How international law applies to the use of information and communications technology by States is still a matter of discussion. Against this background, cyberspace has become the main area of competition between States, and this competition, to put it simply, is resulting in a constant low-intensity warfare below the threshold for a use of force. Such low-intensity cyber warfare, from a legal point of view, revitalizes the debate over the concept of a “state of intermediacy” that has the potential to overcome the dichotomy between peace and war. In the present author's opinion, this state of intermediacy also supports the idea that the international humanitarian law (IHL) principle of distinction should be applied, even before the eruption of a full-scale war, whenever wartime means and capabilities are employed by States. This paper argues that some opacities in international law have created favourable conditions for such constant low-intensity warfare, and that tackling the identified opacities would therefore be beneficial in order to achieve a more peaceful cyberspace. Thus, the paper goes on to address one of the identified opacities, namely the definition of espionage under international law, because, as international law now stands, it does not allow us to tackle the other identified opacities. Finally, the paper discusses how the proposed narrow interpretation of espionage can cope with the IHL principle of distinction in the cyber domain.

This article adopts a critical approach towards scholarship seeking to identify binding due diligence obligations for States in cyberspace. The article demonstrates that due diligence obligations are anchored in specific primary rules and are not a universal standalone source from which it is possible to derive binding obligations for all areas of activity. The consensus position of States in United Nations fora clearly determines that due diligence in cyberspace is a voluntary, non-binding norm of responsible State behaviour, and there is currently insufficient State practice and opinio juris to support the development of a customary rule containing binding due diligence obligations in cyberspace. Consequently, the article concludes that attempts to establish binding due diligence obligations in cyberspace constitute lex ferenda that may be understood as an interventionist attempt by scholars to fill what they perceive to be dangerous legal gaps.

This article argues that the growing involvement of civilians in activities on the digital battlefield during armed conflicts puts individuals at risk of harm and contributes to the erosion of the principle of distinction, a cornerstone of international humanitarian law (IHL). The article begins by outlining the ongoing trend of civilianization of the digital battlefield and puts forward brief scenarios to illustrate it. It then examines the narrow circumstances under which such forms of civilian involvement may qualify as direct participation in hostilities under IHL, and discusses what this means for the individuals concerned, particularly from the perspective of their loss of protection under the law. The analysis shows that certain types of State conduct which put civilians in harm's way by inducing them to directly participate in hostilities may constitute standalone violations of IHL and human rights law obligations. Beyond these specific prescriptions, the encouragement of civilian involvement undermines the principle of distinction, with dangerous ripple effects on the interpretation of those rules of IHL that flow from it. Accordingly, the article concludes that States should act to reverse the trend of civilianization of the digital battlefield and refrain as much as possible from involving civilians in the conduct of cyber hostilities.

Digitalization and new technologies have an increasingly important role in today's humanitarian activities. As humanitarian organizations become more active in and reliant on new and digital technologies, they evolve from being simple bystanders to being fully fledged stakeholders in cyberspace, vulnerable to adverse cyber operations that could impact on their capacity to protect and assist people affected by armed conflict or other situations of violence.

This shift makes it essential for humanitarian organizations to understand and properly map their resulting cyber perimeter. Humanitarian organizations can protect themselves and their activities by devising appropriate cyber strategies for the digital environment. Clearly defining the digital boundaries within which they carry out operations lays the groundwork for humanitarian organizations to develop a strategy to support and protect humanitarian action in the digital environment, channel available resources to where they are most needed, and understand the areas in which their operational dialogue and working modalities need to be adapted for cyberspace.

The purpose of this article is to identify the unique problems facing international humanitarian organizations operating in cyberspace and to suggest ways to address them. More specifically, the article identifies the key elements that an international humanitarian organization should consider in developing a cyber security strategy. Throughout, the International Committee of the Red Cross and its specificities are used as an example to illustrate the problems identified and the possible ways to address them.

The use of cyber operations during armed conflicts and the question of how international humanitarian law (IHL) applies to such operations have developed significantly over the past two decades. In their different roles in the Legal Division of the International Committee of the Red Cross (ICRC), the authors of this article have followed these developments closely and have engaged in governmental and non-governmental expert discussions on the subject. In this article, we analyze pertinent humanitarian, legal and policy questions. We first show that the use of cyber operations during armed conflict has become a reality of armed conflicts and is likely to be more prominent in the future. This development raises a number of concerns in today's increasingly cyber-reliant societies, in which malicious cyber operations risk causing significant disruption and harm to humans. Secondly, we present a brief overview of multilateral discussions on the legal and normative framework regulating cyber operations during armed conflicts, looking in particular at various arguments around the applicability of IHL to cyber operations during armed conflict and the relationship between IHL and the UN Charter. We emphasize that in our view, there is no question that cyber operations during armed conflicts, or cyber warfare, are regulated by IHL – just as is any weapon, means or methods of warfare used by a belligerent in a conflict, whether new or old. Thirdly, we focus the main part of this article on how IHL applies to cyber operations. Analyzing the most recent legal positions of States and experts, we revisit some of the most salient debates of the past decade, such as which cyber operations amount to an “attack” as defined in IHL and whether civilian data enjoys similar protection to “civilian objects”. We also explore the IHL rules applicable to cyber operations other than attacks and the special protection regimes for certain actors and infrastructure, such as medical facilities and humanitarian organizations.

Armed reprisals are the limited use of military force in response to unlawful actions perpetrated against states. Historically, reprisals provided a military remedy for states that had been wronged (often violently) by another state without having to resort to all-out war in order to counter or deter such wrongful actions. While reprisals are broadly believed to have been outlawed by the UN Charter, states continue to routinely undertake such self-help measures. As part of the roundtable, “The Ethics of Limited Strikes,” this essay examines the doctrine of armed reprisals in light of recent instances of states using force “short of war” in this manner. We argue that the ban on reprisals has been largely ignored by states, and that recent attempts to apply the laws of armed conflict to the cyber domain (such as the Tallinn Manual) are further weakening this prohibition. We conclude that this is a potentially dangerous development that lowers the bar for resorting to military force, risking escalation and thereby further destabilizing the international system.

As a general matter, international humanitarian law is up to the task of providing the legal framework for cyber operations during an armed conflict. However, two debates persist in this regard, the resolution of which will determine the precise degree of protection the civilian population will enjoy during cyber operations. The first revolves around the meaning of the term “attack” in various conduct of hostilities rules, while the second addresses the issue of whether data may be considered an object such that operations destroying or altering it are subject to the prohibition on attacking civilian objects and that their effects need be considered when considering proportionality and the taking of precautions in attack. Even if these debates were to be resolved, the civilian population would still face risks from the unique capabilities of cyber operations. This article proposes two policies that parties to a conflict should consider adopting in order to ameliorate such risks. They are both based on the premise that military operations must reflect a balance between military concerns and the interest of States in prevailing in the conflict.

The most significant debate regarding the applicability of international humanitarian law to cyber operations involves interpretation of the rules governing cyber “attacks”, as that term is understood in the law. For over a decade, the debate has been a binary one between advocates of the “permissive approach” developed by the author and a “restrictive approach” championed by those who saw the permissive approach as insufficiently protective of the civilian population and other protected persons and objects. In this article, the author analyses that debate, and explains a third approach developed during the Tallinn Manual project. He concludes by suggesting that the Tallinn Manual approach best approximates the contemporary law given the increasing value which societies are attributing to cyber activities.