6 ICT-related threats in today’s armed conflicts – and how to address them

By Tilman Rodenhäuser and Noa Schreuer, ICRC

Next week, the new UN Global Mechanism on ICTs in International Security will hold its first substantive session. Member States will come together to advance ‘responsible State behaviour’ in the use of information and communication technologies (ICTs). One reality that states have addressed in the multilateral processes that preceded the Global Mechanism is that ‘States are developing ICT capabilities for military purposes’ and that such capabilities – also referred to as cyber tools or activities – are used in today’s armed conflicts. In this short article, we present six key ICT-related threats that the International Committee of the Red Cross (ICRC) observes in armed conflicts around the world, and which the ICRC will present to states next week in a new working paper entitled ‘Preventing ICT Threats to Civilian Populations in Times of Armed Conflict: Six Humanitarian and Legal Priorities’. 

1. ICT operations disabling the provision of essential services 

ICTs have become an indispensable part of the lives of human beings throughout the world. In armed conflict, these technologies become vulnerable to threats. The use by states and non-state actors of ICTs in recent armed conflicts has shown that cyber operations can disable civilian infrastructure, damage or destroy civilian data, and disrupt the delivery of essential services. The consequences include power outages, the loss of access to life saving information, disruption of transport systems, banking, water supply, and food production. Alarmingly, ICT operations have not spared hospitals, aggravating the hardship suffered by the affected populations.

When we think about how international law, and especially international humanitarian law (IHL), addresses these threats, government lawyers and academics generally agree that ICT activities that cause physical damage (think about a plane crash caused by a cyber operation) must be considered similar to more traditional, kinetic attacks. However, such physical destruction is rarely caused by cyber operations. The more challenging question is therefore: can cyber activities which disable systems without causing physical damage be considered attacks under IHL? Our focus must thus turn to how to prevent and mitigate the danger of non-physical damage or destruction that cyber attacks cause to the data and the ICT systems that form the digital backbone of today’s digitalised world. 

2. ICT operations targeting medical facilities and humanitarian organisations

At the ICRC, we been voicing concern about ICT operations targeting medical facilities. These can have particularly serious consequences in times of armed conflict. Recent years have seen a significant number of ICT operations targeting hospitals and other medical facilities.

And unfortunately, we also know first-hand what it means when humanitarian organisations are targeted by ICT activities. These activities can range from distributed denial of service (DDoS) operations, to the intrusion of systems and exfiltration of sensitive data, to the disabling of computer systems aimed at disrupting humanitarian operations. They harm the targeted organisation and, more importantly, pose a real risk to the safety and dignity of the people they serve. 

The protections afforded to medical facilities and humanitarian organisations have been universally agreed red lines anchored in international treaties, including obligation to respect and protect medical units, transports, and personnel, and the obligation to respect and protect the life-saving work of humanitarian organizations. These lines must be upheld and defended – online and offline. 

3. Children on the digital battlefield

For over a decade, armed groups have reportedly used social media to recruit fighters, including children. And while this continues, ICTs are today also used to engage children as agents to conduct specific acts of violence in armed conflict. In addition, children no longer need to be in physically close to an armed force or group to join the fight, as they now also take part in conflict-related cyber operations.  

The use of ICTs has expanded the reach of recruiters who are now able to contact more children, more quickly, via online communities. This recruitment and use of children in armed conflict is unlawful and has harmful consequences for children. It is for states to prevent child recruitment and use in hostilities, in particular by equipping children and their caregivers with the knowledge and resources to recognise and resist online child recruitment and use in hostilities.

4. Civilian hackers targeting civilian infrastructure 

With new technologies come new actors. One set of new actors are hacktivists, or civilian hackers as we call them. Threat intelligence experts have counted dozens of such hacker groups taking part in inter-state conflicts since 2022. A key challenge is that many civilian hackers do not know or ignore the long-standing limits that international law imposes on ICT operations. In practice, some of these actors have directed their operations against civilian infrastructure and services, including medical facilities, food production, civilian transport infrastructure, civilian government services, and private businesses. 

If trends observed in recent conflicts can provide an indication of what lies ahead, one can assume that these actors are here to stay. Thus, states should come together to ensure that civilian hackers do not operate on the assumption that cyberspace is a ‘wild west’. This idea is long gone, and states must ensure that civilian hackers, too, respect IHL.

5. Technology companies in the crosshairs 

Technology companies operate and maintain much of the world’s ICT infrastructure – the infrastructure and services that facilitate civilian life in digitalised societies. Some companies also provide their infrastructure, assets, and services to warring parties. Recent events have shown that when civilian technology companies provide products and services to armed forces, there is a real risk that belligerents consider the assets, infrastructure, and employees of such companies as lawful targets. 

Attacks on the ICT infrastructure provided by technology companies can have wide-ranging effects on civilian populations. States and tech companies must be aware of this risk and should develop practical measures to prevent or mitigate these risks. One such measure could be to physically or technically separate the infrastructure, services, and products used in military operations from those used for civilian purposes. 

6. AI accelerating the scale and speed of harm caused by ICT activities

The past year has seen rapid technological advances in the field of AI, especially in the complex tasks that span the cyber kill chain. Today, state armed forces are reportedly integrating AI into their military ICT operations, as are some civilian hackers. In situations of armed conflict, we worry that this may heighten the risks of indiscriminate attacks, incidental civilian harm, damage to civilian infrastructure, and uncontrolled escalation. 

One message must be clear: the fact that new technologies are integrated into means and methods of warfare – traditional weapons or cyber operations – does not change the applicable rules. ICT operations in armed conflict, including those that involve AI or other emerging technologies, must comply with the existing framework on responsible state behaviour, first and foremost international law. Importantly, as militaries advance technological innovation, states should also advance – individually and collectively – measures to prevent risks to civilian populations posed by AI-enabled ICT activities.

***

With the number of armed conflicts around the world continuously rising, and the growing conflict-driven innovation in new technologies of warfare, multilateral fora like the UN Global Mechanism on ICTs in International Security provide a much-needed space to build shared understandings of global threats among states. These discussions should build on the significant progress on humanitarian ICT questions achieved by states over the past years. At the ICRC, we aim to bring the potential human cost of the use of new technologies of warfare to the attention of states, in the hope that they will collectively act to prevent these threats from materializing, or to mitigate the harm they cause.