Should Cyber Arms Be Treated Like Bioweapons?

In an important contribution, Jeffrey T. Biller and Michael N. Schmitt argue that cyber capabilities are not “weapons” or “means of warfare,” but can be “methods of warfare” under international humanitarian law (IHL). These conclusions challenge the prevailing notion, contained in the Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations, that cyber capabilities can be weapons and means of warfare. Biller’s and Schmitt’s claim is that, unlike other military technologies, cyber capabilities do not cause direct harm to people or property. “Having a damage mechanism with the ability to directly inflict the damaging or injurious terminal effect on a target is,” they write, “the litmus test for qualification as a means of warfare.” When computer code is deployed, “the harmful effects are . . . indirect; they are not terminal vis-à-vis the code.” Harmful effects directly arise from the operation of the target system infected with the code, rather than from the code itself. “Therefore,” they conclude, “computer code and associated systems cannot qualify as means of warfare.”

For much of article, I nodded in agreement as the argument unfolded. With one exception, which produced a quizzical tilt of the head.

Biller and Schmitt observe that biological weapons are “beyond question” a means of warfare because the biological agent’s “damage mechanism is...terminal” as the agent “directly inflicts the harm.” However, they appear to conflate biological agents with toxins in stating that “[t]ypical biological toxins include bacteria, rickettsia, fungi, and viruses.” Not all biological agents are toxins or generate morbidity or mortality through toxins.

Some agents, such as anthrax, produce toxins that directly damage cells and organs. Other pathogens considered biological weapons trigger a cascade of adverse physiological reactions in the host that contribute to, or cause, illness or death. In addition, fears about biological weapons include how inadequate health systems can exacerbate pathogenic damage. Put another way, many harmful effects of biological agents directly arise from the operation of biological and social systems the pathogen affects, rather than from the pathogen itself.

Related: Suspected Iranian Cyber Attacks Show No Sign of Slowing

Related: States Must Explain When a Cyber Attack Might Draw a Violent Reprisal

Related: NATO Getting More Aggressive on Offensive Cyber

The smallpox virus is one of the most feared biological weapon agents. How the virus causes disease and death is complicated and does not simply involve the virus killing cells. Responses of the immune system factor significantly in the morbidity and mortality associated with smallpox. The virus interferes with the normal functioning of the immune system, which over-reacts in ways that seriously harm the body. A review of smallpox in Clinical Infectious Diseasesstated that “many features of severe illness...were the result of host inflammatory responses. In severe cases, the release of cytokines, chemokines, and other mediators into the bloodstream caused vascular dysfunction, coagulopathy, and multiorgan failure, resembling septic shock.” Smallpox also generates concern because most countries do not have adequate health capabilities to address re-emergence of the smallpox virus.

Whether biological agents are “means of warfare” or only “methods of warfare” based on direct or indirect effects has not been a major policy or legal question. Smallpox and other pathogens that cause adverse biological and societal cascades are considered “repugnant to the conscience of mankind” because of the totality of their direct and indirect effects. The indirect effects of pathogenic infection are proximate to the direct action of the pathogen on the host and sufficiently severe in the human body and the body politic to take into account.

This treatment of biological agents perhaps suggests that deciding whether cyber capabilities constitute a means of warfare should involve consideration of the nature and scale of indirect effects and not just the direct effects of code on target computer systems. The indirect effects of malware can be proximate to the direct impact of the code and, potentially, severe enough within the target system and beyond to warrant inclusion in the determination of a means of warfare.

However, reasoning from biological analogy is not persuasive. International law bans the development and use of biological agents for non-peaceful purposes. Indeed, biological agents are one of the few areas in which states have banned specific technologies as means of war. Many of these bans reflect heightened concerns about the direct and indirect effects these technologies can inflict on people and societies. So far, cyber capabilities and operations have not generated fears about such grave, gruesome, and repugnant threats to human life, health, and social order.

As a method of warfare, cyber operations that constitute attacks would, Biller and Schmitt note, “still have to comply with all [IHL] prohibitions and limitations that apply to attacks.” Thus, the likely indirect effects of cyber capabilities would not escape scrutiny. Further, the nature and complexity of military cyber operations, military-civilian interdependence in cyberspace, and civilian dependence on cyber technologies counsel early and comprehensive technical, policy, and legal consideration of the potential direct and indirect effects of such operations, regardless how cyber capabilities slot into legal definitions of means or methods of warfare. Whether such prudential handling of cyber capabilities keeps indirect effects tolerable as military cyber operations expand remains to be seen.

This piece, first published by the Council on Foreign Relations, is used with permission.

Related podcast: