44 Annex B question whether a cyber operation that does not produce such effects (e.g., disrupting the functionality of a water treatment facility without necessarily causing physical damage) can constitute an attack. Diverging views have emerged to date including among the Tallinn Manual 2.0’s Independent Group of Experts.68 29. A majority of the Tallinn Manual 2.0’s experts took the view that violence required some physical damage, including “replacement of physical components” such as a control system.69 Others interpreted damage to include cases where no physical components require replacing and functionality can be restored by reinstalling the operating system, while a few other experts believed an attack could occur via the “loss of usability of cyber infrastructure” itself.70 For its part, the ICRC has argued that during an armed conflict an operation designed to disable a computer or a computer network constitutes an attack under IHL, whether the object is disabled through kinetic or cyber means.71 30. The sixth question was thus designed to see if Member States likewise view IHL’s attack threshold in terms of violence (or violent effects) or if they would consider that the “attack” label could be applicable to cyber operations based on loss of functionality rather than more traditional concepts of physical damage or destruction. 31. The questionnaire responses reveal support for the applicability of IHL generally as well as the idea that cyber operations can constitute an attack in that context.72 Responses were more mixed, however, with respect to Tallinn 2.0, supra note 20, at 417. Id. 70 2015 ICRC Report, supra note 67, at 41; see also ICRC, Report on International Humanitarian Law and the Challenges of Contemporary Armed Conflict (Nov. 2019) at 28 (“2019 ICRC Report”) (“IHL rules protecting civilian objects can, however, provide the full scope of legal protection only if States recognize that cyber operations that impair the functionality of civilian infrastructure are subject to the rules governing attacks under IHL.”) 71 See ICRC Position Paper, supra note 62, at 7-8; 2015 ICRC Report, supra note 67, at 43 (arguing that international law must treat as attacks those cyber operations that disable objects since the definition of a military objective includes neutralization (suggesting that neutralizing objects falls within the ambit of IHL)). 72 See, e.g., Bolivia Response, supra note 1, at 3-7; id. at 4-7 (noting two views on whether a cyber operation alone can give rise to an armed conflict subject to IHL); Chile Response, 68 69 Inter-American Juridical Committee Fifth Report whether a cyber operation could qualify as an “attack” under IHL if it fails to cause death, injury, or direct physical harm. Chile, Peru, and the United States all gave negative responses.73 Chile cited Article 49 of Additional Protocol 1 to the Geneva Conventions (API) to insist that IHL attacks must involve “effects or consequences arising from the act itself” that are “violent.”74 In particular, it suggested that to qualify as an attack, its result must require the affected State to “take action to repair or restore the affected infrastructure or computer systems, since in those cases the consequences of the attack are similar to those described above, in particular physical damage to property.”75 Peru’s response suggests for there to be an “attack” there must be “people” or “public or private property” that is “physically harmed.”76 The United States, meanwhile, has emphasized that the IHL “attack” threshold requires looking at “inter alia, whether a cyber activity results in kinetic and irreversible effects on civilians, civilian objects, or civilian infrastructure, or non-kinetic and reversible effects on the same.”77 The implication is that if a cyber operation produces non-kinetic or reversible effects, it will not “rise to the level of an armed attack.”78 This would seem to exclude, for example, ransomware exploits that are not kinetic themselves or where the data they interrupt can be restored. 32. In contrast, Guatemala and Ecuador both responded positively to the idea of delimiting attacks based on functionality losses rather than death, injury, or destruction of property. Guatemala indicated that among cyber operations that can be considered an attack are those “that only produce a supra note 1, at 3. Guyana Response, supra note 1, at 3; Peru Response, supra note 1, at 1; Koh, supra note 1, at 595 (U.S. view). 73 Guyana Response, supra note 1, at 4. 74 Chile Response, supra note 1, at 3. 75 Id. 76 Peru’s response is, however, a bit ambiguous, as it appears to rely on jus ad bellum materials to identify the standards for an IHL attack, including citing the U.S. contextual approach favored by Harold Koh. Peru Response, supra note 1, at 6. 77 2014 US GGE Submission, supra note 1, at 736. 78 Egan, supra note 1, at 818. Egan’s speech did not mention the reversible/irreversible criterion but emphasized instead “the nature and scope of those effects, as well as the nature of the connection, if any, between cyber activity and the particular armed conflict in question.” Id. International Law and State Cyber Operations 45