Cyber-Warfare and the Relevance of International Humanitarian Law

I. The law of cyber-warfare and war

Although the term “Cyber-Warfare” has become part of common parlance, few have aimed to examine closely the scope of Cyber-activity that might be governed by the law of war. In this Part, we aim to fill this gap by examining when a Cyber-Attack constitutes an armed attack under jus ad bellum—and thus can be accurately considered “Cyber-Warfare.” We also examine how the laws governing conduct in the course of war—known as jus in bello—might apply to Cyber-Attacks.

Generally speaking, the term is applied to a “Cyber-Attack” that has the backing of one nation with the intent of hurting another. Although there is no clear doctrinal definition of ‘Cyber-Warfare,’” the U.S. Congressional Research Service said in a 2015 report, “it is typically conceptualized as state-on-state action equivalent to an armed attack or use of force in cyberspace that may trigger a military response.” By now the world superpowers have established Cyber-Warfare units which in a certain way lend support to military missions and gathering of operations. These mostly work with people with power or choose a specific group which can be easily brainwashed. This action is known as information warfare³--a typical jargon used by these forces. In May 2007, the Estonian government faced the reality of Cyber-Warfare An anonymous Cyber-Attack targeted both civilian and government.⁴ Hitting the websites of banks, ministries, newspapers, and broad-casters, the assault left Estonia without the means to tell the world it was under attack. No state or terrorist group claimed responsibility after the attack, but analysts believed the complexity of the attack required the cooperation of a state and/or several large telecom firms. Given the history of the Baltic State, some naturally suspected Russian involvement.⁵ The attack on Estonia illustrates the need to confront the seriousness of Cyber-Warfare. As leaders begin to address the problem of defending against such attacks, they must not ignore the legal questions. For example, does a Cyber-Attack constitute an “armed attack” under the United Nations Charter?⁶ If analysts eventually link Russia to the attack, would the attack justify Estonia in invoking its right of self-defense under the Charter?⁷

These issues will take time to address, and yet such jus ad bellum⁸ issues barely scratch the surface of the legal conundrum. International and military lawyers must also consider how the jus in bello or International Humanitarian law applies to Cyber-Warfare.

A. JUS AD BELLUM

What law governs states’ right to resort to armed force in self-defense against Cyber-Attacks? First, we outline the general prohibition on the use or threat of force in International relations contained in Article 2(4) of the U.N. Charter. Second, we discuss the exceptions to that prohibition for collective security operations and self-defense, with particular attention to when a Cyber-Attack would justify resort to self-defense. Finally, we close by explaining the customary International law requirements of jus ad bellum necessity and proportionality and by detailing the limitations and problems of applying jus ad bellum requirements to Cyber-Attacks. We conclude that states may only use defensive armed force in response to a Cyber-Attack if the effects of the attack are equivalent to those of a conventional armed attack.

1. Legal Principles

Article 2(4) of the U.N. Charter provides that member states “shall refrain in their international relations from the threat or use of force against the territorial integrity or political independence of any state, or in any other manner inconsistent with the Purposes of the United Nations.”⁹ This prohibition is complemented by a customary international law norm of non-intervention, which prohibits states from interfering in the internal affairs of other states.

Article 2(4) broadly does not only prohibit use of force but also political and economic coercion. Nonetheless the consensus is that Article2(4) prohibits only armed force. At the same time, there are preliminary indications that Cyber-Attacks as defined in this Article may violate the customary international law norm of nonintervention. First, states generally do not engage in Cyber-Attacks openly, but rather tend to try to hide their responsibility through technical means and by perpetrating the attacks through non-state actors with ambiguous relationships with state agencies. Second, when states acknowledge that they have been victims of Cyber-Attack, they and their allies tend to denounce and condemn the attacks.¹⁰ Third, in its common approach to cyber-defense, NATO has indicated that Cyber-Attacks trigger states parties’ obligations under Article 4 of the NATO treaty, which applies only when “the territorial integrity, political independence or security of any of the Parties is threatened.” The invocation of this provision strongly suggests that NATO member states believe that Cyber-Attacks violate the customary norm of nonintervention or a related international law norm. Still, as the next Subsection explains, the fact that a Cyber-Attack is unlawful does not necessarily mean that armed force can be used in response.

2. Exceptions for Self-defense

There are two exceptions on Article 2(4) namely self-defense and collective operations. The second exception to Article 2(4) is articulated in Article 51, which provides that “nothing in the present Charter shall impair the inherent right of individual or collective self-defense if an armed attack occurs.”¹¹ Lawful self-defense is much harder to define and identify than lawful collective security operations. Indeed, in most armed conflicts, both sides claim to be acting in self-defense, and the international debates tend to focus on factual and political disputes rather than legal doctrine.¹² It is clear, however, that the critical question determining the lawfulness of self-defense is whether or not an armed attack has occurred. Many agree that a Cyber-Attack may rise to the level of an armed attack. For example, there may be acts that violate Article 2(4)’s prohibition on the use or threat of force that do not rise to the level of an armed attack and do not trigger the right of self-defense under Article 51. The ICJ has indicated that cross-border incursions that are minor in their “scale and effects” may be classified as mere “frontier incidents” rather than “armed attacks.”¹³ Instead, armed attacks must be of sufficient gravity to constitute “most grave forms of the use of force.”¹⁴ This does not leave states unable to respond to low-level violations of their sovereignty; even if they may not resort to defensive force, states may engage in retorting or non-forceful countermeasures.

3. Ad Bellum Necessity and Proportionality

The principle of necessity requires that force must be used only as a last resort, when peaceful means, such as a diplomatic settlement, cannot achieve the state’s overall aim. Proportionality extends this logic, prohibiting force if the overall scope and intensity of force is excessive in relation to the state’s actual or imminent danger.¹⁵ The United States has acknowledged that these principles apply to military responses to Cyber-Attacks.

While principles of necessity and proportionality are clear, applying those principles to state responses to Cyber-Attacks is challenging. Evaluating whether an invocation of self-defense complies with the principles of necessity and proportionality is difficult and fact-intensive even for conventional attacks, and Cyber-Attacks present hard new questions. For example, Cyber-Attacks rising to the level of armed attacks may require decision makers to devise ways of measuring harm to computer networks and its indirect effects against more conventional kinds of harm in order to determine what would constitute a lawful response. This Section demonstrates that applying the existing jus ad bellum framework in the context of Cyber-Attacks is challenging—and can address only a small subset of the broad range of Cyber-Attacks. An ad bellum analysis will be relevant for regulating the use of or response to only Cyber-Attacks addressed by Security Council resolutions and which meet the standard for an armed attack giving rise to a right of self-defense.

B. JUS IN BELLO

The novel conditions of cyber-warfare pose novel challenges to applying jus in bello principles of proportionality, distinction, and neutrality. Because Cyber-Attacks are often not immediately lethal or destructive and may cause only temporary incapacity of network systems, it may be hard to evaluate whether a Cyber-Attack is proportional. It can also be nearly impossible to distinguish between combatants, civilians directly participating in hostilities, civilians engaged in a continuous combat function, and protected civilians in the context of Cyber-Attacks. Finally, the ease of masking the source of a Cyber-Attack makes enforcement of neutrality duties complicated and expensive.

1. Necessity

Although the necessity of a Cyber-Attack may be difficult to evaluate, this difficulty arises from line-drawing debates that did not originate in Cyber-Warfare and are not unique to in bello Cyber-Attack. In bello necessity relates to the concrete military advantage to be gained from a specific hostile act. An individual Cyber-Attack may be unnecessary if it does not advance the military’s objective. While Cyber-Attacks must be necessary to be lawful, evaluating them in bello necessity does not present novel challenges.

2. Proportionality

It is difficult to evaluate whether an attack would be proportional according to the relevant categories of “loss of civilian life, injury to civilians, damage to civilian objects, or a combination thereof,”¹⁶ as the typical direct effects of Cyber-Attacks may be non-lethal or temporary, yet severe.¹⁷ Furthermore, how should the temporary incapacity of critical systems be evaluated?¹⁸ For example, a Cyber-Attack that effectively stops the transmission of information through the Internet might merely inconvenience the populace—or it might result in hospitals being unable to communicate vital information, leading to loss of life. An in bello proportionality analysis requires anticipating the probable consequences of an action, but that may be difficult, if not impossible, in the context of Cyber-Warfare.¹⁹ Just as Cyber-Attacks may change the understanding of an armed attack under Article 2(4),Cyber-Attacks may also change the weight given to temporary or non-lethal consequences.

C. CONVENTIONAL WARFARE

It is quite clear that in case of a conventional war there is armed conflict which leads to a lot of losses of life and bloodshed but the fact that a potential Cyber-Warfare is illegal and moreover has the caliber to cause mass destruction and lethal in many other ways is unwavering. In case of a Cyber-Warfare the main objects of destruction are typically traditionally protected objects hence cause imbalance to the law of distinction. It is contended that the nonlethal potential of Cyber-Warfare may lead to more frequent violations of the principle of distinction as compared to conventional warfare.

1. The meaning of Distinction

Distinction as a principle is one of the most fundamental protections afforded to the civilian population in time of hostilities. The need to distinguish between combatants and civilians is an important aspect of warfare that has been recognized for long as the indispensable means by which humanitarian principles are injected into the rules governing conduct in war. The Principle imposes an obligation on parties to armed conflict to always distinguish between the civilian population and combatants and between civilian objects and military objectives, and accordingly military operations should be directed only against the military objectives.²⁰ The reason underlying the principle of distinction is that combatants have the right to participate in hostilities and consequently may be the object of attack for the enemy. While civilians lack the right to directly participate in hostilities therefore they are to be protected from the effects of military operations.²¹

2. Legality of Potential Cyber-Attack

The principle of distinction shall be applied in same cause as it is applied in case of conventional war. As military sometimes uses Cyber Weapons for military Weapons, the principle also has to be reinterpreted to understand the potentiality of a Cyber-Warfare. As such, some uses of cyber Weapons are clearly acceptable under the principle of distinction, while the principle clearly prohibits other uses. At one end of the spectrum of possible attacks, the principle will likely permit a state to use a cyber-Weapon to attack a purely military target. It seems obvious that such a use would not violate the principle of distinction. For example, an attack that neutralizes an air defense station as part of a general campaign would offer the belligerent a definite military advantage. The use of a cyber-Weapon may in fact result in fewer civilian deaths than the use of a conventional aerial bombing campaign.²²

The legality of such an attack seems like a “no-brainer.” Similarly, IHL will ban any Cyber-Attack that would seriously damage the environment or cause the release of natural forces in violation of Articles 54, 55, and 56 of Additional Protocol I. Again, for these attacks, the use of a cyber-Weapon would not change the analysis.

a) Who may lawfully be targeted in Cyber-Attack?

Under the law of war, only three categories of individuals may be lawfully targeted: combatants, civilians directly participating in hostilities, and civilians acting in a continuous combat function. Civilians lose their right not to be targeted to the extent that they “participate directly in hostilities.”²³ Furthermore, under recent guidance from the International Committee of the Red Cross, civilians who adopt a continuous combat function may also be targeted.²⁴ The unique characteristics of civilian contributions to Cyber-Attacks blur the line between direct participation, continuous combat function, and other types of involvement in the execution of hostilities. As a result, civilians involved in Cyber-Attacks might be regarded as performing tasks that might alter their status under the law of war, rendering them lawful targets of a counter-attack.

3. Cyber-Attack, Cyber-Warfare and Cyber-Crime compared

In order to understand Cyber-Attack, it is important to appreciate the distinctions between Cyber-Attack and cyber-crime. Cyber-crime is a broad concept analytically distinct from Cyber-Attack. In particular, cyber-crime is generally understood as the use of a computer-based means to commit an illegal act. Unlike Cyber-Attacks, cyber-crimes need not undermine the target computer network (though in some cases they may do so), and most do not have a political or national security purpose. Finally, like all crimes, but unlike Cyber-Attacks, cyber-crimes are generally understood to be committed by individuals not state. For example, a person who transfers child pornography, for example, would commit a cyber-crime but not a Cyber-Attack, both because his actions do not undermine the function of a computer network and because he is not motivated by a political or national security purpose.

II. Cyber-warfare and modern internet

(A) The Modern Internet

Computers control much of our civilian and military infrastructure, including communications, power systems, sewage regulation, and healthcare. Further, the Internet provides nearly universal inter connectivity of computer networks without distinction between civilian and military uses. The unitary term “Internet” implies a single network; in fact, the Internet’s physical structure is made up of many different linked networks, which are known collectively as the “Internet backbone.”²⁵

The Internet backbone has the capacity to carry data across the countries, continents, and oceans of the world. Keeping with its military roots, the Internet has a significant level of redundancy in the backbone, such that if one network experiences a problem the Internet can reroute traffic in real time to avoid it. However, as the Internet has become more commercialized, major net-work providers have begun to move to a “hub-and-spoke” system that funnels Internet traffic through nodes located in major cities.²⁶ Such a system, while easier to maintain, significantly increases the vulnerability of the Internet to attack by placing a large number of nodes in one location. All Internet communications traffic must pass through a node on its way to a destination. The communications protocol of the Internet divides every email, web search, and message sent over the Internet into discrete blocks of data called packets. The Internet then routes the packets between nodes over data links shared with other Internet traffic. A message sent from Country A to Country B may pass through nodes located in Country C and Country D before reaching Country B. As noted above, the Internet re-routes data traffic if a node is shut down or rendered inoperable, but the loss of a large number of nodes can result in the loss of Internet service for extended periods.²⁷ The use of packets decreases the time required for data to move across the network and increases the robustness of communication. The communications protocol may divide a longer message into several packets and then reassemble the message at the destination. When the Internet divides a single message into multiple packets, each packet may follow a different route on its way to its destination.

(B) Recent Cyber-Attack Scenarios

Cyber warfare is more than just an issue for websites and some forms of communication; indeed, some Cyber-Attacks may cause serious physical, tangible effects, as evidenced by the attack on Estonia. Had the attack been more global in nature, millions of people could have been without communications for some time—a situation both life threatening and damaging to the global economy. Similarly, cyber at-tacks on purely military targets may be capable of effectively neutralizing a hostile threat without risking lives or equipment.

1. Infiltration of a secure computer network

During NATO’s Kosovo campaign in the 1990s, NATO air war planners devised a Cyber-Attack to insert false messages and targets into the Serbian military’s centralized air-defense command network.²⁸ As in the attack discussed in Scenario 1, NATO could have delivered the Weapon via the host country’s Internet or possibly could have “beamed” the Weapon to the target directly from a NATO warplane. This attack would have limited Serbia’s ability to accurately target NATO warplanes during the bombing campaign, but, if improperly planned, such a Cyber-Attack could have put civilian tar-gets at risk, with the air-defense network possibly confusing relief planes or commercial aircraft for military targets. Further, fuel-depleted missiles launched at false targets could have fallen on civilian structures, such as homes, hospitals, and schools. NATO did not ultimately launch this Cyber-Attack, but in the future NATO commanders might be tempted to risk additional harm to the civilian population to reduce risk to the lives of NATO pilots.

2. Attack on power plant

Militaries may also develop cyber Weapons to disable civilian infrastructure serving both military and civilian functions. Many recent U.S. aerial bombing campaigns have included the outright destruction of such targets, which include power plants, telecommunications, and transport infrastructure. Unlike conventional strikes, which may leave civilians without power for months or even years,²⁹ a cyber-strike could disable the power grid for the duration of hostilities yet allow electrical service to resume immediately once the fighting was over. This result would not completely eliminate the public health and safety concerns, but cyber warfare at least offers the possibility of lessening the damage relative to a conventional attack.

III. New law for cyber-attack

Cyber-Attacks present a new and growing threat—one that current international and domestic law is not prepared to meet. The law of war, often cited as the relevant body of law to address Cyber-Attacks in fact offers a basis for responding only to those Cyber-Attacks that amount to an armed attack. To begin to fill the gaps left by existing law, it is recommended two types of legal reform—domestic and international—aimed at addressing these shortcomings. The domestic law reforms are twofold: First, India should take steps to add extraterritorial applicability to criminal laws bearing on Cyber-Attack. Second, the India should utilize limited counter-measures, as appropriate, to combat Cyber-Attacks that do not rise to the level of armed attacks under the law of war. We therefore recommend an international cyber-treaty with two central aims. First, such an agreement should provide a definition of Cyber-Attacks and cyber-warfare. The transnational conversation leading to such a treaty should serve to limit and define the Cyber-Attacks to which states may respond with force. Second, the treaty should empower states to engage in international cooperation in evidence collection and criminal prosecutions of individuals involved in transnational Cyber-Attacks.

(A) A Cyber-Attack treaty

Changes in domestic law and policy, such as adding extraterritorial applicability to criminal laws and planning for the use of countermeasures, are valuable legal responses to the threat of Cyber-Attack. Given the transnational nature of the challenge, international cooperation is likely to be necessary to provide a solution commensurate to the problem.³⁰ While the development of international norms is useful, it will not provide governments and private actors with the clarity of a codified definition of Cyber-Attack or written guidelines on how states should respond to certain types of challenges. For this reason, we recommend that the international community create a multilateral agreement. The agreement should have two central features. First, it must offer a shared definition of Cyber-Attack and which Cyber-Attacks constitute armed attack— “Cyber-Warfare”—under the U.N. Charter. Second, it should offer a framework for more robust international cooperation in evidence collection and criminal prosecution of those participating in cross-national Cyber-Attacks. That framework should be attentive to the challenges of over-criminalization, maintaining room for individuals to use the Internet and related technologies to engage in lawful dissent. Such a treaty would serve both international aims and national interests of participating countries.

*****