In the first part of this post I discussed the position paper’s articulation of the views of France on the applicability of IHL to cyber operations, on the classification of armed conflicts, and on their geographical scope in the cyber context. In this part I will examine the position paper’s views on the concept of “attack,” on the conduct of hostilities and on data as an object.
The Meaning of the Term “Attack”
The issue of the meaning of the term “attack” has occupied center stage from the very inception of legal thinking about cyber operations during an armed conflict. It is a critical one because most key IHL “conduct of hostilities” rules are framed in terms of attacks – it is prohibited to direct “attacks” against civilians or civilian objects (distinction), an “attack” expected to cause collateral damage that is excessive to the anticipated military advantage is prohibited (proportionality), parties must take precautions in “attack” to minimize harm to civilians (precautions in attack), etc. These prohibitions, limitations, and requirements beg the question of when a cyber operation qualifies as an “attack” such that the rules govern it.