Fighting a war without violence The rules of International Humanitarian Law for military cyber-operations below the threshold of ‘attack’
Bart van den Bosch
Introduction
Future warfare will most likely not follow the cleavages that states and lawmakers traditionally use to regulate and control the seemingly infinite complexity of human societies. Consider the fight against Islamic State that was fought on the territory of Syria and Iraq by a coalition of states. For International Humanitarian Law (IHL) it makes a significant difference whether the conflict is classified as an international or a non-international armed conflict. In an international armed conflict, captured combatants are granted a prisoner of war status, while in a non-international armed conflict fighters might be criminally prosecuted for their engagements. Another example is the so-called ‘war on terror’ which the United States of America launched after the 9-11 attacks in 2001. Initially it was clearly an international armed conflict fought by the United States and its allies against Afghanistan where the Taliban government harboured Al-Qaeda. It became slightly obscured when the Taliban was defeated and even more when the United States decided to expand the ‘war on terror’ outside Afghanistan. Was there still an armed conflict ongoing and if so against whom? From a legal point of view essential questions since IHL is only applicable during an armed conflict.
To make matters even more complex distinctions between a party’s Diplomatic Information Military Economic Financial Information and Legal (DIMEFIL) powers have become increasingly blurred and sometimes even are undefinable.1 Moreover, modern conflicts might involve both public and private entities with very different agendas and who, through modern technology, are capable of projecting their power over time and distance. This decline of ‘natural’ barriers results in a diminishing role for physical borders and complicates the use of territorial-based notions like sovereignty or - more military - control over an area. Because of the consecutive lack of clarity, such conflicts are sometimes referred to as ambiguous or grey zone warfare.2 The ramifications of this emerging reality are being felt by both practitioners and academics. Whereas the latter are engaged in a debate on which paradigm fits this situation best, the former have to deal with uncertainty over which measures to take and what rules to follow. This contribution aims at providing new scholarly insights while simultaneously offering military commanders solutions that can be applied to the conduct of war.
Before analysing conflicts in the grey zone from a legal perspective it is essential to realize that there exists no such a thing as a single set of rules -what is normally referred to as a legal regime - regulating this type of warfare. There are all kind of legal regimes but they are all shaped in accordance with traditional distinctions. There is, for instance, a regime for peace and another for war. There are rules for national issues, but international problems are solved following different rules. From a legal point of view, the different regimes, each with own rules and mostly also with a unique vocabulary, are clearly separated by rigid watersheds. This, however, also implies that the same word or expression can have a specific meaning in a certain regime but a different meaning in another. For instance, attack in ‘armed attack’ as mentioned in article 51 of the Charter of the United Nations has a different meaning and connotation than ‘attack’ in IHL. Consequently, one has to be clear about the meaning of a term in a specific legal regime before even trying to take the discussion up to the level of covering multiple regimes as is the case in grey zone warfare.
A most urgent example, in this regard, is the term cyberattack. For the military fighting a war, the legal paradigm is IHL also known as the Law of Armed Conflict (LOAC). New technologies, especially the development of the cyber domain, have created a number of possibilities to fight a war with lethal but even more with non-lethal means and methods. IHL deals extensively with the former but is ostensibly silent on the latter. This can be explained by the fact that IHL has developed over many years with the twofold purpose of regulating hostilities (including the limitation of permitted methods and means of warfare), and protecting those persons and objects that do not or no longer participate in armed conflicts. To achieve these goals, the main focus has been on the reduction of the horrors of war. This has resulted in a focus on ‘attacks’, a specific category of military operations that is defined as ‘acts of violence against the adversary, whether in offence or in defence’.3 A direct consequence of the focus on attacks is the relative lack of attention for military operations that do not meet the conditions of ‘attack’ as prescribed by IHL.
The rapid development of the cyber domain has rendered both the military and society as a whole increasingly dependent on non-physical elements such as data and computer programs. For armed conflicts this opens up a whole range of possibilities for ‘non-violent’ operations, or operations below the threshold of ‘attack’ as understood by IHL. This urges for a better understanding of what exactly encompasses a cyberattack, and when an operation is staying below this threshold. Furthermore, clarification is needed about the extent and way in which the rules IHL apply to these (cyberjoperations not reaching the level of‘attack’. Although it is generally accepted that IHL
Fighting a war without violence 213 is applicable in the cyber domain, the exact implementation of existing rules has been subject of a fierce debate.4 In the case of cyberattacks this has resulted in two main points of view, the so-called permissive and the restrictive school, respectively.5 This chapter introduces a theory that combines both schools by preserving their strong and overcoming their weak points which allows for formulating practical guidelines for implementing IHL in military (cyberjoperations below the threshold of attack.6 In addition, this novel theoretic approach towards IHL also offers a new starting point for the discussion on what legal regime or regimes best fit grey zone warfare.
