The efforts of the International Committee of the Red Cross to establish rules of engagement to combatants in a cyberwar should be applauded internationally, even if adherence is likely to be limited.
The ICRC recently released a set of rules for civilian hackers involved in conflicts to follow in order to clarify the line between civilians and combatants, as cyberspace can be a blurry place to work in - especially during a war.
The ongoing conflict between Russia and Ukraine in particular has caused unprecedented numbers of civilian hackers to place themselves in the middle of the war, using their skills to fuel attacks on banks, manufacturing facilities, hospitals, and railways, in an attempt to sway the war to one side or another.
Do not direct cyberattacks against civilian objects.
Do not use malware or other tools or techniques that spread automatically and damage military objectives and civilian objects indiscriminately.
When planning a cyberattack against a military objective, do everything feasible to avoid or minimize the effects your operation may have on civilians.
Do not conduct any cyber operation against medical and humanitarian facilities.
Do not make threats of violence to spread terror among the civilian population.
These rules come at a time when it's never been easier for groups, or even individuals, to get involved in attacks and do their part for their cause.
The easier it is for anybody with a grudge to launch a cyberattack, the less restrictive these rules will be and the less they will be followed.
Many of the stateless groups involved in the Russia-Ukraine conflict aren't bound by current national or international laws.
Several groups, such as the pro-Russian Killnet group, already have reported they will not follow the ICRS's rules.
Even though these rules likely will not be accepted by the hacking groups currently operating within the Russia-Ukraine conflict, the ICRC should be commended for coming up with and publishing these rules.
Establishing norms is crucial for holding such groups accountable for potential war crimes, civilian death and destruction, and other harmful ancillary effects.
The rules are supposed to fall in line with international humanitarian law, a set of rules that seek to limit the effects of armed conflict and, when broken, constitute war crimes.
The IHL rules for armed conflict are critical in protecting citizens in military zones during wartime, but the often anonymous and detached nature of cyberspace means it will be much, much harder to police these new cyber-focused IHL rules.
Rule No. 3, for example, is absolutely critical to mitigating the damage to civilians during a conflict.
Civilian hackers working on behalf of a military goal may be totally unaware of the unintended destruction they would cause with their attacks.
NotPetya - a targeted attack against Ukrainian infrastructure - went into the wild in 2017, paralyzing factories across the globe and costing shipping company Maersk $300 million.
If even some level of deterrence can be achieved by these rules, it will serve to avoid unnecessary damage and harm in future conflicts.
This Cyber News was published on www.darkreading.com. Publication date: Mon, 04 Dec 2023 14:35:04 +0000