III. Obligations of States under international humanitarian law (IHL) a) Applicability of IHL in the cyber context Germany reiterates its view that IHL applies to cyber activities in the context of armed conflict.29 The fact that cyberspace as a domain of warfare was unknown at the time when the core treaties of IHL were drafted does not exempt the conduct of hostilities in cyberspace from the application of IHL. As for any other military operation, IHL applies to cyber operations conducted in the context of an armed conflict independently of its qualification as lawful or unlawful from the perspective of the ius ad bellum. An international armed conflict – a main prerequisite for the applicability of IHL in a concrete case – is characterized by armed hostilities between States. This may also encompass hostilities that are partially or totally conducted by using cyber means. Germany holds the view that cyber operations of a non-international character, e.g. of armed groups against a State, which reach a sufficient extent, duration, or intensity (as opposed to acts of limited impact) may be considered a non-international armed conflict and thereby also trigger the application of IHL. 30 At the same time, cyber actions can become part of an ongoing armed conflict. In order to fall within the ambit of IHL, the cyber operation must show a sufficient nexus with the armed conflict,31 i.e. the cyber operation must be conducted by a party to the conflict against its opponent and must contribute to its military effort.32 Cyber operations between a non-State actor and a State alone may provoke a noninternational armed conflict. However, this will only seldom be the case due to the level of intensity, impact and extent of hostilities required. Thus, activities such as a large-scale intrusion into foreign cyber systems, significant data theft, the blocking of internet services and the defacing of governmental channels or websites will usually not singularly and in themselves bring about a non-international armed conflict.33 b) The fundamental principles of IHL limiting the recourse to cyber operations in the context of an armed conflict The basic principles governing the conduct of hostilities, including by cyber means, such as the principles of distinction, proportionality, precautions in attack and the prohibition of 29 30 31 32 33 Cf. also ibid., rule 80. Generally, a non-international armed conflict is characterized by ‘protracted armed violence between governmental authorities and organized armed groups or between such groups within a State’, International Criminal Tribunal for the former Yugoslavia (ICTY), Prosecutor v. Dusko Tadić (aka ‘Dule’), Decision on the Defence Motion for Interlocutory Appeal on Jurisdiction (Appeals Chamber), Case No. IT-94-1, 2 October 1995, para. 70. On the definitions of international and non-international armed conflict in the cyber context, cf. also Tallinn Manual 2.0 (note 4), rules 82 and 83. Tallinn Manual 2.0 (note 4), rule 80, commentary, para. 5. See on the discussion ibid., rule 80, commentary, paras. 5, 6. Ibid., rule 83, commentary, paras. 2, 7 and 8. 7