Wired warfare 3.0: Protecting the civilian population during cyber operations

Abstract

As a general matter, international humanitarian law is up to the task of providing the legal framework for cyber operations during an armed conflict. However, two debates persist in this regard, the resolution of which will determine the precise degree of protection the civilian population will enjoy during cyber operations. The first revolves around the meaning of the term “attack” in various conduct of hostilities rules, while the second addresses the issue of whether data may be considered an object such that operations destroying or altering it are subject to the prohibition on attacking civilian objects and that their effects need be considered when considering proportionality and the taking of precautions in attack. Even if these debates were to be resolved, the civilian population would still face risks from the unique capabilities of cyber operations. This article proposes two policies that parties to a conflict should consider adopting in order to ameliorate such risks. They are both based on the premise that military operations must reflect a balance between military concerns and the interest of States in prevailing in the conflict.

"International Crime": Different Approaches To The Question Of The Concept Definition

“…In current conditions, the complications of international relations and scientific and technological progress, computer network attacks committed against critical infrastructure facilities of other states are becoming a reality. These determine both the development of international information security law (Biller, 2018;Macak, 2017;Schmitt, 2019) and the transformation of national military doctrines (Finlay & Payne, 2019).…”

Protection of (Personal) Data in Armed Conflicts

“…51 The Tallinn Manual states that cyber-attacks -which are not to be confused with hacker attacks in everyday language or with armed attacks under jus ad bellum -are cyber operations causing injury or death to persons and damage to or destruction of objects. 52 The International Group of Experts drafting the Tallinn Manual pointed out that the act of violence referred to in Additional Protocol I does not apply only in a kinetic sense -it is sufficient to refer here to attacks conducted by chemical or biological weapons -but rather the decisive factor of identifying an operation as an 'attack' is the damage it caused. 53 Regarding electronic data, there was an understanding among experts that operations against data could only qualify as an attack if they were likely to cause results as described above (e.g.…”