Dr Natasha Gooden, Assistant Professor, Birmingham Law School
Keywords: Disinformation, conflict, international law, international humanitarian law, international human rights
Current Realities of Disinformation and Conflict
Disinformation is not new — it merely has adapted to meet today’s technical and geopolitical realities. Disinformation is the purposeful dissemination of false information which has the intention to mislead or cause harm. The use of disinformation through the creation and diffusion of deepfakes during conflict raises an increasing concern over AI’s potential to change the narrative of a conflict due to the distortion of information to undermine truths. Acting as a military tool, altered or fabricated images and videos are manipulated for a specific purpose to target impulses and anxieties, which often evoke strong emotions reflecting the notion of ‘enrage to engage’ and subsequently have an impact on international peace and security.
Current International Legal Framework
Under the application of International Humanitarian Law (IHL), disinformation is not directly addressed; however, Article 37 of Additional Protocol I regulates perfidy and ruses of war, which disinformation may fall under. Article 37(1) stipulated that combatants are prohibited from killing, injuring or capturing an adversary by resort to perfidy. The deceptive tactic uses the confidence of an adversary to mislead and with the intent to betray that confidence. Examples of perfidious behaviour include; (a) the feigning of an intent to negotiate under a flag of truce or of a surrender; (b) the feigning of an incapacitation by wounds or sickness; (c) the feigning of civilian, non-combatant status; and (d) the feigning of protected status by the use of signs, emblems or uniforms of the United Nations or of neutral or other States not Parties to the conflict.
Whereas, Article 37(2) API stipulates that ruses of war are permitted, such as the use of camouflage, decoys, mock operations and misinformation. These acts are intended to mislead the adversary; however, they do not invite the confidence of the adversary. This is where there is a clear contrast between the traditional regulation and the current realities of disinformation, where lines have become blurred in relation to the use and regulation. Furthermore, the provision related to the adversary in the Additional Protocol, which indicates a party of the conflict, the military opponent, whereas disinformation can come from the civilian population.
Therefore, under the current international legal framework, if deepfakes are considered perfidious, they would violate regulations. However, if deepfakes were a ruse of war, they would be considered a legitimate method of warfare. The use of deepfakes during hybrid conflicts has become a common threat to the conflict landscape. Hybrid threats consist of military and non-military, the deployment of irregular armed groups and the use of regular forces in both overt and covert means, broadening the conventional understanding of conflict. Hybrid tactics currently operate in legal grey areas where regulatory boundaries are blurred and require legal clarification.
Unanswered Legal Questions: The UN OEWG Report
Following the five-year mandate, the UN Open-Ended Working Group on security of and the use of information and communication technologies (OEWG) adapted its final consensus report in July 2025. The report highlighted the success following the challenges geopolitical environment with rising concerns of malicious use of ICTs by State and Non-State Actors and the impact on international peace and security (para 1). Furthermore, the report also addressed the usage of ICTs in conflict, which affects both military forces and civilians and civilian objects and the growing emergence of new technologies such as generative AI (paras 15 and 26).
The OEWG reaffirmed the general application of international law (para 39). International Humanitarian Law and International Human Rights regimes were mentioned in a tokenistic manner, while substantive discussion was omitted from the report. IHL discussion was mentioned in relation to the GGE report from 2021 and the UN GA Resolution 76/19, to recall IHL’s general application in situations of armed conflict and the established legal principles of humanity, necessity, proportionality and distinction.
Whilst the OEWG has allowed an international platform for dialogue and development, the report failed to address one of its foundational tasks: the promotion of common understandings on how international law applies to states’ use of ICTs, resulting in a neglected opportunity for legal clarification.
OEWG Recommendations
The complexity and lack of consensus were undoubtedly the culpability of the aforementioned limitations. However, to ensure future discourse, the report outlined the following three recommendations:
(1) States to continue discussions at the future permanent mechanism on how international law applies in the use of ICTs (para 44).
(2) States encouraged to share their national views and positions (para 45)
(3) Capacity building (para 46)
Whilst the report left key questions unanswered, recommendation (2) to share national views and positions has already been on the international community agenda.
State Positions on Disinformation: A Continued Void or Just the Beginning?
Currently, 42 states have shared their position on international law applicable to cyber operations. Although only seven states directly address disinformation. The state’s focus is limited to disinformation in relation to (a) the prohibition of intervention (and state sovereignty) and (b) human rights.
(a) The prohibition of intervention
At the forefront of the state positions, six states (Costa Rica, Austria, the US, Germany, New Zealand, and the Republic of Poland) directly address disinformation from a prohibition of intervention perspective. This approach is also reflected in academic discussion within the area.[1] Collectively, the states highlight that if coercion is undertaken through the use of ICTs, and if activities interfere with states’ sovereignty functions of internal or external affairs, it may violate the principle of non-intervention.
Examples include:
- Ransomware attacks are crippling or simply interfering with a State’s ability to run public services
- Foreign election interference
- Disinformation affecting a State’s health policies
- Inciting others to wage wars of aggression
- Deliberately incite violent political upheaval, riots and/or civil strife
- Compel another state to involuntarily change its behaviour
- Cyber activity deliberately causing significant damage to, or loss of functionality in, a state’s critical infrastructure.
There are still areas which need further consensus, and this is reflected by the US posing further questions based on other states’ positions and the ICJ’s understanding of prohibited intervention (pages 11-12). Similarly, Switzerland recognises that defining what constitutes a violation of the principle of sovereignty in cyberspace is particularly challenging and has yet to be clarified conclusively (page 3). Overall, this demonstrates a small growing consensus around disinformation and the prohibition of non-intervention.
(b) Human rights
Three states have also highlighted the interplay and link of disinformation with human rights considerations, which demonstrates a limited level of current consensus. Austria stipulated that the following rights may be affect through disinformation campaigns and states should not restrict; “right to privacy (Art. 17 ICCPR and Art. 8 ECHR), freedom of expression, including the freedom to seek, receive and impart information (Art. 19 ICCPR and Art. 10 ECHR – which include a right to internet access), as well as the right to freedom of association (Art. 22 ICCPR and Art. 11 ECHR).” The Netherlands, in its state position, went further and also addressed the right to education and the right to health and the right to privacy, and the right to family and demonstrated the vast range of rights potentially impacted by disinformation.
From a more cautious stance, Costa Rica noted that there is a balance that needs to come into place, as measures to protect the rights of States and individuals in cyberspace may often clash with certain individual human rights. Costa Rica provides the example that, to tackle online disinformation, the rights to receive and impart information freely on the internet may be limited. This clearly highlights the tensions and complexity within the area.
Looking Ahead
Advancing technologies will continue to shape both society and conflict. The international legal framework needs to ensure that it is robust enough to meet the demands of disinformation and deepfakes. Furthermore, the neglected opportunity of the UN OEWG report has led to a continued search for answers. While the current state positions shed some light on their approaches, this only reflects a small number of states. Additionally, the identification and discussion of disinformation within conflict is omitted. This suggests the large amount of work that needs to be done in order to gain further consensus. It also raises further questions about whether the state positions contribute to the development of customary international law. The development of future mechanisms and advanced state positions can hopefully fill the void and work towards legal clarity to ensure international peace and security is maintained in our cyber-enabled society.
[1] See; Nicholas Tsagourias, ‘Electoral Cyber Interference, Self-Determination and The Principle of Non- Intervention in Cyberspace’ in Dennis Broeders and Bibi van den Berg, Governing Cyberspace: Behaviour, Power and Diplomacy (Rowman & Littlefield, 2020); Michael Schmitt, ‘Virtual Disenfranchisement: Cyber Election Meddling in the Grey Zones of International Law’ (2018) 19:1 Chicago Journal of International Law; Marko Milanovic and Michael Schmitt, ‘Cyber Attacks and Cyber (Mis)Information Operations During a Pandemic’ (2020)11:247 Journal of National Security Law and Policy.
*Part of broader research addressing disinformation and deepfakes within conflict.