Cyber war and international law

Wars and armed conflicts are becoming increasingly digital phenomena. Battles in the past have been mainly physical, but states and armed groups are increasingly using the cyber domain as a war scene similar to land, air and sea. This requires major changes in how states and groups view warfare - but it has also raised the question of how international law should be applied to cyber-attacks.

 

International law is a broad area consisting of a number of intergovernmental laws and agreements. These include space, maritime and environmental law, regulations on diplomatic relations and human rights. Of course, the cyber domain overlaps large parts of international law. This also applies to international humanitarian law, which regulates how warring parties may act in an ongoing war.

International humanitarian law is important for cyber issues insofar as digital weapons or tools are used in warfare. In this age of technology where everything is digitizing, there comes a huge responsibility of every IT services company to provide best cyber security to the clients. It already occurs today to some extent, and then often for the purpose of putting systems out of play to reduce the opponent's ability to act. At the same time, there is also a fear that the damage from the attacks that we see today is only a foretaste of more obvious physical damage that may affect civilians and objects in the future. International humanitarian law provides these persons and objects with protection from attacks in the physical world and, according to most relevant actors, also in the context of cyber-attacks.

 

It is a matter of fact that the relatively new cyber issues have not yet fully found their place in how the states (the main actors in international law) choose to apply international law. There is almost a consensus that its current rules should apply - state and intergovernmental actors such as the Swedish Ministry of Foreign Affairs, the EU, NATO, the UN and the International Court of Justice in The Hague have all expressed in different ways that international law also applies in the cyber field. The International Committee of the Red Cross, which has a special position among non-state actors in international humanitarian law, also believes that existing laws written for physical warfare should also apply to the cyber field.

 

The issues that are or will be relevant are thus rather about how to take the international legal framework that consists of international law and apply it in an area that in many ways differs from conventional warfare. In international humanitarian law, therefore, there are a number of unresolved challenges that the states of the world will need to resolve.

 

To begin with, cyber warfare involves even greater difficulties in terms of attribution that is, attributing crimes committed to a perpetrator, than conventional warfare. A cyber-attack can be designed in a way that makes it difficult to determine whether the sender is actually the actor the tracks are pointing to. This makes it difficult to introduce proportionate countermeasures or to bring those responsible to justice so at this time when no proper tracing technology is available and even no proper law is designed to punish the attackers here come the responsibility of IT consulting firms to make their defense as strong as possible. Proportional countermeasures and cyber-self-defense are another difficult issue. A debate that has arisen in the wake of the cyber domain becoming a war scene, among others, is whether physical violence as self-defense after an initial cyber-attack can be considered proportionate. As I said, cyber-attacks can cause physical damage to people and objects - can an attacked actor use physical force to defend himself and claim that it is to respond with the same coin? If so, what level should physical violence be applied to?

 

International humanitarian law applies only in an armed conflict, which means drawing a line between peace and war. It is also something that is easier said than done in conventional warfare and it only becomes more difficult when cyber warfare is involved. The very idea of   a cyber-attack can be to carry out operations to get an opponent where you want to go but without triggering an armed conflict. Using the cyber domain thus provides opportunities to avoid the very situation that activates international humanitarian law. Nevertheless, the rules of the jurisdiction are considered to apply. How to decide if a war is going on, and when these laws are activated, thus becomes a difficult nut to crack for the future.

 

The distinction between civilian and military is central to international humanitarian law. In order for an attack to be considered in accordance with international law, the attacking party needs to ensure that the target is military and that civilian casualties are minimized. Civilian persons or objects may never be the target of an attack, but certain civilian injuries are allowed if they are in proportion to the military benefits of the attack. For this to work, the parties must separate military and civilian persons and objects, so that civilians do not in practice become human shields against attacks from other parties. In theory and in the physical world, it is probably so difficult to determine such distinctions. The potential consequences in the cyber field are even greater, as civilian and military use of cyber infrastructure overlaps, and vital civilian systems share much the same hardware and software as the military. Should the demarcation between civilian and military thus change with the digitalization of the war, it could have devastating consequences for one of the most important principles of international humanitarian law on the protection of civilians.

 

Finally, one must also relate to the indirect effects of the means used in the cyber arena. Autonomous systems, which use AI to attack either physical targets or cyber targets, will also have technical vulnerabilities that can be exploited by another actor. Thus, the points of contact between cyber and autonomous weapons become many and the consequences of attacks are great.