160
conduct of hostilities
3. This Rule envisages a situation where a cyber attack on a military objective will result in harm to civilian objects, including computers, networks, or infrastructure, or to civilians, that could not be avoided pursuant to Rules 52 to 58. It should be noted in this regard that cyber attacks on military objectives are sometimes launched via civilian communications cables, satellites, or other civilian infrastructure. When this is the case, they might harm that infrastructure. In other words, a cyber attack can cause collateral damage during transit and because of the cyber attack itself. Both forms of collateral damage are to be considered in application of this Rule. 4. As an example of the operation of this Rule, consider the case of a cyber attack on the Global Positioning System. The system is dual-use and thus a lawful target. However, depriving the civilian users of key information such as navigational data is likely to cause damage to, for instance, merchant vessels and civil aircraft relying on Global Positioning System guidance. If this expected harm is excessive in relation to the anticipated military advantage of the operation, the operation would be forbidden.160 5. Cyber operations may cause inconvenience, irritation, stress, or fear. Such consequences do not qualify as collateral damage because they do not amount to ‘incidental loss of civilian life, injury to civilians, damage to civilian objects’.161 Such effects are not to be considered when applying this Rule. The International Group of Experts agreed that the notion of ‘damage to civilian objects’ might, in certain circumstances, include deprivation of functionality (Rule 30). When this is the case, it is to be considered in a proportionality evaluation. 6. Collateral damage can consist of both direct and indirect effects. Direct effects are ‘the immediate, first order consequences [of a cyber attack], unaltered by intervening events or mechanisms’. By contrast, indirect effects of a cyber attack comprise ‘the delayed and/or displaced second-, third-, and higher-order consequences of action, created through intermediate events or mechanisms’.162 The collateral damage factored into the proportionality calculation includes any indirect effects that should be expected by those individuals planning, approving, or executing a cyber attack. For example, if Global Positioning Satellite data is blocked or otherwise disrupted, accidents involving transportation 160 161 162
Rome Statute, Art. 8(2)(b)(iv). AMW Manual, commentary accompanying Rule 14. Joint Chiefs of Staff, Joint Publication 3–60: Joint Targeting I-10 (2007).