As we near the second quarter of the twenty-first century, the space and cyber domains are becoming more competitive and contested, with conflicts fuelled as much by commercial interest as by military and defence interests (Johnson-Freese 2016; Steer 2017). Much as cyber operations and cybersecurity play a critical role in national defence, space systems are now so integral to routine military operations, as well as to critical operations during conflict, that they have already become a target during both “grey-zone” operations and terrestrial warfare. The fact that space-based technologies are also integral to our daily civilian lives, means that avoiding space conflict — or at the very least, avoiding the negative impacts of a conflict that extends into space — is a global imperative. While cyberwarfare is already something we have had to come to terms with, preventing large-scale impacts on civilians of the use of cyber as a tool of war is also a global imperative.
The author argues that a greater understanding of the international humanitarian law (IHL) framework as it applies to the nexus between space and cyber can contribute to avoiding escalation of a conflict, and therefore to reducing risks to international peace and security. IHL can limit the potential impacts of space and cyberwarfare in space, in cyberspace and on Earth, which is in the interests of all nations, and of our global population.
The Risk of Conflict in the Space and Cyber Grey Zones
Since the beginning of the space age in the mid-twentieth century, geopolitics have played out in space just as they have played out on Earth. Whereas geopolitics in that early space era was dominated by the great powers, as was space, our contested world today is multi-stakeholder, influenced by multiple states of varying size and influence, by international and regional organizations, and by non-state actors including commercial entities, civil society and individuals. The space sector is also made up of these different actors, making space security more complex than it was last century. Similarly, while cyber operations have become part of routine operations between adversary nations, the greatest threats in the cyber domain may come from non-state actors.
Issues of conflict and security in the twenty-first century are not only “multi-stakeholder,” but also undeniably “multi-domain.” No situation plays out only on land, at sea or in the air, and operations in all these domains, as well as cyber and outer space, are integral to national and international security. For many years, cyber and space were seen as support domains to the traditional domains in which military operations take place; however, today entire military operations may play out in the cyber domain, and space has become a strategic domain unto itself, because the most effective way to compromise an adversary’s ability to see, hear and navigate, or even to access command-and-control systems, is to compromise their space systems (Steer 2017). Indeed, the most effective way to achieve this is often through a cyberattack on the space system.
Most of us have a decent awareness of the importance of cybersecurity for the protection of our privacy and personal finances. We also hear about cyberwarfare in the news: attacks on national infrastructure as a tool during political tensions or all-out armed conflict. Similarly, the critical importance of space-based technologies cannot be overstated. Satellite applications are today an inherent part of our daily civilian lives, as well as of national and international security. If we were to “lose space” — even for a day — the impacts would be catastrophic. The extent of military dependence on space-based applications means that interferences or attacks on space systems have increased in recent years.
These cyber and space operations tend to be grey-zone activities. The grey zone can be defined in two ways. The first is military operations or other uses of power to achieve national objectives that take place in times of tension but are short of an actual armed conflict (Wirtz 2017). The entire situation can be described as a grey zone between peace and war. The second use of the term is to describe specific tactics, whether they are undertaken during peacetime or during armed conflict, that are difficult to define under the laws of armed conflict. They may or may not be “attacks,” and therefore there is a grey area as to whether the laws of targeting apply (Schmitt 2012). In both definitions, “grey zone” has become associated predominantly with cyber operations but can include information warfare, disinformation, and many typical, temporary or reversible attacks or interferences with space systems, such as jamming or spoofing a signal, or dazzling or blinding an Earth observation satellite.
Cyber operations are highly effective grey-zone tactics because they are often difficult to attribute to an author, and they can have desired effects with limited impacts in the physical world. The same goes for most forms of temporary or reversible interferences with space systems.
Australia has provided a model for an international cyber engagement strategy (Soldani 2020), and many nations are developing more sophisticated ways to cooperate and engage through their militaries and foreign ministries. But the centrality of space for military operations has only been more recently evidenced in the establishment of the US Space Force in 2019, and the rise of “space commands” within existing armed forces in other countries, including Australia, Canada, France, Germany, India, Japan and the United Kingdom. China has already had a similar central unit for space in its military organization for some time. For allied and partnered countries, having a centralized space command is a prudent move to ensure coordinated operations, strategic approaches and the ability to assist in protecting each other’s space systems.
Another similarity the space and cyber domains share is the very strong military-civil nexus, due not only to the ways in which we all depend on both domains for civilian and military activities, but also to the fact that the applications, or the technologies themselves, are often serving civilian and government needs simultaneously. These “dual-use” systems, upon which both militaries and civilians depend, are being targeted during times of tension as well as during conflict, which creates risks for the commercial entities operating them, and for the civilians depending on them. Cybersecurity and cyber intelligence are often offered by the private sector (Lilli 2021), and the space sector is overwhelmingly commercialized. Of the approximately 4,800 operational satellites (as of the time of writing), approximately two-thirds are commercially owned (Burgueño Salas 2022). More than half of all operational satellites are owned by one company: SpaceX (Clark 2022). The fact that most of our space-based needs are provided by commercial entities creates a whole set of complexities when it comes to interstate tensions and warfare.
The risk posed by this kind of grey-zone targeting has increased in recent years for commercial entities, and for the civilian populations who depend on cybersecurity and on space systems. One example is the February 2022 Russian cyber interference with Viasat satellites. The desired effect, to compromise Ukrainian internet access, was achieved, but user populations in other countries were also affected, and some German wind farms that were dependent on those same systems were also impacted (Werner 2022).
Greater clarity of the rules of IHL and their application to the space and cyber domains among operators, commanders and decision makers across the government and private sectors, could contribute to the reduction of the risk of escalation and negative impacts on civilian populations.
The Applicability of IHL to the Space and Cyber Domains
Space is often described as unique compared to other domains because of its physics and the difficulty of accessing it. The global challenge of accurate space situational awareness to deal with the continually growing population of satellites and space debris is also unique. It is sometimes difficult to correctly attribute failures in space systems either to space debris, unintentional interference or a deliberate act — and if it is deliberate, it may be difficult to identify the responsible actor (Steer and Stephens 2020, 29). Avoiding conflict in space requires decision makers to have a sophisticated grasp of all these unique factors.
The cyber domain is also unique compared to other domains, for the obvious reason that it is not a physical domain but a virtual one. Electronic warfare and cyberwarfare have become integral parts of grey-zone operations, and interferences by non-state actors during peacetime have become a complex threat for governments to deal with. Attribution is also a great challenge in the cyber domain since plausible deniability is usually built into the design of any cyber operation.
Despite these differences, when it comes to the application of IHL, we simply need to apply familiar notions to new sets of facts and new technologies. Effective strategies over time require understanding when and how space or cyber are different, and when and how they are not. This is particularly true when it comes to IHL and the role these rules can play in reducing threats and mitigating the impacts of conflict that extends into space or the cyber domain. It is also particularly important given that one of the greatest threats to space systems is through cyberattacks.
IHL is made up of more than 60 international treaties that regulate the use of specific weapons, methods and means of warfare. The foundational treaties are the four Geneva Conventions, negotiated shortly after the Second World War, and the two 1977 Additional Protocols, following the horrors of the Vietnam War in particular (Cassese 1984). Almost all of the content of the Geneva Conventions, and much of the Additional Protocols, is considered to reflect customary international law, meaning that these rules bind states whether or not they have signed these treaties, and also bind non-state actors that are party to a conflict (Henckaerts and Doswald-Beck 2009).
Given the periods of history from which they emerged, the space and cyber domains are absent from the formulation of IHL rules. Nonetheless, neither space nor cyber is a legal void. Customary international rules of IHL apply to activities in space and cyber operations, due to the nature of IHL as a special body of law that prevails over any potentially conflicting obligation, and can only be derogated from in extreme situations (Dinstein 2016, 21). Thus, it is a body of law that must be applied to all conflict situations. The very purpose of IHL is to ensure the principle of humanitarianism prevails in situations of conflict, regardless of where such conflict takes place (Clapham and Gaeta 2014). Article 1 of all four of the Geneva Conventions obliges states to “respect and to ensure respect for the present Convention in all circumstances” (emphasis added), ensuring all future warfare would fall under these rules. As such, IHL has been recognized by the International Court of Justice (ICJ) to apply “to all forms of warfare and to all kinds of weapons, those of the past, those of the present and those of the future.”1
There is no doubt that warfare, and the use of military tactics during grey-zone situations or times of tension that may fall short of war, can have devastating consequences.
In respect of space in particular, article III of the 1967 Outer Space Treaty states that all activities in outer space must be carried out “in accordance with international law.” This, in effect, exports many rules, norms and principles of various bodies of international law to space, including IHL, international environmental law, human rights law, international criminal law, and general rules such as the law of treaties, state responsibility and others.
The application of IHL to cyber operations has been confirmed by the UN Group of Governmental Experts on Advancing Responsible State Behaviour in Cyberspace2 and articulated clearly in the Tallinn Manual on the International Law Applicable to Cyber Warfare (Schmitt 2013).
The purpose of IHL is to limit the impacts of warfare by protecting civilians and civilian objects, protecting the environment from long-term and unnecessary damage from weapons, and protecting the rights of those voluntarily involved in warfare, either as militaries or as armed groups. There is no doubt that warfare, and the use of military tactics during grey-zone situations or times of tension that may fall short of war, can have devastating consequences. And there is no doubt that some actors do not heed the laws of war, leading to the news stories that we all find so upsetting. But the fact is, most actors adhere to most rules of IHL most of the time during conflict because it is in their interests to do so, and because of the expectation of reciprocity. Thus, while we cannot prevent space or cyber from being implicated in military activities, the application of IHL can have a positive constraining effect.
The Application of IHL Norms, Rules and Principles to Space
The two core principles of IHL are military necessity and humanity, which the ICJ has described as “the fabric of humanitarian law.”3 On the one hand, military necessity requires that force is used only when it is indispensable or imperative to the direct aims of the conflict (for example, submission of the adversary); that such force is proportionate to those aims; and that no unnecessary suffering is caused by such force. On the other hand, balancing the principle of military necessity is the principle of humanity, which requires that any actions undertaken during a conflict are done so with a minimum loss of life, minimum standard of humanity toward wounded or captured soldiers, and maximum possible protection of civilians who are not engaged in conflict (Steer and Stephens 2020, 34–35).
The application of these two general principles in specific situations is broken down into further operational principles, the most important of which are distinction and proportionality.
The principle of distinction has a heritage of hundreds, if not thousands, of years of organized conflict: ancient Chinese and Indian texts contain instructions that only those who are armed may be attacked, and that the civilian population should be protected. Today, this rule of distinction is codified in article 48 of Additional Protocol I: “In order to ensure respect for and protection of the civilian population and civilian objects,” parties to a conflict are obliged only to direct their operations against military objectives, and never against civilians or civilian objects.
The application of this principle guides commanders in their targeting orders and requires a case-by-case analysis in each new factual situation. In traditional conflicts, the principle of distinction means that it is unlawful to target, for example, schools and hospitals. In cyber operations and in space, the challenge is identifying the impacts of targeting decisions on civilians. In the Tallinn Manual, a cyberattack is defined as “operations that cause injury or death to people or damage or destroy objects” (Schmitt 2013, Rule 30). The harmful impact in the physical world is at the heart of this definition. The principle of distinction applies to cyberattacks (Rule 31), which means that civilians and civilian objects (including computers, computer networks and cyber infrastructure) may never be the object of a cyberattack (Rules 32 and 37).
In space, it can be more challenging to identify which assets or systems are civilian, and which are military, since the majority of satellites are commercially owned, and many space systems are “dual use,” providing services for civilian and military needs concurrently.
In terrestrial conflicts, dual-use objects can also prove a challenge. Some objects, such as a bridge, railroad, electricity distribution facility or telecommunications centre, may generally be civilian, but under some circumstances may be used for military purposes and thus lose their protected status and become lawfully targetable. The rule in IHL errs on the side of continued protection: in the case of doubt, an object shall be presumed to be civilian and therefore protected (Additional Protocol I, article 53(3)). This means that the decision to target a satellite or space system requires a high level of scrutiny and a high level of confidence that it is solely military-owned and provides solely a military service.
Even if an object, cyber system or space infrastructure is identified as targetable, the principle of proportionality must then be applied. An attack must never lead to civilian injury, loss of life or damage to civilian objects that would be “excessive in relation to the concrete and direct military advantage anticipated” (Additional
Protocol I, article 51(5)(b)). If there are expected significant knock-on effects of a cyberattack on a space system for civilians, then the attack may be unlawful. For example, if a telecommunications system, electricity infrastructure or water management facility that was dependent on space systems were to be targeted, or if a cyberattack were aimed at the operations of those systems, the proportionality analysis would weigh heavily — perhaps more heavily than in other domains (Steer and Stephens 2020). Targeting a navigation system such as the Global Positioning System would likely always be prohibited, because of the enormous civilian dependency on this military technology, to which we have free access in many countries.
Reducing Threats in Space and Cyberspace by Clarifying IHL
These norms, rules and principles of IHL are long-standing, binding laws that limit the impacts of warfare, whether on Earth or in space. But they can also have a positive effect on reducing the risk of warfare extending into space in the first place, because they provide clear, neutral norms, whereas the lack of transparency and clarity regarding space activities and capabilities form potentially the greatest threat.
The author has argued elsewhere that clarifying the application of IHL to space and space systems can have a cooling effect during terrestrial conflict where space systems are implicated (Steer 2022).4 Preventing disproportionate or unnecessary attacks on space systems may be one important way of preventing terrestrial conflict from extending into space.
Additionally, having clarity and international agreement on the application of IHL to space and cyberspace can be helpful during grey-zone operations, whether or not there is an existent situation of armed conflict. This is because IHL limits on targeting are often applied during grey-zone situations precisely to prevent escalation into an armed conflict. The risk of triggering an armed conflict because a particular action is miscalculated or interpreted by an adversary as something more than the author of the action intended, can be avoided if the constraining rules of IHL are applied.
Anything that can contribute to greater clarity, transparency and shared norms is a contribution to reducing threats. Therefore, the clear articulation by states as to how they interpret that application of IHL to space and cyberspace is an important step forward in preventing escalation or extension of conflict in these domains, which may be one of the greatest security imperatives of the twenty-first century.
