Scenario 20: Cyber operations against medical facilities

Public hospitals in a State fall victim to a hostile cyber operation, encrypting hospital computers. As a result, patient data becomes unavailable and a number of patients have to be diverted to private hospitals. The victim State’s forensic investigation indicates that the operation was conducted by a State actor but cannot immediately determine which State was responsible. Two possible culprits emerge: a State that is a political adversary of the victim State; and a State engaged in an armed conflict with the victim State. Therefore, this scenario analyses the incident first from the perspective of peacetime international law (primarily the principles of sovereignty and non-intervention, the prohibition against the use of force, and international human rights law) and then under international humanitarian law applicable during armed conflict (notably the obligation to respect and protect medical units).
==Scenario ==
===Keywords===
International humanitarian law, international human rights law, medical facilities, hospitals, ransomware, prohibition of intervention, sovereignty, use of force
===Facts===
[F1] State A is located in a region rattled by conflict and rivalry among regional powers. The tensions between States A and B run high and their governments have been constantly exchanging insults and political threats. However, neither State has ever used physical force against the other. By contrast, State A is locked into an ongoing international armed conflict with State C. For several years, the conflict has been continuing at low intensity with frequent shelling across the frontline.
[F2] Recently, public hospitals of State A, which account for 30% of all its hospitals, fell victim to a ransomware attack. All public hospitals use the same administration software and are connected to each other. The operation encrypted computers used in the hospitals and doctors became unable to access patient data stored digitally. This included data containing test results from hundreds of patients tested for a highly infectious disease. The inaccessibility of patient data meant the hospitals became unable to admit some patients or to treat others. As a result, the affected public hospitals had to transfer urgent cases to private hospitals.
[F3] After three days, cyber security specialists from State A found the key needed to decrypt the computers. Still, as a result of the incident, medical care at the hospitals was disrupted by delays and unavailability of important data on patient treatment. Two of the patients diverted to private hospitals died while in transit, although investigations were inconclusive as to whether their lives could have been saved if they had been admitted on time. Moreover, due to test results being unavailable, public authorities were unable to track and inform individuals who had been infected. State A’s Ministry of Health stated that the inability to track positive cases undermined the State’s strategy to combat the infectious disease.
[F4] State A’s forensic experts quickly determine that the operation was conducted by an advanced persistent threat actor, likely linked to a State. However, at the early stages they are unable to attribute the operation to a specific State. While waiting for further clarity from forensic experts, on the basis of the evidence available, State A’s intelligence service considers it is highly probable that the operation was either the work of State B, or of State C.
[F5] All States involved in this scenario are parties to the four Geneva Conventions, their Additional Protocol I, the Rome Statute of the International Criminal Court, the International Covenant on Civil and Political Rights (ICCPR), and the International Covenant on Economic, Social, and Cultural Rights (ICESCR).
===Examples===
* Springhill Medical Center ransomware attack (2019)
* Brno University Hospital ransomware attack (2020)
* Ireland’s Health Service Executive ransomware attack (2021)
==Legal analysis ==
For a general overview of the structure of analysis in this section, see Note on the structure of articles.
[L1] Attribution of the cyber operation against State A’s public hospitals is unclear. With available evidence suggesting that it was conducted either by State B or by State C, the legal analysis discusses the two possibilities in two separate sections below.
===What if it was State B: Focus on peacetime international law===
[L2] If the operation was attributed to State B, it would have taken place in time of peace. Thus, the legal analysis in this section focusses on whether the operation would have violated State A’s sovereignty, amounted to a prohibited intervention into the internal affairs of State A, and/or amounted to a use of force against State A. The analysis also examines whether State B would have violated its obligations under international human rights law.
====Obligation to respect the sovereignty of other States====
[L3] This analysis proceeds on the basis that the obligation to respect the sovereignty of another State is a rule of international law applicable to cyberspace. The operation interrupted and slowed down the delivery of medical services in another State. The fact that this was done through an unauthorized penetration of State A’s systems would suffice for the qualification of the operation as a breach of sovereignty under the test proposed by France.French Ministry of the Armies, ‘International Law Applied to Operations in Cyberspace’ (9 September 2019), 6.
[L4] The ransomware operation also resulted in a widespread loss of functionality, given that the affected systems in State A’s public hospitals ceased to operate properly until the encryption key was found.In this regard, see Tallinn Manual 2.0., commentary to rule 4, para. 14 (noting that some of the experts considered that ‘a temporary, but significant, loss of functionality’ could qualify as a violation of the victim State’s sovereignty). In addition, the operation prevented State A from tracking and informing patients who were tested positive for a highly infectious disease, thereby undermining its capacity to contain that disease. Taking measures to curb an epidemic is a governmental responsibility of any State (i.e., public healthSome States have referred to health care services as within the notion of ‘inherently governmental functions’, such as Canada.) and thus the tracking and informing of patients can be considered as an inherently governmental function of State A.Marko Milanovic and Michael N. Schmitt, ‘Cyber Attacks and Cyber (Mis)information Operations During a Pandemic’ (2020) 11 Journal of National Security Law & Policy 247, 255 (‘[C]risis management during an epidemic or a pandemic is a governmental responsibility in every state and accordingly an inherently governmental function.’). Accordingly, State B’s cyber operation could also be characterized as a violation of State A’s sovereignty due to it having caused a loss of functionality of cyber infrastructure in State A (option 3 in the box above) and interfered with State A’s inherently governmental functions (option 4).
====Prohibition of intervention====
[L5] With regard to the first element of prohibited intervention, the ransomware incidents related to matters of public policy including the operation of public hospitals and the development of a strategy to contain an infectious disease, i.e. public health.See in this regard for essential medical services, the national positions of Italy, Japan, New Zealand and the United Kingdom. Although some aspects of these matters are now subject to international regulation – for example, the World Health Organization’s International Health Regulations codify certain international obligations in handling public health emergenciesInternational Health Regulations (signed 23 May 2005, entered into force 15 June 2007) 2509 UNTS 79. – the overall management of a public health crisis at a national level is still widely considered to remain a sovereign prerogative falling within each State’s domaine réservé.Marko Milanovic and Michael N. Schmitt, ‘Cyber Attacks and Cyber (Mis)information Operations During a Pandemic’ (2020) 11 Journal of National Security Law & Policy 247, 257 (‘It is unquestionably within the domaine réservé of a state to determine how it will handle a health crisis, as is the actual handling of that crisis.’); Gary P. Corn, ‘Covert Deception, Strategic Fraud, and the Rule of Prohibited Intervention’, Hoover Working Group on National Security, Technology, and Law, Aegis Series Paper No. 2005 (18 September 2020) 9 (‘the adoption and implementation of public-health policies and measures, especially in the face of a global pandemic, are widely recognized as legitimate matters of governance within a state’s internal sovereign jurisdiction’). Accordingly, the incidents related to matters upon which State A had the right to decide freely.
[L6] With respect to the second element, the two approaches to the meaning of “coercion” defined above lead to different results in the present scenario. On the first approach, an intent to compel State A to change its behaviour cannot be discerned from the facts. The cyber operation interfered with the functioning of the hospitals and the implementation of State A’s public health strategy, but there is insufficient information to conclude that the State of origin had the goal of effecting any particular change in the behaviour of State A.
[L7] By contrast, on the second approach, the interference with the hospitals would be considered coercive because it prevented State A from operating those hospitals according to its own will. As such, it effectively deprived that State of its ability to control or govern matters within its domaine réservé and, accordingly, it qualified as a violation of the prohibition of intervention.
====Use of force====
[L8] It is unlikely that the ransomware operations amounted to a use of force. There is no evidence of direct physical damage and it is doubtful that the operations can be considered comparable to the use of kinetic force on the basis of the criteria mentioned above. The consequences of the operations – in particular, the disruption to the functioning of public hospitals – would arguably not be considered serious or severe enough to equate the operation with a physical use of force against those targets.See also Tallinn Manual 2.0, commentary to rule 69, para 9(a) (‘Severity is the most significant factor in the analysis.’). Even if a causal link between the cyber operations and the two patient deaths could be established, these effects might still fall below a de minimis threshold suggested in legal doctrineSee, eg, Robert Kolb, Ius contra bellum: Le droit international relatif au maintien de la paix (2nd edn, Bruylant 2009) 247; Olivier Corten, The Law Against War: The Prohibition on the Use of Force in Contemporary International Law (Hart Pub 2021) 55; Mary Ellen O’Connell, ‘The Prohibition on the Use of Force’, in Nigel D. White & Christian Henderson (eds), Research Handbook on International Conflict and Security Law (OUP 2013) 102; see also Tallinn Manual 2.0, commentary to rule 69, para 9(a); but see, eg, Tom Ruys, ‘The Meaning of “Force” and the Boundaries of the Jus ad Bellum: Are “Minimal” Uses of Force Excluded from UN Charter Article 2(4)?’ (2014) 108 AJIL 159. as well as in international practice.IIFFMCG, Independent International Fact-Finding Mission on the Conflict in Georgia: Report (September 2009) vol 2, at 242 (‘The prohibition of the use of force covers all physical force which surpasses a minimum threshold of intensity. … Only very small incidents lie below this threshold, for instance the targeted killing of single individuals, forcible abductions of individual persons, or the interception of a single aircraft.’) (emphasis added). The indirect nature of any such effects would also militate against the qualification of the underlying operation as a use of force.Tallinn Manual 2.0, commentary to rule 69, para 9(c) (‘Cyber operations in which cause and effect are clearly linked are more likely to be characterised as uses of force than those in which they are highly attenuated.’). Finally, the target of the operations and the circumstances prevailing at the time when the operations were launched did not suggest that the operations had a military character.See French Ministry of the Armies, ‘International Law Applied to Operations in Cyberspace’, 9 September 2019, 7 (‘In the absence of physical damage, a cyberoperation may be deemed a use of force against the yardstick of several criteria, including the circumstances prevailing at the time of the operation, such as the origin of the operation and the nature of the instigator (military or not), the extent of intrusion, the actual or intended effects of the operation or the nature of the intended target’) (emphasis added).
====Applicability of international humanitarian law====
[L9] Provided that the operation is attributed to State B, a separate legal question is whether the cyber operation conducted by State B would bring into existence an international armed conflict between State B and State A. On the difference in the cyber context between the relevant thresholds under the law on the use of force and IHL, see Laurent Gisel, Tilman Rodenhäuser, and Knut Dörmann, ‘Twenty years on: International humanitarian law and the protection of civilians against the effects of cyber operations during armed conflicts’, (2020) 102(913) International Review of the Red Cross 287, 302–310.
[L10] In the present scenario, the effect of the cyber operation is difficult to compare to a classic kinetic operation because there is no physical damage comparable to that resulting from armed hostilities between States. At the same time, if computer systems in a significant number of hospitals are targeted and disrupted, it is reasonably foreseeable that injury or death will result. In line with the prevailing view that there is no requirement of a specific level of intensity of violence to trigger an international armed conflict (see in the box above), it could thus be argued that such operations would bring into existence an international armed conflict and have to comply with the limits imposed by IHL (on which see section 2.2.1 below). For the time being, however, it is unclear whether States would classify such cyber operations as bringing IHL into application.For instance, Germany states broadly that ‘armed hostilities’ that are ‘totally conducted by using cyber means’ can amount to an international armed conflict. Germany, ‘On the Application of International Law in Cyberspace: Position Paper’ (March 2021), 7. France considers that ‘while an armed conflict consisting exclusively of digital activities cannot be ruled out in principle, it is based on the capacity of autonomous cyberoperations to reach the threshold of violence required to be categorised as such’ (emphasis added). French Ministry of the Armies, ‘International Law Applied to Operations in Cyberspace’ (9 September 2019), 12. While Japan considers that the effects of a cyber operation ‘alone may reach the threshold of an "armed conflict”’, it also argues that this ‘needs to be decided on a case-by-case basis, taking into account a number of elements, such as the manner of the actual attack and the intent of each party to the incident, in a comprehensive manner’. Japan, Basic Position of the Government of Japan on International Law Applicable to Cyber Operations (28 May 2021), 7.
====International human rights law====
[L11] The scenario also raises the question of whether the cyber operation is in violation of State B’s obligation (1) to respect the right to life of those patients who died following the operation (Article 6 ICCPR) and (2) the right to health of persons whose health was negatively affected by the operation (Article 12 ICESCR).
[L12] In the present scenario, it must first be determined whether the patients are within State B’s jurisdiction, meaning whether State B owes human rights obligations to them. 
[L13] There are at least three possible approaches to determining whether a State owes human rights obligations to persons abroad who are affected by its cyber activities. 
[L14] First, a few States take the view that human rights treaties, such as the ICCPR, do not apply extraterritorially.Human Rights Committee, Concluding observations of the Human Rights Committee, United States of America, 18 December 2006, CCPR/C/USA/CO/3/Rev.1, para 10; Committee on Economic, Social and Cultural Rights, Concluding observations of the Committee on Economic, Social and Cultural Rights, Israel, 26 June 2003, E/C.12/1/Add.90, para. 11. See also Israel’s position as reflected in Legal Consequences of the Construction of a Wall in the Occupied Palestinian Territory, Advisory Opinion, I.C.J. Reports 2004, 136 [110]. On this view, State B would not owe human rights obligations to anyone outside of its territory, including the affected patients in State A. However, it should be noted that this view has been contradicted by the International Court of JusticeSee International Court of Justice, Legal Consequences of the Construction of a Wall in the Occupied Palestinian Territory, Advisory Opinion, 9 July 2004, paras 111 and 112. and it has gained minimal traction outside of the limited number of its supporters.See Nicola Wenzel, ‘Human Rights, Treaties, Extraterritorial Application and Effects’ in Rüdiger Wolfrum (ed), Max Planck Encyclopedia of Public International Law (OUP 2008) (updated May 2008) paras 4 and 21; see also Human Rights Committee, General Comment No. 31 on ‘The Nature of the General Legal Obligation Imposed on States Parties to the Covenant’, 26 May 2004, CCPR/C/21/Rev.1/Add.13, para. 10. 
[L15] Second, in line with the well-established understanding of jurisdiction under human rights law, a State only owes obligations under the ICCPR or the ICESCR to persons abroad if it exercises effective control over the territory in which the effects of the operation manifest,See Human Rights Committee, Concluding Observations, Israel, UN Doc CCPR/C/79/Add.93 (18 August 1998), para 10 (‘the Covenant must be held applicable to the occupied territories and those areas…where Israel exercises effective control’); Committee on Economic, Social and Cultural Rights, Concluding observations, Israel, UN Doc E/C.12/1/Add.90 (26 June 2003), para 31 (‘the Committee reaffirms its view that the State party’s obligations under the Covenant apply to all territories and populations under its effective control’). or if it has physical control over the victims;See Human Rights Committee, General Comment No. 31 on ‘The Nature of the General Legal Obligation Imposed on States Parties to the Covenant’, 26 May 2004, CCPR/C/21/Rev.1/Add.13, para. 10 (‘a State Party must respect and ensure the rights laid down in the Covenant to anyone within the power or effective control of that State Party, even if not situated within the territory of the State Party’); Committee on Economic, Social and Cultural Rights, Concluding observations, Israel, UN Doc E/C.12/1/Add.90 (26 June 2003), para 31 (‘the Committee reaffirms its view that the State party’s obligations under the Covenant apply to all territories and populations under its effective control’). referred to in the literature as, respectively, the spatial and personal models of jurisdiction.See generally Marko Milanovic, Extraterritorial Application of Human Rights Treaties: Law, Principles, and Policy (OUP 2011) 118–228. However, neither of these conditions is met in the present scenario. As a result, a cyber operation by State B that affects victims in State A would not violate State B’s human rights obligations because the victims do not come within State B’s jurisdiction.
[L16] Third, and without specifically referring to cyber operations, human rights treaty bodies have presented more extensive views on the scope of States’ extraterritorial jurisdiction under the ICCPR and the ICESCR. With regard to the right to life under the ICCPR, the UN Human Rights Committee opined that a State’s obligations to respect and to ensure this right extend to “persons located outside any territory effectively controlled by the State, whose right to life is nonetheless impacted by its military or other activities in a direct and reasonably foreseeable manner”.See Human Rights Committee, General comment No. 36 (2018) on article 6 of the International Covenant on Civil and Political Rights, on the right to life, 30 October 2018, CCPR/C/GC/36, para. 63. See also Marko Milanovic, Extraterritorial Application of Human Rights Treaties: Law, Principles, and Policy (OUP 2011) 209 ff. More broadly, the UN Committee on Economic, Social, and Cultural Rights has argued that under the ICESCR “States parties have to respect the enjoyment of the right to health in other countries”.CESCR General Comment No. 14: The Right to the Highest Attainable Standard of Health (Art. 12), 11 August 2000, E/C.12/2000/4, para. 39; see also Committee on Economic, Social and Cultural Rights, General comment No. 24 (2017) on State obligations under the International Covenant on Economic, Social and Cultural Rights in the context of business activities, 10 August 2017, E/C.12/GC/24, para. 29, in which the Committee states: “The extraterritorial obligation to respect requires States parties to refrain from interfering directly or indirectly with the enjoyment of the Covenant rights by persons outside their territories.” Under this approach, State B would owe human rights obligations to those affected by its cyber operations. It is unclear, however, whether such broad interpretations of the notion of jurisdiction reflect the current state of international law.Several States have rejected such interpretations in non-cyber contexts explicitly. See, for instance, the reactions of Austria, Canada, France, Germany, Norway, Netherlands, United States to draft General Comment No. 36 of the UN Human Rights Committee, available here: https://www.ohchr.org/en/hrbodies/ccpr/pages/gc36-article6righttolife.aspx
[L17] If the view suggested by the UN treaty bodies was followed, it would still need to be analysed whether State B acted in violation of its obligation under the right to life by using ransomware against public hospitals. Following the UN Human Rights Committee’s interpretation of the right to life, this would be the case if an act of the State – in this case the cyber operation that likely resulted in the death of two patients – impacted the right to life in an “in a direct and reasonably foreseeable manner”.See Human Rights Committee, General Comment No. 36 (2018) on article 6 of the International Covenant on Civil and Political Rights, on the right to life, 30 October 2018, CCPR/C/GC/36, para. 63. See also Marko Milanovic, Extraterritorial Application of Human Rights Treaties: Law, Principles, and Policy (OUP 2011) 209 ff. On another occasion, the Committee defines the relevant standard as an impact on the right to life in an “intentional or otherwise foreseeable and preventable” manner. Human Rights Committee, General Comment No. 36 (2018) on article 6 of the International Covenant on Civil and Political Rights, on the right to life, 30 October 2018, CCPR/C/GC/36, para. 6. In the present case, it could be argued that a cyber operation against a significant number of hospitals affects the right to life of patients in a direct and reasonably foreseeable manner, even if the cyber operation is not the immediate cause of death.Marko Milanovic and Michael N. Schmitt, ‘Cyber Attacks and Cyber (Mis)information Operations During a Pandemic’ (2020) 11 Journal of National Security Law & Policy 247, 262 (arguing that a State would violate the right to life if it, ‘through a hostile cyber operation, knowingly and intentionally increased the risk that a population would be exposed to infection, or denied them effective treatment’) (emphasis added).
[L18] Similarly, if the more extensive approach to jurisdiction was taken, it would follow that State B also violated its obligations under the right to health. This is because, as noted by the Committee on Economic, Social, and Cultural Rights, the obligation to respect that right requires States not to interfere “directly or indirectly with the enjoyment of the right to health”.CESCR General Comment No. 14: The Right to the Highest Attainable Standard of Health (Art. 12), para. 33. State B’s cyber operations which prevented patients from receiving treatment and which negatively affected State A’s ability to respond to a public health crisis would have violated that obligation.See Marko Milanovic and Michael N. Schmitt, ‘Cyber Attacks and Cyber (Mis)information Operations During a Pandemic’ (2020) 11 Journal of National Security Law & Policy 247, 262 (arguing that ‘[h]ostile cyber operations that disrupt individuals’ access to health care, or more generally a state’s ability to mitigate the effects of a pandemic, would easily run afoul of [the obligation to respect the right to health], which contains no threshold criterion’).
===What if it was State C: Focus on the law applicable during armed conflict===
====International humanitarian law====
[L19] If the operation is attributed to State C, it takes place in the context of an existing international armed conflict. As a consequence, all acts of the parties to the conflict with a sufficient nexus to that conflict are governed by IHL.See, eg, Marco Sassòli, International Humanitarian Law: Rules, Controversies, and Solutions to Problems Arising in Warfare (Edward Elgar 2019) 201 (“IHL only governs conduct that has a sufficient nexus to the armed conflict”); Gloria Gaggioli (ed), The Use of Force in Armed Conflicts (ICRC 2013) 4 (“In order to be covered by IHL, the use of force must take place in an armed conflict situation and must have a nexus with the armed conflict.”); Tallinn Manual 2.0, commentary to rule 80, para 5 (“there must be a nexus between the cyber activity in question and the conflict for the law of armed conflict [i.e., IHL] to apply to that activity”). Based on the evidence available, it is unclear whether such nexus existed, which would be assessed by reference to whether State C “acted in furtherance of or under the guise of the armed conflict”.Prosecutor v Kunarac et al (Appeal Judgement) IT-96-23 & IT-96-23/1-A (12 June 2002) [58]; see also Tallinn Manual 2.0, commentary to rule 80, para 6 (noting a difference of views among the experts: “According to one view, [IHL] governs any cyber activity conducted by a party to an armed conflict against its opponent … By a second view, the cyber activity must have been undertaken in furtherance of the hostilities, that is, in order to contribute to the originator’s military effort.”) The remainder of the analysis in this subsection proceeds on the assumption that this requirement was met.
[L20] In the present scenario, the malware encrypted computers used in the hospital and made medical data of hospital patients temporarily unavailable. The operation thereby interfered with the hospital’s medical work and prevented medical staff from treating those in need of care. Therefore, the operation would have constituted a violation of State C’s obligations to respect and to protect medical units.
[L21] It must further be inquired whether the operation amounts to an attack against a medical unit, which could amount to a war crime.Article 8(2)(b)(xxiv) Rome Statute of the International Criminal Court. This would be the case if the operation can reasonably be expected to cause injury or death to persons or damage or destruction to objects (see box above). If the view is taken that the notion of damage includes a loss of functionality, the present operation amounts to an attack because it effectively disabled the hospital computers. This conclusion will also be reached if the focus is not on the damage caused but on the reasonably foreseeable injury or death. This is because conducting a cyber operation that is expected to disrupt computers in 30% of a State’s hospitals can be “reasonably expected to cause injury or death to persons”.Tallinn Manual 2.0, Rule 92. On the basis of the foregoing, the operation would thus qualify as a prohibited attack against a medical unit.
====International human rights law====
[L22] Finally, it should be noted that it is generally – though not universally – accepted that international human rights law continues to apply during armed conflicts.See Legality of the Threat or Use of Nuclear Weapons Case (Advisory Opinion) (1996) ICJ Rep 226, para 25; Legal Consequences of the Construction of a Wall in the Occupied Palestinian Territories (Advisory Opinion) (2004) ICJ Rep 136, para 106; Armed Activities on the Territory of the Congo (Democratic Republic of the Congo v. Uganda), Judgment, I.C.J. Reports 2005, 168 [216]; see also Human Rights Committee, General Comment No. 31: Nature of the General Legal Obligation on States Parties to the Covenant, UN Doc. CCPR/C/21/Rev.1/Add. 13, 26 May 2004, para. 11; General Comment No. 35 – Article 9: Liberty and Security of person, UN Doc. CCPR/C/GC/35, 16 December 2014, para. 64; General Comment No. 36 – Article 6: Right to life, UN Doc. CCPR/C/GC/36, 3 September 2019, para. 64; but see e.g. M. J. Dennis, ‘Application of Human Rights Treaties Extraterritorially in Times of Armed Conflict and Military Occupation’ (2005) 99 American Journal of International Law 119. If the more extensive view on the notion of jurisdiction is taken, the conduct attributed to State C might also implicate its human rights obligations, in particular those under the rights to life and health (see paras L16–L18 above). In that case, the precise interplay between the relevant IHL and human rights obligations would require further analysis, which is beyond the scope of the present scenario.See generally René Provost, International Human Rights and Humanitarian Law (CUP 2002); Cordula Droege, ‘Elective Affinities? Human Rights and Humanitarian Law’ (2008) 90 IRRC 501; Iain Scobbie, ‘Principle or Pragmatics? The Relationship between Human Rights Law and the Laws of Armed Conflict’ (2009) 14 JCSL 449; Orna Ben-Naftali (ed), International Humanitarian Law and International Human Rights Law (OUP 2011); Daniel Bethlehem, ‘The Relationship between International Humanitarian Law and International Human Rights Law in Situations of Armed Conflict’ (2013) 2 Cambridge J Int’l & Comp L 180; Andrew Clapham, ‘The Complex Relationship Between the Geneva Conventions and International Human Rights Law’ in Andrew Clapham, Paola Gaeta, and Marco Sassòli (eds), The 1949 Geneva Conventions: A Commentary (OUP 2015); Marco Sassòli, International Humanitarian Law: Rules, Controversies, and Solutions to Problems Arising in Warfare (Edward Elgar 2019) 423–443.
==Checklist ==
* Who is responsible for the operation and can the act be attributed to a State?
* Does the operation take place in time of peace or in the context of an armed conflict?
* If the operation takes place in time of peace, does it
** Violate the principle of sovereignty, the principle of non-intervention, or the prohibition against the use of force?
** Violate the acting State’s human rights obligations? Does the acting State owe human rights obligations to the victims?
** Could it bring into existence an international armed conflict to which IHL applies?
* If the operation takes place in times of armed conflict, does it violate relevant rules of IHL, notably the obligation to respect and protect medical facilities and the prohibition against attacks against medical units?
==Appendixes ==
===See also===
* Scenario 13: Armed conflict
* Scenario 14: Ransomware campaign
* Scenario 23: Vaccine research
* International human rights law
* Sovereignty
* Prohibition of intervention
* Use of force
===Notes and references===
===Bibliography and further reading===
* Laurent Gisel, Tilman Rodenhäuser and Knut Dörmann, ‘Twenty years on: International humanitarian law and the protection of civilians against the effects of cyber operations during armed conflicts (2020) 102 IRRC 913.
* Kubo Mačák, Tilman Rodenhäuser and Laurent Gisel, Cyber attacks against hospitals and the COVID-19 pandemic: How strong are international law protections?, ICRC Humanitarian Law and Policy Blog, 2 April 2020.
* Marko Milanovic and Michael N Schmitt, Cyber Attacks and Cyber (Mis)information Operations during a Pandemic, (2020) 11 Journal of National Security Law & Policy 247.
* Harriet Moynihan, ‘The Vital Role of International Law in the Framework for Responsible State Behaviour in Cyberspace’ (2020) 5 Journal of Cyber Policy.
* Harriet Moynihan, ‘The Application of International Law to State Cyberattacks: Sovereignty and Non-intervention’ (2019) Chatham House. 
*Michael N Schmitt (ed), Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations (CUP 2017).
* Oxford Statement on the International Law Protections against Cyber Operations Targeting the Health-Care Sector (20 May 2020).
===Contributions===
* Scenario by: Tilman Rodenhäuser & Kubo Mačák
* Analysis by: Tilman Rodenhäuser & Kubo Mačák
* Reviewed by: Joost Bunk; Gary Corn; Przemyslaw Roguski
Previous: Scenario 19: Hate speech	Next: Scenario 21: Misattribution caused by deception
Category:Attack (international humanitarian law)Category:International humanitarian law
Category:International human rights law
Category:Hospitals
Category:Medical units
Category:Ransomware
Category:Prohibition of intervention
Category:Sovereignty
Category:Use of force
Category:Scenario