Legal review of cyber weapons, means and methods of warfare

== Definition ==
Legal review of cyber weapons, means and methods of warfare
The requirement that the legality of all new weapons, means and methods of warfare be systematically assessed is arguably one that applies to all States. It flows logically from the truism that States are prohibited from using illegal weapons, means and methods of warfare or from using weapons, means and methods of warfare in an illegal manner.ICRC, A Guide to the Legal Review of New Weapons, Means and Methods of Warfare: Measures to Implement Article 36 of Additional Protocol I of 1977 (Kathleen Lawand ed.) (ICRC 2006) 4. It is also widely considered, including by the ICRC, that a requirement to carry out legal reviews of new weapons, means and methods of warfare also flows from the obligation to ensure respect for IHL.ICRC, International Humanitarian Law and the Challenges of Contemporary Armed Conflicts: Recommitting to Protection in Armed Conflict on the 70th Anniversary of the Geneva Conventions (October 2019) 34 (“In the ICRC’s view, the requirement to carry out legal review of new weapons also flows from the obligation to ensure respect for IHL under Article 1 common to the Geneva Conventions.”). This view is shared by a number of States. See, Australia, The Australian Article 36 review process, working paper submitted to the Group of Government Experts of the High Contracting Parties to the Convention on Prohibitions or Restrictions on the Use of Certain Conventional Weapons Which May be Deemed to be Excessively Injurious or to Have Indiscriminate Effects (CCW), 2018, para. 3; The Netherlands and Switzerland, Weapons review mechanisms, working paper submitted to the CCW, 2017, para. 17. See also Tallinn Manual 2.0, commentary to rule 110, para 2. In addition, with respect to State parties to Additional Protocol I, Article 36 of that instrument mandates that “[i]n the study, development, acquisition or adoption of a new weapon, means or method of warfare,” States must determine whether its employment would, in some or all circumstances, be prohibited under IHL or any other applicable rule of international law.Article 36 AP I. It has been argued that the Article 36 obligation represents customary international law,See, eg, Duncan Blake and Joseph S. Imburgia, ‘“Bloodless Weapons”? The need to conduct legal review of certain capabilities and the implications of defining them as “weapons”’, (2010) 66 AFLRev 157, 163–64; see also, William H Boothby, Weapons and the Law of Armed Conflict (2nd edn, OUP 2016) 342–43 (“For states that are not party to AP1, the implied obligation should not necessarily be expressed in the same terms as article 36, but its existence is attested to by the practice of certain states before the adoption of AP1”). but this view is not universally accepted.See Tallinn Manual 2.0, commentary to rule 110, para 2; see also Natalia Jevglevskaja, ‘Weapons Review Obligation under Customary International Law’ (2018) 94 International Law Studies 186, 220.
The mere fact of a weapon’s novelty or its reliance on new technology does not automatically mean that the weapon is illegal.See, eg, US DoD Law of War Manual, para 6.2.1. Similarly, the lack of general practice by States in using the new weapon is irrelevant as to its legality under IHL.David Wallace, ‘Cyber Weapon Reviews under International Humanitarian Law: A Critical Analysis’ (2018) Tallinn Paper No. 11, 9. In determining the weapon’s lawfulness, the State in question must therefore assess those rules of IHL, which are binding on the State – be they treaty-based or customary.ICRC, A Guide to the Legal Review of New Weapons, Means and Methods of Warfare: Measures to Implement Article 36 of Additional Protocol I of 1977 (Kathleen Lawand ed.) (ICRC 2006) 10. Additionally, all States remain subject to the so-called Martens Clause,For a modern formulation of the Martens Clause, see Art 1(2) AP I (“In cases not covered by this Protocol or by other international agreements, civilians and combatants remain under the protection and authority of the principles of international law derived from established custom, from the principles of humanity and from dictates of public conscience.”). See also ICRC, A Guide to the Legal Review of New Weapons, Means and Methods of Warfare: Measures to Implement Article 36 of Additional Protocol I of 1977 (Kathleen Lawand ed.) (ICRC 2006) 17 para 1.2.2.3. which reinforces the notion that the lawfulness of a new weapon must be assessed under customary international law according to the principles of humanity and the requirements of public conscience.David Wallace, ‘Cyber Weapon Reviews under International Humanitarian Law: A Critical Analysis’ (2018) Tallinn Paper No. 11, 9. It is unsettled whether this consideration must take the form of a formal legal review.See Tallinn Manual 2.0, commentary to rule 110, para 4. According to the majority of the International Group of Experts, it would suffice for the State to seek the advice of a legal advisor at the relevant level of command. Nevertheless, legal review of new weapons conducted at the earliest possible stage is a critical measure to ensure compliance with the applicable IHL rules. It also helps prevent the costly consequences of approving and procuring a weapon the use of which is likely to be restricted or prohibited.ICRC, International Humanitarian Law and the Challenges of Contemporary Armed Conflicts: Recommitting to Protection in Armed Conflict on the 70th Anniversary of the Geneva Conventions (October 2019) 34-35; see also ICRC, A Guide to the Legal Review of New Weapons, Means and Methods of Warfare: Measures to Implement Article 36 of Additional Protocol I of 1977 (Kathleen Lawand ed.) (ICRC 2006) 11.
Although the precise definition of a “cyber weapon” is unsettled as yet,See, eg, Gary D. Brown and Andrew O. Metcalf, ‘Easier Said Than Done: Legal Reviews of Cyber Weapons’ (2014) 7 JNSLP 115, 135 (defining a kinetic and/or a cyber weapon as “an object designed for, and developed or obtained for, the primary purpose of killing, maiming, injuring, damaging or destroying”); Tallinn Manual 2.0, rule 103, para 2 (“cyber weapons are cyber means of warfare that are used, designed, or intended to be used to cause injury to, or death of, persons or damage to, or destruction of, objects”); Air Force Instruction 51-401 (3 August 2018) 13 (defining a cyber capability as “any device, computer program or computer script, including any combination of software, firmware or hardware intended to deny, disrupt, degrade, destroy or manipulate adversarial target information, information systems, or networks”). at the very least, all cyber tools capable of conducting “attacks” as understood in IHL, that is, acts of violence against the adversary whether in offence or in defence,Art 49 AP I. should be considered to qualify as cyber weapons,Tallinn Manual 2.0, rule 103, para 2; but see Jeffrey T Biller and Michael N Schmitt, ‘Classification of Cyber Capabilities and Operations as Weapons, Means, or Methods of Warfare’ (2019) 95 Int’l L Stud 179, 218 (arguing that “code used in hostile cyber operations does not qualify as a means of warfare”) and 219 (characterizing “cyber operations as a method of warfare”) (emphasis added). See further Scenario 22: Cyber methods of warfare (discussing the implications of these different views from an IHL perspective). thus falling under the principle that IHL applies to “all forms of warfare and to all kinds of weapons, those of the past, those of the present and those of the future”.Legality of the Threat or Use of Nuclear Weapons Case (Advisory Opinion) [1996] ICJ Rep 226, para 86. For State parties to Additional Protocol I, the obligation extends to the early stages of studying and developing a new cyber capability, be it a cyber weapon, means or method of warfare; these States must conduct a legal review; and the scope of the applicable legal framework includes the entirety of international law, not just the rules of IHL.ICRC, A Guide to the Legal Review of New Weapons, Means and Methods of Warfare: Measures to Implement Article 36 of Additional Protocol I of 1977 (Kathleen Lawand ed.) (ICRC 2006) 5, 10-11, 20, and 23-24; see also Tallinn Manual 2.0, commentary to rule 110, para 6.
In reviewing the lawfulness of a new weapon, means or method of warfare, States must first consider whether its employment is specifically prohibited or restricted by treaty-based or customary IHL.Examples of such specific prohibitions include the general ban on the use of chemical or biological weapons. Although no prohibitions of this kind exist at present with respect to cyber capabilities, this may well change in the future. In particular, there is recurring talk of States entering into “cyber arms control treaties” or agreeing to specific limitations on the development and use of cyber offensive capabilities. If formulated as binding prohibitions, these may prevent States from utilizing capabilities falling under the remit of such rules.
If no specific prohibition or restriction is found to apply, the cyber weapon, means or method of warfare in question must be assessed in light of the general prohibitions or restrictions under IHL that bind the State, be they treaty-based or customary. These include, in particular, the prohibition of weapons, means and methods of warfare that are of a nature to cause superfluous injury or unnecessary sufferingArt 23(e) Hague Regulations; Art 35(2) AP I; ICRC CIHL Study, rule 70; Tallinn Manual 2.0, rule 104. See also ICRC, A Guide to the Legal Review of New Weapons, Means and Methods of Warfare: Measures to Implement Article 36 of Additional Protocol I of 1977 (Kathleen Lawand ed.) (ICRC 2006) 15-16, paras 1.2.2.1-1.2.2.2. and the prohibition of means and methods of warfare that are by nature indiscriminate.Art 51(4)(b) AP I; ICRC CIHL Study, rules 12 and 71; Tallinn Manual 2.0, rule 105; see also ICRC, A Guide to the Legal Review of New Weapons, Means and Methods of Warfare: Measures to Implement Article 36 of Additional Protocol I of 1977 (Kathleen Lawand ed.) (ICRC 2006) 15-16, paras 1.2.2.1-1.2.2.2; and US DoD Manual, para 16.6 (“a legal review of the acquisition or procurement of a weapon that employs cyber capabilities likely would assess whether the weapon is inherently indiscriminate”). In addition, a weapon or means of warfare cannot be assessed in isolation from the manner in which it is expected to be used in the battlefield. States should therefore determine if the employment of a weapon for its normal or expected use would be prohibited by IHL under some or all circumstances.ICRC, A Guide to the Legal Review of New Weapons, Means and Methods of Warfare: Measures to Implement Article 36 of Additional Protocol I of 1977 (Kathleen Lawand ed.) (ICRC 2006) 10.
Publicly available national positions that address this issue include: 
 (2021),
 (2022), 
 (2023),
 (2024), 
 (2021), 
 (2021), 
 (2012),
==National positions==
===Australia (2020)===
===Brazil (2021)===
===Canada (2022)===
===Costa Rica (2023)===
===Czech Republic (2024)===
===Germany (2021)===
===Switzerland (2021)===
===United States (2012)===
== Appendixes ==
=== See also ===
* Scenario 10: Legal review of cyber weapons
* Scenario 22: Cyber methods of warfare
=== Notes and references ===
=== Bibliography and further reading ===
Category:Means and methods of cyber warfare
Category:International humanitarian law
Category:Legal review of cyber weapons
Category:Legal concepts