Rules of cyberwar: don't target nuclear plants or hospitals, says Nato manual

Handbook drawn up for Nato's Co-operative Cyber Defence Centre of Excellence attempts to codify how international law applies to state-sponsored online attacks
Bushehr nuclear power plant
The Bushehr nuclear power plant in southern Iran. The Stuxnet attack on Iran’s nuclear programme is widely believed to have been created by the US and/or Israeli. Photograph: Atta Kenare/AFP/Getty Images

State-sponsored cyber-attacks must avoid sensitive civilian targets such as hospitals, dams, dykes and nuclear power stations, according to the first advisory manual on cyber-warfare produced for Nato, which predicts that online attacks could in future trigger full-blown military conflicts.

The attempt to codify how international law applies to online attacks includes a provision for states to respond with conventional force if aggression through hacking into computer networks by another state results in death or significant damage to property.

The handbook, written by 20 legal experts working in conjunction with the International Committee of the Red Cross and the US Cyber Command, says full-scale wars could be triggered by online attacks on computer systems. It also states that so-called "hacktivists" who participate in online attacks during a war can be legitimate targets even though they are civilians.

The group of experts was invited to draw up the handbook by Nato's Co-operative Cyber Defence Centre of Excellence (CCDCOE) in Tallinn, the Estonian capital. The project took three years.

The centre was established in 2008 following a wave of cyber-attacks on the Baltic state from inside Russia. The denial-of-service attacks crashed websites and damaged Estonia's infrastructure, raising awareness about the damage that online operations can inflict in an increasingly computer-dependent era.

In January David Cameron announced that the UK would be joining the CCDCOE this year. The UK ambassador to Tallinn, Chris Holtby, said then: "The UK will send an expert as well as continue the wider co-operation between the UK and the centre which already exists. The UK values strongly the work of the centre and looks forward to increasing our contribution."

The Tallinn manual, which contains 95 "black letter rules", was formally launched at the London thinktank Chatham House last Friday.

Colonel Kirby Abbott, an assistant legal adviser at Nato, said at the launch that the manual was now "the most important document in the law of cyber-warfare. It will be highly useful."

Professor Michael Schmitt, director of the project, who works at the US Naval War College, said there was relatively little consensus about how existing legal regimes governed online activities. The Stuxnet attack on Iran's nuclear programme, which physically damaged sensitive centrifuges, divided opinion among experts in the Tallinn group as to whether it constituted an armed conflict. The computer worm is widely believed to have been created by the US and/or Israel.

Rule 22 of the handbook states: "An international armed conflict exists whenever there are hostilities, which may include or be limited to cyber operations occurring between two states or more."



Formulating a framework for permitted counter-measures should not lower the threshold for future conflicts, Schmitt told the Guardian. "You can only use force when you reach the level of armed conflict. Everyone talks about cyberspace as though it's the wild west. We discovered that there's plenty of law that applies to cyberspace."

It is often difficult to locate the source of an online attack. Publicity last month about a tower block in Shanghai said to contain a Chinese army unit and to be the source of numerous global cyber-attacks highlighted the difficulty of proving who is responsible for causing damage to computer systems.

Rule seven of the manual declares that if a cyber operation originates from a government network, "it is not sufficient evidence for attributing the operation to that state but is an indication that the state in question is associated with the operation".

The handbook says that, in accordance with Geneva conventions, attacks on certain key civilian sites are outlawed. Rule 80 of the handbook states: "In order to avoid the release of dangerous forces and consequent severe losses among the civilian population, particular care must be taken during cyber-attacks against works an installations containing dangerous forces, namely dams, dykes and nuclear electrical generating stations, as well as installations located in their vicinity." Hospitals and medical units are also protected as they would be under rules governing traditional warfare.

The handbook is not official Nato document or policy but an advisory manual. It is published by Cambridge University Press. A retired UK air commodore and several British lawyers were among those who worked on the project.

In 2010 the UK's national security strategy characterised cyber-attacks, including those by other states, as one of four "tier one" threats alongside terrorism, military crises between states and major accidents.

This article was amended on 26 March 2013. The original article, and subheading, said the report was the first attempt to codify how international law applies to online attacks. It is the first produced for Nato, but the EastWest Institute produced a report on rules for governing cyber conflict in 2011.