On Thin Ice: Qualification of Cyber-Attacks on Personal Data under International Humanitarian Law

The article examines the possibility and conditions for qualifying cyber-attacks on personal data as a military operation, an attack, and/or an armed conflict from the perspective of international humanitarian law (hereinafter — IHL). It is often personal data that is the target of a cyber-attack. In this context, potential legal qualification of a cyber-attack depends on whether and to what extent states recognise data as an “object” under IHL. In the absence of a specific treaty dealing with the application of IHL to the malicious use of information and communication technologies (hereinafter — ICTs), the main focus of the study is on the existing sources of IHL (Geneva Conventions, Additional Protocols, principles), customary international law as well as judicial decisions and legal teachings as subsidiary means for the determination of rules of law. Special attention is paid to the positions of the Russian Federation and the United States on the issue of the application of IHL to cybernetic activities. The author concludes that a cyber-attack on personal data can qualify as a military operation, an attack and a prerequisite for the outbreak of an armed conflict, and offers possible qualification criteria. At the same time, “stretching” jus in bello to the activities involving ICTs creates threats for the international community due to prospective militarisation of “cyberspace”.