents 1 and 2 were expected to cause significant damage to the natural environment, including the severe contamination of at least Lake X and parts of River Y, and arguably parts of the surrounding ecosystem. However, it is not clear from the facts if the damage meets the very high threshold as provided by the cumulative criteria established in Articles 35(3) and 55 of Additional Protocol I, should it be applicable, including damage for a period of decades.[144] Therefore, no conclusive assessment could be done regarding the violation of this absolute prohibition under IHL.

[L31] However, the natural environment including the water resources, is a civilian object unless it becomes itself a military objective. As such, environmental damage caused by the release of harmful substances, including the contamination and degradation of water supplies, the soil and the ecosystem as a whole, should be duly considered within the incidental civilian harm when applying the principles of the conduct of hostilities to the attacks against the targeted water facilities, in particular within the proportionality assessment (see para L17 above).[145]

Conclusion[edit | edit source]

[L32] To conclude, State B’s cyber operations against State A’s water infrastructure fall within the scope of IHL applicable to IACs and were not in compliance with the applicable rules governing the conduct of hostilities, including the principles of distinction, proportionality and precautions, in addition to qualifying as violations of the prohibition to attack, destroy, remove or render useless objects indispensable to the survival of the civilian population.

Obligations of State A[edit | edit source]

Precautions against the effects of attacks[edit | edit source]

Obligations to take precautions against the effects of attacks
In addition to obligations to take precautions in attack, IHL requires parties to take precautions against the effects of attacks (also referred to as “passive precautions”).[146] According to Article 58 of Additional Protocol I, ‘The Parties to the conflict shall, to the maximum extent feasible: a) [...] endeavour to remove the civilian population, individual civilians and civilian objects under their control from the vicinity of military objectives; b) avoid locating military objectives within or near densely populated areas; c) take the other necessary precautions to protect the civilian population, individual civilians and civilian objects under their control against the dangers resulting from military operations.’[147]

These specific measures require defending forces to protect the civilian population and civilian objects under their control.[148] They are cast in relative terms,[149] as they incorporate a standard of feasibility.[150] A type of conduct, rather than a result, is what lies at the heart of these precautionary obligations. In cyberspace, these precautionary measures can take the form of, for example, building strong cyber resilience cultures at a societal level, segregating civilian and military cyber networks and infrastructure, using antivirus software, or setting up systems for the detection of cyber vulnerabilities.[151]

[L33] State A had an obligation to adopt feasible precautionary measures to protect the civilian population and civilian objects under its control from the danger resulting from military operations, including cyber operations. While taking measures such as segregating civilian and military uses of water infrastructure may be less feasible in practice, applicable measures can include implementing strong cyber security defense measures and resilience of essential services’ cyber infrastructure to reduce cyber vulnerabilities and thus the risk of civilian harm.[152]

[L34] In the present scenario, State A was systematically warned about the exposure of its water infrastructure to several cyber vulnerabilities but disregarded the implementation of precautionary measures that could have enhanced the protection and resilience of the infrastructure itself[153] and thus of the civilian population and civilian objects relying on such essential service from the effects of the attacks, such as updating the software of the plants or segregating them from the internet.[154]

[L35] Therefore, State A prima facie failed to take all feasible precautions, even in the knowledge of existing vulnerabilities within the water infrastructure’s systems, to protect to the maximum extent feasible the civilian population and civilian objects under its control, in contravention of its obligations under treaty (assuming that Additional Protocol I was applicable) and customary IHL.[155]

Checklist[edit | edit source]

  • Did the operations have a nexus with an armed conflict?
  • Did the operations qualify as “attacks” under IHL?
  • Were the targeted objects military objectives under IHL?
  • Did the operations comply with the principle of proportionality under IHL? Was environmental damage appropriately weighed within the proportionality assessment?
  • Did the attacker adopt feasible precautions in order to avoid or minimize civilian harm?
  • Did the defender take feasible precautions to protect the civilian population under its control against the danger resulting from military operations?
  • Did the special protection that IHL affords to objects indispensable to the survival of the civilian population apply to the operations under analysis?
  • Were the rules on the protection of the natural environment applicable to the operations and if so, were they complied with?

Appendixes[edit | edit source]

See also[edit | edit source]

Notes and references[edit | edit source]

  1. Common Article 2 GC I (stipulating that the Conventions “shall apply to all cases of declared war or of any other armed conflict which may arise between two or more of the High Contracting Parties”).
  2. ICRC (ed), Commentary on the Third Geneva Convention (CUP 2021), commentary on common Article 2, para 246 (‘Even if none of the Parties recognize the existence of a state of war or of an armed conflict, humanitarian law would still apply provided that an armed conflict is in fact in existence.’).
  3. See, eg, Jan K Kleffner, ‘Scope of Application of Humanitarian Law’ in D Fleck (ed), The Handbook of International Humanitarian Law (3rd edn, OUP 2013) 45; ILA Use of Force Committee, Final Report on the Meaning of Armed Conflict in International Law (2010) 32; Gary D. Solis, The Law of Armed Conflict: International Humanitarian Law in War (2nd edn, CUP 2016) 162.
  4. Prosecutor v Tadić (Decision on Jurisdiction) IT-94-1-AR72 (2 October 1995) para 70.
  5. See, eg, Jean S. Pictet (ed) Geneva Convention IV relative to the Protection of Civilian Persons in Time of War: Commentary (ICRC 1958) 20–21; Yves Sandoz, Christophe Swinarski, and Bruno Zimmermann (eds), Commentary on the Additional Protocols of 8 June 1977 to the Geneva Conventions of 12 August 1949 (ICRC 1987) 40; René Provost, International Human Rights and Humanitarian Law (CUP 2002) 250; Jann K Kleffner, ‘Scope of Application of International Humanitarian Law’ in Dieter Fleck (ed), The Handbook of International Humanitarian Law (3rd edn, OUP 2013) 45; Andrew Clapham, ‘Concept of International Armed Conflict’ in Andrew Clapham, Paola Gaeta, and Marco Sassòli (eds), The 1949 Geneva Conventions: A Commentary (OUP 2015) 16 para 38; ICRC (ed), Commentary on the Third Geneva Convention (CUP 2021), commentary on common Article 2, para 251; Noam Zamir, Classification of Conflicts in International Humanitarian Law: The Legal Impact of Foreign Intervention in Civil Wars (Edward Elgar 2017) 53–55; Kubo Mačák, Internationalized Armed Conflicts in International Law (OUP 2018) 15–16.
  6. Cf. Legality of the Threat or Use of Nuclear Weapons Case (Advisory Opinion) [1996] ICJ Rep 226, para 89 (holding that the relevant rules of IHL apply “to all international armed conflict, whatever type of weapons might be used”) (emphasis added).
  7. Tallinn Manual 2.0, commentary to rule 82, para 11.
  8. ICRC (ed), Commentary on the Third Geneva Convention (CUP 2021), commentary on common Article 2, para 288.
  9. ICRC (ed), Commentary on the Third Geneva Convention (CUP 2021), commentary on common Article 2, para 289.
  10. For State views on this matter, see, eg, Finland, ‘International law and cyberspace: Finland’s national positions’ (15 October 2020), 7 (‘International humanitarian law only applies to cyber operations when such operations are part of, or amount to, an armed conflict. Most so far known cyberattacks have not been launched in the context of an armed conflict or have met the threshold of armed conflict.’); French Ministry of the Armies, ‘International Law Applied to Operations in Cyberspace’, 9 September 2019, 12 (‘Cyberoperations that constitute hostilities between two or more States may characterise the existence of international armed conflict (IAC)’); Germany, ‘On the Application of International Law in Cyberspace: Position Paper’ (March 2021), 7 (‘An international armed conflict – a main prerequisite for the applicability of IHL in a concrete case – is characterized by armed hostilities between States. This may also encompass hostilities that are partially or totally conducted by using cyber means.’); Japan, Basic Position of the Government of Japan on International Law Applicable to Cyber Operations (28 May 2021), 7 (‘If the effects of cyber operations are taken into consideration, the conduct of cyber operations alone may reach the threshold of an "armed conflict."’).
  11. See further Kubo Mačák, Internationalized Armed Conflicts in International Law (OUP 2018) 39–47.
  12. Prosecutor v Prlić et al (Trial Judgment) IT-04-74-T (29 May 2013), vol 1, para 86(a).
  13. See Military and Paramilitary Activities in and against Nicaragua (Nicaragua v US) (Merits) [1986] ICJ Rep 14, paras 112–15; see further Kubo Mačák, ‘Decoding Article 8 of the International Law Commission’s Articles on State Responsibility: Attribution of Cyber Operations by Non-State Actors’ (2016) 21 JCSL 405, 421.
  14. Case Concerning the Application of the Convention on the Prevention and Punishment of the Crime of Genocide (Bosnia and Herzegovina v Serbia and Montenegro) (Judgment) [2007] ICJ Rep 43, para 405; but see ICRC (ed), Commentary on the Third Geneva Convention (CUP 2021), commentary on common Article 2, para 304 (arguing that overall control is the controlling test in both contexts).
  15. See Prosecutor v Tadić (Appeal Judgment) IT-94-1-A (15 July 1999) paras 120–121; Prosecutor v Lubanga (Pre-Trial Chamber 1) ICC-01/04-01/06 (29 January 2007) paras 209–211; Case No 001/18-07-2007/ECCC/TC (26 July 2010) para 540.
  16. Marco Sassòli, International Humanitarian Law. Rules, Controversies, and Solutions to Problems Arising in Warfare (Edward Elgar 2019) 537, M.N. 10.119; Tallinn Manual 2.0, Rule 80, Commentary, para. 5.
  17. See in general ICTY, Prosecutor v. Kunarac et al. (Appeals Judgement) IT-96-23 and IT-96-23/1-A (12 June 2002), para. 58. See in particular for the cyber realm Tallinn Manual 2.0, Rule 80, Commentary, para. 6.
  18. Concretely, rules such as the prohibition of attacks against civilians and civilian objects, the prohibition of indiscriminate and disproportionate attacks, and the obligation to take all feasible precautions to avoid or at least reduce incidental harm to civilians and damage to civilian objects when carrying out an attack apply to those operations that qualify as ‘attacks’ as defined in IHL. The notion of attack under IHL, defined in Article 49 of AP I, is different from and should not be confused with the notion of ‘armed attack’ under Article 51 of the UN Charter, which belongs to the realm of the law on the use of force (jus ad bellum). To determine that a specific cyber operation, or a type of cyber operations, amounts to an attack under IHL does not necessarily mean that it would qualify as an armed attack under the UN Charter.
  19. Yves Sandoz, Christophe Swinarski and Bruno Zimmermann (eds), Commentary on the Additional Protocols, ICRC, Geneva, para. 1879 (‘Commentary of Additional Protocol I’).
  20. International Criminal Court (ICC), Situation in the Democratic Republic of the Congo in the case of the Prosecutor v Bosco Ntaganda, Roger O’Keefe, Observations by Professor Roger O’Keefe, pursuant to rule 103 of the Rules of Procedure and Evidence, No. ICC-01/04-02/06 A2, 17 September 2020, p. 3.
  21. ICC, Situation in the Democratic Republic of the Congo in the case of the Prosecutor v Bosco Ntaganda, Submission of Observations to the Appeals Chamber Pursuant to Rule 103 by Geoffrey Corn et al, No.: ICC-01/04-02/06 A2, 18 September 2020, paras. 14 – 15.
  22. ICC, Prosecutor v Bosco Ntaganda, ICC-01/04-02/06, Judgment (Appeals Chamber), 30 March 2021, Partly Concurring Opinion of Judge Eboe-Osuji, para. 110; Yoram Dinstein and Arne Willy Dahl, Oslo Manual on Select Topics of the Law of Armed Conflict (Springer 2020), rule 8 and the discussion of reasonable foreseeability of harm.
  23. Cordula Droege, “Get Off My Cloud: Cyber Warfare, International Humanitarian Law, and the Protection of Civilians”, (2012) 94(886) International Review of the Red Cross 533, 557; William H. Boothby, The Law of Targeting (OUP 2012) 384; Laurent Gisel, Tilman Rodenhäuser, and Knut Dörmann, ‘Twenty years on: International humanitarian law and the protection of civilians against the effects of cyber operations during armed conflicts’, (2020) 102(913) International Review of the Red Cross 287, 312.
  24. ICRC, “International humanitarian law and the challenges of contemporary armed conflicts” (2015) 41–42; Tallinn Manual 2.0, rule 92. This view is also held by States including Australia, Australia’s submission on international law to be annexed to the report of the 2021 Group of Governmental Experts on Cyber, at 4; and Switzerland, Switzerland's position paper on the application of international law in cyberspace, Annex UN GGE 2019/2021, at 10.
  25. See, for instance, the commentary to the relevant rules in the Tallinn and Oslo Manuals: Tallinn Manual 2.0, rule 92 and accompanying commentary; Yoram Dinstein and Arne Willy Dahl, Oslo Manual on Select Topics of the Law of Armed Conflict (Springer 2020), rule 8 and accompanying commentary.
  26. Denmark, Military Manual on International Law Relevant to Danish Armed Forces in International Operations (2016) 677 (when discussing computer network attacks); Finland, International law and cyberspace: Finland’s national positions (2020) 7; New Zealand, Manual of Armed Forces Law (2nd edn, 2017) vol 4, para 8.10.22; Norway, Manual i krigens folkerett (2013) para 9.54; Switzerland, “Switzerland’s position paper on the application of international law in cyberspace: Annex UN GGE 2019/2021” (27 May 2021) 10; United States, “United States Submission to the UN Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security (2014–15)”, at 6, and from a practical perspective Joint Publication 3-12 (R) ‘Cyberspace operations’ (5 February 2013), at IV-4.
  27. ICRC, International Humanitarian Law and Cyber Operations during Armed Conflicts: ICRC position paper (November 2019) 7. Israel has further argued that an operation may amount to an attack if ‘a cyber operation is intended to shut down electricity in a military airfield, and as a result is expected to cause the crash of a military aircraft—that operation may constitute an attack’. Roy Schöndorf, ‘Israel’s Perspective on Key Legal and Practical Issues Concerning the Application of International Law to Cyber Operations’, (2021) 97 International Law Studies 395, 400.
  28. Denmark, Military Manual on International Law Relevant to Danish Armed Forces in International Operations (2016) 290–291; Roy Schöndorf, ‘Israel’s Perspective on Key Legal and Practical Issues Concerning the Application of International Law to Cyber Operations’, (2021) 97 International Law Studies 395, 400; Peru, Response Submitted by Peru to the Questionnaire on the Application of International Law in OAS Member States in the Cyber Context (June 2019), cited in OAS, Improving Transparency: International Law and State Cyber Operations: Fifth Report, OAS Doc. CJI/doc. 615/20 rev.1 (7 August 2020) para 31.
  29. Austrian Position on Cyber Activities and International Law (April 2024) p. 17; Bolivia, Note from the Plurilateral State of Bolivia, Ministry of Foreign Affairs, OAS Permanent Mission to the OAS Inter-American Juridical Committee, MPB-OEA-NV104-19 (17 July 2019), cited in OAS, Improving Transparency: International Law and State Cyber Operations: Fifth Report, OAS Doc. CJI/doc. 615/20 rev.1 (7 August 2020) para 33; Ministry of Foreign Affairs of Costa Rica, "Costa Rica's Position on the Application of International Law in Cyberspace" (21 July 2023) 13 (footnotes omitted); Ecuador, Verbal Note 4-2 186/2019 from the Permanent Mission of Ecuador to the OAS (28 June 2019), cited in OAS, Improving Transparency: International Law and State Cyber Operations: Fifth Report, OAS Doc. CJI/doc. 615/20 rev.1 (7 August 2020) para. 32; France, Ministry of the Armies, International Law Applied to Operations in Cyberspace, 2019, p. 13; Germany, On the Application of International Law in Cyberspace Position Paper, March 2021, p. 9; Guatemala, Note Of. 4VM.200-2019/GJL/lr/bm, from Mr. Gabriel Juárez Lucas, Fourth Vice Minister of the Interior Ministry of the Republic of Guatemala to Luis Toro Utillano, Technical Secretariat, Inter-American Juridical Committee (14 June 2019), cited in OAS, Improving Transparency: International Law and State Cyber Operations: Fifth Report, OAS Doc. CJI/doc. 615/20 rev.1 (7 August 2020) para. 32; Italy, Italian Position Paper on ‘International Law and Cyberspace’, 2021, pp. 9–10; Japan, Ministry of Foreign Affairs of Japan, Basic Position of the Government of Japan on International Law Applicable to Cyber Operations, 2021, p. 7; New Zealand, The Application of International Law to State Activity in Cyberspace (1 December 2020), para. 25.
  30. ICRC, International Humanitarian Law and Cyber Operations during Armed Conflicts: ICRC position paper (November 2019) 7–8. The ICRC bases this interpretation on a contextual and teleological interpretation of the notion of ‘attack’ in Additional Protocol I. See ICRC, International humanitarian law and the challenges of contemporary armed conflicts (2015) 41.
  31. As has been stated, “[i]njury includes illness and disease triggered by, for example, inadequate or insufficient water provision caused by an attack on […] a water purification station, a water pump […]”. See Eirini Giorgou and Abby Zeith, “When the lights go out: the protection of energy infrastructure in armed conflict” (Humanitarian Law & Policy, 20 April 2023). See also ICRC, International Humanitarian Law and the Challenges of Contemporary Armed Conflicts – Recommitting To Protection In Armed Conflict On The 70th Anniversary Of The Geneva Conventions (Challenges Report), ICRC, Geneva  (2019) 17-18.
  32. See national positions of Denmark, Israel, and Peru. See also discussions in Tallinn Manual 2.0, Rule 92.
  33. See the position of Ecuador, Bolivia and Guyana in OAS, “Improving Transparency: International Law and State Cyber Operations: Fourth Report”, OAS Doc. CJI/doc. 603/20 rev.1 corr.1 (5 March 2020), pp. 44-45, cited in Laurent Gisel, Tilman Rodenhäuser and Knut Dörmann, “Twenty years on: International humanitarian law and the protection of civilians against the effects of cyber operations during armed conflicts”, (2022) 102(913) International Review of the Red Cross, 316, footnotes 139-140.
  34. Art 48 AP I; ICRC CIHL Study, rule 7.
  35. See Yves Sandoz, Christophe Swinarski and Bruno Zimmermann (eds), Commentary on the Additional Protocols of 8 June 1977 to the Geneva Conventions of 12 August 1949 (ICRC 1987), 635 para 2018; International Law Association Study Group on the Conduct of Hostilities in the 21st Century, ‘The Conduct of Hostilities and International Humanitarian Law: Challenges of 21st Century Warfare’ (2017) 93 International Law Studies 322, 327–328.
  36. Art 52(3) AP I; on the customary nature of this rule, see ICRC CIHL Study, commentary to rule 10, 35–36. In the cyber context, see e.g., the national positions of France (Ministry of Defense of France, ‘International Law Applied to Operations in Cyberspace’ (9 September 2019) 14); and Germany (Federal Government of Germany, ‘On the Application of International Law in Cyberspace’, Position Paper (March 2021) 8).
  37. Art 1 AP I.
  38. See, e.g., Amended Protocol II to the CCW, Article 2(6); Second Protocol to the Hague Convention for the Protection of Cultural Property, Article 1(f).
  39. See, e.g., Brian Egan, Legal Adviser, Department of State, “Remarks to the American Society of International Law: International Law, Legal Diplomacy, and the Counter-ISIL Campaign” (1 April 2016), 242 (“In particular, I’d like to spend a few minutes walking through some of the targeting rules that the United States regards as customary international law applicable to all parties in a NIAC: … Insofar as objects are concerned, military objectives are those objects which by their nature, location, purpose or use make an effective contribution to military action and whose total or partial destruction, capture or neutralization, in the circumstances ruling at the time, offers a definite military advantage.”).
  40. ICRC CIHL Study, rule 8. See also Tallinn Manual 2.0., commentary to rule 100, para 1.
  41. Tallinn Manual 2.0, rule 80 (“Cyber operations executed in the context of an armed conflict are subject to the law of armed conflict.”).
  42. See William H Boothby, The Law of Targeting (OUP 2012) 387–88.
  43. Cf Art 49(1) AP I (defining “attacks” as “acts of violence against the adversary, whether in offence or in defence”).
  44. See, e.g., William H Boothby, The Law of Targeting (OUP 2012) 384–87; Noam Lubell, ‘Lawful Targets in Cyber Operations: Does the Principle of Distinction Apply?’ (2013) 89 Int’l L Studies 252, 254–74; Marco Roscini, Cyber Operations and the Use of Force in International Law (OUP 2014) 180–81; Yoram Dinstein, The Conduct of Hostilities under the Law of International Armed Conflict (3rd edn, CUP 2016) 3.
  45. Art 48 AP I (“the Parties to the conflict ... shall direct their operations only against military objectives”). It should be noted that it is not universally accepted that the reference to “operations” in Article 48 reflects customary international law. See, e.g., Noam Neuman, ‘Challenges in the Interpretation and Application of the Principle of Distinction During Ground Operations in Urban Areas’ (2018) 51 VJTL 807, 821 fn 44.
  46. See Laurent Gisel, Tilman Rodenhäuser, and Knut Dörmann, ‘Twenty years on: International humanitarian law and the protection of civilians against the effects of cyber operations during armed conflicts’, (2020) 102(913) International Review of the Red Cross 287, 321–322.
  47. Sergio Caltagirone, “Industrial cyber attacks: a humanitarian crisis in the making” (Humanitarian Law & Policy, 3 December 2019), specific assessment done by Kubo Mačák.
  48. AP I, Arts. 48 and 52(1); ICRC CIHL Study, Rule 7. See also Geneva Water Hub, The Geneva List of Principles on the Protection of Water Infrastructure, Geneva (2019), Principle 6, p. 27; ICRC, International Humanitarian Law and the challenges of contemporary armed conflicts in 2015, Report prepared by the International Committee of the Red Cross for the 32nd International Conference of the Red Cross and Red Crescent, ICRC, Geneva (December 2015).
  49. Laurent Gisel, Tilman Rodenhäuser and Knut Dörmann, “Twenty years on: International humanitarian law and the protection of civilians against the effects of cyber operations during armed conflicts”, (2022) 102(913) International Review of the Red Cross, 287–334,  296; ICRC, The principle of distinction under IHL, Cyber Operations during Armed Conflict Series, Geneva (March 2023) 1.
  50. Geneva Water Hub, The Geneva List of Principles on the Protection of Water Infrastructure, Geneva (2019), Principle 6, Commentary, paras. 2-3. See also Yves Sandoz, Christophe Swinarski and Bruno Zimmerman (eds), Commentary on the Additional Protocols (ICRC 1987) (Commentary on Additional Protocol I), para. 2023.
  51. ICRC, The principle of distinction under IHL, Cyber Operations during Armed Conflict Series, Geneva (March 2023) 1.
  52. Laurent Gisel, The Principle of Proportionality in the Rules Governing the Conduct of Hostilities Under International Humanitarian Law. International Expert Meeting 22-23 June 2016, ICRC, Geneva (August 2018) 37-38. See also Tallinn Manual 2.0, Rule 101, Commentary, para. 3.
  53. Robert Kolb, ‘Military Objectives in International Humanitarian Law’ (2015) 28 Leiden Journal of International Law, 691-700, 694.
  54. Marco Roscini, Cyber Operations and the Use of Force in International Law (Oxford University Press 2014) 186.
  55. See Marco Sassòli, International Humanitarian Law. Rules, Controversies, and Solutions to Problems Arising in Warfare (Edward Elgar 2019) 352, M.N. 8.302.
  56. For further discussion see ICRC, International Humanitarian Law and the challenges of contemporary armed conflicts in 2015, Report prepared by the International Committee of the Red Cross for the 32nd International Conference of the Red Cross and Red Crescent (December 2015), paras. 215 ff.
  57. ICRC, The principle of distinction under IHL, Cyber Operations during Armed Conflict Series, Geneva (March 2023), 2.
  58. AP I, Art. 51(4)(c); See also ICRC CIHL Study, Rules 11-12.  See also, Tallinn Manual 2.0, Rule 105(b).
  59. See Yves Sandoz, Christophe Swinarski and Bruno Zimmerman, Commentary to Additional Protocols (ICRC 1987) para. 1963, affirming that “[t]here are also methods which by their very nature have an indiscriminate character, such as poisoning wells”, which results applicable mutatis mutandis to the present situation.
  60. AP I, Art. 51(5)(b).
  61. Marco Roscini, Cyber Operations and the Use of Force in International Law (Oxford University Press 2014) 173 and 218. As argued by the author, Art. 51(4)(c) focuses on the effects of the means or method “whether or not the weapon is capable to strike specific military objectives”. See also Geneva Water Hub, The Geneva List of Principles on the Protection of Water Infrastructure, Geneva (2019), Principle 8, Commentary, para. 1.
  62. Art 52(3) AP I; on the customary nature of this rule, see ICRC CIHL Study, commentary to rule 10, 35–36. It is worth noting that some States argue that this obligation does not reflect customary IHL.
  63. AP I, Art. 51(4)(c).
  64. See for the analysis of an example of a cyber-attack against a water treatment facility, Tallinn Manual 2.0., Rule 106, Commentary, para. 4.
  65. Additional Protocol I, Article 51(5)(b). On the applicability of the proportionality principle in cyber space see: Ministry of Defense of France, International Law Applied to Operations in Cyberspace (9 September 2019); Federal Government of Germany, ‘On the Application of International Law in Cyberspace’ (March 2021) 9-10; Federal Department of Foreign Affairs, ‘Switzerland's position paper on the application of international law in cyberspace’ (May 2021) 9-10; Tallinn Manual 2.0, rule 113.
  66. ICRC Customary IHL Study, Rule 14. Tallinn Manual 2.0, rule 113.
  67. See ICRC, International humanitarian law and the challenges of contemporary armed conflicts, (2019) 16.
  68. Laurent Gisel, The principle of proportionality in the rules governing the conduct of hostilities under international humanitarian law: international expert meeting, 22-23 June 2016 (ICRC 2018) (Expert Report on Proportionality) 9, 52-53.
  69. Yves Sandoz, Christophe Swinarski and Bruno Zimmerman (eds), Commentary on the Additional Protocols (ICRC 1987) (Commentary on Additional Protocol I), para 1978; Emanuela-Chiara Gillard, Proportionality in the Conduct of Hostilities: The Incidental Harm Side of the Assessment (Chatham House 2018) 28.
  70. ICRC, International humanitarian law and the challenges of contemporary armed conflicts, (2015) 41. See, also, Emanuela-Chiara Gillard, Proportionality in the Conduct of Hostilities: The Incidental Harm Side of the Assessment (Chatham House 2018) (Proportionality in the Conduct of Hostilities) 13-18; Tallinn Manual 2.0, commentary to rule 113, paras 6–7.
  71. Expert Report on Proportionality 43-45; Proportionality in the Conduct of Hostilities 18-20.
  72. U.S. Department of Defense, Law of War Manual, June 2016 (revised December 2016) (DoD Law of War Manual), para 5.12.1.3.
  73. See, the Cyber Law Toolkit entry for ‘Attack (international humanitarian law)’ (‘In the assessment of what constitutes the ‘reasonably expected’ effects of an operation that have to be considered, some States, including Denmark, Finland, New Zealand, Norway, Switzerland, or the United States, have clarified that this includes harm due to the foreseeable direct and indirect (or reverberating) effects of an attack’).
  74. Tallinn Manual 2.0, commentary to rule 92, paras 10–12; ICRC, International Humanitarian Law and Cyber Operations during Armed Conflicts: ICRC position paper (November 2019) 7-8.
  75. Tallinn Manual 2.0, commentary to rule 113, para 5.
  76. Additional Protocol I, Article 51(5)(b).
  77. Commentary on Additional Protocol I, para 2209.
  78. Commentary on Additional Protocol I, para 2209. For a discussion of different State interpretations of this requirement see ICRC Customary IHL Study, Rule 14.
  79. William H. Boothby, The law of targeting (Oxford University Press 2012) 94-95.
  80. International Law Association Study Group, Final Report: The Conduct of Hostilities and International Humanitarian Law Challenges of 21st Century Warfare, 25 June 2017, 31.
  81. Expert Report on Proportionality 13.
  82. Commentary on Additional Protocol I, para 2210.
  83. Final Report to the Prosecutor by the Committee Established to Review the NATO Bombing Campaign Against the Federal Republic of Yugoslavia’ [50]. See also Expert Report on Proportionality 52.
  84. ICRC, The Principle of Proportionality, Cyber Operations during Armed Conflict Series, Geneva (March 2023), 1.
  85. AP I, Art. 51(5)(b); see ICRC CIHL Study, Rule 14.
  86. See analysis in ICRC, International Humanitarian Law and the challenges of contemporary armed conflicts in 2015, Report prepared by the International Committee of the Red Cross for the 32nd International Conference of the Red Cross and Red Crescent (December 2015), para. 216; ICRC, International humanitarian law and cyber operations during armed conflicts: Position paper (2019) 7; see similarly the analysis in Geneva Water Hub, The Geneva List of Principles on the Protection of Water Infrastructure, Geneva (2019), Principle 6, Commentary, para. 3, Principle 9, Commentary, paras. 3-4, and its Annex, Commentary, para. 4.. See further, Tallinn Manual 2.0, Rule 101, Commentary, para. 3, and Rule 113, Commentary, para. 6.
  87. ICRC, International Humanitarian Law and the Challenges of Contemporary Armed Conflicts, Recommitting to protection in armed conflict on the 70th anniversary of the Geneva Conventions, ICRC, Geneva (October 2019), 18-19; ICRC, Explosive weapons with wide area effects: a deadly choice in populated areas, ICRC, Geneva (2022) 100-101.
  88. Geneva Water Hub, The Geneva List of Principles on the Protection of Water Infrastructure, Geneva (2019) Principle 15, Commentary, para. 5, and its Annex, Commentary, para. 9.
  89. See mutatis mutandis, ICRC, Explosive weapons with wide area effects: a deadly choice in populated areas, ICRC, Geneva (2022) 58.
  90. See ICRC, Guidelines on the Protection of the Natural Environment in Armed Conflict: Rules and Recommendations Relating to the Protection of the Natural Environment under International Humanitarian Law, with Commentary, ICRC, Geneva (2020), Rule 7, Commentary, paras. 115 ff.
  91. See Laurent Gisel, The principle of proportionality in the rules governing the conduct of hostilities under international humanitarian law: international expert meeting, 22-23 June 2016, ICRC (2018).
  92. ICRC, The Principle of Proportionality, Cyber Operations during Armed Conflict Series, Geneva (March 2023) 2.
  93. Compare Article 57(2)(a)(i)–(ii) with Article 57(2)(c) Additional Protocol I.
  94. Théo Boutruche, “Expert Opinion on the Meaning and Scope of Feasible Precautions under International Humanitarian Law and Related Assessment of the Conduct of the Parties to the Gaza Conflict in the Context of the Operation ‘Protective Edge’”, Expert Opinion commissioned by Diakonia, 2015, p 17.
  95. id, pp 15 – 16.
  96. See Protocol II to the CCW (1980), Article 3(4); Protocol III to the CCW (1980), Article. 1(5); Amended Protocol II to the CCW (1996), Article 3(10); J-M. Henckaerts and L. Doswald-Beck (eds), Customary International Humanitarian Law, Volume I: Rules (2005), Rule 15; ICRC, Explosive Weapons with Wide Area Effects: A Deadly Choice in Populated Areas (2022), p 104.
  97. Marco Sassòli and Anne Quintin, “Active and Passive Precautions in Air and Missile Warfare”, Israel Yearbook on Human Rights, Vol. 44, 2014, p 87.
  98. ICRC, International humanitarian law and the challenges of contemporary armed conflicts (2015), p 43; see also ICRC, Avoiding Civilian Harm from Military Cyber Operations during Armed Conflicts (2021).
  99. Art. 57(1) AP I; on the customary nature of this rule, see ICRC CIHL Study, Rule 15.
  100. See Art. 57(2)(b) AP I. See also analysis in Geneva Water Hub, The Geneva List of Principles on the Protection of Water Infrastructure, Geneva (2019), Principle 9, Commentary, para. 4, and Principle 10, Commentary, para 3; ICRC, International Humanitarian Law and the challenges of contemporary armed conflicts in 2015, Report prepared by the International Committee of the Red Cross for the 32nd International Conference of the Red Cross and Red Crescent (December 2015).
  101. ICRC, The Principle of Proportionality, Cyber Operations during Armed Conflict Series, Geneva (March 2023) 2.
  102. See Eirini Giorgou and Abby Zeith, “When the lights go out: the protection of energy infrastructure in armed conflict” (Humanitarian Law & Policy, 20 April 2023). While not per se considered incidental civilian harm, displacement due to unavailability of essential services is relevant for proportionality and precautions in attack.
  103. AP I, Arts. 57(2)(a)(iii) and 57(2)(b); ICRC CIHL Study, Rules 18 and 19. See ICRC, The Principle of Proportionality, Cyber Operations during Armed Conflict Series, Geneva (March 2023) 1.
  104. See ICRC CIHL Study, commentary to Rule 20. See also Tallinn Manual 2.0, Rule 120, Commentary, para. 8.
  105. See for example the analysis in: Sergio Caltagirone, “Industrial cyber attacks: a humanitarian crisis in the making” (Humanitarian Law & Policy, 3 December 2019), specific assessment done by Kubo Mačák.
  106. AP I, Art. 54; AP II, Art 14. See also UNSC, Res. 2573 (2021) S/RES/2573 (27 April 2021).
  107. AP I, Art. 54; AP II, Art 14. See also ICRC CIHL Study, Rule 53. The Rome Statute of the ICC criminalizes “intentionally using starvation of civilians as a method of warfare by depriving them of objects indispensable to their survival” as a war crime in IACs under Article 8(2)(b)(xxv) and NIACs under Article 8(2)(e)(xix) as amended in 2020. See also the prohibition of starvation as a method or warfare in the cyber realm, Tallinn Manual 2.0, Rule 107.
  108. See also ICRC CIHL Study, Rule 54. See also Tallinn Manual 2.0, Rule 141, Commentary, para. 1.
  109. Ministry of Foreign Affairs of Costa Rica, “Costa Rica's Position on the Application of International Law in Cyberspace” (21 July 2023) 17: “61. Under IHL, it is prohibited to attack, destroy, remove or render useless objects indispensable to the survival of the population, including when using cyber operations. The protection under this rule extends to the ICT equipment and the data needed to operate such objects. Thus, for example, a cyber operation against food production systems, drinking water installations, or wastewater management systems would be a violation of IHL even if it did not reach the threshold of attack under IHL.”
  110. Czech Republic, “Position paper on the application of international law in cyberspace” (February 2024) 12: “43. It is prohibited to make objects indispensable for the survival of the civilian population the object of attack, including through cyber means. It is likewise prohibited to destroy, remove or render them useless by cyber means. Parties to an armed conflict must not disrupt the functioning of such objects, including through cyber means. All feasible measures must be taken to facilitate their functioning and prevent harm to these objects, including by cyber operations.”
  111. Ministry of Defense of France, “International Law Applied to Operations in Cyberspace” (9 September 2019) 15: “Cyberoperations must also take into account the special protection of certain objects, such as medical units, cultural property, the natural environment, objects indispensable to the survival of the civilian population and installations that contain dangerous forces. This protection extends to ICT equipment and services and to the data needed to operate them, such as medical data linked to the operation of a hospital.”
  112. Official compendium of voluntary national contributions on the subject of how international law applies to the use of information and communications technologies by States, UNODA, A/76/136 (August 2021), 75: “IHL also prohibits attacking, destroying, removing or rendering useless objects indispensable to the survival of the population, including through cyber means and methods of warfare. ‘Objects indispensable to the survival of the civilian population’ include ICT infrastructure for food production or drinking water installations.”
  113. See Yves Sandoz, Christophe Swinarski and Bruno Zimmerman, Commentary to Additional Protocols (ICRC 1987) 655, paras. 2102-3 and 1458, para. 4802-3.
  114. Geneva Water Hub, The Geneva List of Principles on the Protection of Water Infrastructure, Geneva (2019) 50, citing the Official Records of the Diplomatic Conference (Geneva, 1974-1977), Vol. XV, CDDH/III/264/Rev.1, 349. As has been affirmed, “[i]t extends to pieces of energy infrastructure critical to the effective operation of other indispensable objects” (See  Eirini Giorgou and Abby Zeith, “When the lights go out: the protection of energy infrastructure in armed conflict” (Humanitarian Law & Policy, 20 April 2023))
  115. Laurent Gisel, Tilman Rodenhäuser and Knut Dörmann, “Twenty years on: International humanitarian law and the protection of civilians against the effects of cyber operations during armed conflicts”, (2022) 102 (913) International Review of the Red Cross, 287–334, 327-8; Kubo Mačák and Laurent Gisel, “The Legal Constraints of Cyber Operations in Armed Conflicts”, in Rajeswari Pillai Rajagopalan (ed) Future Warfare and Technology: Issues and Strategies (ORF and Global Policy Journal 2022) 147. See for example the analysis with regards to ransomware in Jeffrey Biller, “The Strategic Use of Ransomware Operations as a Method of Warfare”, (2023) 100 International Law Studies.
  116. Yves Sandoz, Christophe Swinarski and Bruno Zimmerman, Commentary to Additional Protocols (ICRC 1987), 655, para. 2101.
  117. Tallinn Manual 2.0, Rule 141, Commentary, para. 2.
  118. ICRC CIHL Study, Commentary to Rule 54.
  119. See Geneva Water Hub, The Geneva List of Principles on the Protection of Water Infrastructure, Geneva (2019) 52.
  120. See Tallinn Manual 2.0, Rule 141; Geneva Water Hub, The Geneva List of Principles on the Protection of Water Infrastructure. Annex: Principle: Cyber operations, Geneva (November 2021).
  121. Tallinn Manual 2.0, Rule 141, Commentary, para. 5. See in this regard, the national positions of Costa Rica, France, and Norway. See also Sergio Caltagirone, “Industrial cyber attacks: a humanitarian crisis in the making” (Humanitarian Law & Policy, 3 December 2019), specific assessment done by Kubo Mačák.
  122. Tallinn Manual 2.0, Rule 141, Commentary, para. 6; Marco Roscini, Cyber Operations and the Use of Force in International Law (Oxford University Press 2014) 231.
  123. Laurent Gisel, Tilman Rodenhäuser and Knut Dörmann, “Twenty years on: International humanitarian law and the protection of civilians against the effects of cyber operations during armed conflicts”, (2022) 102(913) International Review of the Red Cross, 287–334, 317; Kubo Mačák and Laurent Gisel, “The Legal Constraints of Cyber Operations in Armed Conflicts”, in Rajeswari Pillai Rajagopalan (ed.) Future Warfare and Technology: Issues and Strategies (ORF and Global Policy Journal 2022) 149.
  124. Michael N. Schmitt, “The Notion of ‘Objects’ During Cyber Operations: A Riposte in Defence of Interpretive and Applicative Precision” (2015) 48 Israel Law Review 81, 107.
  125. Sergio Caltagirone, “Industrial cyber attacks: a humanitarian crisis in the making” (Humanitarian Law & Policy, 3 December 2019), specific assessment done by Kubo Mačák; Geneva Water Hub, The Geneva List of Principles on the Protection of Water Infrastructure. Annex: Principle: Cyber operations, Geneva (November 2021), Commentary, para. 7.
  126. See ICRC, International Humanitarian Law and the challenges of contemporary armed conflicts in 2015, Report prepared by the International Committee of the Red Cross for the 32nd International Conference of the Red Cross and Red Crescent (December 2015), para. 205.
  127. Yves Sandoz, Christophe Swinarski and Bruno Zimmerman, Commentary to Additional Protocols (ICRC 1987), 655, para. 2101.
  128. Mara Tignino, “The regulation of crimes against water in armed conflicts and other situations of violence”, (2023) 105(923) International Review of the Red Cross, 706-734, 717.
  129. Yves Sandoz, Christophe Swinarski and Bruno Zimmerman, Commentary to Additional Protocols (ICRC 1987), 656, para. 2109.
  130. Yves Sandoz, Christophe Swinarski and Bruno Zimmerman, Commentary to Additional Protocols (ICRC 1987), 657, para. 2112.
  131. Yves Sandoz, Christophe Swinarski and Bruno Zimmerman, Commentary to Additional Protocols (ICRC 1987), 657, para. 2110.
  132. See Eirini Giorgou and Abby Zeith, “When the lights go out: the protection of energy infrastructure in armed conflict” (Humanitarian Law & Policy, 20 April 2023).
  133. AP I, Arts. 35(3) and 55; ICRC CIHL Study, Rule 45. There have been some objections as to the customary nature of this rule, and its applicability to NIACs is less clear than to IACs.
  134. See ICRC CIHL Study, Rule 45, Summary; Tallinn Manual 2.0, Rule 143, Commentary, para. 2.
  135. ICRC CIHL Study, Rule 45.
  136. ICRC CIHL Study, Rule 46.
  137. See Convention on the Prohibition of Military or Any Other Hostile Use of Environmental Modification Techniques (December 1976), Understandings; Yves Sandoz, Christophe Swinarski and Bruno Zimmerman, Commentary to Additional Protocols (ICRC 1987) 416, para. 1452-53, footnote 114, and p. 664, para. 2136. For example, for the purpose for Additional Protocol I, ‘long-lasting’ refers to a period of decades, while the ENMOD Convention establishes that the threshold is of a period of months, or approximately a season.
  138. ICRC, Guidelines on the Protection of the Natural Environment in Armed Conflict: Rules and Recommendations Relating to the Protection of the Natural Environment under International Humanitarian Law, with Commentary, ICRC, Geneva (2020) para. 54.
  139. ICRC CIHL Study, Rule 43; ILC, Principles on protection of the environment in relation to armed conflicts (2022), Principle 13(3); Marco Sassòli and others, How Does Law Protect in War? (2014), Environment entry; Tallinn Manual 2.0, Rule 143. For an alternative view, see Israel’s comment in International Law Commission, Protection of the environment in relation to armed conflicts: Comments and observations received from Governments, international organizations and others, UN Doc. A/CN.4/749 (17 January 2022).
  140. See ICRC, Guidelines on the Protection of the Natural Environment in Armed Conflict: Rules and Recommendations Relating to the Protection of the Natural Environment under International Humanitarian Law, with Commentary, ICRC, Geneva (2020) Rules 5-9; ILC, Principles on protection of the environment in relation to armed conflicts (2022), Principle 14; See also Legality of the Threat or Use of Nuclear Weapons, Advisory Opinion, I.C.J. Reports 1996, 226, para. 30.
  141. Tallinn Manual 2.0, Rule 143, Commentary, para. 2.
  142. There is no established definition of the natural environment under IHL, but it has been understood that “refers more broadly to the system of inextricable interrelations between living organisms and their inanimate environment. The notion of the natural environment under IHL includes everything that exists or occurs naturally, such as the general hydrosphere, biosphere, geosphere and atmosphere (including fauna, flora, oceans and other bodies of water, soil and rocks). The natural environment moreover includes natural elements that are or may be the product of human intervention, such as foodstuffs, agricultural areas, drinking water and livestock”. See ICRC, Guidelines on the Protection of the Natural Environment in Armed Conflict: Rules and Recommendations Relating to the Protection of the Natural Environment under International Humanitarian Law, with Commentary, ICRC, Geneva (2020) para. 16 (internal footnote omitted). See also Geneva Water Hub, The Geneva List of Principles on the Protection of Water Infrastructure. Annex: Principle: Cyber operations, Geneva (November 2021), Commentary, para. 9.
  143. See also Geneva Water Hub, The Geneva List of Principles on the Protection of Water Infrastructure. Annex: Principle: Cyber operations, Geneva (November 2021).
  144. Yves Sandoz, Christophe Swinarski and Bruno Zimmerman, Commentary to Additional Protocols (ICRC 1987) 416, para. 1454; Tallinn Manual 2.0, Rule 143, Commentary, para. 6-7.
  145. Geneva Water Hub, The Geneva List of Principles on the Protection of Water Infrastructure, Geneva (2019), Principle 9, Commentary, para. 5; Eirini Giorgou and Abby Zeith, “When the lights go out: the protection of energy infrastructure in armed conflict” (Humanitarian Law & Policy, 20 April 2023).
  146. Additional Protocol I, art. 58; see also ICRC Customary IHL Study, Rules 22, 23-24.
  147. Under customary IHL, the second and third rules are “arguably” applicable in non-international armed conflicts. See Henckaerts/Doswald-Beck, commentary on Rules 23 and 24, pp 71 and 74.
  148. Commentary of Additional Protocol I, para. 2239.
  149. Dieter Fleck (ed.), The Handbook of International Humanitarian Law, OUP 2021, s 8.08.
  150. Eric Jensen, “Precautions against the effects of attacks in urban areas”, International Review of the Red Cross, Vol. 98 (1), 2016, pp 164 – 165.
  151. ICRC, Avoiding Civilian Harm from Military Cyber Operations during Armed Conflicts, 2021; Jonathan Horowitz, “Cyber Operations under International Humanitarian Law: Perspectives from the ICRC”, American Society of International Law Insights, Vol. 24:11, 2020.
  152. See ICRC, Avoiding Civilian Harm from Military Cyber Operations During Armed Conflicts, Report of Expert meeting held from 21-22 January 2020, ICRC, Geneva (May 2021). 27; Geneva Water Hub, The Geneva List of Principles on the Protection of Water Infrastructure. Annex: Principle: Cyber operations, Geneva (November 2021), Commentary, para. 5. See also the national position of Costa Rica: “Some of these measures may need to be implemented already in peacetime. For instance, States should cultivate a strong culture of cyber resilience throughout their societies and ensure that their critical infrastructure and other infrastructure used by civilians is protected to the highest possible standard”. See Ministry of Foreign Affairs of Costa Rica, “Costa Rica's Position on the Application of International Law in Cyberspace” (21 July 2023) 15.
  153. See ICRC, International Humanitarian Law and the challenges of contemporary armed conflicts in 2015, Report prepared by the International Committee of the Red Cross for the 32nd International Conference of the Red Cross and Red Crescent, 8-10 (December 2015), para. 214.
  154. See ICRC, Avoiding Civilian Harm From Military Cyber Operations During Armed Conflicts, Report of Expert meeting held from 21-22 January 2020, ICRC, Geneva (May 2021) 54. See also mutatis mutandis, Tallinn Manual 2.0, Rule 146, Commentary, para. 7.
  155. AP I, Art. 58(c); ICRC CIHL Study, Rule 22. For discussions on the customary nature of this rule, see Eric T. Jensen, “Article 58 and Precautions Against the Effects of Attacks in Urban Areas” (2016), 98(147) International Review of the Red Cross.

Bibliography and further reading[edit | edit source]

Contributions[edit | edit source]

Previous: Scenario 28: Extraterritorial incidental civilian cyber harm Next: Scenario 30: Backdoors and implants