124
conduct of hostilities
5. A violation of Rule 36 requires an intent to spread terror amongst the population. The International Group of Experts agreed that terrifying one or only a few individuals, even if that is the primary purpose of the act or threat, does not suffice, although engaging in an act of violence against one person in order to terrorize a significant segment of the population would violate this Rule.75 Consensus also existed that this Rule does not prohibit conducting attacks against enemy combatants in order to terrorize them. 6. The text of Rule 36 only extends to conducting or threatening cyber terror attacks. However, employing cyber means to communicate a threat of kinetic attack with the primary purpose of terrorizing the civilian population is likewise prohibited by the law of armed conflict. 7. It should be noted that Article 33 of Geneva Convention IV prohibits ‘measures of intimidation or of terrorism’. Unlike the norm set forth in Article 51(2) of Additional Protocol I, which is reflected in this Rule, the Article 33 prohibition is not limited to attacks that have a primary purpose of terrorizing those individuals. However, it extends only to protected persons as defined in Article 4 of that treaty. A minority of the International Group of Experts took the position that the confluence of Article 33, Article 51(2), and State practice has resulted in a customary norm prohibiting any operations, including cyber operations, intended (whether the primary purpose or not) to terrorize the civilian population.
SECTION 4:
ATTACKS AGAINST OBJECTS
Rule 37 – Prohibition on attacking civilian objects Civilian objects shall not be made the object of cyber attacks. Computers, computer networks, and cyber infrastructure may be made the object of attack if they are military objectives. 1. The prohibition on attacking civilian objects derives historically from the 1868 St Petersburg Declaration, which provided that ‘the only legitimate object which States should endeavour to accomplish during war is to weaken the military forces of the enemy’.76 This norm has since been codified in 75 76
Galić Trial Chamber judgment, para. 133. St Petersburg Declaration, preamble. See also Hague Regulations, Art. 25 (noting ‘attack or bombardment … of towns, villages, dwellings, or buildings which are undefended is prohibited’).