Digital Emblems in Cyberspace: A Deterrent or a Target?

Emory University School of Law Emory University School of Law

Emory Law Scholarly Commons Emory Law Scholarly Commons

Emory International Law Review Recent Developments

Emory International Law Review

Digital Emblems in Cyberspace: A Deterrent or a Target? Digital Emblems in Cyberspace: A Deterrent or a Target?

Fatemah Albader

Part of the International Law Commons

DIGITAL EMBLEMS IN CYBERSPACE: A DETERRENT OR A TARGET?

Fatemah Albader*

In 2022, the ICRC proposed a digital emblem to identify and protect medical and humanitarian digital assets during armed conflict. While this initiative marks a pivotal evolution of IHL into cyberspace, its effectiveness depends on whether states can ensure accountability, attribution, and compliance. This article argues that digitalizing IHL’s distinctive emblems, such as the red cross, is not optional but mandatory under both conventional and customary law. Once developed, states must adopt and regulate the digital emblem to protect hospital networks and medical personnel online as they are protected offline. However, emblem digitalization alone cannot deter deliberate cyberattacks or unintentional secondary effects resulting from self-propagating malware. Through the examination of cases like Stuxnet and NotPetya, this article distinguishes between direct cyberattacks and reverberating effects that inadvertently impact protected systems. It argues that without enforceable cyber-specific frameworks, emblem digitalization risks becoming merely symbolic. This article concludes that the digital emblem’s success hinges on the establishment of binding technical safeguards, attribution mechanisms, and accountability provisions. Ultimately, the digital emblem can strengthen IHL protection in cyberspace only if states treat it not as a symbol of goodwill but as a legal obligation demanding enforcement.

international protocols

integrating

INTRODUCTION ................................................................................................... 3

PROTECTED OBJECTS: A MANDATORY REQUIREMENT ........................... 4 A. Military Necessity, Distinction, and Precautions ............................ 5 1. The Principle of Military Necessity ........................................... 5 2. The Principle of Distinction ...................................................... 5 3. The Principle of Precautions ..................................................... 6

B. Hospitals, Ambulances, and Authorized Humanitarian

and Medical Personnel: Mandatory Digitalization ......................... 6

DIGITAL INFRASTRUCTURE ..................................................................... 9 A. Emblem Digitalization and Direct Attacks .................................... 13 B. Emblem Digitalization and Reverberating

Cyber Effects ................................................................................. 14

MEDICAL FACILITIES ............................................................................. 16 CONCLUSION ..................................................................................................... 18

In November 2022, the International Committee of the Red Cross (ICRC) called on states and relevant experts to join forces and develop a digital emblem of the red cross to identify and protect digital assets – such as networks, infrastructure, and data – associated with medical and humanitarian actors in armed conflict.1 This initiative is currently in progress, with ongoing collaboration between the ICRC and relevant stakeholders to develop the necessary legal, technical, and operational frameworks for its effective implementation.2 Recognizing these efforts, this article applauds the ICRC’s initiative and notes that other emblem digitalization should be considered concurrently (or at least shortly thereafter) so that all persons and objects with specific protections under international humanitarian law (IHL) – particularly those performing medical or humanitarian functions – eventually receive the same protections online.

For the time being, the ICRC’s efforts have raised a number of questions, prominent of which is how and whether states will hold individuals (and the breaching state, where individuals’ actions are attributable to the state) accountable for attacks on healthcare networks in the event that a digital protection symbol is discovered.3 Another related question is whether or not attackers will deliberately shield themselves from liability and steer clear of probing for the digital emblem.4 Medical networks are more vulnerable if they had not been recognized as protected objects if states are unwilling or unable to hold individuals responsible for breaches caused by accessing networks secured by a digital red cross. Similarly, digitalization would have no effect on

preventing attacks on these networks if attackers can somehow avoid culpability by purposefully ignoring the emblem marking a protected object. These concerns are further exacerbated when attacks on hospital networks are the result of unintentional secondary attacks, in which the attackers target other legitimate military objectives – for example, authorized attacks on electricity-generating stations or communication networks during war – instead of hospital networks.

Thus, digitalization processes must ensure that these preliminary questions are answered and addressed. This article argues that, after binding the digital emblem to hospital and other protected networks, states are now under a duty to hold those responsible accountable under IHL. Moreover, assuming that the attackers can be identified, this article argues that this obligation persists even where attempts are made to circumvent the discovery of the emblem and, where appropriate, in the case of secondary attacks on hospital networks.

Accordingly, this article is divided into three parts. Part I makes the case that digitalizing the distinctive emblem used to signal IHL protection must now be viewed as a mandatory requirement rather than a mere option by briefly examining the laws governing objects with special protection under IHL and their relation to the cyber domain. Part II considers two types of cyber operations: those that directly target specific systems, and those that generate reverberating effects, where the operation causes secondary harm to protected systems through self-propagation or lack of containment safeguards. Part II then considers these cyber operations in relation to emblem digitalization, analyzing whether or not emblem digitalization would have the desired effect, as intended by the ICRC. Finally, Part III examines the necessity of strengthening international regulations on cyber operations to ensure the protection of medical facilities in cyberspace. While digitalizing the protective emblem is a step toward safeguarding these networks, its effectiveness depends on enforceable legal frameworks, clear prohibitions on certain cyber operations, and accountability mechanisms that deter violations under IHL.

The conduct of warfare is governed by core legal principles established under IHL.5 Among the most central of these are the principles of military

necessity, distinction, and most notably, the principle of precautions.6 Each will be briefly discussed in turn.

A. Military Necessity, Distinction, and Precautions

1. The Principle of Military Necessity

The principle of military necessity permits attacks only to the extent necessary to achieve a legitimate military objective.7 If the measure is prohibited by IHL, then it is never necessary.8 Thus, for example, using weapons that are prohibited by IHL does not meet the principle of military necessity.

In both physical and digital contexts, this principle reinforces that protected entities, such as hospitals, retain their immunity from attack regardless of military convenience. Military necessity cannot override these protections.

2. The Principle of Distinction

The principle of distinction requires that combatants distinguish between combatants and civilians, as well as between military objectives and civilian objects.9 Accordingly, it is forbidden for combatants to feign civilian status or misuse civilian presence to shield military operations from attack. The principle of distinction also prohibits the use of weapons that cannot discriminate between combatants and civilians. Thus, rockets with no system of aiming at particular targets are prohibited.10

One of the ways parties to a conflict comply with the principle of distinction is by using certain emblems to mark civilian objects and indicate their protected status under IHL. For example, the red cross (in other nations, the red crescent or the red crystal)11 is the emblem that is used to identify hospital buildings,

ambulances, and medical personnel, as well as certain authorized humanitarian actors affiliated with the Red Cross and Red Crescent Movement.12 The blue and white shield symbol identifies cultural and religious property as described in the 1954 Hague Convention for the Protection of Cultural Property in the Event of Armed Conflict.13 These emblems signal to attackers and parties to the conflict that some objects are off-limits for military use and cannot be targeted.

3. The Principle of Precautions

Finally, the principle of precautions obliges parties to a conflict to take all feasible steps to avoid or minimize incidental harm to civilians and civilian objects.14 In the cyber context, this means anticipating the possible effects of cyber operations on protected systems and building in safeguards to prevent unintended harm. The principle is forward-looking and technical as much as it is legal, requiring both careful planning and the use of protective design features to uphold IHL obligations.

Altogether, these jus in bello principles guarantee that IHL is comprehensive enough such that attacks are targeted only against those who are actively participating in the hostilities while also ensuring respect and protection for those who are not. As a result, a number of rules have emerged in order to safeguard objects that require special protection, including hospitals. Thus, in considering emblem digitalization, it is worth examining the specific regulations that apply to protect these specially protected objects.

B. Hospitals, Ambulances, and Authorized Humanitarian and Medical

Personnel: Mandatory Digitalization

Article 38 of the First Geneva Convention and Article 41 of the Second Geneva Convention retain the red cross emblem as the distinctive sign of the Medical Services of the armed forces.15 The Fourth Geneva Convention retains

similar obligations in the context of civilian hospitals. Thus, for example, hospital employees and other personnel involved in the operation of civilian hospitals are required to wear an armlet bearing the emblem of the red cross.16 The emblem must also be used to mark civilian hospitals and ambulances, as provided in Articles 18 and 21 of the Fourth Geneva Convention.17 Granted, Article 18 states that: “Civilian hospitals shall be marked by means of the emblem provided for in Article 38 of the [First Geneva Convention], but only if so authorized by the State.”18 A textual interpretation of Article 18 suggests that marking hospitals with the red cross emblem is discretionary and not mandatory. However, states are required to recognize and authorize the use of the red cross emblem by civilian hospitals within their territories, and to ensure that such hospitals are marked with the emblem in accordance with the provisions of the Fourth Geneva Convention.19 While the Convention does not explicitly require states to authorize the use of the emblem, it does establish that civilian hospitals are entitled to protection during armed conflict, and that the use of the red cross emblem is necessary in order to be recognized as such and to be afforded this protection.20 Consistent with this special protection afforded to civilian hospitals, the use of the emblem supports the implementation of the principle of distinction, which requires parties to an armed conflict to distinguish between civilian objects and military objectives. Marking civilian hospitals with the emblem facilitates their recognition and reinforces the obligation to respect their protected status under IHL.

As evidence of further support concerning the significance attached to the mandatory use of the red cross emblem, state parties to the Four Geneva Conventions adopted Additional Protocol III, a 2005 protocol dedicated entirely to the adoption of an additional distinctive emblem in addition to the previously existing distinctive emblems of the Geneva Conventions.21 The Four Geneva Conventions of 12 August 1949 had previously confirmed the use of three emblems: (1) the red cross, (2) the red crescent, and (3) the now-abandoned red lion and sun.22 Over time, these symbols, especially the red cross, became associated with religion, even though that was not the purpose of these symbols.

In fact, in the Commentary on Article 38 of the First Geneva Convention, the ICRC specifically stated: “[t]he red cross emblem is intended to signify one thing only—something which is, however, of immense importance: respect for the individual who suffers and is defenseless, who must be aided, whether friend or enemy, without distinction of nationality, race, religion, class or opinion.”23 The symbol merely reflects the Swiss flag in reverse, as a tribute to Henry Dunant, the Swiss founder of the ICRC.24 Thus, any religious connotation associated with the red cross or any other emblem of the ICRC is unfounded. Nonetheless, Additional Protocol III was adopted in order to provide states that refused to adopt any of the existing emblems on religious or other grounds with another option: the red crystal. The ICRC stated that the goal of this emblem is not to replace the previously existing emblems but “to come up with a result devoid of any political, religious, or other connotation and which could thus be used all over the world.”25

Finally, in addition to being regulated by the Geneva Conventions and their Additional Protocols, the use of the red cross emblem by civilian hospitals during armed conflict is widely recognized as a principle of customary international law, and it has been consistently followed by states and has been recognized as such by international courts and leading IHL experts.26 The use of the emblem is required by the military manuals and rules of engagement of many states. It is regularly used by the International Committee of the Red Cross, the International Federation of Red Cross and Red Crescent Societies, and National Red Cross and Red Crescent Societies in armed conflict to identify and protect persons and objects entitled to special protection under IHL. Taken together, these practices constitute state practice sufficient for a formulation of custom. This further underscores the mandatory nature of the requirement to use the emblem, even if it is not explicitly set out in the text of the Convention.

Given all of the above, it is clear that the use of the red cross emblem to protect hospitals, ambulances, and humanitarian and medical staff is a

mandatory obligation, one that is required under both conventional and customary international law. Accordingly, as it pertains to the use of the digital emblem, once such an emblem is created, given that medical facilities and persons are specially protected under IHL, this article argues that states should adopt the digital emblem and identify the national authorities and entities involved in authenticating and managing its use.27 The framework should also allow for the emblem to be withdrawn in circumstances where its continued presence would pose greater risk than benefit to the protected digital infrastructure.28 Once the technology becomes available, states are required to ensure that hospitals and medical staff are protected online, just as they are mandatorily protected offline. The emblem carries with it specific obligations, and these obligations do not change whether protected offline or online.

However, this endeavor is not without its challenges. For one, once in the online domain, it becomes difficult to attribute actions to particular individuals. That is, it is difficult to ascertain which individuals are responsible for breaches of protected networks in cases where, for instance, individuals have decided to disregard the emblem and move forward with their attacks against hospital networks. Likewise, even if there are no issues with attribution, individuals may purposefully avoid searching the networks for protected insignia, thereby shielding themselves from potential responsibility. These concerns are further exacerbated when attacks on hospital networks are the result of secondary attacks, in which the attackers target other legitimate military objectives – for example, authorized attacks on electricity-generating stations or communication networks during war – instead of hospital networks. The next Part will attempt to address the issues raised herein.

Cyber operations targeting or affecting medical networks during armed conflict can occur in two forms: (1) operations that directly target protected infrastructure, and (2) operations that produce indirect, cascading, or reverberating effects.29 While the former involve deliberate targeting of medical networks or their supporting systems, the latter may result from cyber operations

aimed at other infrastructure, but whose effects spread to protected medical assets. These categories help assess the legal implications of emblem digitalization and whether such digitalization can reduce harm to medical systems.

Direct attacks are launched with the specific intent to disrupt or damage a given target. These cyber operations are often carried out with a clear understanding of how the attack will work and with the intention of causing a specific outcome or effect.30 They can be launched by a variety of actors, including states, criminal organizations, or individual hackers, and they can take many forms, including malware attacks, phishing attacks, and denial of service attacks.31 The key characteristic of these attacks is that they are purposefully directed at a particular system, network, or entity, reflecting a clear and calculated intent to achieve a predetermined goal. One of the most notorious examples of such a cyberattack is the Stuxnet worm, a sophisticated malware discovered in 2010 that was specifically designed to target Iran’s nuclear research facilities.32 Unlike conventional cyberattacks aimed at stealing data or disrupting generic systems, Stuxnet was meticulously engineered to sabotage Iran’s centrifuges at the Natanz nuclear plant by causing them to spin at dangerous speeds.33 While originally designed to target the Natanz facility, due to the absence of propagation controls, the worm generated an impressive number of secondary effects, including the infection of numerous systems across multiple countries.

As such, reverberating effects may arise from cyber operations that are not aimed at medical systems directly, but which nonetheless affect them. These attacks might involve the misuse of cyber techniques without a full understanding of how they will work, or they might involve the use of cyber techniques that were not intended to be used in this way. Such consequences may be triggered by a lack of containment mechanisms, such as geofencing (which restricts malware to a specific geographic area), operating system-based restrictions (which limit malware to certain types of systems), or propagation filters (which would control how far and where malware spreads), that would

otherwise limit malware to its intended environment.34 Moreover, these cyberattacks may produce secondary effects on medical systems, even where the original operation was directed at other infrastructure. A notable example – mirroring the dynamics of Stuxnet – is the 2017 NotPetya malware attack. Although NotPetya was designed to target Ukrainian infrastructure, it was not coded with sufficient guardrails, such as containment measures or propagation limits.35 As with Stuxnet, the absence of such safeguards allowed the malware to spread uncontrollably beyond its intended environment, ultimately affecting numerous multinational companies and causing billions of dollars in damages worldwide.36

Self-propagating cyber capabilities, like NotPetya above, are tools that are able to spread or propagate themselves in some way, often through the use of replicating or self-replicating mechanisms. In the cyber domain, these are malware with a wormable function, a type of malicious software that is designed to replicate and spread itself to other computers or devices without the need for human interaction.37 Stuxnet exhibited this capability by autonomously infecting Siemens Step-7 systems used in industrial control environments.38 Once launched, these capabilities can spread rapidly and unpredictably, causing significant and widespread damage in a short amount of time.

Unlike targeted malware that requires manual deployment, self-replicating cyber tools can evolve beyond the attacker’s control, making containment exceedingly difficult. The issue with NotPetya and Stuxnet was not the intent to cause broad-based harm, but rather the absence of technical guardrails that

would have contained their spread.39 This uncontained propagation leads to reverberating effects, that is, harm caused to protected systems not because they were directly targeted, but because they were unintentionally affected through interconnected digital infrastructure.40 These effects may be especially acute for hospital networks, which are often embedded in broader systems such as energy grids or transportation hubs.

While the use of traditional self-propagating weapons is often regulated or prohibited by international law,41 self-propagating cyber capabilities are generally not specifically prohibited, although their use may be regulated or restricted in some states. Many countries have adopted laws and regulations that prohibit the use of malicious software, including self-propagating malware, or that provide for the punishment of individuals or groups who use these types of digital tools.42 Moreover, the principle of precautions under IHL provides an important normative framework for mitigating the risks associated with their use. This principle obliges parties to an armed conflict to take all feasible precautions to avoid or minimize incidental harm to civilian objects and populations, including those in the digital domain.43 In the context of cyber operations, this means that attackers must assess the potential reverberating effects of deploying self-propagating tools, particularly where civilian infrastructure – such as hospitals, energy systems, or transportation networks – may be inadvertently impacted. The failure to implement containment safeguards, such as limiting propagation or integrating recognition of protected systems, may amount to a breach of the obligation to take precautions in attack. Thus, even where no specific prohibition exists against a given cyber capability, the principle of precautions imposes a substantive duty to prevent or mitigate foreseeable harm to civilian digital infrastructure.

It is important to note that while these laws and regulations can help to prevent the use of self-propagating tools in cyberspace, they do not completely eliminate the risk of their being used, especially when combined with the fact

that attribution in cyberspace is difficult to ascertain. It is therefore worthy to consider the effectiveness of emblem digitalization on preventing these various types of cyberattacks on hospital networks.

A. Emblem Digitalization and Direct Attacks

Emblem digitalization will, without a doubt, prove ineffective in preventing direct attacks on hospital networks when those attacks are the result of deliberate targeting decisions. In such cases, the attacker has already identified the hospital network as a target and made a conscious decision to violate IHL. In those instances, the presence of a digital emblem will unlikely deter the attack, similar to how hospitals and other medical facilities are sometimes attacked or targeted during armed conflicts despite the protections afforded to them under IHL.44 Combatants are presumed to be aware of the rules of warfare and are required to adhere to them. In practice, however, IHL violations subsist. During the Syrian conflict, for example, hospitals and other medical facilities were attacked by various parties to the conflict.45 Hospitals in Afghanistan have also been attacked during armed conflicts.46 In 2015, a Doctors Without Borders (MSF) hospital in Kunduz was bombed by US forces, resulting in the deaths of 42 people.47 The conflict in Yemen has also seen numerous attacks on medical facilities. In 2015, an MSF hospital in Saada was bombed by the Saudi-led coalition.48 That same year, an MSF-supported hospital in Haydan was also bombed.49 Most recently, countless attacks on healthcare facilities have repeatedly occurred in the Gaza Strip.50 All these examples illustrate that if combatants are not willing to respect

the laws of war offline, they are very unlikely to respect these rules online, where attribution of attacks is even more difficult to ascertain.

However, emblem digitalization may still provide meaningful operational value in specific phases of cyber operations, particularly during the reconnaissance phase of cyber operations.51 Before launching a cyberattack, an attacker typically engages in target mapping and network scanning to confirm the nature and value of a system. In this early stage, the presence of a recognizable and verifiable digital emblem could serve as a protective function by signaling to cyber operators that the network in question is entitled to special protection under IHL. This is especially relevant in scenarios where an attacker does not intend to target a medical facility but may do so based on flawed or incomplete intelligence.52 Just as errors in physical targeting can result in accidental strikes on hospitals, cyber operations are similarly, if not more, vulnerable to misidentification or mistaken assumptions about a network’s function.

In such cases, a visible and verifiable digital emblem could help prevent an attack by serving as an additional layer of information, prompting a reassessment of the target or triggering automated flags within targeting systems before deployment. Here, the emblem may cause the operation to be modified, halted, or canceled altogether. Therefore, although a digital emblem may not stop actors who intentionally violate IHL, it may help prevent attacks that arise from intelligence failures, where operators mistakenly target protected medical systems.

B. Emblem Digitalization and Reverberating Cyber Effects

Reverberating effects occur when a cyber operation, though not directed at medical systems, causes secondary harm to them through interconnected digital infrastructure.53 A core technical reason for such effects is the use of selfreplicating or autonomously spreading malware, particularly when safeguards are absent.

NotPetya, launched in 2017, was intended to target Ukrainian infrastructure but lacked containment features such as geofencing, operating system-based

restrictions, or propagation filters.54 As such, it spread globally, affecting multinational companies and causing extensive damage. Similarly, Stuxnet, engineered to sabotage Iranian centrifuges at the Natanz facility, escaped its intended confines due to the absence of technical fences, leading to wider infection of industrial systems.55 In both cases, the self-propagating nature of the malware was not accidental; it was a built-in functionality, deliberately coded to enable the malware to autonomously spread. As such, while developers may not have anticipated or desired the malware to reach protected or unrelated infrastructure, the propagation itself was by design. These cases illustrate how secondary harm can arise not from the choice of target but from the technical architecture of the cyber capability itself.

While self-propagation in malware is typically a designed function, the consequences of that propagation are not always foreseen. The malware may be equipped to spread, but its developers may not anticipate or desire its reach into protected or unrelated infrastructure, such as hospital networks. In this sense, the effects on medical networks are reverberating, arising not from a decision to target them, but from the absence of technical safeguards that could have contained the malware’s spread.

Under IHL, the principle of precautions requires parties to take all feasible steps to avoid or minimize incidental harm to civilian objects. In the cyber context, this means that the potential for malware to propagate beyond its intended environment must be evaluated in advance. Developers and operators of such capabilities must integrate safeguards to prevent protected infrastructure, like hospitals, from being caught in the crossfire.

Digital emblems may support this effort by creating a recognizable signal within cyberspace, indicating that certain systems are protected. When integrated into malware logic, the emblem could help cyber operators identify and avoid protected systems during the design or deployment phases. In scenarios where malware spreads beyond its target, such as from a transportation system network to a hospital network, the presence of a digital emblem may serve as a critical identification marker. For this to be effective, however, the malware must be equipped with the capability to detect the emblem autonomously. In other words, not only must human operators check for the

existence of the emblem during reconnaissance, but self-spreading tools themselves must also be coded to recognize and respect it during propagation. If properly integrated into pre-coded fences, such as geofencing, network certification, or system identifiers, the emblem could prevent malware from jumping to protected hosts.56 Whether this occurs in practice, however, depends on both the attacker’s adherence to IHL and their willingness to program respect for the emblem into their tools. While emblem digitalization cannot entirely eliminate the risk of reverberating effects, it can increase the visibility of legal protections in a domain where attribution, accountability, and control remain deeply challenging.

As cyber threats against medical networks escalate, the effectiveness of the ICRC’s digital emblem initiative depends not only on its adoption but also on the broader regulation of cyber operations. Without enforceable legal and technical mechanisms ensuring compliance, emblem digitalization risks becoming a symbolic measure rather than a practical deterrent. Just as international law prohibits attacks on hospitals and medical personnel in physical warfare, cyber warfare must include legally binding prohibitions on cyber operations targeting digital infrastructure marked by the emblem.

To that end, states and international bodies must establish clear rules governing the permissible and impermissible use of cyber tools that are akin to existing restrictions on biological and chemical weapons.57 The Geneva Conventions and their Additional Protocols set clear prohibitions against attacks on medical facilities in armed conflict, and these protections already extend to cyber operations.58 However, clearer and more specific formulations applicable to the cyber domain would significantly enhance compliance and enforcement. The failure to do so leaves protected networks vulnerable, as cyberattacks are

often less attributable and more difficult to prosecute than traditional violations of IHL.

Several existing international instruments provide a foundation for strengthening these regulations. The Budapest Convention on Cybercrime, also known as the Council of Europe Convention on Cybercrime, is the most comprehensive international treaty currently in force addressing cybercrimes.59 It establishes procedures for cross-border cooperation and provides mechanisms for investigating and prosecuting cyber offenses.60 While designed to combat fraud, hacking, and other cybercrimes, expanding its scope to cover cyberattacks on emblem-marked medical infrastructure would be a significant step toward reinforcing these protections under international law.

Additionally, the United Nations Convention against Cybercrime, which opened for signature in October 2025,61 presents an opportunity to codify legally binding obligations for states to protect medical institutions from cyberattacks. While both the Budapest Convention and its United Nations counterpart focus primarily on tackling cybercrime, these conventions could serve as the cornerstone for introducing a new treaty regulating cyber operations used against medical entities in the future, thus reinforcing medical network protections under international law. While the Tallinn Manual on the International Law Applicable to Cyber Warfare outlines how existing IHL applies to cyber operations, it lacks binding authority.62 Thus, states must go further by negotiating enforceable treaties that directly regulate cyber operations capable of breaching or undermining digital emblem protections.

No matter the framework, effective regulation must ensure that medical institutions are shielded from both direct and collateral cyberattacks. This requires (1) clear prohibitions on the use of cyber operations against hospitals and medical networks, regardless of whether they are physically or digitally marked; (2) mechanisms for attribution to track and identify perpetrators of cyberattacks on digitally marked medical infrastructure; and (3) strong enforcement provisions that impose penalties on states and non-state actors that violate these protections. Crucially, the mere presence of a digital emblem will

not prevent attacks unless states are willing to enforce consequences. While traditional emblem protections are well established, cyberattacks present unique challenges in attribution, enforcement, and compliance. Unlike conventional warfare, where violations can often be directly linked to a state or military unit, cyberattacks frequently involve processes that make it difficult to trace the source of an attack. This ambiguity creates an enforcement gap, allowing perpetrators to exploit the absence of binding cyber laws to conduct attacks with impunity.

To that end, states should consider advancing a dedicated protocol, either as an addition to the Geneva Conventions or as a standalone instrument, that expressly addresses the legal status, recognition, and technical implementation of the digital emblem. This protocol could specify obligations for respecting digitally marked medical systems, mandate the integration of emblem-detection capabilities into cyber tools, and outline verification and accountability procedures. It should also establish safeguards to ensure that emblem deployment is verifiable, secure, and limited to authorized actors. Further, the protocol could provide a tiered compliance framework, defining levels of technical integration tailored to state capacity. It should require certification of digital emblem systems and designate neutral monitoring entities to periodically audit adherence and investigate misuse. By embedding these protections in a legally binding international framework, the emblem’s practical value can be preserved.

As digital threats to medical infrastructure continue to grow, the ICRC’s initiative to implement a digital emblem is a timely and necessary adaptation of IHL. However, as this article has demonstrated, emblem digitalization alone is insufficient to deter cyberattacks on medical networks. Without strong enforcement mechanisms, clear attribution frameworks, and international cooperation, the emblem risks being nothing more than a symbolic gesture. Emblem digitalization is a step in the right direction, but it must be supported by a comprehensive regulatory framework that ensures its effectiveness. Only by aligning cyber-specific treaties with established principles of IHL can states guarantee that medical institutions receive meaningful protection offline and online. The international community must act decisively to enshrine these protections into law, thereby ensuring that authorized medical and humanitarian entities in cyberspace remain safeguarded from the growing threats of cyber warfare.

--- FOOTNOTES ---

ABSTRACT

* Fatemah Albader is Head of the Public International Law Department and an Associate Professor of Public International Law at Kuwait International Law School. She received her Doctor of Law, with Honors, from Emory University, where she served on the editorial board of Emory International Law Review, and her Master of Laws, with High Honors, from University of California-Berkeley. She would like to thank the editors of Emory International Law Review for their outstanding work during the review and editing process.

TABLE OF CONTENTS

I. DIGITALIZING IHL’S EMBLEMS FOR SPECIALLY

II. CYBER OPERATIONS AND EFFECTS ON PROTECTED

III. REGULATING CYBER OPERATIONS TO PROTECT

INTRODUCTION

1 TILMAN RODENH. . .USER ET AL., DIGITALIZING THE RED CROSS, RED CRESCENT AND RED CRYSTAL EMBLEMS: BENEFITS, RISKS, AND POSSIBLE SOLUTIONS 16 (2022); ICRC proposes digital red cross/crescent emblem to signal protection in cyberspace, ICRC (Nov. 3, 2022), https://www.icrc.org/en/document/icrcproposes-digital-red-crosscrescent-emblem-signal-protection-cyberspace [https://perma.cc/6XVY-DM8C].

2 Modern Warfare; Timeless Emblems: The Digital Emblem Project, ICRC (Sept. 3, 2025), https://www.icrc.org/en/article/icrc-digital-emblem-project [https://perma.cc/A26R-2AQ3]; Samit D’Cunha, Conceive, standardize, integrate: the past, present, and future of adopting distinctive emblems and signs under IHL, ICRC BLOGS (Sept. 12, 2024), https://blogs.icrc.org/law-and-policy/2024/09/12/conceive-standardizeintegrate-the-past-present-and-future-of-adopting-distinctive-emblems-and-signs-under-ihl/ [https://perma.cc/7CJE-HXP7].

3 Alexander Martin, Could a ‘digital Red Cross emblem’ protect hospitals from cyber warfare?, RECORD (Nov. 2, 2022), https://therecord.media/could-a-digital-red-cross-emblem-protect-hospitals-from-cyberwarfare/ [https://perma.cc/3K7A-2SKN].

4 Cal Harrison, Could a Digital Red Cross Protect Hospitals From Ransomware?, BANKINFOSECURITY (Nov. 9, 2022), https://www.bankinfosecurity.com/could-digital-red-cross-protect-hospitals-from-ransomwarea-20442 [https://perma.cc/K5DQ-PX59].

I. DIGITALIZING IHL’S EMBLEMS FOR SPECIALLY PROTECTED OBJECTS: A MANDATORY REQUIREMENT

5 LAURIE R. BLANK & GREGORY P. NOONE, INTERNATIONAL LAW AND ARMED CONFLICT: FUNDAMENTAL PRINCIPLES AND CONTEMPORARY CHALLENGES IN THE LAW OF WAR 456 (2d ed. 2018); Customary IHL Rules,

ICRC: IHL DATABASES, https://ihl-databases.icrc.org/en/customary-ihl/v1 [https://perma.cc/N9UQ-A23M] (last visited Dec. 29, 2025).

6 See, e.g., Customary IHL Rules, supra note 5. 7 BLANK & NOONE, supra note 5, at 40. 8 Id. at 40-41. 9 Id. at 48. 10 Id. at 584. 11 There are four emblems: (1) the red cross, (2) the red crescent, (3) the red crystal, and (4) the nowabandoned red lion and sun. See Protocol Additional to the Geneva Conventions of 12 August 1949, and Relating to the Adoption of an Additional Distinctive Emblem (Protocol III) art. 1, Dec. 8, 2005, S. TREATY DOC. NO. 109-10(A), 2404 U.N.T.S. 261 [hereinafter Protocol III]. All of these emblems will be used interchangeably throughout the article.

12 See id. 13 Convention for the Protection of Cultural Property in the Event of Armed Conflict arts. 6, 16, May 14,

1954, S. TREATY DOC. NO. 106-1, 249 U.N.T.S. 240. 14 Rule 15. Principle of Precautions

IHL DATABASES, https://ihldatabases.icrc.org/en/customary-ihl/v1/rule15 [https://perma.cc/8PTH-XSZK] (last visited Jan. 3, 2026); Protocol Additional to the Geneva Conventions of 12 August 1949, and Relating to the Protection of Victims of International Armed Conflict (Protocol I) art. 57(1), June 8, 1977, 1125 U.N.T.S. 3 [hereinafter Protocol I].

in Attack,

ICRC:

15 Geneva Convention for the Amelioration of the Condition of the Wounded and Sick in Armed Forces in the Field art. 38, Aug. 12, 1949, 6 U.S.T. 3114, 75 U.N.T.S. 31 [hereinafter First Geneva Convention]; Geneva Convention for the Amelioration of the Condition of Wounded, Sick and Shipwrecked Members of Armed Forces at Sea art. 41, Aug. 12, 1949, 6 U.S.T. 3217, 75 U.N.T.S. 85 [hereinafter Second Geneva Convention].

16 Geneva Convention Relative to the Protection of Civilian Persons in Time of War art. 20, Aug. 12, 1949,

6 U.S.T. 3516, 75 U.N.T.S. 287 [hereinafter Fourth Geneva Convention].

17 Id. arts. 18, 21. 18 Id. art. 18 (emphasis added). 19 BLANK & NOONE, supra note 5, at 479. 20 Fourth Geneva Convention, supra note 16, at art. 18. 21 Protocol III, supra note 11, at art. 2(1). 22 Id. art. 1.

23 Convention (I) for the Amelioration of the Condition of the Condition of the Wounded and Sick in Armed Forces in the Field. Geneva, 12 August 1949: Commentary of 1952, ICRC, https://ihl-databases.icrc.org/en/ihltreaties/gci-1949/article-38/commentary/1952 [https://perma.cc/W87Z-R8E2] (last visited Jan. 2, 2026).

24 See Sebastian Zelada, A

controversial

emblem,

ICRC BLOGS

(Apr.

21,

2021),

https://blogs.icrc.org/cross-files/a-controversial-emblem/ [https://perma.cc/G4M4-KHAB].

25 Protocol additional to the Geneva Conventions of 12 August 1949, and relating to the Adoption of an Additional Distinctive Emblem (Protocol III), 8 December 2005, ICRC: IHL DATABASES, https://ihldatabases.icrc.org/en/ihl-treaties/apiii-2005 (last visited Jan. 2, 2026) (discussing the historical background of Protocol III); see Protocol III, supra note 11.

[https://perma.cc/8U2V-STU4]

26 See, e.g., BLANK & NOONE, supra note 5, at 479.

II. CYBER OPERATIONS AND EFFECTS ON PROTECTED DIGITAL INFRASTRUCTURE

27 See, e.g., RODENH. . .USER ET AL., supra note 1, at 29. 28 Id. at 23. 29 Isabel Robinson & Ellen Nohle, Proportionality and Precautions in Attack: The Reverberating Effects

of Using Explosive Weapons in Populated Areas, 98 INT’L REV. RED CROSS 107, 112-13 (2016).

30 See Samuli Haataja & Afshin Akthar-Khavari, Stuxnet and International Law on the Use of Force: An

Informational Approach, 7 CAMBRIDGE INT’L L.J. 99, 100 (2018).

31 See Oona A. Hathaway et al., The Law of Cyber-Attack, 100 CALIF. L. REV. 817, 829 (2012). 32 See John Richardson, Stuxnet as Cyberwarfare: Applying the Law of War to the Virtual Battlefield, 29

J. MARSHALL J. COMPUT. & INFO. L. 1, 2 (2011).

33 Richardson, supra note 32, at 3.

34 See ‘World’s Biggest IT Outage’ Caused by a Cybersecurity Software Update, OXFORD GLOB. RES. (July 23, 2024), https://www.oxfordcorp.com/insights/industry-commentary/worlds-biggest-it-outage-causedby-a-cybersecurity-software-update/ [https://perma.cc/W4Y9-QCPK]; see also “Psychology of Human Error” Could Help 2020), Security https://cisomag.com/psychology-of-human-error-could-help-businesses-prevent-security-breaches/ [https://perma.cc/5YR4-C3Z4] (discussing a study revealing that “nine in 10 (88%) data breach incidents are caused by employees’ mistakes.”).

CISOMAG

Businesses

Breaches,

Prevent

(Sep.

12,

35 Andy Greenberg, The Untold Story of NotPetya, the Most Devastating Cyberattack in History, WIRED (Aug. 22, 2018, at 05:00 ET), https://www.wired.com/story/notpetya-cyberattack-ukraine-russia-code-crashedthe-world/ [https://perma.cc/4ZBG-PGMT]; see also Josephine Wolff, “Cyberwar by Almost Any Definition”: NotPetya, the Evolution of Insurance War Exclusions, and Their Application to Cyberattacks, 28 CONN. INS. L.J. 85, 87 (2021) (discussing NotPetya and whether it could be classified as “warlike”).

36 MATTEO CROSIGNANI, MARCO MACCHIAVELLI & ANDRÉ F. SILVA, PIRATES WITHOUT BORDERS: THE

PROPAGATION OF CYBERATTACKS THROUGH FIRMS’ SUPPLY CHAINS 1-2 (2021).

37 E. Eugene Schultz, Where have the worms and viruses gone? – new trends in malware, 2006 COMPUT. FRAUD & SEC. 4, 4 (2006); Miranda Rodriguez, All Your IP Are Belong to Us: An Analysis of Intellectual Property Rights as Applied to Malware, 3 TEX. A&M L. REV. 663, 664 (2016).

38 MARIE BAEZNER & PATRICE ROBIN, STUXNET 12 (2017).

39 See MONICA KAMINSKA, DENNIS BROEDERS & FABIO CRISTIANO, LIMITING VIRAL SPREAD: AUTOMATED CYBER OPERATIONS AND THE PRINCIPLES OF DISTINCTION AND DISCRIMINATION IN THE GREY ZONE 60 (2021); DIJIANG HUANG, ANKUR CHOWDHARY & SANDEEP PISHARODY, SOFTWARE-DEFINED NETWORKING AND SECURITY: FROM THEORY TO PRACTICE 294 (2019). 40 See CROSIGNANI, MACCHIAVELLI & SILVA, supra note 36, at 31. 41 See, e.g., Convention on the Prohibition of the Development, Production, and Stockpiling of Bacteriological (Biological) and Toxin Weapons and on Their Destruction, Apr. 10, 1972, 26 U.S.T. 583, 1015 U.N.T.S. 163 [hereinafter Biological Weapons Convention].

42 See, e.g., Computer Fraud and Abuse Act, 18 U.S.C. § 1030. 43 Rule 15. Principle of Precautions in Attack, supra note 14; Protocol I, supra note 14, at art. 57(1).

44 Neve Gordon & Nicola Perugini, ‘Hospital Shields’ and the Limits of International Law, 30 EUR. J. INT’L L. 439, 440 (2019); Lara Hakki, Eric Stover & Rohini J. Haar, Breaking the Silence: Advocacy and Accountability for Attacks on Hospitals in Armed Conflict, INT’L REV. RED CROSS, Jan. 2022, at 1201, 1202.

45 Abdulaziz Omar, Understanding and Preventing Attacks on Health Facilities During Armed Conflict in Syria, 13 RISK MGMT. & HEALTHCARE POL’Y 191, 191 (2020); United Nations News, Syria: Warring parties failed 2020), https://news.un.org/en/story/2020/04/1061192 [https://perma.cc/BH7W-ZLFM].

international

hospital

attacks

abide

(Apr.

over

law

by

to

6,

46 Gordon & Perugini, supra note 44, at 440. 47 Key MSF Publications about

the Kunduz Hospital Attack, MSF

(Oct. 3, 2018),

https://www.doctorswithoutborders.org/latest/key-msf-publications-about-kunduz-hospital-attack [https://perma.cc/7L3N-6T9N].

48 HIDING BEHIND THE COALITION: FAILURE TO CREDIBLY INVESTIGATE AND PROVIDE REDRESS FOR

UNLAWFUL ATTACKS IN YEMEN 24-25 (Hum. Rts. Watch ed., 2018).

49 Crisis update – September 2016, MSF (Sept. 27, 2016), https://www.msf.org/yemen-crisis-update-

september-2016 [https://perma.cc/P775-3EN3].

50 United Nations News, Israel attacks push Gaza healthcare ‘to brink of collapse’(Dec. 31, 2024),

https://news.un.org/en/story/2024/12/1158646 [https://perma.cc/FSR5-68BZ].

51 RODENH. . .USER ET AL., supra note 1, at 17. 52 See id. at 14. 53 INTERNATIONAL HUMANITARIAN LAW AND CYBER OPERATIONS DURING ARMED CONFLICTS 7 (Int’l

Comm. Red Cross ed., 2019).

54 See Christina Czeschik, War in Ukraine also threatens German hospital IT security, HEALTHCARE EUR. https://healthcare-in-europe.com/en/news/war-ukraine-threatens-german-hospital-it-

2022),

16,

(June security.html [https://perma.cc/7P7D-4DLG]. 55 See Richardson, supra note 32, at 23.

III. REGULATING CYBER OPERATIONS TO PROTECT MEDICAL FACILITIES

56 See EWAN LAWSON & KUBO MAČÁK, AVOIDING CIVILIAN HARM FROM MILITARY CYBER OPERATIONS

DURING ARMED CONFLICTS 26 (2020).

57 Biological Weapons Convention, supra note 41, at art. 1; Convention on the Prohibition of the Development, Production, Stockpiling and Use of Chemical Weapons and on their Destruction, opened for signature Jan. 13, 1993, S. TREATY DOC. NO. 103-21, 1975 U.N.T.S. 45 (entered into force Apr. 29, 1997).

58 To ensure the legal recognition and enforceability of the digital emblem, states could negotiate a new Additional Protocol IV to the Geneva Conventions, specifically addressing the digital emblem and its protections in cyberspace. Similar to how Additional Protocol III established the red crystal as a protective emblem, Additional Protocol IV could codify the digital emblem’s status, explicitly prohibiting cyberattacks against networks marked with the emblem and imposing legal consequences for violations. Protocol III, supra note 11.

59 Budapest Convention on Cybercrime, Nov. 23, 2001, S. TREATY DOC. NO. 108-11, 2296 U.N.T.S. 167. 60 Id. 61 United Nations News, Sixty-Five Nations Sign First UN Treaty to Fight Cybercrime, in Milestone for Digital Cooperation (Oct. 25, 2025), https://news.un.org/en/story/2025/10/1166182 [https://perma.cc/XD742B76].

62 See TALLINN MANUAL ON THE INTERNATIONAL LAW APPLICABLE TO CYBER WARFARE 1-6 (Michael N.

Schmitt ed., 2013).

CONCLUSION