{"id":34683,"date":"2022-05-05T11:17:53","date_gmt":"2022-05-05T09:17:53","guid":{"rendered":"https:\/\/humanrights-online.org\/pravo-vojny-v-cifrovuju-jepohu-ili-kogda-kiberataka-stanovitsja-voennym-prestupleniem\/"},"modified":"2022-05-05T12:31:58","modified_gmt":"2022-05-05T10:31:58","slug":"law-of-war-in-a-digital-age-or-when-is-a-cyberattack-a-war-crime","status":"publish","type":"post","link":"https:\/\/humanrights-online.org\/uk\/law-of-war-in-a-digital-age-or-when-is-a-cyberattack-a-war-crime\/","title":{"rendered":"Law of war in a digital age or when is a cyberattack a war crime?"},"content":{"rendered":"

Law of war in a digital age or when is a cyberattack a war crime?<\/h1>\n
\"\"

Cyberattacks on critical infrastructure, such as power plants or telecommunication networks, can cause real harm to ordinary people. Attacks against civilians may under international humanitarian law amount to war crimes. (Source photo by Reuters)\u00a0 <\/span><\/p><\/div>\n

 <\/p>\n

The damage caused by cyberattacks in the war in Ukraine pales in comparison with the atrocities of the fighting on the ground. But that does not mean it is not happening, or that civilians are spared.<\/p>\n

 <\/p>\n

On February 24, the day Russia launched its invasion of Ukraine, a cyberattack targeting the KA-SAT satellite internet service disrupted Ukraine\u2019s military communications. The attack, which United States officials attributed toExternal link<\/span><\/a> Russia\u2019s military spy agency, spread further than Ukraine\u2019s borders. It left tens of thousands of people across Europe, from France to Ukraine, without internet access. Some 2,000 wind turbines in Germany remained offlineExternal link<\/span><\/a> a month after the attack.<\/p>\n

A day later, a border control station between Ukraine and Romania was hitExternal link<\/span><\/a> by a data-wiping malware \u2013 a malicious software \u2013 that slowed the processing of refugees seeking to flee the country. The authors of that attack remain unknown.<\/p>\n

These are two of the 35 significant cyberattacks against critical and civilian infrastructure in Ukraine that the CyberPeace Institute, a Geneva-based NGO, has recorded on its websiteExternal link<\/span><\/a> since the start of the war. Bruno Halopeau, the organisation\u2019s chief technology officer and head of cyber analysis, says that although most of the attacks targeted military objectives, public institutions, and the media, civilians were \u2013 intentionally or not \u2013 affected too.<\/p>\n

Attacks against civilians may under international humanitarian law (IHL) amount to war crimes.<\/p>\n

\u201cWe monitor the situation and collect evidence so that if at some point there is an investigation, we are in a position to provide evidence of what happened,\u201d says Halopeau. On its website, the NGO lists and describes the cyberattacks, the societal harm they caused, and details about their attribution.<\/p>\n

\u201cWhat we publish on our website is a fraction of the information we have,\u201d says Halopeau. That information, he says, is available for potential future legal proceedings. The CyberPeace Institute also collects this evidence to assess whether countries respect the international treaties they signed, and to identify gaps in the law.<\/p>\n

Law of war in a digital age<\/h2>\n

International humanitarian law \u2013 also known as the law of war \u2013 imposes limits on the conduct of hostilities and seeks to protect civilians, medical personnel, wounded soldiers, and prisoners of war.<\/p>\n

Directly targeting civilians is prohibited. Using weapons whose effects cannot be limited to military objectives is too. In the physical world, that means, for example, not targeting a hospital, or not shelling densely populated areas. But in the digital world, things get more complicated.<\/p>\n

Halopeau says it is very difficult to design a malware that only affects specific systems and not a wide range of them. The KA-SAT internet service hack illustrates this.<\/p>\n

The current war between Russia and Ukraine, which has spilled into cyberspace, is also blurring the line between civilians and soldiers.<\/p>\n

On February 26, the government of Ukraine called onExternal link<\/span><\/a> amateur hackers of the world to join its \u201cIT army\u201d and launch attacks against Russian objectives. Anonymous, a global hacker collective, declaredExternal link<\/span><\/a> on the first day of the war that it was engaging in a cyberwar against Moscow.<\/p>\n

Halopeau doubts many cyber warriors are aware of what their participation in the conflict implies under IHL.<\/p>\n

\u201cBy taking an active part in this conflict, they may unknowingly lose their legal protection as civilians and be treated as combatants. They are subject to retaliation from the state they attack and are subject to potential prosecution after the war,\u201d he says.<\/p>\n

Guardian of international humanitarian law<\/h2>\n

As the guardian of IHL, the International Committee of the Red Cross (ICRC) pays close attention to the latest developments on the battlefield, engages confidentially with states to remind them of the existing rules, and gauges whether the law needs to be changed.<\/p>\n

\u201cWe see a reality in which cyber operations become more frequent in armed conflicts,\u201d says Tilman Rodenh\u00e4user, a legal advisor at the ICRC. \u201cAnd one of the key roles of the ICRC is to emphasise the potential human cost of such operations, the potential cost to civilians.\u201d<\/p>\n

IHL was established in a world in which cyberattacks did not yet exist. So are its rules still fit for purpose today?<\/p>\n

\u201cWe cannot aim for new rules of armed conflict with every technological development that we see,\u201d answers Rodenh\u00e4user.<\/p>\n

But aspects of the law remain open to interpretation. One of the oldest rules of IHL is the protection of civilian objects. For many years, civilian data \u2013 understood, for example, as confidential documents held in physical archives \u2013 could not legally be damaged or destroyed. But what does the law say if the same data is stored digitally?<\/p>\n

\u201cThe protection of data is not explicitly addressed by the rules of international humanitarian law,\u201d says Rodenh\u00e4user, who adds that legal experts and states have diverging views on how IHL applies in this case.<\/p>\n

For the ICRC, it is important that states interpret the existing law in a way that civilians and civilian infrastructure enjoy the same level of protection they did in the past. And that cyber weapons are subject to the same limits as traditional means of warfare.<\/p>\n

\u201cIf states came forward and said: no actually, data is fair game, and data can be damaged and deleted in armed conflicts without legal consequences, then that would be a real humanitarian concern, and we would have to think about new rules,\u201d Rodenh\u00e4user says.<\/p>\n

But new rules of international law have to be negotiated by states. Once a treaty exists, it must be signed and ratified \u2013 a long and complicated process, especially given that the current rules of IHL bind virtually all states.<\/p>\n

\u201cIt is key that these agreed rules are also respected with regard to cyber operations because the vast majority of what we see as a threat to civilians is actually covered by the existing rules,\u201d says Rodenh\u00e4user.<\/p>\n

The international community\u2019s stance<\/h2>\n

Knowing if and how international law \u2013 including IHL \u2013 applies to cyberspace has been the subject of many multilateral discussions at the United Nations over the past two decades.<\/p>\n

A breakthrough came in 2013, when a Group of Governmental Experts (GGE) produced a report adopted by consensus affirming that the use by states of information technologies was subject to international law. The question of how the law applies remained open.<\/p>\n

In 2019, a new working group open to all 193 member states was established at the UN. Their goal was to follow-up on the findings of the governmental experts.<\/p>\n

\u201cThe challenge was to bring back everybody around the table and re-establish the consensus,\u201d says J\u00fcrg Lauber, Switzerland\u2019s ambassador to the UN in Geneva and the former chair of the working group.<\/p>\n

His task, Lauber says, was complicated by \u201cincreased political tensions among the big powers\u201d and \u201cattempts to rewrite the rules from a small group of countries\u201d.<\/p>\n

In the end, the working group too concluded that international law applies to cyberwarfare. But it too could not find an agreement on how to implement this.<\/p>\n

\u201cIn substance there was progress, but it was not a huge leap. However, the support now is much broader because everybody had the opportunity to participate in the discussion,\u201d says Lauber.<\/p>\n

A new working group at the UN has been established for the 2021-2025 period.<\/p>\n

\u201cI hope that they can go further [\u2026] there\u2019s clearly a gap between all member states agreeing on the applicability of existing international law, and what we see is happening with cybertechnology being used in an illegal way.\u201d<\/p>\n

War crimes?<\/h2>\n

Trying war crimes for atrocities committed on the physical battlefield is a long and difficult process that will take years. Cyberspace adds to this complexity.<\/p>\n

Finding who is behind a cyberattack is very difficult, as they can easily be launched by proxies.<\/p>\n

\u201cIt sometimes requires years of investigation to really understand how an attack was planned, how it was carried out, who ordered it, and to really know which individuals were behind it,\u201d says Halopeau. Usually, real world information \u2013 if a government was involved, names of the people who worked at a certain time in a certain place, pictures, etc. \u2013 is needed to corroborate virtual traces, he adds.<\/p>\n

\u201cYou need to combine a lot of information that is not immediately available. And this is in the best-case scenario where you more or less know that you only have one attacker,\u201d says Halopeau.<\/p>\n

In the war in Ukraine, nation states, but also criminal groups and individuals have conducted cyberattacks. \u201cAnd then the liability of those people who took part will have to be defined and it\u2019s going to be very complicated,\u201d predicts Halopeau.<\/p>\n

Halopeau thinks it is possible that some cyberattacks that have harmed civilians \u2013 such as the KA-SAT or the Ukraine-Romania border control hacks \u2013 might be of interest to the International Criminal Court (ICC), which has already launched an investigation into alleged war crimes on the ground in Ukraine. So far the ICC is not investigating cyberwarfare.<\/p>\n

Despite the horrors, the war in Ukraine may serve as a lesson about the need to strengthen accountability processes in cyberspace, he says.<\/p>\n

\u201cThis is one of the first conflicts where cyberattacks are used at this scale. [\u2026] So I think regarding international humanitarian law, there must be a discussion to recognize how cyberspace can be used to harm people and to prevent inappropriate behaviour.\u201d<\/p>\n

 <\/p>\n

Source: swissinfo.ch<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Law of war in a digital age or when is a cyberattack a war crime?   The damage caused by cyberattacks in the war in Ukraine pales in comparison with the atrocities of the fighting on the ground. But that does not mean it is not happening, or that civilians are spared.   On February 24, the day Russia launched its invasion of Ukraine, a cyberattack targeting the KA-SAT satellite<\/p>\n","protected":false},"author":113,"featured_media":34681,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"slim_seo":{"title":"Law of war in a digital age or when is a cyberattack a war crime? - Menschenrechte Osteuropa - News & Konflikte","description":"Law of war in a digital age or when is a cyberattack a war crime? Cyberattacks on critical infrastructure, such as power plants or telecommunication networks, c"},"footnotes":""},"categories":[218,482,541,1240,487,269],"tags":[],"class_list":["post-34683","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-bl-en","category-country-russia-2-en","category-country-russia-en","category-country-ukraine-3","category-country-ukraine-2-en","category-ukraine-cat-en"],"_links":{"self":[{"href":"https:\/\/humanrights-online.org\/uk\/wp-json\/wp\/v2\/posts\/34683","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/humanrights-online.org\/uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/humanrights-online.org\/uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/humanrights-online.org\/uk\/wp-json\/wp\/v2\/users\/113"}],"replies":[{"embeddable":true,"href":"https:\/\/humanrights-online.org\/uk\/wp-json\/wp\/v2\/comments?post=34683"}],"version-history":[{"count":3,"href":"https:\/\/humanrights-online.org\/uk\/wp-json\/wp\/v2\/posts\/34683\/revisions"}],"predecessor-version":[{"id":34695,"href":"https:\/\/humanrights-online.org\/uk\/wp-json\/wp\/v2\/posts\/34683\/revisions\/34695"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/humanrights-online.org\/uk\/wp-json\/wp\/v2\/media\/34681"}],"wp:attachment":[{"href":"https:\/\/humanrights-online.org\/uk\/wp-json\/wp\/v2\/media?parent=34683"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/humanrights-online.org\/uk\/wp-json\/wp\/v2\/categories?post=34683"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/humanrights-online.org\/uk\/wp-json\/wp\/v2\/tags?post=34683"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}