PerspectiveCyber Attacks against Hospitals and the COVID-19 Pandemic: How Strong are International Law Protections?

In a situation where most, if not all of us are potential patients, few government-provided services are more important than the efficient delivery of health care. The strain on hospitals around the world is rapidly growing, to which states have responded by mobilizing military medical units, nationalizing private medical facilities, and building emergency hospitals.

Kubo Mačák, Laurent Gisel, and Tilman Rodenhäuser write in Just Security that

It is essential that all of these facilities can function without interruption and that they have sufficient resources as they scale up their operations due to the unfolding crisis. However, as noted in a 2019 International Committee of the Red Cross (ICRC) report on the potential human cost of cyber operations, even in ordinary times the health-care sector is particularly vulnerable to cyber attacks due to its increasing digital dependency and “attack surface.” (see page 6 of the report)

All of this underlines the urgent need to understand what protections the law offers against such attacks. This article examines the protections afforded by existing international law. To the extent that rules that govern the behavior of States are discussed, it should be remembered that these apply only if a given operation is attributable to a State (e.g. because it was conducted by a State organ or under the instructions, direction, or control of a State). Experts have already warned of indications that some “coronavirus-themed cyberattack campaigns” may have been carried out by states.