1. Introduction
The nature of warfare is undergoing a paradigm shift. Comparable in significance with the moments when armed contest for the first time expanded into the sea and then into the air, warfare has today irrevocably entered another domain: cyberspace.
While this latest development has opened a host of yet unresolved problems, ranging from questions of military strategy and tactics to technical matters and to issues of law, this article focuses narrowly on one significant challenge posed by this development to the applicability of international humanitarian law (IHL): namely, how do we assess, from this perspective, cyber attacks the aim of which is the destruction of electronic data without necessarily resulting in physical damage? In particular, does such data qualify as an ‘object’ under IHL, and may it thus be considered a military objective?
The answers to these questions have significant consequences for the conduct of cyber operations in general and cyber warfare in particular. Attacks of this kind have not only been forecast and pondered over in academic literature,Footnote 1 but they have become a frequent occurrence in modern day reality.Footnote 2 One of the cornerstones of IHL is the principle of distinction, described by the International Court of Justice (ICJ) as a ‘cardinal’ principle of IHL.Footnote 3 It prescribes that belligerent parties must at all times distinguish between civilian objects and military objectives and direct their operations only against military objectives.Footnote 4 Does this distinction extend into the realm of cyberspace?
This article argues in favour of a broad understanding of the notion of ‘object’, bringing data within the scope of the rules on military objectives as codified in Additional Protocol I to the 1949 Geneva Conventions.Footnote 5 This interpretation runs against the ‘emerging orthodoxy’ represented by the recently published Tallinn Manual on the International Law Applicable to Cyber Warfare.Footnote 6
Accordingly, the article begins by presenting the position taken by the authors of the Tallinn Manual (Section 2). It then disposes of the possible objection that while an alternative view could be desirable, it would at best amount to a view de lege ferenda, but not an interpretation de lege lata (Section 3). It considers and rejects one possible interpretation under which data would amount to a non-object, yet it could constitute a legitimate military objective (Section 4). Finally, the article presents its case for the consideration of data as an object under IHL utilising the general rule of treaty interpretation reflected in Article 31 of the Vienna Convention on the Law of Treaties (Section 5). It will be demonstrated that this understanding is in line with the ordinary meaning of the term ‘object’ as understood in light of present day conditions, taking account of the context of the term in the Protocol and the object and purpose of the treaty.Footnote 7
2. Emerging Orthodoxy: The Notion of Military Objective Does Not Include Data
The Tallinn Manual is the result of a comprehensive and rigorous endeavour that aims to identify the rules of international law applicable to cyber warfare. Produced by a group of international experts who were ‘carefully selected to include legal practitioners, academics, and technical experts’,Footnote 8 it purports to reflect their consensus as to the lex lata governing cyber conflict derived primarily from ‘treaty law directly on point or sufficient state practice and opinio juris from which to discern precise customary international law norms’.Footnote 9 The Manual identifies a total of 95 rules belonging to general international law, the law on the use of force and IHL.
The question of the status of computer data under IHL arises in relation to the experts' interpretation of the rules on targeting in the context of cyber conflict. The relevant analysis can be found in Rule 38 and the attached commentary.Footnote 10 The rule forms part of Section 4 of Chapter 4, entitled ‘Attacks against Objects’, and is directly preceded by a section entitled ‘Attacks against Persons’.Footnote 11 As this structure suggests, the authors distinguished between, on the one hand, rules on targeting applicable to living human beings and, on the other hand, those applying to everything else (denoted in the manual as ‘objects’).Footnote 12 The commentary in the Manual even appears to limit the term ‘military objective’ to the latter category,Footnote 13 which would, however, be at odds with much of the available state practice, according to which the term comprises individuals, objects, and often even land area.Footnote 14
The Tallinn Manual transplants the wording from the Protocol into its legal definition of the term ‘military objective’.Footnote 15 The relevant provision, Article 52(2) of the Protocol, which is considered today to reflect customary law,Footnote 16 reads:Footnote 17
Attacks shall be limited strictly to military objectives. In so far as objects are concerned, military objectives are limited to those objects which by their nature, location, purpose or use make an effective contribution to military action and whose total or partial destruction, capture or neutralization, in the circumstances ruling at the time, offers a definite military advantage.
As rephrased by the Manual, Rule 38 states the following:
Civilian objects are all objects that are not military objectives. Military objectives are those objects which by their nature, location, purpose, or use, make an effective contribution to military action and whose total or partial destruction, capture or neutralization, in the circumstances ruling at the time, offers a definite military advantage. Military objectives may include computers, computer networks, and cyber infrastructure.Footnote 18
As expressly mentioned in the text of the rule in fine, tangible technological infrastructure, including computers and computer networks, is not excluded from the material scope of the rule. However, this is not the case with computer data.
As the experts tied the definition of military objectives closely to the notion of ‘objects’, they assigned central importance to the meaning of this term in the framework of Additional Protocol I. They cited the International Committee of the Red Cross (ICRC) Commentary on the Additional Protocols and observed that in this commentary ‘[a]n object is characterized ... as something “visible and tangible”’.Footnote 19 Placed against this interpretative background, data was poised to remain outside the scope of IHL rules on targeting. The experts continued: ‘Data is intangible and therefore neither falls within the “ordinary meaning” of the term object nor comports with the explanation of it offered in the ICRC Additional Protocols Commentary’.Footnote 20 The experts did not explain what they considered to be the ‘ordinary meaning’ of the term ‘object’. The only footnote in the whole paragraph leads to Article 31(1) of the Vienna Convention on the Law of TreatiesFootnote 21 (VCLT) without further elaboration.Footnote 22 In particular, no mention is made of any of the other methods of interpretation enshrined in the VCLT.Footnote 23 A key consequence of this position is that a cyber operation targeting data would not fall within the ambit of IHL unless it were to affect the functionality of a control system resulting in the need to replace its physical components.Footnote 24
The text, however, acknowledges the contrary position held by a ‘minority’ of the experts – namely that ‘for the purposes of targeting, data per se should be regarded as an object’. This position is justified by the essentially teleological consideration that if data was not to be considered an object, the act of deletion of valuable civilian datasets would fall outside of the scope of application of IHL, thus contradicting the principle of protection of the civilian population from the effects of hostilities.Footnote 25 The relevant text concludes with a laconic observation that ‘[t]he majority characterised this position as de lege ferenda’.Footnote 26
3. The Significance of the Lack of State Practice for the Distinction between Lex Lata and Lex Ferenda
The view promoted in this article aligns with the minority opinion among the international group of experts. It is therefore necessary to consider at this point the objection that, however desirable this interpretation might be, it would nonetheless be a position ‘de lege ferenda’.Footnote 27
At first blush, such an objection might certainly appear formidable. In the methodological section of the study, the experts clearly confined the scope of the Tallinn Manual within the four corners of lex lata.Footnote 28 Furthermore, the chairman of the group of experts, Professor Michael Schmitt, has in his separate writing relevant to cyber conflict occasionally characterised views differing from the positions eventually embraced by the Manual as not representative of lex lata.Footnote 29 Both in Professor Schmitt's writing and in the methodology of the Manual, a putative interpretation of the law would be rejected as merely de lege ferenda if it was not grounded in relevant state practice and opinio juris.Footnote 30 It is submitted, however, that this is not an appropriate standard for the interpretation of international law.
The distinction between lex lata (law as it is) and lex ferenda (law as it ought to be) – borrowed from positivist legal theory and domestic law – sits uneasily in the unique horizontal legal framework of international law. To a much greater extent than municipal law, international law is characterised by uncertainty as to the existence, not just the interpretation, of many of its putative rules, including some of the most fundamental ones. Arguments as to their existence (dimension lex lata) often feature some elements of policy, desirability and progressiveness (dimension lex ferenda).Footnote 31
By way of an example, we may consider the recent debate over the existence of a norm permitting humanitarian intervention in international law in respect of the ongoing Syrian conflict. Although such a norm cannot easily be deduced from the corpus of written treaty law,Footnote 32 the United Kingdom government issued a statement in August 2013 in which it seemed to consider this norm as part of customary international law.Footnote 33 It did not cite any state practice and many commentators were quick to point out that there was a lack of such practice at the time.Footnote 34 The UK's approach was evocative of the 1945 Truman Proclamation,Footnote 35 in which the United States famously put forward a claim known to be inconsistent with pre-existing international law with the aim of generating a new norm of customary international lawFootnote 36 – the difference being, of course, that where the Truman-led US succeeded,Footnote 37 David Cameron's UK seems to have failed.Footnote 38
However, irrespective of the final fate of the UK's proposition, it is interesting for our purposes to highlight what the British government did cite in place of the missing analysis of state practice. The UK, led by the aforementioned aim to persuade other states to ascribe to its view, included in its statement the contention that the intervention would ‘alleviate the scale of the overwhelming humanitarian catastrophe in Syria’.Footnote 39 This was clearly a policy-based consideration which, if expressed in general terms, would amount to a proposition that non-consensual foreign military intervention that alleviates humanitarian disasters ought to be or is permitted by international law. Such an argument thus obviously inhabits the borderline area between lex lata and lex ferenda.Footnote 40 Indeed, one might interpret the allegedly noble purpose of the intervention as one of the requirements permitting it under the (putative) rule lex lata. Some have gone even further to argue that the legality of a military intervention would turn on a strategic assessment of its capacity to achieve the stated objective of improving the situation on the ground.Footnote 41 Be that as it may, this example serves to illustrate the close relationship between lex lata and lex ferenda in international law.Footnote 42
However, it is important to bear in mind that the fact that the two dimensions do not exist in two watertight compartments does not mean that they have somehow collapsed into one single criterion of persuasiveness or have become irrelevant altogether. The aim here is rather to show that the lack of state practice in favour of one interpretation does not necessarily mean that an alternative interpretation should automatically prevail, as some of the writing referred to above might appear to suggest.Footnote 43
After all, despite the unambiguously proclaimed aim to limit the scope of their scrutiny to lex lata,Footnote 44 even the experts arguably tread along both sides of the fuzzy line separating the two dimensions. Putting aside the notion at the centre of the present article (to which I will return shortly), we may pick another notion almost at random to demonstrate the flaw at the basis of this objection. Let us consider, for instance, the way in which the experts apply the criterion of minimum organisation to ‘virtual’ groups.
The Tallinn Manual discusses ‘virtual’ groups, or groups organised solely online, in a section concerned with the criteria for the existence of a non-international armed conflict.Footnote 45 Although the applicable treaty text, Common Article 3 of the Geneva Conventions, does not contain a specific bottom threshold, post-Cold War case law has identified two – today generally accepted – criteria of minimum intensity of hostilities and minimum organisation of the non-state conflict party.Footnote 46 The Manual also reflects and accepts this development.Footnote 47
It then applies the criterion of ‘minimum organisation’ to ‘virtual’ groups, defined as those in which all relevant activities occur online.Footnote 48 The experts seemed reluctant to classify any cooperatively operating online group of individuals engaged in cyber attacks as an organised armed group for the purposes of IHL.Footnote 49 However, ‘[t]he majority of [experts] agreed that the failure of members of the group physically to meet does not alone preclude it from having the requisite degree of organisation’.Footnote 50 In other words, the majority of experts were willing to accept that a ‘virtual’ group could be an organised armed group under IHL (triggering the application of the law of non-international armed conflict).Footnote 51
The experts did not identify any state practice or opinio juris to bolster this interpretation. This is not surprising. After all, ‘online’ or ‘virtual’ groups engaged in cyber warfare are a novelty, which could not have been foreseen by the drafters of the Geneva Conventions in 1949 or even, in all likelihood, by the ICTY Appeals Chamber in 1995.Footnote 52 However, the absence of state practice, the likely basis of the rejection of the minority view regarding data as objects,Footnote 53 did not prove determinative in the analysis of the law applicable to ‘virtual’ groups.Footnote 54
How then do we get out of this interpretative maze? The distinction between lex lata and lex ferenda is undoubtedly one worth maintaining. However, to equate the absence of relevant state practice and opinio juris in support of a certain interpretation with the incorrectness of such interpretation under lex lata would be a step too far. After all, subsequent practice of states in the application of a treaty is but one of the considerations to be taken into account in interpreting the treaty in question,Footnote 55 and its absence cannot conclusively prove one over all other possible interpretations.Footnote 56
Technological progress by definition entails the emergence of novel concepts and categories, which are initially untied to any state practice or opinio juris regarding the interpretation of the concomitant legal issues. We should not substitute the dearth of state practice for proper treaty interpretation. Instead, we should assess the meaning of terms found in international treaties by reference to agreed methods of interpretation. This is what this article turns to in the remaining text.
4. Alternative Route: Data is not an Object, yet it May be a Military Objective
The experts have modified slightly the text of Article 52(2) of the Protocol without directly acknowledging so. The literal reading of the provision clearly permits the existence of military objectives which are objects, as well as those which are not. This is apparent from the limiting language at the beginning of the second sentence of the provision: ‘In so far as objects are concerned, military objectives are limited to ...’.Footnote 57 The highlighted part of the sentence allows for the existence of a class of things which are not objects, yet which should be considered military objectives. The Tallinn Manual, however, equates military objectives with objects.Footnote 58 The definition of military objectives it proposes in Rule 38 leaves out non-objects: ‘Military objectives are those objects which ...’.Footnote 59
It thus appears possible to read data, as a matter of lex lata, into the undefined class of non-objects left out by the Manual, but clearly contained in Additional Protocol I. This option certainly has some superficial appeal. It would allow us to accept the requirement of visibility and tangibility in relation to ‘objects’ proposed by the experts. The rest of the analysis in the Manual would thus remain unaffected. Data would be intangible ‘non-objects’, yet potentially military objectives.
The problem with this ‘alternative route’ solution is twofold: (i) it is entirely inconsistent with the traditional understanding of the notion of military objectives, and (ii) it would lead to a number of further interpretive difficulties in specific situations. First, this solution undermines the traditional interpretation of the dichotomy of targets which constitute legitimate military objectives in IHL, namely persons and objects.Footnote 60 Within this understanding, Article 52(2) of the Protocol defines military objectives falling into the latter category and leaves it for its other provisions to define the former.Footnote 61 This is also how the vast majority of states interpret military objectives in their military manuals.Footnote 62
Admittedly, for a few states, ‘establishments’ or ‘places’ form a third – ostensibly separate – category.Footnote 63 For example, the 1983 Belgian Law of War Manual categorises military objectives into ‘1) Persons … 2) Objects … 3) Places’.Footnote 64 Nevertheless, in spite of the different taxonomy, it would appear that this division is still consistent with the dichotomous structure of Article 52(2). ‘Places’ are simply a subcategory of ‘objects’ largo sensu, singled out for clarity. The Commentary by Bothe and his co-authors confirms this understanding by referring to the drafting history of Additional Protocol I: ‘[T]o make this interpretation unambiguously clear, several NATO countries expressed an understanding in their explanation of vote on Art. 52, that a specific area of land may be a military objective’ if it fulfils the criteria specified in the provision with respect to objects.Footnote 65 None of the other state parties objected to this interpretation, which means that we may safely assume that localities were to be considered a subclass of objects.Footnote 66 The persons–objects dichotomy, insofar as the construction of these provisions is concerned, thus appears to be correct.
This well-accepted and uncontroversial interpretation would, however, be turned upside down if data were held to belong in the ‘non-object’ category, until now populated only by living human beings.
Second, the ‘alternative route’ interpretation would consequently leave no valid criterion to assess whether a specific dataset would be a military objective. This is so because, in order to determine whether a specific object or a person is targetable in the specific circumstances, IHL sets out different legal criteria.
On the one hand, the rule for objects is spelt out in the second half of the second sentence of Article 52(2). This provision contains a two-pronged test, which requires that the object in question makes an effective contribution to military action and that its destruction, capture or neutralisation offers a definite military advantage.Footnote 67 Although this test is equally suitable in its application to data as it is to tangible objects (a point to which I return in the next section), it would not be available because of the interpretation of data as a non-object.
On the other hand, criteria which determine whether a certain person may permissibly be targeted in combat are, without hesitation, inapplicable to non-living things, whether tangible or not. It would be patently absurd to insist that the targetability of a certain dataset is assessed on the basis of its ‘combatant status’ or ‘direct participation in hostilities’. It thus becomes clear that the association of data with other non-objects in the normative framework of the Protocol would lead to absurd results. Therefore, despite its initial appeal, the ‘alternative route’ solution must also be rejected.
5. Proposed View: Data is an Object, Ergo It May Be a Military Objective
The view advocated by this article is that, contrary to the conclusion reached by the experts drafting the Tallinn Manual, data may indeed be considered as an object within the meaning of Article 52(2) AP I. If this interpretation is correct, whether a particular dataset is a military objective would be considered by reference to the criteria in the second part of the second sentence of that provision.Footnote 68 In this section of the article, my aim is to expound the term ‘object’ in Article 52(2), using the generally accepted methods of treaty interpretation as codified in the VCLT.
It is submitted that the ensuing analysis applies also, to a great extent, to the meaning of the term ‘object’ under customary international law. This is despite the obvious fact that stricto sensu the VCLT does not apply to norms of customary law.Footnote 69 The possibility that a norm exists in parallel in both treaty law and customary law is firmly established in international law.Footnote 70 Article 52(2) may safely be described as a ‘fundamentally norm-creating’ treaty rule of the kind that the ICJ considered in the North Sea Continental Shelf cases to be capable of evolving into custom.Footnote 71 Its parallel existence in customary and treaty law should thus not be in doubt.Footnote 72 It is true that the ICJ noted in Nicaragua that such rules, even if identical in treaty law and customary law, are nevertheless distinguishable, inter alia, by reference to the available methods of interpretation.Footnote 73 However, the differences should not be overstated. As Judge Tanaka observed in North Sea, ‘[t]he method of logical and teleological interpretation can be applied in the case of customary law as in the case of written law’.Footnote 74 As will be seen, the present analysis is in large part based precisely on these two shared methods of interpretation. Moreover, to the extent that this article relies on methods not available in respect of customary law (especially the contextual method insofar as it takes other treaty provisions into account), this should be seen as complementary in that it provides an additional reason in favour of the interpretation advocated here. In any event, this approach does not differ significantly from that undertaken by the authors of the Tallinn Manual. The experts, while describing the Article 52(2) definition as customary,Footnote 75 openly stated that they considered ‘treaty law directly on point’ when identifying the rules governing cyber conflictFootnote 76 and accepted that the VCLT rules on interpretation are pertinent to the analysis of the meaning of the term ‘object’ in international law.Footnote 77
According to the ‘general rule’ of interpretation found in Article 31(1) VCLT, ‘[a] treaty shall be interpreted in good faith in accordance with the ordinary meaning to be given to the terms of the treaty in their context and in the light of its object and purpose’. The question before us is whether the meaning of the term ‘object’ today extends to cover electronic data for the purposes of the definition of military objectives. Mark Villiger, the author of a detailed commentary on the VCLT, cautions that ‘the various means mentioned in Article 31 are all of equal value; none are of an inferior character’.Footnote 78 Apart from the ordinary meaning of the term in question we must therefore examine, in particular, the context in which it appears and the object and purpose of the treaty.Footnote 79
5.1. Ordinary Meaning in Context
As a starting point, let us recall that the authors of the Tallinn Manual based their refusal to characterise data as objects on the fact that an object must be, in their view, something ‘visible and tangible’.Footnote 80 Although the Manual was completed in early 2013, these words were borrowed from the ICRC Commentary on the two Additional Protocols, published 26 years earlier.Footnote 81 Although the concept of electronic data was not unknown in 1987, it is not difficult to believe that the idea of cyber warfare did not cross the minds of the authors of the Commentary. After all, it was published two full years before Tim Berners-Lee invented the World Wide Web,Footnote 82 revolutionising the way in which information was exchanged online and laying the foundations of the modern day virtual world.
The discussion of military objectives in the ICRC Commentary was instead very much grounded in the reality of ‘analog’ warfare. In fact, the word ‘computer’ is mentioned in the Commentary only twice. First, the authors highlight (with barely concealed bewilderment) the then novel possibility of storing ‘all provisions of international law applicable in case of armed conflict ... in the memory of a computer’.Footnote 83 Second, when discussing the requirements for identity cards under Annex I to Additional Protocol I, the authors refuse to accept that an electronic card (which could be produced, as they observe, thanks to ‘[c]urrent developments in computer information’) could replace good old paper-based cards foreseen by the drafters of the Protocol.Footnote 84
With these considerations in mind, could the authors of the Commentary then have intended to exclude data when they wrote that in order for something to be an object, it must be ‘visible and tangible’? Surely not. In 1987 it was still much too soon to consider hostilities in cyberspace. So why did they include these words? ‘Visible and tangible’ – as opposed to what?
The authors of the Commentary provide the answer to that question only a few paragraphs below the text cited in the Tallinn Manual. They write, in relation to the term ‘objective’, that it is also supposed to mean ‘tangible and visible things ... and not the general objective (in the sense of aim or purpose) of a military operation’.Footnote 85 The authors described objects and objectives as tangible to distinguish them from abstract notions such as the goals and aims of the parties to the conflict.Footnote 86 The reason behind this distinction is readily apparent. If a party's aim were to amount to a legitimate target justifying an attack by its opponent, the detailed and balanced rules on targeting would lose any sense.Footnote 87 Belligerents would gain a trump card if they wanted to pursue an attack against an object which would not meet the orthodox understanding: they could just claim they need to destroy it in order to neutralise the aim of the enemy.Footnote 88 Civilian infrastructure would thus become fair game through the back door of this too broad interpretation of the term ‘objective’. However, it would be incorrect to read more into the ICRC Commentary.Footnote 89
5.1.1. Contemporaneity
Since we cannot accept the interpretation of the term ‘object’ adopted by the ICRC Commentary for the purposes of our inquiry, we need to examine independently what its ‘ordinary meaning’ is. This raises a crucial inter-temporal aspect: is the question determined by the ‘ordinary meaning’ at the time of the adoption of the treaty, or may this meaning evolve over time?
If it is the former, the matter could be disposed of at this stage. If we have just accepted that the authors of the ICRC Commentary could not in 1987 have conceived of the potentiality that data would play a role in warfare, then even less could we presume that the drafters of the Protocol would have been capable of doing the same ten years earlier. Unfortunately, there is no provision in the VCLT that provides a simple answer. The only related draft article – Article 56 entitled ‘The inter-temporal law’ – was deleted from the VCLT during the travaux préparatoires stage.Footnote 90
The classic formulation of the former position comes from Judge Gerald Fitzmaurice. In his series of articles entitled ‘The Law and Procedure of the International Court of Justice’ he labelled it the principle of contemporaneity:Footnote 91
The terms of a treaty must be interpreted according to the meaning which they possessed, or which would have been attributed to them, and in the light of current linguistic usage, at the time when the treaty was originally concluded.
For Fitzmaurice, this principle derived from the rule that the rights of parties to a dispute, as they stood on a certain date, should be adjudged on the basis of the law as it was on that same date.Footnote 92 In relation to treaties, he added that ‘it follows automatically’ that a valid determination could be reached only on the basis of the contemporaneous meaning of the terms on the date on which the treaty was concluded.Footnote 93
Although Fitzmaurice's position carried great weight at the time, it is submitted that it was already overbroad at the time of the writing and has since been superseded by the ensuing development of international legal practice. First, the principle of contemporaneity as proposed by Fitzmaurice was overbroad as it assumed, without any further analysis, that for any dispute on any point of law arising from a treaty, the appropriate reference point would be the state of law at the time of the conclusion of the treaty. This is patently not true for all conceivable situations. The original understanding of a treaty obligation may lose its meaning, become absurd or manifestly inapplicable with the passage of time, leading to the necessity to abandon the strict application of this principle in a given case. After all, earlier rulings departing from or ignoring this putative principle had already existed by the time of Fitzmaurice's writing in 1957.Footnote 94
Second, whatever the status of the alleged principle was at that time, the following course of events undermined its claim to universal applicability. In spite of its endorsement by the International Law Commission's (ILC) Special Rapporteur on the law of treaties, Sir Humphrey Waldock, the principle was rejected by the ILC in 1964 and was not included in the final text of the VCLT.Footnote 95 Moreover, even the ICJ, from whose case law Fitzmaurice originally derived his principles of treaty interpretation,Footnote 96 did not subsequently apply the principle of contemporaneity without exception. In fact, in 1991, in one of a series of articles conceived as a continuation of Fitzmaurice's earlier work,Footnote 97 Hugh Thirlway concluded, again on the basis of examination of the ICJ jurisprudence, that the principle had been qualified in the following way:Footnote 98
Provided that, where it can be established that it was the intention of the parties that the meaning or scope of a term or expression used in the treaty should follow the development of the law, the treaty must be interpreted so as to give effect to that intention.
Returning to the subject of the present inquiry, how do we choose between Fitzmaurice's and Thirlway's understandings of contemporaneity? It is submitted that for three independent reasons, we ought to rely on this latter ‘qualified’ principle in interpreting the term ‘object’ in Article 52(2). The first reason relates to the nature of the Protocol and the term in question. As the ICJ held in the Navigation Rights case, if parties choose a generic term in a treaty entered into for a very long period, they should be presumed to have intended that such a term is to have an evolving meaning.Footnote 99 As we know, the Protocol is a treaty of indeterminate duration and the term in question is a generic one, supporting the use of evolutive interpretation.
Second, the object of the Protocol as a treaty providing for the protection of victims of armed conflictsFootnote 100 also supports resort to evolutive interpretation. The three most influential international human rights tribunals have established that human rights treaties are living instruments which must be interpreted in light of present day conditions.Footnote 101 It is submitted that when in doubt over whether to turn to the originalist or evolutive reading, the latter should be used with regard to multilateral treaties which are designed for the protection of individuals, a characteristic shared by the human rights treaties and the Protocol.Footnote 102
Third, terms of the Additional Protocol have been anything but immune to the evolutive approach so far. A number of other terms found in the Protocol have been interpreted in light of the circumstances prevalent at the time of their application. For instance, in the Nuclear Weapons advisory opinion, the ICJ emphasised the importance of the so-called Martens Clause enshrined in Article 1 of the ProtocolFootnote 103 as means of addressing what the Court called ‘the rapid evolution of military technology’.Footnote 104 It has been correctly observed that the merit of this passage in the opinion was to embrace a dynamic approach to IHL in general.Footnote 105
As a further example, in the Targeted Killing case, the Israeli Supreme Court was faced with the question of when a civilian is taking a direct part in hostilities and thus loses his or her protection from attack under Article 51(3) of the Protocol. The Court unequivocally embraced an evolutive interpretation of that provision, reasoning that if the reality changes, the interpretation of previously developed rules must also evolve.Footnote 106 Although this decision has been the subject of a considerable degree of criticism, the application of the evolutive method of interpretation to the terms of Additional Protocol I has not raised specific objections.Footnote 107
5.1.2. Modern Meaning
It is submitted that we should interpret the term ‘object’ in Article 52(2) in light of present day conditions. In this respect, we may be assisted by the other authentic language versions of the ProtocolFootnote 108 as well as by a closer examination of the modern reality relevant to the present subject.
First, there is a striking discrepancy dividing the six authentic language versions of Additional Protocol I into two groups. English, along with Arabic, Chinese, and Russian, are in the first group. These four languages use the generic word ‘object’ to express the term in question: ‘object’ in English, ‘بالأعيان ’ in Arabic,Footnote 109 ‘物体’ in ChineseFootnote 110 and ‘объект’ in Russian.Footnote 111 However, the second group of languages, made up of French and Spanish, use a different word. Here, the word used is ‘un bien’ in both FrenchFootnote 112 and SpanishFootnote 113 (plural ‘les biens’ and ‘los bienes’, respectively), which translates into English literally as ‘a good’ or ‘a property’.Footnote 114 We may put the first group aside as the words used are identical and do not shed further light on one another.
However, as far as the word ‘bien’ is used, in particular in francophone legal literature, it is immediately notable that it is not limited to objects which have a physical presence in the ‘real world’. On the contrary, the term ‘bien’ is specifically divided in several French-speaking jurisdictions into tangible and intangible (corporeal and incorporeal) sub-categories.Footnote 115 In a different context, the majority of experts insisted that ‘sensu stricto, data does not qualify as property’.Footnote 116 This view was not, however, supported by any citation and it was followed by an express rejection by the minority.Footnote 117
It is important to add that our aim here is not to transplant terms from domestic law into international law without paying due regard to their context. The fact that ‘un bien’ may also conceivably exist in an intangible form is mentioned solely in order to shed more light on the meaning of the word ‘object’ in the English version of the Protocol.Footnote 118
Second, I turn to the question of whether present day reality has evolved with an effect on the ordinary meaning of the term ‘object’. In order to do this properly, we must not examine the term in abstract but in the context of the Protocol as such.Footnote 119 I have already stated that the remainder of the sentence in which the term ‘objects’ finds itself rules out the abstract meaning of the word in the sense of a goal or a purpose.Footnote 120
The examined term appears in Section I of Part IV of the Protocol. Although the section is labelled ‘General Protection against Effects of Hostilities’, it also sets out the key rules on targeting during international armed conflicts.Footnote 121 The understanding of the term ‘object’ throughout this section generally means something that may become the target of attacks.Footnote 122 It must thus be something susceptible to ‘destruction, capture or neutralization’.Footnote 123
It is submitted that data fits this description. Even though the Tallinn Manual itself does not consider this issue further, the chairman of the group of experts has raised two different cogent objections in his writing in defence of the view found in the Manual. I will address them in turn. First, Professor Schmitt has argued that destruction of data without direct physical consequences is more akin to psychological operations, which fall outside of the scope of the rules on targeting in Additional Protocol I.Footnote 124 Second, he has claimed that if all data were treated as an object, states would have to forfeit their ability to conduct some operations with an effect on civilians. According to this argument, states would therefore not accept such a limitation.Footnote 125
As to the first point, is computer data analogous to abstract notions such as population morale or to ‘tangible’ things such as a bridge? While morale may be affected by attacks, it is a subjective category the existence or extent of which cannot be objectively determined. A bridge, on the other hand, either remains unscathed, is damaged, or is no more. Its existence and condition does not depend on subjective assessment or belief.
Computer data, as generally understood today, is more akin to the latter. According to the Oxford English Dictionary, in the realm of computing data means ‘the quantities, characters, or symbols on which operations are performed by a computer, being stored and transmitted in the form of electrical signals and recorded on magnetic, optical, or mechanical recording media’.Footnote 126 It is true that at a certain point it might be difficult to determine whether a particular dataset has been tampered with from the outside, as the attacker may conceal his or her traces. For example, although various organisations within Iran were targeted by the Stuxnet virus as early as June 2009, its existence was only discovered 13 months later.Footnote 127 However, this difficulty does not mean that the potential alteration or destruction of data in question is categorically indeterminable. Similarly, a bridge located in a place that is too remote for a belligerent to determine its current state, or even its existence, would not become a non-object for the purposes of Article 52(2) of the Protocol.
In a recent article, Noam Lubell also rejects the analogy between cyber and psychological operations, although he arrives at the same conclusion on the basis of a different line of argument, focusing on the notion of attack rather than object.Footnote 128 He emphasises that the nature of psychological operations is to convince and not to harm, whereas cyber operations will inevitably cause some form of harm, which may in some cases cross the threshold of attack.Footnote 129
The present analysis is in agreement with Lubell's conclusion. However, it bears emphasising that, unlike Lubell, I am not concerned here with the required intensity of harm, only with the eligibility of certain types of object to be harmed at all. Not all types of interference with data would amount to harm in this sense: for instance, misappropriation or misuse of data might not, whereas its deletion or alteration most probably would. Nevertheless, because data is susceptible to destruction and this destruction would be objectively verifiable – even if at times, admittedly, with some or significant evidentiary difficulty – the analogy with psychological operations must be rejected at this point.Footnote 130
The second objection relates to the supposed unwillingness on the part of states to accept the definition of data proposed here on the ground of it being overbroad. Professor Schmitt has argued that treating data as an object would mean that states would no longer be able to engage in cyber activities that have effects on the civilian population.Footnote 131 His earlier writing may provide some guidance as to the kind of activities he had in mind: ‘It would appear overbroad to characterize all data as “objects.” Surely a cyber operation that deletes an innocuous e-mail or temporarily disrupts a television broadcast does not amount to an unlawful attack on a civilian object’.Footnote 132 Although under a certain set of circumstances this might be the correct conclusion, it is submitted that the premise of the argument is flawed.
For greater clarity, let us consider instead the example of the ‘innocuous e-mail’, but in relation to an equally innocuous letter, one written on paper and sealed in an envelope rather than stored as computer data. As the (somewhat loaded) qualifying adjective ‘innocuous’ suggests, the letter's destruction per se would indeed probably not be lawful under IHL. This would, however, not be the consequence of the letter not being an object. Rather, its destruction would probably be unlawful as the letter would not be a military objective in that it fails to meet the criteria in Article 52(2) – namely the dual consideration of whether it makes an effective contribution to the military action of one conflict party and whether its destruction would offer a definite military advantage for the other.
It is, however, unlikely that states would, within the scope of an armed conflict,Footnote 133 engage in a military operation the sole aim of which would be to destroy one civilian letter (or one such email). Such an outcome would in virtually all conceivable situations be the consequence of a larger operation targeting, say, the post office building overtaken by the military forces of the enemy. In this case, if an attack on the post office-cum-military outpost occasioned the destruction of letters stored in the building, their destruction might nevertheless be lawful by the operation of the rule of proportionality. On this basis, an attack may be expected to cause incidental damage to civilian objects and yet be lawful as long as this damage is not excessive in relation to the concrete and direct military advantage anticipated.Footnote 134 The same considerations would apply to the electronic equivalent of the innocuous civilian letter. Admittedly, its destruction in isolation would most probably fail to meet the criteria of lawfulness under IHL. However, as long as it is an incidental effect of an otherwise lawful military operation compliant with the principle of proportionality, the fact that the email was deleted would not amount to an unlawful attack.Footnote 135
The extant architecture of IHL thus appears to be satisfactory and should not diverge from the expectations of states. Their capacity to engage in cyber operations occasioning the destruction of data, as long as those operations complied with the applicable rules of IHL, would remain unimpeded. Moreover, as stated above, psychological operations (whether ‘cyber’ or not in nature) would remain beyond the reach of IHL. In sum, it is hoped that this analysis serves to alleviate, to some extent, the concern that states would not be willing to accept the interpretation proposed here.
5.1.3. Normative Context
What remains to be assessed at this point is the correlation of the proposed interpretation with the normative framework of which the interpreted provision forms a part – in other words, the broader context surrounding the term ‘object’. Do the provisions of Section I of Part IV of the Protocol presume that an ‘attack’ against an object would have to entail the use of physical or kinetic force, rendering the proposed interpretation meaningless?Footnote 136 Professor Schmitt has persuasively shown that even though the definition of ‘attack’ in Article 49 of the Protocol is ‘instrumentality-based’, the rest of the section takes a ‘consequence-based’ approach when operationalising the term.Footnote 137 In other words, even though attacks were originally defined as ‘acts of violence’ in the Protocol, they can, ‘[t]hrough the process of induction’,Footnote 138 ‘be redefined as operations that result in, or if unsuccessful were originally expected to result in, death or injury of individuals or destruction or damage of objects’.Footnote 139 The use of physical force is not a sine qua non of an attack under the terms of the Protocol. Further, and here I part ways with Professor Schmitt's interpretation, cyber operations that aim to destroy data fit this consequence-based approach. Let us consider two examples to shed more light on this proposition.
First, an attack of this sort may target critical data of a military nature, such as weapons logs,Footnote 140 timetables for the deployment of military logisticsFootnote 141 or air traffic control information.Footnote 142 Their destruction would not entail the use of physical force and yet it would fit the dual considerations of Article 52(2). Such data makes an effective contribution to the military action of one party; in fact, its military action would be inextricably bound to and based on this particular dataset. Its destruction would, therefore, also offer a definite military advantage to the opposing party. In this example, data is a legitimate military objective; it is submitted that it would probably also be accepted as such by states.
Second, an attack might target essentially civilian data such as electronic health records held at a particular hospital. If this data were to be clandestinely erased or altered, the lives and health of patients in the hospital would be endangered.Footnote 143 This data does not, of course, meet the criteria of a military objective; its destruction would rather affect the integrity of a civilian object (the data itself) and the safety of the civilian population (the patients in the hospital). The Commentary by Bothe and his co-authors extrapolates these two considerations as attributes of ‘attacks’ bringing them within the scope of the Protocol.Footnote 144
Both of these examples share the fact that the direct consequence of the attacks considered would be solely the destruction of data. For the Tallinn Manual, such attacks would normally fall outside the scope of IHLFootnote 145 unless, in addition, they were to interfere with the functionality of the control system to an extent requiring the replacement of physical components.Footnote 146 However, in neither of the examples considered would such interference be necessary or even useful to achieve the aims of the attacker. Still, as we have seen, assessing such attacks would entail making determinations expressed in the Protocol's rules on targeting. It is therefore submitted that, taking present day conditions into consideration, the proposed interpretation of data as an object better fits the context of the interpreted provision.
5.2. Object and Purpose
Finally, we need to examine the possible interpretations of the term ‘object’ with regard to the object and purpose of Additional Protocol I. Not only is the recourse to teleological interpretation mandated by the VCLT, but its importance is further underlined by the fact that the Protocol is a multilateral treaty of humanitarian import. For treaties of this nature, examining the object and purpose is particularly important and may even prevail over the intentions of the parties.Footnote 147
Teleological interpretation is also an available method of interpretation with respect to customary norms.Footnote 148 It is submitted that the telos of a treaty rule of a norm-creating character carries over into customary international law in the event of its evolution into custom.Footnote 149 In addition, the analysis of the object and purpose of the Protocol carries an additional degree of relevance for those states that have signed but not ratified this instrument, a category which includes, but is not limited to, the United States.Footnote 150 According to the accepted rules of treaty-making, such states are bound to refrain from acts that would undermine the object and purpose of the treaty in question.Footnote 151
Although a treaty may have several objects and purposes,Footnote 152 it would hardly be doubted that one of the main ones if not the object and purpose of Additional Protocol I is to improve the protection of victims of armed conflicts over and above that provided by the four Geneva Conventions: the title of the Protocol states that it relates ‘to the Protection of Victims of International Armed Conflicts’.Footnote 153 Its Preamble refers to the goal of enhancing the protection as something the state parties considered necessary.Footnote 154 The ICRC Commentary states expressly that this was the object and purpose of the ProtocolFootnote 155 and the same position has been taken for granted by academiaFootnote 156 and international jurisprudence.Footnote 157
The rules in Part IV of Additional Protocol I focus specifically on civilians as a subcategory of victims of armed conflicts.Footnote 158 We may thus infer that the object and purpose of Article 52(2) and its normative context is the enhancement of the protection of civilians during situations of armed conflict.Footnote 159 Of the two potential interpretations, we must thus choose the one which better serves the identified object and purpose of the Protocol.Footnote 160
The interpretation propounded in the Tallinn Manual removes data from the scope of IHL unless its destruction entails the loss of functionality of physical infrastructure (computers and networks) carrying the data in question.Footnote 161 In addition, the experts only considered an interference with functionality to qualify as damage if restoration of functionality requires replacement of physical components.Footnote 162 What this means is that many targets whose physical equivalents are firmly protected by IHL from enemy combat action would be considered fair game as long as the effects of the attack remain confined to cyberspace. This is, unfortunately, not just a fanciful comment without any real support in the field. Cordula Droege sums up the literature which puts forward the view that the availability of cyber operations expands the list of legitimate targets as even attacks on objects which are prohibited in the physical world might now be considered legal.Footnote 163
For illustration, let us consider the real-world example of the attack on the official Twitter account of Associated Press in April 2013. A group of Syrian hackers known as the Syrian Electronic Army published a fake tweet announcing explosions in the White House and injury to the US President. The effects were immediate and momentous: the Dow Jones Industrial Average index of the New York Stock Exchange dropped with the effect of erasing $136 billion of equity market value.Footnote 164 It should be highlighted that all of this occurred without any effect on physical objects, whether the servers of Twitter or the stock exchange, or the internet infrastructure carrying the data in question. Although the consequences of this particular attack were short-lived, it highlights the extent of damage that can be caused by means of cyber operations. Any such large-scale damage to civilian property in the physical world would certainly not escape the regulatory reach of IHL. Many other hypothetical examples of this kind abound.Footnote 165
The interpretation of data as non-object would thus greatly expand the class of permissible targets in warfare. It is submitted that this expansion would go against the object and purpose of Additional Protocol I as it would expose the civilian population to additional danger instead of providing it with protection. The general principle of IHL that the right of belligerents to adopt means of injuring the enemy is not unlimitedFootnote 166 further supports a restrictive interpretation of the notion of military objectives.Footnote 167 Because anythingFootnote 168 that is not an object cannot qualify as a military objective, we should therefore interpret the term ‘object’ broadly in order to achieve the aim underlying the rules on targeting. Accordingly, data should, also on the analysis of the object and purpose of the Protocol, be considered an ‘object’ in this context.Footnote 169
This interpretation has the additional benefit of providing clarity as to the identification of permissible military targets in cyber warfare. For example, bringing down a website used solely for military purposes would clearly qualify as an attack on a military objective under IHL. The Tallinn Manual recognises that such a cyberspace-confined object, using the example of ‘a website passing coded messages to resistance forces behind enemy lines’, would be making an effective contribution to military action.Footnote 170 However, because of its approach, it is forced to maintain a strained reasoning that the military objective in this case would not be the website itself, but ‘the cyber infrastructure supporting the website’.Footnote 171 This is entirely counter-intuitive and without correspondence in reality, where any attempt to bring the website down would be likely to take the form of a denial-of-service attack and would certainly not have any consequences in physical space, and even less would it demand the replacement of physical components.Footnote 172
6. Conclusion
To interpret the law without due regard to the changes in reality is to risk its reduction into irrelevance. The Tallinn Manual is therefore a very valuable contribution to the interpretation of international law with regard to the novel challenges posed by cyber warfare. Nevertheless, it is the contention of this article that in one narrow aspect the Manual has not succeeded in this aim.
This article has put forward the view that, in spite of the dearth of state practice on the matter, the concept of military objectives in IHL should properly be construed to include computer data. It has been argued that data is an ‘object’ for the purposes of the IHL rules on targeting. The interpretation proposed by this article is openly evolutive in character. This is, however, the rule rather than an exception in this area.
After all, the 1982 Commentary by Bothe and his co-authors had already observed with a degree of foresight that ‘in the dynamic circumstances of armed conflict, objects which may have been military objectives yesterday may no longer be such today and vice versa’.Footnote 173 This prediction has been confirmed repeatedly since the Commentary was published – for example, although back in 1982 drones belonged to the realm of science-fiction,Footnote 174 today they are considered to be standard military objectives.Footnote 175
The rapid development of information technology in the decades following the adoption of Additional Protocol I has entailed an unprecedented challenge for IHL. Both civilian life and military operations depend to a growing degree on information and activities confined to cyberspace, with little to no ramifications in the physical world. If the law of armed conflict is to retain its relevance, it ought to reflect this change. That is why, it is submitted, in 2015 computer data are objects under international humanitarian law.
