Cyberconflict and the Geneva Convention

We shouldn’t forget that cyberwar is war. People can get hurt and it has a very real impact on military strategies. Conflict in general is governed by the Geneva convention and other international agreements. Is cyber conflict similarly regulated? We asked Heather Harrison-Dinnis from the International Law Centre of the Swedish National Defence College...

Heather - The basic answer is yes, it is. And the vast majority of states agree that the law of armed conflict applies to cyber operations exactly the same as it applies to other operations. There are a handful of states who disagree with that and those states include China and Russia. The easy part is saying that the principle of distinction (that you have to distinguish between military objectives on the one hand and civilian objects on the other, and only target military objectives) it's easy enough to say, "Well, that applies whether it's bombs, whether it's bullets, whether it's bitstreams," but the more difficult part of that is saying, "Well what amounts to an attack in cyberspace, how does that part work? Is it that you have to cause physical damage? Or is it enough that you just take it offline for a while?"

Robert - How is that differentiation typically done?

Heather - We have this sort of definition of what a military objective is: something that by its nature, purpose, or use offers a definite advantage, and the second part is its neutralisation offers you the advantage. Something by its nature, for example, would be a military communications network - it's military by nature, therefore it's a military objective. We define civilian objects in the law as anything that is not a military objective. GPS is dual use: it's a military satellite system but it's used so heavily by civilians. The trick with that, though, is that just because something is a military objective doesn't automatically mean that you can target it. There are other principles such as principle of proportionality, which says that you need to take into account the effect that it will have on civilians.

Robert - Are there any objects which are specially protected? I'm thinking, in traditional warfare, medical facilities and medical staff enjoy internationally recognised protection. Does the same hold for cyber objectives?

Heather - Absolutely. And those special protections also extend to what we call installations containing dangerous forces. Those are dams, dykes and nuclear power generating systems which are of particular interest.

Robert - Are cyber weapons that precise?

Heather - To be honest, it's one of the beauties of cyber weapons. They can be incredibly discriminate. It would be unlawful to craft a piece of code that could not distinguish - there are other pieces of malware out there (that's malicious software) that we've seen rampaging through the internet that really just don't care whether it's a military computer or a civilian computer, it just tries to spread as much as it can. There's also a distinction in relation to people and, again, it's this broad distinction between the fact you can target those who are fighting - combatants, members of the armed forces of the state - but also civilians who are directly participating in hostilities. I think that's something that people need to bear in mind because what we are seeing in these conflicts, and as we've seen over the past few days, people come out and say, "Well, I'm hacking in support of Russia", or "I'm hacking against Russia," people do need to bear in mind that if you are actively participating in hostilities, you become a lawful target.

Robert - So, sitting behind your computer and attacking in cyberspace is legally similar to taking up arms and attacking in the real world? Is that what you're saying?

Heather - That's what I'm saying. I would also point out there is nothing in the law that says that you have to be targeted in the same manner that you were targeting others. Bottom line: even if you hack, you could still be shot.