48 Fifth Report Annex B objects.”89 Although it recognizes that the question of whether data can constitute a civilian object remains unresolved, the ICRC has suggested that IHL should do so or otherwise face a large “protection gap” inconsistent with IHL’s object and purpose. The seventh question sought Member State views on this important issue. civilian population, unless such data are being used for military purposes.”93 Guyana’s response adopted a similar lens. Noting that “the deletion, suppression, corruption of data may have far reaching consequences,” it focused on the effects of the cyber operation rather than whether the data targeted qualified as an object or not.94 36. None of the States that responded to this question took the position that civilian data is directly subject to the principle of distinction in armed conflict. Indeed, several States emphasized the principle of distinction without offering an opinion on the status of data as an object.90 Chile’s response suggested, however, that the principle of distinction could apply to cyber operations against data indirectly based on the knock-on effects of such operations. It cited the Commentary to API for the idea that objects must be “visible and tangible” which means that “under current international humanitarian law the aforementioned data would not qualify as objects, in principle, because they are essentially intangible, without prejudice to the physical elements containing the data—hardware, for example.”91 At the same time, Chile emphasized that “an attack directed exclusively at computer data could well produce adverse consequences affecting the civilian population,” citing as an example the possibility of a cyber operation eliminating a State’s social security database.92 It concluded that “[t]he principle of distinction must therefore be taken into consideration in the context of cyber operations, whereby a state should refrain from attacking data in case it could affect the 37. Peru’s response did not address the potential of data to qualify as a civilian object, but focused (affirmatively) on its potential to qualify as a military objective. It characterized certain “data” (e.g., software allowing troop communications in the field, synchronization of a missile arsenal or location of enemy aircraft) as lawful “military objectives” while suggesting other data systems used in conflicts (e.g., “a data system that enabled the operating room of a field hospital treating war wounded or civilians to function”) were not subject to attack.95 89 ICRC Position Paper, supra note 62, at 8; accord 2019 ICRC Report, supra note 70, at 21 (“Moreover, data have become an essential component of the digital domain and a cornerstone of life in many societies. However, different views exist on whether civilian data should be considered as civilian objects and therefore be protected under IHL principles and rules governing the conduct of hostilities. In the ICRC’s view, the conclusion that deleting or tampering with essential civilian data would not be prohibited by IHL in today’s ever more data-reliant world seems difficult to reconcile with the object and purpose of this body of law. Put simply, the replacement of paper files and documents with digital files in the form of data should not decrease the protection that IHL affords to them.”); 2015 ICRC Report, supra note 67, at 43. 90 See Bolivia Response, supra note 1, at 5-7; Ecuador Response, supra note 1, at 2; Guatemala Response, supra note 1, at 3. 91 Chile Response, supra note 1, at 4. 92 Id. Inter-American Juridical Committee 38. Several Member States’ comments to the OEWG affirmed the importance of applying IHL to the cyber context. States like Brazil emphasized, moreover, that this application should expressly include core principles—“humanity, necessity, proportionality, and distinction.”96 None of the Member State OEWG contributions, however, addressed the definition of an attack nor the idea of data as a civilian (or military) object. Id. Guyana Response, supra note 1, at 4 (“As it relates to data…regard should be had to whether the cyber operation that targets data has produced such a loss of functionality that it may constitute an attack”). 95 Peru Response, supra note 1, at 6. Peru explained that attacks in the first case could cause significant military harm to opposing forces while an attack on the data in the field hospital would “not create a legitimate military advantage.” Id. 96 Brazil Comments, supra note 5. 93 94 International Law and State Cyber Operations 49