Legal review of cyber weapons

Definition

CollapseLegal review of cyber weapons, means and methods of warfare
Legal review of cyber weapons.svg
The requirement that the legality of all new weapons, means and methods of warfare be systematically assessed is arguably one that applies to all States. It flows logically from the truism that States are prohibited from using illegal weapons, means and methods of warfare or from using weapons, means and methods of warfare in an illegal manner.[1] It is also widely considered, including by the ICRC, that a requirement to carry out legal reviews of new weapons, means and methods of warfare also flows from the obligation to ensure respect for IHL.[2] In addition, with respect to State parties to Additional Protocol I, Article 36 of that instrument mandates that “[i]n the study, development, acquisition or adoption of a new weapon, means or method of warfare,” States must determine whether its employment would, in some or all circumstances, be prohibited under IHL or any other applicable rule of international law.[3] It has been argued that the Article 36 obligation represents customary international law,[4] but this view is not universally accepted.[5]

The mere fact of a weapon’s novelty or its reliance on new technology does not automatically mean that the weapon is illegal.[6] Similarly, the lack of general practice by States in using the new weapon is irrelevant as to its legality under IHL.[7] In determining the weapon’s lawfulness, the State in question must therefore assess those rules of IHL, which are binding on the State – be they treaty-based or customary.[8] Additionally, all States remain subject to the so-called Martens Clause,[9] which reinforces the notion that the lawfulness of a new weapon must be assessed under customary international law according to the principles of humanity and the requirements of public conscience.[10] It is unsettled whether this consideration must take the form of a formal legal review.[11] Nevertheless, legal review of new weapons conducted at the earliest possible stage is a critical measure to ensure compliance with the applicable IHL rules. It also helps prevent the costly consequences of approving and procuring a weapon the use of which is likely to be restricted or prohibited.[12]

Although the precise definition of a “cyber weapon” is unsettled as yet,[13] at the very least, all cyber tools capable of conducting “attacks” as understood in IHL, that is, acts of violence against the adversary whether in offence or in defence,[14] should be considered to qualify as cyber weapons,[15] thus falling under the principle that IHL applies to “all forms of warfare and to all kinds of weapons, those of the past, those of the present and those of the future”.[16] For State parties to Additional Protocol I, the obligation extends to the early stages of studying and developing a new cyber capability, be it a cyber weapon, means or method of warfare; these States must conduct a legal review; and the scope of the applicable legal framework includes the entirety of international law, not just the rules of IHL.[17]

In reviewing the lawfulness of a new weapon, means or method of warfare, States must first consider whether its employment is specifically prohibited or restricted by treaty-based or customary IHL.[18] Although no prohibitions of this kind exist at present with respect to cyber capabilities, this may well change in the future. In particular, there is recurring talk of States entering into “cyber arms control treaties” or agreeing to specific limitations on the development and use of cyber offensive capabilities. If formulated as binding prohibitions, these may prevent States from utilizing capabilities falling under the remit of such rules.

If no specific prohibition or restriction is found to apply, the cyber weapon, means or method of warfare in question must be assessed in light of the general prohibitions or restrictions under IHL that bind the State, be they treaty-based or customary. These include, in particular, the prohibition of weapons, means and methods of warfare that are of a nature to cause superfluous injury or unnecessary suffering[19] and the prohibition of means and methods of warfare that are by nature indiscriminate.[20] In addition, a weapon or means of warfare cannot be assessed in isolation from the manner in which it is expected to be used in the battlefield. States should therefore determine if the employment of a weapon for its normal or expected use would be prohibited by IHL under some or all circumstances.[21]

Publicly available national positions that address this issue include: National position of Brazil (2021) (2021), National position of Brazil (2021) (2022), National position of Costa Rica (2023) (2023), National position of Germany (2021) (2021), National position of Switzerland (2021) (2021), National position of the United States of America (2012) (2012),

National positions

Australia (2020)

“Australia, and other States parties to Additional Protocol I to the Geneva Conventions of 1949 are required under Article 36 to determine whether the employment of new weapons, or means or method of warfare, would, in some or all circumstances be prohibited by Additional Protocol I or any other rule of international law applicable to that State. A cyber capability could, in certain circumstances, constitute a ‘weapon, or a means or method of warfare’ within the meaning of Article 36 and require a review in accordance with Article 36 obligations”.[22]

Brazil (2021)

“[..] according to AP I, States have an obligation, “in the study, development, acquisition or adoption of a new weapon, means or method of warfare,” to “determine whether its employment would, in some or all circumstances,” be prohibited. This norm, although being less strict than some States wished during the negotiations of AP I, already encompasses some precautionary elements. It must guide the development, acquisition and adoption of cyber capabilities.”[23]

Canada (2022)

“50. States that are Parties to Additional Protocol I to the Geneva Conventions are required to review new weapons, means or methods of warfare to ensure compliance with IHL. This obligation applies in the context of cyber capabilities and activities, although not all cyber capabilities and activities will constitute a weapon or means or method of warfare.[24][25]

Costa Rica (2023)

“56. The legality of all new weapons, means and methods of warfare, including cyber capabilities, must be systematically assessed by all States. IHL requires that in the study, development, acquisition or adoption of any new weapon, means or method of warfare, States must determine whether its employment would, in some or all circumstances, be prohibited under IHL or any other applicable rule of international law. Costa Rica considers this obligation to reflect customary international law binding on all States. In Costa Rica’s view, the obligation is also applicable to cyber means and methods of warfare. For instance, this would include an obligation to review whether ransomware or other forms of malware designed or expected to be employed in times of armed conflict are capable of being used in accordance with IHL.”[26]

Germany (2021)

“The obligation to take precautions in attack is complemented by the obligation to conduct weapon reviews of any new means or method of cyber warfare to determine whether its employment would, in some or in all circumstances, be prohibited by international law. The findings of such reviews, to the extent that they identify legal constraints for the employment of means and methods in particular operational settings, should serve as a basis for operational planning. However, the means and methods used in cyber warfare are typically tailored to their targets, as they generally involve exploiting vulnerabilities that are specific to the target and the operational context. This entails that the development of means or the adoption of the method will often coincide with the planning of a concrete operation. Thus, the obligation to take precautions in attack and the requirement of a legal review remain separate requirements, but may overlap in substance.”[27]

Switzerland (2021)

“States and parties to a conflict have an overarching obligation to “respect and ensure respect” for IHL “in all circumstances”. It is uncontested that preparatory measures must be taken to implement IHL and that its implementation needs to be supervised. This requires states and parties to a conflict, inter alia, to take measures to ensure that the development and use of means and methods of warfare fully comply with IHL, and to prevent outcomes that would be unlawful.

This is also applicable to cyberspace and the cyber means and methods of warfare. As with any other weapon, means or method of warfare, States have the positive obligation to determine, in their study, development, acquisition or adoption, whether their employment would, in some or all circumstances, violate existing international law. In this regard, the obligation to assess the legality of a new weapon as set out in Art. 36 of Additional Protocol I to the Geneva Conventions is an important element to prevent or restrict the development and employment of new cyber weapons that would fail to meet in particular the obligations set out above.”[28]

United States (2012)

“States should undertake a legal review of weapons, including those that employ a cyber capability. Such a review should entail an analysis, for example, of whether a particular capability would be inherently indiscriminate, i.e., that it could not be used consistent with the principles of distinction and proportionality. The U.S. Government undertakes at least two stages of legal review of the use of weapons in the context of armed conflict: first, an evaluation of new weapons to determine whether their use would be per se prohibited by the law of war; and second, specific operations employing weapons are always reviewed to ensure that each particular operation is also compliant with the law of war.”[29]

Appendixes

See also

Notes and references

  1. ICRC, A Guide to the Legal Review of New Weapons, Means and Methods of Warfare: Measures to Implement Article 36 of Additional Protocol I of 1977 (Kathleen Lawand ed.) (ICRC 2006) 4.
  2. ICRC, International Humanitarian Law and the Challenges of Contemporary Armed Conflicts: Recommitting to Protection in Armed Conflict on the 70th Anniversary of the Geneva Conventions (October 2019) 34 (“In the ICRC’s view, the requirement to carry out legal review of new weapons also flows from the obligation to ensure respect for IHL under Article 1 common to the Geneva Conventions.”). This view is shared by a number of States. See, Australia, The Australian Article 36 review process, working paper submitted to the Group of Government Experts of the High Contracting Parties to the Convention on Prohibitions or Restrictions on the Use of Certain Conventional Weapons Which May be Deemed to be Excessively Injurious or to Have Indiscriminate Effects (CCW), 2018, para. 3; The Netherlands and Switzerland, Weapons review mechanisms, working paper submitted to the CCW, 2017, para. 17. See also Tallinn Manual 2.0, commentary to rule 110, para 2.
  3. Article 36 AP I.
  4. See, eg, Duncan Blake and Joseph S. Imburgia, ‘“Bloodless Weapons”? The need to conduct legal review of certain capabilities and the implications of defining them as “weapons”’, (2010) 66 AFLRev 157, 163–64; see also, William H Boothby, Weapons and the Law of Armed Conflict (2nd edn, OUP 2016) 342–43 (“For states that are not party to AP1, the implied obligation should not necessarily be expressed in the same terms as article 36, but its existence is attested to by the practice of certain states before the adoption of AP1”).
  5. See Tallinn Manual 2.0, commentary to rule 110, para 2; see also Natalia Jevglevskaja, ‘Weapons Review Obligation under Customary International Law’ (2018) 94 International Law Studies 186, 220.
  6. See, eg, US DoD Law of War Manual, para 6.2.1.
  7. David Wallace, ‘Cyber Weapon Reviews under International Humanitarian Law: A Critical Analysis’ (2018) Tallinn Paper No. 11, 9.
  8. ICRC, A Guide to the Legal Review of New Weapons, Means and Methods of Warfare: Measures to Implement Article 36 of Additional Protocol I of 1977 (Kathleen Lawand ed.) (ICRC 2006) 10.
  9. For a modern formulation of the Martens Clause, see Art 1(2) AP I (“In cases not covered by this Protocol or by other international agreements, civilians and combatants remain under the protection and authority of the principles of international law derived from established custom, from the principles of humanity and from dictates of public conscience.”). See also ICRC, A Guide to the Legal Review of New Weapons, Means and Methods of Warfare: Measures to Implement Article 36 of Additional Protocol I of 1977 (Kathleen Lawand ed.) (ICRC 2006) 17 para 1.2.2.3.
  10. David Wallace, ‘Cyber Weapon Reviews under International Humanitarian Law: A Critical Analysis’ (2018) Tallinn Paper No. 11, 9.
  11. See Tallinn Manual 2.0, commentary to rule 110, para 4. According to the majority of the International Group of Experts, it would suffice for the State to seek the advice of a legal advisor at the relevant level of command.
  12. ICRC, International Humanitarian Law and the Challenges of Contemporary Armed Conflicts: Recommitting to Protection in Armed Conflict on the 70th Anniversary of the Geneva Conventions (October 2019) 34-35; see also ICRC, A Guide to the Legal Review of New Weapons, Means and Methods of Warfare: Measures to Implement Article 36 of Additional Protocol I of 1977 (Kathleen Lawand ed.) (ICRC 2006) 11.
  13. See, eg, Gary D. Brown and Andrew O. Metcalf, ‘Easier Said Than Done: Legal Reviews of Cyber Weapons’ (2014) 7 JNSLP 115, 135 (defining a kinetic and/or a cyber weapon as “an object designed for, and developed or obtained for, the primary purpose of killing, maiming, injuring, damaging or destroying”); Tallinn Manual 2.0, rule 103, para 2 (“cyber weapons are cyber means of warfare that are used, designed, or intended to be used to cause injury to, or death of, persons or damage to, or destruction of, objects”); Air Force Instruction 51-401 (3 August 2018) 13 (defining a cyber capability as “any device, computer program or computer script, including any combination of software, firmware or hardware intended to deny, disrupt, degrade, destroy or manipulate adversarial target information, information systems, or networks”).
  14. Art 49 AP I.
  15. Tallinn Manual 2.0, rule 103, para 2; but see Jeffrey T Biller and Michael N Schmitt, ‘Classification of Cyber Capabilities and Operations as Weapons, Means, or Methods of Warfare’ (2019) 95 Int’l L Stud 179, 218 (arguing that “code used in hostile cyber operations does not qualify as a means of warfare”) and 219 (characterizing “cyber operations as a method of warfare”) (emphasis added). See further Scenario 22: Cyber methods of warfare (discussing the implications of these different views from an IHL perspective).
  16. Legality of the Threat or Use of Nuclear Weapons Case (Advisory Opinion) [1996] ICJ Rep 226, para 86.
  17. ICRC, A Guide to the Legal Review of New Weapons, Means and Methods of Warfare: Measures to Implement Article 36 of Additional Protocol I of 1977 (Kathleen Lawand ed.) (ICRC 2006) 5, 10-11, 20, and 23-24; see also Tallinn Manual 2.0, commentary to rule 110, para 6.
  18. Examples of such specific prohibitions include the general ban on the use of chemical or biological weapons.
  19. Art 23(e) Hague Regulations; Art 35(2) AP I; ICRC CIHL Study, rule 70; Tallinn Manual 2.0, rule 104. See also ICRC, A Guide to the Legal Review of New Weapons, Means and Methods of Warfare: Measures to Implement Article 36 of Additional Protocol I of 1977 (Kathleen Lawand ed.) (ICRC 2006) 15-16, paras 1.2.2.1-1.2.2.2.
  20. Art 51(4)(b) AP I; ICRC CIHL Study, rules 12 and 71; Tallinn Manual 2.0, rule 105; see also ICRC, A Guide to the Legal Review of New Weapons, Means and Methods of Warfare: Measures to Implement Article 36 of Additional Protocol I of 1977 (Kathleen Lawand ed.) (ICRC 2006) 15-16, paras 1.2.2.1-1.2.2.2; and US DoD Manual, para 16.6 (“a legal review of the acquisition or procurement of a weapon that employs cyber capabilities likely would assess whether the weapon is inherently indiscriminate”).
  21. ICRC, A Guide to the Legal Review of New Weapons, Means and Methods of Warfare: Measures to Implement Article 36 of Additional Protocol I of 1977 (Kathleen Lawand ed.) (ICRC 2006) 10.
  22. Australian Government, Australia’s submission on international law to be annexed to the report of the 2021 Group of Governmental Experts on Cyber (2021) 4.
  23. Official compendium of voluntary national contributions on the subject of how international law applies to the use of information and communications technologies by States, UNODA, A/76/136, August 2021, 23.
  24. Government of Canada, International Law applicable in cyberspace, April 2022, See Footnote [32], Protocol I, supra note 31, Art. 36; see also generally Tallinn Manual 2.0 supra note 15, Rule 110 and accompanying commentary at 464.
  25. Government of Canada, International Law applicable in cyberspace, April 2022
  26. Ministry of Foreign Affairs of Costa Rica, “Costa Rica’s Position on the Application of International Law in Cyberspace” (21 July 2023) 15-16 (footnotes omitted).
  27. Federal Government of Germany, ‘On the Application of International Law in Cyberspace’, Position Paper (March 2021) 10.
  28. Federal Department of Foreign Affairs, ‘Switzerland’s position paper on the application of international law in cyberspace’ (May 2021) 9-10.
  29. Harold Hongju Koh, International Law in Cyberspace, 18 September 2012, 6

Leave a Reply

Your email address will not be published. Required fields are marked *

Back to top button