46 Fifth Report Annex B loss of functionality.”79 Ecuador opined that “[a] cyber operation can qualify as an attack if it renders inoperable a state’s critical infrastructure or others that endanger the security of the state.”80 33. Bolivia and Guyana’s responses were more equivocal. On the one hand, Bolivia emphasized that IHL would define attacks to include those cyber operations “intended to be able to cause loss of human life, injury to people, and damage or destruction of property.”81 On the other hand, it suggested that a cyber operation “could be considered an attack when its objective is to disable a state’s basic services (water, electricity, telecommunications, or the financial system”).82 Guyana noted that “[w]hen a cyber operation produces a loss of functionality, it may or may not constitute an attack.”83 Like Chile, it referenced API Article 49, tying the attack concept to a need for violence (whether in terms of means or consequences): “a cyber operation which does not result in death, injury, or physical harm cannot constitute an attack” under IHL.84 On the other hand, it also suggested that “cyber operations that undermine the functioning of computer systems and infrastructure needed for the provision of services and resources to the civilian population constitute an attack” among which it included “nuclear plants, hospitals, banks, and air traffic control systems.”85 Such responses suggest a need for further dialogue on how proximate the death or destruction must be to the loss of functionality. In other words, does the loss of functionality to an essential service alone constitute an attack or must there be some attendant (or reasonably foreseeable) death or injury to people or property? 79 80 81 82 83 84 85 Guatemala Response, supra note 1, at 3. Ecuador Response, supra note 1, at 3. Bolivia Response, supra note 1, at 4-7. Id. Guyana Response, supra note 1, at 3. Id. Id. (citing API Art. 54(2)). Inter-American Juridical Committee Question 7 Is a cyber operation that only targets data governed by the international humanitarian law obligation to direct attacks only against military objectives and not against civilian objects? 34. IHL clearly requires “attacking” States to distinguish between civilian and military objects, permitting attacks on military objectives while prohibiting those against civilians and civilian objects.86 When it comes to cyberspace, however, it is not always clear what constitutes an “object” to which this principle applies. The primary debate has centered on “data.” Does the non-physical nature of “data” mean it will not constitute an object so that militaries need not distinguish it and exclude it as a target in their cyber operations? Or should at least some “data” qualify as an “object” to which the principle of distinction and relevant IHL rules apply? 35. A majority of the Tallinn Manual 2.0’s Independent Group of Experts adopted the former view: the “armed conflict notion of ‘object’ is not to be interpreted as including data, at least in the current state of the law.”87 That said, the experts did agree that a cyber operation against data could trigger IHL’s rules where it “foreseeably results in the injury or death of individuals or damage or destruction of physical objects” since the latter individuals and objects would be protected by relevant IHL rules like distinction.88 The ICRC has, in contrast, suggested a more expansive definition of data via the term “essential civilian data” (e.g., medical data, biometric data, social security data, tax records, bank accounts, companies’ client files, or election lists and records). It has pointed out that “[d]eleting or tampering with essential civilian data can “cause more harm to civilians than the destruction of physical When a particular object is used for both civilian and military purposes (so-called “dual-use objects”), it becomes a military objective (except for separable parts thereof ). For sources codifying this principle of “distinction” see supra note 61. 87 Tallinn 2.0, supra note 20, at 437. 88 Id. at 416. 86 International Law and State Cyber Operations 47