54. States must put in place effective measures to protect the civilian population against the dangers resulting from military cyber operations (“passive precautions”). Parties to an armed conflict that may be targeted by cyber operations have a responsibility to minimize the danger of civilian harm caused by such operations.93 Some of these measures may need to be implemented already in peacetime. For instance, States should cultivate a strong culture of cyber resilience throughout their societies and ensure that their critical infrastructure and other infrastructure used by civilians is protected to the highest possible standard. States should also have an adequate understanding of the critical dependencies in their networks in order to be able to restore their functionality in the event of a destructive or disruptive attack. Moreover, whenever feasible, armed forces should segregate military networks from civilian cyber infrastructure, thus limiting the spread of harmful effects onto civilian networks in case a military network is attacked. Similarly, civilian systems should be designed so as to avoid dependence on systems that may qualify as military objectives, thus reducing the risk of civilian harm. States should assist each other with capacity building to ensure that all States have the means to protect themselves against harmful cyber operations. Finally, during armed conflict, States should avoid involving civilians in military cyber operations as doing so may expose them to a grave risk of harm. Choice of means and methods of warfare 55. The right of the parties to an armed conflict to choose means and methods of warfare, including cyber capabilities, is not unlimited.94 In particular, parties to an armed conflict are barred from using means and methods of warfare that are expressly prohibited by IHL. For instance, the use of poison or poisoned weapons is prohibited.95 This means that a cyber operation that is designed or expected to result in poisoning the water supply is specifically prohibited by IHL. This is true irrespective of whether the operation would amount to an attack or if the water supply would qualify as an object indispensable to the civilian population (on which see paras 49 and 61, respectively). Similarly, a cyber operation directed at a factory or other infrastructure containing or using toxic chemicals, designed or expected to cause harm through their release, is prohibited.96 Legal review of new cyber capabilities 56. The legality of all new weapons, means and methods of warfare, including cyber capabilities, must be systematically assessed by all States. IHL requires that in the study, development, acquisition or adoption of any new weapon, means or method of warfare, States must determine whether its employment would, in some or all circumstances, be prohibited 93 Additional Protocol I, Article 58; ICRC, Customary International Humanitarian Law Study, Rules 22-24. Additional Protocol I, Article 35(1). 95 Hague Regulations (1907), Article 23(a); ICRC, Customary International Humanitarian Law Study, Rule 72. 96 Convention on the Prohibition of the Development, Production, Stockpiling and Use of Chemical Weapons and on their Destruction (1993), Article 1; ICRC, Customary International Humanitarian Law Study, Rule 74. 94 15