The Internal Proportionality Assessment in Cyberspace

The International Criminal Tribunal for the former Yugoslavia’s Prosecutor v. Prlić et al. Appeals Chamber judgment, as well as the Eritrea-Ethiopia Claims Commission’s Western Front arbitral award found that a bridge and an electrical power station, respectively, were military objectives in their entirety, although they simultaneously served both military and civilian purposes. In a similar manner, several States consider that objects composed of both military and civilian parts are military objectives in their entirety, meaning that they can be made the object of an attack. This is evident, for example, in the military manuals of the United States (p. 217, 1034), United Kingdom (p. 54), Australia (p. 5-7), New Zealand (p. 8-10), and Denmark (p. 300).

According to this view, when assessing proportionality, commanders confronted with a military objective that also serves a civilian purpose must consider the expected incidental harm to civilians and civilian infrastructure occurring outside the target. However, there is no requirement for the commander to assess the incidental harm resulting from curtailing the civilian use of the targeted object itself.

The experts who drafted an International Committee of the Red Cross (ICRC) report on proportionality defined “external proportionality” as “harm to civilians or objects other than the dual-use object targeted … whether or not the targeted object was a dual-use object or an object used solely for military purposes” (p. 39). Conversely, “internal proportionality” is a balance between the potential military advantage gained and the expected civilian harm obtained by the “destruction of the civilian part of the object” or by the “ending [of] its civilian use or function.” In short, external proportionality goes only to the loss of life, injury, or destruction of objects outside the targeted objective, whereas internal proportionality concerns the impairment of the civilian functions of the attacked object itself. The first is assessed according to one or more steps of causation (the destruction of object X also impacts object Y in the surroundings; or reverberating effects), the second requires zero steps of causation (object X alone).

More precisely, there are two types of “internal” proportionality, one in the narrower and one in the larger sense. First, regarding the narrow category, the civilian activities take place inside the attacked object, and its impairment renders these activities more difficult or impossible. Thus, if a hospital is targeted because it is a military objective, its destruction will impede the use of the place to take care of the wounded and sick civilians, who in turn may die. Second, from a broader perspective, the civilian activities take place outside the attacked object, but they are based on the contribution this object makes to their functioning.

Therefore, if an electricity power station is attacked and the electricity that supplies a hospital is no longer available, those receiving care in the hospital may once again die. The denial of the civilian fraction of electricity from the attacked object is the “internal” part of proportionality here, and the consequences are at the same time indirect, knock-on, or reverberating. It would be possible to classify this latter situation as an “external” proportionality assessment. However, the ICRC considers that it falls within the “internal” proportionality test because the focus is on the civilian fraction of the attacked object itself. In this second situation, the proportionality test is indeed a mixture of “internal” and “external” elements. We will however classify it as a type of internal proportionality.

In some situations, the inability of civilians to use certain infrastructure can have disastrous effects. An attack targeting a dual-use object such as a power grid “might indeed have a significant impact on public health, as electricity is needed to operate hospitals and treat water and sewage.” The loss of the use of the civilian part of the object must be considered: it is the “internal proportionality” assessment. Refusing to address this when assessing attacks on dual-use objects prevents the civilian part of the object from being included in the assessment of proportionality, thereby preventing the assessment of internal proportionality.

This post aligns with the view that dual-use objects are military objectives for which the civilian component must, where relevant, be considered in the proportionality analysis. This is particularly true in cyberspace. Neglecting the existence of dual-use objects and thus their internal proportionality assessment would excessively limit the reach of the rule. Indeed, effects necessitating an external proportionality assessment are rare in cyberspace, whereas those necessitating an internal proportionality assessment are abundant.

Cyberattacks Generating an External Proportionality Assessment

Not all cyberattacks trigger proportionality issues, whether internal or external. Thus, cyberattacks that consist of launching a virus designed to self-replicate, and that have the potential to randomly reach other civilian cyber infrastructure, do not qualify as attacks that generate incidental harm in the sense of the proportionality rule. These cyberattacks would “be inherently indiscriminate in the sense that their effects cannot be predicted or controlled” (p. 736). This type of attack is inherently unlawful.

A cyberattack that raises issues of external proportionality would be one that causes effects such as collateral blast strike effects, generating potential incidental harm reaching the threshold of “incidental loss of civilian life, injury to civilians, damage to civilian objects” (Additional Protocol I, art. 51(5)(b)). This kind of collateral effects can be assimilated to those caused by an explosive kinetic weapon, that is, a weapon that has repercussions on civilians or civilian infrastructures in the surrounding area. This configuration is very uncommon in practice.

Two cyberattacks causing physical effects can illustrate this category. In 2014, a German steel mill was the target of a cyberattack that hit “the industrial control systems of a blast furnace, causing the furnace to shut down improperly” causing “massive physical damage.” Such an improper shutdown could have resulted in an explosion and killed employees or damaged other infrastructure in the steel mill (as happened in the United Kingdom in 2001, but not due to a cyberattack). Another cyberattack posed an even greater risk of producing effects that would be relevant to an external proportionality assessment. A group of hackers called Predatory Sparrow asserted it carried out the attack of June 27, 2022, causing a “serious fire” in an Iranian steel production facility. If such collateral effects resulted from a State attack, the responsible State should have conducted an external proportionality assessment.

Cyberattacks that produce physical effects are uncommon and cyberattacks that produce physical effects with external effects are even more so. On the contrary, cyberattacks that generate internal effects are abundant in practice.

Cyberattacks Generating an Internal Proportionality Assessment

Although the Tallinn Manual 2.0 states that all dual-use objects are military objectives (p. 445), it also recalls that they are subject to the rule of proportionality and that the attacker must notably “consider any expected harm to … clearly distinguishable civilian components of the military objective” in the proportionality assessment. For harm to be considered as collateral damage, it must amount to “incidental loss of civilian life, injury to civilians, damage to civilian objects.” The International Group of Experts recognized that, in certain circumstances, the potential “deprivation of functionality” generated by a cyberattack on a dual-use object must also be included in the notion of damage to civilian objects (Tallinn Manual 2.0, p. 472). This must therefore be considered in the proportionality assessment.

In the context of the conflict in Ukraine, the CyberPeace Institute has counted 510 disruptive cyberattacks that targeted Ukraine and 187 that targeted Russia. There are consequently far more cyberattacks with disruptive effects, destroying the use of the object, than cyberattacks that have collateral blast strike-like effects. Although cases are rare, there is technically a greater probability that a cyberattack that results in the destruction of cyberinfrastructure will result in deaths, injuries, and physical destruction or deprivation of functionality, than from a cyberattack with collateral blast strike-like effects.

One example of such a disruptive cyberattack was the attack that impacted the UK National Health Service blood services at London hospitals in June 2024, impeding the use of systems and having serious collateral effects. The cyberattack brought down at scale the “systems that underpin[ed] diagnostics and treatment” and provoked 14 “moderate” harm cases as well as the death of one person. This attack produced effects stemming from the ending of the use of the object. In the context of an armed conflict, such effects must be considered prior to the attack as part of an internal proportionality assessment.

Conclusion

Seemingly only two known cyberattacks to date have had the potential to generate effects that would be considered under an external proportionality assessment. The role of internal proportionality in cyberspace is more significant. It is therefore crucial to integrate the notion of “dual-use objects” for military objectives bearing a civilian component.

With regard to such objects, an internal proportionality assessment must consider any consequences that will flow from the potential destruction of the object’s civilian part and the cessation of civilian use. Neglecting internal proportionality when targeting dual-use cyber objects would permit excessive cyberattacks, undermining the due protection of civilians and civilian infrastructure during armed conflicts. Cyberspace is thus a good example of an area where the tools of the proportionality assessment must be adapted to the peculiarities of its factual configuration.

***

Robert Kolb is a Professor of Public International Law at the University of Geneva and former legal staff member of the ICRC. Prof Kolb is also a member of the legal section of the Swiss military high command (IHL section).

Margaux Germanier is a PhD Candidate and teaching assistant at the University of Geneva.

The views expressed are those of the authors, and do not necessarily reflect the official position of the United States Military Academy, Department of the Army, or Department of Defense. 

Articles of War is a forum for professionals to share opinions and cultivate ideas. Articles of War does not screen articles to fit a particular editorial agenda, nor endorse or advocate material that is published. Authorship does not indicate affiliation with Articles of War, the Lieber Institute, or the United States Military Academy West Point.

Photo credit: Getty Images via Unsplash