In situations of armed conflict, the methods and means of warfare used by the parties
to the conflict are subject to regulations under international humanitarian law. This
extends to cyber operations implemented by the parties to the conflict. Several principles
under international humanitarian law, including the principle of humanity, necessity,
proportionality and distinction, are also applicable to acts in cyberspace. In paragraph
28(d) of the 2015 GGE report, those principles are referred to as "established international
legal principles." This reference, considered together with the fact that this report affirms
the applicability of existing international law, can be interpreted to affirm the applicability
of those principles. Meanwhile, Article 49 of the Additional Protocol I to the Geneva
Conventions stipulates: "'Attacks' means acts of violence against the adversary, whether
in offence or in defence."1415 The Government of Japan understands that cyber operations
that may cause the destruction or neutralization of military targets, for example, may also
constitute "attacks" under international humanitarian law, depending on the
circumstances.
In principle, the existence of an "armed conflict" is a prerequisite for the application of
international humanitarian law. Under the Geneva Conventions, there is no particular
definition of an "armed conflict," and therefore, whether or not a certain incident
constitutes an "armed conflict" needs to be decided on a case-by-case basis, taking into
account a number of elements, such as the manner of the actual attack and the intent of
each party to the incident, in a comprehensive manner. If the effects of cyber operations
are taken into consideration, the conduct of cyber operations alone may reach the
threshold of an "armed conflict."
As affirming the applicability of international humanitarian law to cyber operations
contributes to the regulation of methods and means of warfare, the argument that doing
so will lead to the militarization of cyberspace is groundless. For example, cyber
operations during armed conflict that cause physical damage or loss of functionality to
medical institutions may constitute a violation of international humanitarian law16 and
therefore should be appropriately regulated. On the other hand, modes of combat in
cyberspace are different from those in traditional domains. Therefore, how international
humanitarian law regarding, for example, the scope of combatants applies to cyberspace
should be further discussed.
(7) International human rights law
International human rights law is also applicable to cyber operations. Individuals enjoy
the same human rights with respect to cyber operations that they otherwise enjoy.
Pursuant to international human rights law, States are under the obligation to respect
human rights. The human rights that must be respected in cyberspace include all human
rights that are recognized under international human rights law, such as civil, political,
14
"Attacks" means acts of violence against the adversary, whether in offence or in defense (Article 49 of the
Additional Protocol I to the Geneva Conventions).
15
Tallinn Manual 2.0 stipulates that "a cyberattack is a cyber operation, whether offensive or defensive, that
is reasonably expected to cause injury or death to persons or damage or destruction to objects." (Tallinn
Manual 2.0., Rule 92)
16
For example, Article 12 of the Additional Protocol I to the Geneva Conventions
7