I Spy: Espionage, Perfidy, and Fighting in the Shadows
In a 2024 Articles of War post, I identified that intelligence gathering, including espionage, is authorized by both treaty and customary international law during armed conflict. For international armed conflicts, the treaty basis is found in Article 24 of the 1907 Hague Land Warfare Regulations, which states “[r]uses of war and the employment of measures necessary for obtaining information about the enemy and the country are considered permissible” (emphasis added). The Hague Regulations are considered to reflect customary international law, as established by the 1946 Nuremburg International Military Tribunal and the International Court of Justice (ICJ) (here, here, and here).
The authority to conduct intelligence gathering extends to non-international armed conflict. Initially, the legal framework applied for such conflicts may be based in domestic human rights law. In other words, the peacetime status quo continues when there are relatively low levels of violence and the territorial State has a functioning and effective government. However, increasing levels of violence often lead to State security forces carrying out security related intelligence gathering pursuant to international humanitarian law (IHL) (the lex specialis). There may also be a hybrid situation where some intelligence gathering is carried out under the domestic legal regime as an ordinary aspect of governance, while other operations rely on the armed conflict based legal authority.
Espionage, which involves the clandestine collection of information, invariably relies on an element of deceit. In both types of conflict, espionage or spying (terms that are used interchangeably) carried out to further military operations raises the issue of when such clandestine activity is so treacherous it breaches international law. This post explores the issue by looking at the lawfulness of espionage, the role it performs in the conduct of warfare, and what constitutes the war crime of perfidy. The post also considers the effect that factors such as remoteness and proximate cause have in establishing that crime, the relationship of spies to unprivileged belligerency and direct participation in hostilities, and finally the impact of spying being associated with ruses as a lawful means of conducting operations.
Espionage and Its Role in the Conduct of Warfare
The Hague Land Warfare Regulations define spying in Article 29 as clandestinely or on false pretences obtaining or endeavouring “to obtain information in the zone of operations of a belligerent, with the intention of communicating it to the hostile party.” Military manuals from the early 20th century onward have recognized that espionage is included as part of the “obtaining of information” permitted by Article 24 of the Hague Land Warfare Regulations.
Such espionage is ordinarily carried out by someone disguised as an innocent civilian or by wearing an enemy uniform. Spies can be civilians or military personnel. The United States’ 1914 manual Rules of Land Warfare stated that Article 24 “is distinct recognition of the necessity for employing spies and other secret agents for obtaining information about the enemy, so that the acquirement of such information by secret methods is regulated by the law and usages of war” (para. 200). Similarly, the 1914 United Kingdom Manual of Military Law noted “[i]t is lawful to employ spies and secret agents, and even to gain over by bribery or other means enemy soldiers or private enemy subjects” (para. 155). Just prior to U.S. entry into the Second World War, the 1940 U.S. Rules of Land Warfare reiterated it was lawful to employ spies (para. 203). The Second World War witnessed a virtual explosion of intelligence agencies engaged in supporting and facilitating military and paramilitary action (e.g. the British Special Operations Executive, U.S. Office of Strategic Services, and Soviet People’s Commissariat for Internal Affairs (NKVD)).
Espionage and Intelligence-Gathering
The post-Second World War period saw continuing confirmation of the lawfulness of espionage under international law. The 1950 Nuremburg tribunal Hostage Case ruled “[b]y the law of war it is lawful to use spies” (p. 1245), while a 1949 Dutch Court of Cassation decision, In re Flesche, determined that espionage “is a recognized means of warfare and therefore is neither an international delinquency of the part of the State employing the spy nor a war crime proper on the part of the individual concerned” (see Shane Darcy, To Serve the Enemy: Informers, Collaborators, and the Laws of Armed Conflict, p. 107).
The 1956 U.S. Law of War Manual recognized the lawfulness of employing spies, as has the 2004 British Joint Service Manual of the Law of Armed Conflict, the 2006 Australian Law of Armed Conflict manual, the 2016 Danish Military Manual on International Law, the 2019 U.S. Commander’s Handbook on the Law of Land Warfare, and the 2023 version of the U.S. Department of Defense Law of War Manual. Experts who prepared the 2010 Air and Missile Warfare Manual Commentary referred to an authority to conduct espionage in the context of Article 24 of the Hague Land Warfare Regulations. The International Committee of the Red Cross (ICRC) similarly refers to Article 24 in its 1987 Additional Protocols Commentary (para. 1765).
Meanwhile, Article 46 of 1977 Additional Protocol I recognizes spying. That provision, like Article 29 of the 1907 Hague Land Warfare Regulations, focuses on the status of spies if captured. These provisions highlight the special treatment provided to spies under IHL, where those engaged in such activity are not subject to prosecution should they successfully return to their lines. The 2013 Tallinn Manual on the International Law Applicable to Cyber Warfare (rule 66(b)) and the 2017 Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations (p. 409-12) reflect a similar focus on the status of spies. Neither of these two manuals deals with the impact of authority to conduct espionage under Article 24 of the Hague Land Warfare Regulations. This is consistent with the lack of attention paid historically to analyzing the operational effect of a legal authority to carry out espionage during armed conflict.
Assessing the role espionage plays during conflict raises important and challenging legal issues, particularly given its crucial role in the conduct of operations and especially in targeting. Applying the foundational principle of distinction depends upon being able to separate lawful military objectives, both people and objects, from those that cannot be targeted. To do so, their status as lawful targets must be determined as part of the targeting precautions set out in treaty and customary international law.
That in turn requires information. While targeting can rely on a wide range of intelligence sources (signals, open source, imagery), human intelligence (HUMINT) such as espionage often performs a key role. HUMINT can be derived from a variety of sources including specialized military, paramilitary, and police units operating undercover (e.g. the UK Special Reconnaissance Regiment and Israel’s Sayeret Matkal, Duvdevan, and Ya’mas units), and agents recruited by civilian intelligence agencies (e.g. the U.S. Central Intelligence Agency, Russia’s Federal Security Service (FSB), Israel’s Mossad and Shin Bet) or by military intelligence (e.g. the U.S. Defense Intelligence Agency, Russia’s Main Directorate of the General Staff of the Armed Forces, Israel’s Unit 504).
Modern Examples of State Espionage
Contemporary armed conflict is replete with examples of States relying on espionage to conduct hostilities. In the post-2022 Ukraine/Russia conflict, both sides rely on recruited agents to identify targets, confirm those targets have been hit, and carry out a form of bomb damage assessment. In this regard it is reported that the Security Service of Ukraine (SBU) recently arrested a prominent Dnipro lawyer acting on behalf of the Russian FSB who “provided Russia with coordinates for a local enterprise, workshops, and drone warehouses to help ‘inflict maximum damage.’ He then passed information on the consequences of the attack and provided coordinates for another strategic facility in Dnipro, according to the SBU.”
Meanwhile, Ukraine has developed and controlled resistance organizations in occupied Ukraine that perform the same function for its attacks. One partisan group called Atesh (“fire” in Crimean Tatar) carries out sabotage and intelligence gathering in occupied Ukraine and inside Russia. Reporting indicates that “Atesh’s intelligence has played a crucial role in significant Ukrainian operations against the Russian fleet in Crimea … . These include successful strikes on the landing ship Minsk and the submarine Rostov-on-Don, as well as an attack on the headquarters of the Black Sea Fleet.” Ukraine’s use of spies in Russia was demonstrated in the December 2024 killing of Lieutenant General Igor Kirillov in Moscow. It is reported that the Ukrainian SBU recruited an Uzbek civilian who planted a bomb laden scooter outside a residential building. A camera placed in a car rented by the agent videoed the general’s exit from the building, allowing the Ukrainian security service personnel to remotely detonate the explosives, killing Kirillov and another Russian officer.
This is not the only conflict where undercover military or civilian spies have been used to facilitate targeting. In the January 2020 drone strike that killed Iranian Major General Qassem Soleimani and Iraqi Shia militia leader Abu Mahdi al-Muhandis outside the Baghdad airport, it is reported that amongst the personnel providing intelligence in the U.S. operation were Kurdish Counterterrorism Group operatives. They posed as baggage handlers at the airport in order to positively identify Soleimani. Accepting that IHL governed the conduct of the operation, either as part of an ongoing armed conflict between the United States and Iran or in one created by the exercise of State self-defence, it is the rules governing espionage during hostilities that applied regarding such undercover work.
Previously, in 2007, agents of the Israeli Sayeret Matkal dressed in Syrian military uniforms driving their military pattern vehicles carried out a reconnaissance of a Syrian nuclear facility to collect intelligence prior to a strike by the Israeli air force that destroyed the objective (Yaakov Katz, Shadow Strike, p. 159-60). For the 2024 Israeli hostage rescue operation in Nuseirat Gaza, it has been suggested as likely that “undercover operatives [the mistra’avrim (Israeli units that integrate into Arab populations)] were in the neighborhood for weeks before the rescue and present when it began to deal with Hamas’s guards.”
The intelligence gathering in these scenarios shares a common feature: the disguising of military or security force personnel in civilian clothes or enemy military uniforms, or the use of civilians acting in a manner inconsistent with that protected status. They are then involved in identifying targets and passing intelligence for attacks to be carried out. This raises questions about the point at which, or even whether, such clandestine intelligence gathering in support of an attack might be considered perfidious and therefore a war crime.
Perfidy, Remoteness, and Proximate Cause
Perfidy
Espionage involving the clandestine collection of information while dressed in civilian clothes or an enemy uniform raises the issue of perfidy. In terms of targeting, the relationship between espionage and the treacherous or perfidious killing or wounding of an adversary is addressed in the 2010 Air Warfare Manual Commentary and the 2017 Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations. The Commentary states,
[Unmanned aerial vehicles (UAV)] used by the military, but feigning civilian status, although used mainly for intelligence gathering purposes, will be deemed to be acting perfidiously if they are used in close conjunction with military units in order to identify at target, designate it, monitor the engagement, or assess the results in order to determine whether a re-attack is necessary. In all such cases, the UAV can be regarded as part of the attacking force (rule 114(b), para. 8).
Similarly, the 2017 Tallinn Manual 2.0 indicates that if the primary purpose of espionage fulfilling the perfidy criteria (e.g. feigning civilian status) results in the death or injury of an adversary, then there is a violation of the rule against perfidy (rule 122, para. 11).
These interpretations effectively criminalize the use of espionage to facilitate targeting. Such broad statements linking espionage to targeting and perfidy are clearly inconsistent with significant State practice. This author participated in the development of both the 2010 Air Warfare Manual and an earlier 2013 Tallinn Manual on the International Law Applicable to Cyberwarfare. Upon further analysis, it is my view that this issue needs to be reassessed.
Such a reassessment requires careful consideration of perfidy itself. What is perfidy, and what is the impact of there being an IHL authority to conduct a deceitful activity such as espionage during armed conflict? There is a terminological challenge in analyzing this area of the law. The terms treachery and perfidy are largely used interchangeably. Treachery in ordinary usage means “[d]eceit, cheating, perfidy; violation of faith or betrayal of trust.” It can cover a wide range of activities including espionage and treason.
However, as Sean Watts points out in a 2014 article, not all perfidy is treated the same under IHL. He noted “it seems the best understanding of the codified, law-of-war perfidy prohibition of [Additional Protocol I] appreciates three varieties of perfidy: simple perfidy [acts inviting a betrayal of confidence]; prohibited perfidy [killing, wounding, or capture]; and grave perfidy [emblems of the Red Cross, etc.]” (p. 154). Indeed, not all perfidious conduct during war is prohibited. It is not a war crime to perfidiously cause damage (e.g. sabotage) if no human deaths or injuries are intended. And although Professor Geoffrey Corn argued there should be a prohibition against attempted perfidy it is difficult to conclude that attempts are presently viewed as being contrary to international law. This in turn has led to a common practice to refer to “prohibited perfidy” as the type of action associated with a war crime. Distinguishing perfidy from prohibited perfidy is an acknowledgement that other deceptive and treacherous activity can occur without sanction.
Even the criminalization of perfidious acts can create a degree of confusion. The 1907 Hague Land Warfare Regulations described such activity as “treacherously” killing an individual belonging to the hostile nation or army in Article 23(b). Article Art. 8(2)(b)(xi) of the International Criminal Court’s Rome Statute similarly addresses the “treacherous” killing of individuals belonging to a hostile nation or army during international armed conflict, while Article 8(2)(e)(ix) prohibits the such killing of a combatant during non-international conflicts. However, such conduct is described as “perfidy” in Article 39(1) of Additional Protocol I.
Further, the prohibited activity is extended to include the capture of an opponent. While 90 percent of the world’s States are bound by this extension, the minority (that are not party to Additional Protocol I), like the United States, are not. As a matter of law, the capture extension applies to the Russia/Ukraine war. Treacherous acts have long been included in, but not overtly described as such, within other prohibitions in the codified law. This includes poisoning an opponent, denial of quarter, abusing a flag of truce, and misusing uniforms and insignia. As noted above, the misuse of enemy uniforms and the feigning of civilian status covered by Article 37(1)(c) of Additional Protocol I are most often connected to espionage.
It is widely accepted that the elements of perfidy concerning treacherous wounding and killing are as set out in the Tallinn Manual 2.0,
(1) An act inviting particular confidence of the adversary; (2) an intent to betray that confidence; (3) a specific protection provided for in international law; and (4) death or injury of an adversary (rule 122, para. 3).
However, there have long been other factors to consider. One is that perfidy is largely rooted in the 19th century focus on the visual indicators of what fighters are wearing or carrying (e.g. carrying arms openly). Further, there is a personal aspect to the concept. The Tallinn Manual 2.0 indicates that the notion of adversary is broad enough that the person deceived does not have to be the person killed or injured (para. 4). In contrast, as Bill Boothby notes in a recent book, the elements for Article 8(2)(b)(xi) of the Rome Statute suggest “the crime would seem only to be committed if the persons to whom the treacherous invitation was issued are also the persons who are killed or injured” (AI Warfare and the Law, p. 359). This interpretation is a significant narrowing of the offence, which facilitates the use of disguises to infiltrate enemy territory.
Remoteness and Proximate Cause
Since the adoption of Additional Protocol I, there has been an acknowledgement that finding prohibited perfidy has taken place also depends on factors such as remoteness and proximate cause. In this respect, Sean Watts notes influential commentators have indicated that a perfidious act “must be the proximate cause of the killing, injury or capture. A remote causal connection will not suffice” (p. 146). Further, Watts states “the physical consequences to a person must result immediately from the forbearance secured by feigned protected status.” The 2017 Tallinn Manual 2.0 also indicates that “[i]n order to breach the prohibition against perfidy, the perfidious act must be the proximate cause of the death or injury” (rule 122, para. 5, emphasis added).
So, what do remoteness or proximate cause mean? “Remote” has been defined in terms of “far away in distance” and “far away in time”, as well as being “[f]ar, distant; removed, set apart.” The Oxford English Dictionary defines proximate cause as “[c]oming immediately before or after in a chain of causation, agency, reasoning or other relation; immediate, short term,” while the Cambridge Dictionary states it is “something that is considered to be the direct cause of damage, loss, or injury.” Further, proximate is defined as “closest in time, place, relationship, etc. to something,” and introduces elements of time and space.
Meanwhile, a legal dictionary definition focuses on the causal relationship by indicating that proximate cause is “[a]lso known as direct cause. The result of an [sic] direct action and cause of loss to property that sets in motion a chain of events that is unbroken and causes damage, injury.” However, another legal dictionary states “direct and proximate cause” means “the immediate reason damage was caused by an act or omission (negligence); the negligence must have caused the damages, without intervention of another party, and cannot be remote in time or place.”
Overall, the meanings of the terms remote and proximate cause suggest that, in considering whether prohibited perfidy has occurred, there must not only be a direct causal connection, but that other factors such as time and distance must be considered as well. Notably, the Tallinn Manual 2.0 appears to reject time as a factor to be considered when assessing perfidy in the cyber realm. It states that “[p]roximate cause should not be confused with temporal proximity” and suggests the rule against perfidy is “violated even though substantial time has passed since the initiating perfidious act” (rule 122, para. 6).
This is an issue that should be re-assessed. Given the definition of these terms and the degree to which they have been integrally tied to prohibited perfidy, it is difficult to see how malicious software, even planted while feigning civilian status, should be considered perfidious if any injury or death results even hours, and certainly days, weeks, months, or years later.
Perfidy, Unprivileged Belligerency, and Direct Participation in Hostilities
Another factor to be considered concerning the scope of perfidy as a war crime is the connection between spying and unprivileged belligerency. Unlike spying, the involvement of belligerents in hostilities who did not qualify for combatant or prisoner of war status was viewed as a war crime prior to the Second World War. A change occurred in the aftermath of that conflict, largely brought on by the considerable reliance Allied Powers placed on resistance movements operating in Axis Power occupied territory and in the development and use of specialized intelligence and military units to support these resistance movements or otherwise operate behind enemy lines. This led to incremental changes to the 1949 Third Geneva Convention on Prisoners of War recognizing that it was possible, if improbable given the strict criteria introduced, that members of organized resistance movements could be considered lawful belligerents (Article 4A(2)).
Importantly, in a seminal 1951 article, the American academic and former ICJ judge Richard Baxter outlined the concept of “unprivileged belligerent.” Equated to spies, persons engaged in hostilities without meeting the status requirements for a lawful belligerent were not to be viewed as war criminals under IHL. However, they could be prosecuted under the domestic law of the detaining State, or with security offences applicable in occupied territory under the Fourth Geneva Convention (e.g. art. 68). These are legal authorities associated with governance. The use of the term “unprivileged belligerent” has gained widespread acceptance as can be seen in UK (here) and U.S. (here) law of armed conflict manuals.
Recognition that belligerents could lawfully fight out of uniform was further reinforced in Article 44(3) of Additional Protocol I. In circumstances such as occupied territory, that provision allowed for more relaxed criteria for combatancy, such as simply carrying arms openly during military engagements and while deploying prior to an attack. While this provision has met with resistance by some States, such as the United States, it more accurately reflects the full scope of warfare where spies, guerrillas, and specialized military forces operate in the shadows.
As Hays Parks noted in his treatment of “non-standard” uniforms worn by special forces, “[t]he drafters of Article 44 had a better sense of state practice than did critics of US and Coalition Special Forces wear of non-standard uniforms” (p. 523). As a result, conduct that constitutes prohibited perfidy is considerably narrower in scope than that applicable to qualifying as an unprivileged belligerent. It is here that factors such as intent, remoteness, and proximate cause perform an important role.
The clandestine provision of intelligence for targeting purposes makes spies not only unprivileged belligerents, but also direct participants in hostilities. The ICRC’s Direct Participation in Hostilities Study has been rightly critiqued (here, here, here, and here) for attempting to introduce overly restrictive interpretive concepts (e.g. continuous combat function, “revolving door” of protection) to targeting. However, it did properly identify that “an unarmed civilian sitting in a restaurant using a radio or mobile phone to transmit tactical targeting intelligence to an attacking air force would probably have to be regarded as directly participating in hostilities” (p. 81). While taking a direct part in hostilities makes the spy a lawful target, it does not necessarily mean the spy is acting perfidiously in the sense of committing a war crime.
Spying as a Ruse or Perfidy?
Article 39(3) of Additional Protocol I reinforces that the use of enemy emblems, insignia, or uniforms does not “affect the generally recognized rules of international law applicable to espionage.” Neither does operating in civilian clothes. As an ICRC Commentary to the Additional Protocols states, “Certainly, it would be nonsensical to make the sending of a spy wearing the enemy’s uniform unlawful, while the sending of a spy dressed in civilian clothes remained lawful” (para. 1583).
This has been established by the aforementioned examples in the Russia-Ukraine conflict, and the use of spies in the collection of intelligence for the purposes of conducting an attack by the United States and Israel. Although the Additional Protocols Commentary suggests the wording of Article 24 of the Hague Land Warfare Regulations “confuses ruses of war and gathering of information in a single provision,” the combining of ruses and intelligence gathering within the same sentence is particularly telling (para. 1513).
As Richard Baxter stated, “the sanctioning by Article 24 of the ‘employment of measures necessary for obtaining information about the enemy’ is strongly indicative that espionage falls into the same category of legitimate ruses of war” (p. 23-24). Baxter also indicated that “[a]s long as espionage is regarded as a conventional weapon of war, being neither treacherous or productive of unnecessary suffering, the sanctions visited on spies are only penalties to deter the use of that ruse.”
Conclusion
On one level, all acts of espionage are treacherous in the broadest sense because they rely on deceit. However, as a “conventional” means of conducting warfare, such activity is likely to contribute to the death or injury of the enemy. Perhaps the best way of exploring how espionage and actionable perfidy should be addressed is to return to the killing of General Krillov. In this example, the Uzbek agent was acting as both a saboteur and spy. The decision to initiate the explosion was directly reliant on information passed through a camera set up by the agent. It is not known if the agent remained at the site of the attack with the camera, or whether the incident resembles the reported 2021 remote machine gun killing by Mossad of a Iranian nuclear scientist, Mohsen Fakhrizadeh, by relying on images provided by a camera was left mounted in the vicinity of the attack. In the Fakhrizadeh killing, cameras were apparently installed on the truck holding the weapon and on another vehicle. The images were used to confirm the intended target was driving his car.
In the Kirillov killing, the Uzbek agent may have had the intention of killing the target when he planted the explosive laden scooter. There was also a direct causal connection between the planting of the bomb and the deaths of the Russian officers. However, there was no personal interchange that invited the confidence of Lieutenant-General Kirillov at the time of the attack. Further, it is not clear what length of time passed between the planting of the explosives and their initiation. This issue is one common to many situations where intelligence is gathered in support of targeting. Espionage identifying the military objective as lawful may occur significantly before an attack. Similarly, information confirming the effects of an attack may be passed on long after the strike.
The longer the time that is passed, the less likely that perfidy will be considered to have happened due to a lack of proximate cause. In passing intelligence to the remotely situated Ukrainian operatives, the spy was only one part of a more complex effort to target and kill lawful Russian targets. This introduces yet another remoteness factor. Further, if it is suggested the act of espionage is perfidious, the issue to be resolved is whether that makes the whole targeting process tainted as result. An important question to ask is, if the killing itself was not perfidious, then how could the passage of information as part of the targeting process make the actions of the agent a war crime, as the Air Warfare Manual Commentary and the Tallinn Manual 2.0. appear to suggest?
Finally, the agent was, in the words of Richard Baxter, being used as one part of a “conventional weapon of war.” The analysis would be different had he relied on his disguise as an uninvolved civilian and killed someone to gain access to intelligence. At the same time, if he was discovered in disguise and reacted to the threat by opening fire, it is not immediately clear that would constitute perfidy. In that instance he would not have embarked on the espionage associated mission with the intent to kill the person attacking him. However, being a spy, he would still be subject to domestic prosecution in that capacity and perhaps be acting as an unprivileged belligerent.
The result is that conducting espionage to facilitate targeting should not be readily associated with prohibited perfidy. The extensive State practice alone suggests that should not be done. This too is an area of law that merits further analysis.
***
Ken Watkin served for 33 years in the Canadian Forces, including four years (2006-2010) as the Judge Advocate General.
Photo credit: Ssu.gov.ua
