Cyber weapons are a low cost but an effective tool for modern day operations. Since the growth of information and communication technologies in the late 1990s-early 2000s, they have been used in several situations. In 2007, Russia used low tech cyber weapons against Estonia for wanting to shift a soldier memorial outskirts of Estonia Since 2014 when Russia annexed Crimea, there...
Cyber weapons are a low cost but an effective tool for modern day operations. Since the growth of information and communication technologies in the late 1990s-early 2000s, they have been used in several situations.
In 2007, Russia used low tech cyber weapons against Estonia for wanting to shift a soldier memorial outskirts of Estonia
Since 2014 when Russia annexed Crimea, there have been reports of Russians using cyber-weapons against Ukraine. It has been reported that Russian state hackers attacked the Ukrainian Central Election Commission computer systems to rig the Presidential elections in 2014. Apparently in December 2015, a cyber-weapon known as Black Energy was used to remotely switch off powerplants where more than 2 Lacs Ukrainians experiences severe chill and darkness, some even lost their lives.
All this took another turn with the onslaught of Russian invasion in the physical territory of Ukraine.
The Deputy PM of Ukraine and the Minister for Digital Transformation tweeted the initiation of an 'IT Army', which, according to Wall Street Journal has been joined by more than 400,000 people from Ukraine and the rest of the world. The Government of Ukraine published a list of tasks for different kind of specialists. This universal army then began targeting several government departments, businesses, etc.
EU activated its Cyber Rapid Response Team (CRRT) in support of Ukraine, with members from Lithuania, Croatia, Poland etc.
In March 2022, Hacker collective, the Anonymous, sympathetic to Ukraine, also joined the fight stating "We will unleash full wrath of world hackers, key components of your Government (Russian)would be hijacked. Websites of Duma, Ministry of Defence, State control tv R.com and of Russian stock exchange have already been taken down."
In the same month, President Joe Biden (USA) too stated that, "Russian president is likely to use cyber-attacks as a form of retaliation against our country for its action to counter Russia's incursion in Ukraine".
Do Cyber Operations Happen In Legal Vacuums?
After all, IHL was drafted keeping in mind physical armed conflict. While this is a point of contention, Dr Kubo Mačák, Legal adviser to the International Committee to the Red Cross states that cyber operations during armed conflicts are governed by international humanitarian law ('IHL'). One must note that, in other kinds of cyber operations, IHL doesn't apply.
Additionally, ICRC, in its Position Paper titled 'IHL and Cyber Operations during Armed Conflicts' from 2019, states that IHL applies and thereby limits cyber warfare, just like it regulates any other weapon using the major principles and means of conducting warfare:
Jus ad Bellum – the principle which determines whether countries have a right to resort to war through an armed conflict,
Jus in bello – the principle which governs the conduct of the countries' soldiers/States itself which are engaging in war or an armed conflict.
In the International Court of Justice's Advisory Opinion on the Legality of the Threat or Use of Nuclear Weapons: the Court reiterated that principles and rules of IHL applicable in armed conflict apply 'to all forms of warfare and to all kinds of weapons', including 'those of the future', which ICRC believes applies to cyber operations during armed conflict too.
Cyber War Between Ukraine And Russia In 2022:
In the case of Russia-Ukraine, soon after Putin announced his act of aggression, the 'IT Army' supporting Ukraine was formed. The physical armed conflict and the cyber warfare continues till date. Therefore, the cyber warfare is occurring at the same time as the physical armed conflict, and IHL does apply.
The IT Army has launched a number of distributed denial-of-service attacks (DDOS) against Russia's Foreign Ministry and Ministry of Defence, various Russian companies, banks and also the Moscow Stock Exchange. While attacking Russia, the IT Army also attacked Belarus's railway network to disrupt Russia's transportation of troops and equipment to Ukraine and even defaced government and private websites based out of Belarus and Russia.
While there are no specific provisions dealing with Cyber operations in an armed conflict, there is however Martens Clause, from the Preamble of 1899 Hague Convention II, which can be interpreted in many ways, one of them being – "conduct in armed conflicts is not only judged according to treaties and custom but also to the principles of international law referred to by the Clause".
Additionally, ICRC's Position Paper also affirms that IHL's principles of principles of distinction, proportionality, and precautions applies to cyber operations as well, such as –
- Prohibiting indiscriminate use of cyber weapons (Rule 71 ICRC Customary IHL Study)
- Prohibiting direct attacks against civilians and civilian objects including when using cyber means or methods of warfare (Arts 48, 51 and 52 AP I; Rules 1 and 7 ICRC Customary IHL Study)
- Prohibiting acts or threats of violence, the primary purpose of which is to spread terror among the civilian population, including when carried out through cyber means or methods of warfare (Art. 51(2) AP I; Rule 2 ICRC Customary IHL Study)etc
The members of the IT army are pro-Ukraine cyber guerrillas spread all over the world. Accepting that IHL applies to cyber warfare is just the first step. This new kind of war being fought online, bring up a lot of questions. Are the civilians that are part of the IT Army be called combatants or are they Levée en masse? There is ample proof to show that the global IT Army was called to action by the Ukrainian Government, therefore it fails to fulfil the 'spontaneous' criterion of Levée en masse. It can be argued that, just like civilians directly participating in physical armed hostilities, members of the IT army, indulging in cyber warfare deprives them of their civilian immunity. However, it must be pointed out, this is a case of an international IT Army, who has members from foreign borders, so I wonder, does that make them pro-Ukraine cyber guerrilla mercenaries?
Other issues include – how does IHL determine injuries, deaths, damage to property etc, caused by cyber operations during armed conflict? How to pinpoint to invisible perpetrator(s)? And since Ukrainian Government called for an 'IT Army', should one look at Ukraine's Minister for Digital Transformation or the President as the commander?
The need of the hour is for all States to reach a common understanding regarding the cyber warfare and the rules that govern it, while actively trying to reduce the loss of all living beings.
Views are personal.