Law
Applying International Humanitarian Law to Cyber Warfare
Quick fact
In 2013, the UN Group of Governmental Experts, including the US, Russia, and China, agreed that international humanitarian law applies to cyber operations in armed conflict, despite the legal uncertainty surrounding cyber attacks.
Why this is interesting
Can the laws designed for bombers and bayonets also govern attacks that happen in milliseconds through fiber-optic cables? When a cyberattack disables a hospital's power grid, is it a war crime?
Read the full explanation
Understanding Applying International Humanitarian Law to Cyber Warfare
Imagine you're a commander planning an attack on a physical military base. You'd drop a bomb on the barracks, but you'd avoid the hospital next door. That's the principle of distinction: you must only target combatants and military objectives, not civilians or civilian objects. Now imagine a cyberattack. You're not dropping bombs; you're sending a malicious code that could disable the enemy's air defense system. But that same code might spread uncontrollably and infect civilian networks, like the power grid or hospitals, causing massive collateral damage. This is the core challenge: applying the spirit of IHL to the digital world. IHL, also known as the laws of war, was written for physical weapons like guns, bombs, and tanks. It has clear rules like distinction, proportionality, and precaution. These rules require you to distinguish between combatants and civilians, weigh the expected military advantage against likely civilian harm, and take precautions to minimize harm. In cyber warfare, these principles still apply, but the execution is trickier because cyber attacks are invisible, can spread unpredictably, and often target dual-use infrastructure—systems that serve both military and civilian purposes. For example, a cyberattack on a power grid that supplies both a military base and civilian homes must consider the impact on civilians. This is why the Tallinn Manual, a comprehensive study by legal experts, fills the gap by providing guidance on how IHL applies to cyber operations, even though it's not a binding treaty.
A deeper explanation
The application of IHL to cyber warfare hinges on the legally binding principle that IHL applies to all means and methods of warfare, including cyber means. This was confirmed by the International Court of Justice in 1996 and by the UN Group of Governmental Experts in 2013 and 2015. The Tallinn Manual, especially its second edition (Tallinn Manual 2.0), is the most comprehensive attempt to articulate how IHL rules apply in cyberspace. It explains that a cyber operation constitutes an 'armed attack' when it triggers the right of self-defense, and that IHL 'cyber attacks' must comply with all IHL rules. Key principles include: distinction, proportionality, and precaution. Distinction requires that attacks be directed only at military objectives. But in cyberspace, almost everything is dual-use—a network can carry both military and civilian data. The rule of proportionality forbids attacks where expected civilian harm is excessive compared to the anticipated military advantage. Precaution demands that attackers take all feasible measures to minimize harm to civilians. The Tallinn Manual applies these rules to specific cyber operations, like disrupting a military communication network versus a civilian banking system. Critically, it also addresses problems of attribution—identifying the source of an attack—which is notoriously difficult in cyberspace, since attackers can hide behind proxies and false flags. This hampers enforcement and makes it hard to determine state responsibility. Despite these challenges, the consensus is that IHL does apply, and the Tallinn Manual provides a practical framework for states to interpret their obligations. This is vital because cyber warfare is already a reality, and legal clarity helps prevent escalation and protect civilians.