Navigating International Law In Critical Infrastructure Cyber Events

### Overview This panel session from the S4 conference, moderated by Maggie (Product Security Research Manager at Rockwell Automation), explores the complex challenges of applying international humanitarian law (IHL) and the law of armed conflict (LOAC) to cyber events targeting critical infrastructure and operational technology (OT). Featuring Joe Slowik (Gigamon and Paralus) and Danielle Jablanski (Nozomi Networks and Atlantic Council), the discussion examines foundational international law principles—distinction, proportionality, necessity, and self-defense—and interrogates how they intersect with modern cyber network operations, offensive tooling, and state proxy behaviors.

### Key Topics - **Dual-Use Tension (Espionage vs. Destructive Action):** Initial reconnaissance, access development, and deployment techniques for cyber espionage often look identical to preparations for kinetic or disruptive attacks. Highlighting examples like Nobelium/SolarWinds, Ukrainian wipers, Dragonfly, and Palmetto Fusion, the panelists discuss the difficulty of determining when an operation transitions from intelligence collection into a military armed conflict action, noting that threat actor attribution becomes critical for discerning mission and intent. - **Defining Combatants and Accountability in Cyberspace:** Traditional LOAC definitions rely on uniformed combatants belonging to state armed forces. Cyberspace complicates this with fluid roles across development teams, access brokers, effects teams, contractors, and cybercriminal syndicates. The panel debates whether developers (e.g., Chernovite regarding Incontroller/Pipedream, or commercial defense contractors) bear legal or retaliatory responsibility compared to deployment teams, citing the US Treasury OFAC sanctions against TsNIIKhM (associated with Xenotime and Triton). Danielle highlights that combatant status in practice shifts toward what entities target and the societal impacts of those actions. - **Arms Control and Due Care for Cyber Capabilities:** Applying traditional arms control regimes (e.g., Wassenaar) to cyber capabilities faces immense hurdles. The panel addresses commercial dual-use software (such as Cobalt Strike), code leaks, public virus repositories (e.g., VirusTotal hosting Triton framework artifacts), and the responsibilities of security firms and researchers. Technical constraints within payloads—such as Incontroller and Industroyer2's hardcoded configurations or Stuxnet's narrow targeting—are evaluated alongside the reality that enabling mechanisms and zero-days frequently spread far beyond intended targets. - **Rules of Engagement and Impact Thresholds:** The speakers contrast the formal doctrine of entities like US Cyber Command (e.g., Defend Forward) with the opaque operational thresholds of adversarial agencies like the SVR or GRU, as well as cybercriminal groups like Conti that walk back state-alignment declarations out of self-interest. Danielle and Joe note that unlike nuclear doctrine, cyber conflict lacks clear, agreed-upon fallout impact thresholds to define when an event constitutes an armed attack or cyber warfare.

### Technical Details - **Malware & Campaigns Referenced:** Triton/Xenotime (targeting safety controllers/SIS), Stuxnet (targeting Siemens Step 7 PLCs and centrifuges), Industroyer2 (noted for hardcoded configuration parameters), Incontroller/Pipedream (associated with the Chernovite group), Cobalt Strike, Nobelium (SolarWinds supply chain event), Dragonfly, Palmetto Fusion, and recent Ukrainian wipers and NotPetya-style supply-chain backdoors. - **Accidental Disruption in OT:** Fragile industrial control systems and PLCs can suffer unintended disruption from benign or espionage activities (e.g., knocking over a PLC while dumping configurations, or ambiguous cases like the 2014 German steel mill incident).

### Takeaways - International legal frameworks developed for physical warfare struggle with cyber realities where military targets are blurred with civil society and critical infrastructure. - The cyber domain still lacks a critical mass of precedent and standardized fallout/impact models to establish definitive thresholds between espionage, crime, and cyber warfare. - Organizations must focus on potential impact severity and resilience rather than relying solely on adversary intent or traditional legal boundaries.