In times of armed conflict, IHL foresees that impartial humanitarian organizations, such as the International Committee of the Red Cross, may undertake, or offer to undertake, humanitarian activities to provide assistance for those in need and to protect persons affected by armed conflict.^[1] In practice, humanitarian activities may include, for instance, the distribution of material assistance, the restoration of family links, the search for missing persons, or the visiting of detainees.^[2]

IHL sets out specific rules to facilitate and protect humanitarian activities.

Under IHL, once an offer of services by an impartial humanitarian organization has been accepted by the parties concerned, ‘the parties to the conflict must allow and facilitate rapid and unimpeded passage of humanitarian relief for civilians in need, which is impartial in character and conducted without any adverse distinction, subject to their right of control’.^[3] For the purpose of this rule, humanitarian relief items traditionally include ‘food and medical supplies’ as well as ‘clothing, bedding, means of shelter, other supplies essential to the survival of the civilian population’.^[4] In the cyber context, experts have interpreted this rule as prohibiting cyber operations that are ‘designed or conducted to interfere unduly with impartial efforts to provide humanitarian assistance’.^[5]

IHL further provides that humanitarian relief personnel and objects must be ‘respected and protected’.^[6] This obligation builds on, but goes beyond, the general protection of humanitarian organizations and their staff as civilians. In analogy to the obligation to respect and protect medical personnel and facilities, this obligation should also be understood as prohibiting not only attacks against humanitarian relief operations but also ‘other forms of harmful conduct outside the conduct of hostilities’ against humanitarian relief personnel or undue interference with their work.^[7]

In the cyber context, these obligations entail a prohibition against attacking or otherwise harming humanitarian relief personnel and consignments, an obligation to protect them against harm,^[8] and a prohibition against using cyber operations to interfere with the impartial efforts to provide humanitarian relief, even if this interference does not rise to the level of attack.^[9] The obligation to respect and to protect relief personnel and operations should also be understood as protecting the relevant data.^[10]

Publicly available national positions that address this issue include: (2023).