《塔林手冊2.0》與網路戰：以俄羅斯針對烏克蘭之網路行動為例之國際人道法案例分析

Abstract

起始於2022年二月的俄羅斯侵略烏克蘭之武裝衝突中，許多異常的網路行動分別鎖定烏克蘭政府與民間企業的重要基礎設施及網路基礎設施以惡意軟體或駭客行動進行網路攻擊。發起這些網路行動的駭客往往與俄羅斯政府有密切關聯，極可能屬於俄羅斯入侵烏克蘭的作戰計畫之一環，而有適用國際人道法之可能。 本論文乃將由來自各國之國際法學者與電腦科技專家經數次學術討論會議所擬定之《塔林手冊2.0》的規則假借為國際人道法之成文法，涵攝於烏俄戰爭中出現較具代表性的網路行動，以便探討在現行的國際法體系與規則下，國際人道法對於網路攻擊之管轄權範圍、適用國際人道法之涵攝結果、與現仍未有定論或存有歧見之相關法律爭議。 本論文以隸屬國際人道法分支的「戰時法」(jus in bello)為母題，將所涉及之國際人道法上的重要法律概念設定為子題，以2022年爆發的烏俄戰爭中所觀察到的網路行動為例，將《塔林手冊2.0》提出之重要原則與概念逐一涵攝以揭示目前未有定見之爭議，進而梳理出將《塔林手冊2.0》之規則適用於已實際發生的武裝衝突之困難。 本論文認為，雖《塔林手冊2.0》已提出許多衡量標準與具體實例，但從針對各項規則的評論與解釋可知，學術界對於網路攻擊造成之後果的評估仍欠缺共識，尤其於因果關係與分別未遂及既遂的標準，尚未形成具體化或一致的準則；又因國際刑事法院與常設仲裁法院目前未審理過關於可歸責於國家之網路攻擊的案例，未累積出足以參考的案例法，連帶造成舉證責任之強度與分配尚且不明。 本論文建議，各國應針對武裝衝突期間如何保護數位資訊另行締訂新的國際條約或針對日內瓦公約進行修訂或補充，以具體化國際人道法之規定；各國政府亦應與法律與科技專家進行定期密切合作，針對技術規範與法律規範間之差距共同進行評估與修正；國際社會亦應考慮建立國際法庭以外之新機制以調解或調查關於網路戰的爭議。

Since Russia's invasion of Ukraine on February 2022, numerous abnormal cyber operations targeting critical infrastructure and information and communications technology infrastructure of the Ukrainian government and private enterprises have been observed. The cyber operators behind these operations are often closely affiliated with the Russian government and likely form parts of the overall military plan of the invasion, potentially falling under the scope of international humanitarian law. By adopting the rules proposed in the Tallinn Manual 2.0 and applying them to cyber operations observed during the Russo-Ukrainian War, this thesis aims to explore the jurisdictional scope of international humanitarian law concerning cyber attacks, the legal implications, and unresolved or controversial legal disputes under the current framework of international law. This thesis focuses on the application of jus in bello, also known as the law of war, in the cyber context, analyzing the relevant principles and concepts presented in the Tallinn Manual 2.0 to uncover existing controversies. The purpose of this thesis is to identify the challenges in applying the rules from the Tallinn Manual 2.0 to armed conflicts in the real world. This thesis argues that despite the Tallinn Manual 2.0 providing various standards and concrete examples, there is still a lack of consensus among the academic community regarding the assessment of consequences resulting from cyber attacks. Particularly concerning the causal link and distinguishing attempted attacks from successful ones, specific and consistent criteria have yet to be established. Additionally, since the International Criminal Court and the Permanent Court of Arbitration have not yet handled cases related to State-attributable cyber attacks, there is a lack of case law for reference, leading to uncertainty in determining and allocating the burden of proof. This thesis proposes that States should enter into new international treaties or revise and supplement the 1949 Geneva Conventions and Additional Protocols in order to specifically address the importance of protection of digital information during armed conflicts, thereby concretizing the of international humanitarian law norms. Governments should also engage in periodic and close cooperation with legal and technology experts to assess and amend discrepancies between technical norms and legal norms. The international community should consider establishing new mechanisms outside of international courts to mediate or investigate disputes related to cyber warfare, creating impartial organizations composed of expert representatives to address the current shortcomings in the international legal framework.