The International Committee of the Red Cross (ICRC) wants to devise a digital equivalent of its emblems (the red cross and red crescent), to signify that certain digital resources are protected and must not be targeted during cyberwarfare.
“For more than 150 years, protective emblems like the red cross have been used to convey a simple message: In times of armed conflict, those who wear the red cross or facilities and objects marked with [it] must be protected from harm,” the organization wrote last week, adding “The obligation of all warring parties to respect and protect medical and humanitarian actors applies online as well.”
The organization therefore wants a digital emblem to “make it easier for those conducting cyber operations during armed conflict to identify and spare protected facilities – just as a red cross or crescent on a hospital roof does in the real world.”
Three proposals for how the emblem might be implemented have been suggested:
- A DNS-based emblem. This would use a special label to link the “digital emblem” to a domain name (such as
www.hospital.emblem). This would be a simple, human-readable “digital emblem” that identifies the protected system. - An IP-based emblem. This type of emblem would require embedding semantics – for example a specific sequence of numbers – in IP addresses to identify both protected digital assets and protected messages traversing a network.
- An ADEM (Authenticated Digital Emblem). This would use certificate chains to signal protection. These certificates can be authenticated by different actors and communicated over different protocols.
The ICRC wrote it has already started work with the Center for Cyber Trust (a joint endeavor of ETH Zurich and the University of Bonn), Johns Hopkins University, and the ITMO University of Saint Petersburg “to develop the necessary technological solutions for identifying the digital infrastructure of protected facilities in cyberspace.”
The Australian Red Cross has also set the ball rolling by bringing together cyber security companies, former government officials, representatives of other Red Cross Red Crescent National Societies, experts with a background in criminology, and white-hat hackers to solicit their views on potential solutions and the risks and benefits involved.
The organization hasn’t set a deadline for development and deployment of the digital emblem, but director general Robert Mardini said it is needed because cyber-ops are an established tactic of modern warfare.
“Our mandate to protect the lives and dignity of victims of armed conflict requires us to understand how these operations can cause harm,” he said.
The ICRC is not alone in seeking to ensure that civilian digital infrastructure is off limits during conflict. The Global Commission on the Stability of Cyberspace (GCSC) has proposed global norms to protect the operation of the internet so its role in supporting humanitarian activities continues during conflict. The United Nations has worked on similar rules, and some nations have struck “no hack pacts” that make attacks on civilian infrastructure out of bounds.
Some nations, however, ignore those norms or don’t sign up to be bound by them.
And as we’ve seen in recent months during Russia’s illegal invasion of Ukraine, Moscow sees attacks on digital infrastructure as an acceptable tactic – even civilian infrastructure like satellite broadband services if they’re seen to aid an enemy. ®