Classification of Cyber Capabilities and Operations as Weapons, Means, or Methods of Warfare

Abstract

Despite several persistent controversies regarding how international law applies to cyber operations during an armed conflict, general understanding of the law in this domain is maturing. Reasoning by analogy to non-cyber application and interpretation of international law underlies much of the progress. Yet, although preexisting normative structures and legal terminology enable legal advisors and scholars to usefully draw upon previously acquired experience and understanding, there are obstacles to definitive analogizing that result from fundamental differences between cyber and kinetic operations. The number of imperfect analogies that underlie some of the normative uncertainty in the field underscores this point.

One key difference between kinetic and cyber operations is that most of the latter result in no injury to persons or physical damage to objects. Moreover, even when those consequences manifest because of a cyber operation, the harm caused was not the direct product of the cyber capability that was employed. Rather, it is the follow-on result of data communications between two systems. These and other technical realities of cyber operations must be considered carefully when conducting legal reasoning by analogy.

Building on such differences, this article examines three terms drawn from classic international humanitarian law (IHL) – weapons, means, and methods of warfare – in the context of cyber operations. The article begins by identifying those IHL and neutrality rules that the use of the terms implicates, namely the weapon review obligation, the requirement to choose among available means and methods of attack to minimize civilian harm, and the prohibition on transportation of weapons across neutral territory. It then assesses the prevailing understandings of weapons, means, and methods of warfare in an effort to tease loose the sine qua non characteristics that define the terms. This analysis leads to the conclusion that cyber capabilities cannot logically be categorized as weapons or means of cyber warfare. However, they may qualify as a method of warfare in certain contexts. Finally, the findings are applied to the attendant legal requirements and prohibitions in order to evaluate their effect of those rules.