Cyber Operations and the Jus in Bello: Key Issues

• Author: Michael N. Schmitt
• Position: Chair of Public International Law, Durham University, United Kingdom
• Pages: 89-110

V

Cyber Operations and the Jus in Bello:

Key Issues

Michael N.Schmitt*

OnAugust 7, 2008, Georgian forces launched attacks into South Ossetia, in-

cluding against Russian troops who were in the breakaway region as

"peacekeepers." The jus ad bellum issues surrounding the conflict remain contro-

versial. 1However, it is incontrovertible that once Georgian and Russian forces

became embroiled in hostilities against each other, an international armed conflict

subject to the jus in bello (international humanitarian law (IHL) or the law of

armed conflict) had begun.

During the conflict, numerous defacement and denial of service cyber opera-

tions were directed against Georgian entities. 2The cyber targets included the

websites of the President; Parliament; Foreign Affairs, Defence and Education

ministries; domestic and foreign media; banks; and private Internet servers and

blogs. For instance, defacement of the Ministry of Foreign Affairs website in-

cluded the posting of acollage of photos of Adolf Hitler and Georgian President

Mikheil Saakashvili. Similarly, the site of the National Bank of Georgia was re-

placed with one depicting twentieth-century dictators together with Saakashvili.

On average, each operation lasted two hours. Although no physical damage or in-

juries were reported, the disruption of services proved severe. In particular, the

Georgian government found itself unable to broadcast information about the

*Chair of Public International Law, Durham University, United Kingdom.

Cyber Operations and the Jus in Bello: Key Issues

conflict and Georgian banks went off-line, as aself-imposed precautionary mea-

sure, for ten days.

The identity of the originators of the operations remains uncertain. As with

those against Estonia the previous year, most of the operations were traceable to

Russia but there was no conclusive evidence that the Russian government con-

ducted the attacks or was otherwise involved therein. While certain of them were

traceable to Russian government computers, the possibility that they were

"pwned," that is, taken over for the purpose of mounting attacks, cannot be ruled

out. Nevertheless, that awebsite containing potential Georgian cyber targets and

malicious software, StopGeorgia.ru, came on line within hours of the commence-

ment of hostilities aroused suspicions of governmental involvement.

Foreign governments and private sources promptly assisted the Georgians.

Google provided hosting services for Georgian sites, an important contribution in

light of its advanced security. The Georgian Ministry of Defence and Ministry of

Foreign Affairs websites were moved to US and Estonian servers, while the Polish

President made his website available for posting Georgian government informa-

tion about the conflict. Despite these efforts, the attacks significantly disrupted the

operation of the Georgian cyber infrastructure.

As the Georgia case illustrates, cyber operations have become embedded in

modern warfare. This article examines three central IHL issues raised by cyber op-

erations mounted during armed conflicts: the principle of distinction, direct par-

ticipation by civilians in hostilities and classification of conflict. It makes no effort

to explore thejus ad bellum, which is addressed by companion contributions to this

volume of the International Law Studies. As the normative architecture governing

cyber operations remains indistinct, it must be cautioned that the conclusions

drawn are those of the author alone and somewhat tentative. However, attention is

drawn to the ongoing efforts of agroup of international experts working under the

auspices of the NATO Cooperative Cyber Defence Centre of Excellence to craft a

Manual on the International Law of Cyber Warfare? Said manual, albeit soft law,

will help clear much of the legal fog of cyber warfare.

Cyber Operations and the Principle ofDistinction

Article 48 of Additional Protocol Irequires the parties to aconflict to "at all times

distinguish between the civilian population and combatants and between civilian

objects and military objectives and accordingly direct their operations only against

military objectives."4In doing so, it restates the customary law principle of distinc-

tion, which has been labeled by the International Court of Justice as one of two

"cardinal" principles of IHL (the other being the prohibition of unnecessary

90