Scenario 28: Extraterritorial incidental civilian cyber harm

State A, involved in an international armed conflict against State B, designs a cyber operation aimed at damaging State B’s military command and control system. The operation might also incidentally impact one university in State B and many universities located in State C, not party to the armed conflict. This scenario analyses whether and how to apply the international humanitarian law principle of proportionality to this operation. In doing so, it also examines the application of the principle of proportionality and the law of neutrality to attacks expected to cause incidental civilian harm in a neutral non-belligerent State.
==Scenario==
===Keywords===
Attack (international humanitarian law), conduct of hostilities, international humanitarian law, military objectives, neutrality, proportionality.
===Facts===
[F1] State A and State B are in an international armed conflict against each other. State C is not party to that conflict. Using a zero-day software vulnerability, cyber operators who are members of State A’s armed forces plan to conduct a cyber operation that is expected to damage beyond repair computer consoles that are essential to the functioning of a command and control (C2) system critical to State B’s ability to synchronize combat operations.
[F2] The operators design a bespoke malware with a self-spreading capability in order to reach the C2 system. They know the vulnerability is not unique to the military consoles and they therefore incorporate a restriction into the malware, which is designed to prevent it from activating in any non-target systems. 
[F3] Nevertheless, they reasonably expect there being a moderate likelihood that the malware will anyway spread outside the original target and, if that does happen, that it will result in the same effects on a civilian computer console in State B and a large number of civilian consoles in State C, which all rely on the same software. State A assesses that the damage to civilian infrastructure would result in significant financial loss and other minor disruptions of civilian life due to loss of connectivity.
[F4] Taking all of these considerations into account, State A decides to launch the operation.
===Examples===
*NotPetya (2017)
*HermeticWiper malware attack (2022)
*Viasat KA-SAT attack (2022)
*Cyber operations against NATO’s aid mission in Turkey and Syria (2023)
==Legal analysis==
For a general overview of the structure of analysis in this section, see Note on the structure of articles.
[L1] This scenario analyses whether and how to apply the principle of proportionality under international humanitarian law to a cyber operation that is expected to cause incidental civilian harm in both a State that is a party to an international armed conflict and in a neutral non-belligerent State. In doing so, it assesses whether the principle of proportionality prohibits the operation. Separate from that assessment, this scenario also assesses whether the operation is prohibited under the law of neutrality.Note: For the purposes of this scenario, it is assumed that the restrictions added to prevent the malware from activating in non-target systems (see para. F2) were sufficient to comply with the obligation to take all feasible precautions to avoid or at least minimize incidental harm to civilians and damage to civilian objects when carrying out an attack. Additional Protocol I, Article 57(1); Jean-Marie Henckaerts and Louise Doswald-Beck, Customary international humanitarian law, (Vol. I, Cambridge University Press 2005) (ICRC Customary IHL Study), Rule 15. 
While other areas of public international law may be relevant to this scenario, many of them are already analysed in a number of different scenarios in the Toolkit and thus generally excluded from the scope of this scenario. See, for example, the Toolkit’s treatment of self-defence, retorsion, and countermeasures in Scenario 14: Ransomware campaign.
===Applicability of international humanitarian law===
[L2] In situations of armed conflicts, all acts of the parties with a sufficient nexus to the conflict are governed by IHLSee, e.g. Marco Sassòli, International Humanitarian Law: Rules, Controversies, and Solutions to Problems Arising in Warfare (Edward Elgar 2019) 201 (‘IHL only governs conduct that has a sufficient nexus to the armed conflict’); Gloria Gaggioli (ed), Expert Meeting: The Use of Force in Armed Conflicts (ICRC 2013) 4 (‘In order to be covered by IHL, the use of force must take place in an armed conflict situation and must have a nexus with the armed conflict’.)., including any cyber operations.Michael N. Schmitt et al (eds), Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations (Cambridge University Press 2017) (Tallinn Manual 2.0), commentary to rule 80, para 5. Views differ, however, on when this standard is met. For example, some Tallinn Manual experts considered it sufficient for an operation to originate from one party to an armed conflict and be directed against its opponent, whereas other experts took the position that the act must be conducted in furtherance of the hostilities.Tallinn Manual 2.0, commentary to rule 80, para 6. State A’s planned cyber operation against State B’s C2 system meets both threshold tests and, therefore, the operation is subject to the principles and rules of IHL.
===Attack===
[L3] State A reasonably expects that its cyber operation will cause damage to computer consoles that are essential to the functioning of State B’s military command and control (C2) system and will have the same effects on civilian consoles. Whilst different views exist as to whether the ‘damage’ must result in physical damage as opposed to loss of functionality for the operation to qualify as an ‘attack’ under IHL, in this scenario the loss of functionality is expected to be irreparable, meaning that the affected computer consoles would need to be physically replaced. Following the approach of the majority of the Tallinn Manual experts, the planned cyber operation would constitute an ‘attack’ under IHL.Tallinn Manual 2.0, commentary to rule 100, para 10 (‘…a majority of them was of the view that interference with functionality qualifies as damage if restoration of functionality requires replacement of physical components’.) Under this conclusion, State A’s cyber operation is subject to the rules specifically applicable to ‘attacks’. 
===Military objective===
[L4] Having assessed that the cyber operation qualifies as an ‘attack’ under IHL, it is necessary to assess if the targeted C2 system qualifies as a military objective. As the name indicates, a C2 system is used to direct and guide a party’s own military forces in the accomplishment of their mission. It follows that it is reasonable to conclude that the nature of the system provides an effective contribution to the military action of State B, thereby fulfilling the first part of the definition.Tallinn Manual 2.0, commentary to rule 100, paras. 8 and 15. (‘“Nature” involves the inherent character of an object, and typically refers to those objects that are fundamentally military and designed to contribute to military action’.) It is also reasonable to conclude that the C2 system’s total or partial destruction would, in the circumstances ruling at the time, offer a definite military advantage to the other party to the conflict, as it would hamper State B’s ability to carry out military operations against State A.Views differ however on whether an object that qualifies as a military objective due to its ‘nature’ needs to meet this second part of the definition. See, Tallinn Manual 2.0, commentary to rule 100, paras 16–17. The C2 system thereby qualifies as a military objective.
===Proportionality===
[L5] State A’s planned cyber operation constitutes an attack under IHL (see para. L3) and the attack is directed at a military objective (see para. L4).Considering that the attack is targeted at a military objective as well as the restrictions incorporated into the malware (see para. F2), it is presumed that the attack complies with the prohibition of indiscriminate attacks as codified in 1977 Additional Protocol I, Article 51(4). See also ICRC Customary IHL Study, Rule 11; William H. Boothby, The law of targeting (Oxford University Press 2012) 91. The question then turns to whether State A’s operation is expected to result in incidental civilian loss of life or injury, or damage to civilian objects. If so, the principle of proportionality applies and the total sum of that expected incidental civilian harm must be measured against the concrete and direct military advantage anticipated to be gained from the attack.
[L6] The expected irreparable harm to a civilian computer console in State B, meaning that the console would need to be physically replaced, qualifies as damage to a civilian object. This reflects the majority view of the Tallinn Manual experts.Tallinn Manual 2.0, commentary to rule 92, para 10 (‘a majority of them was of the view that interference with functionality qualifies as damage if restoration of functionality requires replacement of physical components. Consider a cyber operation that is directed against the computer-based control system of an electrical distribution grid. The operation causes the grid to cease operating. In order to restore distribution, either the control system or vital components thereof must be replaced. The cyber operation is an attack for the majority’.) The significant financial expenses and other disruptions of civilian life due to loss of connectivity negatively affect civilians. However, the facts do not indicate that any of them would directly or indirectly result in loss of civilian life, civilian injury, or damage (physical or otherwise) to civilian objects.Isabel Robinson and Ellen Nohle, ‘Proportionality and precautions in attack: The reverberating effects of using explosive weapons in populated areas’, International Review of the Red Cross (2016), 98 (1), 107–145, 130 (‘As such, even under a broad interpretation of “injury”, incidental harm does not include effects such as poverty, unemployment or economic capacity’.) The sum of civilian harm in State B would therefore be limited to the damaged console. As discussed below (para. L10), the financial losses and other civilian disruptions may however be factors when weighing whether the damage to the console is expected to be excessive.
[L7] With regard to the anticipated effects that State A’s cyber attack will cause in State C, it is unclear how a State must consider the incidental civilian harm expected to occur beyond belligerent territories, in this case State C, when assessing the principle of proportionality. Two possible approaches to this issue may be identified.
[L8] Under the first approach, the only incidental civilian harm to be taken into account is that which is expected to occur in State B. This is because, notwithstanding views to the contrary provided below (see paras L9–L10), the geographical scope of most IHL rules is traditionally thought to be limited to the territory of the States parties to the armed conflict.Prosecutor v Tadic (Decision on the Defence Motion for Interlocutory Appeal on Jurisdiction) ICTY-94-1 (2 Oct 1995) [68]; Dieter Fleck, ‘Scope of Application of International Humanitarian Law’, in Dieter Fleck (ed), Handbook of International Humanitarian Law (4th edn, OUP 2021) 65. This approach serves several functions, including safeguarding against importing into neutral States principles and rules of IHL, in particular the principle of proportionality, that tolerate some degree of incidental civilian harm. (For other safeguards that mediate this concern, see the section on Neutrality below.)
[L9] The second approach is to place no geographic limitations when assessing the incidental civilian harm, thereby requiring all foreseeable incidental civilian harm in States B and C to be assessed under the principle of proportionality. Indeed, the geographical scope of IHL encompasses State A’s operation, to which the rule of proportionality therefore applies, and that rule does not spell out a geographic limit to the incidental civilian effects to be considered.The 1974-1977 Diplomatic Conference rejected several attempts aimed at excluding incidental harm that is not in the proximity of the target from the application of the proportionality principle. Michael Bothe, Karl Josef Partsch and Waldemar Solf, New Rules for Victims of Armed Conflicts, (2nd edition, Martinus Nijhoff Publishders, 2013), p. 406, para. 2.6.2 on Article 57. See also ICRC, Explosive weapons with wide area effects: A deadly choice in populated areas, (2022) 97. This approach appears to have stronger support than the first, with some States and academics arguing that the principle of proportionality can be violated when incidental civilian harm occurs in a neutral State.In support of this approach, see ‘Letter dated 19 June 1995 from the Permanent Representative of Solomon Islands to the United Nations, together with Written Statement of the Government of Solomon Islands’, in the case in ICJ, Legality of the Use by a State of Nuclear Weapons (Advisory Opinion), 20 June 1995, para 3.103, https://www.icj-cij.org/public/files/case-related/95/8714.pdf (‘…since these effect may affect people outside the scope of the conflict, both in time and geographically, the use of nuclear weapons violates the prohibition on the use of weapons which cause unnecessary suffering, cause harm to civilians, and have indiscriminate effects. The principles of proportionality and humanity are obviously violated’.) See also Tamsin Phillipa Paige, Douglas Guilfoyle, and Rob McLaughlin, ‘The Final Frontier of Cyberspace: Ensuring that Submarine Data Cables are Able to Live Long and Prosper (Part II)’ (Opinio Juris, 16 October 2020), available at: http://opiniojuris.org/2020/10/16/the-final-frontier-of-cyberspace-ensuring-that-submarine-data-cables-are-able-to-live-long-and-prosper-part-ii/ (‘We suggest that any application of [the proportionality test to attacks on submarine data cables] will always come back in the negative. This is because the combination of the scale of impact on civilian social and economic infrastructure, and the likelihood of this damage spreading beyond the targeted state to neutral third states, can only be excessive in relation to any military advantage’.) Others have more specifically argued that the rules of IHL apply to attacks with effects in non-belligerent States as long as the attack has a nexus to an armed conflict.Michael N. Schmitt, ‘Russian cyber operations and Ukraine: The Legal Framework’ (Articles of War, 16 January 2022) (‘the fact that consequences were caused beyond belligerent territory has no bearing on whether the cyber operations causing them are subject to IHL rules. The question is whether the nexus condition is met. So long as that condition is satisfied, consequences manifesting outside belligerent territory still matter in the application of IHL to the cyber operation, as in the case of assessing incidental injury and collateral damage pursuant to the proportionality rule’.) See also Tallinn Manual 2.0, commentary to rule 80, para 5. Sassòli takes the view that ‘IHL of IACs applies in any location where opposing State forces exercise belligerent activity against each other irrespective of whether or not this activity occurs on their territory. In my view, even hostilities on the territory of a non-consenting neutral State are governed by IHL even though they are prohibited […] they are neither outside the geographical scope of application of IHL of IACs nor prohibited by IHL’. Marco Sassòli, International Humanitarian Law: Rules, Controversies, and Solutions to Problems Arising in Warfare (Edward Elgar 2019), para 6.46. This approach finds further support in commentaries that indicate that IHL’s prohibition against excessive incidental harm to the environment must take into account the harm expected to occur both inside and outside belligerent territory.See, ICRC, Guidelines on the Protection of the Natural Environment in Armed Conflict – Rules and Recommendations relating to the Protection of the Natural Environment under International Humanitarian Law, with Commentary, (ICRC December 2020) [ICRC Guidelines on the Protection of the Natural Environment in Armed Conflict] [122].
[L10] In the present case, the harm expected to be caused in State C is directly associated with the international armed conflict between State A and State B. The expected effects therefore have a nexus to the conflict and, as such, the attack falls within the geographical scope of IHL. Damage to the computer consoles in States B and C would therefore constitute the total sum of expected harm. While the significant financial losses and other disruptions do not per se constitute damage to civilian objects, which might lead some to hold the view that they do not need to be considered, they have to be considered when determining the weight given to the objects expected to be damaged for the purpose of assessing excessiveness, a view shared by the ICRC.Proportionality in the Conduct of Hostilities 35; Expert Report on Proportionality 42; ICRC, Explosive weapons with wide area effects: A deadly choice in populated areas, (2022) 98 and 100. This approach thereby results in an assessment that may be different than for operations damaging civilian consoles with less disruptive effects.
[L11] The total amount of harm expected by the damaging of one console in State B and a large number of consoles in State C then needs to be weighed against the direct and concrete military advantage anticipated to be gained from State A’s attack on State B’s C2 system.
[L12] Having assessed the expected incidental civilian harm and the concrete and direct military advantage anticipated, it is necessary to determine whether the harm would be excessive. In making this assessment it is reasonable to assume that State A would benefit significantly from the cyber attack given that the system is considered critical to State B’s ability to synchronize combat operations (para. F1). While a definite conclusion could only be drawn based on more detailed factual circumstances, on the basis of the limited guidance on the notion of excessiveness found in military manuals and case lawSee e.g. Expert Report on Proportionality, 53-55. it may be argued that the expected irreparable damage to a large number of civilian consoles would not be excessive when compared to the concrete and direct military advantage anticipated, and therefore the attack not prohibited under the principle of proportionality. Ultimately, however, the answer will have to be measured against the standard of how a reasonable military commander would apply the principle of proportionality based on the circumstances ruling at the time of the attack.
[L13] While this scenario assumes that the cyber attack sufficiently complies with the obligation under IHL to take all feasible precautions in the choice of means or methods of attack with the view of avoiding or at least minimizing the incidental loss of civilian life, injury to civilians, and damage to civilian objects (para. L1, footnote [1]), it should be recalled that the obligation to take such precautions must be complied with even if an attack is not prohibited under proportionality.
===Neutrality===
[L14] Whatever approach is adopted for assessing the principle of proportionality, it would be necessary to look separately at the law of neutrality, which is distinct from IHL and applies to non-belligerent States—in this case State C—in situations of international armed conflict.Additionally, State A would also need to consider whether the planned cyber attack would comply with its obligations under international human rights law, which continues to apply in parallel to IHL.
[L15] In spite of the divergent views and considerations around how the law of neutrality regulates cyber operations, it is reasonable to conclude that under the law of neutrality (and without prejudice to the legal analysis under IHL), State A’s cyber attack would likely be unlawful because the harm in State C was foreseeable, raised above a de minimis level, and was intrusive enough to tip the balance in favor of State C’s right to remain unaffected by the conflict.
===Conclusion===
[L16] In conclusion, State A’s planned cyber operation falls within the scope of IHL, has a nexus to the existing international armed conflict and meets the requirements for it to be subject to the principle of proportionality. Evaluated from of a number of different perspectives, there is support for the position that, for the purposes of IHL, the incidental civilian harm expected to occur in State C must be part of the proportionality assessment together with that expected to occur in State B. State A would then need to include incidental civilian harm expected to occur in State C into its total sum of civilian harm when determining if the attack complies with the principle of proportionality. In any event, as the attack is not seemingly expected to incur incidental civilian harm excessive to the direct and concrete military advantage anticipated, the attack is not prohibited under the principle of proportionality. At the same time, it is reasonable to conclude that the cyber attack would be prohibited under the law of neutrality due to the harm it is expected to cause in State C.
==Checklist==
*Does the operation qualify as an attack that is regulated by the principle of proportionality?
*Which of the expected effects of the attack constitute incidental civilian harm under the principle of proportionality?
*How does the principle of proportionality assess incidental civilian harm that is expected to occur in a non-belligerent neutral State?
*Is the expected incidental civilian harm of the attack excessive to the anticipated concrete and direct military advantage?
*What impact might the law of neutrality have on the lawfulness of an attack that is expected to cause harm in a non-belligerent neutral State?
==Appendixes==
===See also===
*Scenario 13: Cyber operations as a trigger of the law of armed conflict
*Military objectives
*International armed conflict
*Attack (international humanitarian law)
*Neutrality
===Notes and references===
===Bibliography and further reading===
*Emanuela-Chiara Gillard, Proportionality in the Conduct of Hostilities: The Incidental Harm Side of the Assessment (Chatham House 2018)
*Laurent Gisel, Tilman Rodenhäuser and Knut Dörmann, ‘Twenty years on: International humanitarian law and the protection of civilians against the effects of cyber operations during armed conflicts’ (2020) 102 IRRC 913.
*Laurent Gisel, The principle of proportionality in the rules governing the conduct of hostilities under international humanitarian law: international expert meeting, 22-23 June 2016 (ICRC 2018)
*Michael N. Schmitt, ‘Russian cyber operations and Ukraine: The Legal Framework’, Articles of War (16 January 2022)
*Michael N. Schmitt et al (eds), Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations (Cambridge University Press 2017)
*Noam Neuman, Neutrality and Cyberspace: Bridging the Gap between Theory and Reality, 97 ILS 765 (2021)
===Contributions===
*Scenario by: Jonathan Horowitz & Florentina Pircher
*Analysis by: Jonathan Horowitz & Florentina Pircher
*Reviewed by: Laurent Gisel, Ori Pomson and Ann Väljataga
Previous: Scenario 27: Contesting and redirecting ongoing attacks	Next: Scenario 29: Cyber operations against water and water infrastructure
Category:Scenario
Category:Attack (international humanitarian law)
Category:Conduct of hostilities
Category:International humanitarian law
Category:Military objectives
Category:Neutrality
Category:Proportionality