A Biblical Lesson
According to Mark 2:22 in the King James Bible: “And no one pours new wine into old wineskins. Otherwise, the wine will burst the skins, and both the wine and the wineskins will be ruined.” There was a sound basis for this parable. In ancient times, leather flasks were used to hold wine. When wine was first poured into a wineskin, it would ferment and release gasses which forced the wineskin to expand. Before the wineskin reached its point of maximum stretch, the wine would (hopefully) stop releasing any new gasses. This way, both the wine and the skin would be safe. However, if one tried to reuse the skin by placing new wine inside, the fermentation process would begin once more, and the old (already weakened) wineskin would likely burst. This would result in the loss of both the vessel and (more worryingly) the contents. Today, this biblical lesson is used to express the idea that old systems are often unsuitable for accommodating new phenomena.
The Notion of a Cyber Levée en Masse
One such old system is the notion of the levée en masse in international humanitarian law (IHL) (also known as the law of war or the law of armed conflict). Centuries old, he levée en masse is can be traced back to Article 51 of the Lieber Code 1863. Its most recent formulation can be found in Geneva Convention III 1949 which provides, at Article 4(A)(6), that a levée arises when “[i]nhabitants of a non-occupied territory … on the approach of the enemy spontaneously take up arms to resist the invading forces.”
When this happens, individuals who would otherwise be considered “civilians” are recategorized as “combatants” and given both the rights and obligations of combatant status. In other words, they can legally fight and are entitled to prisoner of war status upon capture. This also means, however, that they can be directly targeted by the enemy. This recategorization occurs on a strictly temporary basis for a period before civilian status resumes, perhaps because the invasion ends through victory or defeat or because the individuals are deemed to have been organised more formally into the war effort. This sort of mass uprising was precisely the reaction that recently occurred when Russian forces invaded Ukraine. Ukrainians rose in defence of their homeland alongside the more formalised military and militia groups.
The bulk of the repulse effort in Ukraine involved people taking up machine guns and preparing ‘Molotov cocktails’ to hurl at Russian invaders. This was even encouraged by the Ukrainian government, with Volodymyr Zelenskyy tweeting that his government would “give weapons to anyone who wants to defend the country” and urging people to “be ready to support Ukraine in the squares of our cities.” The rules concerning levées en masse were designed to accommodate precisely this sort of traditional, kinetic activity. However, a sizeable proportion of the response of the Ukrainian population was based on the new phenomenon of cyber-attacks, with individuals using computers to launch electronic attacks against Russian forces and the Russian State in general. For example, there were “unusually large denial-of-service attacks” in which hackers flood a website with traffic to knock it offline. In at least one case, hackers successfully defaced the website of Russia Today and replaced headlines and articles containing the word “Russia” with the word “Nazi.” Other cyber-attacks might include stealing information, corrupting data, hijacking networks, and even shutting networks down.
Bursting at the Seams
Pouring the “new wine” of population-launched cyber-attacks into the “old wineskin” of the levée en masse framework is causing the latter to burst at the seams, as it struggles to contain the bubbles and froth that emanate from this complex new mode of warfare. Six criteria must be fulfilled for an individual to participate legitimately in a levée en masse: (1) there must be an international armed conflict, (2) the individual must be an inhabitant of the attacked State, (3) the individual must act spontaneously, (4) the territory must be unoccupied, (5) arms must be carried openly, and (6) the laws and customs of war must be respected. If any of these criteria are not met, the individual is ineligible for the duties and protections of combatant status that accompany levée en masse participation and they instead become unlawful belligerents with scant legal protection.
Strains emerge when applying the levée en masse criteria to cyber-attacks. For example, regarding the inhabitation requirement, inhabitants are likely to have the capacity to launch strikes from overseas, if they were abroad before the invasion began or if they can find a way out of the country after it has started. This is worrying as such individuals are potentially targetable notwithstanding the fact that they are in a different country. Thus, the invading State might be tempted to violate the prohibition on the use of force against other States, found in Article 2(4) of the United Nations Charter, in order to retaliate against such individuals. There is also the more general attribution problem of trying to establish the origin of cyber-attacks, as it is difficult to ascertain which individual(s) actually launched them and whether they were inhabitants of the attacked country.
Furthermore, the requirement of non-occupied status of the territory revolves around physical territory. The significance of physical territory, however, begins to melt away in the cyber context. For example, fighters on the ground may be able to tell when an area is occupied, but how is a cyber attacker to know whether a given area of territory is occupied or not? Conversely, could we say, that territory is effectively occupied when it has been subjugated wholly or partly by cyber-attacks? For example, if Russia takes control of a Ukrainian city through a combination of traditional and cyber-based force, this arguably results in occupation of territory and thus precludes a levée en masse in that area. Instead, the law on occupation takes over.
Regarding the requirement of open carrying of arms, targetable individuals who participate in a levée en masse are required not to conceal their weapons to ensure that they distinguish themselves from un-targetable civilians. In other words, an open carry rule applies in which combatants cannot conceal their weapons during an attack or during the preparation of an attack with a view to feigning civilian status. This open carry rule displaces the normal requirement in war to wear a fixed and distinctive sign recognizable at a distance, as required under Article 4A(2)(b) of Geneva Convention III 1949, on the basis that there may not have been enough time to agree on (or to fabricate or disseminate) such signs. However, it is hard to see how the requirement to carry arms openly transposes to the virtual theatre of warfare. How does one “carry” or “display” cyber capabilities in such a way as to advertise one’s combativeness to an enemy online? It has been suggested by the International Committee of the Red Cross (ICRC) that the provision to carry arms openly “is intended to guarantee the loyalty of the fighting, it is not an attempt to prescribe that a hand-grenade or a revolver must be carried at belt or shoulder rather than in a pocket or under a coat.” Thus, arguably, this requirement is satisfied by cyber attackers provided they simply do not use IHL-protected infrastructure (such as hospital or school software and hardware) to launch a strike. However, that suggestion conflates distinction during levée en masse participation with the rules on perfidy in a manner that seems to rob the former of any meaning.
Finally, regarding the IHL requirement, it is difficult even in conventional wars to ensure that levée en masse participants are trained in the basics of the laws of armed conflict. Often, outreach workers from organisations such as the ICRC and Geneva Call will travel around camps to instruct people on what may and may not be done. However, this task becomes more difficult when people can fight from their homes, or even from overseas locations, in a disconnected and largely invisible manner.
Conclusion
The framework designed to accommodate levées en masse is a product of the mid-nineteenth and early-twentieth centuries. To attempt to use this regime to regulate the emerging phenomenon of cyber-attacks directed by individuals against States risks stretching the regime beyond its limits. This is in the interests of neither the levée en masse framework nor cyber warfare. Perhaps it is time to invest in a new wineskin by developing a bespoke regime designed specifically to marry the regulation of popular uprisings with the reality of public-led cyber-attacks.
Elliot Winter is a lecturer (assistant professor) in international law at Newcastle University in the United Kingdom.
