Australia considers that a cyber activity may constitute an ‘attack’ against an adversary under IHL if it rises to the same threshold as that of a kinetic ‘attack’ (or act of violence). The rules governing such attacks during armed conflict will apply to those kinds of cyber activities. Accordingly, it will be necessary to assess whether the cyber activity is sufficiently connected to hostilities and results in the reasonably foreseeable death or injury to individuals or damage and destruction to objects. IHL also provides rules that apply to cyber activities in an armed conflict that do not constitute or rise to the level of an ‘attack’, including the general protections afforded to the civilian population and individual civilians against dangers arising from military operations. In accordance with the IHL principle of military necessity, a combatant is justified in using measures, not forbidden by international law, which are indispensable for securing complete submission of an enemy at the soonest moment. The principle cannot be used to justify actions prohibited by law, as the means to achieve victory are not unlimited. The IHL principle of distinction seeks to ensure that only legitimate military objectives are attacked. Distinction has two components. The first, relating to personnel, seeks to maintain the distinction between combatants (who may be attacked), and civilians or non-combatants (including protected persons). The second component distinguishes between objects which are targetable as legitimate military objectives, and civilian and protected objects. The IHL principle of proportionality prohibits the launching of an attack which may be expected to cause incidental loss of civilian life, injury to civilians, damage to civilian objects, or a combination thereof, which would be excessive in relation to the concrete and direct military advantage anticipated. Australia, and other States parties to Additional Protocol I to the Geneva Conventions of 1949 are required under Article 36 to determine whether the employment of new weapons, or means or method of warfare, would, in some or all circumstances be prohibited by Additional Protocol I or any other rule of international law applicable to that State. A cyber capability could, in certain circumstances, constitute a ‘weapon, or a means or method of warfare’ within the meaning of Article 36 and require a review in accordance with Article 36 obligations. In armed conflict, Australian military capabilities are employed within a well-established system of command and control, within applicable legal frameworks, and subject to orders, directives and procedures. This includes approved targeting procedures. Cyber activities are no different. Where cyber actions or activities amount to an attack under IHL, as for conventional activities, Australian targeting procedures comply with the requirements of IHL. Trained legal officers are available to support Commanders with advice to ensure that Australia satisfies its obligations under international law and operates in accordance with its domestic legal requirements. International human rights law (IHRL) also applies to State conduct in cyberspace. Under IHRL, States have obligations to protect relevant human rights of individuals under their jurisdiction, including the right to privacy, where those rights are exercised or realised through or in cyberspace. Subject to lawful derogations and limitations, States must ensure without distinction individuals’ rights to privacy, freedom of expression and freedom of association online. 4 www.internationalcybertech.gov.au