Introduction
The principle of distinction is right at the centre of international humanitarian law (IHL). Woven deep into the fabric of this body of law, it is the material from which many of its rules are made. By prescribing that parties to armed conflicts must at all times distinguish between civilians and combatants and between civilian objects and military objectives, it draws a firm line of protection around those persons and objects that must be spared, as much as possible, from the effects of hostilities.
With the ongoing digitalization of warfare, however, the principle of distinction has come under renewed pressure. It has never been easier to involve civilians in military cyber and digital activities – and it has never been easier to harm them through these means. Most alarmingly, some behaviours of parties to armed conflicts may bring about both of these consequences at the same time. Can the law keep pace with these developments? And can the centre of IHL withstand the pressure that they bring?
This article argues that States and parties to armed conflicts more generally should refrain from involving civilians in the conduct of cyber hostilities, for important reasons of law and policy. Its principal contention is that it is not too late to reverse the damaging trend of the erosion of the principle of distinction in the cyber context, but it is essential that we recognize what is at stake and take action now. In order to build this argument, the article proceeds in five consecutive steps.
First, the article outlines the ongoing trend of civilianization of the digital battlefield and puts forward three brief scenarios to illustrate it. Second, the article examines the narrow circumstances under which such forms of civilian involvement may qualify as direct participation in hostilities under IHL. Third, it explores what this means for the individuals concerned, particularly from the perspective of their loss of protection under the law. Fourth, it analyzes the legal implications for States that engage in such conduct, under both IHL and human rights law. Finally, the article ends with an overall conclusion and recommendations for States.
Civilianization of the digital battlefield
From general trends to qualitative and quantitative shifts in the digital space
One of the fundamental premises of IHL is the separation of all persons affected by an armed conflict into two generic categories: on the one hand, there are the combatants, who conduct the hostilities on behalf of the parties to the conflict, and on the other hand, there are the civilians, who are presumed to refrain from doing so and who must therefore be protected against the dangers arising from the conflict.Footnote 1
The line between these two categories has never been fully impermeable, and civilians have been used to perform military functions during armed conflicts and to assist in the war effort since time immemorial.Footnote 2 Yet, for most of human history this involvement has typically been fairly minimal or limited to indirect forms of support such as “the production or provision of arms, equipment, food and shelter, [or] economic, administrative and political support”.Footnote 3
This is no longer the case today. Private contractors, civilian intelligence personnel and other civilian government employees are increasingly involved in military operations. The urbanization of warfare has brought conflict literally onto individual civilians’ doorsteps, with many of them taking on active roles in the fighting. In asymmetrical conflicts in particular, the nominally weaker side will often engage and rely on civilians to confuse and outmanoeuvre the asymmetrically stronger enemy.Footnote 4
In addition, the ongoing process of digitalization has enabled certain novel qualitative and quantitative shifts. From the qualitative perspective, digital forms of involvement have a much lower threshold – with some degree of exaggeration, it can be said that anyone with a smartphone is capable of joining in. Digitalization has also erased, or transformed, the concept of remoteness: while individuals may be physically remote from the theatre of hostilities, they are only a few clicks away from the digital battlefield.
On the quantitative side, the characteristics of the digital space have made it much easier to scale up any civilian involvement. A group comprising thousands or even tens of thousands of individuals may be formed and coordinated in a matter of hours. Similarly, the attack surface of societies has vastly increased – there are digital devices, apps and networks everywhere, which means that in time of armed conflict, there are exponentially more vulnerabilities than in the wars of the past.
Three illustrative scenarios
Several examples – all drawing on incidents and activities reported during recent armed conflicts – may help illustrate these trends. First, States may encourage civilians to engage in offensive cyber operations against targets associated with the enemy (scenario 1). These kinds of involvement may range from the simplest forms, such as joining a distributed denial-of-service (DDoS) attack, to more complex ones, such as contributing to cyber operations aimed at disrupting enemy assets or infrastructure. Individual civilians can be easily mobilized and coordinated through digital means, and existing groups of “hacktivists” can be federated by States.Footnote 5 The outsourcing of military cyber operations to civilians may offer certain advantages such as lower costs and operational efficiency, but these must be weighed against the risks posed by the lack of training and discipline at the level expected from military personnel.
Second, States may repurpose existing e-government or other smartphone applications for military use (scenario 2). During an armed conflict, such applications can be “enhanced” by building in new functionalities to encourage users to contribute to the military effort by, for example, reporting the movements of enemy troops, vehicles or aircraft by uploading location-tagged images or videos.Footnote 6 Given that the apps are well understood by the population, their use does not require a training period; the new capabilities can be used immediately. For the State in question, an existing community of digital citizens familiar with a given app may present an opportunity to rapidly increase its capabilities in time of war. At the same time, the reliability, accuracy and ultimately operational value of information gathered in this way must be carefully assessed by the receiving State. As will be detailed later, another key disadvantage relates to the risk that the provision of the information poses to the civilians using the app.
Third, either voluntarily or out of a domestic legal obligation, private companies – i.e., civilian entities – that control cyber infrastructure may defend against deliberate cyber attacks originating from abroad or share threat intelligence with government authorities such as national cyber defence entities (scenario 3). A key advantage of such activities for States is that they strengthen the national cyber resilience while offloading the costs for doing so to non-State actors. Even if the frameworks for such involvement are developed with peacetime contexts in mind, the cyber defence actions taken on their basis during armed conflicts may well in effect thwart or at least impede the enemy's military cyber operations. These forms of involvement may, however, invite retaliation by the enemy, which can not only directly endanger the staff and property of the concerned companies but may also negatively affect civilians and civilian services reliant on those companies.Footnote 7
These three examples highlight different forms of civilian involvement as well as their key potential advantages and disadvantages from the military and policy perspectives. Some of them may be taken on the civilian actors’ own initiative, while others may be encouraged by States or even mandated by the law. What all of them share, though, is that they draw civilians into a space that is normally occupied by the military, thus potentially blurring the line between civilians and combatants in cyberspace.Footnote 8
This problem is not unknown to States, which have acknowledged its various facets in their official pronouncements. For instance, during recent multilateral discussions at the United Nations (UN), Russia has suggested that it is “very difficult (if not impossible) to draw a distinction in virtual space between … combatants and non-combatants”.Footnote 9 Similarly, Japan has called for further discussions on how IHL rules on “the scope of combatants apply to cyberspace”.Footnote 10 And in its 2021 national position on the application of international law in cyberspace, Brazil described the question of “when a civilian acting in the cyberspace might be considered as taking direct part in hostilities” as one of the key unsettled issues in IHL.Footnote 11 This is the question to which we will turn in the next section.
Cyber activities and direct participation in hostilities
General rule
Under IHL, civilians are protected against attack unless and for such time as they directly participate in hostilities. This rule is articulated in Article 51(3) of Additional Protocol I (AP I) and Article 13(3) of Additional Protocol II (AP II). It reflects customary international law applicable in both international and non-international armed conflicts.Footnote 12
Importantly, not every form of civilian involvement in the war effort qualifies as direct participation in hostilities.Footnote 13 The cited treaty provisions do not contain more precise criteria and so far, no clear and uniform definition of direct participation in hostilities has been developed in State practice either.Footnote 14 However, the International Committee of the Red Cross (ICRC) has published an Interpretive Guidance on the Notion of Direct Participation in Hostilities under International Humanitarian Law (ICRC Interpretive Guidance), according to which an act amounts to direct participation in hostilities if it meets the following three cumulative conditions:
1. the act must be likely to adversely affect the military operations or military capacity of a party to an armed conflict or, alternatively, to inflict death, injury, or destruction on persons or objects protected against direct attack (threshold of harm), and
2. there must be a direct causal link between the act and the harm likely to result either from that act, or from a coordinated military operation of which that act constitutes an integral part (direct causation), and
3. the act must be specifically designed to directly cause the required threshold of harm in support of a party to the conflict and to the detriment of another (belligerent nexus).Footnote 15
The ICRC's criteria have been described in international jurisprudence as “useful guidance”.Footnote 16 While not all States are fully aligned with the tripartite test,Footnote 17 several have expressly endorsed it, either in general terms or specifically in the cyber context, including Colombia (in general),Footnote 18 Denmark (in general),Footnote 19 France (specifically)Footnote 20 and Germany (specifically).Footnote 21 In the cyber context, it has also been endorsed by the international group of experts who drafted the Tallinn Manual 2.0 on International Law Applicable to Cyber Operations (Tallinn Manual 2.0).Footnote 22
In the next subsection, we will return to the three scenarios mentioned earlier and assess them against the “analytical tools”Footnote 23 set out in the ICRC Interpretive Guidance. In practice, each activity must be carefully evaluated on a case-by-case basis against these criteria before a determination is made.Footnote 24 As will be seen, the cumulative criteria set the bar very high, and specific forms of civilian involvement clear it only in exceptional circumstances.
Application of the general rule to the three scenarios
Threshold of harm
In order for an act to meet the first criterion, it must be likely to adversely affect the military operations or capacity of the adversary, irrespective of the means used or of whether it would reach the level of an attack on its own.Footnote 25 It does not necessarily have to qualify as an “attack” under IHL (the exact threshold of which is unsettled in the cyber contextFootnote 26) or involve the use of “weapons”.Footnote 27 Accordingly, it is widely accepted that, for example, clearing mines placed by the enemy or wiretapping the enemy's communications could suffice depending on the situation, even though such activities do not amount to attacks in the IHL sense of the word.Footnote 28
Offensive cyber operations against targets associated with the enemy, as envisaged in scenario 1, do not meet this criterion unless they may “negatively affect the enemy militarily”.Footnote 29 In practice, this means that such operations would, if successful, reduce the military capacity of the enemy or at least interfere with the enemy's military operations. For example, a cyber operation against the computer network of a railway company in time of armed conflict could be designed to block the deployment of trains carrying military equipment belonging to the enemy, thus adversely affecting the enemy's operations.Footnote 30 However, not any manipulation of computer networks would suffice; adverse military effects must be at least likely at the time the operation is planned.Footnote 31
Many forms of information about the enemy's movements provided to the military through a smartphone application – covered in scenario 2 – would be too general or insignificant to meet the “threshold of harm” criterion. In the traditional physical-world context, there is a “general agreement that civilians merely answering questions asked by passing military personnel could not be considered as directly participating in hostilities”.Footnote 32 The same logic applies with regard to digital intelligence sharing. It is only if the information is essential for the execution of a specific military operation, such as transmitting tactical targeting information for an attack, that its provision may be considered sufficient to meet the “threshold of harm” criterion.Footnote 33 This question is closely related to the issue of direct causation, which will be analyzed in the next section.
Finally, with respect to scenario 3, the majority of activities taken by private companies will fall well below the threshold of harm. This includes activities with some relevance to national cyber defence or to the prosecution of the war effort, such as the development of generic cyber capabilities designed for military use, training military cyber personnel, hardening existing cyber defences, or strengthening societal cyber resilience in anticipation of enemy military operations. All of these are types of “conduct that merely builds up or maintains the capacity of a party to harm its adversary”.Footnote 34 As such, they are excluded from the notion of direct participation in hostilities.Footnote 35 Conversely, some forms of action taken by private companies to defend the domestic cyber infrastructure against the enemy's military cyber operations may impede or thwart such operations, and thus potentially cross the required threshold of harm.Footnote 36 This would be the case if the company conducted a “hack-back” against the source of the enemy operation – but not if it was merely restoring its system after that operation had ended.
Direct causation
The second criterion, that of direct causation, has been described as “really the key principle in this area”,Footnote 37 and this is arguably also the case for our present purposes. The existence of a direct causal link may be established more easily in some of the examples discussed here than in others, however. The ICRC Interpretive Guidance explains that according to the criterion, the harm must be brought about in “one causal step”.Footnote 38 Launching an offensive cyber operation (scenario 1) or a hack-back (scenario 3) against the enemy is less difficult to classify in this regard: the requisite harm may be reasonably expected to result directly from the act in question.Footnote 39 This is irrespective of the geographic or temporal distance between the civilian's action and the relevant harm: what matters is causal proximity, not geographic or temporal proximity.Footnote 40
By contrast, providing intelligence on enemy movements through a smartphone app (scenario 2) is less causally proximate. Whether this provision of information by individual civilians results in the requisite harm depends on the action of the receiving party to the conflict, and for the criterion to be fulfilled, the provision of information must be an integral part of a coordinated operation directly causing the harm.Footnote 41 A lot turns on the specific circumstances of each case. As noted earlier, in the kinetic context, there is “general agreement that civilians merely answering questions asked by passing military personnel could not be considered as directly participating in hostilities”.Footnote 42 Similarly, answering a general question through an app, even if the answer could be of military value to a belligerent, would normally be too remote to qualify as directly causing the requisite harm.Footnote 43 As long as the military information being gathered and shared by civilians is of a general nature, the act of gathering and sharing the information does not constitute direct participation in hostilities.Footnote 44
The reverse would only be the case in the exceptional circumstances in which the information in question was provided “with a view to the execution of a specific hostile act”.Footnote 45 This is a long-standing interpretation, as evidenced by the 1923 Hague Rules of Air Warfare, according to which “[t]he term ‘hostilities’ includes the transmission … of military information for the immediate use of a belligerent”.Footnote 46 An example in our present context would be the provision of exact targeting coordinates for a specific military objective, as an integral part of a concrete and coordinated tactical operation by the belligerent in question to attack that target.Footnote 47 The requirement that the intelligence must be gathered and transmitted for the purposes of a specific attack is also echoed in the positions of the few States that have expressed their views on these matters in the digital context.Footnote 48
This difference may be subtle, but it is critically important. There is a wide range of situations in which reporting the position of the enemy to the authorities is a normal (i.e., non-hostile) civilian conduct that should not be construed as an act leading to the person's targetability.Footnote 49 Otherwise, for instance, internally displaced persons arriving in camps would not be able to tell their stories to the government authorities if those stories contained information on the location of enemy forces – or a civilian air traffic controller could not report the approach of enemy military aircraft in the course of her work – without becoming targetable under IHL.Footnote 50 Such interpretations would lead to a manifestly absurd result that would be impossible to reconcile with the protective object and purpose of the relevant rules on the conduct of hostilities.Footnote 51
Belligerent nexus
Determining whether the belligerent nexus criterion is met may again be more straightforward in some of the above examples than in others. The act of launching an offensive cyber operation at the instigation of one's own State against that State's enemy during an armed conflict (scenario 1) is a type of action specifically designed to support the actor's own State and to be detrimental to the other. Ordinarily, such forms of conduct will suffice to meet the criterion.
Things are less clear with regard to the transmission of intelligence on enemy movement (scenario 2). As with the direct causation criterion, a lot will depend on the exact parameters of the app and the type of information provided. Informing one party to the conflict about the military actions of the other may be specifically designed to support one to the detriment of another, thus fulfilling the belligerent nexus criterion. However, doing so may also be designed to enable civilian warning and evacuation, to support the work of civil defence organizations, or to achieve other non-belligerent purposes, in which case the criterion would not be met.Footnote 52 Furthermore, if the questions and answers transmitted through an app are so general that the civilians involved “are totally unaware of the role they are playing in the conduct of hostilities”, then the action of transmitting the information would not reach the nexus threshold.Footnote 53 To say otherwise would mean removing the protection against attack from individuals who are being wholly instrumentalized and who therefore cannot be regarded as performing a legally relevant action.Footnote 54
The belligerent nexus criterion is even harder to meet with respect to the conduct of private companies (scenario 3). It could be argued that when such companies engage in acts of cyber defence, even if mandated by the law, they do so primarily in order to protect their own interests (such as limiting exposure to liability, protecting their share value or simply maintaining their reputation) rather than to support the war effort of one State and/or to harm another.
This raises the question of the relevance of subjective intent in evaluating the belligerent nexus criterion. The ICRC Interpretive Guidance bases its approach strictly on the objective purpose of the act in question, noting that “the subjective motives driving a civilian to carry out a specific act cannot be reliably determined during the conduct of military operations and, therefore, cannot serve as a clear and operable criterion for ‘split second’ targeting decisions”.Footnote 55 With some narrow exceptions,Footnote 56 whether or not a person becomes targetable under IHL is contingent on the objective nature of their conduct, and not on their inner state of mind.Footnote 57
It is submitted that the same approach should apply to the involvement of private companies in national cyber defence. The adversary will normally not be able to determine the subjective motives of the acting entity, and it would be particularly unrealistic to saddle it with this burden in the cyber context, which is characterized by geographical remoteness and uncertain attribution.Footnote 58 Therefore, the objective purpose should be determined by reference to the design of the operation in question.Footnote 59 If the operation can reasonably be regarded as being designed to support one party to the conflict to the detriment of another, it would thus meet the nexus criterion irrespective of the associated subjective motivations.Footnote 60 If not (for example, because a company's operations affect both parties equally), then the criterion would not be met. This may of course be difficult to determine in practice;Footnote 61 in case of doubt, the conduct should be presumed not to qualify as direct participation in hostilities.Footnote 62
Additionally, if the operation is objectively taken in defence of the company or its infrastructure, it could potentially fall within the separate exemption of “individual self-defence” against unlawful acts of violence.Footnote 63 As noted in the ICRC Interpretive Guidance, “although the use of force by civilians to defend themselves against unlawful attack or looting, rape, and murder by marauding soldiers may cause the required threshold of harm, its purpose clearly is not to support a party to the conflict against another”.Footnote 64 Similarly, protecting one's own networks against existing or imminent unlawful cyber harm is conduct not designed to support any party to a conflict and as such would lack belligerent nexus.Footnote 65
Interim conclusion
Only if a certain form of civilian involvement meets all three of these criteria simultaneously will the conduct in question qualify as direct participation in hostilities. The foregoing analysis demonstrates that this outcome is an exception rather than the rule. While certain offensive cyber operations conducted by civilians (scenario 1) may in some circumstances qualify as direct participation in hostilities, most forms of provision of information by civilians through smartphone apps (scenario 2) and cyber defence activities by private companies (scenario 3) do not.
Nonetheless, the exceptions cannot be ignored, and their legal consequences need to be understood. In addition, the narrow conclusions endorsed here may be challenged by others who interpret the applicable criteria more extensively than the present article, with the result that more types of conduct would be perceived as direct participation. This only underlines the need to understand the legal implications of such qualifications, both for the individuals and for the States concerned. This is what we turn to in the remaining two sections of this article.
Legal implications for individuals
Violation of international or domestic law?
To begin with, it might be queried whether the forms of engagement described above are unlawful for the individuals concerned: do civilians violate IHL by directly participating in hostilities? In this regard, it is noteworthy that IHL provides only combatants with an express right to participate directly in hostilities.Footnote 66 According to one view (expressed succinctly by the British military lawyer General A. P. V. Rogers), “[t]he inference is that others do not have the right to participate directly in hostilities and, if they do, they violate the law of war”.Footnote 67 A similar (and similarly rare) position can be found in a 1976 US Air Force pamphlet, according to which there is an “obligation on the part of civilians not to take a direct part in hostilities”.Footnote 68
This interpretation is not generally accepted, however. The dominant position – also shared by the ICRC – is that “IHL neither prohibits nor privileges civilian direct participation in hostilities”.Footnote 69 Probably the only treaty prohibition against involving civilians in armed conflict is the prohibition against privateering found in the 1856 Paris Declaration on maritime law,Footnote 70 which is of little relevance in the context discussed in this article. Therefore, while it is certainly true that civilians “were never meant to directly participate in hostilities on behalf of a party to the conflict”,Footnote 71 there is no express prohibition against them doing so. It logically follows that civilian direct participation in hostilities does not, in and of itself, constitute a war crime.Footnote 72 This is confirmed by the fact that none of the statutes of past or existing international criminal tribunals have criminalized such conduct.Footnote 73 Returning to the cyber context, the Tallinn Manual 2.0 group of experts also observed that IHL “does not bar any category of person from participating in cyber operations”.Footnote 74
By contrast, acts of direct participation in hostilities are often criminalized under domestic law, together with numerous other forms of harmful behaviour that may fall below the direct participation threshold as far as IHL is concerned. Domestic statutes may do so expressly, or they may provide for offences that cover the same forms of behaviour as those typically committed by individuals engaged in armed conflicts: deliberate killing or injuring of another, damaging or destroying property, or – more relevant in the present context – computer-related offences such as the creation, use or distribution of malicious software.Footnote 75 Because civilians are by definition not combatants, they are not shielded from domestic prosecution for such acts by combatant immunity.Footnote 76 Similarly, if captured, civilians who have directly participated in hostilities are not entitled to prisoner-of-war status.Footnote 77
Loss of protection from attack and the related safeguards
In addition, a key consequence of direct participation in hostilities is the loss of protection from attack for the individual concerned.Footnote 78 In this sense, there is no difference between “kinetic” and “cyber” direct participation in hostilities. In practical terms, the act of direct participation in hostilities by a civilian renders them liable to be attacked by any lawful means, whether cyber or not.Footnote 79
However, the specific characteristics of the cyber environment, together with the remoteness implicit in practically any cyber activity, pose certain additional challenges as well as safeguards relevant to the targeting of individuals who have directly participated in hostilities through cyber or digital means.
First, there may be certain territorial considerations to be taken into account. Until now, a tacit assumption of this article has been that the individuals concerned are located in the territory of one of the parties to the conflict. However, it is certainly conceivable that civilians could engage from outside of those territories in cyber activities that would fall under the definition of direct participation in hostilities if IHL applied. If that is the case, other branches of international law – such as the law on the use of force, the law of neutrality, or human rights law – will contain important limitations that will in most cases preclude the application of lethal force against such individuals.Footnote 80
Second, IHL imposes important temporal considerations. Civilians only lose protection from attack “for such time as” they directly participate in hostilities.Footnote 81 This means that if the specific act that constitutes direct participation ends, their protection against attack is restored.Footnote 82 The exact beginning and end of specific acts amounting to direct participation in hostilities must therefore be determined with utmost care.Footnote 83
Consider, for example, a civilian using a smartphone app to provide tactical intelligence to attacking forces (scenario 2).Footnote 84 As noted earlier, in certain very narrow circumstances, such conduct may amount to direct participation in hostilities.Footnote 85 Importantly, the information thus provided (e.g. the targeting coordinates sent via a chat function in the app or an image of an enemy military objective uploaded through the app) may remain stored in the phone after such engagement. Does the act of direct participation continue while the information is available in the phone concerned?
It is submitted that such a reading would be overbroad, and that the civilian involvement ends at the moment when the information is provided. This is because at that point in time, the relevant conduct (i.e., the “act”Footnote 86) of the civilian comes to an end, and the mere carrying of a phone containing militarily relevant information cannot be considered as direct participation,Footnote 87 even if the object as such may continue to have military value.Footnote 88 The individual's conduct does not present any danger for the adversary any more, and as such they may no longer be directly attacked.Footnote 89
Third, there are uncertainty considerations that must be taken into account. In order to avoid the erroneous or arbitrary targeting of civilians, parties to a conflict must take all feasible precautions in verifying whether a person is a civilian and, if that is the case, whether they are directly participating in hostilities.Footnote 90 In case of doubt, the person in question must be presumed to be protected against direct attack.Footnote 91 As explained by Yoram Dinstein, this interpretation is necessary “to ensure that soldiers tasked with the mission of winnowing out false civilians who are de facto combatants will not treat innocent civilians as targetable, ‘shooting first and asking questions later’”.Footnote 92
Fourth, even where a civilian loses protection from attack, any use of force against them remains governed by other rules of IHL. In particular, if attacking the individual may be expected to result in disproportionate incidental civilian harmFootnote 93 or if it was feasible to obtain a similar military advantage while causing less or no incidental civilian harm, then the attack would be prohibited by IHL.Footnote 94 Moreover, IHL expressly provides that the presence of civilians directly participating in hostilities among the civilian population does not deprive the population at large of the protection from attack to which it is entitled.Footnote 95
Finally, it is important to distinguish the lawfulness of an attack from its operational feasibility or military value. In practical terms, parties to armed conflicts may prefer to target the objects used by the civilian in question – such as the network, the device or the app – rather than the person. Doing so may be more militarily expedient and thus preferable as a matter of policy. (It would also have to be determined whether the said object qualifies as a military objective, and the operation against it would have to comply with all other applicable rules of IHL.Footnote 96) However, the fact remains that civilians may indeed exceptionally lose their legal protection from attack through these forms of involvement. In the next section, we will analyze what this means from a systemic perspective.
Legal implications for States
International humanitarian law
The principle of distinction is one of the oldest principles in IHL and a cornerstone of that body of law. The International Court of Justice (ICJ) has described it as a “cardinal” and “intransgressible” principle that is part of “the fabric of humanitarian law”.Footnote 97 It reflects the prevailing post-Westphalian philosophical and political paradigm according to which the monopoly on the legitimate use of force belongs to States.Footnote 98 As Jean-Jacques Rousseau wrote in The Social Contract, war is a relation “not between man and man, but between State and State”.Footnote 99 In other words, civilians are not the enemies of States, and they must thus be spared, as far as possible, from the effects of any hostilities between States.Footnote 100
This paradigm has also been reaffirmed by the international community in the cyber context. In particular, the UN General Assembly has repeatedly given unanimous endorsement to the consensus reports issued by several Groups of Governmental Experts, which have described distinction as an “established international legal principle” applicable to the use of information and communications technologies by States.Footnote 101 The principle of distinction and the values it represents are today part of the irreducible core of the normative framework applicable during armed conflicts, including when these involve new means and methods of warfare.Footnote 102
In this respect, encouraging civilian participation in cyber activities that may amount to direct participation in hostilities raises several crucial systemic-level concerns. One has to begin with the humanitarian concern: such acts of encouragement undermine the central humanitarian value that undergirds the principle of distinction, namely the protection of those who must be spared from the effects of armed conflict.
In modern-day armed conflicts, civilians are killed and injured at much higher rates than their combatant counterparts.Footnote 103 Any pattern of conduct which makes them more susceptible to harm is thus by definition morally suspect and practically problematic. As Eric Jensen has noted, in the kinetic context, encouraging individuals “to fight as civilians will inevitably lead to more civilian casualties as combatants struggle to distinguish the fighters amongst the civilians”.Footnote 104 The same concern arises in the cyber context.
An objection could be made that the kinetic targeting of individuals based on their cyber participation in hostilities is unlikely. For example, in 2019, France's Ministry of Armies noted in a public position paper that “[g]iven the difficulties of identifying the perpetrators of a cyberattack, the targeting of such individuals remains marginal”.Footnote 105 However, technical attribution capabilities have dramatically improved in the recent period,Footnote 106 so over time, the risk exists that such targeting may become less marginal.
In addition, there have already been reports of militaries targeting civilians in combat zones for being suspected of using their mobile phones to report the enemy's location.Footnote 107 If parties to armed conflicts encourage civilians to engage in this type of conduct, such incidents may become much more common, including in situations where the civilian in question was using the phone for another reason – for instance, to warn their families to leave or to seek shelter.
This humanitarian concern translates into legal concerns under IHL. To begin with, there is a strong strand of scholarship arguing that the practice of involving civilians in combat functions is eroding (or undermining) the principle of distinction.Footnote 108 As noted, this principle requires that – insofar as persons are concerned – parties to armed conflicts must at all times distinguish between civilians and combatants.Footnote 109 The principle is most effective in practice if participation in hostilities is limited to those endowed with combatant privilege.Footnote 110 In other words, blurring the distinction between combatants and civilians by definition “endanger[s] the protection afforded to the latter”.Footnote 111 This is because if the lines become unclear, then there is a risk that parties to armed conflicts may gradually begin to err on the side of considering all individuals in the enemy population to be involved in hostile acts, thus diminishing restraints on attacks against them.Footnote 112
For some authors, the deliberate contribution to such risks by States does not merely “erode” or “undermine” the principle of distinction, but constitutes a standalone violation of IHL attributable to the State in question. In particular, Lindsey Cameron and Vincent Chetail write:
Respect for the principle of distinction entails that a state may not use civilians to directly participate in hostilities. Indeed, if a state were to do so, it would be putting its own civilians in jeopardy since civilians directly participating in hostilities lose protection against attack and may be arrested and tried for such acts. What is more, states are responsible for ensuring that the principle of distinction is upheld. If a state were to permit civilians to undertake combat functions, or to require them by contract to do so, that state would violate its obligation to uphold the principle of distinction.Footnote 113
This is a powerful argument that goes a long way towards addressing the protective needs identified in this article. However, it may be challenging to identify a precise legal basis for such a generalized obligation to uphold the principle of distinction, or to determine the exact contours of this obligation. Even Article 48 of AP I – sometimes described as “the basic rule of distinction”Footnote 114 – is narrower in its remit: it demands that the parties to the conflict should distinguish between the civilian population and combatants at all times, but it does not establish a generalized obligation to uphold the principle that underpins the text of the rule. In this author's view, it is thus preferable to examine specific IHL obligations that flow from the principle of distinction. Three of them stand out in this context: the obligation of constant care, the obligation to take passive precautions, and the obligations relating to participation in hostilities by children.
First, parties to armed conflicts are bound by the obligation of constant care, which mandates that in the conduct of military operations, constant care must be taken to spare the civilian population, civilians and civilian objects.Footnote 115 Several States – including FranceFootnote 116 and GermanyFootnote 117 – have explicitly stated that this obligation also applies in the context of cyber operations, and this view is also shared by the ICRC.Footnote 118 In the Tallinn Manual process, it was agreed that this duty “requires commanders and all others involved in the operations to be continuously sensitive to the effects of their activities on the civilian population and civilian objects, and to seek to avoid any unnecessary effects thereon”.Footnote 119 Exposing civilians to a loss of their protection under IHL is hardly compatible with the duty to spare them from such effects, as required by the constant care obligation.
Second, parties to armed conflicts are obliged to take, “to the maximum extent feasible”, the necessary precautions “to protect the civilian population, individual civilians and civilian objects under their control against the dangers resulting from military operations”.Footnote 120 Again, there is little doubt that this rule applies in the cyber context, and this has been expressly recognized by France.Footnote 121 In the Tallinn Manual context, it was underlined that this rule was “designed to protect against death or injury to civilians”.Footnote 122 Therefore, encouraging civilians to directly participate in cyber hostilities, and thereby exposing them to the risk of losing their IHL protections, is in direct tension with this rule as well.
It could be objected that the constant care and passive precaution obligations are inapplicable to civilians who are directly participating in hostilities given that these individuals are no longer covered by the protection against attack normally afforded to civilians. However, that would be a misunderstanding of the present argument. This author accepts that for such time as civilians are engaged in an act of direct participation in hostilities, the protective ambit of these rules is removed from them.Footnote 123 However, that is not the case before they do so. It is submitted that until such time, parties remain bound by the said obligations, and encouraging civilians to cross the line, so to speak, towards unprotected territory is hard to reconcile with those obligations.Footnote 124
Lastly, parties to armed conflicts must do everything feasible to ensure that children under 15 years of age do not directly participate in hostilities.Footnote 125 As noted in the ICRC Commentary on the relevant provision in AP I, “[t]he intention of the drafters of the article was clearly to keep children under fifteen outside armed conflict”.Footnote 126 The age limit rises to 18 for States party to the African Charter on the Rights and Welfare of the Child,Footnote 127 and the ICRC recommends that all States adopt this higher age limit of 18.Footnote 128 Given that some of the activities on the digital battlefield may qualify as direct participation, this means that belligerents have an additional duty to prevent children under 15 or 18 from joining in. This is a pressing concern in view of the low threshold for digital forms of involvement discussed earlierFootnote 129 – not to mention the possibility that some of the relevant digital tools may be especially appealing to children, who are generally less able to accurately assess risk and may perceive such tools as just another game on their smart device.Footnote 130 Depending on the circumstances, specific examples of feasible measures could include implementing age restrictions and blocks on access to those digital tools the use of which may constitute direct participation in hostilities.Footnote 131 By contrast, failure to take any such measures could result in a standalone violation of the relevant IHL rules on the protection of children.
International human rights law
Encouragement of civilians to directly participate in hostilities during armed conflicts also raises concerns under international human rights law (IHRL). True, it is sometimes said that IHRL was designed for the environment of a normal State in the condition of peace.Footnote 132 However, it is now generally accepted that IHRL applies both in time of peace and during armed conflict.Footnote 133 This has been confirmed in a consistent line of case law of the ICJ;Footnote 134 it is also the view of most StatesFootnote 135 – Israel being one exceptionFootnote 136 – as well as of the International Law CommissionFootnote 137 and various human rights mechanisms.Footnote 138
There is a separate controversy as to the extent to which IHRL applies to extraterritorial conduct of States. However, that controversy does not arise here – at least not in relation to the practical scenarios considered in this article – given that our focus is on a State's conduct vis-à-vis the civilians who find themselves in that State's own territory, not abroad. On the basis of the foregoing, it can thus be inferred that IHRL is relevant when considering these forms of conduct in spite of the ongoing armed conflict; what remains to be determined is whether the conduct examined here is compatible with States’ IHRL obligations.
It should be recalled that involving civilians in acts of direct participation in hostilities exposes them to the loss of protection against attack under IHL.Footnote 139 In other words, in doing so, the acting State exposes these individuals under its jurisdiction to the risk of grave injury or loss of life. At the same time, it is well established that the exposure of an individual to the risk of an effect that is proscribed by law – such as ill-treatment, torture or death – can amount to a violation of the concomitant right. For example, in the 2005 Mamatkulov and Askarov v. Turkey case, the European Court of Human Rights (ECtHR) held:
It is the settled case-law of the Court that extradition by a Contracting State may give rise to an issue under Article 3 [of the European Convention on Human Rights, on prohibition of torture and inhuman or degrading treatment or punishment], and hence engage the responsibility of that State under the Convention, where substantial grounds have been shown for believing that the person in question would, if extradited, face a real risk of being subjected to treatment contrary to Article 3 in the receiving country. … Nonetheless, there is no question of adjudicating on or establishing the responsibility of the receiving country, whether under general international law, under the Convention or otherwise. In so far as any liability under the Convention is or may be incurred, it is liability incurred by the extraditing Contracting State by reason of its having taken action which has as a direct consequence the exposure of an individual to proscribed ill-treatment.Footnote 140
The same logic applies here. It is immaterial that the eventual harm would be produced by the actions of another party to the conflict which might attack the directly participating civilians. What matters for the purposes of establishing the international responsibility of the acting State is that its actions have as a direct consequence the exposure of an individual to a real risk of proscribed effects.
What might such proscribed effects be in our present context? The right to life, as explained by the UN Human Rights Committee, “concerns the entitlement of individuals to be free from acts and omissions that are intended or may be expected to cause their unnatural or premature death”.Footnote 141 It is generally accepted that the relevant protections continue to apply during armed conflict, including in the conduct of hostilities.Footnote 142 In this regard, it is crucial that the encouragement of civilians to directly participate in hostilities has been shown to be potentially inconsistent with several obligations under IHL.Footnote 143 As explained by the Committee, “practices inconsistent with international humanitarian law, entailing a risk to the lives of civilians and other persons protected by international humanitarian law, … would also violate article 6 of the [International Covenant on Civil and Political Rights]”.Footnote 144
It is useful at this point to distinguish the involvement of civilians in hostilities from the conscription of civilians into the armed forces of States. The latter is an inherent right of States, including where they do so on a compulsory (forced) basis.Footnote 145 The legal status under IHL of individuals who are recruited into armed forces changes from “civilian” to “combatant”.Footnote 146 This transformation thus brings about key entitlements that are associated with combatant status, including immunity from prosecution for participating in hostilities and entitlement to prisoner-of-war status if captured. Therefore, even though recruitment into armed forces also entails a risk to the lives of the concerned individuals, these no longer qualify as civilians and the acceptance of such risk is an established feature of IHL.Footnote 147
And yet, it would be overbroad to suggest that all forms of encouragement of civilians to engage in cyber activities that constitute direct participation in hostilities amount to a violation of the concerned individuals’ right to life. In the IHRL jurisprudence, relevant criteria include whether the activity at issue is dangerous by its very nature and puts the life of the people concerned at real and imminent risk.Footnote 148 While this may be the case with some activities discussed in this article – such as using one's phone to transmit tactical intelligence directly from the front line (scenario 2) – others may be inherently less dangerous.
In general terms, whenever a State undertakes or organizes dangerous activities, or authorizes them, it must ensure that the risk is reduced to a reasonable minimum.Footnote 149 Applied to the present context, this means that States should prioritize those forms of civilian involvement in the war effort that do not place these individuals in harm's way. This would include cyber activities, which merely build up or maintain the military capacity of a party to the conflict, given that – as noted earlier – these types of conduct do not qualify as direct participation in hostilities.Footnote 150
In addition, the protection of individuals’ lives under the IHRL framework must strike a balance with the protection of personal autonomy, which is an inherent part of the right to respect for private life.Footnote 151 In order for individuals to exercise this autonomy, States should take adequate measures to provide them with information enabling them to assess the relevant risks to their physical integrity.Footnote 152 If the acting State furnishes the concerned individuals with full information about the risks entailed in engaging in a cyber or digital activity that may amount to direct participation in hostilities and they nonetheless decide to do so, it would be more difficult to argue that the State has exposed them to unacceptable risk from the perspective of their right to life.
In the final analysis, it is impossible to draw general conclusions as to the compatibility of the practices considered here with IHRL. The most extreme forms – such as requesting civilians to act in ways that would expose them to the real and imminent danger of being directly attacked, and without informing them of this risk – would most likely violate the concerned individuals’ right to life. For instance, asking unwitting civilians who find themselves in the theatre of hostilities to use their phones to supply tactical intelligence needed for immediate attacks would be highly problematic.
However, lesser forms of involvement may more helpfully be analogized to activities such as State-encouraged voluntary participation in dangerous activities like environmental or industrial disaster response. Provided that, for example, volunteer firefighters are given accurate information about the risks they might be facing in helping to extinguish a massive fire, and provided that the State takes reasonable risk mitigation measures, it would be a stretch to argue (on IHRL grounds) that the State was precluded from requesting their assistance, particularly if there was a lack of professional personnel available.
It is submitted that the same approach should apply to the encouragement of civilians to engage in cyber activities that may constitute direct participation in hostilities during armed conflicts. One would be hard-pressed to identify a blanket prohibition of such practices in IHRL, but at least some of them are problematic from the perspective of that body of law, and, generally speaking, if States have other ways of achieving their goals, they should prioritize those in order to avoid potential liability for human rights violations.
Conclusion
The ongoing process of digitalization of societies is transforming the way in which wars are fought. States have added cyber capabilities to their military arsenals and continue to search for the most effective ways of projecting their cyber power, including during armed conflicts. One of the concerning trends in this regard relates to the growing involvement of civilians in activities on the digital battlefield.
This article has demonstrated that – even though the circumstances when this occurs are quite narrow – some forms of such involvement may qualify as direct participation in hostilities under IHL. While individuals who engage in these activities do not automatically violate international law, they must be aware that doing so temporarily removes their protection from direct attack. States that decide to encourage such engagement should therefore at the very least be open and transparent about what it means in practical and legal terms.
Moreover, certain acts that put civilians in harm's way by making them directly participate in hostilities may constitute standalone violations of IHL and IHRL obligations by the acting States. From the IHL perspective, the relevant rules include the obligations of constant care and passive precautions, and certain obligations relating to the protection of children. From the perspective of IHRL, some extreme forms of civilian involvement may implicate those individuals’ right to life. States must not engage in such conduct in order to comply with their duties under international law.
Beyond these specific prescriptions, the encouragement of civilian involvement in the conduct of hostilities contributes to the erosion of the principle of distinction, an edifice on which the rest of the law applicable in armed conflicts is built. Accordingly, it is strongly recommended for States to reverse the trend of civilianization of the digital battlefield and to refrain as much as possible from involving civilians in the conduct of cyber hostilities. After all, it is a basic truth that “[t]hings fall apart [when] the centre cannot hold”.Footnote 153
