Cyber POWS and the Second Geneva Convention

[Jeffrey Biller, Lt Col, USAF, is the Associate Director for the Law of Air, Space and Cyber Operations at the Stockton Center for the Study of International Law, US Naval War College.]

Those familiar with Patrick O’Brian’s Aubry-Maturin series of novels (brought to film in Master and Commander starring Russel Crowe) will know that the boarding and seizure of ships was a common feature of naval warfare in the Age of Sail. However, modern naval conflicts rely more on the sinking of ships than their capture. Although the standoff range of most modern weapons weighs against an imminent change of this feature, there is one modern method of warfare that raises the question of capture once again: cyber warfare. This post is the second in a series examining the impact of cyber on the law of naval warfare through the lens of the updated commentary to the Second Geneva Convention (GCII). This first of this series examined the question of whether a crew can be “shipwrecked” within the meaning of GCII for purposes of Article 12 protections. This post takes that scenario one-step further and examines the status of a crew on a ship commandeered by cyber means.

Although indeed more difficult from a technical standpoint, it stands to reason that if a ship could be completely disabled through an offensive cyber operation, those same networked systems could also be controlled by an outside entity. With a high enough level of control, it would functionally turn the ship into a remotely operated vessel, similar to other drone-type vehicles. The first question to ask is whether the analysis differs from a ship disabled by cyber means. This could simply be a situation where the crew is “in peril” and, if they refrain from hostilities, must be afforded Article 12 protections. However, if someone is in control of the ship and could choose to pilot the crew to safety, is it really in peril?

Assuming the crew, for whatever reasons, chooses to stay onboard the ship and not disable it through mechanical means, it is fair to ask if they must be afforded Article 16 protections as prisoners of war (POW), which states that “…the wounded, sick and shipwrecked of a belligerent who fall into enemy hands shall be prisoners of war, and the provisions of international law concerning prisoners of war shall apply to them.” Breaking that article down into its parts, we first examine the phrase “wounded, sick and shipwrecked of a belligerent.” It may be tempting to suggest that, at this point, the crew is not wounded, sick or shipwrecked, so Article 16 would not apply. However, para 1575 of the updated commentary states that:

Although in setting down who is a prisoner of war Article 16 uses the looser formulation ‘the wounded, sick and shipwrecked of a belligerent’ rather than the more technical terms used in Article 13, the definition of prisoners of war in the Second Convention is not meant to diverge from that in the Third Convention.

The Third Geneva Convention (GCIII), Article 4, clearly states that “[p]risoners of war, in the sense of the present Convention, are persons belonging to one of the following categories, who have fallen into the power of the enemy,” and covers those “soldiers who became prisoners without fighting.” Essentially, this means that in whatever manner the sailor comes into the power of the enemy, regardless of being wounded, sick, or shipwrecked, they are now a POW.

The next element is the crux of the analysis, the phrase “who fall into enemy hands.” The obvious difficulty is deciding whether this is possible when the enemy is not physically present. The updated commentary, in para 1568, states that “the phrase ‘fall into enemy hands’ is sufficiently broad to cover capture or surrender.” Here, let us assume the crew has neither chosen to leave the ship nor made an affirmative action of surrender. Although para 1571 of the updated commentary suggests “[n]o active ‘capture’ is necessary,” the enemy certainly seems to have captured the ship, and if the crew is unwilling or unable to abandon the captured ship, are they also captured? The updated commentary makes no further definition, which is understandable. Capture without the physical presence of the enemy is a novel concept with few, if any, analogies.

One analogy is the case of unmanned combat systems, such as drones. If the operator of an attack drone witnesses a group of enemy combatants with weapons dropped and waving a white flag, should those soldiers be considered hors de combat and no longer subject to attack? The lack of ground forces to process as POWs those who surrender has made this question a matter of some debate due to the potential for misuse. The difference in the current situation is the greater potential degree of control exercised over those aboard a ship at sea as opposed to soldiers on the ground. The crew of a ship for which they no longer have effective control is subject to the whims of their controllers while they remain onboard the ship. The crew could potentially be driven into a perilous situation or perhaps even internally detonated if the weapon systems have been accessed.

Given the difficulty of defining what is required for capture without the presence of enemy soldiers, it may be instructive to turn a separate, but related, body of law: international human rights law (IHRL) for assistance. Although unlikely to apply in the current scenario, IHRL can offer a useful insight into what level of control is required for certain protective obligations to attach under international law. For example, the European Convention of Human Rights held in Al Skeini, paras 133 – 140, that the Convention applies extra-territorially either through the exercise of effective control over an area or through the exercise of control over a person by a State agent. In an earlier case, the Court had also held that human rights obligations attach to civilians on board a ship when military forces placed the crew under guard and gained control of the ship’s navigation, thereby exercising “full and effective” control. In Al-Skeini, the court ruled that the “exercise of physical power and control over the person in question” was critical in establishing jurisdiction.

Although “full and effective control” is a human rights concept, it illustrates that physical power and operational control of a ship’s navigational functions are potential factors in determining what level of power is required by enemy forces before obligations are placed upon them under that legal regime. It may be that this level of control can be obtained by the use of cyber means and if it is, then the crew should be considered as POWs with the attendant protections. This brings us to the third element of Article 16: “the provisions of international law concerning prisoners of war shall apply to them.”

What would be the obligations towards a crew on a warship over which they no longer have control? Although these requirements are primarily contained in GCIII, the updated commentary to GCII does spell out certain provisions. Of note, it states in para 1579 that “the time a person is held on board is limited to the absolutely necessary.”

If the potential for POWs to be taken under such circumstances exists, what must navies do to prepare? First, navies looking to employ cyber operations involving gaining control over ships should formulate a plan of what to do with the crew if they remain onboard. The Geneva Conventions place certain obligations on how they are to be treated and States must understand how they will transfer that crew to a more appropriate facility. Second, navies that employ networked systems would be wise to ensure there is a mechanism to revert to mechanical control or formulate clear plans as to their operating procedures in the event of a successful cyber-attack.