Technology and the Law of War

by

Abstract

To what extent does the law of war apply to cyberspace? It is a question that legal experts, governments, and military commanders have been asking for some time. There are various treaties, charters, and conventions that address the question. This however has not ended the uncertainty about the legal and ethical limits of online activities that can have disastrous consequences on state infrastructure and can even be seen as a direct “attack”. [The widespread use of the word attack outside the meaning given it by the UN Charter is another article in and of itself!]

This article considers a new issue that has recently developed. It comes in the form of individuals participating in cyber-attacks against one state on behalf of, or at the request of, another state when these two states are at war. These unpaid, anonymous, cyber-mercenaries can play active roles in the theatre of war, whether in offence or defence. And the consequences of such activities pose serious questions; particularly in relation to state vs individual liability for those acts.

Introduction

“[Cyber]Warfare doesn’t exist in a legal vacuum”1. Like any weapon used in armed conflict, cyber weapons (or offensive cyber operations), are subject to the laws of armed conflict. Outside of armed conflict cybercrime exists. There is a grey area and it is where persons who are not combatants use cyber offensive tools or operations as a weapon. This article examines the structure of the law of war in the context of cyber and uses the Russian-Ukraine conflict as a case study.

Case Study

On 24 Feb 2022 Russia commenced armed aggression, termed an international armed conflict or ‘war’ against Ukraine. It followed on from 8 years of disputes between the two nations and arguably it has involved use of non-kinetic weapons including cyber and information operations for most if not all of that period of time. “Without question, an international armed conflict is underway between Russia and Ukraine based on Russia’s occupation of Ukrainian territory.”2

It is beyond the scope of this article to discuss the disparity between the West and the East as regards use of the media (in its broadest sense, to include social media and associated platforms) however when we talk about information and influence operations/war it is critical to understand that the English based platforms are not the sole domain and in all probability may not even be the relevant domain when talking about an armed conflict such as this where both parties are non-English speaking countries. Accordingly having one side or the other claim dominance in the ‘information war’ is unhelpful without a proper mechanism to compare the newspapers, social media sites and general internet propaganda of languages other than English (Baltic languages, Russian, Ukrainian, Indian and so forth):

“It has become commonplace for commentators on Russia’s war in Ukraine to assert that Ukraine is winning the information war…However, Carl Miller, research director of the Centre for the Analysis of Social Media at UK think tank Demos, cautions that while this might be true for Western and Englishlanguage information spaces, it’s probably not true outside the West. Miller says that the wall-to-wall pro-Ukraine sympathy that Western audiences are seeing on social media shouldn’t engender complacency.

‘In fact, it might be blinding us to where the information war is really happening. It could mean that the West is not the battleground over which the information war is currently being fought.’” 3

The nature of the cyber actions taken against Russia and the effect of these actions are areas that bear further examination for this case study.

Cyber hacktivism against Russia by proUkraine supporters external to Ukraine

According to the West there were ‘hacktivists’ from across the world, including the group identifying themselves as ‘Anonymous’4 who applied themselves to the task of weakening aspects of Russia’s government, military, and other targets. Reporting at the time indicated that these hacktivists were answering a call over the social media platform Twitter by Ukraine for assistance.5

What law applies

For the present purposes we accept that Russia’s actions against the Ukraine constituted a use of force which rose to the level of an armed attack and that the laws of war apply 6

Collective self defence

In a situation where one state calls for assistance from another state or states for the use of force in self-defence it is called collective self-defence. That is to say Ukraine calls on other nation states to assist it. The tweet sent out above was sent indiscriminately to individuals and state bodies7. Arguably any resulting actions taken by other states meets the definition of collective self-defence (though there are additional requirements) but when it comes to the action of individuals (who are not combatants) the questions to consider are whether a state can adopt the actions of an individual or group as being those of the state and if not whether the failure of any given state to prevent the hacktivist individual or group cyber ‘crimes’ means that state has waived its right to claim neutrality. The cyber events/operations which are the result of individual hacktivists or ‘vigilantes’ – persons or groups operating without any state endorsement are criminal or terrorist acts (where there is no alternative mandate eg UN endorsed measures).

We know from the 2021 report of the UN Group of Governmental Experts on Advancing Responsible State Behaviour in Cyberspace in the Context of International Security that international law and specifically the Charter of the United Nations are both applicable and essential in cyberspace8

Article 2(4) of the UN Charter sets out that states are to refrain from the threat or use of force against the territorial integrity or political independence of any state.9

And in Article 51 States are given the ability to respond to an armed attack with individual or collective self-defence.

This means Ukraine, as a state, may respond with reasonable measures to the attack(s) by Russia: “the proper law of self-defense

[sic] question would be whether a Ukrainian response that otherwise would be unlawful is “necessary” and “proportionate” when considered in the context of its overall right of self-defense against the ongoing Russian armed attack (on those criteria, see Tallinn Manual 2.0, Rule 72)”10. Such measures are not limited to either kinetic or non-kinetic and may properly involve both.

The laws of armed conflict or laws of war (part of that body of international law termed international humanitarian law comprising the Geneva Conventions11, Additional Protocols12 and related case law13) set out how actions may be made or reacted to by Ukraine and Russia during a state of armed conflict. While the means and methods of warfare are not unlimited, cyber operations14 taken by either state are lawful provided they are reasonable, proportionate, distinct (aimed at combatants) and do not cause unnecessary suffering. Do the people who make up the ‘IT army’ Ukraine’s Minister of Digital Transformation was attempting to raise 15 meet the definition of combatants, and if they do not what status do they have at law. More generally we might ask what is a cyber combatant? Do they wear uniform and have all the standard indicia of ‘kinetic’ combatants? “Combat, Clausewitz says, ‘is not a contest between individuals’ but between soldiers who are ‘recruited, clothed, armed and trained’ to be able to ‘fight at the right place and the right time’.” 16

Effects of cyber operations

The nature of cyber weapons, for example a constructed computer virus, are such that they have the propensity to replicate and spread beyond the theatre of war and beyond the intended target(s) thereby contravening requirements such as distinction and prevention of unnecessary suffering which apply during armed conflict under IHL. This is not novel in the sense that chemical biological weapons (viruses) can also escape and cause harm beyond that intended: which is why they were banned after WWI17. Indeed not just the effects of weapons but warfare is in and of itself unpredictable: “The unforeseen consequences are usually more long-term than the intended outcomes and work in ways that counteract the original reasons for going to war.”18 The novelty with cyber weapons and cyberwar lies in the multitude of ways in which civil population(s) are now dependent upon technology and the therefore immediately disproportionate harm that may be brought to them by the use and then escape or distortion of cyber weapons (eg NotPetya19).

Direct participation in hostilities by civilians

“Under International Humanitarian Law [“IHL”], the concept of direct participation in hostilities refers to conduct which, if carried out by civilians, suspends their protection against the dangers arising from military operations. Most notably, for the duration of their direct participation in hostilities, civilians may be directly attacked as if they were combatants.”20

If not war then crime: the crime of hactivism

The international legal landscape specific to policing cyber activities which do not meet the level of participation in an armed conflict range from internal state criminal laws (enacted by each country unilaterally and can be enforceable internationally with assistance from other states/interpol) to those which are unlawful based upon other applicable international agreements. As already discussed, the United Nations Charter applies to cyber as do the laws of war. For international agreements relating to cybercrime a state which is a party to the agreement that fails to internally enforce the law against actors accused of cybercrime may be subject to prosecution themselves at the International Criminal Court or the International Court of Justice – however those jurisdictions are voluntary and the case will need to prove that the cybercriminal is under the jurisdiction of that state and/or that the alleged cybercrime originated from the state in question. Which leads to the question of attribution.

Attribution

No discussion of cyber operations, be they war like or criminal, can be had without reference to the challenges of attribution in today’s cyber environment. In armed conflict and in general attribution is the act of determining by whom an action was made. In the kinetic world a missile or bomb may be traced. In the cyber world it is a bit more convoluted and the speed required in military operations may preclude absolute certainty in the art of attribution21. Adversaries and criminals may hide their location, may engineer their Internet Protocol addresses and use a variety of tools that keep their identity, location, and even tools hidden. When a state is relying upon the UN Charter for the legal authority in order to ‘respond with reasonable measures’ it is critical to be able to point to who was responsible before responding. It is nonsense to contend that measures were reasonable if they were in fact misdirected (ie proportionately aimed at entirely the wrong state/person). In cyber warfare the importance of accurate and timely attribution cannot be understated: a mistake may increase the type, breadth and severity of hostilities.

A further complication of attribution (or mis- attribution) is where the individual/non-state actor/criminal/terrorist actions are mistaken for those of a state and has the unintended effect of escalating the conflict because the targeted state ascribes the cyber operations as being by, or sanctioned by, the state.

Conclusion

Civilians or non-combatants must think deeply about the political, legal and operational consequences before taking up arms during armed conflict. Even where the cause is just. Even where the arms are a keyboard. The outcome of their individual involvement may be to make their own country (state) a party to the conflict. It may mean their own country (state) prosecutes them under domestic law for cybercrime. Attribution is fuzzy but not fuzzy enough to assume safety in the cloak of cyber.

A state under attack may invite the individuals of other states to participate in hostilities (remotely or in person) but must do so alive to the consequent application of international humanitarian law to those individuals and their home.

Endnotes

1 Lovett, E. 2015, “The Law of Armed Conflict as it applies to CyberSpace”, Cyberpoint Speaker Series, Baltimore Maryland, 26 August 2015, https://youtu.be/sAaIIk7VecI [accessed on 6 June 2022]

2 Schmidt, M. 2022, “Russian cyber operations and Ukraine: the legal framework”, , Articles of War, Lieber Institute, West Point, 16 January 2022, https://lieber.westpoint.edu/russiancyber-operations-ukraine-legal-framework/ [accessed on 5 June 2022]

3 Kapetas, A. 2022, “Russia may be winning the Ukraine information war outside the West”, The Strategist, Australian Strategic Policy Institute, 8 April 2022, https://www. aspistrategist.org.au/russia-may-be-winning-the-ukraineinformation-war-outside-the-west/ [accessed on 15 May 2022]

4 Wikipedia contributors, 2022, “Anonymous (hacker group),”Wikipedia, The Free Encyclopedia, https:// en.wikipedia.org/w/index.php?title=Anonymous_(hacker_ group)&oldid=1091501907 [accessed 6 June 2022]

5 We are creating an IT army. We need digital talents. All operational tasks will be given here: https://t.me/ itarmyofurraine. There will be tasks for everyone. We continue to fight on the cyber front. The first task is on the channel for cyber specialists.” Per Ukraine’s Minister of Digital Transformation, Mykhailo Fedorov as quoted in Väljataga, A, ‘Cyber vigilantism in support of Ukraine: a legal analysis’, CCDOE, March 2022, https://ccdcoe.org/uploads/2022/04/ Cyber-vigilantism-in-support-of-Ukraine-pub.pdf [accessed on 5 June 2022]

6 Supra 2

7 Supra 5

8 United Nations General Assembly, 2021, Group of Governmental Experts on Advancing Responsible State Behaviour in Cyberspace in the Context of International Security, 14 July 2021, Chapter IV, p17 https://documentsdds-ny.un.org/doc/UNDOC/GEN/N21/075/86/PDF/N2107586. pdf?OpenElement [accessed on 23 May 22]

9 United Nations Charter, 24 October 1945, https://www. un.org/en/about-us/un-charter/full-text [accessed on 6 June 2022]

10 Supra 2

11 International Committee of the Red Cross, Geneva Conventions and their Commentaries, https://www.icrc.org/ en/war-and-law/treaties-customary-law/geneva-conventions [accessed on 6 June 2022]

12 International Committee of the Red Cross, Additional Protocols I & II https://www.icrc.org/en/doc/resources/ documents/misc/additional-protocols-1977.htm [accessed on 6 June 2022]

13 National Case Law, International Committee of the Red Cross https://casebook.icrc.org/glossary/national-case-law [accessed on 6 June 2022]