Rule 20 – Applicability of the law of armed conflict

Cyber operations executed in the context of an armed conflict are subject to the law of armed conflict.

1. The law of armed conflict applies to cyber operations as it would to any other operations undertaken in the context of an armed conflict. Despite the novelty of cyber operations and the absence of specific rules within the law of armed conflict explicitly dealing with them, the International Group of Experts was unanimous in finding that the law of armed conflict applies to such activities in both international and non-international armed conflicts (Rules 22 and 23).

2. A condition precedent to the application of the law of armed conflict is the existence of an armed conflict. The term ‘armed conflict’ was first used in a law of war codification in the 1949 Geneva Conventions, but has never been authoritatively defined as a matter of treaty law. It has today replaced the term ‘war’ for law of armed conflict purposes. As used in this Manual, armed conflict refers to a situation involving hostilities, including those conducted using cyber means. The term takes on a different meaning for the purposes of characterizing international and non-international armed conflict. Rules 22 and 23 discuss the extent of hostilities required to reach those thresholds.

3. To illustrate, in 2007 Estonia was the target of persistent cyber operations. However, the law of armed conflict did not apply to those cyber operations because the situation did not rise to the level of an armed conflict. By contrast, the law of armed conflict governed the cyber operations that occurred during the international armed conflict between Georgia and Russia in 2008 because they were undertaken in furtherance of that conflict.