See all articles

Retaliatory strikes as a reaction to cyber-attacks?

The recent Israeli airstrike against HamasCyberHQ from an IHL perspective


Between Friday (3 May 2019) and Sunday (5 May 2019) violence erupted again between Israel and the Palestinians led by governing Hamas in the Gaza Strip. In the course of a severe exchange of violence between the two conflict parties, the Israel Defense Forces (IDF) conducted a physical attack countering an offensive cyber operation by Hamas. According to IDF, the air strike was conducted against the Hamas Cyber Headquarter and a reaction to a cyber operation. Some accounts took this information up and claimed a precedent, arguing that it was the first time a nation reacted to an ongoing cyber operation with a physical strike. In the following I will discuss some of the relevant questions of the law of armed conflict (LOAC) and show that the airstrike does not constitute a legally relevant precedent.

Applicability of Law of Armed Conflict

International humanitarian law and/or LOAC is applicable in international and/or non-international armed conflicts (common Art. 2 GC I-IV, Art. 1 (3), (4) AP I– int. armed conflict; and Art. 3 GC I-IV, Art. 1 AP II– non-int. armed conflict). Both legal frameworks have nearly identical basic sets of rules, which are accepted as customary international law. At least the cardinal principles of humanitarian law – the principle of distinction and the prohibition to cause unnecessary suffering – are in common.

Without prejudice about the legal status of the Gaza Strip the applicability of the LOAC requires an armed conflict. According to the definition of an armed conflict by the ICTY the exchange of rockets, artillery fire and the air strikes between the conflict parties constitute protracted armed violence between governmental authorities of Israel and the Hamas as organized armed group – OAG. Besides the highly controversial topic of ‘Palestine’ as a State, the Gaza Strip and the governing Hamas predominantly are not considered as a State on their own. Thus, the conflict most likely is non-international. In any case the conflict amounted to the necessary level for the applicability of LOAC and the cardinal principles.

Applicable Rules to Airstrikes

Besides the rules of the weapons law, meaning the rules that prohibit certain types of weapons and their effects, compare Art. 35 (2) AP I, Art. 51 (4) lit. b and c AP I and Art. 35 (3) AP I the legality of airstrikes is governed by the so called ‘targeting law‘. The term refers to the set of rules which regulate attacks directed at a certain target. Art. 57 AP I contains a paradigmatic targeting process in accordance with LOAC. Inter alia the following rules have to be respected concerning airstrikes.

Attacks on targets in an area where civilians live, in particular, have to respect the principle of distinction. The principle obliges to differentiate between civilians and combatants, civilian objects and military objectives, thus, between unlawful and lawful targets (Art. 48, 51 and 52 AP I).

According to Art. 51 (3) AP I civilians shall be protected and attacks may not be directed at them, unless and for such time as they directly take part in hostilities (the Direct Participation in Hostilities Rule or ‘DPH-Rule’). Civilians which directly participate in hostilities become a lawful target for the duration of their participation. When they fulfill a continuous combat function this loss is retained. Members of OAGs generally are assumed to have a continuous combat function and may be attacked at all times just the same as regular combatants (compare the ICRCs DPH study).

Likewise, originally civilian objects that are used for military purposes can be attacked. On the other side it is prohibited to hide military targets between civilians, in civilian objects (Art. 58 AP I) and to use civilians as protective shields against attacks (Art. 51 (7)AP I). It constitutes a violation of LOAC if protected areas or objects like hospitals, mosques, schools (…) are abused for military gains as in Art. 51 (7), 54 (3), 58 AP I.

Before and during the attack certain precautions have to be taken. Especially in inhabited areas warnings should be issued before an attack, see Art. 57 AP I.

Finally attacks are prohibited if they may be expected to cause incidental loss of civilian life, injury to civilians, damage to civilian objects (…), which would be excessive in relation to the concrete and direct military advantage anticipated, see Art. 57 (2) (a) (iii) AP I. Therefore, parties of a conflict are obliged to use a minimum of force in civilian surroundings.

The Airstrike against HamasCyberHQ

Concerning the airstrikes from the 5thof May there is no information about the weapons used by the IDF, neither are there confirmed information about the specific content, course and effects of the Hamas cyber operations. Thus, solely targeting law can be evaluated here.

The airstrikes have been conducted against a building in the Gaza Strip, which is a densely populated area. Hence, LOAC obliges to use special care and a minimum of force if attacks are conducted in such civilian surroundings. The IDF air force claims to use smart bombs and precision-guided munition (PGM) in airstrikes.

Hamas and its Members under LOAC

If Hamas is seen as government of a State, the members of their armed groups are considered as combatants. An attack on them would be lawful, provided the aforementioned other rules are complied with. If they are seen as an OAG, their armed members become lawful targets due to their continuous combat function, see Art. 51 (3) AP I.

Other Hamas members who do not carry out a combat function – as the organization has political components, too – possibly may be classified as civilians. However, the organization has a military or paramilitary background. It is therefore hard to distinguish political members from the ones who are part of the armed groups. When a person originally classified as civilian takes up a weapon and gets involved in the fighting, it becomes a lawful target due to Art. 51 (3) AP I. De minimis members with military or semi-military function are seen as lawful targets either due to Art. 43 (2), 48 AP I or due to Art. 51 (3) AP I.

The known problems and discussions concerning the criteria and thresholds of the DPH rule are raised by the status of Hamas members. What about persons who fulfill supply, governance or executive functions? The fine line between lawful targets and protected civilians is blurred on various occasions.

The Case of the HamasCyberHQ

To the extent known, the building which was the object of the airstrike was located in a civilian area. If the nature or purpose of the object does not make an effective contribution to military action, it shall be presumed to be used for civilian purposes as a rule of doubt (Art.52 (2), (3) AP I). Therefore, the nature and purpose of the HamasCyberHQ is decisive for the lawfulness of the strike. This depends on the actual contribution to military action and, thus, on the purpose and function by the personal residing there. In addition, the functions and activities of the personal determine their legal status. If they have to be qualified as protected persons, this might constitute a reason for the unlawfulness of the strike in connection with the proportionality rule.

Provided the building was a base for the intelligence branch and the HamasCyberHQ, their functions must have contributed to the military activities. The intelligence branch regularly serves not only internal purposes but external, cross-border purposes. With a view to the continuously ongoing conflict with regular armed clashes with Israel, it is highly likely that it includes a military component. The military intelligence branch gains military advantage for Hamas when military intelligence is gathered about Israel. Due to this function it becomes a military object. Therefore, an attack against the intelligence service offers a military advantage and is lawful, see Art. 51, 52 AP I.

Cyber Operatives

Concerning cyber operations, the capability and functions of the cyber operatives have to be analyzed. If they conduct harmful cyber operations which can cause physical effects and destruction, especially if they can affect Israeli military operations, the cyber operatives do not have to be treated different than regular participants in armed operations. An example might be a cyber operation that interferes with military communication of the opponent.

Persons linked to an OAG, who are able to affect military operations of another conflict party, execute military functions. Cyber operatives tasked accordingly, have to be classified likewise. If they are affiliated with an OAG, they clearly have a continuous combat function. If they are not a member or part of an OAG and they perform their operations as civilians, they nevertheless directly participate in hostilities. It does not matter whether the personal in question solely works on a computer in distance to the ‘real’ fighting, as long as they contribute to the military efforts of a party to the conflict. Hereto the type, the function and the (intended or possible) effects of the cyber operation become decisive for the legal status.

Cyber Operations

As cyber operations can have various functions and often are ‘dual-use’ the distinction becomes more problematic. Many grey zones or at least close single cases arise as a ‘civilian’ DDOS attack (= Distributed Denial of Service Attack) can have an effect on a military operation. Thus, the lowest threshold with view to LOAC and in connection to the ongoing armed conflict has to be identified: This is any cyber operation that fosters the military operation, helps it to be more effective and consequently provides a military advantage. The cyber operation always has to be compared to conventional operations and non-sufficient support operations.

Inter alia DDOS attacks, the infiltration of military or governmental networks and computers with military (guidance) connection, the change of military or governmental data and the interference with signals can be qualified as a military advantage towards the other party. Besides information operations like publishing or otherwise spreading misleading information for enemy forces create military gain. Also a misinformation about the military status of a civilian object, which additionally leads to an abuse of the civilian protection status, constitutes another violation of Art. 51 AP I.

In conclusion, the lawfulness of the attack on the HamasCyberHQ depends on the single facts of the case and thereby on the type of the conducted cyber operation(s). In case the cyber operatives have or had conducted a cyber operation against Israel as claimed by the IDF, it is not farfetched that the operation was intended to create relevant military gain for Hamas. An attack against the cyber operatives therefore would have been lawful with view to the status of the HamasCyberHQ. Nevertheless, this can only be determined in the end if some ‘hard’ facts of the defended cyber operation are published. The same is true for other legal requirements of the airstrike like the proportionality rule and the duty to precautions. These cannot be assessed without further information.

Prospects of Cyber Operations under LOAC

The incidents of the first weekend of May 2019 again demonstrate how fast the conflict between Israel and Hamas can escalate. It also shows that both parties are ready and willing to use all available tools to defeat the other party. The open statement on a cyber operation against Israel, its defense by the IDF and the thereby justified conventional airstrike on the HamasCyberHQ present a variety of legal issues from LOAC perspective. Most of these questions derive from already existing legal discussions about the content and interpretation of LOAC. Nonetheless, the peculiarities of the conduct of cyber operations, their functions and their effects lead to new grey zones.  There is an urgent need for further clarification by States on their interpretation and categorization of cyber operations to prevent an escalation of violence in reaction to cyber operations. In the present case on the basis of the available information a violation of LOAC has probably not taken place. However, if not in this case – the next airstrike against cyber operatives in a populated area can cause civilian victims and violate LOAC.


Dr. iur. Tassilo Singer is a Trainee Lawyer at the District Court of Traunstein, Germany and a former research associate at the European University Viadrina (Prof. Heintschel von Heinegg) and University of Passau (Prof. Dederer). He is furthermore guest lecturer at the Masaryk University Brno (ELSA Summer School on IT Law).


Cite as: Tassilo Singer, “Retaliatory Strikes as a Reaction to Cyber-Attacks? The recent Israeli Airstrike against HamasCyberHQ from an IHL perspective”, Völkerrechtsblog, 22 May 2019, doi: 10.17176/20190522-172001-0.

Tassilo Singer
View profile
Print article
  1. Dear Prof. Salaam,
    thank you for your remarks, which I will answer in the following.

    1./2. Questions of Ius ad Bellum: The prohibition to use force and the right to self defensse have been left out in this article. However, in these concrete circumstances of the case – without prejudice who started the clashes – the violence started (at least one day) before the airstrike against HamasCyberHQ. The parties were already exchanging rockets and artillery fire between each other. Therefore, this concrete airstrike is not a question of the right of self defense. The airstrike formed a part of the already broken seize-fire agreement(s). Nevertheless, if the whole exchange of force is regarded the question who started to use force and if a party was entitled to use force against the other party is a very important question as there might have been a violation of the prohibition to use force as you mentioned .

    3. As discussed in the section: “Applicable rules to airstrikes” the norms you have mentioned have to be obliged. The principle of distinction is part of the cardinal rules of humanitarian law (ICJ, Nuclear Weapons) and has to be followed in the “targeting law”. The principle of military necessity and proportionality, likewise. In this case no objective, neutral information are available to evaluate possible violations. Therefore, I refrained to go into much detail of these questions. If the rules have not been followed there was a violation of LOAC. The analysis of this case did not concern and argue with any form of terrorism, but with the objective classification of Hamas either being a non-state armed group, civilians DPH-ing or (in the opinion of some) as a “State”party to the conflict. Therefore, if any acts constitute terrorism, which is no legal term in LOAC, is not relevant for this analysis.

    4./5. Of course, in this case as in any other case of relevance under international law the general rules for state responsibility accepted as customary international law are applicable if there has been a violation of an international obligation.

    Overall, as shown by your comment, the whole case includes many questions of various areas of international law. A comprehensive analysis would be very fruitful. I just tried to shed a little light to a few concerning cyber operations. I hope I have answered your remarks! Thank you for your points!

  2. Thanks Singer for such an collaborative and thoughtful presentation . I have some restrictive remarks and comments on legality of use of force by states under Intl Law and Humanitarian International Law . I prefer to arrange my thoughts in the following order :
    1- UN charter had adopted a very conservative approach in addressing the above mentioned principle as it restricted the member states discretion and power to do so only in two cases the first is self-defense under art 51 of the charter and the second is triggered under collective security measures applied by UN security council

    2- States can not resort either claim state of self-defense in violation of UN charter which provides objective and procedural terms and the utmost of these is an aggression must have been only committed by states . This is obvious that in certain circumstances terrorist organisations or armed militants are not in the dominion of state of self-defense practiced by the victim state .
    It is advisable to refer to ICJ advisory opinion in 2004 .

    3- Countering terrorism is not a legal ground for any state to evade its solemn , humanitarian and legal responsibility to evade these customary international law principles : Proportionality – discrimination – military necessity – collateral damage and precautions before any military operation to minimize casualties in unarmed civilians who are not involved in the military hostilities .

    4- Each state bears legal responsibility under different international instruments and domestic statutes to prosecute her individuals who perpetrate war crimes , genocide , crimes against humanity and other international human rights instruments
    5- States can not claim its domestic resolutions , statutes , judgement to violate international law either to evade international liability .

    Dr Ayman Salaam
    Prof of International Law

Leave a Reply

Your email address will not be published.

Submit your Contribution
We welcome contributions on all topics relating to international law and international legal thought. You can send us your text, or get in touch with a preliminary inquiry at:
Subscribe to the Blog
Subscribe to stay informed via e-mail about new posts published on Völkerrechtsblog and enter your e-mail address below.