Cyber and information operations and international humanitarian law
Societies are becoming increasingly digitalized and interconnected. In times of armed conflict, this has an impact on people’s needs, and on the risks and threats they might face.
Today, the use of cyber operations by State and non-State actors are a reality of armed conflict. While only a few states have publicly acknowledged using such operations, an increasing number of states are developing military cyber capabilities. Cyber operations are likely to increase in future.
The international community recognizes that, just as any other means or method of warfare, cyber operations may cause harm to the civilian population and other protected persons and objects, including across international borders, and may cause devastating humanitarian consequences.
There is a real risk that cyber tools – either deliberately or by mistake – will have significant, broad effects on critical civilian infrastructure, such as essential industries, telecommunications and transport, governmental, and financial systems.
Cyber operations carried out over recent years – primarily outside armed conflicts – have shown that malware can spread instantly around the globe and affect civilian infrastructure and essential services.
Today, technological developments that allow the instantaneous transmission of information from any distance through digital means, including via social media platforms and messaging apps, have changed the scale, speed, and reach of misleading, inaccurate, hateful or otherwise harmful information.
Harmful information (including when spread through information operations) is recognized as, among others, having the potential to contribute to or incite violence against people, cause lasting psychological harm, undermine access to essential services, and disrupt the operations of humanitarian actors.
The increasing use of military cyber capabilities and the related humanitarian concerns underscore how important it is to reach a shared understanding of the legal constraints that apply to cyber operations and harmful information during armed conflicts.
The principal body of law that governs the use of cyber and information operations in war is international humanitarian law (IHL). States have codified its rules in such ways that they apply – in the words of the International Court of Justice – to all forms of warfare and to all kinds of weapons, including those of the future.
The basic rules on cyber operations and harmful information are straightforward: targeting civilians and civilian objects is forbidden; indiscriminate weapons must not be used; indiscriminate and disproportionate attacks are prohibited; States and parties to conflict must not encourage violations of IHL; medical services must be respected and protected. These and many other rules also apply in cyberspace.
Other questions still need of further clarification. These include, for instance, whether civilian data enjoy the same protection as civilian objects, and whether cyber operations that disrupt systems without causing physical damage amount to attacks as defined under humanitarian law.
We welcome the increasing international attention to cyber operations’ potential human cost and applicable international law. Societies are rapidly digitizing. It is critical that humanitarian law be interpreted and applied in a way that protects not just physical objects but the digital infrastructure that people rely on in every aspect of their lives.
