precautions
171
attack on which may be expected to cause the least danger to civilian lives and to civilian objects. 1. This Rule is based on Article 57(3) of Additional Protocol I. A substantial majority of the International Group of Experts agreed that this Rule reflects customary international law and is applicable in international and non-international armed conflicts.191 However, a minority of the Experts took the position that Article 57(3) had not matured into customary international law and therefore this Rule is not binding on States that are not Party to that instrument. 2. Rule 56 applies to cyber operations that qualify as an ‘attack’. The term attack is defined in Rule 30. 3. In contrast to the other sub-paragraphs of Article 57, Article 57(3) does not specify to whom it is directed. Therefore, Rule 56 has been drafted to apply to all persons who are involved in target selection, approval, and execution of the attack. 4. Based upon the text of Article 57(3), the International Group of Experts understood the consequences of the danger referred to in this Rule as limited to injury, death, damage, or destruction by the direct or indirect effects of a cyber attack. Damage would, for the majority of the International Group of Experts, include, in certain circumstances, deprivation of functionality (Rule 30). 5. Whether a choice is possible is a question of fact to be determined in the circumstances ruling at the time. For the Rule to apply the options must be more than mere possibilities; they must be reasonable with regard to such factors as practicality, military viability, and technological prospect of success. 6. It must be borne in mind that the Rule only applies in the case of targets the attack upon which will yield similar military advantage. The military advantage does not have to be identical qualitatively or quantitatively. Instead, the issue is whether an attack on the alternative target would achieve comparable military effects.192 7. The military advantage is to be determined in light of the operation as a whole and not based solely on that accruing from an individual attack. Thus, even if the alternative attack is likely to occasion less
191
192
UK Manual, para. 5.32 (as amended); Canadian Manual, para. 716; German Manual, para. 457; AMW Manual, Rule 33, chapeau to sec. G; NIAC Manual, para. 2.1.2d; ICRC Customary IHL Study, Rule 21. AMW Manual, commentary accompanying Rule 33.