By: Priya Urs
Recent years have seen an alarming rise in cross-border cyber operations targeting the healthcare sector. Such operations disrupt the provision of health services, compromise sensitive medical data, and spread false health-related information online, all hindering States’ management of public health. In this context, the question may be posed whether engaging in cyber operations targeting healthcare or giving relevant support to such operations constitutes unlawful intervention by one State in the affairs of another. The lack of clarity in existing doctrine as to the elements of unlawful intervention, however, complicates the assessment of the lawfulness or not of such operations. This Article paves the way for the assessment in two steps. First, it considers how the prohibition of intervention is articulated in existing practice and scholarship, including in the context of cyber operations. In the absence of doctrinal certainty, it suggests the most appropriate understanding of the requirements for unlawful intervention. Second, by applying the proposed requirements, this Article scrutinizes whether a variety of cyber operations targeting the healthcare sector could constitute prohibited intervention. It concludes that while cyber operations that actually disrupt the provision of healthcare or related activities could be unlawful on this basis, data breaches and ‘information’ operations are less likely to so qualify. Ultimately, in light of the increase in cyber operations targeting a range of public services beyond healthcare, this Article offers a blueprint for applying the prohibition of intervention to cyber operations in other contexts.