The International Committee of the Red Cross (ICRC) is urging hacking groups involved in conflict during war to abide by a set of rules meant to protect the general population.
According to the organization, which oversees and monitors the rules of war, an increasing number of civilian hackers are getting involved in military conflicts by means of digital operations, especially in the context of the Russian war in Ukraine.
“With many groups active in this field, and some of them having thousands of hackers in their coordination channels and providing automated tools to their members, the civilian involvement in digital operations during armed conflict has reached unprecedented proportions,” the ICRC says.
This level of engagement from civilian hackers, the organization points out, is worrying because some groups may be directly or indirectly targeting civilian objectives, because these hackers may expose themselves and their close ones to military operations, and because this involvement blurs the line between civilians and combatants.
These hackers, the ICRC notes, may or may not abide by the national laws. During armed conflicts, however, they should follow the universal set of rules that the international humanitarian law (IHL) provides, and which are aimed at safeguarding “civilians, and soldiers who are no longer able to fight, from some of the horrors of war”.
While IHL does not prohibit hacking, nor the involvement of civilians in hacking operations, it does set “elementary considerations of humanity on the protection of civilians, meaning obligations that everybody must respect when conducting operations in the context of an armed conflict, irrespective of the reasons for the conflict”.
When engaging in cyber activities against military or civilian targets during an armed conflict, civilian hackers may become liable for their actions, and risk being considered and prosecuted as criminals or terrorists if captured, ICRC points out.
As such, the organization sets out eight rules of engagement for civilian hackers involved in war:
- Do not target civilian objectives,
- Do not use malware or tools that spread automatically and which may indiscriminately damage military and civilian objectives alike,
- When launching a cyberattack on a military objective, avoid or minimize impact on civilians,
- Do not target medical and humanitarian facilities,
- Do not target objectives impacting the survival of the population or which may release dangerous forces,
- Do not make threats of violence to spread terror among the civilians,.
- Do not encourage the violation of international humanitarian law,
- Comply with these rules even if the enemy does not.
Under IHL, a cyberattack is a cyber operation that may – directly or indirectly – negatively impact infrastructure and data (by damaging, disabling, or destroying it), or may lead to injury or death of individuals. Activities leading to unauthorized access to information are not included here.
According to ICRC, no country should encourage or tolerate the involvement of hackers in cyberattacks in the context of an armed conflict, as this could lead to violations of applicable law.
The organization notes that each country should adopt and enforce national laws to regulate civilian hacking and should ensure that civilians engaging in cyber operations in times of war respect IHL.
Each state, ICRC says, is internationally legally responsible for the actions of hackers acting on behalf of that state, should not encourage civilian hackers to violate IHL, should prevent IHL violations by civilian hackers on their territory, and should prosecute war crimes and IHL violations, including cyberattacks that target ‘the enemy’.
“IHL sets out essential rules to limit the effects of armed conflicts on civilians. No one that participates in war is beyond these rules. In particular, every hacker that conducts operations in the context of an armed conflict must respect them, and states must ensure this is the case to protect civilian populations against harm,” ICRC notes.
The BBC has interviewed several important hacktivist collectives involved in the Russia-Ukraine conflict, including the IT Army of Ukraine, Killnet and Anonymous Sudan, and they all indicated that they are unlikely to follow the ICRC’s recommendations.
Related: UK Warns of Russian Hackers Targeting Critical Infrastructure
Related: A Year of Conflict: Cybersecurity Industry Assesses Impact of Russia-Ukraine War
Related: The Lessons From Cyberwar, Cyber-in-War and Ukraine