Direct Causation in International Humanitarian Law and the Challenge of AI-Mediated Civilian Cyber Operations

Technical Summary: Direct Causation in International Humanitarian Law and the Challenge of AI-Mediated Civilian Cyber Operations

Problem Statement
International Humanitarian Law (IHL) protects civilians from direct attack unless they take a "direct part in hostilities" (DPH). The ICRC's 2009 Interpretive Guidance operationalizes this through a three-criterion cumulative test: threshold of harm, direct causation, and belligerent nexus. This paper identifies a structural failure in the direct causation criterion when applied to AI-mediated civilian cyber operations. Specifically, the deployment of autonomous multi-agent cyber systems by civilians creates a causal gap that existing doctrinal tools cannot bridge.

The core issue is that the Interpretive Guidance presupposes identifiable human actors downstream of the initial civilian act whose conduct can be classified. In traditional cases (e.g., mines, drone strikes), the human either executes the harm or encodes the operative decisions into a system that executes them later. However, in advanced AI scenarios, a civilian may configure a system with a high-level goal and then disengage, allowing the system to autonomously generate the specific operative decisions (target selection, exploit generation, execution timing) that cause harm. Because the human is no longer "endogenous" to the decision-generating system, and because there are no downstream human contributors to form a "joint" operation, the framework defaults to classifying such conduct as indirect participation (capacity-building). This classification is substantively in tension with the framework's purpose, as it fails to capture civilians who personally deploy autonomous systems against military targets, grouping them instead with scientific research or weapons production.

Methodology
The paper employs a doctrinal analysis of the Interpretive Guidance combined with an empirical assessment of emerging offensive AI capabilities.

1. Doctrinal Framework: The authors analyze the "one causal step" standard and the "integral-part" requirement for joint causation. They introduce an endogenous/exogenous analytical lens to determine whether a civilian is inside or outside the system generating operative harm decisions.
2. Scenario Construction: Three scenarios of AI-mediated cyber conduct are constructed, ranging from human-in-the-loop to fully autonomous deployment:
   • Scenario 1: A volunteer uses an LLM to draft a script and manually executes it (Human-in-the-loop).
   • Scenario 2: A hacktivist runs an agentic framework where the AI proposes steps, but the human approves each action before execution (Human-in-the-loop with generative assistance).
   • Scenario 3: A hacktivist configures a hierarchical multi-agent system (e.g., HPTSA) with a broad goal and launches it, allowing the system to autonomously plan, reconnoiter, and execute attacks without further human input.
3. Empirical Context: The analysis draws on documented civilian cyber participation in the Russia-Ukraine conflict (e.g., the IT Army of Ukraine) and recent offensive AI research (e.g., Fang et al.'s GPT-4 agent exploiting 87% of CVEs, and Anthropic's Project Glasswing) to establish that the technical foundations for Scenario 3 are operational, not speculative.

Key Contributions
The paper makes three primary contributions:

1. Doctrinal Identification of Structural Failure: It demonstrates that the direct causation element of the DPH framework fails structurally for autonomous multi-agent deployments. The "one causal step" standard fails because harm is produced by system-generated decisions made after human disengagement. The "integral-part" requirement fails because it presupposes downstream human contributors, which are absent in fully autonomous operations.
2. Introduction of Goal-Specification Granularity: The paper identifies goal-specification granularity as the measurable property determining the concreteness of the "integral-part" test. This construct quantifies how much of the operative decision-making is fixed by the human at the moment of configuration versus how much is generated by the system afterward.
   • The authors propose a five-level spectrum:
     • Level 1 (Fully specified): Human names target, method, and execution steps.
     • Level 2 (Method-specified): Human names target and method class; system selects technique.
     • Level 3 (Target-specified): Human names target; system selects method.
     • Level 4 (Scope-specified): Human names target class; system selects specific targets and methods.
     • Level 5 (Goal-specified): Human states only the objective; system selects targets, methods, and execution.
   • The paper argues that the doctrinal failure occurs specifically at Level 5, where the human is exogenous to the system of operative harm decisions.
3. Assessment of Technical AI Governance (TAIG): The paper evaluates existing technical AI governance instruments (e.g., capability benchmarks like Cybench, agentic frameworks like AgentBench, and output provenance tools). It concludes that none of these instruments log or report goal-specification granularity. While they measure model performance or access, they lack the specific metric required for downstream legal classification of civilian conduct.

Results

• Scenario 1 and 2: These fit within the existing DPH logic. In Scenario 1, the human executes the act. In Scenario 2, the human approves each operative decision, maintaining an endogenous position.
• Scenario 3: This scenario breaks the framework. The human's act (configuration) is separated from the harm by a sequence of autonomous system decisions.
  • The "one causal step" standard is not met because the harm is many steps away.
  • The "integral-part" requirement is not met because there is no "concrete and coordinated tactical operation" defined by humans at the time of the act; the operation is generated by the system.
  • Consequently, the framework defaults to the capacity-building exclusion, misclassifying the deployment as indirect participation.
• Temporal Consequence: The failure of direct causation causes the "for such time as" temporal boundary to break down, as there is no identifiable participatory act to anchor the start and end of the engagement.
• Governance Gap: Current TAIG instruments do not capture the granularity of configuration acts. Without logging whether a deployment was Level 1 or Level 5, there is no evidentiary basis to distinguish between capacity-building (e.g., research) and direct participation (e.g., autonomous attack deployment).

Significance
The paper argues that the misalignment between AI-mediated cyber operations and the DPH framework is structural, not merely interpretive. As autonomous systems proliferate, the gap between what the framework classifies (indirect participation) and what it was designed to classify (direct participation) will widen.

The significance lies in localizing the precise point where the doctrine requires updating: the concreteness component of the integral-part test cannot function without a measure of how much operative content the human fixed at configuration. The paper proposes that goal-specification granularity is the necessary metric to restore the distinction between civilians who build capacity and those who personally take part in hostilities. While the paper notes that instrumentation of cooperative platforms is a potential first step, it acknowledges significant limitations, including the fact that adversarial actors (hacktivists) often operate on local hardware without platform intermediaries, rendering current cooperative governance measures insufficient for the most critical cases. The work serves as a diagnostic of a specific doctrinal failure mode rather than a comprehensive governance proposal.