This could be a really big deal — apparently, according to media reports, the first kinetic strike on a cyber operations center in response to offensive cyber operations. The question is whether this will be seen as a one-off or the first example in the emergence of a new norm. And a second question is whether the cyber attack, if it was a cyber attack, was the trigger for the Israel Defense Force’s (IDF’s) use of kinetic fires — delivery of ordnance against a target — in self-defense.
The law of armed conflict, most of which developed long before the age of computers, is predictably silent on its application to cyberspace. Not surprisingly, law of armed conflict experts have had to analogize traditional concepts to cyber operations and cyber warfare. In an attempt to normalize some of the rules, even in a non-authoritative manner, the NATO Cooperative Cyber Defense Center of Excellence in Estonia commissioned a group of experts to gather to write a sort of restatement of the law. The result was known as the Tallinn Manual on the International Law Applicable to Cyber Warfare.
Rule 30 of the Tallinn Manual notes “a cyber attack is a cyber operation, whether offensive or defensive, that is reasonably expected to cause injury or death to persons or damage or destruction to object.” A cyber operation which rises to the level of a cyber attack, then, triggers the right to self defense under Article 51 of the UN Charter. In this case, if one assumes the IDF made a specific determination the Hamas cyber operation rose to the Rule 30 threshold, and then used force in response, that would be a case of first impression, at least in the unclassified arena.
Still, I’m a bit of a skeptic and want to see more facts unfold: if the cyber operation were directed from a “Hamas-controlled compound” and the IDF was already engaged in armed conflict with Hamas, and the Hamas-controlled compound were a legitimate military target for some other reason, such as being a Hamas command and control facility, the compound could have been targeted anyway under the law of armed conflict, regardless of the cyber attack. To me, at present, the nexus between the cyber operation and the IDF use of force is not clear enough to draw the link between the cyber attack and the kinetic response.
Finally, some commentators have been linking the US unmanned strike on ISIS leader and UK citizen Junaid Hussein as a kinetic strike against a cyber operator. Hussein was much more than merely a hacker, and the strike on him was carefully planned and grounded on his role as an ISIS leader, not solely on his hacking and cyber activities. In fact, the Hussein strike may serve as more of a precedent for decoupling the cyber operation from the kinetic fires, rather than as a precedent for linking them.
At some point, some military actor is going to conduct a cyber operation, and only a cyber operation, outside the context of an armed conflict, and another military actor is going to see it as an attack justifying self-defensive fires solely because of the cyber attack. I am just not as confident as the media that day was this week.
