By: Michael Schmitt. First Published at EJIL: Talk!
In the first part of this post I discussed the position paper’s articulation of the views of France on the applicability of IHL to cyber operations, on the classification of armed conflicts, and on their geographical scope in the cyber context. In this part I will examine the position paper’s views on the concept of “attack,” on the conduct of hostilities and on data as an object.
The Meaning of the Term “Attack”
The issue of the meaning of the term “attack” has occupied center stage from the very inception of legal thinking about cyber operations during an armed conflict. It is a critical one because most key IHL “conduct of hostilities” rules are framed in terms of attacks – it is prohibited to direct “attacks” against civilians or civilian objects (distinction), an “attack” expected to cause collateral damage that is excessive to the anticipated military advantage is prohibited (proportionality), parties must take precautions in “attack” to minimize harm to civilians (precautions in attack), etc. These prohibitions, limitations, and requirements beg the question of when a cyber operation qualifies as an “attack” such that the rules govern it.
Article 49(1) of AP I defines attacks as “acts of violence against the adversary, whether in offense or defence.” This restatement of customary law is universally understood as including acts against both the adversary and civilians. The critical issue is what is meant by “violence” in the cyber context.
The French position paper highlights the AP I definition and develops it with respect to cyber operations. For France, a cyber operation that does not cause injury or physical damage is nevertheless an “attack” if it causes the targeted system to fail to operate as intended, that is, if it loses its intended functionality. These effects may be permanent or temporary. Permanent effects always qualify an operation as an attack. Temporary effects also suffice if they require repair, replacement of parts, reinstallation of network software and the like. This view is highly defensible as a matter of law, for the plain meaning of damage reasonably extends to systems that do not operate as intended and require some form of repair to regain functionality.
France correctly notes that most cyber operations conducted during an armed conflict do not rise to the level of an attack. It offers the example of a denial of service cyber operation interfering with the enemy’s governmental propaganda capability. As this operation is only temporary and requires no repair, it would not be an attack, as the term is understood in IHL, and therefore would not be governed by applicable IHL rules irrespective of whether the target qualifies as a military objective.
Importantly, the position paper cautions that even when a cyber operation does not amount to an attack it remains subject to applicable IHL provisions. The document offers no examples, but the cautionary note is an important reminder that irrespective of whether a cyber operation is an attack as a matter of law, certain cyber infrastructure, such as medical systems, may not be made the object of a cyber operation. The position paper may also be referring to the Article 57(1), AP I, requirement to take “constant care…to spare the civilian population, civilians and civilian objects” “[i]n the conduct of military operations.” Although there is some debate as to whether the provision applies to operations not qualifying as an attack, I am of the view that it does and therefore would govern such cyber operations when, as suggested in the ICRC’s commentary to the article, they are “carried out by the armed forces with a view to combat.” As an example, it would encompass denial of service cyber operation against enemy satellites intended to degrade their communications of intelligence, surveillance, and reconnaissance capabilities.
Unfortunately, the paper asserts that France deviates from the definition of “attack” found in Tallinn Manual 2.0. In doing so, it misapplies the Manual.
In fact, the French view was put forth by the majority of the IGE. As the Manual carefully points out, the numbered rules represent text upon which all the participating Experts agreed – it constitutes the least common denominator of positions. In this case, there was consensus, expressed in Rule 92, that any cyber operations causing injury or death to persons or damage or destruction to objects qualifies as an attack. But a large majority of the Experts also agreed that interference with the functionality of cyber infrastructure amounted to damage for the purpose of the rule. Of these, all agreed that if physical repair of the system was needed, as in replacement of components, the causal cyber operation amounted to an attack. Still others went further and were of the view that if the operation necessitated reloading the operating system or essential data upon which the intended function of the system relied, an attack had occurred. Thus, the French position mirrors that of the majority of the IGE.
The Conduct of Hostilities and Data as an “Object”
With respect to the rules governing the conduct of hostilities, the French position paper usefully catalogues most rules, confirming their direct applicability to cyber attacks and, in certain cases, other cyber operations. For instance, it notes, inter alia, that cyber operations may not be indiscriminate (they must capable of being aimed and be aimed at a military objective, and their effects must be controllable); adopts the standard definition of military objectives found in AP I, Article 52(2), and acknowledges that dual use cyber targets (cyber infrastructure used for both military and civilian purposes) are military objectives; requires that all feasible measures be taken to identify the targeted cyber infrastructure as a military objective; mandates the careful selection of means of warfare and targets in order to minimize harm to civilians while achieving the desired military effect; emphasizes that certain property is specially protected from cyber attack, including cultural property, the environment (France is bound by AP I’s protections of the environment, but expresses no view on whether the protections are customary, as the United States claims they are not), objects indispensable to the civilian population, and medical facilities; and notes that parties to a conflict have a duty to take “passive precautions” to protect the civilian population against the dangers that might result from cyber operations (although no illustrative measures are cited, redundancy of civilian systems/data and separating civilian and military networks are typical examples). It accurately observes that data necessary for delivery of protected services is protected, a position that earlier had been taken by the Tallinn Manual 2.0 IGE.
This raises the complex and troublesome issue of data as an “object.” IHL protects civilian objects from attack. There is wide consensus, with which France surely agrees, that the deletion or alteration of data resulting in a loss of functionality as described above qualifies as an attack on the cyber infrastructure concerned and, if it is civilian in character, is unlawful. The question is whether an operations having effects on the data itself, without a knock-on effect on tangible objects, qualifies as an attack on an “object.”
This issue divided the Tallinn Manual 2.0 IGE and remains unresolved in the broader international law community. The dilemma is that if data is an object, it would seem to rule out, for instance, cyber psychological operations that alter, destroy, or replace, civilian data, as in manipulating an on-line newscast feed or altering a podcast. There is a long history of operations with similar effects being undertaken by non-cyber means. Indeed, psychological operations directed at the civilian population have been a feature of warfare for centuries. Many militaries are unlikely to be comfortable forgoing this useful tool, for the position will be seen as affording too little weight to the military factor in the balancing of military necessity and humanitarian considerations that undergirds IHL.
On the other hand, if data is not an object, civilian data would be wholly unprotected, thereby opening the door to cyber operations against data the loss of which would be highly disruptive for the civilian population, such as banking data, tax records and social services data. To open the door this wide would be to undervalue humanitarian considerations in the aforementioned balancing.
France has taken the former position. It is of the view that in light of the current dependence of societies on digital information, data is protected pursuant to the principle of distinction. Examples cited include civil (governmental) data, banking data, and medical data, although the last would be protected in any event. Importantly, the position paper focuses on so-called “content data,” an approach championed by Heather Harrison-Dinniss, presumably leaving cyber operations that target data upon which the functionality of cyber infrastructure depends (“program data”) to be dealt with through consideration of the effect on the infrastructure itself, as discussed above.
It will be interesting to see how the French approach plays out in “combined” operations conducted with other States that either may wish to target content data that does not qualify as a military objective or that simply treat data as lying outside the plain meaning of the term “object,” which tends to denote something tangible. In my view, both approaches are sensible interpretations of the law – and both have unacceptable consequences with respect to the military necessity-humanitarian considerations IHL balancing.
Perhaps the better approach to both the “attack” and “data as an object” conundrums is to, as I recently have suggested elsewhere, adopt two new policies, that over time may mature into law. The first would “accord special protection to certain ‘essential civilian functions or services’ by committing to refrain from conducting cyber operations against civilian infrastructure or data that interfere with them.” For situations not reached by this policy, States would commit to “refraining from conducting cyber operations to which the IHL rules governing attacks do not apply when the expected concrete negative effects on individual civilians or the civilian population are excessive relative to the concrete benefit related to the conflict that is anticipated to be gained through the operation.”
The French position paper also found reason to expressly question the findings of the Tallinn Manual 2.0 IGE with regard to the issue of doubt. There is general agreement that in case of doubt as to the status of an individual (e.g., combatant or civilian in an IAC), the person is to be considered a civilian. However, most cyber operations will target cyber infrastructure (or through an effect on them, the objects upon which they rely). Article 52(3) of AP I provides that if there is doubt as to whether an object of a type normally dedicated to civilian purposes is a military objective under IHL, it shall be considered to be civilian in character. France takes exactly this position with respect to cyber attacks.
By contrast, the corresponding Tallinn Manual 2.0 rule, as highlighted in the French position paper, provides that cyber infrastructure falling into this category may only be attacked “after careful consideration.” It did so because not all countries, and in particular the United States, agree that Article 52(3) reflects customary law. Accordingly, some members of the IGE hesitated to set forth a Tallinn Manual 2.0 rule that would purport to bind non-Parties to AP I.
Yet, again, the position paper misinterprets the substantive significance of the Tallinn Manual 2.0 rules. As noted in the accompanying commentary to the rule, a majority of the Experts, of which I was one, were of the view that the AP I rule restates customary law and thus was in complete agreement with the French position. The only reason that the text of the rule does not reach that far is because unanimity could not be achieved on the matter. So, in fact, the Tallinn Manual 2.0 text is strong support for the French position.
A final point of interest with respect to the French position paper is its treatment of targetable individuals. It notes that military personnel who have cyber duties, groups of hackers placed under the command of the State, and members of organized armed groups who engage in cyber operations, may be targeted. No one would doubt this is the case, but the reference to members of an organized armed group who conduct operations against the adversary suggests that France has embraced the “continuous combat function” criterion proposed by the ICRC, but rejected by some States, including the United States, as well as many scholars and practitioners, including myself. By the ICRC view, those members not having a regular combat function in the group, which would encompass individuals conducting many cyber operations, would only be targetable while they nevertheless “directly participate in hostilities.” The competing view is that all members of an organized armed group are targetable by cyber or kinetic means.
Civilians who are not targetable based on their status may only be attacked for so long as they are directly participating in hostilities (see here and here). The French explanation is rather cautious in this regard, citing such examples as installing malicious code, preparing a botnet to launch a denial of service attack, and developing malware for perpetration of a specific hostile act. In my view, direct participation in hostilities is in fact a rather broad term that encompasses not only conducting attacks, but engaging in most cyber operations, such as probing for vulnerabilities to exploit or monitoring cyber traffic of potential tactical or operational level intelligence value. Since there is no bright line test for determining whether a particular cyber activity is “direct enough” to qualify as direct participation, and the issue has generated some controversy, it is unclear whether France is taking a restrictive approach in this regard, as the ICRC has done in the non-cyber context, or has simply elected to include examples about which there can be no disagreement.
Concluding Thoughts
As in my Just Security post on the peacetime aspects of the French position paper, I applaud France for having taken the lead in issuing what is the most in-depth statement by any State on how IHL applies to cyber operations conducted during armed conflicts. In most cases, France has arrived at conclusions with which most States and commentators are likely to agree, and that are consistent with the work of the Tallinn Manual 2.0 IGE. In a few cases, the conclusions deviate from those I support; yet in no case was that deviation unreasonable or unsupportable. The document is a sophisticated analysis that will hopefully inspire more States to issue their own positions, for in no situation is it ever more important to have clear rules of the game than in combat.