The use of cyber operations during armed conflicts and the question of how international humanitarian law (IHL) applies to such operations have developed significantly over the past two decades. In their different roles in the Legal Division of the International Committee of the Red Cross (ICRC), the authors of this article have followed these developments closely and have engaged in governmental and non-governmental expert discussions on the subject. In this article, we analyze pertinent humanitarian, legal and policy questions. We first show that the use of cyber operations during armed conflict has become a reality of armed conflicts and is likely to be more prominent in the future. This development raises a number of concerns in today's increasingly cyber-reliant societies, in which malicious cyber operations risk causing significant disruption and harm to humans. Secondly, we present a brief overview of multilateral discussions on the legal and normative framework regulating cyber operations during armed conflicts, looking in particular at various arguments around the applicability of IHL to cyber operations during armed conflict and the relationship between IHL and the UN Charter. We emphasize that in our view, there is no question that cyber operations during armed conflicts, or cyber warfare, are regulated by IHL – just as is any weapon, means or methods of warfare used by a belligerent in a conflict, whether new or old. Thirdly, we focus the main part of this article on how IHL applies to cyber operations. Analyzing the most recent legal positions of States and experts, we revisit some of the most salient debates of the past decade, such as which cyber operations amount to an “attack” as defined in IHL and whether civilian data enjoys similar protection to “civilian objects”. We also explore the IHL rules applicable to cyber operations other than attacks and the special protection regimes for certain actors and infrastructure, such as medical facilities and humanitarian organizations.

How will emerging autonomous and intelligent systems affect the international landscape of power and coercion two decades from now? Will the world see a new set of artificial intelligence (AI) hegemons just as it saw a handful of nuclear powers for most of the twentieth century? Will autonomous weapon systems make conflict more likely or will states find ways to control proliferation and build deterrence, as they have done (fitfully) with nuclear weapons? And importantly, will multilateral forums find ways to engage the technology holders, states as well as industry, in norm setting and other forms of controlling the competition? The answers to these questions lie not only in the scope and spread of military applications of AI technologies but also in how pervasive their civilian applications will be. Just as civil nuclear energy and peaceful uses of outer space have cut into and often shaped discussions on nuclear weapons and missiles, the burgeoning uses of AI in consumer products and services, health, education, and public infrastructure will shape views on norm setting and arms control. New mechanisms for trust and confidence-building measures might be needed not only between China and the United States—the top competitors in comprehensive national strength today—but also among a larger group of AI players, including Canada, France, Germany, India, Israel, Japan, Russia, South Korea, and the United Kingdom.

Why do we need dialogue between ethical and legal perspectives on norms governing the initiation and conduct of interstate conflict? This essay will examine this question by first critiquing the 2013 Tallinn Manual on the International Law Applicable to Cyber Warfare, which sought to apply existing legal frameworks that govern international violence to a new form of conflict. While the manual is for the most part ethically commendable, the first half of the essay will highlight several of its ethical shortcomings and will then extract general reasons why international law nevertheless must be informed by ethical analysis. The second part of the essay will affirm the importance of law for ethical analyses of justified responses to the burgeoning phenomenon of sublethal harms. While states have always used sublethal harms to weaken adversaries, technological developments have magnified the regularity and effectiveness of these practices, particularly against free societies. Responses to such attacks may include—in addition to defensive countermeasures—punishments that deter and reform, and may target “indirect participants” such as financial supporters. However, determining which responses are ethically justified will require insights gleaned from criminal and tort law.

This article presents an initial discussion of the political and legal challenges associated with weaponised technologies in three interconnected areas that may impinge upon the ability to protect civilian populations during peace and war and imperil international security: armed unmanned combat aerial vehicles (commonly known as drones); autonomous weapons systems (known as ‘killer robots’); and the potential militarisation of cyberspace, or its use as a weapon, and the operation of drones and killer robots in the cyber domain. Supporting the argument that the world is ‘facing new methods of warfare’ and that international security governance and law are not keeping up, the article provides an overview and interpretation of three technologies in connection with aspects of five branches of law: state responsibility, use of force, international humanitarian law, human rights law, and law of the commons. I argue therefore that ‘preventive security governance’ could be a strategy to curtail uncertainty in the preservation of stability and international order. I define ‘preventive security governance’ as the codification of specific or new global norms, arising from existing international law that will clarify expectations and universally agreed behaviour on a given issue-area. This is essential for a peaceful future for humanity and for international order and stability.

Cyber warfare figures prominently on the agenda of policymakers and military leaders around the world. New units to ensure cyber security are created at various levels of government, including in the armed forces. But cyber operations in armed conflict situations could have potentially very serious consequences, in particular when their effect is not limited to the data of the targeted computer system or computer. Indeed, cyber operations are usually intended to have an effect in the ‘real world’. For instance, by tampering with the supporting computer systems, one can manipulate an enemy's air traffic control systems, oil pipeline flow systems, or nuclear plants. The potential humanitarian impact of some cyber operations on the civilian population is enormous. It is therefore important to discuss the rules of international humanitarian law (IHL) that govern such operations because one of the main objectives of this body of law is to protect the civilian population from the effects of warfare. This article seeks to address some of the questions that arise when applying IHL – a body of law that was drafted with traditional kinetic warfare in mind – to cyber technology. The first question is: when is cyber war really war in the sense of ‘armed conflict’? After discussing this question, the article goes on to look at some of the most important rules of IHL governing the conduct of hostilities and the interpretation in the cyber realm of those rules, namely the principles of distinction, proportionality, and precaution. With respect to all of these rules, the cyber realm poses a number of questions that are still open. In particular, the interconnectedness of cyber space poses a challenge to the most fundamental premise of the rules on the conduct of hostilities, namely that civilian and military objects can and must be distinguished at all times. Thus, whether the traditional rules of IHL will provide sufficient protection to civilians from the effects of cyber warfare remains to be seen. Their interpretation will certainly need to take the specificities of cyber space into account. In the absence of better knowledge of the potential effects of cyber warfare, it cannot be excluded that more stringent rules might be necessary.

While the rules of the jus in bello are generally operative in cyberspace, it appears to be problematic to apply the fundamental principle of distinction because of the systemic interconnection of military and civilian infrastructure in the cyber realm. In this regard, the application of the accepted legal definition of military objectives will make various components of the civilian cyber infrastructure a legitimate military objective. In order to avoid serious repercussions for the civilian population that might follow from this inherent interconnectedness, different concepts are analysed that could provide potential solutions for a clearer separation of legitimate military targets and protected civilian installations and networks. The approaches discussed range from the exemption of central cyber infrastructure components that serve important civilian functions, to the creation of ‘digital safe havens’ and possible precautionary obligations regarding the segregation of military and civilian networks. As a solution, the authors propose a dynamic interpretation of the wording ‘damage to civilian objects’ within the principle of proportionality of Article 51(5)(b) of Additional Protocol I, an interpretation that would comprise the degradation of the functionality of systems that serve important civilian functions.