The hacker collective Anonymous is also active in the Ukraine war; a loose international group of so-called hacktivists who hack into systems to achieve political ends. “Anonymous” says of itself that it has carried out various successful actions against Russia – such as hijacking Russian television stations to show pictures of the war, or paralyzing state websites. Sanija Ameti is familiar with cyber security and international law and explains a few terms in this context.
SRF News: What does it mean from a legal point of view when Anonymous declares cyber war on Russia?
Sanija Ameti: From a legal point of view, it must be said that only states can declare a war – including a cyber war – and not just any private person or entity like Anonymous. It is also important that a minimum level of violence is required for a war.
In terms of international law, we never speak of a cyber war, but of a hybrid war.
We are talking here about the destruction of objects or the loss of human life. And because cyber operations are fundamentally unsuitable for reaching this threshold of violence, cyber war as such does not exist. This means that we never speak of a cyber war in international law, but of a hybrid war.
Couldn’t a hacker attack clear this hurdle of using force, for example if infrastructure is destroyed?
Even in the very unlikely event that a hacker actually destroys infrastructure with a cyber operation, he’s still not a party to the war. In a war like that between Russia and Ukraine, international humanitarian law distinguishes between combatants and non-combatants. The latter include civilians as well as hackers when they are not part of an armed force.
Legend:
“If someone sees himself as a combatant, he has to carry his weapons openly,” explains Ameti. “That means he has to make it clear that he is a combatant. But if someone from Anonymous neither puts their name behind it nor clearly identifies themselves as a combatant, then they are not combatants, even if they claim to be.”
key stone
Anyone who takes part in a war as a non-combatant – that is, if someone from Anonymous destroys infrastructure, for example – will be punished under criminal law. However, if a private individual is commissioned by a state to carry out a cyber attack that then leads to destruction, then the private individual’s action would be attributed to the state. Then it would be an interstate act of war.
Isn’t this distinction also problematic?
Yes, because certain states such as Russia and China, for example, deliberately use private individuals to cause damage in cyberspace. Then they say: It’s not our fault, it’s private individuals who did it. But behind this lies a mandate from the state. The problem with the whole thing is that it is difficult to prove that the Kremlin is behind it, for example, when it commissions private criminals to carry out certain actions in cyberspace.
Should international humanitarian law be amended?
Lawyers have long been trying to apply international law and international humanitarian law to cyberspace. But there are two problems. For one thing, the existing law cannot simply be applied to cyber operations because the use of force does not work in the same way as with physical attacks.
To this day, there is no national consensus that the Geneva Conventions should be applied in cyberspace.
And the second thing is that there is still no international consensus that the Geneva Conventions and the individual norms of the Geneva Conventions should be applied in cyberspace. This means that the treaty would have to be updated, and this requires the consent of all states that have ratified the Geneva Conventions.
The conversation was conducted by Sandro Della Torre.