Good morning, afternoon everybody. My name is Sandrine Bayeu. I work as a staff software engineer at ARM and I work on the trusted firmware A open source project. I've been working on this project for quite some years from the beginning of the creation of the project in fact. And so this is going to be the subject of this presentation. We're going to give you a technical overview of this project. So I'm co-presenting this with Joanna Fally who is the engineering manager in my team. And without further ado I'm going to hand it over to her. Thank you Sandrine. So as Sandrine said today we're presenting the trusted firmware A class project. And I'm going to be giving you a brief overview of some of our base features. And then Sandrine will take over towards the middle of the presentation to give you an update on some of our more recent features that we're either currently working on or just delivered. So as I said I'm going to give an indication of the foundational features. So what is trusted firmware A class? So TFA as it is often known for short is a reference implementation of firmware for the ARM A class processors. So A as in the application class. So this is Cortex A for client devices and Neoverse for the infrastructure device market. A lot of our work with this reference implementation requires us to work closely with a group that produce within ARM that produces software and architecture and hardware specifications. And what we try to do is provide a reference implementation that is compliant to these standards. So the project has been going approximately since 2013 so roughly seven years now. And it's a reference implementation of the ARM trust zone architecture. That has two states and as you can see in the diagram that's the normal world and the secure world. As well as the two different worlds we have these what are called ELs or exception levels that represent the levels of privileges that are available at those exception levels. And as you can see in the diagram you've got applications and the kernel hypervisor and then at the highest EL level we've got the firmware. So typically the relationship between the normal and the secure world is master slave relationship where the normal world communicates to the secure world through the SMC layer and that's the secure monitor core layer. This is a defined specification as I mentioned that ARM produces that indicates how parameters should be passed through registers and return value and it's a synchronous exception model. So for the TFA project the bits outlined with the purple line are the components that are included in the the source code of the TFA project and the goal is to provide the foundation for a trusted execution environment in the secure world. So it's an isolated execution environment it's a high level of security and this is where trusted OS is and trusted applications can normally provide services from to the normal world. So the code is designed to be reusable for different platforms and what we have is a some core code as well as a platform code that has been upstreamed from consumers of the of the repository and it's approximately 350,000 lines of code but a third of it is the core code and the other two-thirds are the various different upstream platforms of which there's about 30 coming from approximately 15, 16 plus vendors. The code is 90% C and 10% assembler code and there are many build options to support different aspects of the architecture. It is released under the BSD 3 clause so there's almost unlimited freedom to consume the code base and so it's very consumer friendly and we also take contributions under the developer certificate of origin that allows a more relaxed contribution model than having to go through any sort of legal contract to release patches and code to the repository. Since around about 2018 it's been transitioned to the trustyfirma.org organization as an open governance project as opposed to an arm-run open source project and TFA is a number of one of a number of them a firmware project that is under this umbrella. It's not the objective of this presentation to talk about all of those but I would urge people interested to go to the trustyfirma.org site and explore the other offerings that are available there. We have approximately a six month release cycle so we have a single master tree that we tag with a very lightweight process for when we do releases and we have an ongoing CI continuous integration system that helps maintain the quality patch by patches that are merged into the project. You may notice there's a gap at EL2 in the secure world level and one of the features that Sandrine will be talking about later will be this secure partition manager which is a new capability that is being provided. So if we look at the boot flow we have a number of BLs or bootloader images that are provided. So the first BL1 and BL2 are very transitional transient images that only last around for a period of time until we can get to the BL31 image which is the persistent image that you saw in the previous diagram. So BL1 is the first code executed and it's pulled from ROM and it provides a minimal level of initialization to be able to authenticate the BL2 image which is an updatable image and also hand off to that image. So the BL2 image provides some additional initialization and again it loads and authenticates the persistent firmware image the runtime resident BL31. BL31 also known as the EL3 monitor firmware has primary purposes to handle the transitions between the normal and the secure worlds and offers runtime services. There are other images that are outside the remit of the TFA project in the diagram and also shown here and these are commonly the BL32 which is the trusted OS in the secure world and also BL33 which is normally a normal world bootloader that often leads to the you know the booting of a rich OS like Linux or Android or a hypervisor. The boot flow has the capacity to have more platform specific images to be created but that isn't part of the core code that's up to the various platform providers. So trusted boot. So previous slide I talked about the boot flow but one of the big aspects of this project and it's hinted at in the name is that we need to trust the boot process and it's all about trust and there's another arm standard that architectural standard that we look to be compliant with and that is the TBFU the trusted boot firmware update and this allows the design of a more trustworthiness mechanism through something called the chain of trust for the firmware images and this is where the different images are signed with a key a cryptographically private key that is used to sign all the firmware binaries and then as you go through the the boot process that can be verified with the public key. So the images are signed with the root of trust public key the ROTPK and that is available from the BL1 for verification and that is in the ROM image that originates the boot process. Key here is to note that if any of these authentication steps actually fail we stop at that level and we fail too and we stop and refuse to boot. There's an optional cryptographic hardware option that could be used that might be more efficient than some devices for the software rather than software verification on the CPU. So multiple signing domains is a mechanism where we can have multiple roots of trusts for different images and it's a mechanism that's currently under development and it better reflects an ecosystem that's made up of multiple silicon providers ODMs, OEMs and OS these where different images might be coming from different sources and it helps to alleviate the problem of everybody having to use a common root of trust. In addition to the firmware signing sorry the firmware image signing at build time and verification at low time we can have image encryption at build time and decryption at load time. Power management is another key aspect that's architected and specified in the ARM architecture and this is the PSCI specification the power state coordination interface and here it's key that the software images must interoperate when power is being managed. So this is for core idle management dynamic condition and removal of cores secondary core boot and system shutdown and reset and TFA provides a PSCI runtime service that provides this management to the lower level ELs through the SMC calls. There is there on some devices the possibility of having a separate micro controller mic processor often referred to as the system control processor that performs and has responsibility for the power management functions. As I said this may not be present on all designs and for interfacing to this there is a system control and management interface standard specification that is used and this specifies the interface for power domain performance clock sensor and reset domains and various functions and the TFA code base provides a compliant reference implementation of a by an SCMI driver and in this particular model all power management is delegated to the SCP through that interface. Another aspect that's quite important is exception handling so the specification the SDEI the software delegation exception interface is a standard for delivering critical system events. The TFA provides a compliant reference implementation of this and again it's managed through SMC calls where you can register callbacks from the iOS and hypervisor from the upper levels of the ELs and when triggered exceptions are passed to and serviced by those the OS and hypervisor. When these events are triggered it's expected that they will preempt any critical sections and in those in the OS or hypervisor layer. It's important to note that not not shown here is a more general firmware interrupt management handling system and these these systems need to coexist. So platforms through the SDEI can make use of two levels of event priority and they can be the hardware or software generated. Examples could be hardware failures say for every corrected memory failure or they could be in the ability to do profiling say for instance so you could profile when every 100 SMC calls are being performed or have been processed or it could be for debugging. A debug UART event is another type of exception. In the current implementation of TFA we we do support platform error handling through RAST reliability availability and serviceability, routing RAST events up to the normal world to be be handled. So the ARM architecture is constantly evolving. The hardware architecture updates are generally provided yearly. They often blog about in around the September time zone time range and they are then made more formally available in the ARM ARM architectural reference manual in the following spring and these various features support the usage of the ARM V8 architecture in multiple types of markets whether they're client devices like phones and laptops. Infrastructures like servers, network switches, IoT, smart edge devices and automotive so vehicles. The TFA code base and repository involves to support these new architectural features as necessary. Features are added to the master branch as they're implemented but as you can see on this slide we actually in our six month tagging we formalize their availability. So that is a rundown of some of the base features that TFA provides and I'm now going to pass back to Sandrine to give you more ideas of some of the newer features that we're working on. Thank you Joanna. So the first feature that I'd like to talk about is the idea of making the firmware more generic. So the situation today is that whenever you compile your firmware you compile it for a specific platform and that binary only runs on this specific platform. It won't work on another one and that's because all the platform information is expressed through a number of platform header files. You can see an example of this on the right hand side where we have the ARM platform header files defining stuff like the memory map, the interrupts, some of the device settings and so on. So all this information is built into the firmware and that makes a specific binary specific to your platform and what we'd like to do is to have instead a single firmware stack that is able to run across a range of platforms. So this is not a new idea. I'm sure all of you are aware that that's how it works in the Linux kernel today. You usually compile your Linux image for a specific architecture for example ARM64 and then it runs on all ARM64 platforms provided that you have the right device tree for your platform. So we'd like to do something very similar for the trusted firmware and move all differentiating configuration options to a configuration file that the firmware would parse at boot time to self-configure itself for this specific platform. Now we realize that such a feature is not free. It does have performance overhead because obviously you need the code that will parse the configuration file. It also increases the memory footprint to include this additional code in the image and also to load the configuration file and it just adds more complexity to the firmware. So for some other devices for example highly constrained devices this is not something that might be desirable. They might still want to continue having a tailored firmware for their platforms but even for these devices we believe that it would be a good idea to use configuration files to express platform data anyway because we could have a tool that runs on the build host machine that parses this configuration file and generates the platform header file that I've shown at the beginning of this slide and that way all platform data is expressed through the same mechanism configuration files rather than having a mix of configuration file and platform header files. So right now we are using the device tree format for this configuration files and we're using the libfdt to parse them at runtime. Now we might support alternate formats in the future but for now it's the only one. So along just to give you an idea of the kind of information that we would like to move in this configuration file. So aside from the traditional hardware configuration you would typically found in a Linux kernel device tree like the CPU topology some of the devices, base addresses or settings we could express secure firmware features for example. So Joanna talked about trusted boots previously having a Boolean flag that you can just toggle in this configuration file can be quite handy when you are in development mode because it enables you to enable or disable it without recompiling your firmware. Similarly you could have the log level in this configuration file to control the verbosity of the messages printed on the UART or the location of the images that the firmware needs to load and authenticate. This configuration file could be used also to pass information from one firmware stage to the next or even to the Linux kernel or the bootloader. Examples of that would be some memory that we have probed and we want to avoid the next firmware stage to prob it all over again so we could just pass this information in the configuration file or if we reserve some secure memory region and we want to tell to the Linux kernel that it's something that you should avoid accessing because it's a secure memory that's another thing we could put in the file. The last category of options we could put is configuration of a specific firmware component. DDR training parameters is a prime example because we've seen examples of platforms that are extremely similar and they only differ on the way they need to train the DDR so if we move this information to the file again you can use the same firmware across the two platforms. I'm sure most of you were already familiar with this concept so I would just like to give a bit more details about how we've implemented that in the trusted firmware just to give a different perspective. So we've based this code on the firmware configuration framework or fconf. That's a data abstraction layer to access this configuration data so basically we have different modules as you can imagine in the trusted firmware, the power management module, the IOLayer module and some of these modules will want to consume some of the data that is inside the configuration file so the way they would do that is that they would register a callback responsible for extracting the configuration data they are interested in. So here you've got an example where we call the fconf register populator macro and we want to extract the topology information out of the hardware configuration file and that extraction is done by the fconf populate topology callback that the module has to provide. For each call to this fconf register populator macro it actually registers the callback in a specific linker sections so all the callbacks are gathered in this section. So when the trusted firmware boots the configuration data needs to be passed so every callback that has been registered in the linker section is called and each one of them will go and pass the device tree and extract the information it needs. So here we've got an example where you could have a device tree with a CPU's node and the fconf populate topology callback is responsible for passing this node. It knows the bindings of these specific nodes so it can find information it wants and then it will populate a global data structure in this case the struct hardware topology with the different information it wants to keep. Later on the different module can query the global configuration data that has been extracted at step two. One example here is by calling this fconf get property and saying I want to retrieve the topology information out of the hardware configuration information and more specifically the plat cluster count information and that's the way it will get this specific piece of information. Now I've mentioned that this feature is not necessarily interesting for highly constrained devices because of the performance and memory footprint overhead it adds but even for these platforms some of these structures stays the same because the global data structure like the strict hardware topology can still be provided by the platform layer like static data and the way the rest of the code would want to access this configuration data does not change it's still going through this fconf get property macro whether this information has been extracted from a configuration file or whether it's provided statically by the platform layer so that's why in that sense fconf is a data abstraction layer to access this data. So now the second piece of development we've been working on lately that I want to talk about is some work we've been doing to re-architect the secure world software. So first of all let's take a look at how things look like today. So here you've got a diagram of a typical software stack on the left hand side you've got the normal world where you've got your user land applications running serviced by your kernel and potentially managed by your hypervisor if you've got one and on the right hand side you've got the secure world where the trusted firmware runs. So the trusted firmware runs at EL3 which is the highest level of privilege in the system and as Joanna has already explained one of the duties of the firmware is to provide some runtime services. Some of them are secure services like secure payment secure storage and some of them are platform services like trusted boot power management or even some silicone vendor services. So these services would be typically specific to your system on chip. So that makes up for quite a lot of services in your firmware and as you can imagine it increases the code complexity and also increases the attack surface which is not good from a security point of view because remember it's running at the highest level of privilege so if you find a flow in the firmware that you can exploit you've basically you rule the system and the second issue is that it increases the fragmentation because as I as I said you've got some platform services inside it which are specific to your sock so that goes against our our desire to have a generic firmware here. Now it's still looking at how the architecture looks today if you can have a trusted OS running in the secure world to manage some trusted applications and typically when you've got this architecture the trusted OS takes over all the secure services like secure payment secure storage and so what's left in terms of services in the trusted firmware is only the platform services so it makes the code bloat issue a bit less important because your firmware is a bit smaller but it doesn't solve all issues it even brings new ones so the first one is that the trusted firmware is typically provided by a different vendor than the trusted OS and prior to ARMv8.4 there was no hardware isolation provided between secure EL1 and EL3 so in other words between the trusted OS and the trusted firmware which means that for example the trusted OS can see just as much memory as the trusted firmware it can access any address there's no way to have for example some memory that would be specifically mapped for EL3 and forbidden to the trusted OS so that means that the trusted OS vendor and the trusted firmware provider have to trust each other basically which is not always possible the second issue is that whenever you start using a specific trusted OS you also need some companion components all over the software stack so these are the green boxes in this diagram you can see that you need a specific driver in your kernel in your normal world kernel to talk to this specific trusted OS same for your hypervisor if you've got one and you also need some code in the trusted firmware that is responsible for recognizing and delegating the secure monitor calls that are targeting this specific trusted OS so the model we would like to move to instead is to move all services up the exception levels so to take them out of the trusted firmware and move them for example at secure EL0 that way the firmware is a lot more smaller so the attack surface is reduced the complexity of the code is reduced as well and that in turns makes it easier to audit and certify the firmware if you need to also the only remaining services that you've got in your firmware are standard services such as the trusted boot, the power management or the secure monitor called hender because all the remaining platform specific data are expressed through configuration files if we use the the fcon framework I've been talking about just before so that makes for a truly generic trusted firmware that can run across any platform now what I've just explained on the previous slide solved the code bloat issue the other issue if you remember was the fact that the trusted OS and the firmware had there is no isolation between them so to solve this issue we can leverage the mv8.4 extensions and more specifically the secure virtualization so in mv8.4 we now have virtualization in the secure world as Joanna mentioned in one of the previous slides there's now a new exception model sorry a new exception level which is secure el2 and that gives us an opportunity to put some firmware code in this exception level to isolate el3 from secure el1 the other piece of the puzzle is also to standardize the interfaces the communication interface between the different components in the stack if you remember on the previous slide I've explained that when you've got a specific trusted OS you need specific drivers to talk to this trusted OS that's because each trusted OS does it its own way but if we standardize the communication interface then you just need a driver that implements this specification in a standard way and and and the program is solved so that's achieved through an ARM specification called PSA FFA which I will talk more in a second like that you can see in the blue boxes at the different software boxes boundaries so that way we can have generate code running both in el3 and secure el2 now I would like to just give a bit more details about some of the building blocks in this architecture so on the left hand side you've got a diagram that is basically the same as on the previous slide so first building block is on the on the top the the trusted OS with with its trusted applications and the platform services so these are two what we call secure partitions so a secure partition is a software sandbox that runs in the secure world and it's a sandbox because it's got its own execution context and its own address space isolated from other secure partitions so that makes it possible if you've got several providers for your secure partitions they don't need to trust each other because they know that there will be no unintended inter communication between different secure partitions the second building block here is these blue blocks where you've got the SPM or secure partition manager so that's part of the secure el2 firmware and its responsibility is to initialize all the secure partitions at boot time and to enable the communication between the service requesters and the providers and manage their requests at runtime one other key role of the SPM is to enforce the principle of least privilege because when the SPM sets up the execution context and the address space of a secure partition it will just give it the minimum that it needs to see so it will it will set up the translation tables of this specific secure partition such that the address space the secure partition sees is just what it needs not more same for the physical interrupts they are directly managed by the secure el2 firmware and they won't be forwarded to a secure partition if this partition is not supposed to know about this specific interrupt so in terms of implementation we currently have in the trusted firmware a project an initial version of an SPM dispatcher that is compliant to the PSA FFA specification i talked about before so the PSA FFA stands for platform security architecture firmware framework for a class processor the PSA is actually a class range of documents and so FFA is just one of them so it's a standard set of interfaces between secure partitions and the secure partition manager on one side and also between the secure partitions and the normal world and going back to the status the implementation we we've got an initial secure el2 firmware that is based on the Hafnium project which you might have heard about it used to be a google project but it's been migrated into trustedfirmware.org this year to serve as the reference secure el2 SPM of choice so these were two quite recent pieces of development we've been working on there are more than than than just these two so if you want to find more about the projects here are some useful links so we've got a public mailing list for technical discussion we are also organizing a call every other week with the community that anyone can join to discuss anything here is a link also to browse the source code and to the gary server we use for code reviews we've also got quite extensive documentation of the project that is hosted on read.docs and we've got a test suite that is also open source to exercise the trusted firmware and finally if you want to find that more about the trustedfirmware.org initiative in general not specifically for tfa here is where to find the monthly project status update in the board meeting minutes so thanks a lot for attending and i guess we are ready to take any questions then hello i believe that we have around about four questions in the list at the moment and i can if i take them from the top i think that might be the best best approach so the first question is how well are the silicon vendors upstream in the soc support well as mentioned in the first slide there are there's a there's approximately 30 plus platforms now upstreamed from about 16 plus vendors it you know when the project started of course you know the the number of upstream platforms was minimal but as time has gone by since 2013 you know we get you know a number of new platforms for every six month release that we we talked about and well what we do is we provide or we nominate from from the people upstream and a platform owner and we work with that person who's responsible for upstream in their their changes a lot of the discussion goes on in gerrit where there's you know patch reviews but we also have a quite a busy mailing list where folks talk about you know their ideas and issues that they're having with the platforms and as also mentioned by sandrine in the last slide there's a bi-weekly tech forum and this is a live call that we host where we discuss the any issues as well as presenting new ideas and and so forth you know that's going on in the project so i i would think you know you you ask how well i think i think it is going reasonably well with the platforms so the next question was what is the actual motivation for the generic firmware idea so the idea is really that some platforms have very few differences actually one of the examples that was explained in the slides were like you've got pretty much the same hardware but it's just different ways to train your ddr with different settings so in this case it's it's not always very convenient to have two builds of the of the firmware with just the settings that change that you have to deploy on on both platforms instead it's just more convenient and easier to move that to some configuration file that is read and you get the same binary and you just have to to change the configuration file depending on the platform that you want to deploy the firmware on so that that's really the idea hopefully this answers the question the next one was where is the configuration data stored and how do you validate its integrity does it need to be signed so the configuration data is stored along the firmware binaries usually in some kind of flash or non-volatile memory secure storage or not necessarily secure storage in fact because yes it is signed so it could be in non-secure flashed and if you enable trusted boot which is an optional feature then all the images in the bootflow are signed and verified at at runtime including the configuration data file so question number five was what is the advantage of power management in secure world so the idea of putting psci in the trusted firmware at EL3 in the secure world is that um usually power management is driven by the um rich os i mean the the normal world os like linux um and um but you might also have a trusted os running on your platform and if if the if linux decides that it wants to shut down some cpu um well the trusted os might need to be notified of that in order to do some context saving before uh the cpu's gets turned off and so um this coordination task is taken care by the firmware so linux will ask please uh turn off the cpu and then the trusted firmware make sure that any anyone in the secure world that needs to be aware of that before that happens is notified so that's really um a coordination role so question six is are there guidelines how to coordinate access to components that need to be accessed by tfa and linux um i don't know what you think sandrine but i i think of course we have a number of them standards that um that we we work to and we implement these apis they're also implemented or a number of them are implemented by the the kernel as well uh well typically i would expect that a device is um either owned by the kernel or by tfa but there is no i mean if there is if both of them need to um coordinate somehow because they manage part of a device only um then they would need uh yeah some some kind of communication mechanism um but um i'm not aware of any standard from arm or anything like that specifically for some some devices so i guess there is no there is no as far as i know so there there the next question is thanks for the presentation it was really informative will the slides be posted i believe they will be um the next one is is there anything about trusted firmware that uh can be integrated into ids through plugins um so i'm not i'm not sure i understand the question i'm assuming this means um can you like uh use eclipse or something like that when you develop trusted firmware code uh that can automatically build the code or something like that um what's your take on this one uh jenna how do you understand the question yeah i'm not sure if there's any special tfa support for ids you know we don't develop any particular plugins um but we you know people can use ids in their development um of tfa and a number of folks do um but there's not much i think i mean that that that is for a that's part of the project at least yeah yeah um and the last question i believe is uh is el2 execution mandatory to use spm um so spm i mean spm will really uh reach its full power when you're using secure el2 uh that's for sure uh now we realize that uh some platforms uh i mean before i'm v8.4 they don't have secure el2 and they might still want uh to use spm uh so that is possible there is a migration pass but it's really not um the main use case we are targeting so there will be limitations um but it's not strictly mandatory uh but but if you if you want the the full power of it it is it is recommended yes so there is the opti option sandrine isn't there where the people are using the opti trusted environment as a as a an spm solution that talks all the appropriate apis but as you say that's a migration path to um um you know the the real secure el2 whereas um um the opti of course is at el1 yeah yes and uh as we mentioned opti so if you're not aware of that i mean that's a trusted OS implementation that is a open source and available through trusted firmware.org and i think we've covered all questions and run it at time i think yes uh so if you've got any more questions uh i encourage you to join us on the slack channel so we've been advised to use the number two uh on the track mbd linux so we'll stay uh for some time if you go if you've got any other questions thanks a lot everyone and for for attending and for the questions thank you


Welcome to this lecture. I'm very pleased to welcome you all. My name's Rachel Kerr. I'm a professor of War and Society in the Department of War Studies, and also Deputy Header of Department. It's a really great honour and a privilege to welcome you to this event and to be presenting our speaker for this evening. The Sucky and Michael Dockwell Memorial Lecture is a lecture that we hold annually in the School of Security Studies and it celebrates the dedication, collegiality and achievements of Professors Sucky and Michael Dockwell who spent very many years in the Department of War Studies. They were both well-known and eminent international and diplomatic historians. In addition to being accomplished scholars and publishing very widely, they were very generous mentors in the department and very important for the development of war studies and for scholars within it and I myself was privileged to be a student in the department while Professor Michael Dockwell was still teaching and then went on to be able to be a colleague of Sucky Dockwell's during her late years in the department. They both served very many years, Michael from 1971 to 2001 when he retired and Sucky from 1992 to 2009. This memorial lecture is our opportunity to embody the values that they upheld and to do orbit to carry forward the work that they did in inspiring the next generations of scholars in presenting the latest developments in the field of international history, diplomatic history and war studies more broadly. So I'm really pleased to be able to introduce our speaker this evening. It's a very great personal privilege and pleasure to introduce Professor Beatrice Hoyser. It's extremely fitting that this is somebody giving this lecture this evening who also embodies the values that were espoused by the Dockwell's of collegiality, mentoring and inspiration and has personally been very inspiring to me as a mentor and as a role model. Many of us, there are more of us now working in this field of studies. So I for one have benefited from her expertise and her advice hugely and I know many others have. Professor Hoyser holds a BA and an MA from the University of London and a Diffil from Oxford and a Hebilitesion higher doctorate from the University of Marburg. She's taught widely at many places. She spent very many years teaching at the Department of War Studies again when I had the privilege to be taught by her as well when I was a student here many years ago. And then during that time spent a year in NATO headquarters during the Yugoslav Wars. She served as director of research at military history research office of the Bundeswehr and as a professor of international relations at Reading. She's currently professor of international relations at Glasgow and is seconded at the moment back to the Bundeswehr in the higher staff college as director for strategy. She has many significant publications on nuclear strategy, on clousfits and her most recent books The Evolution of Strategy and the one that has just come out. This year wore a genealogy of Western ideas and practices and I would recommend anybody starting out in war studies to reading clousfits as the best introductions to clousfits if you're feeling a bit lost and essential reading for all butting war studies scholars. Her most recent book as I mentioned is a survey of thinking about war and ideas and practices of war, so a genealogy of Western ideas and practices. And she also runs the podcast series with Lucy talking strategy. So this evening Professor Hoyes is going to talk to us about civilians in war, specifically the civilian conundrum in war, so I will stop there and hand over to you. Thank you very much. Thank you very much Professor Kerr, but also I'd like to thank everybody who's come tonight. I'm really privileged to see people having come from, taken time out of busy schedules to be here. But I must say the greatest and happiest surprises to see Barry Pascans because I think he will have the answers to the questions that I will raise tonight. And you will also see the profound effect you've had on me because of the thinking that I was subjected to from you that I've tried to find out more about over the years. So Barry, I'm particularly looking forward to your replies to what I'm going to talk to you about. It is also a great honour to be able to help commemorate in this way Saki, Michael Dockrell, great friends, and we all have lost particularly Saki far too early and it is wonderful that there is this lecture series to commemorate them. I hope that I can be worthy of this particular memory. Here is the structure that I propose to give you. I'm going to bore you to tears to start with a long historical introduction. I'm going to point to change where I think I have identified some change but also to horrendous continuities in the treatment of civilians in war. To then look at total war nationalism and then to raise moral issues and that's where really the political philosophy comes in and the moral and the ethical side comes in. So here we go. If you want to fall asleep, do so during the first two through a few bits and dig up for section five because I will and I really am hoping for interaction with you afterwards and questions and answers because I really have the questions rather than the answers. So having looked in this book on the genealogy of thinking about war and then contrasting it with practice at a fairly long period of time I've covered also this question of how civilians were perceived and one of the things that I found was that in ancient Greece and ancient Rome there was really a very extensive lack of compassion. Just about everybody was killed. Prisoners of war were killed in besieged towns. The classic pattern that the population could be allowed to surrender but then they could still be expelled. They might still all die of starvation or of exposure if they were expelled from their towns. If they had not surrendered, if a besieged town had been captured then generally all the men were killed, other else they were enslaved. Women were systematically raped and then they were abducted with children into slavery and that was a fairly classical pattern there. If you were insurgent and you were defeated then you were most likely going to be killed. There were occasional acts of mercy. Yes we do find them in all sorts of different sources but they're almost described as a sort of weird luxury and then so and so did something. Imagine they didn't do the normal thing of killing but they spared this person or they spared these two people. Alexander with Darius as wise is a big fuss about a very numerically limited case of clemency when a few pages earlier they told us that they had tens of thousands of people killed. This comes against the background of course where the brutality in families is also quite different from what we would be expecting today and not only the Spartans but also the Romans. Roman fathers had the right to kill their children if they chose. Population control included simply killing infants if you couldn't feed them and of course Greeks and Romans could kill their own slaves if they felt like it. There was no protection against that. This comes against the background of an immense tolerance of cruelty and brutality as we would now see it in their societies. What I think this amounts to is that there is an amazing lack of compassion. The Greeks if they are sparing people they will say that this isn't done in order not to offend the gods. They seem to be more worried about the gods being offended than about these people suffering. In the Roman case it's sort of less the gods although they get to mention a lot of the time as well but it's really disorderly. You're breaking the laws and laws are really the most important thing. You have to go along with the laws. You do have some people spared in war and this is mentioned over in several sources. It tends to be people to do with religion in some way. So it would be priests, it would be people taking refuge in sanctuaries. We all know that the example from Thucydides and elsewhere where then the sanctuary is ignored by somebody and the massacre still takes place but in principle there are certain rules about sparing people which tend to be related to religion or to sanctuaries in some way and all religious feasts. So it's quite, again it sort of enforces this pattern of to do with deities and gods rather than with compassion. People don't say, don't do this because these people would suffer and you don't want people to suffer, it's all about we don't want to offend the gods. You do have this both in one. You do have people suddenly showing sides of, this is unpleasant, we shouldn't be doing this, at the same time as they are showing extreme cruelty just to give one example, Alexander, Alexander III of Maconad, I refuse to call him the Great, who was happy to massacre the Thebans and the Tyrians because they hadn't surrendered to him in very large numbers, tens of thousands. But when he came to the Bactrians and found out that the Bactrians had this habit of getting rid of their old people and sick people by throwing them to a breed of dogs who had been trained particularly to attack them and eat them, he thought that was not very civilised and forbade it. So we do find in one person things practice that we find totally repulsive and then things that we can sort of relate to and you can have a nice argument as historians have had and I'd love to join in on that on the question of whether Alexander had any business telling the Bactrians not to continue with that because that was cultural interference, wasn't it? You do have, at the end of the Rome Republic, some evidence of humanitarian views creeping in and I do, I'd be late to discover Cicero and I've come to really, really like him who even says that in dealing with enemies there should be a limit to retribution and punishment. There are certain duties that we owe even to those who have wronged us. It is sufficient that the aggressor should be brought to repent of his wrongdoing in order that he may not repeat the offence and that others may be deterred from doing wrong. And then elsewhere the rights of all must be strictly observed and when the victory is won however we should spare those who have not been excessively cruel and monstrous. So there is an idea, there's an idea of limitation that does creep in but I would still argue that somebody must be thinking at the moment that surely the word Caritas is Roman and yes there was this, the virtue of charity even in Rome. Have you noticed that charity is always depicted as a mother with children? So I would say that's a case of hormones rather than of a mental disposition to be kind towards people who are not yourself with whom you're not related. So it's interesting that that is the prime example that they had of charity. Somebody who by their hormones is driven to look after their young. Fascinatingly one little idea I've come across in archaeology which is that in fact compassion also crept in not just from single individuals but from Judaism in Rome in the first century AD where you've got the I shall love thy neighbour as thyself is translated apparently in a system whereby richer Jews in Rome paid for the burial sites of poorer Jews and that is something that could be found in archaeology that Leonard Rutgers and some other archaeologists found out when they looked more closely at the Villa Torlonia catacombs in Rome. And that's very fascinating because it means that there is an element of social looking after each other which was quite, quite alien to the Romans in this respect that creeps in around the time when Christianity also very, very slowly takes off. And I think the argument could be made that this love thy neighbour as thyself this key point which then is fully taken into Christianity then becomes a driving factor for the limitation of war and the creation of, or the translation of caritas into something that isn't simply mother's love, hormonal love for the child but also something that is about caring for people who are not at all related to you. So I think the big tool norm, the big change does really come when Christianity becomes a state religion and you have the abolition of crucifixion as a punishment the abolition of lethal circus games and pretty late still even actually after the end of the Western Empire the attempts at least driven by the church to abolish slavery even though John Gillingham has shown that in fact the practice of enslavement particularly of women and children continued in the Christian West among Christians against each other until the 12th century which is pretty awful. So the Christian Church was actually quite important I think in a long fight to drive back two other forces Western or European civilization being basically an amalgam of three important forces one of them being the pagan traditions that I was mentioning earlier but then that pretty horrid, Germanic warrior culture that comes in with all the invasions and then the collapse of the Western Empire against which the Christian Church falls very hard with the result being a set of rules that are gradually introduced we don't actually know when they started but initially they are very much in the tradition of what we've seen from the ancient Greeks namely all about religion all about the protection of what belongs to the church i.e. the clergy and church property but very very gradually you find that that builds up also to in some other ways where it says well coming near the property of Gregory of Ture sorry, it's in margin of Ture or Ilerre of Poitiers in this area we shouldn't probably pillage peasants belongings and things like that so gradually an area that is particularly seen as holy also encompasses the poor peasants who should be spared in that area we have slightly more restrictions already self-imposed on the East Roman Empire in the Mauritius strategicon but in the west it takes a long time for these restrictions to come off I've done a bit of research into this you don't have to read this all just to give you an idea very gradually in the 9th century you begin to have more and more protection extended to peasants to widows orphans the poor in the context of saying we want to protect people on the territory through which our armies are moving and the crucial thing and I'll come back to this in a moment the crucial thing is this originally concerns only your own territory all these ordinances are initially only formulated to say we should protect our own peasants against our soldiers ravaging the land moving through the land and not only living off the land but eventually also very often killing the peasants in the process of it because if you're a peasant and you have enough food for the winter and soldiers come and want to take that from you you've got the choice between fighting them or dying of starvation over the winter with your family and therefore you might fight and then you're probably going to be defeated because you're going to be killed because the soldiers fight better than you so it's about protecting the poor and the soldiers in your own territory the other thing that comes up is that you have sovereign princes already from Anglo-Saxon England onwards trying to enforce a piece of the land the protection of their own citizens against interference and why do I have a gate here of Regent's Park I hope that some of you at least occasionally wander across Regent's Park which is a royal park and at least in my time when you came into Regent's Park there was a large panel saying that we had to follow certain orders in that park certain rules in that park one of which was, and we remember that particularly was not to interfere with the swans and why was this because this was a royal park where in my time the Queen's Peace had to be kept this idea of the King's Peace and the Queen's Peace is actually a revival if you like of the Pax Augusta the idea of an internal peace where only the monarch monopolised justice and violence and tries to stop everybody else from killing each other in vendettas introduced in the Holy Run Empire by Emperor Frederick I and then later by the famous Land Freedom of the end of the 15th century but it's interesting how that then spreads alongside this idea saying if we're at war and we're moving our forces to the frontier to fight the enemy on the way we should spare the poor and the peasants and not ravage the land the 100 years war and the Anglo-Scottish wars then produce a very large list of ordinances which are very interesting because more and more these ideas of these rules that are acceptable to all sides becomes crystallisers and more and more you have the standard line in there that you must spare civilians and you shouldn't go against them having said that we also from these wars have plenty of evidence again that this always applied to your own side to the poor and peasants on your own side and that this protection was only extended very occasionally and selectively to an abbey on the enemy's territory if that abbey surrendered to you with its lands or to a town if that town surrendered to you so all the time, shockingly I think for us it really only applied to our lot as it were and this is I think where the first big change comes in and it curiously comes in Burgundy the late 15th century where it moves from the ordinances move from protecting people on your own land to the idea that it should happen to all civilians including those on enemy territory I think there is a recognition here this is in the context of Burgundy the Dukes of Burgundy were actually the same family as the French kings they kept going to war with each other that there is a sense that they were fighting they were the same population and actually wanted to win the allegiance of that population and therefore it might not be wise to pillage them and to kill them if you then afterwards wanted to have their loyalty but interestingly this is where you do potentially have a change coming in at the same time there is some literature again just there which claims that there was a decline of violence also domestic violence also violence in small-scale societies whatever it is in the west in the late 15th to 18th century I personally can only say a heart this is what they say but I do at the same time see that there are more and more of these ordinances coming out and incidentally some of the fun was to find them because they were very often attached as annexes to books on war where you wouldn't have suspected them so you would suddenly have this Burgundy of more and more of these ordinances some of them simply stand alone you go to war you have somebody at the beginning of their campaign and it seemed to be the case that whenever you went to war whenever you went on a campaign you had to have publish these ordinances what the interesting thing about it is that these are unilaterally adopted it isn't international codes of conduct it isn't the use in bellow that is somehow agreed internationally but because everybody starts adopting them and copying from each other it becomes traditional law it becomes conventional law and you had so again even until the mid 19th century we find that ordinances are in such a way are issued ad hoc for an individual campaign and just to give you a little flavour of one just randomly chosen the Danish one upon pain of death are prohibited less majesty, all deliberate homicide, murder, sexual conduct against nature, incest, bigger means incidentally rape is not rape is exempt from the kidnapping, forceful abduction, laying fire street robbery, highway robbery stealing church property so these would be classic cases and it's quite interesting that a lot of them don't actually exclude rape horrible continuity at the same time absolutely horrendous continuity when it comes to siege warfare and since antiquity absolutely systematically you get the pattern all the way to what we're seeing in Ukraine now that if a city surrenders on certain conditions the besieged forces on the whole like expected to respect the conditions and then also not to pillage, not to rape, not to kill but if the city does not surrender but is taken everything is allowed and that is simply a practice that we see all over and just to have an example of this you have of course the element there of starving civilian populations until they surrender scorched tactics around places so that they run out of food naval blockade as in the naval dimension of this bombardment from land or from the air once you have the technology to do that and then the sacking as I said continues clearly from antiquity to the present we have there those pictures from Mariopole quite recently but we could add all the horrible pictures that we have seen since Erasmus of Rotterdam already commented that it was the greatest part of the suffering that falls on those who least deserve to suffer namely on farmers, old people, wives, orphans and young girls if anyone cries that this is it is unjust not to punish a sinner my answer is that it is much more unjust to call down absolute disaster on so many thousands of innocent who have not deserved it so it was quite clear for contemporaries what was going on so war should not be seen primarily as the clashing of armies religious wars and national wars well those two types of wars where all sides had it in particularly for the anybody every single person, all the civilians because it meant that this was a battle of good and evil and if you were in your soul you were on that other side you were an enemy of your deity as an element in the Muslim wars of conquest in 1630 the atrocities committed by the crusaders when they captured Jerusalem just as one of the many atrocities of the crusades but also in the confessional wars then of the early 15th century and then the religious underpinned wars of the 16th century and the early 17th century the wars of conquest and the Spanish Dutch 80 years war particularly horrendous and merciless as every single civilian on the other side was very often treated as an adversary whether they were a babe in arms or whether they were an old person or whatever there is a big debate among scholars about the violence in the 30 years war there is one school which says there was the 30 years war was a particular height of deliberate cruelty whereas the other school of historians speaks particularly about the indirect effects that led to so many casualties in this war which were up to a third of the population of some of the areas concerned where this particular school claims it was mainly because of famine and plague that so many people died I have a tendency to side with those who say that there was the deliberate cruelty that was inflicted and that this was it was a myth that the cabinet wars that followed after that were so very limited where does this myth come from just a very brief run through that because it's quite interesting it comes up an awful lot in literature about strategy called in French lace warfare la guerre en dentelle we know that it definitely goes back to the French author Guybert who thought that the wars that he'd witnessed in his own time particularly the seven years war were very unsatisfactory because people were always stopping the war whenever they ran out of money and then they resumed when the money came back and this was decided by cabinets hence the word cabinet wars it was picked up by Klausawits who crypt an awful lot from Guybert where he had this whole passage saying armies were paid for from the treasury which princes treated almost like their privy purse apart from a few commercial issues relations with other states concerned the treasury or the governments not the people war thus became the business exclusively of the governments hence cabinet war thus essentially became a real game looting and devastation of enemy territory which had played such an important part in the warfare of the ancients and even in the middle ages where no longer regarded as acceptable to the spirit of the age war was thus limited more and more to the armed forces themselves this is what Klausawits wrote he had never experienced them he wrote that retrospectively there was an inspiration from Guybert practically paraphrasing Guybert and that particular interpretation of the wars before the French Revolution particularly of the 18th century was then picked up by an awful lot of other people Moltger picked it up Carl Schmidt if infamously picked it up and there was this whole argument therefore that this is there was the limited period of cabinet warfare until I think Hervé de Réviant started writing about this period and said no actually it was pretty horrendous some of the little things that he mentioned as examples of this first of all lots of cities burned lots of looting of the city's bombardment of cities on the right hand side you will see a picture of the city of Dresden it's not just 14th of February 1944 that it was bombed it was already bombed in 1760 from the ground and destroyed and this is why so much of the centre of Dresden was then late 18th century and the wars of Louis XIV were horrendous and had horrendous effects for the people who were in the areas where he had this scorched politics tactics and where masses of people died from starvation but also as Hervé de Réviant underscores drilled forces firing at each other in lines and advancing towards each other had very high casualty rates more higher casualty rates per soldiers than you had in previous and later wars so this is really it was particularly also for the soldiers a particularly bloody business and the idea that the cabinet wars were so limited not necessarily the case but in any case however it seems get worse once you got back to a model in which an ideology inspired people to think that all enemies the entire enemy population was the adversary and that's really when religion was now replaced by nationalism and nationalist wars I think by logic and reason drift into being total wars because in that context it starts with a French Revolution not only do you mobilise your entire own population i.e. the entire nation against an assault by the adversary against your nation it's no longer just your dynasty but you then logically have to start sooner or later to think that therefore every member of the other side is also an adversary every single human being in the other nation let's pass review what people have thought about that and go back a step just go back to how people at some stage thought this was not the case Plato would not admit that the whole people the whole people of a state men women and children are enemies but only the hostile minority who are responsible for the quarrel so for Plato it was decidedly not the entire policy should be treated like that in the late 18th century you have a vatel saying women children the old and the sick come under the description of enemies and we have certain rights over them but these are enemies who make no resistance and consequently we have no right to maltreat their persons or use any violence against them much less to take away their lives this is so plainly a maxim of justice and humanity that at present every nation in the least degree civilized acquiesces in it so at least the theory was that you couldn't do that before the French Revolution before the rise of nationalism but then the big turning point comes with the introduction of nationalism all of a sudden you could see quite different views taken by the jurists of the 19th century the US Supreme Court in 1814 said in the state of war nation is known to nation only by their armed exterior each threatening the other with conquests or annihilation or a leipzig jurist at the university Julius Weisker saying 1845 the war of nations sees in each member of the enemy people an enemy who has to be fought or at least disarmed or Hallek a bit later this again a jurist the state of war means that the whole state is placed in the legal attitude of a belligerant towards another state so that every member of the if the one nation is authorized to commit hostilities against every member of the other so clearly this idea of the mobilization the entire mobilization of one's own people and then the the designation of the entire population of the other side as enemies in every place and under every circumstance thus there are in two ideological contexts you get the entire population as enemy namely if they're enemies of God in Islam versus Christendom or the confessional wars among Christian nominations or if they're enemies of a nation where you have warfare of nation against nations just described or even then the genocidal war as practiced by Ludendorff who actually formulated this out and went to the last logic of this why am I telling you all this well I think it's really important to see that Europe had produced an ethical spectrum of attitudes towards civilians which goes all the way and these are all European traditions from Mother Teresa to Adolf Eichmann all these are contained in European traditions and they were competing with each other you do have in the 19th century in parallel and competing with each other the jurists trying to create more rules that are internationally accepted with the whole legislation movement incidentally strongly supported if not even champion by Russia with the Tsar's main jurists who tried to convene those first Saint Petersburg declaration etc. international treaty efforts whereas at the same time in parallel you have this increasing development of the nationalization of war with this drift towards identifying the entire enemy population as enemies this good this ethically good side of it the greater protection of civilians by international law international law for the first time now turning from traditional law and simply conventional law to two treaties that are signed by various sides by multiple sides this tradition of course only takes off in the second half of the 19th century and is illustrated by this very long list that all jurists will immediately recognize of legislation that is supposed to afford protection to civilians but also for prisoners of war to fighting soldiers etc. I've highlighted the very important take draft rules of aerial warfare the one exception herein which wasn't ratified by the various sides which is why bombing from the air was still legitimate legal in the second world war but all the other legislation progressively tried to humanize warfare tried to restrain below tried to increase the rights of civilians and the protection for civilians but also of wounded soldiers captured soldiers etc. Aerial bombardment becomes this large and very important exception developed nicely in the colonial context because it was a cheap form of counterinsurgency you didn't need to put boots on the ground in the second world war the alternative to early invasion of course and then only really properly outlawed with the new appendices to the Geneva protocols of 1977 so we are I think in agreement everybody that what Russians forces are doing by bombing civilian properties in Ukraine that is a war crime but even then we find that the odd return to this thinking that you had in the middle ages before the Burgundians afforded something of a change that people, militaries tend to be very concerned about saving forces on their own side force protection on their own side and this whole development in the context of using missiles or aerial bombardment of trying to achieve a war with zero dead tended always to be about zero dead on its own side so let's not mistake that for a particular humane form of war the extremes of course of the nationalization of warfare are then in Genoa and Demoside where the classic cases are still, the jury is still out or put it that way, I don't know enough about it to be able to decide whether it was neglect or deliberate and incompetence or deliberate policy the Holodomor, the great Chinese famine mentioned in that context there are two schools on each of these one of them says it's deliberate the other says it was just extreme incompetence but design was definitely there in the German genocide of the Nama and the Hereros the Turkish genocide of the Armenians the German genocide of Slav Jews Sinti Roma and the Polpots genocide in Campachia the Rwandan genocide was by design and of course Reprenitsa was by design although on a different scale but still there's clearly that's the pinnacle of that okay this is the bit where I hope you're going to wake up because this is the bit where I will now need you so far we have considered the killing of clearly innocent people but this is now the conondrum and the moral dilemma that I want to raise which is how responsible are citizens for their government's wars and I have then restricted it by saying let's assume they are in a democracy but even in more authoritarian systems one should raise that question so in this context can we differentiate between innocence in the sense of those who really cannot do any harm that's where the word comes from in knocker, knocker or do harm not knocker or not doing any harm citizens of a totalitarian system which who may just have the choice between being incarcerated possibly even shot if they go against the government anyway so one would say that not everybody is born to be a martyr from me in any case I would have always been very worried about against the government if I had children to look after or the family to feed or something like that the active and voluntary professional contribution to a war effort which is still on a different scale if you actually joined the Nazi party if you volunteered for the military and if you were actually combatants in that war yourself let's for the purpose of this part of the discussion leave aside the question it would actually be physically possible in a war to differentiate between these people we should come back to that at the end because I think there might be interesting technological developments in the future that might make this turn this somewhat around so let me repeat there are degrees of responsibility whether this comes from voting for a party that proclaims war to be its aim or not protesting as a government against a government when it embarks on something that you think is wrong morally supporting such a government's war and actively supporting it by civilian or then military work in support of that economy well let me now just run past you some different views that have been taken on the subject and it's not uninteresting that Christine de Pison early in the 15th century who herself was writing at the court of the French king at the time during a time of civil war just to take you back you all know about the wars of the roses in England where you had exactly the same thing a generation earlier in France the Armagnac against the Bourguignon was basically another family feud led by two different factions of the royal family two uncles of the king who just like Henry the 6th in the later English case Charles the 6th was insane had great periods in which he couldn't reign and the uncles fought each other and in this context of civil war Christine de Pison came to the following a very interesting verdict let us suppose that the people of the enemy country or is it the enemy faction because it's left open wished not to aid their king or in injuring our king the other side doesn't want to aid their side okay in accordance with lawful practice we should not in any way cause bodily harm to or injure the property of such people or those who did not come to the aid of the enemy king so if the other side abstains from supporting our enemy king we shouldn't harm them by contrast if the subject of that enemy king be they poor or rich farmers or anything else give aid and comfort to him to maintain the war according to military right we may overrun their country and seize what they find prisoners of whatever class and all manner of things without being obliged by any law to return the same so interestingly here in a monarchy which is pretty close at this day we have no electoral system here people hadn't chosen by the election of their king she still assumes that there is a choice to be made by people whether they support this other ruler or not and that they deserve to be treated accordingly grotsious several centuries later says to start with the civil community is one body with a sovereign head thus no separation of interest between those of the prince and his subjects should be allowed not only those who actually bear arms who are immediately subjects of the belligerent power are our enemy but even all who are within the hostile territories so interestingly there again the assumption is made that the property of the enemy monarch and the subject of the enemy monarch are all collectively also the enemy's property as such extension of the adversary Cynulleson Baker's hook says the war is an attempt to subjugate the enemy and all that he has by seizing all the power that the sovereign has over the state that is to say by exercising complete dominion over all persons and all things contained in that state but that's a sort of still a benign thing because it doesn't at all suggest that you're going to kill them but it does still have this perception that the population is the sovereign's property so to speak we don't see here this fascinating argument that is made by Christine de Pison that suggests that they have a choice about this much of the contrary both Grotsius and Baker's hook give this impression that basically the subjects are just extensions almost property of the monarch but let's get back to this idea of Christine de Pison which strikes as being much more modern and in some way much more worrying of course in the same way so here this question of are they responsible do they have a choice let me introduce you to the thinking of somebody who was so out of tune with the rest of her environment and the rest of her thinking around her that people spotted her as being very exceptional and appointed her to chair a philosophy in Oxford in the second world war the Catholic philosopher Hanscom who was totally against the bombing strategy that was adopted by the British and of course the Americans in the second world war where she pleaded for a clear distinction by occupation between people who in some way supported the war offered and some people who didn't she said that innocent civilians could be in her opinion identified even in what others called total war they are those who are not fighting and not engage in supplying those who are with the means of fighting a farmer growing wheat which may be eaten by the troops is not supplying them with the means of fighting so she was very clear that there were these different categories I think for many other people and for many of her critics of course this distinction was not as clear cut but there is this position on the very extreme side that you can differentiate and that there are jobs in which you are wholly innocent again on the other end of the spectrum saying that you haven't got anybody innocent but anybody who supports the government who does something that is wrong we will find on the arguments that Islamist terrorists have put forward you find the Osama bin Laden saying that basically if you bomb my population we bomb yours we issue a fatwa to all Muslims the ruling to kill the Americans and their allies civilians and military is an individual duty for every Muslim who can do it in any country that is able to do so as an active retribution because he saw that as something he argued that was equivalent it is a fundamental principle of any democracy that the people choose their leaders and as such approve and are parties to the actions of their elected leaders by electing their leaders the American people have given their consent to the incarceration of the Palestinian people and the slaughter of the children of Iraq this is why the American people are not innocent the American people are active members so this assumption here that by having just voted for a particular government in advance you are already making yourself culpable of any later deeds committed so an extreme position there on this long spectrum that I am showing you but also very interestingly in the context of the Yugoslav wars and here in particular the Kosovo campaign air campaign that NATO conducted against Serbia in particular we had Barry Buzan arguing that people get the government they deserve and most a lot of people in this room are too young many of you are not but let me just for the younger ones remind you what happened there the Serbs got so or the rest Yugoslavia population got so angry about this if you were Serb you'd probably feel the same at that stage that they started painting targets on themselves or on their prams or on their hats and things and they deliberately said well NATO is going to bomb us so we are the targets come on bomb us to which Barry Buzan argued that if Serb civilians turned themselves into human civilian shields by occupying key bridges in order to prevent NATO from blowing them up from the air then these Serbs were in his view legitimate targets so here a much greater engagement on the part of the population in support of a particular policy but on the spectrum you can see that this is a debate definitely worth having Lord Guthrie of Craigbank and Sir Michael Quinlan took a slightly different angle on this and they said well let's not talk so much about whether they were responsible for getting a government into power and let's look simply at what they are doing at the time of the confrontation so in their book about just war they said that the concept of innocence as people who should not be deliberate attack does not turn upon whether these individuals in question had any personal responsibility for the evils which are engaging in war is intended to terminate or rectify i.e. let's disregard whether they were involved in voting for that government or anything like that the word innocent they suggested should be used to refer to whether or not they are involved their own willingness or reluctance is not relevant in contributing to do us harm whether in different terminology they are or are not essentially non-combatants a different take on it which makes it easier to distinguish between whether you will try to punish somebody for a decision that they made in the past or even are sustaining in the present or whether you are trying to target them or you will think it is legitimate to go for them because they are actively involved in the war effort so back to the question of the active involvement in the war effort rather than the punitive responsibility for something that happened earlier finally perhaps the philosopher David Lubin who dwelt on this question of whether this is a war can be seen or should be seen as a punishment where he said democratic states may be even more collectively guilty of international crimes and undemocratic ones precisely because their regimes rely more heavily on popular support but we should reject the conception of collective guilt that can lead to the death or maining or loss of possession of anyone in a guilty population anyone here meaning they could indiscriminately take up people irrespective of whether they have supported these war crimes or not so the anyone is the indiscriminate bit nevertheless injustice arises from the fact that the disasters of war are distributed among the enemy population without regard to their individual guilt this gets back to the big question of would there even be a possibility for differentiating in targeting between people who supported that government or people who have not so imagine a situation whereby you had in say Germany in late 1932 I think when the last free elections were when you had whole areas cities even where the popular vote had gone very strongly against the Nazis would you feel that these people were not supporters of the Nazis and therefore deserved punishment less than people in populations and cities who had the great majority voted for the Nazi in those elections but even then of course you'd still have those minorities you'd still have minorities in each side that had sided with the other side could you differentiate how could you make that difference in a way we let more and more to think about the question of whether there might be the means in any way in warfare to distinguish to recap civilians in European history were seen as great treasures to be protected those parts of the population that were the most vulnerable and therefore the most worthy of protection Christianity with its roots in Judaism in this very interesting combination of first of all looking after your own poor started to change that but it took a heck of a long time for this to penetrate it took an even longer time for this to be applied to the populations of enemy countries and to see some sort of distinction and yet there is a standing and very very long debate about whether in fact the population of an enemy country should be seen as innocent or whether they are actually particularly in a democratic system or if they are the subjects of an enemy monarch on any way part of an extension of that enemy should be particularly targeted if they are actually very much part of the enemy to be targeted so you have two parallel traditions from that point onwards on the one hand the tradition of trying to limit the destruction in war the collateral damage the killing of civilian populations to try to limit the effects on civilian populations first just on your own side but increasingly also through international law on the other side we have stand for and in parallel to that a tradition which particularly demonizes the entire enemy population and in any case we are very much left with the question of whether it would even be possible to differentiate between those in the population of an adversarial state who are supporting that state and its war imagine an illegitimate war and those who are silent objectors who are trying to keep out of it and who are not supporting this to end on the context of the Russian war against Ukraine we are beginning to see we have already seen in practice for a long time since 2014 the latest an attempt made to distinguish to punish selectively on supporters of that regime where they can be identified with the sanctions on oligarchs and sanctions on a media who have been particularly prevalent in their campaigning against Ukraine in the context of that war but we also see the application of economic sanctions which more indiscriminately affect the Russians more generally and we have the whole debate about whether Russian citizens should no longer be allowed to come to the European Union countries Finland was leading in that and has imposed its own restrictions on that so that's an indiscriminate if you like targeting and then my question for you and this is where I'm hoping very much that our debate will be of interest what other measures would be appropriate and just as a little tickler for your imagination can you think of ways in which in the future these things can be spread to a larger number of people now before you immediately dismiss that I'm not for a second saying bomb Russian cities from the air or anything like that but we should also start with saying what have the Russians been doing to western countries for quite a while hands up anybody in this audience who has already been subject to Russian hacking internet hacking so I mean there's already stuff going on in that respect people, individuals are identified as saying things which are hostile to the Russian government and at some stage you'll get interesting emails or your friends will get interesting emails and write you nasty letters saying why have you just etc so this is one way of doing this but I think there is much more that can be imagined it is pretty you know all the sort of new technology coming up where we can identify the actual soldiers, where we can identify the actual soldiers who shot off that missile that brought down the Malaysian airline in 2014 well the other side can do that too more and more it is possible to identify people to target people in that particular way and I think there are a lot of things that are already going on think of how Russians have or somebody has nation attempts and some very successful to Russian former spies in the west but all sorts of other things that can be done and that might be done in the future I think it's something that probably is going to come but I still want to leave the question with you what you think would be appropriate to what extent you would formulate that in terms of punishment because they have an opinion that you don't share and they're supporting a regime that you think is wrong and to what extent this would be a more practical way of putting pressure on them in order to stop them from supporting their government and where you can go with this and I'm very much looking forward to the discussion but if you wanted to have more examples of what I've said is all in my book War, a Genealogy and for the purpose of the discussion I'm going to sit down. Thank you very much.