Connect with us

Hi, what are you looking for?



Red Cross Publishes Rules of Engagement for Hacktivists During War

ICRC is telling hacktivists involved in conflict during war to avoid targeting civilian objectives and hospitals, or making threats of violence.

The International Committee of the Red Cross (ICRC) is urging hacking groups involved in conflict during war to abide by a set of rules meant to protect the general population.

According to the organization, which oversees and monitors the rules of war, an increasing number of civilian hackers are getting involved in military conflicts by means of digital operations, especially in the context of the Russian war in Ukraine.

“With many groups active in this field, and some of them having thousands of hackers in their coordination channels and providing automated tools to their members, the civilian involvement in digital operations during armed conflict has reached unprecedented proportions,” the ICRC says.

This level of engagement from civilian hackers, the organization points out, is worrying because some groups may be directly or indirectly targeting civilian objectives, because these hackers may expose themselves and their close ones to military operations, and because this involvement blurs the line between civilians and combatants.

These hackers, the ICRC notes, may or may not abide by the national laws. During armed conflicts, however, they should follow the universal set of rules that the international humanitarian law (IHL) provides, and which are aimed at safeguarding “civilians, and soldiers who are no longer able to fight, from some of the horrors of war”.

While IHL does not prohibit hacking, nor the involvement of civilians in hacking operations, it does set “elementary considerations of humanity on the protection of civilians, meaning obligations that everybody must respect when conducting operations in the context of an armed conflict, irrespective of the reasons for the conflict”.

When engaging in cyber activities against military or civilian targets during an armed conflict, civilian hackers may become liable for their actions, and risk being considered and prosecuted as criminals or terrorists if captured, ICRC points out.

As such, the organization sets out eight rules of engagement for civilian hackers involved in war:

Advertisement. Scroll to continue reading.
  • Do not target civilian objectives,
  • Do not use malware or tools that spread automatically and which may indiscriminately damage military and civilian objectives alike,
  • When launching a cyberattack on a military objective, avoid or minimize impact on civilians,
  • Do not target medical and humanitarian facilities,
  • Do not target objectives impacting the survival of the population or which may release dangerous forces,
  • Do not make threats of violence to spread terror among the civilians,.      
  • Do not encourage the violation of international humanitarian law,
  • Comply with these rules even if the enemy does not.

Under IHL, a cyberattack is a cyber operation that may – directly or indirectly – negatively impact infrastructure and data (by damaging, disabling, or destroying it), or may lead to injury or death of individuals. Activities leading to unauthorized access to information are not included here.

According to ICRC, no country should encourage or tolerate the involvement of hackers in cyberattacks in the context of an armed conflict, as this could lead to violations of applicable law.

The organization notes that each country should adopt and enforce national laws to regulate civilian hacking and should ensure that civilians engaging in cyber operations in times of war respect IHL.

Each state, ICRC says, is internationally legally responsible for the actions of hackers acting on behalf of that state, should not encourage civilian hackers to violate IHL, should prevent IHL violations by civilian hackers on their territory, and should prosecute war crimes and IHL violations, including cyberattacks that target ‘the enemy’.

“IHL sets out essential rules to limit the effects of armed conflicts on civilians. No one that participates in war is beyond these rules. In particular, every hacker that conducts operations in the context of an armed conflict must respect them, and states must ensure this is the case to protect civilian populations against harm,” ICRC notes.

The BBC has interviewed several important hacktivist collectives involved in the Russia-Ukraine conflict, including the IT Army of Ukraine, Killnet and Anonymous Sudan, and they all indicated that they are unlikely to follow the ICRC’s recommendations. 

Related: UK Warns of Russian Hackers Targeting Critical Infrastructure

Related: A Year of Conflict: Cybersecurity Industry Assesses Impact of Russia-Ukraine War

Related: The Lessons From Cyberwar, Cyber-in-War and Ukraine

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join us as we delve into the transformative potential of AI, predictive ChatGPT-like tools and automation to detect and defend against cyberattacks.


As cybersecurity breaches and incidents escalate, the cyber insurance ecosystem is undergoing rapid and transformational change.


Expert Insights

Related Content


WASHINGTON - Cyberattacks are the most serious threat facing the United States, even more so than terrorism, according to American defense experts. Almost half...


Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.


Russian espionage group Nomadic Octopus infiltrated a Tajikistani telecoms provider to spy on 18 entities, including government officials and public service infrastructures.


Several hacker groups have joined in on the Israel-Hamas war that started over the weekend after the militant group launched a major attack.


On the first anniversary of Russia’s invasion of Ukraine, cybersecurity companies summarize the cyber operations they have seen and their impact.


Websites of German airports, administration bodies and banks were hit by DDoS attacks attributed to Russian hacker group Killnet


Ask any three people to define cyberwar and you will get three different answers. But as global geopolitics worsen and aggressive cyberattacks increase, this...


The war in Ukraine is the first major conflagration between two technologically advanced powers in the age of cyber. It prompts us to question...