Trason Lasley, Commingled Nuclear and Cyber Facilities: Obligations of States to Take Precautions Against the Effects of a Cyberattack, 42 Wis. Int'l L. J. 293 (2025).
In June 2010, a unique virus was broadly introduced to the world. This virus didn’t affect all it came in contact with; it only infected hosts that met specific requirements and was never meant to leave a particular host. With that said, the virus escaped and infections were found worldwide. Luckily, no humans were ever affected by this virus directly; instead, it was a cyberweapon, later coined Stuxnet, that was developed to target Iranian nuclear facilities. States in a time of war have a duty under the law of armed conflict not to attack installations containing dangerous forces, such as nucleargenerating stations, because of the harm they would cause to civilians. However, when states combine nuclear development facilities and the development of malicious cyberwarfare weapons within the same cyberinfrastructure, they forfeit protections under the law of armed conflict that would prohibit states from attacking said nuclear facilities. Because of this, states that combine such industries inherit a duty, under Article 58 of Additional Protocol I, to their civilian population to put in place safeguards to protect nuclear facilities from being victims of cyberwarfare and, therefore, protect their citizens from the effects of such attacks.
