Part Three Distinction, 9 Who Did It? Attribution of Cyber Intrusions and the Jus in Bello

Subject(s):

Armed conflict — Weapons — Ius in bello

The central concepts that make up the Law of Armed Conflict (LOAC) have not been easy to adapt to cyber operations. In addition to their kinetic history and orientation, the core LOAC principles do not in most instances anticipate the kind of cyber-specific analysis that should accompany the use of increasingly advanced cyber systems and tools in conflict. Cyber operations rarely cause physical damage, much less injury or death. More often they cause cyber harm—by corrupting, manipulating or stealing data, denying access to a website, or interfering temporarily with the functionality of information systems. Or they indirectly disrupt or damage objects that are not part of the cyber domain. Measuring the harm from a cyber incident and calculating that harm in ways that the LOAC credits remains challenging, as does defining and distinguishing civilian and military objects, and accounting for the indirect effects of cyber operations. The LOAC also has not settled on a legal status for critical national security-related components of the cyber domain, including data and dual-use infrastructure.