I. Introduction
In the age of the industrial revolution, every area of the world is developing non-stop, so as the means and method of warfare. On the contrary, the law does not grow at such a level. The Geneva Conventions governing armed conflict was 1949 when a computer or internet was never heard of, so it is not comprehensive enough to cover the emergence of cyber warfare, which cannot keep the pace of the 21st world’s evolution where technology has become the core practice in almost every sector. The advent and expansion of the internet are ubiquitous until it is used to control weapon use and monitor on nation’s security. Anything with an internet interface is vulnerable to cyber attack from anywhere. There is no exact finding on when the cyber attack was conducted. However, the first significant cyber attack known as Morris worm — rapidly infected the limited computers connected to the internet[1] — was found in 1988.[2] However, the prominent and first cyberwar was found in Russian v. Georgia [3] in 2008 [4] because this cyber operation happened further through that armed conflict. It is estimated that more than 100 states have developed — or are developing — military cyber capacities.[5] Since it is a new concern, the applicability of international humanitarian law (“IHL”), specifically the Geneva conventions — one of the IHL sources besides custom and general principle of law [6] — is in question.
This paper contains three sections. First, it provides whether or not cyber warfare is considered an attack (Part II). Second, it states the applicability of the Geneva conventions (Part III). Lastly, the conclusion regarding the legal issue (Part IV).
II. Is Cyberwarfare considered an “attack”?
The term “attack” is defined in Article 49 of Additional Protocol I as “acts of violence against the adversary, whether in offense or defense.” Basically, we all understand that an attack would be in a physical form or physical force as it can be seen realistically and on the battlefield. The consequence of an operation, not its nature, determines the scope of the term attack.[7] It corresponds with the sense of violent consequences, which is not limited to violent acts. Some acts like cyber attack seem not violent, but its consequence does.
Turning to the cyberattack, cyberspace should be considered a sui generis battlefield when it comes to the study of applicable law. [8] A term “cyber attack” is generally defined as a new form of attack on computerized information systems to alter, destroy, steal data, and exploit or malfunction a network.[9] Although the exact term is not stipulated under Geneva Conventions, there are many legal interpretations and implications on cyber attack. The International Committee of the Red Cross (“ICRC”) provides the definition within the context of IHL as means and methods of warfare that consist of cyber operations conducted in the context of an armed conflict.
With the combination of the case decision, book, and military manual, a cyber-attack is an attack[10] which is considered as an act of violence, against the adversary,[11] that are reasonably expected to cause damage or destruction to objects.[12] It can be implied that the character of the attack matters, but the consequence of said attack more matters. From this implication, it shared the common ground with the definition of cyberattack provided by the legal publicist — Michael N. Schmitt, he stated that “cyber attacks are those cyber operations that result, or could result, if unsuccessful, in death or injury to individuals or destruction or damage to objects”.[13] When an attack is carried out in cyberspace against one state, it can affect many others. Here are some basic examples of cyber warfare.
Hit the computers and…blackout the airport or the power station in no time as its consequence. [B]ank balance may be dropped to zero and later unexpectedly leaps up, showing that one has got millions of dollars in the account. [T]he stock prices get moving crazy as the hackers tend to alter data coming into the stock exchange […]. Even trains aren’t even running on time because the signaling system is jammed and that also stops working, and no one even can drive anywhere as the traffic lights are all wedged on red […].[14]
In Ukrainian Power Grid case, the electricity was hacked and blacked out in the capital of Ukraine. This cyber-attack can affect directly and indirectly to the civilians. Once again, the term “attack” does not mean it is physical force. Contaminating a well or water resource would be qualified as an attack. Likewise, opening the water gate to physical harm to the civilian population is also considered an attack. In addition, starving a civilian population to death or causing them physical or mental suffering would again be constituted as an attack. These scenarios are commonly accepted as attacks because of the consequence-based approach. Therefore, a cyber-attack is constituted as an attack.
III. The Applicability of Geneva Conventions
The fact that the Geneva Conventions are not specifically addressed, does not automatically mean that it is outside the scope of the laws of war [15] or that cyber attacks can be launched without any restrictions. To consider the applicability of IHL, first, it requires cyberwarfare to be an attack. As it is demonstrated above as an attack, it also needs to consider the prerequisite elements which the conduct is in the context of and associated with the nature of the armed conflict because IHL is only applicable during armed conflict. In addition, there must be a nexus between the cyber warfare in question and the conflict for the IHL to apply to such an act. Supposing the cyber-attack is conducted in the absence of war, the Geneva Conventions are not applicable. As an example, Estonia was the target of ongoing cyber operations, but the IHL was not applicable because the situation did not reach the threshold of an armed conflict.[16] Even a cyber-attack is conducted during the armed conflict, it is not applicable when such conduct is not associated with armed conflict. The ICRC provides an interpretation on armed conflict as “any difference arising between two states and leading to the intervention of members of armed forces, even if one of the parties denies the existence of a state of war.”[17]
An armed conflict consists of international armed conflict (IAC) and non-international armed conflict (NIAC). An IAC exists when there is a resort to armed force against another state,[18] but at this point, when it reached in situations involving cyber operations without resorting armed force against another state without physically damaging military or civilian infrastructure, so is IHL applicable? That remains unclear.[19] According to the Geneva Conventions, Common Article 2, “occupation that meets no armed resistance also qualifies as armed conflict despite the absence of hostilities.” It can be implied that the conduct of cyber-warfare is also considered as armed conflict despite the absence of armed force or physical damage to civilians or infrastructure. With the support from several international groups of experts,[20] they are unanimous in finding that the IHL applies to both IAC and NIAC [21] even though the absence and ambiguous rules within the IHL.
“For the ICRC, there is no question that IHL applies to, and therefore limits, cyber operations during armed conflict — just as it regulates the use of any other weapon, means, and methods of warfare in an armed conflict, whether new or old.”[22]
As there are many explicit explanations and positions on the applicability of Geneva conventions on cyber warfare, it is still difficult to apply when cyber warfare is conducted by the veil of secrecy.
Thereby, Eitan Diamond — the ICRC Delegation in Israel and the Occupied Territories — provides some considerations for the compatibility with IHL such as “(a) the technology available, (b) the attacks conducted, © the identity of the parties conducting the attacks, and (d). the policies, guidelines, and rules that states apply in relation to cyber warfare, along with their reading of the applicable rules of IHL”. [23]
IV. Conclusion
Every new technology presents the possibility of new weapons and warfare tactics, which countries hope will yield a definite advantage and not hold liability. Albeit the long-established rule of Geneva Conventions, cyberwarfare is still within the scope defined by these conventions. Even cyber warfare directed at computers rather than humans, such operations could cause a tremendous degree of human suffering in an indirect way. Imagine that Geneva Conventions do not govern cyberwarfare; the consequence would be a disaster for humanity. Thereby, the Geneva Conventions govern cyber warfare like many modern weapons are not mentioned in IHL, but nonetheless, state parties agree that they are covered.
[1] Security Encyclopedia, What is the Morris worm? 5 Things to Know [Hypr, https://www.hypr.com/morris-worm/.]
[2] Mohan B. Gazula (2017), Cyber Warfare Conflict Analysis and Case Studies [Massachusetts Institution of Technology, Working Paper CISL# 2017–10], pp. 23.
[3] Max Gordon (2015), Lessons From The Front: A Case Study Of Russian Cyber Warfare [Air Command And Staff College Air University, AU/ACSC/2015], pp.12.
[4] The Nato Cooperative Cyber Defence Center of Excellence (2013), Tallinn Manual On The International Law Applicable To Cyber Warfare [Cambridge University Press, http://csef.ru/media/articles/3990/3990.pdf], pp. 68.
[5] Tilman Rodenhäuser (2021), Cyber Warfare: does International Humanitarian Law apply? [ICRC, https://www.icrc.org/en/document/cyber-warfare-and-international-humanitarian-law]
[6] Nels Melzer (2019), International Humanitarian Law — A Comprehensive Introduction [ICRC, https://library.icrc.org/library/docs/DOC/icrc-4231-002-2019.pdf], pp.21.
[7] The Nato Cooperative Cyber Defence Center of Excellence (2013), Tallinn Manual On The International Law Applicable To Cyber Warfare [Cambridge University Press, http://csef.ru/media/articles/3990/3990.pdf], pp. 92.
[8] Mavropoulou, E. (2015), Targeting in the Cyber Domain: Legal Challenges Arising from the Application of the Principle of Distinction to Cyber Attacks [Journal of Law & Cyber Warfare, http://www.jstor.org/stable/26441253], pp.23.
[9] Diamond, E. (2014), Applying International Humanitarian Law to Cyber Warfare [Institute for National Security Studies, http://www.jstor.org/stable/resrep08957.8], pp.67.
[10] Nathan Alexander Sales (2013), Regulating Cyber-security [Northwestern University Law Review 107 Nw. U. L. Rev. 1503, https://scholarlycommons.law.northwestern.edu/nulr/vol107/iss4/1], pp. 1523
[11] Additional Protocol I, Art.49(1).
[12] Tallinn Manual on the International Law Applicable to Cyber Warfare, Rule 30.
[13] Michael N. Schmitt (2012), “Attack” as a term of Art in International Law: The Cyber Operation Context, [The 4th International Conference on Cyber Conflict, https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2184833], pp.291.
[14] Mukherjee Sourav (2019), Cyber Warfare and Implications, [SSRN, http://dx.doi.org/10.2139/ssrn.3431676].
[15] Döge, Jenny (2010), Cyber Warfare. Challenges for the Applicability of the Traditional Laws of War Regime [Archiv Des Völkerrechts 48, no. 4, http://www.jstor.org/stable/25782613.], pp.489.
[16] The Nato Cooperative Cyber Defence Center of Excellence (2013), Tallinn Manual On The International Law Applicable To Cyber Warfare [Cambridge University Press, http://csef.ru/media/articles/3990/3990.pdf], pp. 68.
[17] ICRC Commentary, Article 2, para.1, pp.20.
[18] ICTY, Prosecutor v. Tadic, Decision on the defense motion for interlocutory appeal on the jurisdiction, 2 October 1995, ¶70.
[19] Tilman Rodenhäuser (2021), Cyber Warfare: does International Humanitarian Law apply? [ICRC, https://www.icrc.org/en/document/cyber-warfare-and-international-humanitarian-law]
[20] See The NATO Wales Summit Declaration (2014), para. 72; See also Developments in the Field of Information and Telecommunications in the Context of International Security (2014) [Report of the Secretary General, at 2, UN Doc. A/69/112 (Australia)]; Developments in the Field of Information and Telecommunications in the Context of International Security (2013) [Report of the Secretary General, at 15, UN Doc. A/68/156 Add. 1 (Japan)]; European Union (2013) [Conclusions, General Affairs Council Meeting, Doc. 11357/13].
[21] Schmitt, M. (2017), The law of cyber armed conflict. In Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations [Cambridge: Cambridge University Press], pp.373.
[22] ICRC (2019), International Humanitarian Law and the Challenges of Contemporary Armed Conflicts [ICRC, 33IC/19/9.7, https://rcrcconference.org/app/uploads/2019/10/33IC-IHL-Challengesreport_EN.pdf.], pp.18
[23] Diamond, E. (2014), Applying International Humanitarian Law to Cyber Warfare [Institute for National Security Studies, http://www.jstor.org/stable/resrep08957.8], pp.70.
