42 Fifth Report Annex B be argued that the draft articles have a different scope of application.”58 As noted, however, the ASR standard of responsibility only references “control” generally, without differentiating whether it must be “effective” or “overall.” 26. Other States had more trouble answering the fifth question. Guatemala suggested that “international forums must continue their discussions on the uniquely different aspects that a conflict in cyberspace would entail, particularly regarding such issues as attribution and territorial considerations.”59 Other States read this question to ask about differing standards of responsibility between international and non-international armed conflicts.60 Question 6 Under international humanitarian law, can a cyber operation qualify as an “attack” for the rules governing the conduct of hostilities if it does not cause death, injury or direct physical harm to the targeted computer system or the infrastructure it supports? Could a cyber operation that produces only a loss of functionality, for example, qualify as an attack? If so, in which cases? ian objects) while permitting others (e.g., those targeting military objects).61 As the ICRC recently noted, “[t]he question of how widely or narrowly the notion of ‘attack’ is interpreted with regard to cyber operations is therefore essential for the applicability of these rules and the protection they afford to civilians and civilian infrastructure.”62 Indeed, to the extent an operation does not constitute an “attack,” it may be conducted in an armed conflict without regard to most IHL rules.63 28. Under IHL, an “attack” is defined by customary international law (as codified in Article 49 of Additional Protocol I to the Geneva Conventions (API)) as “acts of violence against the adversary, whether in offence or defense.”64 As the Tallinn Manual 2.0 explains, moreover, “the consequences, not its nature, are what generally determine the scope of the term ‘attack’; ‘violence’ must be considered in the sense of violent consequences and is not limited to violent acts.”65 The ICRC has noted, moreover, “[i]t is widely accepted that cyber operations expected to cause death, injury or physical damage constitute attacks under IHL.”66 As is well known, however, some cyber operations (e.g., ransomware) are novel in that they offer an opportunity to “render objects dysfunctional without physically damaging them.”67 This raises the For example, the principle of distinction is regularly framed as a prohibition on making civilians the object of an attack. See, e.g., Protocol Additional to the Geneva Conventions of 12 August 1949, and relating to the Protection of Victims of Armed Conflict (Protocol I) (June 8, 1977), 1125 UNTS 3, Art. 51(2) (“API”); Protocol Additional to the Geneva Conventions of 12 August 1949, and Relating to the Protection of Victims of Non-International Armed Conflicts (Dec. 12, 1977), 1125 UNTS 609, Art. 13(2); Rome Statute of the International Criminal Court (July 17, 1998), Art. 8(2)(b); Convention (IV) respecting the Laws and Customs of War on Land and its annex: Regulations concerning the Laws and Customs of War on Land (Oct. 18, 1907), 36 Stat. 2277, Art. 23(b); JEAN MARIE HENCKAERTS & LOUISE DOSWALD-BECK, 1 CUSTOMARY INTERNATIONAL HUMANITARIAN LAW (ICRC, 2005), Rules 1, 7, 9, and 10. 62 ICRC, Position Paper on International Humanitarian Law and Cyber Operations during Armed Conflicts (Nov. 2019) at 7 (“ICRC Position Paper”). 63 Even outside of attacks, States must still exercise “constant care” in an international armed conflict to avoid “unnecessary effects” on civilians and their objects. API, supra note 61, Art. 57(1); Tallinn 2.0, supra note 20, at 476. 64 API, supra note 61, Art. 49. 65 Tallinn 2.0, supra note 20, at 415. 66 See ICRC Position Paper, supra note 62. 67 ICRC, International Humanitarian Law and the Challenges of Contemporary Armed Conflicts, (Oct. 2015) 41 (“2015 ICRC Report”). 61 27. The sixth question is the first of two addressing how international humanitarian law (IHL or the jus in bello) applies to cyber operations. It focuses on an issue that has divided States and scholars to date – how to define an “attack” for IHL purposes. Much of IHL, including its fundamental principles of distinction, proportionality, and precautions, are largely framed in terms of prohibiting certain types of “attacks” (e.g., those targeting civilians or civil- Peru Response, supra note 1, at 4-5. Guatemala Response, supra note 1, at 3. 60 See, e.g., Bolivia Response, supra note 1, at 4-7; Guyana Response, supra note 1, at 3. Ecuador’s Response simply emphasized that States “are responsible for complying with the rules in armed conflicts, even where there are parties that are not party” to those Conventions. Ecuador Response, supra note 1, at 2. 58 59 Inter-American Juridical Committee International Law and State Cyber Operations 43