Hostname: page-component-78c5997874-lj6df Total loading time: 0 Render date: 2024-11-10T23:54:38.470Z Has data issue: false hasContentIssue false
  • English
  • Français

Some legal challenges posed by remote attack

Published online by Cambridge University Press:  28 February 2013

William Boothby
Get access Rights & Permissions [Opens in a new window]

Abstract

Attacking from a distance is nothing new, but with the advent of certain new technologies, attacks can be undertaken in which the attacker remains very remote from the scene where force will be employed. This article analyses the legal issues raised by attacks employing, respectively, remotely piloted vehicles, autonomous attack technologies, and cyber capabilities. It considers targeting law principles and rules, including distinction, discrimination, proportionality, and the precautions rules, observes that they all apply to remote attack and proceeds to explore the challenges that arise from implementing the legal requirements. Due note is taken of states’ legal obligation to review new weapons, methods and means of warfare, an obligation that reinforces the view that existing law will provide the prism through which these new attack technologies must be evaluated by states. The article then discusses how notions of liability apply in relation to remote attack, and considers whether it is depersonalization rather than remoteness in attack that is the critical legal issue.

Keywords

remote attackremotely piloted vehiclesunmanned aerial vehicles (UAVs)cyber attackautonomous attacklegal review of new weaponsmeans or method of warfareliability
Type
New Technologies and the Law
Information
International Review of the Red Cross , Volume 94 , Issue 886: New Technologies and Warfare , June 2012 , pp. 579 - 595
Copyright
Copyright © International Committee of the Red Cross 2013 

Access options

Get access to the full version of this content by using one of the access options below. (Log in options will check for institutional or personal access. Content may require purchase if you do not have access.)

References

1 P. Chatterjee, ‘Should we allow NATO free rein to attack and kill people?’, in The Guardian, 29 November 2011, available at: http://www.guardian.co.uk/commentisfree/2011/nov/29/nato-free-range-to-kill (this and all subsequent links last visited April 2012).

2 For reference to the earlier cited incident, see David Zucchino, ‘US Report faults Air Force drone crew, ground commanders in Afghan civilian deaths’, in Los Angeles Times, 29 May 2010, available at: http://articles.latimes.com/2010/may/29/world/la-fg-afghan-drone-20100531.

3 Cyber operations are taken for the purposes of this article to consist of the use of a computer to interact with another computer for purposes linked to a military operation. Cyber attack is therefore, for similar purposes, the use of a computer to target another computer and thus to cause violent effects, consisting of damage or destruction to property or death or injury to persons. See Schmitt, Michael N., ‘Cyber operations and the jus in bello: key issues’, in International Law Studies, Vol. 87, 2011, pp. 93–94Google Scholar.

4 Tikk, Eneken, Kaska, Kadri and Vihul, Liis, International Cyber Incidents: Legal Considerations, CCD COE Publications, Talllinn, 2010, pp. 18–25Google Scholar. Note also that a DDoS operation on 26–28 April 2008, which targeted the website of Radio Free Europe/Radio Liberty's Belarus service, is reported and discussed at E. Tikk, ibid., pp. 39–48, as is a cyber operation that targeted Lithuania on 17 June 2008, E. Tikk, ibid., pp. 51-64.

5 Owens, William A., Dam, Kenneth W. and Lin, Herbert S., Technology, Policy, Law and Ethics Regarding US Acquisition and Use of Cyberattack Capabilities, National Research Council of the National Academies, The National Academies Press, Washington D.C., 2009, pp. 173–176Google Scholar.

6 It is understood that these reports of damage have not been confirmed by Iran. See, however, Jonathan Fildes, ‘Stuxnet worm “targeted high value Iranian assets”’, in BBC News, 23 September 2010, available at: http://www.bbc.co.uk/news/technology-11388018; and Broad, William J., Markoff, John and Sanger, David E., ‘Israeli test on worm called crucial in Iran nuclear delay’, in New York Times, 15 January 2011Google Scholar, available at: http://www.nytimes.com/2011/01/16/world/middleeast/16stuxnet.html?pagewanted=all.

7 See Article 49(1) of API, which defines attacks in terms of the use of violence, whether in offence or defence.

8 As to the controversies raised by the use of unmanned platforms to conduct attacks during current operations, see for example Karen DeYoung, ‘U.S. officials cite gains against Al-Qaeda in Pakistan’, in Washington Post, 1 June 2009, available at: http://www.washingtonpost.com/wp-dyn/content/article/2009/05/31/AR2009053102172.html; the associated analysis by Kenneth Anderson in ‘The continuing predator drone campaign in Pakistan’, in Opinio Juris Blog, 1 June 2009, available at: http://opiniojuris.org/2009/06/01/the-continuing-predator-drone-campaign-in-pakistan/; and Karen DeYoung, ‘CIA idles drone flights from base in Pakistan’, in Washington Post, 1 July 2011, available at: http://www.washingtonpost.com/world/national-security/cia-idles-drone-flights-from-base-in-pakistan/2011/07/01/AGpOiKuH_story.html. As to US appreciation of the strategic importance of attacks on Al Qaeda often carried out using unmanned platforms, see Eric Schmitt and Mark Mazzetti, ‘Obama adviser outlines plans to defeat Al Qaeda’, New York Times, 29 June 2011, available at: http://www.nytimes.com/2011/06/30/world/30terror.html.

9 Adopted in Geneva, 8 June 1977.

10 For a discussion of this issue, see Michael N. Schmitt, ‘Cyber operations and the jus in bello: key issues’, in US Naval War College Blue Book, ‘International Law and the Changing Character of War’, Vol. 87, 2011, p. 89.

11 In practice, many of the rules in API, Articles 48 to 67, are customary in nature and thus bind all states; see Henckaerts, Jean-Marie and Doswald-Beck, Louise, Customary International Humanitarian Law, Vol. 1: Rules, Cambridge University Press, 2005CrossRefGoogle Scholar (hereafter ‘ICRC Study’). While in the view of the present author the rules in Articles 35(3), 55 and 56 of API have not achieved customary status, note for example the principle of distinction as reflected in the ICRC Study, rule 1 at page 3: ‘The parties to the conflict must at all times distinguish between civilians and combatants. Attacks may only be directed against combatants. Attacks must not be directed against civilians’. Note also the International Court of Justice (ICJ) finding that the principle of distinction is ‘an intransgressible principl[e] of international customary law’, International Court of Justice, Advisory Opinion on the Threat or Use of Nuclear Weapons, ICJ Reports, 8 July 1996, p. 257, para. 79. The ICRC Study reflects the principle of discrimination in its rule 11 at page 37, rule 12 at page 40, rule 13 at page 43, and rule 14 at page 46. These rules respectively prohibit indiscriminate attacks, spell out what such attacks comprise, and then reflect Article 51(5)(a) and (b) of API which, it will be recalled, are described in the treaty as examples of indiscriminate attacks. Customary law also recognizes a rule that requires attackers to take certain precautions in attacks. These customary precautionary rules are reflected in the ICRC Study at rules 18 to 21 on pages 58 to 65. For a discussion of the customary law of targeting, see Boothby, William H., The Law of Targeting, Oxford University Press, Oxford, 2012CrossRefGoogle Scholar, Chapter 5.

12 See, for example, the discussion in ‘Targeting operations with drone technology: humanitarian law implications’, in Background Note for the American Society of International Law Annual Meeting, Human Rights Institute, Columbia Law School, 25 March 2011.

13 Article 48 of API requires that ‘in order to ensure respect for and protection of the civilian population and civilian objects, the Parties to the conflict shall at all times distinguish between the civilian population and combatants and between civilian objects and military objectives and accordingly shall direct their operations only against military objectives’. The notion of ‘military objective’ is defined, so far as objects are concerned, in Article 52(2) of API.

14 By virtue of Article 51(4) of API, attacks are indiscriminate and therefore prohibited if they are not directed at a specific military objective, if they employ a method or means of combat that cannot be directed at a specific military objective, or the effects of which cannot be limited as required by international law, and in any such case are of a nature to strike the military objective and civilians or civilian objects without distinction. An attack that may be expected to cause excessive incidental injury to civilians and/or damage to civilian objects is stated at Article 51(5) to be an example of an indiscriminate attack.

15 For example, the prohibitions on making the civilian population, individual civilians, or civilian objects the object of attack in Articles 51(2) and 52(1) of API.

16 Article 57(1) of API.

17 The language used in Article 57(2)(a)(i) is ‘everything feasible’, which the UK interprets as everything ‘practicable or practically possible taking into account all circumstances ruling at the time including humanitarian and military considerations’; UK statement (b) made on ratification of API on 28 January 1998. Consider also Eritrea/Ethiopia Claims Commission, Partial Award, Central Front, Ethiopia's Claim 2, 28 April 2004, para. 110, available at: http://www.pca-cpa.org/showpage.asp?pag_id=1151.

18 Article 57(2)(a)(ii) of API.

19 Article 57(2)(a)(iii) of API.

20 Article 57(2)(b) of API.

21 Article 57(2)(c) of API.

22 Article 57(3) of API.

23 The interesting question is whether the absence of a person from the cockpit renders compliance with the rules easier or more difficult. Providing an answer would involve considering whether direct, as opposed to sensor-based observation of the intended target by the person deciding on the particular attack would have been feasible in the relevant circumstances had a manned platform been used; whether such direct observation in the prevailing circumstances would have made any difference to the quality of attack decision-making; whether enemy action may have diverted the pilot's attention from the targeting task; whether other distractions would have been present; and relevant and numerous other issues.

24 The word ‘autonomy’ is sometimes used to refer to aspects of the navigational system of the platform. In the present article, it specifically refers to the method of attack, and particularly to the method whereby the weapon's target is selected.

25 This requirement is customary in nature; see rule 18 of the ICRC Study and the discussion at W. Boothby, above note 11, p. 73.

26 See above note 17.

27 See Bill Boothby, ‘The law relating to unmanned aerial vehicles, unmanned combat aerial vehicles and intelligence gathering from the air’, in Humanitäres Völkerrecht – Informationsschriften, Vol. 24, issue 2, 2011, p. 81.

28 UK statement (i) made on ratification of API on 28 January 1998.

29 The statement was made by reference to Articles 51 and 57. Viewing individual hostile acts in isolation ‘would ignore the problems resulting from modern strategies of warfare, which are invariably based on an integrated series of separate actions forming one ultimate compound operation … The aggregate military operation of the belligerent may not be divided up into too many individual actions, otherwise the operative purpose for which the overall operation was designed slips out of sight’. Oeter, Stefan, ‘Methods and means of combat’, in Fleck, D. (ed.), The Handbook of International Humanitarian Law, 2nd edn, 2009, p. 186Google Scholar.

30 The particular platform will form part of the weapon system associated with the relevant missile, etc. It will be a part of that means of warfare.

31 See, however, Arkin, Ronald C., Governing Lethal Behavior in Autonomous Robots, CRC Press Taylor & Francis Group, Boca Raton, F.A., 2009CrossRefGoogle Scholar, for a discussion of technical approaches to robotic decision-making designed to overcome the issues discussed in the present section. For a statement of the technological requirements before autonomous attack is likely to become legally acceptable, see Gillespie, Tony and West, Robin, ‘Requirements for autonomous unmanned air systems set by legal issues’, in The International C2 Journal, Vol. 4, No. 2, 2010, pp. 1–32Google Scholar, available at: http://www.dodccrp.org/files/IC2J_v4n2_02_Gillespie.pdf. For a suggested ethical duty to use UAVs, see Strawser, Bradley J., ‘Moral predators: the duty to employ uninhabited aerial vehicles’, in Journal of Military Ethics, Vol. 9, No. 4, 2010, pp. 342–344CrossRefGoogle Scholar. Arkin, Ronald C., ‘The case for ethical autonomy in unmanned systems’, in Journal of Military Ethics, Vol. 9, No. 4, 2010, pp. 332CrossRefGoogle Scholar, analyses why humans breach the legal and moral prohibition of attacking civilians and argues that robotic attack techniques will tend to obviate such unacceptable behaviour.

32 The word ‘environment’ is used because views differ as to whether cyberspace can properly be described as a ‘domain’; see Hayden, Michael V., ‘The future of things “cyber”’, in Strategic Studies Quarterly, Vol. 5, No. 1, Spring 2011, pp. 3–4Google Scholar; and Shaud, John A., ‘An Air Force strategic vision for 2020–2030’, in Strategic Studies Quarterly, Vol. 5, No. 1, Spring 2011, pp. 8–17Google Scholar.

33 Note, for example, the May 2009 cyber operation that shut down the US FBI computer network; Bill Gertz, ‘Inside the ring’, in The Washington Times, 18 June 2009, available at: http://www.washingtontimes.com/news/2009/jun/18/inside-the-ring-95264632/?page=all; for an indication of the scale and extent of cyber espionage, see Sean Rayment, ‘How safe are Britain's cyber borders?’, in The Sunday Telegraph, 26 June 2011, available at: http://www.telegraph.co.uk/news/uknews/defence/8598952/How-safe-are-Britains-cyber-borders.html.

34 See E. Tikk, et al., above note 4, pp. 18–25; and W. A. Owens, et al., above note 5, pp. 173–176.

35 J. Markoff, ‘Georgia takes a beating in the cyberwar with Russia’, in New York Times, Bits Blog, 11 August 2008, available at: http://bits.blogs.nytimes.com/2008/08/11/georgia-takes-a-beating-in-the-cyberwar-with-russia/; European Union Independent International Fact Finding Mission on the Conflict in Georgia, Report (2009); and see also E. Tikk, et al., above note 4, pp. 67–79.

36 J. Fildes, ‘Stuxnet worm attacked high value Iranian assets’, in BBC News, 23 September 2010, available at: http://www.bbc.co.uk/news/technology-11388018; and W. J. Broad, et al., above note 6.

37 For the meaning of weapon see McClelland, Justin, ‘The review of weapons in accordance with Article 36 of Additional Protocol 1’, in International Review of the Red Cross, Vol. 85, No. 850, June 2003, p. 397CrossRefGoogle Scholar. For the meaning of ‘means of warfare’, see Boothby, William H., Weapons and the Law of Armed Conflict, Oxford University Press, Oxford, 2009, p. 4CrossRefGoogle Scholar.

38 For a discussion of the application of the law of armed conflict to cyber operations, see Dunlap, Charles J., ‘Perspectives for cyber strategists on law for cyberwar’, in Strategic Studies Quarterly, Spring 2011, pp. 81–99Google Scholar.

39 Article 36 of API.

40 W. H. Boothby, above note 37, pp. 69–85 and 345–347.

41 See statement (c) made by the UK on ratification of API on 28 January 1998.

42 Note in this regard the observation in the UK Manual that the level at which legal responsibility to take precautions in attack rests is not specified in API, that whether a person has this responsibility will depend on whether he has any discretion as to the way in which the attack is carried out, and that the responsibility will therefore range from Commanders in Chief and their planning staffs to individual soldiers opening fire on their own initiative; those carrying out orders for an attack must cancel or suspend it if the object to be attacked is such that the proportionality rule will be breached. UK Joint Service Manual of the Law of Armed Conflict, UK Ministry of Defence, 2004, para. 5.32.9.

43 This is an important caveat – opposing forces may be deliberately corrupting the image, impeding the operation of critical sensors, or using spoofs or other ruses to distort the picture.

44 Article 8(2)(b)(i) of the Rome Statute of the International Criminal Court, 1998 (hereinafter ‘Rome Statute’) provides for the crime of ‘intentionally directing attacks against the civilian population as such or against individual civilians not taking direct part in hostilities’.

45 Article 8(2)(b)(ii) of the Rome Statute provides for the offence of ‘intentionally directing attacks against civilian objects, that is, objects that are not military objectives’.

46 Article 8(2)(b)(iv) of the Rome Statute provides for the offence of ‘intentionally launching an attack in the knowledge that such attack will cause incidental loss of life or injury to civilians or damage to civilian objects or wide-spread, long-term and severe damage to the natural environment which would be clearly excessive in relation to the concrete and direct overall military advantage anticipated’.

47 Article 87 of API, and Article 28 of the Rome Statute.

48 The lawfulness of the action precludes liability of the state that undertook the attack in question; Hague Convention IV, Article 3, requires that there has been a violation. As to liability of individual combatants, Article 43(2) of API provides that members of the armed forces are combatants, that is they have the right to participate directly in hostilities.

49 The Article provides: ‘A belligerent party which violates the provisions of the said Regulations shall, if the case so demands, be liable to pay compensation. It shall be responsible for all acts committed by persons forming part of its armed forces’.

50 This Article is in similar terms to Article 3 of Hague Convention IV, 1907, save that Article 91 refers to breaches of any of the 1949 Conventions or of the Protocol, and thus explicitly refers to breaches of the targeting rules in API. Paragraph 3646 of the API Commentary makes the point that the provision in Article 3 corresponded to the general principles of law on state responsibility, a view which is endorsed by the International Law Commission (ILC) in its Commentary to Article 7 of the Draft Articles on State Responsibility, 2001, para. 4.

51 For a more detailed discussion of compensatory arrangements, see API Commentary, paras 3652–3659.

52 Note, for example, the decision of the Eritrea-Ethiopia Claims Commission, partly based on adverse inferences, reinforcing the conclusion that not all feasible precautions were taken by Eritrea in its conduct of air strikes on Mekele on 5 June 1998 and finding Eritrea liable for the resulting deaths and injury to civilians and damage to civilian objects, reflected in Eritrea-Ethiopia Claims Commission, Partial Award Decision, Central Front, Ethiopia's Claim 2, 28 April 2004, para. 112, available at: http://www.pca-cpa.org/showpage.asp?pag_id=1151.

53 ‘Compensation can only be awarded in respect of damages having a sufficient causal connection with conduct violating international law … The degree of connection may vary depending upon the nature of the claim and other circumstances’; Eritrea-Ethiopia Claims Commission, Decision Number 7, para. 7, available at: http://www.pca-cpa.org/showpage.asp?pag_id=1151. Later in the same decision, the Commission determined that the necessary connection is best characterized as ‘proximate cause’ and that in deciding whether that test is met the Commission would consider whether the relevant event should have been reasonably foreseen by an actor committing the international delict in question; ibid., para. 13. It would be for an adjudicating court, tribunal, or commission to determine, in the light of its remit, whether a similar approach should be adopted in determining whether a sufficient causal relationship exists between a failure to take precautions and ensuing injury, damage, or loss.

54 Compensatory payment may, however, be made on an ex gratia basis, such as reportedly occurred following the attack of the Chinese Embassy in Belgrade by US aircraft operating with NATO on 7 May 1999; see Kerry Dumbaugh, ‘Chinese Embassy bombing in Belgrade: compensation issues’, in CRS Report for Congress, available at: http://congressionalresearch.com/RS20547/document.php.

55 See T. Gillespie and R. West, above note 31, citing Myers, A., ‘The legal and moral challenges facing the 21st century Air Commander’, in Royal Air Force Air Power Review, Vol. 10, No. 1, Spring 2007, pp. 76–96Google Scholar, for the view that the responsibility of designers is discharged ‘once the UAS [unmanned aerial system] has been certified by the relevant national air authority’; T. Gillespie and R. West, ibid., p. 7.

56 The criticism by Idomeneus of the bow was that ‘my way is not to fight my battles standing far away from my enemies’; Homer, Illiad, 13.262–3. O'Connell comments that the bow did not fit with the confrontational image that was the essence of heroic warfare; O'Connell, Robert L., Of Arms and Men: A History of War, Weapons and Aggression, Oxford University Press, Oxford, 1989, p. 48Google Scholar. Perhaps our ethical misgivings about some aspects of remote warfare have their origins in the Homeric notion of heroic warfare.

57 B. J. Strawser, above note 31, p. 343.

58 See Article 6 of the ILC Draft Articles on State Responsibility, 2001, available at: http://untreaty.un.org/ilc/texts/instruments/english/commentaries/9_6_2001.pdf, and note para. 3 of the associated commentary.

59 Consider, however, paragraph 5.32.9 of the UK Manual summarized above at note 42.

60 Whether proceedings on such a basis would be viable would, as always, depend on the available evidence.