Does cyber warfare break international law?

The UN Charter includes the prohibition on the “use of force against the territorial integrity or political independence” of any state. But what is “force” when it comes to hacking?

Disturbing questions: Is releasing a computer virus a use of force? Similarly, International Humanitarian Law – primarily the Geneva Conventions, which govern international warfare – bans attacks on civilian targets. So if a fibre optic cable carries packets of data for the army and for civilian hospitals, is cutting it a war crime?

It’s not only states who are concerned: Microsoft – a major contractor with staff and facilities servicing the US military – has been lobbying for more clarity in the law for years.

The conduct of war in cyberspace – and what rules could or should apply – is such a thorny issue that two UN bodies are considering it simultaneously. One, the Group of Governmental Experts (GGE), is due to hold its third meeting in Geneva starting 31 August. The UN General Assembly formed the GGE on cybersecurity (its full name is the “Group of Governmental Experts on Advancing responsible State behaviour in cyberspace in the context of international security”) in 2018 to answer questions on whether international law can be interpreted to include acts of cyber warfare. It consists of 25 member states, chaired by Brazil.

The GGE’s cousin, the Open-Ended Working Group (OEWG), is another UN body  that considers similar questions but with a broader membership that includes all UN member states. The OEWG should produce its final report in March 2021. The overlap between the two groups is the result of a complex piece of diplomatic choreography partially rooted in rivalry and tensions between the US,  NATO allies, and Russia.

Confused? Thankfully, the Geneva Internet Platform makes sense of it all. It monitors talks by both bodies and issues handy explainers to keep you up to date.