Neue Kontaktadresse: SicherheitspolitikMS@outlook.de Dieser Blog beschäftigt sich mit aktuellen sicherheitspolitischen Themen. Die Bearbeitung beruht auf Hintergrundwissen und versucht mit den Medienwahrheiten aufzuräumen. Ziel ist die kompetente Darstellung der Fakten.
Mittwoch, 18. Mai 2016
NATO Paper on the TALLIN MANUAL Paper 7 The Law of Cyber Targeting ( Summary) english
Summary of the paper`s background
Papers is a peer reviewed publication of the NATO Cooperative Cyber Defense
Centre of Excellence, designed to inform strategic dialogue regarding cyber
security within the alliance and beyond.
The Law of Cyber Targeting
between Russia and Georgia (2008) marked the birth of cyber war ( not
hacktivism). Today we see cyber operations (CO) in Syria and Ukraine. Attention
must be paid to the law that governs these activities. Given the novelty of CO
as a method of warfare during an armed conflict any alleged misuse has the
potential for strategic consequences. NATO CCDCE has taken a global lead in
addressing this issue. The following questions are asked:
applies to my operation ?
engage the intended target ?
weapon that I use legal ?
precautions must I take to avoid collateral damage ?
scope and degree of likely collateral damage prohibit me from engaging the
will explain how each is resolved with respect to CO.
The Applicable Law (Part I)
Humanitarian Law ( IHL ) comes into play when there is an armed conflict in
legal parlance ( international and not international). To kill members of the
civilian population is a violation of IHL and a war crime. There is no
normative or practical logic for distinguishing between an CO and a kinetic
operation (e.g. Stuxnet 2010). The enemy must be an organized armed group which
is difficult to see in most cyber threats. The group must be armed and not only
long to “denial of service actions (Estonia) In simple terms: The cyber
conflict must start looking like war.
The Applicable Law (Part II)
discussion of targeting begins within the principle of distinction which is
codified in Article 48 ( Geneva Conventions). Attacks against civilians and
civilian objects are prohibited, indiscriminate attacks are forbidden, parties
to a conflict must take precautions to minimize civilian harm when planning and
conducting attacks and so forth.
surrounds the issue of whether the nation attacks should be interpreted more
broadly. A CO targeting civilian cyber infrastructure (CCI) without physical
effects could be far more detrimental than one causing limited damage. Consider
an attack during an armed conflict on the enemy`s CCI: It seems incongruent to
prohibit only the latter. If Data is treated as an object any manipulation of
civil data would be qualify as unlawful damage or destruction (mind the
deletion of a forum or blog post).Unless a CO has consequences that at least
affect the functionality of an object it does not qualify as attack and
therefore it is not prohibited. During an armed conflict it is generally legal
to conduct CO against civilians as long as they are not harmed or injured.
Denial of service is lawful until physical effects like starvation or illness.
CO must be
frequently implicate the prohibition on attacking civilian objects, which are
not military ones. Military objects are objects which by their nature,
location, purpose or use make an effective contribution to military action and
whose total or partial destruction, capture or neutralization in the
circumstances ruling the time, offers a definite military advantage. “ A
particular location might be to open dame gates to flood an area and deny its
use to the enemy. A civilian object can become a military object though
purpose: A civilian server farm that will store military data which may be
attacked even before data storage begins or air traffic control or airspace
management systems ( “war fighting or war supporting objects). Many war
sustaining targets cannot be struck kinetically in a fashion that would
generate the same effects as cyber attacks (bank systems for example). Persons
may qualify as targets like combatants. Civilians qualify as well for the time
they are members of an armed organized group with a continuous combat function.
All those who conduct CO against the enemy or who defend against hostile
operations have a continuous combat function and would be targetable. Analogue
to human shields would be the development of more specific to an attack of the
enemy system allowing CO to be launched from one`s home or business by others.
certain uses of cyber weapons (malware) violate OHL such as attacking
civilians, cyber weapons may also be unlawful per se. Weapons are prohibited
directed at a specific military objective
weapons may at times run afoul of these prohibitions – consider malware
intended for use against military cyber infrastructure linked to civilian networks.
If the malware is designed to spread randomly though the system into which it
is introduced it is indiscriminate by nature and prohibited per se. The most
well known indiscriminatecyber weapon
is the malicious but seemingly innocuous e-mail attachment sent to a
combatant`s private e-mail account. Since the attacker has no control to whom
it might be it would be indiscriminate ( mind of puppy or kitten videos).
Restrictions do not bear on malware that does not cause injury, damage or loss
of system functionality. Cyber weapons can be employed against closed military
systems in which the risk of bleed over into civilian networks is low.
Precautions to avoid Civilian Harm and
must take constant care to spare the civilian population, civilians and
civilians objects. He must do everything feasible to verify that the target is
not protected by IHL select the weapon, tactic and target that will minimize
civilian harm without forfeiting military advantage or cancel an attack when reason
to believe that the attack may be unlawful comes to light and warn the civilian
population of any attack that may affect them.
which may expected to cause incidental loss of civilian life injury o
civilians, damage to civilian objects or a combination thereof which would be
excessive in relation to the concrete and direct military advantage anticipated
On the one
hand options that are in fact lawful are sometimes needlessly taken off the
table out of misguided concern as to their legality. On the other hand unlawful
options are in times seriously considered thereby risking public and
intentional condemnations should they be selected. The normative fog of Cyber
war is beginning to clear.