Civilian cyber-hackers engaged in conflicts have been warned not to target hospitals or release uncontrollable malware that could terrorize civilians after the International Committee of the Red Cross (ICRC) issued eight rules of engagement to reduce the impact of hacktivism on civilian life.

The ICRC – which is responsible for overseeing and monitoring the rules of war – says that large numbers of Ukrainian civilian cyber-hackers have joined patriotic cyber-groups since the beginning of the war with Russia. Similar groups have also been formed in Russia to attack Ukrainian targets, according to the Red Cross.

But the actions of some hackers are putting the lives of civilians at risk. A statement released by the organization and sent to cyber-hacking groups has warned that hackers are impacting banks, hospitals, railway networks and government agencies. In doing so they are failing to comply with existing humanitarian laws that also apply to individual and groups of hackers.

READ MORE

UK musicians say Brexit is killing their careers

Environmentalists warn of dangers posed by Slovakian dam

As well as impacting the lives of ordinary people, the ICRC says civilian hackers are also putting their own lives – and their loved ones – at risk, if they are found to be targeting a country and subsequently become a legitimate military target.

"We've been contacted by private hackers and groups," ICRC thematic legal advisor Tilman Rodenhauser told CGTN Europe. "They want to know what the rules are. If they attack civilian infrastructure and are prosecuted or captured they are not protected by international humanitarian law in the same way that soldiers are."

The ICRC's eight rules for civilian hackers during war

1. Do not direct cyber-attacks against civilian objects

2. Do not use malware or other tools or techniques that spread automatically and damage military objectives and civilian objects indiscriminately

3. When planning a cyber-attack against a military objective, do everything feasible to avoid or minimise the effects your operation may have on civilians

4. Do not conduct any cyber-operation against medical and humanitarian facilities

5. Do not conduct any cyber-attack against objects indispensable to the survival of the population or that can release dangerous forces

6. Do not make threats of violence to spread terror among the civilian population

7. Do not incite violations of international humanitarian law

8. Comply with these rules even if the enemy does not

A hybrid conflict

Ukraine's conflict with Russia has blurred the lines between military and cyber-conflict, say some experts. Ukrainians have been encouraged to join patriotic cyber-groups, such as the 160,000-strong 'IT Army of Ukraine,' to attack Russian infrastructure.

The group has banned attacks on hospitals and other healthcare facilities but a spokesman told the BBC that the impact on civilians was "unavoidable" and abiding by the rules could put one party at a "disadvantage."

Ukraine and allied countries have accused Russian based groups of regular attacks, disabling websites temporarily and targeting hospitals. Pro-Russian groups have been accused of directly working with the Kremlin, but have routinely denied any links with the state.

Rodenhauser says states must take responsibility for ensuring hackers operating within their territories stay within the rules of engagement. "The first step is that states must communicate the rules of engagement to hackers," he said. "If they fail to comply the next step is to punish them. We've already seen this happen in some countries."

Misinformation spread by hackers online is also the responsibility of individual states, says Rodenhauser. "It's not up to technology companies to implement humanitarian law," he added. "Tech companies should do their best to eliminate false information but it's up to states to enforce the rules of engagement."

What does international law say?

Article 36 of the 1977 Protocol I additional to the Geneva Conventions requires each state party to make sure that any new weapons it deploys or considers deploying – such as cyber-hacking – comply with the rules of international humanitarian law.

At the 28th International Conference of the Red Cross and Red Crescent, in 2003, states aligned with the Geneva Conventions called for a "rigorous and multidisciplinary review" of new weapons and means and methods of warfare, to make sure that the law's protection is not overtaken by the development of technology. 

Since then there have been repeated calls for updated regulations to guard against the impact of cyber-hacking. In 2017, Microsoft made the case for a digital version of the Geneva Convention to protect civilians from state-sponsored cyber-attacks, but that hasn't yet materialized.

Subscribe to Storyboard: A weekly newsletter bringing you the best of CGTN every Friday