How do the Geneva conventions work in a cyber war?

The Red Cross is working on a digital emblem to protect its data from cyber attacks.

The Red Cross emblem is one of the world’s most recognised symbols. It, and its fellow emblems the red crescent and the red crystal, are a sign to armies and armed groups that this building or vehicle must not be attacked. They tell the wounded, or the displaced, that help is at hand.

“The emblem is a symbol of hope” says former ICRC delegate Philippe Stoll. “It’s a sign that, OK there is a human in the midst of war, of awful situations.”

“There are people who are looking at this emblem because they know, maybe their family will be found, or maybe they will get medical treatment.”

Stoll should know; he has worked for the ICRC in the West Bank, Sierra Leone, Myanmar, Ukraine, Afghanistan, and more. But now, he’s devoting himself to a new project: developing a digital emblem that, in the age of cyberwarfare, will try offer the same protection as the physical emblem. Stoll, and in a way the emblem itself, are the focus of our Inside Geneva podcast this week.

>>>Listen to this week’s episode:

The ICRC has been working on a digital emblem for a while. The organisation itself suffered a cyberattack in 2022, when the details of more than half a million people registered with the Red Cross Restoring Family Links service were stolen. It was a highly professional attack, the Red Cross said at the time. Fortunately, it appears the details of vulnerable people, many of them searching for missing loved ones, were never used in an exploitative way.

But the possibility is always there. “It’s not a question of if, it’s more a question of when,” says Stoll. “We know that the ICRC has access to information that is highly interesting for state or non-state armed groups.”

The potential harm is great, he adds. “The distress of people not being able to get the information online because it was hacked. The fact that some information might put your family or you at risk because you belong to a tribe or clan that is under attack.”

How will it work?

So how would a digital emblem work? After all, the ones we know are physical entities, fixed to the side of a vehicle, or the wall of a hospital. And what exactly needs to be protected in cyberspace?

Samit d’Cunha, the ICRC’s legal advisor, says there is “clear and unambiguous protection afforded to medical and humanitarian data”. So hacking a Red Cross hospital’s servers to steal data would be a violation of protected status.

The digital emblem then, would appear when cyber warriors try to attack protected entities. “We put…a virtual red cross on the server to say to those who want to attack, this belongs to the Red Cross, and don’t attack it,” explains Stoll.

Of course, he adds “it doesn’t prevent them from doing it. You can have an emblem on an ambulance, you can {still} shoot at it. The idea is to try to reverse the responsibility onto the attackers; they won’t be able to say, ‘I didn’t know.’’’

Standards and big tech buy in

To unveil the progress made with the digital emblem, the ICRC this month held a one day conference in July. It was the perfect timing; Geneva was already full of IT specialists, tech industry leaders, and diplomats for the AI for Good Summit. Without support from all those groups, and especially big tech, the digital emblem won’t get off the ground, and Stoll believes the need for it is becoming urgent.

The picture we may imagine of a cyber warrior is of a lone individual, sitting in a darkened room, hunched over a computer. But it’s not like that anymore. “A human doing only one attack per hour or something like that, it’s in the past,” says Stoll. Now, “it’s huge quantities. And you generate a program to do it for you.”

In fact, he continues, the whole process may no longer have humans directly involved. “Cyberattacks are more and more done by machines. We are talking about a machine talking to another machine, and this emblem is a way to identify something that the machine will understand and not attack.”

But if a machine is to recognise another machine displaying the Red Cross digital emblem, the world’s biggest IT companies, the biggest software developers, will have to support the process.

One particular hurdle is that a number of these big players are also making products for the military. Imagine a conflict scenario in which a targeting system for drones is made by the same company which provides the software for a hospital. A cyberattack might, targeting that particular company, take out both systems.

Stoll says the big tech companies are “super interested”, in getting involved with the digital emblem, but agrees “this won’t happen overnight.”

And he points out that the ICRC has always tried to keep up, or even keep ahead of, developments in warfare to make sure the Geneva Conventions continue to apply. Whatever the weapon, the principles of proportion, of protection of civilians, medical staff, and prisoners of war, must be upheld.

“Throughout history war has evolved and the ICRC pushes international humanitarian law to follow,” says Stoll. “We have a responsibility. People who are suffering from conflict, they look to us to. We try our best, it’s not always successful, but we want to push the limits for better protection of civilians wherever they are.”

>>> Listen to the whole interview on Inside Geneva.

Edited by vm