The fact that States resort to automated cyber operations like NotPetya, which spread virally and have indiscriminate effects, raises the question of how the use of these might be regulated. As... Show moreThe fact that States resort to automated cyber operations like NotPetya, which spread virally and have indiscriminate effects, raises the question of how the use of these might be regulated. As automated operations have thus far fallen below the threshold of the use of force, the letter of international humanitarian law (IHL) does not provide such regulation. In IHL, the principles of distinction and discrimination hold that attacks should in their targeting distinguish between the civilian population and combatants, and between civilian objects and military objectives. Attacks must not be indiscriminate, and operations that might foreseeably spread to affect civilian objects are prohibited. This paper draws inspiration from the legal principles of distinction and discrimination to suggest a non-binding norm for responsible State behaviour with regard to automated operations that fall below the threshold of the use of force: the norm proposes that States should design cyber operations so as to prevent them from indiscriminately inflicting damage. The paper finds that in the case of automated cyber operations, a distinction between the nature of the operation and the use of the operation does not make sense because the design (nature) of the malware defines the use. In order to conform with the norm, responsible States should conduct a review of cyber operations prior to their execution. Finally, as the paper illustrates with a comparative analysis of NotPetya and Stuxnet, the post-incident forensic analysis of an operation can allow third parties and victims to determine whether the operation’s designer conformed with the norm. This can help set a normative benchmark by providing a basis upon which States may call out unacceptable behaviour. Show less
This article argues that it is possible—given the right resources and expertise—to hold individual non-state actors responsible for violations of international humanitarian law (also known as ‘the... Show moreThis article argues that it is possible—given the right resources and expertise—to hold individual non-state actors responsible for violations of international humanitarian law (also known as ‘the laws and customs of war’) perpetrated with cyberweapons. It describes jurisdictional elements of violations of the laws and customs of war as well as points that prosecutors and investigators must consider when planning investigations of serious violations of international humanitarian law perpetrated in cyberspace. It addresses how certain theories of individual criminal responsibility for war crimes apply to offences committed by non-state actors during cyberwarfare and identifies particular evidentiary challenges arising from the particular qualities of cyberspace and cyberweapons. Individual accountability for war crimes perpetrated during cyber operations requires new thinking about the application of legal principles and theories during cyber conflict. Show less
