On Thin Ice: Qualification of Cyber-Attacks on Personal Data under International Humanitarian Law
Abstract
The article examines the possibility and conditions for qualifying cyber-attacks on personal data as a military operation, an attack, and/or an armed conflict from the perspective of international humanitarian law (hereinafter — IHL). It is often personal data that is the target of a cyber-attack. In this context, potential legal qualification of a cyber-attack depends on whether and to what extent states recognise data as an “object” under IHL. In the absence of a specific treaty dealing with the application of IHL to the malicious use of information and communication technologies (hereinafter — ICTs), the main focus of the study is on the existing sources of IHL (Geneva Conventions, Additional Protocols, principles), customary international law as well as judicial decisions and legal teachings as subsidiary means for the determination of rules of law. Special attention is paid to the positions of the Russian Federation and the United States on the issue of the application of IHL to cybernetic activities. The author concludes that a cyber-attack on personal data can qualify as a military operation, an attack and a prerequisite for the outbreak of an armed conflict, and offers possible qualification criteria. At the same time, “stretching” jus in bello to the activities involving ICTs creates threats for the international community due to prospective militarisation of “cyberspace”.
Downloads
References
Ardilla Castro C. A., Ramírez Benítez E., Cubides-Cárdenas J. (2020) International Humanitarian Law and Its Significance for Current and Future Military Operations. Revista Científica General José María Córdova, vol. 18, no. 32, pp. 857–882. DOI: https://doi.org/10.21830/19006586.697
Chang Z. (2017) Cyberwarfare and International Humanitarian Law. Creighton International and Comparative Law Journal, vol. 9, no. 1, pp. 29–53. DOI: https://doi.org/10.2139/ssrn.2973182
David E. (2011) Printsipy prava vooruzhennykh konfliktov [Principles of the Law of Armed Conflict], Moscow: The ICRC.
Dörr O., Schmalenbach K. (eds.) (2018). Vienna Convention on the Law of Treaties: A Commentary, Heidelberg: Springer Berlin. DOI: https://doi.org/10.1007/978-3-662-55160-8
Garkusha-Bozhko S. Yu. (2021) Mezhdunarodnoe gumanitarnoe pravo v kiberprostranstve: ratione materiae, ratione temporis i problema kvalifikatsii kiberatak [International Humanitarian Law in Cyberspace: Ratione Materiae, Ratione Temporis and Problem of Cyber-Attack Qualification]. Tsifrovoe pravo, vol. 2, no. 1, pp. 64–80. (In Russian). DOI: https://doi.org/10.38044/2686-9136-2021-2-1-64-82
Garkusha-Bozhko S. Yu. (2023) Opredelenie vooruzhennogo konflikta v kiberprostranstve [The Definition of Armed Conflict in Cyberspace]. Vestnik of Saint Petersburg University. Law, vol. 14, no. 1, pp. 194–210. (In Russian). DOI: https://doi.org/10.21638/spbu14.2023.112
Geiss R., Lahmann H. (2021) Protection of Data in Armed Conflict. International Law Studies, vol. 97, no. 556, pp. 556–572.
Faisal S., Emad A. A., Sultan I. A. (2022) International Responsibility Arising from Cyberattacks in the Light of Contemporary International Law. International Journal of Cyber Criminology, vol. 16, no. 1, pp. 156–169.
Ivanova K. A., Myltykbaev M. Zh., Shtodina D. D. (2022) Ponyatie kiberprostranstva v mezhdunarodnom prave [The Concept of Cyberspace in International Law]. Pravoprimenenie, vol. 6, no. 4, pp. 32–44. (In Russian). DOI: https://doi.org/10.52468/2542-1514.2022.6(4).32-44
Kapustin A. Ya. (2022) Suverenitet gosudarstva v kiberprostranstve: mezhdunarodno-pravovoe izmerenie [Sovereignty in Cyberspace: International Legal Dimension]. Zhurnal zarubezhnogo zakonodatel’stva i sravnitel’noogo pravovedeniya, vol. 18, no. 6, pp. 99–108. DOI: https://doi.org/10.12737/jflcl.2022.079
Laurent G., Tilman R., Knut D. (2020) Twenty Years On: International Humanitarian Law and the Protection of Civilians Against the Effects of Cyber Operations During Armed Conflicts. International Review of the Red Cross, vol. 102, no. 913, pp. 287–334. DOI: https://doi.org/10.1017/S1816383120000387
Mačák K. (2015) Military Objectives 2.0: The Case for Interpreting Computer Data as Objects under International Humanitarian Law. Israel Law Review, vol. 48, no. 1, pp. 55–80. DOI: https://doi.org/10.1017/S0021223714000260
Mačák K. (2021) Unblurring the Lines: Military Cyber Operations and International Law. Journal of Cyber Policy, vol. 6, no. 3, pp. 411–428. DOI: https://doi.org/10.1080/23738871.2021.2014919
Manevich V. V. (2024) Mezhdunarodno-pravovoe regulirovanie primeneniya kibersredstv pri vedenii vooruzhennykh konfliktov: pravovye osnovy i nauchnye discussii [International Legal Regulation of the Use of Cyber Means in Armed Conflicts: Legal Foundations and Scientific Discussions]. Zakon i Pravo, vol. 12, no. 2, pp. 275–282. (In Russian).
McCormack T. (2018) International Humanitarian Law and the Targeting of Data. International Law Studies, vol. 94, no. 1, pp. 222–240.
Ottis R. (2008) Analysis of the 2007 Cyber Attacks Against Estonia From the Information Warfare Perspective. 7th European Conference on Information Warfare and Security 2008, pp. 163–168.
Pomson O. (2023) ‘Objects’? The Legal Status of Computer Data under International Humanitarian Law. Journal of Conflict and Security Law, vol. 28, no. 2, pp. 349–387. DOI: https://doi.org/10.1093/jcsl/krad002
Roscini M. (2014) Cyber Operations and the Use of Force in International Law, Oxford: Oxford University Press. DOI: https://doi.org/10.1093/acprof:oso/9780199655014.001.0001
Rusinova V. N. (2018) Mezhdunarodno-pravovoy printsip nevmeshatel’stva i kiberoperatsii: neopravdannye ozhidaniya? [The International Legal Principle of Non-interference and Cyber-operations: Unjustified Expectations?]. Mezhdunarodnoe pravosudie, no. 1, pp. 38–52. (In Russian).
Rusinova V. N. (2022) Mezhdunarodno-pravovaya kvalifikatsiya vredonosnogo ispol’zovaniya informatsionno-kommunikatsionnaykh technologii: v poiskakh konsesusa [Qualification of Harmful Use of Information and Communications Technologies Under International Law: In Search of a Consensus]. Moscow Journal of International Law, no. 1, pp. 38–51. (In Russian).
Schmitt M. N. (2013) Tallinn Manual on the International Law Applicable to Cyber Warfare, Cambridge: Cambridge University Press. DOI: https://doi.org/10.1017/CBO9781139169288
Schmitt M. N. (2017) Tallinn Manual 2.0 on International Law Applicable to Cyber Operations, 2nd ed., Cambridge: Cambridge University Press. DOI: https://doi.org/10.1017/9781316822524
Schmitt M. N. (2019) Wired Warfare 3.0: Protecting the Civilian Population during Cyber Operations. International Review of the Red Cross, vol. 101, no. 910, pp. 333–355. DOI: https://doi.org/10.1017/S1816383119000018
Schondorf R. (2021) Israel’s Perspective on Key Legal and Practical Issues Concerning the Application of International Law to Cyber Operations. International Law Studies, vol. 97, no. 395, pp. 395–406.
Spaic B. (2023) Evolutionary and Static Interpretation. In: Załuski W. (ed.) Research Handbook on Legal Evolution, Edward Elgar Publishing. DOI: https://doi.org/10.4337/9781803921822.00035
Veljković S. (2024) Possibility of Applying the Rules of International Humanitarian Law to Cyber Warfare. Pravo – Teorija I Praksa, vol. 41, no. 3, pp. 17–28. DOI: https://doi.org/10.5937/ptp2403017V
Vöneky S. (2008) Analogy in International Law. In: Wolfrum R. (ed.) Max Planck Encyclopedia of Public International Law, Oxford: Oxford University Press.
This work is licensed under CC BY-NC-ND 4.0
