# Collateral Damage from Offensive Cyber Operations-- A Systematic Literature Review
## 2 Collateral Damage Within the Cyberspace Context  
This section describes the terminology and concepts of civilian harm from warfare and how they have been understood within the cyber domain. The term \"collateral damage\" (CD) was coined in the early 1960s to refer to the \"unlimited, indiscriminate, and exhaustive\" effects of warfare [6]. By more recent definition, this term refers to \"unintentional damage or incidental damage affecting facilities, equipment, or personnel, occurring as a result of military actions directed against targeted enemy forces or facilities\" [12]. This definition is closely aligned with the laws of armed conflict and is used in this paper when talking explicitly about collateral damage in the legal or military sense. In the context of conventional warfare, the avoidance of civilian casualties and damage to civilian infrastructure, risk calculation, and the estimation of the economic value of collateral damage have been institutionalized in many of the world's militaries. While conventional weapons have evolved to increase their precision in targeting and reduce the risk of collateral damage, military OCOs are still developing, and damage to civilian infrastructure and commerce is common [13]. The legal framework governing the use of force in war (_jus in bello_) and the permissibility of a specific offensive operation is a large field of study in its own right. The legal requirement to avoid indiscriminate attacks against civilian targets was codified by the 1977 Additional Protocol I to the Geneva Convention. Legal sources [14] provide up to four principles governing the selection and targeting of legitimate targets in warfare: discrimination (between combatants and non-combatants), proportionality (between military utility and collateral damage), necessity (of the level of force used), and humanity (in the types of weapons used). These legal and ethical principles were laid down with consideration only of the context of conventional warfare and in the context of a \"hot\" war. Operations conducted in cyberspace add complexity both in terms of attribution and in terms of the highly variable temperature under which they are conducted. In 2016, NATO formally recognized cyberspace as a domain of operations [15]. A cyberspace operation, then, can be defined as the \"(1) use [of] cyber capabilities, such as computers, software tools, or networks [that] (2) have a primary purpose of achieving objectives or effects in or through cyberspace\" [16]. A cyberspace operation of military origin can affect civil society adversely in several distinct ways:  
1. Unintended, damaging consequences from operations against legal and legitimate targets, e.g., in the conduct of a declared cyberwar;
2. Damage from intentional operations against civilian targets, e.g., South Korean banks and television stations in 2013;
3. Damage from the reuse of discovered or reverse-engineered technology, e.g., the WannaCry ransomware. Moreover, collateral damage is not automatically unlawful per se. The rules of the Geneva Convention protect only against collateral damage that is \"excessive in relation to the concrete and direct military advantage anticipated\". Minor (i.e., proportionate) and unintentional collateral damage may pass muster under this provision. The laws of armed conflict have no bearing or relevance, however, upon cyber operations that are conducted by law enforcement or non-state actors; these make up the vast majority of operations and cause the majority of damage. Broadening the definition of collateral damage beyond the context of military cyber operations is not a new thought. [PERSON] and [PERSON] [13] recognize that the same principles can usefully be applied to law enforcement. The value of a broader definition is in the greater coverage afforded (i.e., the vast majority of OCOs), whereas the value of the narrower definition is that it is more specific and has specific terminology that delineates it and simplifies searches (and research).