Regulating non-kinetic effects of cyber operations: the ‘Loss of Functionality’ approach and the military necessity-humanity balance under International Humanitarian Law

Abstract In pursuing the objective of protecting the civilian population during armed conflict, the normative framework of International Humanitarian Law (IHL) is premised on the relationship between the foundational principles of military necessity and humanity. This balance is embodied in the ‘rules on targeting’ under Additional Protocol I, whereby ‘attacks’ are limited by the principles of distinction, proportionality, and precaution. However, as modern conflict evolves, the rise of cyber technologies as a means of warfare challenges the traditional understanding of the notion of ‘attack’ as synonymous with kinetic violence, whether in the form of death or injury to individuals or damage or destruction of objects. Two competing approaches to what amounts to an ‘attack’ in the cyber domain have emerged. The prevailing one, adopted by the Tallinn Manual, qualifies as an attack any cyber operation that is expected to result in death, injury to individuals, damage or destruction of objects, or a combination thereof. Conversely, the ‘Loss of Functionality’ (LoF) approach advanced by the International Committee of the Red Cross (ICRC) extends the definition of an attack to cyber operations causing LoF to the targeted network or systems. This article argues that the prevailing interpretation of IHL in the cyber domain favours military necessity considerations over the principle of humanity, allowing belligerents to engage in non-kinetic, disruptive cyber-attacks against civilian infrastructure without being limited by the rules of targeting, to the detriment of the civilian population and civilian objects. Nevertheless, the balance between the two principles can be tipped in favour of humanitarian considerations by relying on the more expansive LoF approach. And yet, while the LoF approach has been endorsed by a growing number of States, its practical application to the rules of targeting remains, at the time of writing, underexplored. In light of this consideration, this article aims to clarify the application of the LoF approach to the principle of distinction and, more importantly, the principle of proportionality, arguing that non-kinetic effects should be included within the meaning of ‘incidental harm’ that is relevant to the proportionality assessment; otherwise, the effectiveness of the LoF approach would be greatly reduced.