QUESTION 2: THE APPLICATION OF THE FUNDAMENTAL PRINCIPLES OF IHL TO CY-

BER OPERATIONS

As technology advances, warfare is increasingly shifting to the digital realm, leading to the
emergence of cyber operations.i The increasing prevalence of cyber operations raises important
legal questions about the applicability of international law to this new form of warfare. ii In partic-
ular, the fundamental principles of International Humanitarian Law (IHL) are highly relevant to
the regulation of cyber operations.iii

The principles of distinction, proportionality, and precaution are the basic principles of IHL that
apply to cyber operations, just as they apply to traditional forms of warfare. iv The principle of dis-
tinction requires parties to distinguish between combatants and civilians, and to direct attacks
only against military objectives.v This principle is particularly relevant to cyber operations, which
can often have effects that extend beyond the intended target, potentially harming civilians or
civilian infrastructure.vi In the context of cyber operations, the principle of distinction requires that
attacks be directed only at military objectives, and that care be taken to avoid harm to civilians
and civilian objects.vii

The principle of proportionality requires that any military advantage gained from an attack must
be proportionate to the harm caused to civilians or civilian objects. viii In the context of cyber op-
erations, the principle of proportionality requires that the anticipated military advantage of an at-
tack be balanced against the potential harm to civilians and civilian objects, and that attacks be
directed only at military objectives where the expected military advantage outweighs the ex-
pected harm to civilians and civilian objects.

The principle of precaution requires parties to take all feasible precautions to avoid or minimise
harm to civilians and civilian objects.ix This principle is particularly relevant to cyber operations,
which can be difficult to control and can have unintended consequences. In the context of cyber
operations, the principle of precaution requires that parties take all feasible steps to avoid or
minimise harm to civilians and civilian objects, including by conducting risk assessments, using
appropriate target selection procedures, and implementing appropriate cyber defences.

There are several authorities that further support the applicability of IHL to cyber operations. For
example, the International Court of Justice’s (ICJ) Advisory Opinion on the Legality of the
Threat or Use of Nuclear Weaponsx recognised the importance of the principles of distinction
and proportionality in regulating the use of force, principles which are equally applicable to cyber
operations.xi Additionally, the Tallinn Manualxii provides an in-depth analysis of how the princi-
ples of IHL apply to cyber operations.xiii

In conclusion, cyber operations are subject to the fundamental principles of IHL, just as tradi-
tional forms of warfare are. The principles of distinction, proportionality, and precaution are par-
ticularly relevant to the regulation of cyber operations, and should be carefully applied to ensure
that the conduct of cyber operations is consistent with international law. Through careful appli-
cation of these principles, it is possible to minimise harm to civilians and civilian objects, and to
ensure that cyber operations are conducted in a manner that is consistent with the principles of
humanity and the dictates of public conscience.
i For example, the use of cyber operations during the Georgia-Russia conflict (2008), which was the first time cyber warfare
was being used alongside armed combat. See, Georgia-Russia conflict (2008), Cyber Law Centre, CCDCOE Wiki
https://cyberlaw.ccdcoe.org/wiki/Georgia-Russia_conflict_(2008) accessed 5 April 2023.
ii Over the years, arguments have arisen for both sides of the divide as to if and how the rules of IHL apply to cyber opera-
tions in times of armed conflict. See, Michael Schmitt ‘The Sixth United Nations GGE and International Law in Cyberspace'
(2021) Just Security https://www.justsecurity.org/76864/the-sixth-united-nations-gge-and-international-law-in-cyberspace/ ac-
cessed 5 April 2023.
iii David Wenk, ICRC, 'International Humanitarian Law and the Challenges of Contemporary Armed Conflict' (2019) Case-
book ICRC https://casebook.icrc.org/case-study/icrc-international-humanitarian-law-and-challenges-contemporary-armed-
conflict-2019 accessed 5 April 2023.
iv Ibid. International Committee of the Red Cross, ‘International Humanitarian Law and Cyber Operations during Armed Con-
flicts’ (Position Paper, 11 November 2019) https://unoda-web.s3.amazonaws.com/wp-content/uploads/2020/01/icrc_ihl-and-
cyber-operations-during-armed-conflicts.pdf accessed 5 April 2023
v See, Protocol I Additional to the Geneva Conventions of 12 August 1949, and relating to the Protection of Victims of Inter -
national Armed Conflicts (Protocol I) (adopted 8 June 1977 entered into force 7 December 1978) Arts 48-58.

International Committee of the Red Cross, Customary IHL Database Study: Rule 1: The Principle of Distinction between
Civilians and Combatants (2005) https://ihl-databases.icrc.org/customary-ihl/eng/docs/v1_rul_rule1 accessed 5 April 2023.

International Criminal Tribunal for the former Yugoslavia (ICTY), Prosecutor v Tadić, Case No IT-94-1-A, Decision on the De-
fence Motion for Interlocutory Appeal on Jurisdiction, IT-94-1-A (2 October 1995).

International Criminal Court (ICC), Prosecutor v Bemba, ICC Trial Chamber III, Case No ICC-01/05-01/08, Judgment pur-
suant to Article 74 of the Rome Statute (21 March 2016).
vi Ibid note 3. See the incident involving the Ukrainian Viasat KA-SAT, https://www.reuters.com/world/satellite-outage-
caused-huge-loss-communications-wars-outset-ukrainian-official-2022-03-15/ accessed 5 April 2023.
vii Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations (Michael N. Schmitt ed., 2017) para 4.14
which states that: "the principle of distinction requires that attacks be directed only at military objectives and that care be
taken to avoid or minimise incidental harm to civilians and damage to civilian objects.” It further notes that "as a matter of
customary international law, this obligation applies to both kinetic operations and cyber operations.".
viii Rule 14 of the International Committee of the Red Cross' 'Study on Customary International Humanitarian Law' states
that "Launching an attack which may be expected to cause incidental loss of civilian life, injury to civilians, damage to civilian
objects, or a combination thereof, which would be excessive in relation to the concrete and direct military advantage antici-
pated, is prohibited." (International Committee of the Red Cross, ‘Customary IHL Database, Rule 14: Proportionality’ (ICRC)
https://ihl-databases.icrc.org/applic/ihl/ihl.nsf/customary.xsp?action=generate&id=467 accessed 5 April 2023.).

AP I Art 51(5)(b) & 57.

This principle is particularly relevant to cyber operations, which can cause widespread harm with relative ease.
ix International Committee of the Red Cross, ‘Customary IHL Database, Rule 15: Precautions in Attack’ (ICRC).
AP I Art 57(1).
x 1996 I.C.J. 226 (July 8, 1996).
xi Additionally, AP I Art 36 provides: In the study, development, acquisition or adoption of a new weapon, means or method
of warfare, a High Contracting Party is under an obligation to determine whether its employment would, in some or all circum -
stances, be prohibited by this Protocol or by any other rule of international law applicable to the High Contracting Party.

Cyber Operations can be classified as new means or method of warfare.

xii Ibid note 7.
xiii The Manual does not carry a binding force, however it is widely regarded as an authoritative source of guidance on the
subject.