Mind the Gap: The Distance Between WHO Data and International Legal Standards

International lawyers, UN bodies, and human rights organizations increasingly cite one source when they discuss violence against health care in armed conflict: the World Health Organization’s Surveillance System on Attacks on Health Care (SSA). Since its launch in 2017, the SSA has become the default empirical basis for claims about the scale and pattern of harm caused to hospitals, clinics, medical transport, and health personnel in dozens of conflicts. The UN Office of the Special Representative for the Secretary-General for Children and Armed Conflict draws on it. Special rapporteurs cite it. Advocacy organizations build their own datasets on top of it. It now shapes the narrative of accountability for alleged attacks on health care and forms the basis for misplaced arguments about culpability for them as breaches of international humanitarian standards.

We spent months reviewing the SSA’s methodology and publicly available data. Our conclusion—in a report recently published by The Hague Initiative for International Cooperation and the Henry Jackson Society—is that the system, as currently designed, cannot support the legal and comparative claims routinely built on top of it. This is not an argument against monitoring attacks on health care, which is an important and legitimate project. It is an argument that continuing to treat SSA figures as verified, comparable, or legally dispositive risks distorting the debate it’s meant to inform.

The Definitional Problem

The SSA defines an “attack” as “any act of verbal or physical violence, threat of violence or other psychological violence, or obstruction that interferes with the availability, access and delivery of curative and/or preventive health services.” This is considerably broader than the operative legal definition of “attack” found in Additional Protocol I, Article 49, which requires an “act of violence against the adversary” connected to an armed conflict.

The over-extension matters. The SSA’s event taxonomy includes categories such as “psychological” violence (insults, intimidation, threats) and “obstruction,” which by the WHO’s own methodology can include a health worker being delayed at a security checkpoint, which is not an “act of violence.” It also includes arrests, detentions, and searches; categories of State and non-State conduct that international humanitarian law (IHL) does not automatically treat as unlawful, and that may in some circumstances be required by a party’s obligation to take precautions against the misuse of medical facilities. Some of this conduct is problematic, but labeling all of it “attack,” without further qualification, imports a legal conclusion the underlying facts don’t establish.

We also found, using conflict-onset data from the Uppsala Conflict Data Program, that 39% of logged SSA events in the occupied Palestinian territory occurred during periods that would not meet standard thresholds for active armed conflict, a precondition for the legal category of “attack” to apply at all. This suggests the SSA is, at least in part, capturing lower-level friction and violence. Such conduct is distinct from attacks governed by IHL.

The Verification Gap

The SSA’s methodology draws a distinction that is easy to miss and important to understand: WHO staff assign a confidence score to whether an event occurred at all, but they do not independently verify the details within a given record, including the number of people killed or injured, or who is responsible. This means that when the WHO or downstream users describe SSA events as “verified,” the term applies, at most, to the bare fact of an event’s occurrence, not to its severity or attribution.

This gap has produced results that are hard to defend on closer inspection. The single deadliest event in the entire SSA dataset is the October 2023 strike on Al-Ahli Arab Hospital in Gaza, an incident initially, and incorrectly, attributed by the news media to an external strike by Israel, before forensic evidence indicated it resulted from a failed rocket launched from within Gaza. We flag this case because it illustrates a structural point: a database that does not investigate causation or verify casualty figures against primary sources (death certificates, medical records, forensic evidence) will, sooner or later, enshrine an initial and incorrect public narrative as its most-cited statistic. That is what appears to have happened here, and it should concern anyone using SSA aggregate figures for legal or policy analysis, regardless of which conflict is at issue.

Our review also found event records with internally inconsistent or implausible casualty figures relative to independently reported facts about the same incidents. For example, the SSA entry for a July 2024 strike on a children’s hospital in Ukraine reported casualties that were substantially lower than those described in contemporaneous UN Security Council discussion of the same event. Such discrepancies may reflect the limits of a decentralized reporting network operating in active conflict zones. But they underscore that SSA casualty figures should not be treated as authoritative without independent corroboration.

The Reporting Bias Problem

The SSA data is also deeply problematic and misleading because of extensive opportunities for bias in data reporting. These opportunities for bias arise because: (i) irregularities are produced by the use of different standards and procedures across various reporting territories; (ii) data reporting agencies affiliated with or subordinate to predominant armed groups have strong incentives to manipulate reporting; (iii) lack of protocols for substantive verification results in inflated counts of alleged events; and (iv) SSA procedures allow misattribution of responsibility by downstream users with agendas that distort the data with false positives. This bias then misleads narratives about armed conflict and health care.

The SSA relies on WHO country offices and pre-identified partner organizations to report events from the ground. This design has an unavoidable consequence: reporting is a function not just of underlying violence, but of the presence, capacity, and institutional incentives of local reporting networks. These factors vary enormously and unevenly across the 26 countries and territories currently in the system.

The resulting irregularities are stark. Iraq reported 36 events in 2018, its first year of participation, and then reported zero events for the following seven years, despite documented violence against medical workers by State security forces during that period, including incidents that the WHO’s own regional office publicly condemned. Similarly, Nagorno-Karabakh has a single SSA entry, dating to 2020, despite a documented humanitarian blockade of the Lachin Corridor beginning in December 2022 and a subsequent military campaign that produced mass displacement in 2023. By contrast, several other territories in the dataset show large, sustained reporting volumes over multiple years.

This is a predictable outcome of a reporting architecture that depends on local partners who may lack capacity, may face retaliation for reporting certain actors, or may simply stop participating without any public notice from the WHO that they’ve done so. The practical effect is a dataset in which apparent “hotspots” of health care violence reflect local reporting infrastructure rather than a comparison of the severity or frequency of actual events. This bias poses a serious problem for any legal or policy argument that relies on cross-country comparison.

A related concern is attribution. The SSA does not identify which party is responsible for a given event, a limitation that the WHO does not prominently disclose. Yet downstream users—including some UN mechanisms—routinely draw or imply attribution conclusions from SSA data, sometimes for territories where the reporting network itself is embedded within, or dependent on the tolerance of, one of the parties to the conflict. We contacted one UN office that does publish attributed findings to ask how its determinations are made and how they relate to underlying WHO data. The office would not provide substantive information about its methodology despite repeated inquiries.

Toward Reform

The SSA is worth fixing. Several reforms would help.

First, the WHO should adopt more legally neutral terminology—something like “disruptions to health care,” reserving “violence” or comparable terms for events that clearly satisfy that description—rather than applying “attack” indiscriminately across a heterogeneous set of event types.

Second, the WHO should publish explicit, prominent guidance on the limits of SSA data: that it does not support cross-country or cross-conflict comparison given uneven reporting infrastructure; that it does not constitute a legal determination of responsibility; and that “verification” refers only to an event’s occurrence, not to reported severity or attribution.

Third, the WHO should invest in independent verification of reported figures, which it currently has the country-level infrastructure to do but does not.

Fourth, the WHO should create a mechanism for States and other parties to formally contest specific entries on the public record, rather than leaving disputed attributions to circulate unchallenged.

Fifth, the WHO should publicly indicate when a previously reporting State or territory has stopped participating, so that data gaps are not mistaken for the absence of violence.

The international law and policy community has a strong interest in reliable data on attacks on health care—both to support genuine accountability efforts and to protect the credibility of the institutions and legal frameworks built to address this problem. Continuing to treat the SSA as though it already meets that standard does a disservice to both accountability and credibility.

***

Leslie Johns is a Professor of Political Science and Law at UCLA.

Gregory Rose is a Professor of Law at the University of Wollongong.

They are the authors of a report on the WHO’s health care attack data published by the Henry Jackson Society and The Hague Initiative for International Cooperation.

The views expressed are those of the authors, and do not necessarily reflect the official position of the United States Military Academy, Department of the Army, or Department of Defense.

Articles of War is a forum for professionals to share opinions and cultivate ideas. Articles of War does not screen articles to fit a particular editorial agenda, nor endorse or advocate material that is published. Authorship does not indicate affiliation with Articles of War, the Lieber Institute, or the United States Military Academy West Point.

Photo credit: State Emergency Service of Ukraine