The ICRC calls on all States to affirm that IHL applies to, and therefore restricts, cyber operations during armed conflicts

Excellencies, ladies and gentlemen,

The International Committee of the Red Cross is grateful for the opportunity to address the Group of Governmental Experts before their fourth and final meeting.

Over the past two years, intergovernmental discussions about risks and rules in cyberspace have made remarkable progress. Today, the international community recognizes that ‘a [significant number] of States are developing ICT capabilities for military purposes’ and that ‘the use of ICTs in future conflicts between States is becoming more likely’.[1] States also share the understanding that cyber operations against critical infrastructure risk having ‘potentially devastating humanitarian consequences’.[2] Such risks to humans are acute at all times. Our experience shows, however, that disrupting critical civilian infrastructure has particularly severe consequences in societies that are already weakened by armed conflict.

Excellencies,

The ICRC is mandated ‘to work for the faithful application of international humanitarian law applicable in armed conflicts’.[3] In line with this mandate, we are calling on all States to affirm that IHL applies to, and therefore restricts, cyber operations during armed conflicts. Such affirmation should not be construed as encouraging the militarization of cyberspace or as legitimizing cyber operations that are conducted in violation of other rules of international law, most importantly the Charter of the United Nations.

The ICRC encourages the GGE to make this affirmation collectively, and we also hope that States will consider IHL if they submit national contributions to the GGE report.

We do so for humanitarian and legal reasons.

Let me illustrate the humanitarian concern with the following example: If an electricity network is attacked during an armed conflict, there can be no difference in the lawfulness of such attacks solely based on the means or methods of warfare that are used, be they kinetic or cyber. For the civilian population, it does not matter how electricity supply is disabled – the humanitarian consequences are what matters.

And legally, the International Court of Justice held that excluding certain means or methods of warfare during armed conflict from the scope of application of the established principles and rules of humanitarian law would ‘be incompatible with the intrinsically humanitarian character of the legal principles in question which permeates the entire law of armed conflict’.[4] International humanitarian law does not allow for the conclusion that it only regulates some means and methods or warfare but not others. At a time when technology is evolving at great speed, the international community should not accept that there could be means or methods of warfare relying on new technologies that would escape legal limits.

The ICRC has repeatedly stated that affirming the applicability of IHL to cyber operations conducted during armed conflict – and only to those – is not more than a first step. Further discussion is needed on how the rules and principles of IHL apply to cyber operations, including the principles of humanity, necessity, proportionality and distinction, which were described as ‘established international legal principles’ in the 2015 GGE report. Such discussions have to be approached with prudence – but they are also necessary. IHL principles and rules need to be understood and interpreted, and potentially further strengthened or adapted, taking into account the specific characteristics of the ICT environment. For example, in an increasingly data-driven world, it should be a priority for States to agree that civilian data enjoys protection against attack, just as civilian paper files do. If new rules are to be developed, they should build on and strengthen the existing legal framework.

To conclude, the international community should not stop at recognizing the likelihood that ICT capabilities will be used in armed conflicts and cause humanitarian consequences. The ICRC encourages the present GGE to go one step further, build on the existing acquis and strengthen the shared understanding of how international law, including international humanitarian law, limits the humanitarian consequences of the use of ICT capabilities during armed conflict.

Thank you.