This article adopts a critical approach towards scholarship seeking to identify binding due diligence obligations for States in cyberspace. The article demonstrates that due diligence obligations are anchored in specific primary rules and are not a universal standalone source from which it is possible to derive binding obligations for all areas of activity. The consensus position of States in United Nations fora clearly determines that due diligence in cyberspace is a voluntary, non-binding norm of responsible State behaviour, and there is currently insufficient State practice and opinio juris to support the development of a customary rule containing binding due diligence obligations in cyberspace. Consequently, the article concludes that attempts to establish binding due diligence obligations in cyberspace constitute lex ferenda that may be understood as an interventionist attempt by scholars to fill what they perceive to be dangerous legal gaps.

This article argues that the growing involvement of civilians in activities on the digital battlefield during armed conflicts puts individuals at risk of harm and contributes to the erosion of the principle of distinction, a cornerstone of international humanitarian law (IHL). The article begins by outlining the ongoing trend of civilianization of the digital battlefield and puts forward brief scenarios to illustrate it. It then examines the narrow circumstances under which such forms of civilian involvement may qualify as direct participation in hostilities under IHL, and discusses what this means for the individuals concerned, particularly from the perspective of their loss of protection under the law. The analysis shows that certain types of State conduct which put civilians in harm's way by inducing them to directly participate in hostilities may constitute standalone violations of IHL and human rights law obligations. Beyond these specific prescriptions, the encouragement of civilian involvement undermines the principle of distinction, with dangerous ripple effects on the interpretation of those rules of IHL that flow from it. Accordingly, the article concludes that States should act to reverse the trend of civilianization of the digital battlefield and refrain as much as possible from involving civilians in the conduct of cyber hostilities.

Digitalization and new technologies have an increasingly important role in today's humanitarian activities. As humanitarian organizations become more active in and reliant on new and digital technologies, they evolve from being simple bystanders to being fully fledged stakeholders in cyberspace, vulnerable to adverse cyber operations that could impact on their capacity to protect and assist people affected by armed conflict or other situations of violence.

This shift makes it essential for humanitarian organizations to understand and properly map their resulting cyber perimeter. Humanitarian organizations can protect themselves and their activities by devising appropriate cyber strategies for the digital environment. Clearly defining the digital boundaries within which they carry out operations lays the groundwork for humanitarian organizations to develop a strategy to support and protect humanitarian action in the digital environment, channel available resources to where they are most needed, and understand the areas in which their operational dialogue and working modalities need to be adapted for cyberspace.

The purpose of this article is to identify the unique problems facing international humanitarian organizations operating in cyberspace and to suggest ways to address them. More specifically, the article identifies the key elements that an international humanitarian organization should consider in developing a cyber security strategy. Throughout, the International Committee of the Red Cross and its specificities are used as an example to illustrate the problems identified and the possible ways to address them.

The use of cyber operations during armed conflicts and the question of how international humanitarian law (IHL) applies to such operations have developed significantly over the past two decades. In their different roles in the Legal Division of the International Committee of the Red Cross (ICRC), the authors of this article have followed these developments closely and have engaged in governmental and non-governmental expert discussions on the subject. In this article, we analyze pertinent humanitarian, legal and policy questions. We first show that the use of cyber operations during armed conflict has become a reality of armed conflicts and is likely to be more prominent in the future. This development raises a number of concerns in today's increasingly cyber-reliant societies, in which malicious cyber operations risk causing significant disruption and harm to humans. Secondly, we present a brief overview of multilateral discussions on the legal and normative framework regulating cyber operations during armed conflicts, looking in particular at various arguments around the applicability of IHL to cyber operations during armed conflict and the relationship between IHL and the UN Charter. We emphasize that in our view, there is no question that cyber operations during armed conflicts, or cyber warfare, are regulated by IHL – just as is any weapon, means or methods of warfare used by a belligerent in a conflict, whether new or old. Thirdly, we focus the main part of this article on how IHL applies to cyber operations. Analyzing the most recent legal positions of States and experts, we revisit some of the most salient debates of the past decade, such as which cyber operations amount to an “attack” as defined in IHL and whether civilian data enjoys similar protection to “civilian objects”. We also explore the IHL rules applicable to cyber operations other than attacks and the special protection regimes for certain actors and infrastructure, such as medical facilities and humanitarian organizations.

Armed reprisals are the limited use of military force in response to unlawful actions perpetrated against states. Historically, reprisals provided a military remedy for states that had been wronged (often violently) by another state without having to resort to all-out war in order to counter or deter such wrongful actions. While reprisals are broadly believed to have been outlawed by the UN Charter, states continue to routinely undertake such self-help measures. As part of the roundtable, “The Ethics of Limited Strikes,” this essay examines the doctrine of armed reprisals in light of recent instances of states using force “short of war” in this manner. We argue that the ban on reprisals has been largely ignored by states, and that recent attempts to apply the laws of armed conflict to the cyber domain (such as the Tallinn Manual) are further weakening this prohibition. We conclude that this is a potentially dangerous development that lowers the bar for resorting to military force, risking escalation and thereby further destabilizing the international system.

As a general matter, international humanitarian law is up to the task of providing the legal framework for cyber operations during an armed conflict. However, two debates persist in this regard, the resolution of which will determine the precise degree of protection the civilian population will enjoy during cyber operations. The first revolves around the meaning of the term “attack” in various conduct of hostilities rules, while the second addresses the issue of whether data may be considered an object such that operations destroying or altering it are subject to the prohibition on attacking civilian objects and that their effects need be considered when considering proportionality and the taking of precautions in attack. Even if these debates were to be resolved, the civilian population would still face risks from the unique capabilities of cyber operations. This article proposes two policies that parties to a conflict should consider adopting in order to ameliorate such risks. They are both based on the premise that military operations must reflect a balance between military concerns and the interest of States in prevailing in the conflict.

The most significant debate regarding the applicability of international humanitarian law to cyber operations involves interpretation of the rules governing cyber “attacks”, as that term is understood in the law. For over a decade, the debate has been a binary one between advocates of the “permissive approach” developed by the author and a “restrictive approach” championed by those who saw the permissive approach as insufficiently protective of the civilian population and other protected persons and objects. In this article, the author analyses that debate, and explains a third approach developed during the Tallinn Manual project. He concludes by suggesting that the Tallinn Manual approach best approximates the contemporary law given the increasing value which societies are attributing to cyber activities.

Cyber warfare figures prominently on the agenda of policymakers and military leaders around the world. New units to ensure cyber security are created at various levels of government, including in the armed forces. But cyber operations in armed conflict situations could have potentially very serious consequences, in particular when their effect is not limited to the data of the targeted computer system or computer. Indeed, cyber operations are usually intended to have an effect in the ‘real world’. For instance, by tampering with the supporting computer systems, one can manipulate an enemy's air traffic control systems, oil pipeline flow systems, or nuclear plants. The potential humanitarian impact of some cyber operations on the civilian population is enormous. It is therefore important to discuss the rules of international humanitarian law (IHL) that govern such operations because one of the main objectives of this body of law is to protect the civilian population from the effects of warfare. This article seeks to address some of the questions that arise when applying IHL – a body of law that was drafted with traditional kinetic warfare in mind – to cyber technology. The first question is: when is cyber war really war in the sense of ‘armed conflict’? After discussing this question, the article goes on to look at some of the most important rules of IHL governing the conduct of hostilities and the interpretation in the cyber realm of those rules, namely the principles of distinction, proportionality, and precaution. With respect to all of these rules, the cyber realm poses a number of questions that are still open. In particular, the interconnectedness of cyber space poses a challenge to the most fundamental premise of the rules on the conduct of hostilities, namely that civilian and military objects can and must be distinguished at all times. Thus, whether the traditional rules of IHL will provide sufficient protection to civilians from the effects of cyber warfare remains to be seen. Their interpretation will certainly need to take the specificities of cyber space into account. In the absence of better knowledge of the potential effects of cyber warfare, it cannot be excluded that more stringent rules might be necessary.