Red Cross publishes hacktivist rules of engagement

Civilian hackers raise the risk of civilian targets in armed conflicts

The International Committee of the Red Cross (ICRC) has issued the first ethical guidelines for hacktivists during wartime, urging them to follow the rules to prevent harm to civilians and hospitals.

This initiative comes in response to a significant increase in civilian hackers joining cyber-gangs following the invasion of Ukraine.

"With many groups active in this field, and some of them having thousands of hackers in their coordination channels and providing automated tools to their members, the civilian involvement in digital operations during armed conflict has reached unprecedented proportions," the ICRC said in a blog post.

The organisation is concerned about the high level of involvement of civilian hackers in armed conflicts, which raises the risk of groups intentionally or unintentionally targeting civilians.

These hackers may also expose themselves and their loved ones to military operations.

International humanitarian law does not forbid hacking military targets during armed conflicts. However, those taking part in such operations must uphold fundamental humanitarian principles.

As per the guidelines, hacktivists are advised not to target civilian objects or employ malware that can affect both military and civilian infrastructure.

One of the rules is to "Stop the attack if the harm to civilians risks being excessive."

The Red Cross has explicitly designated certain targets, such as medical and humanitarian facilities, drinking water systems and hazardous plants, as "must never be targeted."

The rules, based on international humanitarian law, include the following:

• Avoid directing cyberattacks against civilian objects.
• Refrain from using malware or other tools that automatically spread and indiscriminately damage both military objectives and civilian objects.
• When planning a cyberattack against a military objective, make every effort to minimise the potential impact on civilians.
• Do not engage in any cyber operations against medical and humanitarian facilities.
• Do not conduct cyberattacks against objects crucial for the survival of the population or that can unleash dangerous forces.
• Avoid making threats of violence intended to spread fear among the civilian population.
• Do not encourage violations of international humanitarian law.
• Adhere to these rules, even if the opposing party does not.

The ICRC says that no country should endorse or tolerate the participation of hackers in cyberattacks during armed conflicts, as this could potentially result in violations of relevant laws and regulations.

The BBC interviewed several hacktivist collectives engaged in the Russia-Ukraine conflict, including the IT Army of Ukraine and Killnet.

These groups were reluctant to adhere to the ICRC's recommendations.

A spokesperson for the IT Army of Ukraine, which boasts 160,000 members on its Telegram channel, said they had not yet made a decision about implementing the ICRC rules.

The group has already prohibited attacks on healthcare targets, but they acknowledge that the wider impact on civilians may be unavoidable.

"Adhering to the rules can place one party at a disadvantage," the spokesman added.

Russian hacking groups have also been involved in cyberattacks against Ukraine and its allied nations.

A representative from pro-Russia group Killnet, which has 90,000 supporters on its Telegram channel, asked, "Why should I listen to the Red Cross?"

A representative from Anonymous Sudan, a group that has recently targeted tech firms and government services they believe are critical of Sudan or Islam (but is believed to be linked to Russia), told BBC News that ICRC's new rules were "not viable," and that breaking them was inevitable in pursuit of the group's cause.

Computing says:

Unfortunately for the Red Cross, hacktivists are largely criminals already. They've proven that they ignore laws and rules when it suits them, and we don't expect these to be much different.

If anything, civilians are far more likely to ignore rules of engagement than professional soldiers.