From Munitions to Malware: A Comparative Analysis of Civilian Targetability in Cyber Conflict

This article examines when a civilian who takes part in cyber hostilities may lawfully be targeted. The author, Colton Matheson, opens with the 2008 distributed denial-of-service attacks that disrupted Georgian government, media and banking servers two weeks before Russian forces crossed into South Ossetia, and uses it to frame a gap: the conventions protecting civilians in armed conflict were drafted for conventional warfare.

Matheson compares the two competing standards for direct participation in hostilities — the ICRC's Interpretive Guidance and the Tallinn Manual 2.0 — first on the conduct a civilian must undertake to become a direct participant, then on duration, the period for which that civilian remains targetable. Applying both standards to hypothetical cyber scenarios, he aligns with the position advocated by the Tallinn Manual experts, arguing that their treatment of duration better reflects the realities of modern conflict and the balance between military necessity and humanitarian protection.