250
neutrality
Rule 91 – Protection of neutral cyber infrastructure The exercise of belligerent rights by cyber means directed against neutral cyber infrastructure is prohibited. 1. It is a well-established principle of the law of neutrality that parties to the conflict are prohibited from conducting hostilities within neutral territory. The inviolability of neutral territory is laid down in Article 1 of Hague Convention V and Article 1 of Hague Convention XIII. The norm is customary in character.5 2. Neutral cyber infrastructure physically located in international airspace, outer space, or high seas areas is protected by virtue of the State of nationality’s sovereignty. 3. The term ‘directed against’ refers to an operation intended to detrimentally affect neutral cyber infrastructure. As to operations passing through such infrastructure or employing it for operations against the enemy, see Rule 92. 4. The International Group of Experts struggled with the situation in which a cyber attack against a military objective in belligerent territory has spill-over effects in neutral territory. For example, a cyber attack on a server in belligerent territory could significantly affect services in neutral territory. The Experts agreed that if such effects are not foreseeable, the attack does not violate the law of neutrality. As to effects that are foreseeable, the Group of Experts noted that the law of neutrality seeks to balance the right of belligerents to effectively conduct military operations with the right of neutral States to remain generally unaffected by the conflict. Each case must be assessed on its own merits by balancing these competing rights. The Experts agreed that the effects on the neutral State to be considered in making this assessment are not limited to physical effects. They also agreed that in practice, States would be unlikely to regard de minimis effects as precluding the prosecution of an otherwise legitimate attack. 5. It is important to note that neutral cyber infrastructure located in neutral territory may lose its protection under Rule 94. Moreover, neutral cyber infrastructure located outside neutral territory, such as undersea cables, may be attacked if it constitutes a lawful military objective. It may also be subject to capture.
5
US Commander’s Handbook, para. 7.3; UK Manual, para. 1.43; German Manual, paras. 1108, 1118, 1149; San Remo Manual, para. 15; Hague Air Warfare Rules, Arts. 39, 40.