Abstract
This article examines the potential use and legal limitations of ransomware to achieve strategic effects in armed conflicts. Ransomware is defined here as the temporary encryption of data until some pre-condition is met to release the encryption. The article focuses on international law as applicable to a State’s use of ransomware against another State, where both are parties to an existing international armed conflict. The author finds that international humanitarian law does not currently prohibit most uses of ransomware against non-military related targets in armed conflicts. While the encryption of data may be a legal violation when it inhibits the functionality of specific protected categories, civilian data cannot be said to have per se protection. This argument is strengthened when considered in the context of temporary encryption, as opposed to permanent corruption. Recognizing the potential dangers presented by the use of ransomware in armed conflicts, this article identifies primary legal and ethical questions that States must resolve to protect non-military related data from ransomware operations in armed conflicts.
html
