Military objectives

== Definition of military objectives ==
Military objectives
The principle of distinction, one of the foundational precepts of IHL, requires that the parties to an armed conflict must at all times distinguish between civilian objects and military objectives and may, accordingly, only direct their operations against military objectives.Art 48 AP I; ICRC CIHL Study, rule 7. The customary definition of military objectives is found in Article 52(2) of Additional Protocol I: 
In so far as objects are concerned, military objectives are limited to those objects which by their nature, location, purpose or use make an effective contribution to military action and whose total or partial destruction, capture or neutralization, in the circumstances ruling at the time, offers a definite military advantage.
Thus, to qualify as a military objective, an object must cumulatively meet the two criteria set forth in the abovementioned rule, which must be determined on a case-by-case basis.See Yves Sandoz, Christophe Swinarski and Bruno Zimmermann (eds), Commentary on the Additional Protocols of 8 June 1977 to the Geneva Conventions of 12 August 1949 (ICRC 1987), 635 para 2018; International Law Association Study Group on the Conduct of Hostilities in the 21st Century, ‘The Conduct of Hostilities and International Humanitarian Law: Challenges of 21st Century Warfare’ (2017) 93 International Law Studies 322, 327–328. In case of doubt as to whether an object that is normally dedicated to civilian purposes is being used to make an effective contribution to military action, it must be presumed to remain protected as a civilian object.Art 52(3) AP I; on the customary nature of this rule, see ICRC CIHL Study, commentary to rule 10, 35–36. In the cyber context, see e.g., the national positions of France (Ministry of Defense of France, ‘International Law Applied to Operations in Cyberspace’ (9 September 2019) 14); and Germany (Federal Government of Germany, ‘On the Application of International Law in Cyberspace’, Position Paper (March 2021) 8).
The formal scope of application of the Protocol is limited to international armed conflicts (IACs).Art 1 AP I. However, an identical definition of military objectives is found in treaties applicable in non-international armed conflicts (NIACs).See, e.g., Amended Protocol II to the CCW, Article 2(6); Second Protocol to the Hague Convention for the Protection of Cultural Property, Article 1(f). Moreover, certain non-party States to the Protocol accept the customary nature of the definition.See, e.g., Brian Egan, Legal Adviser, Department of State, “Remarks to the American Society of International Law: International Law, Legal Diplomacy, and the Counter-ISIL Campaign” (1 April 2016), 242 (“In particular, I’d like to spend a few minutes walking through some of the targeting rules that the United States regards as customary international law applicable to all parties in a NIAC: … Insofar as objects are concerned, military objectives are those objects which by their nature, location, purpose or use make an effective contribution to military action and whose total or partial destruction, capture or neutralization, in the circumstances ruling at the time, offers a definite military advantage.”). Accordingly, the ICRC has characterized the definition of military objectives as a norm of customary international humanitarian law applicable in both IACs and NIACs.ICRC CIHL Study, rule 8. See also Tallinn Manual 2.0., commentary to rule 100, para 1.
Relevant rules of IHL apply to kinetic operations as well as to cyber operations.Tallinn Manual 2.0, rule 80 (“Cyber operations executed in the context of an armed conflict are subject to the law of armed conflict.”). However, the application of those rules in specific circumstances may pose novel challenges. This is because the rules governing targeting developed with physical operations in mind, and it is not always clear what their application to cyber operations entails.See William H Boothby, The Law of Targeting (OUP 2012) 387–88. For example, there is some disagreement on what types of acts amount to “attacks”Cf Art 49(1) AP I (defining “attacks” as “acts of violence against the adversary, whether in offence or in defence”). in the context of cyber operations, in particular when the operation in question is limited to the manipulation of data.See, e.g., William H Boothby, The Law of Targeting (OUP 2012) 384–87; Noam Lubell, ‘Lawful Targets in Cyber Operations: Does the Principle of Distinction Apply?’ (2013) 89 Int’l L Studies 252, 254–74; Marco Roscini, Cyber Operations and the Use of Force in International Law (OUP 2014) 180–81; Yoram Dinstein, The Conduct of Hostilities under the Law of International Armed Conflict (3rd edn, CUP 2016) 3. Nevertheless, even those operations that might not qualify as “attacks” under IHL may still only be directed against military objectives, as required by the principle of distinction.Art 48 AP I (“the Parties to the conflict ... shall direct their operations only against military objectives”). It should be noted that it is not universally accepted that the reference to “operations” in Article 48 reflects customary international law. See, e.g., Noam Neuman, ‘Challenges in the Interpretation and Application of the Principle of Distinction During Ground Operations in Urban Areas’ (2018) 51 VJTL 807, 821 fn 44. Further, due to the interconnectedness of civilian and military networks as well as in-built redundancies, it may be challenging to apply the definition of military objectives to those parts of cyber infrastructure that simultaneously serve civilian and military purposes (also referred to as “dual-use objects”).See Laurent Gisel, Tilman Rodenhäuser, and Knut Dörmann, ‘Twenty years on: International humanitarian law and the protection of civilians against the effects of cyber operations during armed conflicts’, (2020) 102(913) International Review of the Red Cross 287, 321–322.
Publicly available common and national positions that address this issue include:
 (2024),
 (2024),
 (2023),
 (2024), 
 (2019), 
 (2021), 
 (2012).
===Common positions===
====European Union (2024)====
===National positions===
====Austria (2024)====
====Costa Rica (2023)====
==== Czech Republic (2024) ====
====France (2019)====
====Germany (2021)====
====United States (2012)====
== Qualification of data as an object under IHL ==
Data as an object under IHL
The definition of military objectives and the prohibition of attacks against civilian objects are limited to “objects”. In this regard, a debate has arisen on whether data constitutes an “object” as understood in IHL, in which case cyber operations against data (such as deleting or damaging data) would be governed by the principles of distinction, proportionality and precaution and the protection they afford to civilian objects.See Kubo Mačák, ‘Unblurring the lines: military cyber operations and international law’ (2021) 6(3) Journal of Cyber Policy 411, 421–422. Conversely, if data does not qualify as an “object”, civilian datasets would enjoy significantly more limited protection in times of armed conflict.On the protection afforded by IHL to certain categories of data (such as medical data or data of humanitarian organizations) irrespective of their qualification as “objects”, see e.g. Kubo Mačák and Laurent Gisel, ‘Grammar: Rules in a Cyber Conflict’, in Patryk Pawlak and François Delerue (eds), Cyber Defence in the European Union (EUISS 2022) 67.
Three main views have emerged in this regard. One view, held by the majority of experts involved in the Tallinn Manual process, is that the ordinary meaning of the term “object” cannot be interpreted as including data because objects are material, visible and tangible.Tallinn Manual 2.0, commentary to rule 100, paras 5–6 (noting that the majority of experts considered that due to it being intangible, data does not fall within the ordinary meaning of the term object, which is “something visible and tangible”) (internal quotation marks deleted); but see Michael N Schmitt, ‘The Notion of ‘Objects’ during Cyber Operations: A Riposte in Defence of Interpretive and Applicative Precision’ (2015) 48 IsrLR 81, 93 (noting that although the “visible and tangible” criterion influenced the Tallinn Manual experts’ deliberations, it was not dispositive). Proponents of this view place particular importance on the meaning that the drafters of the definition of military objectives would have ascribed to the word “object” at the time, and they reject that this meaning has evolved since then.See, e.g., Michael N Schmitt, ‘The Notion of ‘Objects’ during Cyber Operations: A Riposte in Defence of Interpretive and Applicative Precision’ (2015) 48 IsrLR 81, 93; Ori Pomson, ‘“Objects”? The Legal Status of Computer Data under International Humanitarian Law’ (2023) __ Journal of Conflict and Security Law __ (forthcoming). Accordingly, cyber operations against data would not fall within the ambit of the relevant rules of IHL unless the operation in question resulted in some physical effect and/or a loss of functionality of the target system or network.Tallinn Manual 2.0, commentary to rule 100, para 6. Some States, including Denmark,Ministry of Defence of Denmark, Military Manual on International Law Relevant to Danish Armed Forces in International Operations (2016) 292. Chile,Chile, Response submitted by Chile to the OAS Inter-American Juridical Committee Questionnaire (14 January 2020), cited in OAS, Improving Transparency: International Law and State Cyber Operations: Fifth Report, OAS Doc. CJI/doc. 615/20 rev.1 (7 August 2020) para 36. or Israel,Roy Schondorf, ‘Israel’s perspective on key legal and practical issues concerning the application of international law to cyber operations’ (2021) 97 International Law Studies, 401. also subscribe to this view.
By contrast, others have argued that either all or some types of data should be considered as “objects” under IHL.See, e.g., Heather A Harrison Dinniss, ‘The Nature of Objects: Targeting Networks and the Challenge of Defining Cyber Military Objectives’ (2015) 48 IsrLR 39; Kubo Mačák, ‘Military Objectives 2.0: The Case for Interpreting Computer Data as Objects under International Humanitarian Law’ (2015) 48 IsrLR 55; Robert McLaughlin, ‘Data as a Military Objective’, Australian Institute of International Affairs (20 September 2018); Tim McCormack, ‘International Humanitarian Law and the Targeting of Data’ (2018) 94 International Law Studies 222. One view, taken by several States – including Austria,[https://docs-library.unoda.org/Open-Ended_Working_Group_on_Information_and_Communication_Technologies_-_(2021)/Austrian_Position_Paper_-_Cyber_Activities_and_International_Law_(Final_23.04.2024).pdf Position Paper of the Republic of Austria:
Cyber Activities and International Law] (April 2024) 18. Costa Rica,Ministry of Foreign Affairs of Costa Rica, "Costa Rica's Position on the Application of International Law in Cyberspace" (21 July 2023) 13–14 (para 50). Finland,Finland, ‘International Law and cyberspace: Finland’s national positions’ (2020) 7. Germany,Federal Government of Germany, ‘On the Application of International Law in Cyberspace’, Position Paper (March 2021) 8. Norway,Norway, Manual i krigens folkerett, (2013) para 9.58. and RomaniaOfficial compendium of voluntary national contributions on the subject of how international law applies to the use of information and communications technologies by States, UNODA, A/76/136 (August 2021) 78. – is that the protection of civilian objects extends to civilian data. This implies that all data constitutes an “object” for the purposes of IHL. This interpretation is supported by the “modern meaning” of the notion of objects in today’s society as well as by the object and purpose of the relevant IHL rules.Kubo Mačák, ‘Military Objectives 2.0: The Case for Interpreting Computer Data as Objects under International Humanitarian Law’ (2015) 48 IsrLR 55, 80; see also Robert McLaughlin, ‘Data as a Military Objective’, Australian Institute of International Affairs (20 September 2018). It has also been described as consistent with the traditional understanding of the notion of “object” under IHL, which is broader than the ordinary meaning of the word and also encompasses, for example, locations and animals. Laurent Gisel, Tilman Rodenhäuser and Knut Dörmann, ‘Twenty years on: International humanitarian law and the protection of civilians against the effects of cyber operations during armed conflicts’ (2020) 102(913) International Review of the Red Cross 287, 319. According to this view, cyber operations that may be reasonably expected to cause damage or destruction of data are subject to the IHL rules on the conduct of hostilities.
A third view – taken by some experts and States – suggests a differentiation between content data and other data. Under this view, civilian ‘content data (such as civilian, bank or medical data, etc.) are protected under the principle of distinction’,Ministry of Defense of France, International Law Applied to Operations in Cyberspace (9 September 2019) 14. meaning they must not be attacked or disproportionately harmed. This position leaves aside the issue of whether other types of data (such as code) qualify as objects or not.See Kubo Mačák and Laurent Gisel, ‘The Legal Constraints of Cyber Operations in Armed Conflicts’, in R Pillai Rajagopalan (ed), Future Warfare and Technology: Issues and Strategies (Wiley 2022) 148. For the view that, conversely, operational-level data (i.e., code) may qualify as an object, see Heather A Harrison Dinniss, ‘The Nature of Objects: Targeting Networks and the Challenge of Defining Cyber Military Objectives’ (2015) 48 IsrLR 39, 41.
For its part, the ICRC has stated that “data have become an essential component of the digital domain and a cornerstone of life in many societies” and thus “in the ICRC’s view, the conclusion that deleting or tampering with essential civilian data would not be prohibited by IHL in today’s ever more data-reliant world seems difficult to reconcile with the object and purpose” of IHL.ICRC, International Humanitarian Law and the Challenges of Contemporary Armed Conflicts (2019) 28. The ICRC has highlighted medical data, tax records, bank accounts, social security and biometric data as essential civilian data and an ‘essential component of digitalized societies’. See ICRC, ‘International Humanitarian Law and Cyber Operations during Armed Conflicts’ ICRC position paper (November 2019) 8. In this regard, it has also highlighted the importance “for States to agree on an understanding that civilian data is protected” by the IHL rules governing the conduct of hostilities.ICRC, ‘International Humanitarian Law and Cyber Operations during Armed Conflicts’ ICRC position paper (November 2019) 8.
Publicly available national positions that address this issue include: 
 (2024),
 (2021), 
 (2023), 
 (2023), 
 (2020),
 (2019),
 (2021),
 (2020), 
 (2021),
 (2021).
===National positions===
====Austria (2024)====
====Brazil (2021)====
====Costa Rica (2023)====
====Denmark (2023)====
====Finland (2020)====
====France (2019)====
====Germany (2021)====
====Israel (2020)====
====Romania (2021)====
====Switzerland (2021)====
== Appendixes ==
=== See also ===
* Scenario 12: Cyber operations against computer data
=== Notes and references ===
=== Bibliography and further reading ===
Category:International humanitarian law
Category:Military objectives
Category:Distinction
Category:Legal concepts