Cyber Warriors in the Jus in Bello

• Author: Vijay M. Padmanabhan
• Position: Assistant Professor, Vanderbilt University Law School
• Pages: 288-308

International Law Studies 2013

288

T

Cyber Warriors and the Jus in Bello

Vijay M. Padmanabhan*

I. INTRODUCTION

he increasing interest in cyber operations, or “efforts to alter, disrupt,

degrade or destroy computer systems or networks or the information or

programs on them,”

1

as a warfighting tool raises questions regarding appli-

cation of the jus in bello to “cyber warriors,” or actors involved with cyber

operations. Most cyber warriors will not be evaluated under the law of

armed conflict. Cyber operations to date generally have amounted to noth-

ing more than annoyances or crimes, or were in reality espionage, and

therefore are regulated by municipal criminal law.

2

Where there is an armed

conflict, most cyber operations and responses to cyber operations target

* Assistant Professor, Vanderbilt University Law School. Thanks to Ashley Deeks,

Andy Grotto and Mike Newton for their helpful comments on this project.

1

. See Matthew C. Waxman, Cyber Attacks as “Force” under U.N. Charter Article 2(4), in

INTERNATIONAL LAW AND CHANGING CHARACTER OF WAR 43 (Raul A. “Pete” Pedrozo

and Daria P. Wollschlaeger eds., 2011) (Vol. 87, U.S. Naval War College International Law

Studies) (defining “cyber-operations”).

2

. See James A. Lewis, Cyber Attacks, Real or Imagined, and Cyber War, CSIS (July 11,

2011), http://csis.org/publication/cyber-attacks-real-or-imagined-and-cyber-war (arguing

against “hyperbole” in characterizing cyber operations as acts of war).

Cyber Warriors and the Jus in Bello Vol. 89

289

infrastructure and property, thereby bypassing the rules governing targeting

of persons.

Nevertheless, the question of the legal status of cyber warriors under

the jus in bello is likely to arise in two circumstances. First, the international

armed conflicts and non-international armed conflicts of the present and

the future are likely to include cyber operations as one element of an inte-

grated war strategy. The 2008 armed conflict between Russia and Georgia

over South Ossetia included large-scale distributed denial of service (DDS)

attacks against Georgian government websites in an effort disrupt commu-

nication between the government and its people.

3

The relatively low cost of

cyber operations compared to kinetic attacks suggests they are likely to be

used, perhaps in more destructive ways, in future wars.

4

Second, an isolated cyber operation may have sufficient kinetic effects

to rise to the level of an “armed attack,” justifying the use of force in lawful

self-defense. The United States and Israel launched a cyber operation

against Iran’s burgeoning nuclear program that used malicious code to im-

pede the functioning of Iran’s centrifuges in order to secure additional time

for negotiations over the future of Iran’s nuclear capability.

5

This opera-

tion, code-named Olympic Games, led at least one scholar to argue that the

United States and Israel committed an armed attack against Iran.

6

It is rea-

sonable to assume that States may wish to use force in the future against

those involved in such attacks, and indeed the United States has expressly

reserved the right to do so.

7

Such force may amount to an “armed conflict”

under the jus in bello, thereby raising issues as to the status of those targeted.

Under these two circumstances, categorization of cyber warriors as

combatants, civilians or potentially unlawful combatants carries conse-

quences. The most important of these are with respect to targeting. Com-

3

. See John Markoff, Before the Gunfire, Cyberattacks, NEW YORK TIMES, Aug. 13, 2008,

at A1 (describing attacks).

4

. See id. (quoting expert comparing the low cost of cyber operations to the greater

cost of kinetic operations).

5

. See David E. Sanger, Obama Order Sped Up Wave of Cyberattacks Against Iran, N.Y.

TIMES, June 1, 2012, at A1 (describing details of the Olympic Games program).

6

. See, e.g., Paul Rosenzweig, The Stuxnet Story and Some Interesting Questions , LAWFARE

BLOG (June 2, 2012, 16:52 EDT), http://www.lawfareblog.com/2012/06/the-stuxnet-

story-and-some-interesting-questions/ (arguing Olympic Games amounted to an “ar med

attack” against Iran as understood under the U.N. Charter).

7

. See THE WHITE HOUSE, INTERNATIONAL STRATEGY FOR CYBERSPACE 14 (2011)

(reserving the right to use “all necessary means,” including military force, to defend the

United States and its allies from cyber operations).