The Red Cross plans to extend its protection to cyberspace

In the physical world, a Red Cross painted on a hospital serves as a symbol in times of war; a new ‘digital emblem’ now also wants to identify online infrastructure protected under the Geneva Conventions. Copyright 2019 The Associated Press. All Rights Reserved.

The International Committee of the Red Cross (ICRC) has unveiled a prototype of its new digital emblem designed to protect humanitarian and health organisations against cyberattacks.

Humanitarian organisations and health services are increasingly being targeted during conflicts. This occurs both in the physical world, as during the Israeli bombardments in Gaza, and in the online world, where cyberattacks can have real human costs.

Hospitals and humanitarian agencies depend on data, servers, and digital networks. When a cyberattack happens, “medical care is delayed, ambulances can’t be dispatched, and families are left without news of their missing loved ones”, says ICRC Director-General Pierre Krähenbühl. “Aid doesn’t reach those who need it, people suffer, and lives can be lost.”

Digital emblem

On July 9th, at the headquarters of the European Organization for Nuclear Research (CERN) in Geneva, the ICRC presented its plans to boost defence against cyberthreats: a prototype of a digital emblem developed with the federal technology institute ETH Zurich.

This emblem identifies online infrastructure that is protected under international humanitarian law – just as a visible Red Cross emblem on an ambulance signals protection under the same laws.

The digital version is not a traditional visual symbol but a digital signature. It will certify the identity of digital infrastructure belonging to the ICRC, national Red Cross and Red Crescent societies, and military and civilian health services.

However, just as the Red Cross symbol doesn’t guarantee safety in the physical world, the new digital emblem can’t ensure complete protection against cyberattacks.

Growing threat

“The threat of cyberattack is clear and present, and unfortunately is getting worse,” says Stéphane Duguin, CEO of the Protect.ngo foundation in Geneva (formerly the CyberPeace Institute).

Dugin explains that humanitarian organisations are “easy targets” because they are vulnerable to two types of threat. The first comes from criminals who extort ransoms indiscriminately. The second comes from state actors that target organisations whose activities, geographic location, or beneficiaries they oppose.

Humanitarian organisations are also vulnerable because a lack of stable funding can make it difficult to invest in cyberdefence.

In 2022, the ICRC itself suffered a cyberattackExternal link on servers containing the personal data of over 515,000 people worldwide. In May, the UN’s World Food Programme was hacked in an attack that exposed sensitive data about 600,000 households in Gaza. This was the sector’s “largest-known [data] breach”, according toExternal link the nonprofit news outlet The New Humanitarian, which broke the story.

>> Can a cyberattack amount to a war crime? Read more in our article below:

“Medical and medical-transport units are already protected under international humanitarian law,” says Samit D’Cunha, a legal adviser at the ICRC headquarters in Geneva. “The goal of the digital emblem is to make that protection apparent” online.

The 1949 Geneva Conventions form the foundation of international humanitarian law, also known as the laws or rules of war. They impose limits on the conduct of hostilities and protect civilians, wounded soldiers, prisoners of war, and certain critical infrastructure such as medical facilities. Destroying patient data, impeding the operation of medical equipment, and disrupting medical supply chains therefore violates the Geneva Conventions.

‘A good solution’

The digital-emblem prototype has already been tested by several national Red Cross societies. It is based on a cryptographic signature that alerts any cyberattacker targeting, for example, a hospital that the institution is protected under the Geneva Conventions.

“It’s a good solution, especially for minimising the risk of targeted attacks in conflict situations,” says Duguin, although he stresses that additional protective measures should be used as well. “It’s a unique tool that allows [organisations] to confront attackers with the obligations of international humanitarian law.”

Dugin points out, however, that the cost of the digital emblem is not yet known, and some organisations might not have the technical or financial capacity to adopt it.

Visibility increases protection

One question remains: given the widespread disregard for the laws of war, will the digital emblem really afford better protection for humanitarian and medical digital infrastructure?

Laurent Gisel, head of ICRC’s arms and conduct of hostilities unit, says the ICRC is “counting on” it. He explains that after consulting with various states and cybersecurity experts, ICRC concluded that the digital emblem would be effective. “Time will tell,” he says. “But history teaches us that visibility can enhance protection. In 1864, when the Red Cross emblem was adopted, some might have feared that military ambulances displaying it would be targeted more than when they were less easily identifiable. But the opposite proved true.”

The ICRC’s recent event at CERN marked a milestone for the digital emblem: the launch of its second phase of development, which is expected to lead to its implementation. This phase of testing and refining the prototype will take several years. In addition, globally recognised technical standards will have to be developed by the International Telecommunication Union (ITU) in Geneva and by the Internet Engineering Task Force (IETF).

>> Humanitarian law is under pressure, but that doesn’t mean it’s been forgotten completely:

Legal update needed

Existing law will also need to be updated. “International humanitarian law will have to include a definition of the digital emblem, as it does for existing [visual] emblems like that of the Red Cross, which are defined in the Geneva Conventions,” says Gisel.

This would not be the first update of the Conventions in response to technological progress. In the 1970s, in order to enable identification of medical aircraft at night, when the Red Cross emblem on the fuselage is not visible, a distinctive flashing blue light was introduced. Its technical specifications were defined in Annex I of the 1977 Protocol Additional I to the Geneva Conventions.

Gisel adds that “the integration of the digital emblem into international humanitarian law will allow the specific rules regulating [Red Cross] emblems to be applied fully to the digital version, in particular states’ obligation to crack down on abuses, such as unlawful use aiming to protect military digital infrastructure”.

The states party to the Geneva Conventions have two options for integrating the digital emblem into the laws of war. The first would be to modify Annex I of the 1977 Protocol Additional I. The second would be to negotiate a fourth additional protocol – a longer and more complex process.

Edited by Virginie Mangin/ptur; adapted from French by Katherine Bidwell/ds