Ukraine Symposium – Cyber Neutrality, Cyber Recruitment, and Cyber Assistance to Ukraine

The war between Russia and Ukraine has given rise to many challenging international humanitarian law (IHL) questions. In this post I will focus on its cyber dimension and consider how certain customary law obligations imposed on belligerents and neutrals under the law of neutrality apply to the current armed conflict.

More specifically I will examine how the obligation not to form corps of combatants or recruit on neutral territory (Article 4 Hague Convention V) applies to the formation of the Ukraine-supporting IT Army and how the obligation not to supply war material (Article 6 Hague Convention XIII which lays down a general customary law duty extending beyond naval warfare but also Article 2 Hague Convention V in relation to land warfare) applies to cyber assistance. Neutral States have provided technical assistance to Ukraine, for example, by dispatching cyber security experts to assist in forestalling cyber attacks, providing technical support and threat intelligence or financial aid to enhance its cyber security, or accepting Ukraine as a contributing participant to the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE).

In view of the fact that publicly available information is quite scarce, I will also use these events as a platform to consider the intricacies as well as difficulties in applying the law of neutrality to the cyber domain, a subject that has received scant attention (see Antonopoulos, ch. 6 and Turns).

Before I proceed, two caveats are in order. First, this post will not consider the broader question of the interrelation between the law of neutrality and the UN collective security system, the concept of benevolent neutrality, or the concept of permanent neutrality (for such discussion see the earlier posts by Wolff Heintschel von Heinegg and Michael N. Schmitt). Second, this post treats Russia and Ukraine as belligerents whereas all other States are neutrals.

Cyber Recruitment

People from across the world joined the IT Army following an invitation by the Ukrainian government. The question I will examine is whether Ukraine and neutral States whose nationals joined the IT Army (assuming the IT Army falls within Ukraine’s Regulations on Military Service in the Armed Forces by Foreigners and Stateless Persons) have breached Article 4 of 1907 Hague Convention V.

The first issue to consider is whether online recruitment qualifies as recruitment for purposes of Article 4 Hague Convention V. The answer is yes. Recruitment describes the process of building an armed force. Its first phase is that of attracting or requesting someone to join which can be done online through advertisement and online applications. Its next phase is that of selection which involves physical and aptitude tests and training. All this can be done online.

The second and more critical issue is whether online recruitment on neutral servers but from sites controlled by Ukraine (for example by functionally controlling or exclusively managing the site) breaches Article 4 Hague Convention V. It should be recalled that Article 4 prohibits the opening of recruitment agencies on neutral territory with opening denoting the establishment of agencies and their active recruiting. In this case, Article 4 Hague Convention V is breached and the neutral State’s Article 5 Hague Convention V obligation of prevention is triggered. If, however, online recruitment takes place from sites under Ukrainian jurisdiction and control, the answer is in the negative because Article 4 Hague Convention V localizes forbidden recruitment to neutral territory.

Would Article 4 Hague Convention V apply if those recruited online remain physically within the neutral State? If physical presence in the neutral territory is central to the application of this rule, one can say that the first limb of Article 4 Hague Convention V is fulfilled in that a corps of combatants is formed on neutral territory. If, however, one wants to look beyond the physical boundaries of the law and look at their digital version in the form of digital persona and digital territory as determined for example by IP addresses, it is possible to argue that Article 4 Hague Convention V does not apply because those recruited are digitally operating outside neutral territory.

If, on the other hand, neutral citizens joined Ukraine’s IT Army voluntarily and did so without the involvement of a belligerent or neutral State, Article 4 Hague Convention V is not engaged. Volunteering is not prohibited under the law of neutrality because it constitutes private conduct (Article 6 Hague Convention V). The requirement to cross the neutral frontier “separately” in such a case highlights the lack of State involvement in organizing these people if compared, for example, to corps of combatants being formed or recruited on neutral territory. There is also no obligation on a neutral State under international law to prevent volunteering in particular involving belligerent nationals on neutral territory although they may decide to regulate volunteering by their nationals under their national law.

In the case of the International Legion for the Defense of Ukraine , it is assumed that many have crossed the neutral frontier to join the IT Army. But if they offered their services to the IT Army online while physically remaining on neutral territory, would that constitute volunteering? The preceding discussion is pertinent in this respect.

It can be said that these people have departed digitally because they have crossed their own State’s cyber frontier (through inter-connected cyber infrastructure) and entered the territory of a belligerent State. If this interpretation is accepted, then Article 6 will apply to this situation; they will be volunteers who provide services to a belligerent army by crossing the neutral’s digital frontier.

If, however, the traditional approach to physical borders is followed, Article 6 will not be engaged. Would Article 4 Hague Convention V apply in this case? It all depends on the level of belligerent or neutral State involvement. Although there is no clear threshold, there must be some kind of organized process by a State in forming a corps of combatants or recruiting to extend Article 4 prohibition whereas, in contrast, Article 6 applies to individuals acting on their own volition and to unorganized groups. This is also in line with the private-public dichotomy that defines the law of neutrality.

Consequently, the mere fact that the UK government expressed its support does not amount to organization; neither does Latvia’s law to allow its citizens to fight in Ukraine. The latter relates to what was said earlier about the potential punishment under national law.

These persons will, however, lose their neutral status according to Article 17 Hague Convention V and be subject to attacks.

With regard to Ukraine as a belligerent State, the initial invitation would not be sufficient to engage Article 4 Hague Convention V but upon joining the IT Army, if they formed a corps of combatants, that may be brought within its scope if they stay within neutral territory. In this case neutral States must take measures to disband them, terminate their activities (Article 5 Hague Convention V) or intern them (Article 11 Hague Convention V). Otherwise, they will be in breach of their neutrality. These persons will also lose their neutral status according to Article 17 Hague Convention V and be subject to attacks.

Cyber Assistance

The second issue to consider is whether cyber assistance provided to Ukraine violates Article 6 Hague Convention XIII which prohibits the supply of “war materials of any kind whatsoever” by neutrals to the belligerents. As I said, this prohibition constitutes customary law that applies beyond naval warfare. The questions I will consider are, first, what constitutes forbidden cyber war material and, second, whether private trade in cyber war material is prohibited.

The use of the word “war material of any kind whatever” means the prohibition is broader than cyber weapons, such as malware. However, there is no definition of what cyber war material is, bearing also in mind that cyber material may be dual use. In principle, hardware and software used or intended to be used to conduct hostilities (for example computers, servers, networks, routers, mobile phones, industrial equipment or systems that are designed to employ or support a cyber weapon) constitute war material. The supply of services (for example, maintenance, non-military training, non-military purpose build cyber technology) is in principle excluded.

That having been said, international practice, although not settled, indicates that not all war material is prohibited but only substantial or, as Bothe put it, “weapons stricto sensu” (see Bothe). The older distinction of the law of contraband between absolute contraband which includes items used exclusively for military purposes and relative contraband that includes dual use items may be of assistance here (see 1909 London Declaration). Consequently the supply of lethal cyber weapons will be prohibited according to Article 6 Hague Convention XIII but not the supply of defensive cyber weapons or cyber defence systems because the latter are not used to prosecute the war.

Contemporary practice also demonstrates that war material may be supplied if there is a pre-existing agreement (for UK practice regarding the Iran-Iraq war see 1986 British Yearbook of International Law, p. 534). This will also extend to the exchange of information on vulnerabilities or threats through Computer Emergency Response Teams (CERTs) or other agreed mechanisms, even if such information relates to specific military operations or to operations that can be used to pursue the conduct of hostilities and thus assist a belligerent. It should be noted that the word “supply” in Article 6 Hague Convention XIII is broader than selling.

The supply of non-war exclusive cyber material is not prohibited but it may be caught by export control regimes. This leads us to the next issue which concerns the private trade in cyber war material.

A neutral has no obligation in principle to prevent private citizens from selling cyberwar material to belligerents provided that any restrictions are applied impartially (Article 7 Hague Convention V and Article 7 Hague Convention XIII). This may apply to Elon Musk’s sending Starlink satellite internet kits to Ukraine (see here) which can also be used for war purposes (although little information exists as to whether funding was exclusively private). However, the private trade in war material may be subject to belligerent rights, for example, seizure.

That having been said, if a belligerent places a particular order to a neutral company to manufacture cyber war material to be used to attack a particular cyber weapon or military cyber system of the other belligerent, for example malware, and the order is accepted by that company, the neutral State’s duty of prevention arises according to Article 8 Hague Convention XIII if read also in conjunction with Article 2 Hague Convention V. Article 8 represents customary law extending beyond naval warfare and applying to the sale of all arms in general. The reason for this is that by placing the specific order for what amounts to war material, the company is acting under the orders of the belligerent and neutral territory is used for the war (see Antonopoulos, p. 97). This duty of prevention is a due diligence duty of conduct and not of result and depends on knowledge and the availability of means.

Another question that arises in relation to private trade is how private trade interacts with export control regimes such as those on dual use goods and technologies (see, for example, Regulation (EU) 2021/821 of 2021). In my opinion, the law of neutrality and export control regimes should remain separate because the scope of the obligations they impose on States differ (customary law obligations by the law of neutrality which also apply in all circumstances whereas treaty law by export control regimes); their scope of application differs (export regimes are designed to apply during peacetime and war time); and also because what falls within each regime may differ, although there may be overlaps.

The critical question, however, is whether such regimes change the character of the private transaction and make it governmental in nature, placing it thus within the prohibitions of Article 6 Hague Convention XIII.  In my opinion, this is what happens because export regimes serve States’ public, not commercial, interests (see also Upcher, Neutrality in Contemporary International Law, pp. 80-83). Consequently, if the cyber war material which is subject to export controls also falls within the scope of prohibited cyber war material as discussed previously, the neutral State should prohibit its sale according to Article 6 Hague Convention XIII. But as was said previously, the pool of prohibited cyber war material is quite narrow.

If the cyber material does not fall within the scope of prohibited cyber war material, its private sale may fall under the export control regime provided that the exporting State is party to such a regime. It has been reported for example that Israel blocked the private sale of spyware to Ukraine. The prohibition will be in line with Article 6 Hague Convention XIII if the spyware constitutes cyberwar material. Otherwise, it will be compliant with Israel’s national and/or international law obligations on export controls. Israel justified its decision by also invoking adherence to international agreements.

Would the trade of data between a neutral private company and a belligerent violate the law of neutrality? If data are intangible and indeed a collection of symbols or numbers whose processing constitutes information, one can say that the trade in data is a private transaction not violating the law of neutrality as discussed earlier. Its transfer through neutral infrastructure is not prohibited according to  Article 8 Hague Convention V provided that it is done impartially according to Article 9 Hague Convention V.

If data are objects that can also be weapons as in malware (see also U.S. Department of Defense Data Strategy), their trade on the open market remains in principle private and therefore not prohibited, as explained previously; however, if a belligerent places an order to a neutral company to transfer specific data to be used in the war and the company accepts it, Article 8 Hague Convention XIII would be implicated as explained above if read also in conjunction with Article 2 Hague Convention V. The neutral State should prevent the departure of such data from its jurisdiction. Of course, discharging such a duty in cyberspace is difficult but, as was explained previously, it is a due diligence duty of conduct and not of result meaning that the State should act if it has knowledge and has the means to do so.

Finally, in relation to financial assistance to enhance Ukraine’s cyber defense, this does not involve assistance to the prosecution of the war and therefore it is not prohibited. Even if it does, financial assistance by neutral States or neutral citizens is not regulated as such under the law of neutrality and, moreover, State practice is ambivalent. During the Second World War, neutral States supported the belligerents financially whereas during the Iran-Iraq war financial support to Iraq was criticized but not as violation of the law of neutrality (see here). Also, commentators who contend that financial assistance to belligerents is prohibited speak of substantive assistance (see Bothe).

Conclusion

This contribution has revealed the intricacies and difficulties in applying the traditional law of neutrality to cyber recruitment and cyber assistance because the law of neutrality is based on traditional notion of territoriality and its physical borders. It is premised on a relatively clear understanding of what constitutes war material. However, these notions are challenged in the cyber domain. Consequently, how the law of neutrality applies to cyber warfare requires more attention. Lawyers and policy makers need to proceed with care but also with some imagination in analogizing, adapting, and re-interpreting existing law. However, in my opinion this should not involve the creation of a new à la carte law.

***

Nicholas Tsagourias is Professor of International Law at the University of Sheffield, UK.

Photo credit: Piqsels