In September of 2019, Kudankulum Nuclear Power Plant’s (KNPP) administrative networks were found to be infected with malware, namely a program called DTrack. The National Power Corporation of India (NPCIL), which manages the plant, stated that the infected network and adjoining computers were used for administrative services only and thus the malware infecting them doesn’t pose any danger to the plant. But the thought of any nuclear power plant getting attacked is itself problematic and horrifying. And this thought becomes even more worrisome because most of the Nuclear facilities in India are in proximity to densely populated areas. Though this is not the first case of a cyber-attack on a nuclear facility. A worm named Stuxnet had infiltrated Iran’s Natanz Nuclear Facility and had affected much of its operation. Thus, the question arises, if any substantial harm is caused to a nuclear facility, then who will be held liable for the damage? In this post, I argue that if there is destruction of civilian property through cyber-attacks on nuclear facilities during an international armed conflict, then it shall constitute a war crime under the framework of International Humanitarian Law (provided that the mens rea part of the offence is also fulfilled).
International Humanitarian Law (IHL) is a body of international legislation that applies in the situation of armed conflict between two or more states. It is a treaty-based and customary law-based body of rules aimed at protecting people in the time of international armed conflict. The Geneva Conventions and their Additional Protocols (AP) are at the helm of regulating the conduct of armed conflict. But for the constituents elements of war crimes, it is appropriate to use the definition of the Rome Statute of the International Criminal Court. Article 8(2)(b)(ii) of the statute shall apply in the current scenario as it provides for commission of War crimes by attacking civilian objects. To satisfy this I will explain all the major elements which need to be satisfied conllectively. The major objective elements are, firstly, an attack must be directed, and secondly, it must be directed towards a civilian object.
Article 49 of AP I gives the meaning of the word “attack” as “Acts of violence against the adversary, whether in offense or in defense.” Michael Bothe and Waldemar Solf, leading jurists on the issue, noted that the phrase “acts of violence” denotes physical force. The ICRC documents recognize that cyber operations which result in physical damage to objects that go beyond the computer program or data attacked by means of viruses, worms, etc. could be qualified as “acts of violence.” Further, the case of Prosecutor v. Tadic has held that the violence here refers to the effects and not the means, i.e., the type of weapon used is immaterial. Michael Schmitt writes that such developments mean that acts which have violent consequences would be covered under the ambit of word “attack.” Lastly, this point has been further strengthened by the International Court of Justice in its advisory opinion which has held that states must never use weapons which are incapable of distinguishing between civilian and military targets. Therefore, cyber-attacks duly come under the meaning of “directing an attack” if it leads to loss of life or any damage to civilian object, or at the least, if its consequences are violent.
Secondly, it is submitted that nuclear power plants, used for generating electricity only are civilian objects, unless proved otherwise. Under the IHL regime, the principle of distinction is employed to differentiate between civilian and military objects. This principle is provided in Article 48 of AP I, and it inculcates a two condition test which has to be proved simultaneously. For any object to be a military object, firstly, nature, location, purpose or use of the objects must make an effective contribution to military action, and secondly, its total or partial destruction, capture or neutralization must offer a definite military advantage in the circumstances ruling at the time. More importantly, The judgement of Gotovina et al. reveals that even military necessity cannot justify such destruction of civilian objects unless the aforementioned test is fulfilled. Moreover, Article 56 of AP I further curtails the scope of military necessity by stating that protection against the attacks can only be given if there was no alternative other than the attack on the nuclear power station.
Thus, to gain the immunity of international law, a perpetrator has to prove that firstly, the nuclear facility was making a significant contribution to military activities and attacking it has proffered the perpetrator, a definite military advantage over the other. Secondly, it also needs to be shown that there was no other alternative left. Surely the bar set to attain protection under the aegis of IHL for such conduct is very high.
Every crime has two parts in it, i.e., guilty behaviour, and a guilty state of mind. Until now, this post has dealt only with former. For the latter part, it is required that perpetrator must have the intention of directing the attack on a nuclear plant, i.e., a civilian object. I believe it is important to lay down the subjective requirements of the crime to provide more clarity to the issue.
Firstly, the ICC in the decision of Abu Garda stated that to prove the requirement of intention to direct an attack, it must be shown that not only there was a presence of standard mens rea, but also of dolus directus of the first degree, or concrete intent. The same views have been echoed by many jurists in the past, including William Schabas. Secondly, it also has to be proved that perpetrator must have the intention that the object of the attack is civilian property. The International Criminal Tribunal for the former Yugoslavia (ICTY) has ruled that the attack must have been conducted intentionally and for the perpetrator it was impossible not to know that civilian objects were being targeted. Lastly, if it is an international armed conflict, it must be shown that perpetrator was aware of the circumstances that established the existence of an armed conflict.
Thus, it is pertinent to note that the differences between the quantum of guilt adduced for the various subjective elements of the crime. In the first case, where it has to be proved that perpetrator had the intention to direct the attacks, the bar to prove the guilt for the crime has been set very high, i.e., concrete intention to direct the attacks must be shown against the perpetrator. Whereas, the burden to prove the intention with respect to the object of the attack is much lower. From the loose language appended by the court, it seems as if even if the perpetrator had reason to know about the object, but for his negligence, recklessness or otherwise, was unaware of it, then liability would still be imputed to him.
In today’s world, cyber-attacks are becoming a convenient mode of causing violence, loss of economy, destruction of properties, etc. Though attacks on civilian objects such as nuclear facilities find their place in the Additional Protocols, cyber-crimes, being relatively new, are still in a nascent stage with limited laws regulating and penalizing them. Thus, it becomes pertinent for laws to be interpreted in such a way so that these modes of violence can be covered under the ambit of existing framework of this legal regime, or alternatively a new code shall be put forth by jurists so as to inculcate changes in the legal framework with changes in society. As cyber-attacks are just a means and not the end of conflict mechanism and simultaneously law requires the ends to be violent, cyber-attacks come under the ambit of the term “attack.” Thus, cyber-attacks on nuclear installations are very well covered by IHL. This interpretation is resonated by many jurists, especially, by Michael Schmitt, in his most exemplar work, Tallinn Manual. Therefore, any cyber-attack on a nuclear power plant, which results in the violent consequence, such as destruction of property or lives, would be a war crime, if it is coupled with the requisite intention of the perpetrator provided by the law.
Aditendra Singh is a second year B.A. LL.B. (Hons.) student at National Law University, Delhi.
Suggested citation: Aditendra Singh, An International Humanitarian Law Perspective on Cyber Attacks Against Nuclear Facilities, JURIST – Student Commentary, May 15, 2020, https://www.jurist.org/commentary/2020/05/aditendra-singh-cyber-attacks-nuclear-plants/
This article was prepared for publication by Tim Zubizarreta, JURIST’s Managing Editor. Please direct any questions or comments to him at commentary@jurist.org
