Civilian hackers in war: The limits that international humanitarian law imposes on volunteer IT armies, hacktivists, and other civilian hackers

Abstract “Hacktivists”, “patriotic hackers” and “civilian hackers” are today conducting cyber operations in several armed conflicts. While some of these groups work closely with State armed forces to support their operations and harm the enemy militarily, reports suggest that too often, civilian hackers have targeted – and damaged or disrupted – various parts of civilian infrastructures, such as banks, companies, pharmacies, hospitals, railway networks and civilian government services. The growing involvement of civilian hackers in digitalizing armed conflicts raises a number of legal questions. First, we must ask what limits international humanitarian law (IHL) imposes on civilian hackers. Second, it must be assessed what “status” these hackers and hacker groups have under IHL, and in what circumstances civilian hackers risk directly participating in hostilities and therefore losing their protection against attack. Third, the question arises of when a State is legally responsible for the conduct of civilian hackers operating under its instruction, direction or control, and what responsibilities States have to ensure respect for IHL by civilian hackers operating from their territory.