A/76/136 potential indiscriminate effects throughout the mission planning process is of key importance to Germany. A cyber attack directed against a military target which is nevertheless expected to cause incidental loss of civilian life, injury to civilians, damage to civilian objects, or a combination thereof, is also prohibited under IHL if such incidental effects would be excessive in relation to the concrete and direct military advantage anticipated. 91 If a cyber attack is executed in conjunction with other forms of military action, such as attacks with conventional weapons directed against the same installation, the military advantage and the collateral damage must be considered with regard to the ‘attack […] as a whole and not only […] [with regard to] isolated or particular parts of the attack.’ 92 Assessing collateral damage and incidental injury or loss of life when conducting a proportionality analysis can be even more difficult in the context of cyber operations as compared to more traditional, i.e. physical, means or methods of warfare. This however does not discharge those planning and coordinating attacks from taking into account their foreseeable direct and indirect effects. (2) The obligation to take precaution in planning and executing a cyber attack A corollary to the prohibition of indiscriminate cyber attacks is the duty to take constant care to spare the civilian population, civilians and civilian objects during hostilities involving cyber operations. 93 Those who plan, approve or execute attacks must take all feasible precautions in the choice of means and methods with a view to avoiding, and in any event minimizing, incidental loss of civilian life, injury to civilians and damage to civilian objects. 94 This might encompass gathering intelligence on the network in question through mapping or other processes in order to assess the attack’s likely effects. Also, the inclusion of a deactivation mechanism or a specific configuration of the cyber tool which limits the effects on the intended target might be considered. Moreover, if it becomes apparent that the target is not a military one or is subject to special protection, those who plan, approve or execute the cyber attack must refrain from executing or suspend the attack. The same applies when the attack may be expected to cause excessive collateral damage to civilians and civilian objects. 95 The obligation to take precautions in attack is complemented by the obligation to conduct weapon reviews of any new means or method of cyber warfare to determine whether its employment would, in some or in all circumstances, be prohibited by international law. 96 The findings of such reviews, to the extent that they identify legal constraints for the employment of means and methods in particular operational settings, should serve as a basis for operational planning. However, the means and methods used in cyber warfare are typically tailored to their targets, as they generally involve exploiting vulnerabilities that are specific to the target and the __________________ 91 92 93 94 95 96 38/142 Additional Protocol I (note 86), art. 51 para. 5 (b); Tallinn Manual 2.0 (note 55), rule 113. Declarations made by Germany at the time of ratification of Additional Protocol I (note 86), see ‘Bekanntmachung über das Inkrafttreten der Zusatzprotokolle I und II zu den Genfer RotkreuzAbkommen von 1949’ (Notice concerning the entry into force of Additional Protocols I and II to the 1949 Geneva Red Cross Conventions), 30 July 1991, BGBl. 1991 II, 968, 969; Tallinn Manual 2.0 (note 55), rule 113, commentary, para. 10. Additional Protocol I (note 86), art. 57 para. 1; Tallinn Manual 2.0 (note 55), rule 114. Cf. Additional Protocol I (note 86), art. 57 para. 2 (a) (ii); Tallinn Manual 2.0 (note 55), rule 116. Additional Protocol I (note 86), art. 57 para. 2 (a) (iii); art. 57 para. 2 (b); Tallinn Manual 2.0 (note 55), rules 117, 119. In Germany, the legal review is carried out by the steering committee for the review of new weapons and methods of warfare under the direction of the Directorate-General for Legal Affairs, Joint service regulation A 2146/1. 21-09670