Sixty-seven years after the ICRC published the so-called “Pictet Commentary” to the 1949 Geneva Convention relative to the Protection of Civilians in Time of War (GC IV), it has completed an updated version that considers, inter alia, State practice, opinio juris, judicial decisions, and scholarly commentary relevant to the evolution of warfare since 1958. That evolution has been driven in great part by technological advances, both in how wars are fought and in their impact on the civilian population. Indeed, the internet, cyber operations, digital data, space operations, autonomous systems, biometrics, artificial intelligence, and countless other technologies were largely inconceivable when the Pictet Commentary was produced. Developed over five years under the leadership of Jean-Marie Henckaerts, the resulting 2025 Commentary addresses technology not through a single dedicated section but by integrating discussion into the commentary on specific rules. Doing so is consistent with the principle that new technologies are subject to existing law of armed conflict rules. The International Court of Justice (ICJ) confirmed this principle in its Nuclear Weapons advisory opinion, where it observed that to hold otherwise would “be incompatible with the intrinsically humanitarian character of the legal principles in question which permeates the entire law of armed conflict and applies to all forms of warfare and to all kinds of weapons, those of the past, those of the present and those of the future” (¶ 86; see also, e.g., DoD Law of War Manual, § 16.2 on cyber). But, of course, the very novelty of new technologies sometimes precludes hand-in-glove application of extant rules. This necessitates interpreting the rules in the changed context in which they are to be applied. As Henckaerts has observed, doing so requires States, acting in good faith, to “adapt their interpretations to ensure that the rationale behind the protections remains in place” (see also VCLT, art. 31(1)). It is an observation that finds support in the ICJ’s Gabčíkovo-Nagymaros statement that “[t]he principle of good faith obliges the Parties to apply [treaties] in a reasonable way and in such a manner that its purpose can be realized” (¶ 142). And, as I have asserted elsewhere, an interpretation must not only be made in good faith and reflect the object and purpose of the rule in question, it must also “pass the straight face test.” In this article, I survey revisions to the 1958 GC IV Commentary that accommodate technologies that did not exist when either the GC IV or the original Commentary drafters were at work, grouping my review across five themes. I do so not only to alert readers to the adjustments, but also to assess whether the ICRC’s Commentaries team applied the aforementioned interpretive approach in a measured fashion, one that remains loyal to the respective rule’s object and purpose without masking an attempt to style lex ferenda (the law that should be) as lex lata (the law as it exists). Ultimately, the ICRC’s work in the Commentary is highly positive, with just one potentially premature conclusion (regarding the treatment of data as property). 1. Cyber Operations and the Threshold of Armed Conflict The 2025 Commentary takes on the challenging question of whether cyber operations can trigger an international armed conflict under Common Article 2 of the Geneva Conventions or a non-international armed conflict under Common Article 3. It is a dispositive question, for in the absence of armed conflict, the GC IV’s rules, including those affording protection to civilians, are inapplicable (although other protections apply in peacetime, such as those provided for by international human rights law). There is universal agreement that cyber operations with a nexus to an ongoing armed conflict, whether international or non-international, are subject to the law of armed conflict (see, e.g., DoD Law of War Manual, § 16.2; ICRC cyber position paper, pages 4-5; and here on the United Nations Groups of Governmental Experts approach). The harder question is whether these operations, standing alone, can initiate armed conflict. As the Commentary notes (¶ 323; see also ¶ 324), Technological advances, in particular the exponential increase in States’ cyber capabilities and their potential impact on the population and infrastructure as well as on the military capabilities of an enemy State, pose important questions in relation to the applicability of international humanitarian law. More specifically, it is important to determine at what point cyber operations bring an international armed conflict into existence. With respect to international armed conflict, the commentary to Common Article 2 accurately notes that “[i]t is generally accepted by experts, and reflected in the positions of a growing number of States, that cyber operations having similar effects to traditional kinetic operations would amount to an international armed conflict and would have to be conducted in accordance with the rules on the conduct of hostilities” (¶ 325; see also Tallinn Manual 2.0, rule 82 commentary). Thus, if a cyber operation results in physical damage, destruction, injury, or death of individuals, and all other conditions for qualification as an international armed conflict (especially that Hostilities are between States) are satisfied, an international armed conflict is underway. As to cyber operations not having these physical consequences, the Commentary is cautious, and rightfully so: “it remains to be seen if and under what conditions states will treat such cyber operations as armed force amounting to armed conflict under international humanitarian law in future operations” (¶ 326). For example, the widespread denial of service operations conducted by a State into another State’s territory would raise the issue. My own view corresponds with the ICRC’s position that “there is no requirement that the use of armed force between the Parties reach a certain level of intensity before it can be said that an armed conflict exists” (¶ 306). I am also of the opinion that a cyber operation that qualifies as an “attack” under the law of armed conflict suffices to trigger an international armed conflict (see Additional Protocol I, art. 49, for an accepted definition of attack). But even if this approach is adopted, the threshold dilemma remains unresolved. The Tallinn Manual 2.0 experts struggled mightily with the legal meaning of the term “attack” in the context of cyber operations. Some would require physical effects, while others would treat a non-physical loss of functionality of the targeted infrastructure as sufficient damage to qualify an operation as an attack. But even those in the latter group disagreed on the degree of functional loss that sufficed (rule 92 commentary). This lack of consensus was subsequently mirrored in State positions (see, e.g., Schmitt & Vihul, pages 69-70). The point is that the question of whether non-destructive, non-injurious cyber operations can initiate an armed conflict remains unsettled. Common Article 3 concerns non-international armed conflicts and sets forth limited protections for civilians. Like Common Article 2 for international armed conflict, the commentary to the article notes that, in principle, the same criteria that are employed to determine whether kinetic operations trigger a non-international armed conflict apply in the case of cyber operations – “protracted armed violence between governmental authorities and organized armed groups or between such groups within a State” (Tadić, para. 70; see also ICTR, Akayesu, para. 619; ICC, Bemba, para. 229). However, it warns that “[p]articular challenges arise when applying the established classification criteria to cyber operations” (¶ 510), highlighting the same issues that others have consistently singled out (see, e.g., Tallinn Manual 2.0, rule 83 commentary; and here). These include the question of how to treat a group organized entirely online (e.g., how to enforce the law of armed conflict within the group) and the fact that most cyber operations do not generate consequences of a nature and intensity sufficient to satisfy the relatively high threshold required for a non-international armed conflict. Interestingly, given the centrality of space in contemporary warfare, a footnote notes that Common Article 3 also applies to an existing non-international armed conflict involving operations in space (FN 123). This is consistent with Rule 30 of the Woomera Manual on the International Law of Space Operations: “To the extent that a terrestrial non-international armed conflict that originates on the territory of a State involves military operations from, to, or within space, all relevant rules of the law of armed conflict relating to non-international armed conflicts apply to those operations.” The Woomera Manual experts, however, were pessimistic about a non-international armed conflict occurring entirely in space, for both legal and practical reasons (rule 30, commentary). Such hesitancy is consistent with the commentary’s decision to limit its mention of space to ongoing non-international armed conflict. With regard to both international and non-international armed conflicts, the ICRC has fairly characterized the state of the law regarding cyber operations that, standing alone, trigger an armed conflict. 2) Protection of Medical Services and Data in Cyberspace Article 18 of GC IV requires that parties to a conflict “respect and protect” civilian hospitals (see also Customary IHL, rule 28; DoD Law of War Manual). Given their vulnerability to hostile cyber operations, the article’s commentary appropriately discusses the effects such operations may have on the delivery of medical services (Commentary, ¶ 1799). The obligation to respect civilian hospitals also involves not interfering with their medical functioning by non-physical means, such as cyber or other digital operations. Disrupting the information technology infrastructure of medical services or disabling the functionality of medical equipment would be unlawful. Importantly, such disruption includes manipulating, deleting or otherwise damaging medical data that form an integral part of medical facilities. Relevant data in the medical context include those necessary for the proper operation of medical equipment and for tracking the inventory of medical supplies, as well as personal medical information essential for the treatment of patients. This is precisely the approach the Tallinn Manual 2.0 experts had earlier taken: “The duty to respect [medical units] is breached by actions that impede or prevent medical … personnel, medical units, or medical transports from performing their medical … functions, or that otherwise adversely affect the humanitarian functions of medical … personnel, units, or transports. It includes, but is not limited to, the prohibition on attacks” (rule 131 commentary). In fact, the commentary’s reference to data draws directly from examples in the commentary to Tallinn Manual 2.0’s Rule 132. Importantly, rule 132 emphasized that the protection did not depend on the cyber operation in question qualifying as an attack under the law of armed conflict. Article 19 of GC IV deals with situations in which medical facilities lose protection because they are being “used to commit, outside their humanitarian duties, acts harmful to the enemy.” Paradigmatic examples include using a medical facility to store weapons or other military equipment, shelter combatants, or serve as a fighting position. Despite the loss of protection, attack is only permitted “after due warning has been given, naming, in all appropriate cases, a reasonable time limit, and after such warning has remained unheeded.” As noted in the article’s commentary, “The absence of a further definition of this concept allows for flexibility in determining how to implement this requirement in light of the prevailing circumstances and available technologies.” Thus, it sensibly observes that among the means that can be employed to issue the warning are “an e-mail addressed to the hospital management or competent authorities” (¶ 1855). Other means, such as text messages or taking control of computers to message the hospital concerned, would likewise suffice, since the requirement is not based on the mode of warning but on its effectiveness. Accommodation has also been made for the possibility of new forms of civilian medical transport, which, like hospitals and other medical facilities, are protected from attack (art. 21 for land and sea transport; art. 22 for medical transport by air; see also Customary IHL, rule 29). Of particular note are uncrewed or autonomous medical transport
![Image for Sausage, Pepper, and Pineapple Skewers [gluten-free + paleo friendly]](https://i0.wp.com/healthyhelperkaila.com/wp-content/uploads/2019/01/Sausage-Pepper-and-Pineapple-Skewers1.png?fit=800%2C800&ssl=1)
