War. A term which traditionally conjures images of uniformed armies, guns, bombs, and other forms of conventional military warfare. Yet the 21st century has seen the rise of a new form of war, one divorced from these traditional methods and means: ‘cyber warfare’.
‘Cyber warfare’ refers to war that is waged not through military hostilities on the ground, but through virtual means and methods, within the domain of ‘cyberspace.’ Despite its unconventional nature, the international legal community agrees that international humanitarian law (‘IHL’) can apply to cyber warfare, provided that attacks are committed within the context of an armed conflict, (see the Tallinn Manual). However, the question of how to transpose and apply IHL rules to this modern phenomenon remains problematic.
One of the greatest challenges arising in the context of a cyber attack is the application of the principle of distinction. The principle of distinction is a cornerstone of IHL, one which requires that parties to a conflict differentiate between civilians/civilian objects, and combatants/military objectives at all times (the latter being legitimate targets in an armed attack, while the former cannot be attacked under any circumstances). Making such a distinction in cyberspace is however wrought with difficulty, due to characteristics of the forum, such as its interconnectivity. Cyberspace is a complex network of countless, interconnected computer systems, spanning across the globe. Civilian and military computer systems therefore may be, and often are, intertwined (with the latter sometimes even relying on the former). As a result, it is incredibly difficult to identify ‘legitimate’ targets, and to limit the effects of an attack to a pure military objective. Continue reading