From Hackers to Tech Companies: IHL and the involvement of civilians in ICT activities in armed conflict

“Excellencies, ladies and gentlemen, dear colleagues, 

It is my pleasure to join Ambassador Lendenmann in welcoming you to today’s event on ‘International Humanitarian Law and the Involvement of Civilians in ICT Activities in Armed Conflict’. I greatly appreciate this opportunity to present an in-depth report on this critical issue, which the ICRC drafted in partnership with the Geneva Academy of International Humanitarian Law and Human Rights.  

Let me sincerely thank the Academy for such a timely and topical research cooperation on the digitalization of armed conflicts. I would also like to thank Switzerland for its generous support. Such partnerships allow us to bring together leading academic experts from all parts of the world to explore some of the biggest looming challenges that we see in contemporary warfare.

One of these challenges is the growing civilian involvement in armed conflict.

This phenomenon has multiple dimensions, many of them are not so new. For example, in many conflicts around the world, we have seen self-defense forces taking up arms to defend their villages or communities.

We have also observed States actively preparing not only their militaries but also their wider societies to defend their nations in future wars. As part of such conflict preparedness, we hear considerations of how to mobilize civilian populations, and civilian infrastructure, as part of the wider military defense effort.

At the ICRC, we have been concerned about the risks that arise from involving civilians in military operations and losing the protection they are entitled to under international humanitarian law. Today, this trend is accelerating with the world’s digitalization, which makes it easier for large numbers of civilians to take part in armed conflict.

Against this backdrop, our legal experts will focus today on three specific issues.

The first one is the risk that arises when civilians are drawn ever closer to hostilities.

Today, smartphones are omnipresent in our lives, and people are almost constantly connected. In armed conflict, civilians use their phone to warn friends and family of hostilities, or simply to stay in contact with their loved ones. However, civilians are also asked by parties to armed conflicts to collect militarily-relevant information, through messaging apps or through purpose-made applications.

Collecting and sharing information with armed forces entails significant risks that are not always well-understood. For years, and in different parts of the world, the ICRC has documented reports about civilians being killed or arrested for being seen with their phones close to hostilities, or for having pictures of military equipment on their phones.

We therefore call on parties to armed conflict to avoid, as much as possible, involving civilians in such activities that put them at risk. And if parties nonetheless decide to do so, they should clearly warn civilians of the risks that this entails, namely that they could lose protection against attack, and inform them of measures they may take to protect themselves.

The second trend that contributes to growing civilian involvement in digitalizing armed conflicts are civilian hackers, or hacktivists.

Concretely, in recent armed conflicts, cyber threat analysts have documented dozens of hacker groups conducting cyber operations to support one side of the conflict in Europe, Asia, the Middle East and Africa.

In many cases, these groups target civilian parts of societies – such as banks, communication and energy infrastructure, and medical facilities. They appear unaware of, or simply disregard the most fundamental principles of the laws of armed conflict: protecting essential civilian objects from the consequences of war.

There is significant work ahead of us to ensure that if civilians conduct cyber operations in the context of armed conflicts, they must be aware of their obligations and respect international humanitarian law. Importantly, none of these hackers live in cyberspace – they all operate on the territory of States, which have the primary responsibility to make IHL known and take the measures necessary to suppress IHL violations.

The third element of civilian involvement in armed conflict is the role of tech companies.

Around the world, governments increasingly rely on the private tech sector to provide digital infrastructure and services. This can have serious consequences in times of war. When civilian tech companies enter into commercial relationships with armed forces, they may not be aware that if an armed conflict erupts, each of these services – cyber security, communication infrastructure, or cloud storage for armed forces – can, depending on the circumstances, raise important issues related to the protection of their assets and staff.

For the past years, the ICRC has engaged in a dialogue with tech companies to sensitize them of these risks, and to provide concrete recommendations on how they might mitigate them. If tech companies provide digital services to parties to armed conflicts, they must be aware of relevant risks, understand the consequences, and familiarize themselves with IHL.

Excellencies, ladies and gentlemen,

The growing involvement of civilians in digitalizing armed conflicts raises serious risks for civilian populations.

Over the past years, together with the Geneva Academy, we have conducted in-depth research and consulted legal experts from all regions of the world on this issue.  Today, our legal experts will present and discuss key findings, hopefully sparking not only further debate and research, but also resolute action. Understanding the risks, and understanding the limits that IHL imposes on civilians when taking part in armed conflict, are a first – and essential – step to prevent harm to civilian populations.

I thank you for your active participation and wish you a productive event.”