Hacking into international humanitarian law: The principles of distinction and neutrality in the age of cyber warfare

Michigan Law Review

Volumn 106, Issue 7, 2008, Pages 1427-1452

  Kelsey, Jeffrey T G ^a  

^a NONE

Author keywords

[No Author keywords available]

Indexed keywords

EID: 44949208439     PISSN: 00262234     EISSN: None     Source Type: Journal    
DOI: None     Document Type: Review

References (174)

1. Newly nasty, Economist, May 26, 2007, at 63, 63.
2. Id.
3. Id. (quoting Linnar Viik, who is described as "Estonia's top internet guru").
4. Id.
5. Id.
6. Id.
7. See U.N. Charter art. 51; The mouse that roared: Is cyberwarfare a serious threat?, Economist.com, Sept. 5, 2007, http://www.economist.com/daily/news/displaystory.cfm?story_id=9752625&fsrc= nwl [hereinafter The mouse that roared].
8. See U.N. Charter art. 51.
9. The mouse that roared, supra note 7.
10. Latin for "justice to war." It is the international legal framework that governs a state's decision to use force. E.g., INTERNATIONAL COMMITTEE OF THE RED CROSS, INTERNATIONAL HUMANITARIAN LAW: ANSWERS TO YOUR QUESTIONS 15 (2002) [hereinafter ICRC, Answers].
11. See, e.g., Eric Talbot Jensen, Computer Attacks on Critical National Infrastructure: A Use of Force Invoking the Right of Self-Defense, 38 Stan. J. Int'l L. 207 (2002).
12. This is the law governing the conduct of war. ICRC, ANSWERS, supra note 10, at 16.
13. Knut Dörmann, Computer network attack and international humanitarian law, INTERNATIONAL COMMITTEE OF THE RED CROSS, May 19, 2001, para. 29, http://www.icrc.org/web/ eng/siteeng0.nsf/htmlall/5p2alj.
14. See, e.g., Robert G. Hanseman, The Realities and Legalities of Information Warfare, 42 A.F.L. REV. 173, 187 (1997);
15. Bruce Smith, An Eye for an Eye, a Byte for a Byte, Fed. L., Oct. 1995, at 12.
16. See, e.g., Jeffrey K. Walker, The Demise of the Nation-State, The Dawn of New Paradigm Warfare, and a Future for the Profession of Arms, 51 A.F. L. REV. 323, 337-38 (2001);
17. Bradley Graham, Military Grappling With Guidelines For Cyber Warfare; Questions Prevented Use on Yugoslavia, WASH. POST, Nov. 8, 1999, at A1 ("Russia warned that information operations 'might lead to an escalation of the arms race.' It said 'contemporary international law has virtually no means of regulating the development and application of such a weapon.' ").
18. See Davis Brown, A Proposal for an International Convention To Regulate the Use of Information Systems in Armed Conflict, 47 HARV. INT'L L.J. 179 (2006).
19. Graham, supra note 15.
20. See, e.g., DEPT. OF DEFENSE OFFICE OF GEN. COUNSEL, AN ASSESSMENT OF INTERNATIONAL LEGAL ISSUES IN INFORMATION OPERATIONS 11 (1999), http://www.maxwell.af.mil/ au/awc/awcgate/dod-io-legal/dod-io-legal.pdf [hereinafter DOD, Assessment] ("There are novel features of information operations that will require expansion and interpretation of the established principles of the law of war. Nevertheless, the outcome of this process of extrapolation appears to be reasonably predictable.");
21. Roger D. Scott, Legal Aspects of Information Warfare: Military Disruption of Telecommunications, 45 NAVAL L. REV. 57, 59 (1998) ("Anyone with an understanding of the fundamental principles of the law of war will not need specific, 'no-brainer' precedents to assess the legality of proposals for information attack.").
22. George K. Walker, Information Warfare and Neutrality, 33 VAND. J. TRANSNAT'L L. 1079, 1200 (2000) (footnotes omitted). Walker notes that the first "internet" began in 1969 when the primary concern was maintaining communication in the face of nuclear attack. Id. at 1094.
23. Bradley Graham, Bush Orders Guidelines for Cyber-Warfare: Rules for Attacking Enemy Computers Prepared as U.S. Weighs Iraq Options, WASH. POST, Feb. 7, 2003, at A1.
24. Id.
25. This Note will focus only on these two principles of IHL. Other scholars have focused on the problems of defining combatants, the application of perfidy, and the principle of proportionality in cyber warfare. See, e.g., Brown, supra note 16, at 198-203.
26. The principle of distinction requires belligerents to distinguish between civilian and military objects in attacks. For a detailed discussion of the principle, see infra Section II.A. "Distinction" is a technical term and is a central tenet of IHL. Legality of the Threat or Use of Nuclear Weapons, Advisory Opinion, 1996 I.C.J. 226, 257 (July 8); Heike Spieker, Civilian Immunity, in Crimes of War 84, 84 (Roy Gutman & David Rieff eds. 1999).
27. The principle of neutrality provides that the territory of a neutral state is inviolable and imposes rights and duties on belligerent and neutral states to maintain that neutrality. See generally Convention Respecting the Rights and Duties of Neutral Powers and Persons In Case of War on Land, Oct. 18, 1907, 36 Stat. 2310, T.S. 540 [hereinafter 1907 Hague Convention V]; Convention Concerning the Rights and Duties of Neutral Powers in Naval War, Oct. 18, 1907, 36 Stat. 2415, T.S. 545 [hereinafter 1907 Hague Convention XIII].
28. See Jim Melnick, Op-Ed., The cyberwar against the United States, BOSTON GLOBE, Aug. 19, 2007, at E9 (noting that each year, more and more industries connect to the Internet to take advantage of the efficiencies offered).
29. Vida M. Antolin-Jenkins, Defining the Parameters of Cyberwar Operations: Looking for Law in All The Wrong Places?, 51 NAVAL L. REV. 132, 132 (2005).
30. Id. at 137-38.
31. Gregory F. Intoccia & Joe Wesley Moore, Communications Technology, Warfare, and the Law: Is the Network A Weapon System?, 28 HOUS. J. INT'L L. 467, 473 (2006) (quoting LAWRENCE T. GREENBERG ET AL., INFORMATION WARFARE AND INTERNATIONAL LAW 12 (1998), http://www.dodccrp.org/files/Greenberg_Law.pdf).
32. Walker, supra note 19, at 1094.
33. SecurityFocus Glossary of Terms, http://www.securityfocus.com/glossary/I (last visited Mar. 8, 2008) ("[The Internet backbone is t]he largest network making up the Internet, connecting the many smaller networks that make up the Internet.").
34. See Walker, supra note 19, at 1094 ("The Internet is an international network of interconnected computers.").
35. See Jeff Grabmeier, Loss of Major Hub Cities Could Cripple Internet, Study Suggests; A More Decentralized Internet Is Best Solution, OHIO ST. UNIV. RES. NEWS, NOV. 26, 2002, http://researchnews.osu.edu/archive/intsurv.htm.
36. Id.
37. Id.
38. See Microsoft Technet Glossary of Terms, http://www.microsoft.com/ technet/prodtechnol/Visio/visio2002/plan/glossary.mspx#E2TAE (defining "Packet Switching") (last visited Mar. 8, 2008).
39. Id.; see also Walker, supra note 19, at 1095-96.
40. See Walker, supra note 19, at 1095-96.
41. Id.
42. Loss Of Major Hub Cities Could Cripple Internet, Study Suggests, SCIENCEDAILY, NOV. 26, 2002, http://www.sciencedaily.com/ releases/2002/11/021126072153.htm.
43. RAND Corporation, Paul Baran and the Origins of the Internet, available at http://rand.org/about/history/baran.html (last visited Mar. 17, 2008).
44. Id.
45. See Microsoft Technet, supra note 35.
46. See Walker, supra note 19, at 1096.
47. The United States Defense Advanced Research Projects Agency ("DARPA") is developing a next-generation Internet that may allow the user more control and perhaps allow the user to avoid routes that are undesirable. Linktionary.com, Active Networks, http://www.linktionary.com/a/ active_network.html (last visited Mar. 8, 2008) (noting that under the DARPA proposal "users can 'program' the network by supplying their own programs to perform these computations").
48. See Antolin-Jenkins, supra note 26, at 137-38 (noting that military communications use public interfaces).
49. See Melnick, supra note 25.
50. The situation easily could have been life threatening. Newly nasty, supra note 1, at 63.
51. See Brian T. O'Donnell & James C. Kraska, Humanitarian Law: Developing International Rules for the Digital Battlefield, 8 J. CONFLICT & SECURITY L. 133, 149 (2003).
52. See id.
53. See id.
54. Bradley Graham, Cyberwar: A New Weapon Awaits a Set of Rules; Military, Spy Agencies Struggle to Define Computers' Place in U.S. Arsenal, WASH. POST, July 8, 1998, at A1.
55. William M. Arkin, The Cyber Bomb in Yugoslavia, WASHINGTONPOST.COM, Oct. 25, 1999, http://www.washingtonpost.com/wp- srv/national/dotmil/arkin.htm (last visited Mar. 8, 2008). "A Top Secret U.S.-only operation . . . was approved soon after the bombing began . . . ." Id.
56. Such a balancing act may violate IHL, since the risk to civilian lives is to be balanced against the expected military advantage to be gained, not the reduction in risk to military forces. See infra Section II.A.
57. These are called "dual-use" targets and strikes on them remain controversial under IHL due to the possible impact on civilian public health and safety. See DOD, ASSESSMENT, supra note 18, at 8-9.
58. As James Fallows reported: Despite the precision of the [American] bombing campaign, by mid-April [2003] wartime damage and immediate postwar looting had reduced Baghdad's power supply to one fifth its pre-war level, according to an internal Pentagon study. In mid-July the grid would be back to only half its pre-war level, working on a three-hours-on, three-hours-off schedule. James Fallows, Blind Into Baghdad, THE ATLANTIC, Jan.-Feb. 2004, at 52, 70.
59. DOD, ASSESSMENT, supra note 18, at 8-9 (discussing the war crime allegations surrounding the coalition bombing of the electrical power system in Baghdad).
60. On April 23, 1999, NATO bombed the headquarters and studios of the Serbian state radio and television station (RTS). Eric David, Respect for the Principle of Distinction in the Kosovo War, 3 Y.B. INT'L HUMANITARIAN LAW 81, 86 (H. Fischer & Avril McDonald eds., 2000). Although cyber warfare offers several possible nonlethal alternatives for future military campaigns, this Note will discuss the legal implications of this strike. See infra Part II.
61. DOD, ASSESSMENT, supra note 18, at 9.
62. This is a form of so-called psychological operations.
63. The U.S. DOD has stated that such an action would violate the ban on perfidy and constitute a war crime. DOD, ASSESSMENT, supra note 18, at 10.
64. Spieker, supra note 23, at 84. While not every state has adopted the provisions of Additional Protocol I, the principle of distinction is accepted as customary law. Id.
65. Protocol Additional to the Geneva Conventions of 12 August 1949, and Relating to the Protection of Victims of International Armed Conflicts (Protocol I) arts. 51(2), 51(1), June 8, 1977, 1125 U.N.T.S. 3 [hereinafter Additional Protocol I].
66. Id. art. 54(2).
67. Legality of the Threat or Use of Nuclear Weapons, Advisory Opinion, 1996 I.C.J. 226, 257 (July 8).
68. Additional Protocol I, supra note 62, art. 57.
69. Id. art. 52(2) (emphasis added).
70. Id. art. 55.
71. Id. art. 56.
72. Id. art. 51(2).
73. MARCO SASSÒLI, LEGITIMATE TARGETS OF ATTACKS UNDER INTERNATIONAL HUMANITARIAN LAW 7 (2003).
74. O'Donnell & Kraska, supra note 48, at 157.
75. Sassòli, supra note 70, at 7.
76. Id.
77. DOD, ASSESSMENT, supra note 18, at 8-9 (discussing the controversy surrounding the bombing of Baghdad power plants in Gulf War I).
78. Id. at 8.
79. See Graham, supra note 15.
80. As Dörman notes: For example, certain attacks against objects indispensable to the survival of the civilian population, such as drinking water installations and irrigation works, or attacks against installations containing dangerous forces, namely dams, dykes and nuclear electrical generating stations are prohibited. These prohibitions are independent of the type of weapons or methods of warfare used. Dörmann, supra note 13, at para. 16; see also Additional Protocol I, supra note 62, arts. 55-56.
81. See supra Section I.B.
82. See O'Donnell & Kraska, supra note 48, at 149-50.
83. Scott, supra note 18, at 59.
84. See supra Section I.B.
85. Graham, supra note 15. "[C]omplicating large-scale computer attacks is the need for an extraordinary amount of detailed intelligence about a target's hardware and software systems." Id.
86. See GREENBERG ET AL., supra note 28, at 11.
87. Id. at 11-12.
88. See Additional Protocol I, supra note 62, arts. 54-56.
89. See Dörmann, supra note 13.
90. Cf. Hays Parks, The Protection of Civilians from Air Warfare, 27 Isr. Y.B. on Hum. Rts. 65, 87-90 (1997) (discussing how the development of smart bombs has resulted in a similar effect on the utility of the principle of distinction).
91. GREENBERG ET AL., supra note 28, at 12. One military leader has noted, " '[t]here is no logical distinction . . . between military or civil systems or technologies. [Therefore] there is also no technical distinction between exploitation, attack or defense of the information warfare target set.' " Id. (quoting Vice Admiral Arthur Cebrowski) (alteration in original); see also O'Donnell & Kraska, supra note 48, at 148 ("[N]et-war . . . tends to defy and cut across standard boundaries, jurisdictions, and distinctions between state and society, public and private, war and peace, war and crime, civilian and military . . . legal and illegal.").
92. Brown, supra note 16, at 193; see also MICHAEL IGNATIEFF, THE WARRIOR'S HONOR 126 (1998) (stating that the purpose of war now seems to include "terrorizing, deporting, and even exterminating the other side's civilian populations"); O'Donnell & Kraska, supra note 48, at 155 ("In the fog of modern war, in which a state's entire society becomes vested in warfare, it is especially difficult to distinguish between lawful and unlawful targets . . . .").
93. See supra Section I.B. The United States has maintained that the legality of an attack on a civilian radio station used by a belligerent for purely psychological operations "is an issue that has yet to be addressed authoritatively by the international community." DOD, ASSESSMENT, supra note 18, at 9; see also Michael N. Schmitt, Wired warfare: Computer network attack and jus in bello, 84 INT'L REV. RED CROSS, 365, 381 (2002) ("[I]f the operation were designed to cause, for example, mere inconvenience, it would not rise to the level of an attack and would thus be permissible regardless of the target's nexus, or lack thereof, to military operations.").
94. See David, supra note 57, at 88-89. It should be noted that NATO made no allegations that RTS had incited the population to commit war crimes. Id.
95. W.J. Fenrick, The Law Applicable to Targeting and Proportionality after Operation Allied Force: A View from the Outside, 3 Y.B. INT'L HUMANITARIAN L. 53, 72 (2000) ("NATO's strategic objectives included 'Damaging Serbia's capacity to wage war against Kosovo in the future or spread the war to neighbours [sic] by diminishing or degrading its ability to wage military operations . . . .' " (omission in original)).
96. See, e.g., David, supra note 57, at 107.
97. See Schmitt, supra note 90, at 381-82.
98. See Additional Protocol I, supra note 62, art. 52. Banks and stock exchanges are two examples of civilian objects.
99. Brown, supra note 16, at 194.
100. See Antolin-Jenkins, supra note 26, at 145 ("A direct attack on financial markets, particularly a mixed attack, which would both change economic data and target financial programs created to respond to that data, has huge long term destructive potential."). But see Brown, supra note 16, at 194 (stating that attacks on banks or telephone networks would likely be condemned as violating IHL since attacks on these targets seem to serve no legitimate military purpose).
101. GREENBERG ET AL., supra note 28, at 12.
102. See O'Donnell & Kraska, supra note 48, at 156 ("As we enter the computer warfare age, nations will attempt to further exploit [the] seam between the protected status of the civilian and the belligerent actions of the state.").
103. See supra Section I.A.
104. See id.
105. See 1907 Hague Convention V, supra note 24, art. 8.
106. STEPHEN C. NEFF, THE RIGHTS AND DUTIES OF NEUTRALS 1 (2000).
107. See generally 1907 Hague Convention XIII, supra note 24.
108. 1907 Hague Convention V, supra note 24, art. 1.
109. Id. art. 2.
110. Jurists Commission, General Report on Rules for the Control of Radio in War and Aerial Warfare, 17 AM. J. INT'L L. (SUPP.) 242, 258 (1923). Article 40 of the Rules of Aerial Warfare was written at the 1923 Hague Conventions, and while never signed into law, many legal commentators believe these rules may restate custom. See Walker, supra note 19, at 1135 n.222.
111. See 1907 Hague Convention V, supra note 24, art. 5.
112. 1907 Hague Convention XIII, supra note 24, art. I.
113. Id. art. II.
114. DOD, ASSESSMENT, supra note 18, at 10.
115. 1907 Hague Convention V, supra note 24, art. 8.
116. Id. art. 9.
117. DOD, ASSESSMENT, supra note 18, at 10 ("The plain language of this agreement would appear to apply to communication satellites as well as to ground-based facilities.").
118. Id. at 10. 1907 Hague Convention V explicitly mentions only cables and communications apparatus, not devices that generate information. 1907 Hague Convention V, supra note 24, art. 8.
119. See DOD, ASSESSMENT, supra note 18, at 10 ("For example, if a belligerent nation demanded that the U.S. government deny GPS navigation services to its enemy, and if the U.S. were unable or unwilling to comply, the belligerent may have the right to take necessary and proportional acts in self-defense, such as jamming the GPS signal in the combat area.").
120. Id. at 10; GREENBERG ET AL., supra note 28, at 10.
121. But see GREENBERG ET AL., supra note 28, at 10 ("The encroachments beyond a nation's borders that may violate its neutrality have, in the past, been physical intrusions by troops, ships, or planes.").
122. 1907 Hague Convention V, supra note 24, art. 8.
123. See DOD, ASSESSMENT, supra note 18, at 10.
124. 1907 Hague Convention V, supra note 24, art. 2 (emphasis added).
125. Brown, supra note 16, at 184 ("In the information age, armed forces need not always deploy bombers and artillery to accomplish these objectives. In other words, the use of computer technology to wage war necessitates a reevaluation of the definition of the term 'weapon.' ").
126. DEPT. OF THE AIR FORCE, POLICY DIRECTIVE 51-4, Compliance with the Law of Armed Conflict para. 6.5 (1993).
127. William J. Bayles, The Ethics of Computer Network Attack, PARAMETERS, Spring 2001, at 44, 45.
128. Brown, supra note 16, at 210.
129. See 1907 Hague Convention V, supra note 24, art. 2.
130. See Brown, supra note 16, at 210. Whether the belligerent will actually choose to launch such an attack will depend on the scale and nature of the cyber attack.
131. See NEFF, supra note 103, at 1.
132. Compare 1907 Hague Convention V, supra note 24, art. 5, with Walker, supra note 19, at 1199 ("A neutral's duty to repel [belligerent] incursions varies with the modality of incursion.").
133. See 1907 Hague Convention V, supra note 24, art. 5.
134. See Newly nasty, supra note 1.
135. Brown, supra note 16, at 210.
136. Id.
137. Walker, supra note 19, at 1199.
138. Id.
139. Id.
140. Id. at 1183.
141. Id.
142. Id. at 1108.
143. Unless, of course, Belligerent A moved its forces through neutral territory.
144. Cf. DOD, ASSESSMENT, supra note 18, at 8 ("The long-distance and anonymous nature of computer network attacks may make detection and prosecution unlikely, but it is the firmly established policy of the United States that U.S. forces will fight in full compliance with the law of war.").
145. Cyrus Farivar, Cyberwar I: What the Attacks on Estonia Have Taught Us About Online Combat, SLATE, May 22, 2007, http://www.slate.com/id/ 2166749/.
146. Id.
147. The DARPA-proposed active network likely would affect this analysis, since the belligerent would be able to reconfigure the Internet nodes and possibly circumvent neutral parties entirely. See supra note 44.
148. See supra Section II.B.
149. See R.B. Brandt, Utilitarianism and the Rules of War, 1 PHIL. & PUB. AFF. 145, 154 (1972) ("[N]either side will consent to or follow rules of war which seriously impair the possibility of bringing the war to a victorious conclusion.").
150. See O'Donnell & Kraska, supra note 48, at 155.
151. SASSÒLI, supra note 70, at 3.
152. Final Report to the Prosecutor by the Committee Established to Review the NATO Bombing Campaign Against the Federal Republic of Yugoslavia, para. 40, June 8, 2000, 39 I.L.M. 1257.
153. See O'Donnell & Kraska, supra note 48, at 156.
154. Id.
155. See Schmitt, supra note 90, at 396-98.
156. See id.
157. See supra Part III.
158. Brown, supra note 16, at 210.
159. Id. at 210-11.
160. See id.
161. See id.
162. Id. at 211.
163. See supra Section III.B.
164. Indeed, some scholars have already attempted these extensions. See, e.g., Brown, supra note 16, at 201-02.
165. BRYAN W. ELLIS, THE INTERNATIONAL LEGAL IMPLICATIONS AND LIMITATIONS OF INFORMATION WARFARE: WHAT ARE OUR OPTIONS? 14 (2001).
166. Id.
167. Id.
168. See Conventions on Prohibitions or Restrictions on the Use of Certain Conventional Weapons Which May Be Deemed to Be Excessively Injurious or to Have Indiscriminate Effects Protocol II, Oct. 10, 1980, 1342 U.N.T.S. 168, 19 I.L.M. 1529.
169. Wealthy states may be far more vulnerable to cyber weapons given the increased level of technological sophistication of their infrastructure. See Ellis, supra note 162, at 14 ("An outright ban on IW or placing strict controls on the weapons of IW appears sensible from the U.S. perspective, particularly if we find our vulnerabilities outweigh our technological advantages.").
170. One proposed convention extends the authority of the ICJ as its enforcement mechanism. See Brown, supra note 16, at 213-14.
171. ELLIS, supra note 162, at 14. Other approaches to creating new norms similarly may fail to obtain the compliance of non-state actors.
172. Walker, supra note 19, at 1200-01 (citation omitted).
173. See O'Donnell & Kraska, supra note 48, at 159.
174. See id.