SOMEONE ELSE’S WINDOWS: IHL and cyber warfare

MALAYBALAY CITY (MindaNews/20 August) — An interview early this week with Cordula Droege, a legal expert at the International Committee of the Red Cross points out interesting concepts of how International Humanitarian Law can be applied in situations where one or more parties engaged in war may employ information technology as a method of warfare. With the ever increasing reliance on IT in almost all aspects of our life, it’s no longer farfetched to imagine future wars maximizing the potentials of this technology, hence the need to study its implications in relation to the legal framework of the rules governing armed conflict.

Given the significance, if not novelty, of the subject, this column would like to share with MindaNews readers the unabridged transcript of the interview which was sent by ICRC. Below is the first installment of the transcript:

Q: What do you mean by “cyber warfare” and why is it of concern to the ICRC?

CD: The concept of cyber warfare is somewhat nebulous and different people appear to mean different things when they refer to it. For the purposes of this discussion, cyber warfare refers to means and methods of warfare that rely on information technology and are used in the context of an armed conflict within the meaning of international humanitarian law – as opposed to the traditional kinetic military operations.

Similarly, such terms as “cyber attacks,” “cyber operations” or “computer network attacks” have no internationally agreed legal meaning and are used in different contexts (not always limited to armed conflicts) and with different meanings. Let us use the rather broad term of cyber operations to refer to operations against or via a computer or a computer system through a data stream. Such operations can aim to do different things, for instance to infiltrate a computer system and collect, export, destroy, change, or encrypt data or to trigger, alter or otherwise manipulate processes controlled by the infiltrated system. The technology can be used in warfare and, under certain circumstances, some of these operations can constitute attacks as defined under international humanitarian law.

Cyber operations can raise humanitarian concerns, in particular when their effect is not limited to the data of the targeted computer system or computer. Indeed, they are usually intended to have an effect in the “real world.” For instance, by tampering with the supporting computer systems, one can manipulate an enemy’s air traffic control systems, oil pipeline flow systems or nuclear plants. The potential humanitarian impact of some cyber operations is therefore enormous. Cyber operations that have been carried out thus far, for example in Estonia, Georgia and Iran, do not appear to have had serious consequences for the civilian population.

However, it seems that it is technically feasible to interfere with airport control systems, other transportation systems, dams or nuclear power plants via cyber space. Potentially catastrophic scenarios, such as collisions between aircraft, the release of poisons from chemical plants, or the disruption of vital infrastructure and services such as electricity or water networks, therefore cannot be dismissed. The main victims of such operations would most likely be civilians.

Q: Does international humanitarian law apply to cyber operations?

CD: International humanitarian law, or IHL, only comes into play if cyber operations are committed in the context of an armed conflict – whether between States, between States and organized armed groups or between organized armed groups. Therefore, we need to distinguish the general issue of cyber security from the specific issue of cyber operations in armed conflict. Terms like “cyber attacks” or even “cyber terrorism” may evoke methods of warfare, but the operations they refer to are not necessarily conducted in armed conflict. Cyber operations can be and are in fact used in crimes committed in everyday situations that have nothing to do with situations of war. A large proportion of operations colloquially termed “cyber attacks” are in fact network exploitation attacks carried out for the purpose of illicit information gathering and occur outside the context of armed conflicts. But in armed conflict situations, IHL applies when the parties resort to means and methods of warfare relying on cyber operations.

Q: If IHL applies to cyber operations, what does it say about them?

CD: IHL does not specifically mention cyber operations. Because of this, and because the exploitation of cyber technology is relatively new and sometimes appears to introduce a complete qualitative change in the means and methods of warfare, it has occasionally been argued that IHL is ill adapted to the cyber realm and cannot be applied to cyber warfare.

However, the absence in IHL of specific references to cyber operations does not mean that such operations are not subject to the rules of IHL. If the means and methods of cyber warfare produce the same effects in the real world as conventional weapons (such as destruction, disruption, damage, injury or death), they are governed by the same rules as conventional weapons.

New technologies of all kinds are being developed all the time and IHL is sufficiently broad to accommodate these developments. IHL prohibits or limits the use of certain weapons specifically (for instance, chemical or biological weapons, or anti-personnel mines). But it also regulates, through its general rules, all means and methods of warfare, including the use of all weapons. In particular, Article 36 of Protocol I additional to the Geneva Conventions provides that, “[i]n the study, development, acquisition or adoption of a new weapon, means or method of warfare, a High Contracting Party is under an obligation to determine whether its employment would, in some or all circumstances, be prohibited by this Protocol or by any other rule of international law applicable to the High Contracting Party.” Beyond the specific obligation it imposes on States parties, this rule shows that general IHL rules apply to new technology.

This is not to say that there might not be a need to develop the law further as technologies evolve or their humanitarian impact becomes better understood. That will have to be determined by States. In the meantime, it is important to stress that there is no legal vacuum in cyber space. Beyond that, however, we are faced with a number of question marks on how IHL will apply in practice. (Next: Difficulty of applying IHL in cyber warfare)