The Application of the Principle of Precaution in the Planning of Cyberattacks

Abstract

The article examines the elements of the principle of precaution in the planning of cyberattacks in the context of the application of international humanitarian law to contemporary armed conflicts. The relevance of the topic is determined by the fact that cyberattacks may affect not only military systems but also civilian infrastructure necessary for ensuring the vital needs of the population. In cyberspace, the distinction between military and civilian objects is often technically blurred, since the same networks, servers, software platforms, data-processing systems or communication channels may simultaneously be used for military and civilian purposes.
It is substantiated that the principle of precaution, enshrined in Article 57 of Additional Protocol I to the Geneva Conventions of 1949 and confirmed by customary rules of international humanitarian law, cannot be interpreted in cyberspace merely as a formal requirement to verify the military character of a target. Its content includes functional assessment of a digital system, analysis of its connection with civilian services, verification of the controllability of the cyber means, assessment of the risk of self-propagation of malicious code, anticipation of direct and indirect consequences, and selection of a less harmful alternative where several possible ways of achieving a military advantage are available.
Particular attention is paid to the loss of functionality, the status of computer data and the cascading effects of cyberattacks. It is demonstrated that, for assessing the lawfulness of planning a cyberattack, not only the possibility of physical damage to an object is relevant, but also the risk of disrupting the functioning of systems on which the civilian population depends. The article concludes that the principle of precaution in cyberspace should be understood not only as an obligation of restraint, but also as an obligation of proper prior knowledge of the digital environment. The limits of this obligation are determined by the criteria of practical feasibility and reasonable foreseeability; however, the technical complexity of cyberspace cannot justify superficial planning or the disregard of obvious risks to the civilian population.