nach oben

Erschienen in:

2017 | OriginalPaper | Buchkapitel

5. Application of the Law of Armed Conflict, Including International Humanitarian Law, In Cyberspace

verfasst von : Kriangsak Kittichaisaree

Erschienen in: Public International Law of Cyberspace

Verlag: Springer International Publishing

Einloggen

Aktivieren Sie unsere intelligente Suche, um passende Fachinhalte oder Patente zu finden.

search-config

KI-gestützte Suche

Aus

Abstract

During a war or an armed conflict which is not a declared war, the law of armed conflict, including international humanitarian law, regulates the rights and obligations of fighting parties. The same applies to cyberattacks as part of a war or an armed conflict, where the parties concerned must respect not only the rules of permissible means and methods of warfare, but also the principles of proportionality, distinction between civilians and fighters, and military necessity. For example, the law of armed conflict prohibits cyberattacks that could have destroyed dams, power stations, nuclear stations, and other facilities or infrastructures, with excessively devastating consequences. However, a cyber infrastructure is usually a dual use object and it is practically difficult to distinguish between the one used for military purposes and that used for purely civilian purposes. In a cyber interdependent world, cyberattack against a military target may lead to a disproportionate, indiscriminate adverse effect on civilians not taking a direct part in hostilities. Military personnel must, therefore, make a careful, informed decision when planning and carrying out cyberattack during an armed conflict or a war. Non-State actors, cyber warriors, or cyber mercenaries taking a direct part in hostilities to support one or more side in an armed conflict/war may be subjected to attack by the other belligerent under the law of war. Artificial intelligence that makes soldiers wage cyber war against a remote target according to the programmed judgment of the AI presents a frightening challenge with regard to the law of armed conflict.

Sie haben noch keine Lizenz? Dann Informieren Sie sich jetzt über unsere Produkte:

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

über 102.000 Bücher
über 537 Zeitschriften

aus folgenden Fachgebieten:

Automobil + Motoren
Bauwesen + Immobilien
Business IT + Informatik
Elektrotechnik + Elektronik
Energie + Nachhaltigkeit
Finance + Banking
Management + Führung
Marketing + Vertrieb
Maschinenbau + Werkstoffe
Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Jetzt informieren

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

über 67.000 Bücher
über 340 Zeitschriften

aus folgenden Fachgebieten:

Bauwesen + Immobilien
Business IT + Informatik
Finance + Banking
Management + Führung
Marketing + Vertrieb
Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Jetzt informieren

Vorheriges Kapitel Cyber Warfare

Nächstes Kapitel Cyber Espionage

Para. 4 of the Commentary to Art. 2 of the Draft Articles on the Effects of Armed Conflicts on Treaties, ILC Yearbook, 2011, vol. II, part Two. This distinction appears throughout that work of the Commission, including para. 2 of the Commentary to Art. 14 and in the Annex (a) of the indicative list of treaties referred to in Art. 7 of the Draft Articles.

ICRC Advisory Service on International Humanitarian Law, What is International Humanitarian Law? (Geneva: ICRC, Jul. 2004), 1, available at: https://www.icrc.org/eng/assets/files/other/what_is_ihl.pdf.

ICRC, Commentary (2016) to the First Geneva Convention of 1949, para. 25.

Adam Roberts, “The Laws of War: Problems of Implementation in Contemporary Conflicts,” Duke J. Comp. & IL 6 (1995): 11, 14.

ICRC, International humanitarian law and the challenges, 41, 44.

Declaration Renouncing the Use, in Time of War, of Explosive Projectiles Under 400 Grammes Weight, Nov. 29/Dec. 11, 1868, 18 Martens Nouveau Recueil (ser. 1) 474.

Jacob Kellenberger, President, ICRC, “International Humanitarian law and New Weapon Technologies,” keynote address, 34th Roundtable on Current Issues of International Humanitarian law, San Remo, 8–10 Sept. 2011.

ICJ Rep. 1996, p. 226, para. 75.

Convention for the Amelioration of the Condition of the Wounded and Sick in Armed Forces in the Field (GC I); Convention for the Amelioration of the Condition of the Wounded and Sick in Armed Forces at Sea (GC II); Convention relative to the Treatment of Prisoners of War (GC III); and Convention relative to the Protection of Civilian Persons in Time of War (GC IV).

Prosecutor v. Tadic, Case No. IT-94-1-A, ICTY App. Ch. Decision on the Defence Motion for Interlocutory Appeal on Jurisdiction, 2 Oct. 1995, para. 70.

Case No. IT-96-23 and 23/1 (2002), para. 57.

Para. 2 of the Commentary to Rule 21 of the Tallinn Manual.

ICRC, Commentary (2016) to the First Geneva Convention of 1949, paras. 63–66.

Cf. ICRC, “How is the Term ‘Armed Conflict’ Defined in International Humanitarian Law?”, Opinion Paper, Mar. 2008, 2–3.

Cordula Droege, “Get off my cloud: cyber warfare, international humanitarian law, and the protection of civilians,” Int’l Rev. Red Cross 94 (2012): 533, 545–546.

Rule 30 of the Tallinn Manual and the Commentary thereto. See also, Schmitt, “International Law in Cyberspace”, 26.

Rule 30 of the Tallinn Manual. This view is endorsed by Dinstein, The Conduct of Hostilities, 3. See also, Knut Dörmann, “Computer network attack and international humanitarian law”(paper presented at the “Internet and State Security Forum”, 19 May 2001, Trinity College, Cambridge, UK).

Tallinn Manual, para. 10 of the Commentary to Rule 30 – Definition of cyber attack. However, those experts in the said majority were divided whether the “damage” requirement is fulfilled where functionality can be restored by reinstalling the operating system.

Cf. Melzer (Cyberwarfare and International Law, 28–29), who argues that the most difficult unsolved question in this regard is whether “destruction” in the cyber context necessarily presupposes physical damage in the absence of military harm. See also, Carlo Focarelli, “Self-Defence in Cyberspace” in Research Handbook, eds. Tsagourias and Buchan, 255–283.

Para. 12 of the Commentary to Rule 30 of the Tallinn Manual. For a similar view, see, Droege, “Get off my cloud”, 556–561. Droege considers that there is still a gray area whether interference with communications systems such as e-mail systems or the media without more constitutes an attack under the law of armed conflict.

“The law of war imposes limits on cyber attacks too”, interview with Laurent Gisel, legal adviser of the ICRC, on 1 Jul. 2013, available at: https://www.icrc.org/eng/resources/documents/interview/2013/06-27-cyber-warfare-ihl.htm. Gisel explains:

… The ICRC generally agrees with the formulation of the rules [in the Tallinn Manual]; however, there may be exceptions. For example, the rule that recalls the prohibition of belligerent reprisals against a number of specially protected persons and objects does not include cultural property, contrary to the finding of the ICRC’s study on customary IHL. The manual also provides useful commentaries to the rules, including the expression of diverging views among the experts. One example of such divergence concerns the obligation of parties to an armed conflict to take all feasible precautions to protect the civilian population and civilian objects under their control against the effects of cyber attacks: while the manual’s commentary argues that this rule’s scope of application would be limited to international armed conflicts, the ICRC considers the obligation to apply in any type of armed conflict.

See also, Knut Dörmann, “Applicability of the Additional Protocols to Computer Network Attacks” (paper presented at the International Expert Conference on Computer Network Attacks & the Applicability of International Humanitarian Law, Stockholm, 17–19 Nov. 2004), part 2.

ICRC, International humanitarian law and the challenges, 41–42, accompanying footnotes omitted.

Ibid., 43.

Dinniss, Cyber Warfare, 127.

Dörmann, “Applicability of the Additional Protocols”.

Roscini, Cyber Operations, 161–163.

For an analysis on the classification of armed conflict in the context of cyber warfare, see, Louise Arimatsu, “Classifying Cyber Warfare” in Research Handbook, eds. Tsagourias and Buchan, 326–342.

Common Art. 2 of the four Geneva Conventions of 1949.

Prosecutor v. Duško Tadić, Case No. IT-94-1-A, ICTY App. Ch. Judgment of 15 Jul. 1999, para. 84.

Ibid., para. 137.

Prosecutor v. Thomas Lubanga Dyilo, Case No. ICC-01/04–01/06, ICC Trial Ch. I, Judgment, 14 Mar. 2012, para. 541.

Cf. Application of the Convention on the Prevention and Punishment of the Crime of Genocide (Bosnia and Herzegovina v. Serbia and Montenegro), ICJ Rep. 2007, p. 43 at para. 404, and the debate on this point in Shane Darcy, Judges, Law and War: The Juridical Development of International Humanitarian Law (Cambridge: Cambridge University Press, 2012), 90–94; Manuel J. Ventura, “Two Controversies in the Lubanga Trial Judgment of the ICC: The Nature of Co-perpetration’s Common Plan and the Classification of the Armed Conflict” in The War Report 2012, ed. S. Casey-Maslen (Oxford: Oxford University Press, 2013), chap. 13; Thomas R. Lifeländer, “The Lubanga Judgment of the ICC: More Than Just the First Step?,” Cambridge J. Int’l & Comp. L. 1 (2012): 191, 193–198.

ICRC, Commentary (2016) to the First Geneva Convention of 1949, paras. 79–83.

Para. 8 of the Commentary to Rule 22 of the Tallinn Manual, citing Tadic, ICTY App. Ch. Judgment, paras. 132, 137, 141, and 145.

ICRC, Commentary (2016) to the First Geneva Convention of 1949, para. 33.

See, Tilman Rodenhäuser, “Self-Defense Operations Against Armed Groups and the Jus in Bello,” EJIL Talk!, 16 Dec. 2015.

Egan, “International Law”. This also seems to be the US Govt. position in its “global war on terrorism” against Al-Qaeda (see, Geoffrey S. Corn, “Triggering the law of Armed Conflict?” in The War on Terror and the Laws of War: A Military Perspective, 2nd ed., eds. Geoffrey S. Corn et al. (New York: Oxford University Press, 2015), 33, 36–41, 52–64).

Jordan J. Paust, “Operationalizing Use of Drones”, 170 note 7; id., “NIAC Nonsense, the Afghan War, and Combatant Immunity,” Ga. J. Int’l & Comp. L. 44 (2016) (forthcoming).

Para. 72, ICRC’s Commentary (2016) to the First Geneva Convention.

Cf. Tallinn Manual, 195–202, esp. 198, para. 13.

For an analysis of the practical difficulty in applying the principle of distinction in the cyber context, see, Karine Bannelier-Christakis, “Is the Principle of Distinction Still Relevant in Cyberwarfare?” in Research Handbook, eds. Tsagourias and Buchan, 343–365.

Prosecutor v. Galić, Case No. IT-98-29-T, ICTY T. Ch. I Judgment of 5 Dec. 2003, para. 58. For an analysis of the principle of proportionality and the duty to take precautions in cyber warfare, see, Terry D. Gill, “International humanitarian law applied to cyber-warfare: Precautions, proportionality and the notion of ‘attack’ under the humanitarian law of armed conflict” in Research Handbook, eds. Tsagourias and Buchan, 366–379.

They receive protection under, e.g., Arts. 19 and 36 of GC I; Art. 22 of GC II; Art. 18 of GC IV; and Arts. 12, 22, and 24 of AP I.

ICRC, International humanitarian law and the challenges, 43.

ICRC, How Does Law Protect in War? (2012), Glossary.

This is the view of the International Group of Experts who drafted the Tallinn Manual. See, Schmitt, “International Law in Cyberspace”, 28–29.

Andress, Winterfeld and Ablon, Cyber Warfare, 142; Singer and Friedman, Cybersecurity and Cyberwar, 132. One author even asserts that that the Stuxnet malware infected “nearly 100,000 computers, a large share of which were in Iran” (Libicki, Crisis, 34, and cf. ibid., 90–97 on the inadvertent path to mutual escalation in the wake of a cyberattack). See also, Neil C. Rowe, “Distinctive Ethical Challenges of Cyberweapons” in Research Handbook, eds. Tsagourias and Buchan, 307–325. Stuxnet is believed to have been carried on an infected USB stick.

The Tallinn Manual contends, on p. 146, that Stuxnet-like malware does not violate the rule against indiscriminate attack since it only damages specific enemy technical equipment without damaging the civilian systems affected by the malware.

Dinstein, The Conduct of Hostilities, 164–165.

Para. 2 of the Commentary to Rule 58 of the Tallinn Manual.

Cf. paras. 4–10 of the Commentary to Rule 58 of the Tallinn Manual.

Koh, “International Law in Cyberspace”.

Cf. Abdelwahab Biad, “Cyberguerre et lex specialis: évolution ou révolution?” in Société Française pour le Droit International, Colloque de Rouen: Internet et le droit international (Paris: Editions A. Pedone, 2014), 253–264. On the principle of distinction, see, Karine Banelier-Christakis, “Enjeux de la cyberguerre pour la protection des personnes et des biens civils: dur principe de distinction au manuel de Tallinn,” ibid., 277–295. On the principle of proportionality, see, Marco Roscini, “Cyber-opérations et principe de proportionalité en droit international humanitaire,” ibid., 297–307.

Para. 16 of the Commentary to Rule 38 (Civilian objects and military objectives) of the Tallinn Manual. See also Schmitt, “International Law in Cyberspace”, 27. Schmitt explains that “war-fighting” refers to “military equipment, such as military cyber attack systems”, whereas “war-supporting objects are exemplified by a factory that produces war-fighting equipment”, and that “war sustaining generally refers to economic targets, the destruction or neutralization of which would deprive the enemy of funds needed to carry on the war effort effectively” (ibid., note 75).

See also, Agnieszka Jachec-Neale, The Concept of Military Objectives in International Law and Targeting Practice (London/New York: Routledge, 2015), 253–256.

Cf. the Commentary to Rule 39 (Objects used for civilian and military purposes) of the Tallinn Manual. Roscini (Cyber Operations, 285) also finds the concern over the dual use nature of most cyber infrastructure to be overestimated since this is not unique to the cyber context.

Schmitt, “International Law in Cyberspace”, 29–30. Cf. Droege (“Get off my cloud”, 561–566), who is pessimistic about the success of the application of distinction in cyberspace.

ICRC, International humanitarian law and the challenges, 42.

Prosecutor v. Pavle Strugar, Case No. IT-01-41-A, ICTY App. Ch. Judgment (17 Jul. 2008), para. 177 (emphasis added, citations omitted).

ICRC, Customary International Humanitarian Law, Rule 6. Civilians’ Loss of Protection from Attack.

Nils Melzer, Interpretative guidance on the notion of direct participation in hostilities under international humanitarian law (Geneva: ICRC, 2009), 45.

Ibid., 46.

Ibid., 48, footnotes omitted.

Ibid., 74. For some criticisms of the interpretative guidance, see, Crawford, Identifying the Enemy, 82–88.

Harvard Program on Humanitarian Policy and Conflict Research (HPCR), Manual on International Law Applicable to Air and Missile Warfare (Cambridge, MA: Harvard University, 2009), 15–16.

Yaroslav Radziwill, Cyber-Attacks and the Exploitable Imperfections of International Law (Leiden/Boston: Brill, 2015), 210.

Crawford, Identifying the Enemy, 90–91, 145.

Dinstein, The Conduct of Hostilities, 121, 177.

Ibid., 121.

Crawford, Identifying the Enemy, 147–148. The other examples mentioned by Crawford are, in the present author’s opinion, not so clear-cut.

Para. 13 of the Commentary to Rule 26 of the Tallinn Manual.

Radziwill, Cyber-Attacks, 204–206.

James Reinl, “CIA Director hacked by teen spotlights US cyber-frailty”, Aljazeera, 24 Oct. 2015.

Cf. the discussion on this point in Droege, “Get off my cloud”, 566–569.

Melzer, Cyberwarfare and International Law, 34.

“Syria’s Electronic Armies,” Al Jazeera, 18 Jun. 2015, and the accompanying 25-min documentary.

Art. 29, Hague Regulations Respecting the Laws and Custom of War on Land, reads:

A person can only be considered a spy when, acting clandestinely or on false pretences, he obtains or endeavours to obtain information in the zone of operations of a belligerent, with the intention of communicating it to the hostile party. Thus, soldiers not wearing a disguise who have penetrated into the zone of operations of the hostile army, for the purpose of obtaining information, are not considered spies. Similarly, the following are not considered spies: soldiers and civilians, carrying out their mission openly, entrusted with the delivery of despatches intended either for their own army or for the enemy’s army. …

See also, Art. 4A of the Geneva Convention III and Art. 43(2) of AP I on the class of persons entitled to combatant status and ensuing privileges.

See, Vitaly Shevchenko, “Ukraine conflict: Hackers take sides in virtual war,” BBC, 20 Dec. 2014.

Lin, “Cyber conflict”, 526–527.

Para. 2 of the Commentary to Rule 28 of the Tallinn Manual.

Jean-Marie Henckaerts and Louise Doswald-Beck, eds., Customary International Humanitarian Law. I: Rules (Cambridge: Cambridge University Press, 2005), 391. Contra: Marina Mancini, Faustin Z. Ntoubandi, and Thilo Marauhn, “Old Concepts and New Challenges?: Are Private Contractors the Mercenaries of the Twenty-first Century?,” in War by Contract: Human Rights, Humanitarian Law, and Private Contractors, eds. Francesco Francioni and Natalino Ronzitti (Oxford: Oxford University Press, 2011), chap. 16, esp. 327–340.

UN Doc. A/RES/44/34 (4 Dec. 1989).

Art. 4A(6) of GC III.

Melzer, Cyberwarfare and Internaional Law, 34. For a contrary view see, Roscini, Cyber Operations, 212.

Radziwill, Cyber-Attacks, 208.

Rules 70–73 of the Tallinn Manual and the various provisions of the Geneva Conventions and Additional Protocols cited therein.

Special Court for Sierra Leone, Prosecutor v. Sesay, Kallon and Gbao, Case No. SCSL-04-15-T, T. Ch. I Judgment, 2 Mar. 2009, paras. 233–234. See further, Rule 74 of the Tallinn Manual.

See, e.g., US Air Force Pamphlet (1976); US Naval Handbook (2007).

Dörmann, “Computer network attack”.

Libicki, Crisis, 30.

Para. 10 of the Commentary to Rule 58 of the Tallinn Manual.

Art. 38, AP I proscribes the improper use of the distinctive emblem of the red cross, red crescent or red lion and sun or of other emblems, signs or signals provided for by the 1949 Geneva Conventions or by AP I. It also prohibits the deliberate misuse in an armed conflict other internationally recognized protective emblems, signs or signals, including the flag of truce, and the protective emblem of cultural property. Moreover, it prohibits the use of the distinctive emblem of the UN, except as authorized by the UN itself.

Melzer, Cyberwarfare and International Law, 33.

Matthew J. Greer, “Redefining Perfidy,” Georgetown JIL 47 (2015): 241, 266–277, esp. 267. Dinstein (The Conduct of Hostilities, 269) also considers that the application of the traditional rule of perfidy may become problematic in the context of cyber warfare. For a similar view see, Radziwill, Cyber-Attacks, 215–216.

Art. 64 of GC IV.

Para. 5 of the Commentary to Rule 88 and para. 3 of the Commentary to Rule 89 of the Tallinn Manual.

Art. 50 of GC I, Art. 51 of GC II, Art. 130 of GC III, and Art. 147 of GC IV.

Tadic, ICTY App. Ch. Decision on the Defence Motion for Interlocutory Appeal on Jurisdiction, para. 126.

Ibid., para. 127.

ICRC, Opinion Paper, Mar. 2008, at 5; ICRC, Commentary (2016) to the First Geneva Convention of 1949, paras. 386–387, 421–435, 438–444. However, since the four Geneva Conventions of 1949 have universally been ratified, the requirement that the armed conflict must occur “in the territory of one of the High Contracting Parties” has lost its importance in practice (ibid., 3).

Tadic, ICTY App. Ch. Decision on the Defence Motion for Interlocutory Appeal on Jurisdiction (2 Oct. 1995), para. 70; Prosecutor v. Limaj, Case No. IT-03-66-T, T. Ch. II Judgment (30 Nov. 2005), paras. 135–170; Prosecutor v. Haradinaj, Case No. Case No. IT-04-84-T, ICTY T. Ch. I Judgment (3 Apr. 2008), para. 49; Prosecutor v. Boškoski & Tarčulovski, Case No. IT-04-82-T, ICTY T. Ch. II Judgment (10 Jul. 2008), paras. 175–178. See also, Droege, “Get off my cloud”, 551.

ICRC, Opinion Paper, Mar. 2008, at 3; and cf. ICRC, Commentary (2016) to the First Geneva Convention of 1949, paras. 443–444.

Michael N. Schmitt, “Classification of cyber conflict,” J. Conflict & Security L. 17 (2012): 245, 256.

Cf. para. 15 of the Commentary to Rule 23, Tallinn Manual.

100

Para. 3 of the Commentary to Rule 31, Tallinn Manual.

101

This is the definition adopted in para. 4 of the Commentary to Rule 29, Tallinn Manual.

102

See, Art. 13(3), AP II.

103

Para. 20 of the Commentary to Rule 26, Tallinn Manual.

104

Egan, “International Law”.

105

Prosecutor v. Stanislav Galić, Case No. IT-98-29-T, ICTY T. Ch. I Judgment of 5 Dec. 2003, paras. 113–129.

106

Ibid., paras. 69–109. For an analysis that cyberattacks could be war crimes, see, Kai Ambos, “International Criminal Responsibility in Cyberspace” in Research Handbook, eds. Tsagourias and Buchan, 118 at 121–137, 142–143.

107

Prosecutor v. Dragomir Milošević, Case No. IT-98-29/1-A, ICTY App. Ch. Judgment of 12 Nov. 2009, paras. 32, 33, 37.

108

Ljube Boškoski and Johan Tarčulovski, Case No. IT-04-82-T, ICTY, T. Ch. II Judgment of 10 Jul. 2008, paras. 175–205, esp. at paras. 176, 190–192, 205.

109

Rome Statute of the International Criminal Court of 1998, Arts. 12–14 (jurisdiction) and Art. 8 (war crimes).

110

Kellenberger, “International Humanitarian law and New Weapon Technologies”; statement of Richard Desgange, Regional Legal Advisor, ICRC, Beijing, at the Half-Day Special Meeting on “International law in Cyberspace”, 54th Annual Session of the Asian-African Legal Consultative Organization (AALCO), Apr. 2015.

111

Haley Sweetland Edwards and Matt Vella, “A shocking Internet attack shows America’s vulnerability”, Time, 7 Nov. 2016, 5–6; “‘Smart’ home devices used as weapons in website attack”, BBC, 22 Oct. 2016; Samuel Burke, “Chinese firm acknowledges inadvertent role in cyberattack”, CNN, 23 Oct. 2016. See also, Stephen Pritchard, “Humble lightbulbs could become a form of attack,” Financial Times: Special Rep. on Cyber Security, 16 Mar. 2016, 2; Tom Chatfield, “IT has fast become antiquated to say that you ‘go online’,” BBC, 28 Mar. 2016. In early November 2016, the Mirai virus was used to cut Internet access in Liberia by attacking Liberia’s connection to the global Internet network (“Hack attacks cut internet access in Liberia”, BBC, 4 Nov. 2016).

112

Lambèr Royakkers and Rinie van Est, “The crucible warrior: the marionette of digitalized warfare”, Ethics Inf. Technol. 12 (2010): 289.

113

In re Ohlendorf & Others, US Military Trib., Nuremberg, 10 Apr. 1948 (1953) 15 Ann. Dig. 566, 665–-666.

Titel: Application of the Law of Armed Conflict, Including International Humanitarian Law, In Cyberspace
verfasst von: Kriangsak Kittichaisaree
Verlag: Springer International Publishing
Buch: Public International Law of Cyberspace
Print ISBN: 978-3-319-54656-8

Electronic ISBN: 978-3-319-54657-5

Copyright-Jahr: 2017
DOI: https://doi.org/10.1007/978-3-319-54657-5_5