The Brief Special Edition: Iran attacked what exactly?
Hi friends,
It’s been another busy news week in the foreign policy world—more on that in the “Also on my radar” section below—but I want to start with an issue with big domestic implications in the United States: specifically, attacks on water infrastructure in seven U.S. states.
Together, we’ll cover what we know about the situation so far, as well as some background on when cyber activities can be considered a use of force under international law, and whether and how cyberattacks on civilian infrastructure can constitute war crimes.
What we know
The FBI and the EPA issued a public advisory last week stating that “malicious cyber actors” were attacking critical infrastructure, including water and wastewater facilities, in at least seven states. The attacks tampered with Programmable Logic Controllers (PLCs) by changing IP addresses and setting passwords, resulting in loss of function in certain facilities. The New York Times reports that there are no indications “that any water supply had been altered or made unsafe to drink,” though the FBI indicated that the attacks resulted in some “loss of pressure and flooding,” which can allow untreated groundwater to seep into pipes. The list of seven states has not been fully disclosed, though it includes Minnesota and Michigan.
U.S. officials have said that they believe Iran may be responsible for the cyberattacks, but that the assessment was preliminary and had not yet been proven. For his part, however, President Trump has blamed Minnesota (!!) for the attacks, stating, “I think Minnesota is behind it. I don’t think there was an Iranian cyberattack.”
In another time, a sitting president blaming a U.S. state for an attack by a foreign actor seems like it would be an impeachable offense, or at least the subject of a sustained Congressional inquiry, but as things currently stand, the statement appears to have made barely a ripple in the current news cycle. But here we are.
Can cyberattacks be an act of war?
In certain circumstances, yes, they can. In 2012, then-Legal Adviser of the U.S. State Department, Harold Koh, gave remarks on the U.S. position on exactly this question, explaining that “[c]yber activities may in certain circumstances constitute uses of force within the meaning of Article 2(4) of the UN Charter and customary international law.”
He went on to state that “[c]yber activities that proximately result in death, injury, or significant destruction would likely be viewed as a use of force,” and that factors to evaluate in assessing whether a cyber event constitutes a use of force include “the context of the event, the actor perpetrating the action (recognizing challenging issues of attribution in cyberspace), the target and location, effects and intent, among other possible issues.”
Can cyberattacks ever constitute war crimes?
Also yes. You will probably recall from our law of war explainers that international humanitarian law is designed to both govern the methods used to conduct war, as well as to protect potential victims of war during a conflict. When cyberattacks constitute a use of force, they are subject to the same principles of international law as conventional uses of force. Those principles include necessity and proportionality, among others.
Additionally, one of the key factors at issue in this particular set of cyberattacks is that they targeted civilian infrastructure—in this case, water and wastewater management systems. Article 48 of Additional Protocol I to the Geneva Conventions requires parties to distinguish “at all times…between civilian objects and military objectives and accordingly shall direct their operations only against military objectives.”
Military objects are defined by article 52 of Additional Protocol I to the Geneva Conventions as those objects “which by their nature, location, purpose or use make an effective contribution to military action and whose total or partial destruction, capture or neutralization, in the circumstances ruling at the time, offers a definite military advantage.” In other words, civilian objects can sometimes be a legitimate military target, and this exact question is the subject of quite a lot of international legal scholarship. But an analysis is required to reach that determination, and can’t just be assumed.
More specifically, attacks against objects that are indispensable to the survival of a civilian population are a violation of international humanitarian law, with very few exceptions, such as when such an object is being used in direct support of military operations. Article 54(2) of Additional Protocol I to the Geneva Conventions provides, “[I]t is prohibited to attack, destroy, remove, or render useless objects indispensable to the survival of the civilian population, such as foodstuffs, agricultural areas for the production of foodstuffs, crops, livestock, drinking water installations and supplies and irrigation works, for the specific purpose of denying them for their sustenance value to the civilian population or to the adverse Party, whatever the motive, whether in order to starve out civilians, to cause them to move away, or for any other motive.”
While the U.S. is not a party to Additional Protocol I, the articles discussed here are widely considered to be customary international law. In the remarks referenced above, Legal Adviser Harold Koh applied these principles to cyberattacks, stating, “The jus in bello principle of distinction applies to computer network attacks undertaken in the context of an armed conflict. The principle of distinction applies to cyber activities that amount to an ‘attack’ – as that term is understood in the law of war – in the context of an armed conflict. As in any form of armed conflict, the principle of distinction requires that the intended effect of the attack must be to harm a legitimate military target. We must distinguish military objectives – that is, objects that make an effective contribution to military action and whose destruction would offer a military advantage — from civilian objects, which under international law are generally protected from attack.”
If Iran is indeed responsible for the attacks on U.S. water systems, it is unfortunately far from the only strike on water infrastructure during the war. The U.S. reportedly struck a desalination plant in Bonji, Iran earlier this year, disrupting water supply to approximately 10,000 people, and has also struck bridges, railways, energy infrastructure, and ports. Around the same time as the U.S. strike in Bonji, Iran damaged a power and water desalination plant in Kuwait. International law, and especially international humanitarian law, is designed in part to prevent parties to a conflict from engaging in a race-to-the-bottom in order to prevail. But that in turn depends, in no small part, on those parties not wanting to hit rock bottom in the first place.
Also on my radar
- Last week, President Trump announced that Hamas had agreed to disarm, a key condition of the U.S. proposal to end the war in Gaza. (The announcement of that proposal was less than a year ago, but it feels like an entire lifetime—if you need a refresher, you can check out our coverage here and here.) Hamas stated that it would hand over its weapons to the National Committee for the Administration of Gaza, and that disarmament was contingent on the withdrawal of Israeli troops. However, it was not clear whether Israel had agreed to Hamas’s disarmament plan, and Israel carried out military strikes in Gaza over the weekend;
- Approximately 50,000 migrants entered Ceuta, an autonomous city of Spain, from Morocco after checkpoints and blockades were removed. Moroccan law enforcement either did not stop, or by some accounts actively allowed, the migrants to cross the border. Conflicting reasons have been given for the removal of the blockades and the influx of people taking advantage of an easier crossing: Spain has accused “human trafficking mafias” of playing a role, and Morocco has also blamed “criminal organizations.” But the Guardian reports that there is speculation that the Moroccan government may have facilitated the opening of the border in response to Spanish Prime Minister Pedro Sánchez’s recent visit to Algeria, which supports independence for Western Sahara, a territory occupied by Morocco;
- The Alliance for American Leadership is circulating a letter asking members of Congress to pledge to dedicate 2% of the federal budget to diplomacy, development, and humanitarian assistance. You can read more—and add your name to the letter—here.
I'll see you back here next week--may the start of August be an easy one for us all!
Alexis
You can follow The Connection on Bluesky, Facebook, Instagram, LinkedIn, and Threads.