Scenario 29: Cyber operations against water and water infrastructure

Two States are involved in an international armed conflict. One of them launches two cyber operations against the other State’s water infrastructure, impacting the quality of the water and affecting that State’s armed forces, the civilian population, and civilian objects. This scenario analyses the application of the principles on conduct of hostilities to these operations, as well as the special protection of certain objects, including water and water facilities, under international humanitarian law.
==Scenario==
===Keywords===
Attack (international humanitarian law), conduct of hostilities, international humanitarian law, military objectives, precautions, objects indispensable to the survival of the civilian population, water infrastructure, natural environment.
===Facts===
[F1] State A’s population is highly concentrated in its capital located around Lake X, which supplies water to 90% of the population, including households and irrigation works, through its main drinking water treatment and supply plants. The main wastewater (sewage) treatment plant for both residential and industrial waste, releases safe levels of treated water directly to River Y, which is an affluent of Lake X. The State has systematically received warnings from its National Cyber Security Agency on the necessary updates to the software used by the plants since several vulnerabilities were evidenced and some attempted intrusions were detected. The Agency recommended the implementation of an air-gapped (isolated from the internet) network for the control and operation systems of the plants. However, sufficient budget has not been allocated to such projects, even when available.
[F2] After years of a tense relationship between State A and its neighboring State B, armed hostilities dramatically escalated by both conventional and cyber means. 
[F3] State B launched a cyber operation (incident 1) against the drinking water treatment installation, main source of drinking water for the civilian population in the capital, but which also provides water to camps where State A soldiers live and train through the same infrastructure and network. The State managed to access remotely the supervisory control and data acquisition (SCADA) systems of the plant and took control of the chlorine valves, while introducing malware which kept the sensors showing normal values to the controllers in order to hide the operation.
[F4] As a result, harmful proportions of chlorine were released into the drinking water source for several days and were only detected once the first intoxicated patients arrived at the hospital. The cyber operation was then detected and countered, but had in the meantime resulted in several deaths, including two soldiers from State A’s army, thousands of intoxications and damage to a substantial part of the crops near the capital. This also resulted in unprecedented rates of civilian population fleeing the capital due to safe water shortages and the acute sanitary situation.
[F5] Some weeks after the incident, State B launched another cyber operation (incident 2) targeting the wastewater treatment plant SCADA systems. The operation aimed to directly affect the military camps located by River Y, near the discharge of the plant, from which State A’s army was directly using and drinking water after incident 1.
[F6] As a result of this cyber operation, the facility’s treatment procedures were shut down, the water quality sensors disabled, and authorized personnel locked out of the compromised system. Unsafe water – containing sewage and industrial waste – was thus discharged in large amounts into River Y for a period of 3 weeks until State A managed to regain control over the systems. The operation resulted in several members of State A’s armed forces being hospitalized with severe gastrointestinal diseases and exacerbated the water insecurity in State A, since Lake X became highly contaminated thereafter.
===Examples===
*Israel’s water facilities attack (2020)
*Cyber incident against a water treatment plant in San Francisco Bay Area (2021)
*Cyber incident against a water authority in Pennsylvania (2023)
==Legal analysis==
For a general overview of the structure of analysis in this section, see Note on the structure of articles.
[L1] This scenario analyses the application of international humanitarian law (IHL) to cyber operations against water infrastructure in the context of an international armed conflict (IAC), causing harm to the civilian population. It addresses whether the operations qualify as attacks, legal issues related to the conduct of hostilities (including the special protection afforded by IHL to objects indispensable to the survival of the civilian population), and the protection of the natural environment in armed conflict.
===Application of international humanitarian law and conflict qualification===
[L2] In the present scenario, there is an ongoing IAC between State A and State B, since there are armed confrontations between the two States, conducted both by conventional and cyber means.
[L3] IHL applies to situations of armed conflict and governs all conduct of the parties to the conflict that has a sufficient nexus to the conflict, including cyber operations.Marco Sassòli, International Humanitarian Law. Rules, Controversies, and Solutions to Problems Arising in Warfare (Edward Elgar 2019) 537, M.N. 10.119; Tallinn Manual 2.0, Rule 80, Commentary, para. 5. Although there have been different interpretations of the requisite nexus,See in general ICTY, Prosecutor v. Kunarac et al. (Appeals Judgement) IT-96-23 and IT-96-23/1-A (12 June 2002), para. 58. See in particular for the cyber realm Tallinn Manual 2.0, Rule 80, Commentary, para. 6. in the present scenario it is clear that both operations against State A’s water installations attributable to State B were conducted in furtherance of the hostilities between the two States and thus fall under the IHL legal framework, including all applicable treaty and customary IHL.
===Obligations of State B===
====The notion of ‘attack’ under international humanitarian law====
[L4] The cyber operations launched by State B were clearly expected to cause reasonably foreseeable harm and therefore qualified as attacks. This holds true even if the method used to cause such effects, i.e., the manipulation of the SCADA control systems, was not violent as such. By altering the levels of chlorine to dangerous levels in the drinking water used by the households in State A for their daily lives (incident 1), the operation could have been reasonably expected to cause injury and even death to people, as well as damage to civilian objects. This is equally the case with respect to the discharge of unsafe water into the main source of water of the military camp (incident 2) which resulted in the injury of several members of State A’s armed forces as well as damage to the natural environment.As has been stated, “[i]njury includes illness and disease triggered by, for example, inadequate or insufficient water provision caused by an attack on […] a water purification station, a water pump […]”. See Eirini Giorgou and Abby Zeith, “When the lights go out: the protection of energy infrastructure in armed conflict” (Humanitarian Law & Policy, 20 April 2023). See also ICRC, International Humanitarian Law and the Challenges of Contemporary Armed Conflicts – Recommitting To Protection In Armed Conflict On The 70th Anniversary Of The Geneva Conventions (Challenges Report), ICRC, Geneva  (2019) 17-18.
[L5] As both operations could have been reasonably expected to cause physical damage in the form of injury to people and damage to civilian objects, they constituted attacks under IHL even applying the more restrictive threshold adopted by some States and part of the doctrine.See national positions of Denmark, Israel, and Peru. See also discussions in Tallinn Manual 2.0, Rule 92. Therefore, both incidents are subject to the IHL rules applicable to ‘attacks’, as discussed below.
[L6] Moreover, some States have specifically affirmed that cyber operations can qualify as attacks if they render inoperable or undermine the functioning of a State’s critical infrastructure needed for the provision of basic services, such as water.See the position of Ecuador, Bolivia and Guyana in OAS, “Improving Transparency: International Law and State Cyber Operations: Fourth Report”, OAS Doc. CJI/doc. 603/20 rev.1 corr.1 (5 March 2020), pp. 44-45, cited in Laurent Gisel, Tilman Rodenhäuser and Knut Dörmann, “Twenty years on: International humanitarian law and the protection of civilians against the effects of cyber operations during armed conflicts”, (2022) 102(913) International Review of the Red Cross, 316, footnotes 139-140.
====Principle of distinction: Military objectives====
[L7] Water infrastructure, including the industrial control systems supporting it,Sergio Caltagirone, “Industrial cyber attacks: a humanitarian crisis in the making” (Humanitarian Law & Policy, 3 December 2019), specific assessment done by Kubo Mačák. normally qualifies as a civilian object. IHL prohibits attacks on civilian objects,AP I, Arts. 48 and 52(1); ICRC CIHL Study, Rule 7. See also Geneva Water Hub, The Geneva List of Principles on the Protection of Water Infrastructure, Geneva (2019), Principle 6, p. 27; ICRC, International Humanitarian Law and the challenges of contemporary armed conflicts in 2015, Report prepared by the International Committee of the Red Cross for the 32nd International Conference of the Red Cross and Red Crescent, ICRC, Geneva (December 2015). including civilian infrastructure, unless the object in question has become a military objective.Laurent Gisel, Tilman Rodenhäuser and Knut Dörmann, “Twenty years on: International humanitarian law and the protection of civilians against the effects of cyber operations during armed conflicts”, (2022) 102(913) International Review of the Red Cross, 287–334,  296; ICRC, The principle of distinction under IHL, Cyber Operations during Armed Conflict Series, Geneva (March 2023) 1. It is therefore necessary to assess if the targeted facilities qualified as military objectives under IHL at the moment of the attack.
[L8] In the case of incident 1, the drinking water installation was providing safe drinking water for both the civilian population in the capital of State A, as well as the military camps of State A forces. The use of the installation for military purposes, i.e., for the sustenance of the military camp, may be considered to make an effective contribution to military action by its use. The fact that the same infrastructure is simultaneously used for civilian purposes, and is thus a so-called “dual-use” object,Geneva Water Hub, The Geneva List of Principles on the Protection of Water Infrastructure, Geneva (2019), Principle 6, Commentary, paras. 2-3. See also Yves Sandoz, Christophe Swinarski and Bruno Zimmerman (eds), Commentary on the Additional Protocols (ICRC 1987) (Commentary on Additional Protocol I), para. 2023. does not affect this conclusion, as long as the two cumulative conditions for a civilian object to become a military objective are met.ICRC, The principle of distinction under IHL, Cyber Operations during Armed Conflict Series, Geneva (March 2023) 1. However, this does not mean that the impact of the operation on the civilian use would not need to be addressed in the proportionality and precautions assessments (on which see paras L12–L22 below).Laurent Gisel, The Principle of Proportionality in the Rules Governing the Conduct of Hostilities Under International Humanitarian Law. International Expert Meeting 22-23 June 2016, ICRC, Geneva (August 2018) 37-38. See also Tallinn Manual 2.0, Rule 101, Commentary, para. 3. It is submitted that taking control over the cyber infrastructure falls under the notion of “capture” in the words of Article 52(2) AP I, since State B seized the object, maintaining control over its functionsRobert Kolb, ‘Military Objectives in International Humanitarian Law’ (2015) 28 Leiden Journal of International Law, 691-700, 694. and denying its use to the adversary.Marco Roscini, Cyber Operations and the Use of Force in International Law (Oxford University Press 2014) 186. The ‘capture’ of the water infrastructure did provide a definite military advantage in those circumstances, by harming State A’s armed forces, preventing the military camps from access to safe drinking water, and thus weakening the fighting ability of enemy armed forces.See Marco Sassòli, International Humanitarian Law. Rules, Controversies, and Solutions to Problems Arising in Warfare (Edward Elgar 2019) 352, M.N. 8.302. The drinking water facility did therefore qualify as a military objective.For further discussion see ICRC, International Humanitarian Law and the challenges of contemporary armed conflicts in 2015, Report prepared by the International Committee of the Red Cross for the 32nd International Conference of the Red Cross and Red Crescent (December 2015), paras. 215 ff.
[L9] In addition, under IHL, the use of indiscriminate means or methods of warfare, including those employing means or methods of warfareICRC, The principle of distinction under IHL, Cyber Operations during Armed Conflict Series, Geneva (March 2023), 2. the effects of which cannot be limited and thus are of a nature to strike both military objectives and civilians or civilian objects without distinction, are prohibited as constituting indiscriminate attacks.AP I, Art. 51(4)(c); See also ICRC CIHL Study, Rules 11-12.  See also, Tallinn Manual 2.0, Rule 105(b). In the present scenario, the method of ‘poisoning’ the drinking water by means of altering the normal parameters of the water installation, has an indiscriminate character, since it cannot be limited to the military objective, including the water facility, but affects all the accessible drinking water thus harming civilians without distinctionSee Yves Sandoz, Christophe Swinarski and Bruno Zimmerman, Commentary to Additional Protocols (ICRC 1987) para. 1963, affirming that “[t]here are also methods which by their very nature have an indiscriminate character, such as poisoning wells”, which results applicable mutatis mutandis to the present situation. and may be expected to cause disproportionate harm to civilians.AP I, Art. 51(5)(b). Therefore, it can be concluded that given the nature of the installation object of the attack (i.e., its preponderant civilian use alongside its military one) and the method employed,Marco Roscini, Cyber Operations and the Use of Force in International Law (Oxford University Press 2014) 173 and 218. As argued by the author, Art. 51(4)(c) focuses on the effects of the means or method “whether or not the weapon is capable to strike specific military objectives”. See also Geneva Water Hub, The Geneva List of Principles on the Protection of Water Infrastructure, Geneva (2019), Principle 8, Commentary, para. 1. the operation constituted an indiscriminate attack and thus was in violation of IHL.
[L10] Regarding incident 2, it should be first analyzed if the wastewater treatment facility constituted a military objective. As in the previous case, the installation was civilian in nature. Although its neutralization did provide a definite military advantage by harming the members of State A’s armed forces and preventing them from using the source of natural water, it is not clear whether its use, location or purpose made an effective contribution to military action per se. It could be argued that since the occurrence of incident 1, the armed forces (as well as the civilian population) had to resort to the natural water provided by the water stream. This water remained usable because of the functioning of the wastewater treatment plant and thus its use became a concrete contribution to military action at the moment of the attack. However, the contribution was, in view of this author, too indirect to qualify the installation as a military objective. The service ensured by the wastewater treatment facility was not providing water directly to the military, but it was preventing raw water from being contaminated. The armed forces directly made use of the raw water. Thus, in this case there was no direct but only an indirect connection with the installations, in contrast to the water treatment plant in incident 1, to which the military camp was directly connected through the pipeline providing drinking water. In addition, it is worth noting that in case of doubt regarding an object normally dedicated to civilian purposes, it must be presumed to remain protected as a civilian object, particularly should Additional Protocol I be applicable.Art 52(3) AP I; on the customary nature of this rule, see ICRC CIHL Study, commentary to rule 10, 35–36. It is worth noting that some States argue that this obligation does not reflect customary IHL.
[L11] Overall, even if the object was considered a military objective at the moment of the attack, State B had to respect the prohibition of indiscriminate attacks. This includes the prohibition of employing methods of combat the effects of which cannot be limited as required by IHL,AP I, Art. 51(4)(c). which was hardly complied with in the present scenario, and the principle of proportionality (on which see paras L12–L19 below).See for the analysis of an example of a cyber-attack against a water treatment facility, Tallinn Manual 2.0., Rule 106, Commentary, para. 4.
====Proportionality====
[L12] As affirmed in the previous section, it can be stated that incident 1 was directed at a military objective. Besides the conclusion that the attack would be contrary to IHL by employing indiscriminate methods, the expected incidental civilian harm caused by such a method would also be of particular relevance to the present analysis.
[L13] The fact that the object was also used for civilian purposes, that is, the provision of drinking water to the civilian population of State A’s capital, implied that the operation should have been reasonably expected to result in incidental civilian harm,ICRC, The Principle of Proportionality, Cyber Operations during Armed Conflict Series, Geneva (March 2023), 1. including civilian loss of life and/or injury and damage of civilian objects, and raised specific questions regarding the principle of proportionality.AP I, Art. 51(5)(b); see ICRC CIHL Study, Rule 14. For such assessment, all the reasonably foreseeable direct and indirect or reverberating effects on the civilian population caused by targeting the installation must be considered and appropriately weighed.See analysis in ICRC, International Humanitarian Law and the challenges of contemporary armed conflicts in 2015, Report prepared by the International Committee of the Red Cross for the 32nd International Conference of the Red Cross and Red Crescent (December 2015), para. 216; ICRC, International humanitarian law and cyber operations during armed conflicts: Position paper (2019) 7; see similarly the analysis in Geneva Water Hub, The Geneva List of Principles on the Protection of Water Infrastructure, Geneva (2019), Principle 6, Commentary, para. 3, Principle 9, Commentary, paras. 3-4, and its Annex, Commentary, para. 4.. See further, Tallinn Manual 2.0, Rule 101, Commentary, para. 3, and Rule 113, Commentary, para. 6. 
[L14] The expected civilian harm to the civilian population of State B’s first operation included the harmful effects to the health of the inhabitants of State A’s capital by means of intoxication by unhealthy levels of chlorine in the consumed water and the possible loss of life.
[L15] The same would hold true in case incident 2 was not already considered to have violated the principle of distinction (see paras L10–L11 above). The expected incidental harm by the foreseeable contamination of Lake X by means of the sewage and industrial waste carried in by its affluent river, would include the injury to the same population that after incident 1 turned to seek water directly from the source, exposing them to the health impacts of such contaminated water, including grave waterborne diseases.
[L16] The ICRC has argued that “[w]hile displacement is not expressly mentioned in the principles of proportionality and precautions as a relevant type of civilian harm”, the expected displacement of civilians when incidentally damaging their livelihoods, “will affect the weight to be given to that damage”.ICRC, International Humanitarian Law and the Challenges of Contemporary Armed Conflicts, Recommitting to protection in armed conflict on the 70th anniversary of the Geneva Conventions, ICRC, Geneva (October 2019), 18-19; ICRC, Explosive weapons with wide area effects: a deadly choice in populated areas, ICRC, Geneva (2022) 100-101. In the present scenario, the expected water insecurity and foreseeable civilian displacement triggered in State A by incident 1, and cumulatively by incident 2, should be also appropriately weighed when assessing the civilian damage in combination with the other types of civilian harm.
[L17] Further, attacks against water infrastructure by conventional or cyber means, especially certain types such as wastewater treatment plants, can cause significant damage to the natural environment. They may have reserves of toxic industrial chemicals, which can have significant adverse effects on the environment if released, including the contamination of surface and groundwaters, and degradation of the soil. This also entails grave risk to the health and livelihoods of the civilian population,Geneva Water Hub, The Geneva List of Principles on the Protection of Water Infrastructure, Geneva (2019) Principle 15, Commentary, para. 5, and its Annex, Commentary, para. 9. and the poisoning of the flora and fauna having an impact on the ecosystem.See mutatis mutandis, ICRC, Explosive weapons with wide area effects: a deadly choice in populated areas, ICRC, Geneva (2022) 58. As will be further explained below (see paras L30–L31), besides having a special protection, the natural environment is protected under the general principles of IHL governing civilian objects. Thus, damage to the natural environment must also be weighed as incidental civilian harm within the proportionality assessment.See ICRC, Guidelines on the Protection of the Natural Environment in Armed Conflict: Rules and Recommendations Relating to the Protection of the Natural Environment under International Humanitarian Law, with Commentary, ICRC, Geneva (2020), Rule 7, Commentary, paras. 115 ff. It should have been reasonably expected that the large amounts of toxic substances released to Lake X and River Y (an affluent of Lake X), including chlorine (incident 1) and sewage and industrial waste (incident 2), would result in the contamination of the water resources and surrounding ecosystems, on top of the harm caused to the civilian population using those resources for their living.
[L18] For its part, the reasonable concrete and direct military advantage anticipated from incident 1 would comprise harming soldiers of State A’s armed forces from the military camps provisioned by the targeted water installation, including injuries and/or loss of life, and prevent them from using the water pipeline as a source of safe drinking water for the military camp. Regarding incident 2, in addition to harming the members of State A’s armed forces, the attack would also imply the absence of water resources to provide for the livelihood of the armed forces in the military camps near Lake X. As a result, the camps would most likely be moved to another location.
[L19] Having assessed the expected incidental civilian harm and the concrete and direct military advantage anticipated, it is necessary to determine whether the harm would be excessive. While a definite conclusion could only be drawn based on more detailed factual circumstances,See Laurent Gisel, The principle of proportionality in the rules governing the conduct of hostilities under international humanitarian law: international expert meeting, 22-23 June 2016, ICRC (2018). it may be argued that the expected harm to the civilian population would be prima facie excessive in both individual incidents and thus in violation of the proportionality rule. This conclusion is based particularly on the expected widespread effects of the attack. Notably, 90% of the population living in the capital were users of the drinking water provided by the affected water infrastructure (incident 1), and subsequently the civilian population is supplied directly from the raw water resources (incident 2) and thus exposed to the direct and indirect effects of the attacks. This, added to the harm caused to the natural environment, that should also be appropriately weighed in the proportionality assessment. This would be arguably justified by the harm caused to soldiers from the camps supplied by the same water sources, and the likely relocation of the camps. Ultimately, however, the answer would have to be measured against the standard of a reasonable military commander based on the circumstances ruling at the time of the attack.ICRC, The Principle of Proportionality, Cyber Operations during Armed Conflict Series, Geneva (March 2023) 2.
====Precautions in attack====
[L20] For the purposes of this analysis it will be assumed that the two cyber operations would have complied with the principle of distinction, otherwise the operations would already be in violation of IHL. Both incident 1 and incident 2 entailed a very high risk for the civilian population and civilian objects, including the natural environment. State B was obliged to take constant care to spare the civilian population, civilians, and civilian objects in the conduct of its military operations.Art. 57(1) AP I; on the customary nature of this rule, see ICRC CIHL Study, Rule 15. In the absence of a feasible possibility of segregating the military use of the facilities from the civilian ones during the attack, the consequent expected civilian harm shall be constantly assessed in the conduct of the cyber operation within the principle of precautions.See Art. 57(2)(b) AP I. See also analysis in Geneva Water Hub, The Geneva List of Principles on the Protection of Water Infrastructure, Geneva (2019), Principle 9, Commentary, para. 4, and Principle 10, Commentary, para 3; ICRC, International Humanitarian Law and the challenges of contemporary armed conflicts in 2015, Report prepared by the International Committee of the Red Cross for the 32nd International Conference of the Red Cross and Red Crescent (December 2015). In the assessment of incidental civilian harm, the reasonably foreseeable direct and indirect (or reverberating) effects of the attack against the systems must be considered.ICRC, The Principle of Proportionality, Cyber Operations during Armed Conflict Series, Geneva (March 2023) 2. In this regard, the assessment should include the injury to the civilian population, but also the shortage of drinking water and starvation, its effects on the provision of other essential services such as health services and resulting disease outbreaks, shortage of safe water for irrigation of foodstuff, educational services, the expected displacementSee Eirini Giorgou and Abby Zeith, “When the lights go out: the protection of energy infrastructure in armed conflict” (Humanitarian Law & Policy, 20 April 2023). While not per se considered incidental civilian harm, displacement due to unavailability of essential services is relevant for proportionality and precautions in attack. and the effects on the natural environment as will be analyzed below (see paras L30–L31).
[L21] In the present case, it could be argued that State B did not comply with its obligations to take precautions in attack. First, although further information would be needed on the available means and methods for State B to conduct the military cyber operation, it presumably did not take all feasible precautions in the choice of means and methods, nor refrained from launching the attacks, to avoid or minimize the expected incidental loss and injury of civilians and damage of civilian objects. To the contrary, it was conducted using indiscriminate methods the effects of which cannot be limited as required by IHL, and causing disproportionate incidental civilian harm, an IHL prohibition reinforced by the principle of precautions.AP I, Arts. 57(2)(a)(iii) and 57(2)(b); ICRC CIHL Study, Rules 18 and 19. See ICRC, The Principle of Proportionality, Cyber Operations during Armed Conflict Series, Geneva (March 2023) 1.
[L22] Further, no advance warnings were given to the civilian population in either of the attacks to avoid or minimize the incidental harm caused by the contaminated water, even though it was clear that they would necessarily be adversely affected by its release. However, it should be recalled that advance warnings must only be given ‘unless circumstances do not permit’. In this regard, the feasibility of the warnings, including whether the element of surprise was essential to the success of the operations, should be also considered under this rule.See ICRC CIHL Study, commentary to Rule 20. See also Tallinn Manual 2.0, Rule 120, Commentary, para. 8. Moreover, the operations were only detected after the first casualties reached the hospital, and only thwarted by State A. Thus, State B did not cancel or suspend the cyber operations when it became apparent, not only that the objectives were subject to special protection under IHL (see para L24 below), but also when the excessive effects over the civilian population and objects became apparent.See for example the analysis in: Sergio Caltagirone, “Industrial cyber attacks: a humanitarian crisis in the making” (Humanitarian Law & Policy, 3 December 2019), specific assessment done by Kubo Mačák. This would indeed be the case of incident 2 as a subsequent incident after the effects of the first attack became apparent.
====Objects indispensable to the survival of the civilian population====
*Although the assessment of whether the objects in question enjoyed a special protection under IHL would ordinarily be done before the assessment of the principles of proportionality and precautions, it is included here in the present scenario for clarity purposes.
[L23] In addition to the previous analysis, water and water infrastructure, as objects indispensable to the survival of the civilian population, benefit from a special protection under IHL and thus additional restrictions apply to the operations targeting them. Therefore, even if the attacks had been lawful under IHL under the general principles, the cyber operations should be analyzed under the special protection regime, which adds a layer of protection to certain objects.
[L24] Both the drinking water facility (incident 1) as well as the water treatment plant (incident 2) of State A clearly fall under the special protection of objects indispensable to the survival of the civilian population under IHL.Sergio Caltagirone, “Industrial cyber attacks: a humanitarian crisis in the making” (Humanitarian Law & Policy, 3 December 2019), specific assessment done by Kubo Mačák; Geneva Water Hub, The Geneva List of Principles on the Protection of Water Infrastructure. Annex: Principle: Cyber operations, Geneva (November 2021), Commentary, para. 7. They are protected as installations securing access to quality water supply, indispensable to the subsistence of the population.See ICRC, International Humanitarian Law and the challenges of contemporary armed conflicts in 2015, Report prepared by the International Committee of the Red Cross for the 32nd International Conference of the Red Cross and Red Crescent (December 2015), para. 205.
[L25] The prohibition under IHL covers all acts denying the sustenance value of these objects, including the pollution of water reservoirs by chemical or other agents,Yves Sandoz, Christophe Swinarski and Bruno Zimmerman, Commentary to Additional Protocols (ICRC 1987), 655, para. 2101. limiting the provision of water supplies and putting the quality of drinking water for the population at risk.Mara Tignino, “The regulation of crimes against water in armed conflicts and other situations of violence”, (2023) 105(923) International Review of the Red Cross, 706-734, 717. These effects were clearly expected from attacking and rendering the installations useless and thus (i) introducing unhealthy concentrations of chlorine to the household water supplies, as well as (ii) polluting the water stream (River Y) as well as Lake X and arguably the soil, with sewage and industrial waste, as a result.
[L26] The cyber operations were indeed conducted by State B with the purpose of denying these objects of their sustenance value to the adverse party, i.e., State A. 
[L27] Considering that the incidents took place during, and had a nexus with, an IAC between States A and B, should Additional Protocol I be applicable, it remains to be addressed whether any of the exceptions apply to the present situation. Regarding the first exception, it is clear from the facts that the targeted water facilities were not only used for the sustenance solely of the armed forces of State A, as both were key installations for the provision of safe drinking water to the civilian population surrounding Lake X. In any case, it has been affirmed that this exception is “undoubtedly concerned with foodstuffs and the agricultural areas producing them, crops, livestock and supplies of drinking water, but not with installations for drinking water or irrigation works”,Yves Sandoz, Christophe Swinarski and Bruno Zimmerman, Commentary to Additional Protocols (ICRC 1987), 656, para. 2109. since they are hardly likely to be used solely for the benefit of armed forces.Yves Sandoz, Christophe Swinarski and Bruno Zimmerman, Commentary to Additional Protocols (ICRC 1987), 657, para. 2112.
[L28] Regarding the second exception, at least in incident 1 the facilities were being used for the sustenance of State A’s armed forces by providing water to its military camps, and thus could be arguably understood as providing direct support of military action. However, it has been argued by some that this does not seem sufficient reason for depriving these objects from its special protection.Yves Sandoz, Christophe Swinarski and Bruno Zimmerman, Commentary to Additional Protocols (ICRC 1987), 657, para. 2110. Further, the operations were clearly expected to leave the civilian population with (at least) inadequate water as to reduce the civilian population to starvation or force its movement.See Eirini Giorgou and Abby Zeith, “When the lights go out: the protection of energy infrastructure in armed conflict” (Humanitarian Law & Policy, 20 April 2023). The operations must have been expected to cause the pollution of the main water supply of State A’s capital, a source indispensable for its survival.
[L29] In conclusion, both cyber attacks constituted unlawful operations under IHL in violation of the special protection afforded to objects indispensable to the survival of the civilian population.
====Protection of the natural environment in armed conflict====
[L30] Water resources, including drinking water, are clearly protected under IHL also as part of the natural environment.There is no established definition of the natural environment under IHL, but it has been understood that “refers more broadly to the system of inextricable interrelations between living organisms and their inanimate environment. The notion of the natural environment under IHL includes everything that exists or occurs naturally, such as the general hydrosphere, biosphere, geosphere and atmosphere (including fauna, flora, oceans and other bodies of water, soil and rocks). The natural environment moreover includes natural elements that are or may be the product of human intervention, such as foodstuffs, agricultural areas, drinking water and livestock”. See ICRC, Guidelines on the Protection of the Natural Environment in Armed Conflict: Rules and Recommendations Relating to the Protection of the Natural Environment under International Humanitarian Law, with Commentary, ICRC, Geneva (2020) para. 16 (internal footnote omitted). See also Geneva Water Hub, The Geneva List of Principles on the Protection of Water Infrastructure. Annex: Principle: Cyber operations, Geneva (November 2021), Commentary, para. 9. Regarding the specific prohibition of employing cyber means or methods of warfare which are intended or may be expected to cause widespread, long-term, and severe damage to the natural environment, this would apply even if the water infrastructure become military objectives by their use.See also Geneva Water Hub, The Geneva List of Principles on the Protection of Water Infrastructure. Annex: Principle: Cyber operations, Geneva (November 2021). Both incidents 1 and 2 were expected to cause significant damage to the natural environment, including the severe contamination of at least Lake X and parts of River Y, and arguably parts of the surrounding ecosystem. However, it is not clear from the facts if the damage meets the very high threshold as provided by the cumulative criteria established in Articles 35(3) and 55 of Additional Protocol I, should it be applicable, including damage for a period of decades.Yves Sandoz, Christophe Swinarski and Bruno Zimmerman, Commentary to Additional Protocols (ICRC 1987) 416, para. 1454; Tallinn Manual 2.0, Rule 143, Commentary, para. 6-7. Therefore, no conclusive assessment could be done regarding the violation of this absolute prohibition under IHL.
[L31] However, the natural environment including the water resources, is a civilian object unless it becomes itself a military objective. As such, environmental damage caused by the release of harmful substances, including the contamination and degradation of water supplies, the soil and the ecosystem as a whole, should be duly considered within the incidental civilian harm when applying the principles of the conduct of hostilities to the attacks against the targeted water facilities, in particular within the proportionality assessment (see para L17 above).Geneva Water Hub, The Geneva List of Principles on the Protection of Water Infrastructure, Geneva (2019), Principle 9, Commentary, para. 5; Eirini Giorgou and Abby Zeith, “When the lights go out: the protection of energy infrastructure in armed conflict” (Humanitarian Law & Policy, 20 April 2023). 
====Conclusion====
[L32] To conclude, State B’s cyber operations against State A’s water infrastructure fall within the scope of IHL applicable to IACs and were not in compliance with the applicable rules governing the conduct of hostilities, including the principles of distinction, proportionality and precautions, in addition to qualifying as violations of the prohibition to attack, destroy, remove or render useless objects indispensable to the survival of the civilian population.
===Obligations of State A===
====Precautions against the effects of attacks====
[L33] State A had an obligation to adopt feasible precautionary measures to protect the civilian population and civilian objects under its control from the danger resulting from military operations, including cyber operations. While taking measures such as segregating civilian and military uses of water infrastructure may be less feasible in practice, applicable measures can include implementing strong cyber security defense measures and resilience of essential services’ cyber infrastructure to reduce cyber vulnerabilities and thus the risk of civilian harm.See ICRC, Avoiding Civilian Harm from Military Cyber Operations During Armed Conflicts, Report of Expert meeting held from 21-22 January 2020, ICRC, Geneva (May 2021). 27; Geneva Water Hub, The Geneva List of Principles on the Protection of Water Infrastructure. Annex: Principle: Cyber operations, Geneva (November 2021), Commentary, para. 5. See also the national position of Costa Rica: “Some of these measures may need to be implemented already in peacetime. For instance, States should cultivate a strong culture of cyber resilience throughout their societies and ensure that their critical infrastructure and other infrastructure used by civilians is protected to the highest possible standard”. See Ministry of Foreign Affairs of Costa Rica, “Costa Rica's Position on the Application of International Law in Cyberspace” (21 July 2023) 15.
 
[L34] In the present scenario, State A was systematically warned about the exposure of its water infrastructure to several cyber vulnerabilities but disregarded the implementation of precautionary measures that could have enhanced the protection and resilience of the infrastructure itselfSee ICRC, International Humanitarian Law and the challenges of contemporary armed conflicts in 2015, Report prepared by the International Committee of the Red Cross for the 32nd International Conference of the Red Cross and Red Crescent, 8-10 (December 2015), para. 214. and thus of the civilian population and civilian objects relying on such essential service from the effects of the attacks, such as updating the software of the plants or segregating them from the internet.See ICRC, Avoiding Civilian Harm From Military Cyber Operations During Armed Conflicts, Report of Expert meeting held from 21-22 January 2020, ICRC, Geneva (May 2021) 54. See also mutatis mutandis, Tallinn Manual 2.0, Rule 146, Commentary, para. 7.
 
[L35] Therefore, State A prima facie failed to take all feasible precautions, even in the knowledge of existing vulnerabilities within the water infrastructure’s systems, to protect to the maximum extent feasible the civilian population and civilian objects under its control, in contravention of its obligations under treaty (assuming that Additional Protocol I was applicable) and customary IHL.AP I, Art. 58(c); ICRC CIHL Study, Rule 22. For discussions on the customary nature of this rule, see Eric T. Jensen, “Article 58 and Precautions Against the Effects of Attacks in Urban Areas” (2016), 98(147) International Review of the Red Cross.
==Checklist==
*Did the operations have a nexus with an armed conflict?
*Did the operations qualify as “attacks” under IHL?
*Were the targeted objects military objectives under IHL? 
*Did the operations comply with the principle of proportionality under IHL? Was environmental damage appropriately weighed within the proportionality assessment? 
*Did the attacker adopt feasible precautions in order to avoid or minimize civilian harm? 
*Did the defender take feasible precautions to protect the civilian population under its control against the danger resulting from military operations? 
*Did the special protection that IHL affords to objects indispensable to the survival of the civilian population apply to the operations under analysis? 
*Were the rules on the protection of the natural environment applicable to the operations and if so, were they complied with?
==Appendixes==
===See also===
*Scenario 13: Cyber operations as a trigger of the law of armed conflict
*Scenario 22: Cyber methods of warfare
*International armed conflict
*Attack (international humanitarian law)
*Military objectives
*Means and methods of cyber warfare
*Objects indispensable to the survival of the civilian population
===Notes and references===
===Bibliography and further reading===
*Laurent Gisel, Tilman Rodenhäuser and Knut Dörmann, “Twenty years on: International humanitarian law and the protection of civilians against the effects of cyber operations during armed conflicts”, (2022) 102 (913) International Review of the Red Cross 
*Sergio Caltagirone, “Industrial cyber attacks: a humanitarian crisis in the making” (Humanitarian Law & Policy, 3 December 2019) 
*Eirini Giorgou and Abby Zeith, “When the lights go out: the protection of energy infrastructure in armed conflict” (Humanitarian Law & Policy, 20 April 2023) 
*Geneva Water Hub, The Geneva List of Principles on the Protection of Water Infrastructure, Geneva (2019)
*ICRC, The principle of distinction under IHL, Cyber Operations during Armed Conflict Series, Geneva (March 2023)
*ICRC, The Principle of Proportionality, Cyber Operations during Armed Conflict Series, Geneva (March 2023)
*Marco Roscini, Cyber Operations and the Use of Force in International Law (Oxford University Press 2014)
*Mara Tignino, “The regulation of crimes against water in armed conflicts and other situations of violence”, (2023) 105(923) International Review of the Red Cross 
*ICRC, Avoiding Civilian Harm from Military Cyber Operations During Armed Conflicts, Report of Expert meeting held from 21-22 January 2020, ICRC, Geneva (May 2021)
===Contributions===
*Scenario by: Dominique Steinbrecher
*Analysis by: Dominique Steinbrecher
*Reviewed by: Tadesse Kebebew, Chris O'Meara, Marco Roscini, and Mara Tignino
Previous: Scenario 28: Extraterritorial incidental civilian cyber harm	Next: Scenario 30: Backdoors and implants
Category:Scenario
Category:International armed conflict
Category:Attack (international humanitarian law)
Category:Military objectives
Category:Means and methods of cyber warfare
Category:Objects indispensable to the survival of the civilian population
Category:Proportionality