Τhe Duty of Constant Care and Data Protection in War
Τhe Duty of Constant Care and Data Protection in War
The Duty of Constant Care and Data Protection in War, in Big Data
and Armed Conflict: Legal Issues Above and Below the Armed
forthcoming, 2022)
Asaf Lubin
Asaf Lubin **
Against this backdrop calls have been made to find restraints within
existing frameworks of IHL to militaries’ emerging data-invasive practices.
In this chapter I explore one such restraint: the Duty of Constant Care as
established under the general customary principle of precautions in attack. I
argue that this duty applies to the entire gamut of a belligerent party’s
informational activity against its adversaries. In fact, I go as far as to suggest
that the “precautions in attack” principle, as was originally envisaged by the
drafters of the First Additional Protocol to the Geneva Conventions (API),
reflects, at least in part, a primeval and elementary data protection rule.
The chapter proceeds in the following order: First it discusses the binding
nature of the Duty of Constant Care and its temporal and subject matter
scope. Second, it examines the Duty’s possible data protection applications,
focusing specifically on two primary categories of obligations: legality and
transparency and storage specification and data integrity. Ultimately, I
propose that the Duty of Constant Care might prove a temporary gap-filler
to the lacuna of wartime data protection, at least until such time as more
expansive and restrictive data protection regimes are implemented through
treaty evolution and custom formation.
*
This is a draft of a chapter that has been accepted for publication by Oxford University
Press in the forthcoming book, BIG DATA AND ARMED CONFLICT: LEGAL ISSUES ABOVE AND
BELOW THE ARMED CONFLICT THRESHOLD, edited by Laura A. Dickinson & Edward Berg,
due for publication in 2022.”
**
Dr. Asaf Lubin is an Associate Professor of Law at Indiana University Maurer School
of Law, Fellow at IU’s Center for Applied Cybersecurity Research, Faculty Associate at the
Berkman Klein Center for Internet and Society at Harvard University, Affiliated Fellow at
the Information Society Project at Yale Law School, and a Visiting Scholar at the Federmann
Cyber Security Center at Hebrew University of Jerusalem. I wish to thank both Laura
Dickinson and Edward W. Berg for inviting me to contribute to this book and for providing
such excellent feedback on earlier versions of this chapter.
Table of Contents
INTRODUCTION ..................................................................................................................... 3
I. THE DUTY OF CONSTANT CARE .................................................................................. 7
A. THE BINDING NATURE OF THE DUTY ...........................................................................................7
B. THE DUTY’S GENERAL SCOPE ........................................................................................................9
1. What military activities trigger the duty? ....................................................... 10
2. When does the duty apply? .................................................................................... 11
3. What Harms is the Duty Meant to Prevent? ................................................... 13
4. When is the Duty Breached? ................................................................................. 14
II. THE DUTY OF CONSTANT CARE AND DATA PROTECTION ............................ 16
A. THE DUTY OF CONSTANT CARE AS A DATA PROTECTION RULE ........................................... 16
B. SPECIFIC APPLICATIONS OF THE DUTY IN THE AGE OF BIG DATA .......................................... 17
1. Legality and Transparency ................................................................................... 18
2. Storage Specification and Limitation and Data Integrity......................... 19
CONCLUSION ......................................................................................................................... 20
INTRODUCTION
The White House defines “big data” as the “growing technological ability
to capture, aggregate, and process an ever-greater volume, velocity, and
variety of data.” 4 Together these three Vs introduce endless opportunities for
algorithmic research that may highlight previously undiscovered correlations
in large and complex datasets. As the Federal Trade Commission noted “the
present scope and scale of data collection enables cost-effective, substantial
research of even obscure or mundane topics.” 5 Militaries can use big data
solutions and associated technologies to improve their procurement,
transportation, and redeployment of material and personnel. They can also
use it to engage the varied aspects of warfare: manage detention facilities,
launch targeted killing operations, and automate the collection and analysis
of military intelligence, if to name but a few applications. This fast-paced
evolution in the development and deployment of big data in the military is
not free of casualties.
1
STEPHANIE RICKER SCHULTE, CACHED: DECODING THE INTERNET IN GLOBAL POPULAR
CULTURE 43 (2013).
2
Ashley S. Deeks, Predicting Enemies, 104 VIRGINIA L. REV. 1529, 1531.
3
Id.
4
EXEC. OFFICE OF THE PRESIDENT , BIG DATA: SEIZING OPPERTUNITIES, PRESERVING
VALUES, THE WHITE HOUSE, 2 (May 2014),
https://obamawhitehouse.archives.gov/sites/default/files/docs/big_data_privacy_report_ma
y_1_2014.pdf.
5
FED. TRADE COMM’N, BIG DATA: A TOOL FOR INCLUSION OR EXCLUSION?, 2 (Jan.
2016), https://www.ftc.gov/system/files/documents/reports/big-data-tool-inclusion-or-
exclusion-understanding-issues/160106big-data-rpt.pdf.
the decision, “more than 50,000 Palestinians” downloaded this app and used
it to access a set of digital services, including for example, the ability to check
on the status of their applications for entry permits into Israel. 10 As part of
12F
petitioned against the terms of use of the app in court, did Israel officially
commit to making changes to both the terms and practice. 12 14 F
6
Colin Freeze, Fearing reprisals, Afghans rush to scrub digital presence after Taliban
takeover, GLOBE & MAIL CANADA (Aug. 21, 2021),
https://www.theglobeandmail.com/canada/article-fearing-reprisals-afghans-rush-to-scrub-
digital-presence-after-taliban/.
7
Id.
8
COGAT is a unit within the Israeli Ministry of Defense responsible for implementing
the government’s civilian policy within the west bank and Gaza strip. For further reading see
COGAT’s website at https://www.gov.il/en/departments/coordination-of-government-
activities-in-the-territories/govil-landing-page.
9
Hagar Shezaf, Israel Tells Court Would Stop Forcing Palestinian Laborers to Give
Access to Phone Data, HAARETZ (May 15, 2020), https://www.haaretz.com/middle-east-
news/palestinians/.premium-over-50-000-palestinians-forced-to-give-phone-data-to-israel-
1.8844580.
10
Id.
11
Id.
12
Following HaMoked’s demand: the military amended the invasive terms of use of the
mobile app enabling Palestinians to check the status of permit requests, HAMOKED (June 2,
2020), http://www.hamoked.org/Document.aspx?dID=Updates2175 (the “petition explained
that the application’s terms of use constitute a severe infringement of the users’ right to
privacy and dignity, were contrary to Israeli and international law; and compelled
Palestinians to disclose information that could be exploited by the occupying power.” In light
of the petition “COGAT announced that the terms of use had been substantively changed, so
Even more drastically, Israel has relied on data governance policies for
years as a tool for enhancing its oppression of the territories. Israeli
authorities “remain in total control of the electromagnetic waves as well as
[the] importing and installation of any equipment by Palestinian telcos and
ISPs.” 13 Israel has relied on national security claims to delay Palestinian
adoption of 3G networks and has yet to authorize the setup of either 4G or
wireless broadband networks. 14 One driver of this policy is Israel’s own
intelligence capacity in penetrating the existing networks, and its desire to
maintain this level of surveillance and control within the occupied
territories. 15
as to make clear that a person’s consent upon downloading the application relates strictly to
the provision of the specific data required for the service in use, and that the application has
no access to files, contacts, photos and so on.” The petition itself was ultimately dismissed
outright with the Court finding that “actual harm remained unproven.”).
13
Exposed and Exploited: Data Protection in the Middle East and North Africa, ACCESS
NOW, 24 (Jan. 2021), https://www.accessnow.org/cms/assets/uploads/2021/01/Access-Now-
MENA-data-protection-report.pdf.
14
Connection Interrupted: Israel’s Control of the Palestinian ICT Infrastructure and Its
Impact on Digital Rights, 7AMLEH, 16 (Dec. 2018) https://7amleh.org/wp-
content/uploads/2019/01/Report_7amleh_English_final.pdf
15
Id., at 30 (citing to a 2014 letter by 43 reserve Israeli intelligence officers which
confirms that Palestinians are currently “completely exposed to espionage and surveillance
by Israeli intelligence.”).
16
Robin Geiß & Henning Lahmann, Data Protection in Armed Conflict,
VERFASSUNGSBLOG (Feb. 15, 2021), https://verfassungsblog.de/data-protection-in-armed-
While we should, of course, continue to call for the urgent evolution and
expansion of data protection frameworks into military operations, as a matter
of future and desired law, 19 we must also look for practical intermediate
solutions. We therefore should ask what data protection restraints, if any, may
be found in existing frameworks of IHL. In this chapter I explore one such
restraint: the duty of constant care as established under the general customary
principle of precautions in attack.
It was Eric Jensen who proposed, almost a decade ago, that “all cyber
operations are governed by the constant-care standard” 20 and that the
standard requires, as a baseline, that commanders take into account the
“effects on civilian population” from their cyber activity. 21 This position was
reaffirmed by the international group of experts (IGE) who drafted Tallinn
Manual 2.0. The IGE noted that the constant care standard introduces a
conflict/.
17
See generally Asaf Lubin, The Rights to Privacy and Data Protection Under
International Humanitarian Law and Human Rights Law, in RESEARCH HANDBOOK ON
HUMAN RIGHTS AND HUMANITARIAN LAW: FURTHER REFLECTIONS AND PERSPECTIVES
(Robert Kolb, Gloria Gaggioli & Pavle Kilibarda eds., Edward Elgar, Forthcoming, 2021);
Asaf Lubin, Big Data and the Future of Belligerency: Applying the Rights to Privacy and
Data Protection to Wartime Artificial Intelligence, in HANDBOOK ON WARFARE AND
ARTIFICIAL INTELLIGENCE (Geiss & Lahmann eds., forthcoming, 2022).
18
Id.
19
See for example a recent imitative by the NATO Cooperative Cyber Defense Centre
of Excellence (CCDCOE) to conduct “a pioneering study on the interplay between different
legal regimes regulating privacy and data protection in conflict situations.” See The Rights
to Privacy and Data Protection in Armed Conflict, CCDCOE (Mar. 2021),
https://ccdcoe.org/research/data-protection-and-privacy-in-armed-conflict/.
20
Eric Talbot Jensen, Cyber Attacks: Proportionality and Precautions in Attack, 89
INT’L L. STUD. 198, 204 (2013).
21
Id., at 202.
The duty of constant care is enshrined in Article 57(1) of API and reads
as follows: “In the conduct of military operations, constant care shall be taken
to spare the civilian population, civilians and civilian objects.” 24 This
provision imposes an “important duty on belligerents” 25 and is part of the
22
TALLINN MANUAL 2.0 ON THE INTERNATIONAL LAW APPLICABLE TO CYBER
OPERATIONS 477 (Michael Schmitt ed., 2nd ed., 2017) [hereinafter: TM2.0]
23
Section I.A. and certain limited parts in section I.B. were first produced and published
in Asaf Lubin, The Reasonable Intelligence Agency, 47 YALE J. INT’L. L. 119 (2022).
24
Protocol I additional to the Geneva Conventions of 1949, and relating to the
Protections of Victims of International Armed Conflicts, 1125 U.N.T.S 3, Article 57(1)
(1977) [hereinafter: API].
25
INTERNATIONAL COMMITTEE OF THE RED CROSS, COMMENTARY ON THE ADDITIONAL
PROTOCOLS OF JUNE 8 1977 TO THE GENEVA CONVENTIONS OF 12 AUGUST 1949, at 680, ¶
While the duty of constant Care only applies to those parties engaging in
offensive operations it is matched by a parallel (albeit not identical) 29 duty
for defenders. Article 58(c) of API confirms that parties to a conflict must “to
the maximum extent feasible” adopt “necessary precautions to protect the
civilian population, individual civilians, and civilian objects under their
control against the dangers resulting from military operations.” 30 The ICRC
CIHL study confirms that this rule too is reflective of custom and applicable
in both IACs and NIACs. 31 I stress the similarities between the two sister
duties only because we may be able to learn more about the scope of the
obligation under Article 57 by comparing it to the obligation under Article
58. 32
Attacks, 88 Tᴇx. L. Rᴇᴠ. 1533, 1553 (2009). (acknowledging that “it is not feasible to protect
everything all the time” and applying that notion in cyberspace).
33
Commentary to API, supra note 25, at 678, ¶ 2191.
34
WILLIAM H. BOOTHBY, THE LAW OF TARGETING 123 (2012).
35
Italy, Statement at the CDDH, Summary Record of the 42nd Plenary Meeting:
Adoption of the Articles of Draft Protocol I, Vol. VI, CDDH/SR. 42, 231 (May 27, 1977).
36
ICRC, Statement at the CDDH, Committee III Summary Record of the 21st Meeting:
Consideration of Draft Protocols I and II, Vol. XIV, CDDHI III/SR. 21, 182 (Feb. 17, 1975).
37
TETYANA KRUPIY, A TOOLBOX FOR THE APPLICATION OF THE RULES OF TARGETING
129 (2016).
38
For further reading on these obligations see e.g. STUART CASEY-MASLEN & STEVEN
HAINES, HAGUE LAW INTERPRETED: THE CONDUCT OF HOSTILITIES UNDER THE LAW OF
ARMED CONFLICT 197-207 (2018).
The duty to spare the civilian population applies “in the conduct of
military operations.” 39 The reference to “military operations” indicates that
the duty extends beyond “attacks,” and applies to “any movements,
manoeuvres, and other activities whatsoever carried out by the armed forces
with a view of combat.” 40 As Eric Jensen writes the term military operations
“imposes a general legal requirement on militaries even when not
attacking.” 41 This is an expansive definition that captures all military
activities with a general nexus to combat.
What this means for military operations in the digital age is still subject
for evolving interpretation. One possible reading, the one I advocate for in
this chapter, is that the rule encompassed in Article 57(1) should cover all
informational operations necessary to support military activity. In this regard,
intelligence collection, in any of its form and conducted by any actor (private
contractors, civilian intelligence agencies), as well as other broader data
collection and management activities should trigger the application of the
duty, so long as the information in question is collected, stored, processed, or
disseminated with the general purpose of advancing combat.
39
See supra note 24 and accompanying text.
40
Commentary to API, supra note 25, at 678, ¶ 2191.
41
See Jensen, supra note 20, at 202.
42
See TM2.0, supra note 22, at 477.
43
See generally Lubin, supra note 23, at ___.
44
Interview with Major S., the deputy commander of the Israeli Air Force 200 Squadron,
reprinted in Ann Rogers, Investigating the Relationship between Drone Warfare and Civilian
In other words, the duty of constant care, and the specific precaution of
target verification (enshrined in Article 57(2)(a)(i)) introduce peacetime
obligations on the party collecting and processing that data. Specifically in
this example, the collector and processor of the data is required to monitor
the database to ensure the accuracy of the data stored. Accuracy of personal
data is a common data protection standard. The principle of accuracy in data
protection establishes “a qualitative requirement and entails a responsibility
that the data be accurate, and necessarily complete and up to date for the
purpose intended.” 46 By requiring the military to take every reasonable step
to rectify inaccurate or incomplete data in targeting, Article 57’s verification
standard is an early articulation of a data protection concept. This is a crucial
finding. If Article 57 is truly a data protection regime in disguise, what other
standards might be hiding at plain sight between its four corners? It may
therefore be in line with the drafters’ intuitive intention that we interpret the
duty of constant care as one that shines a data protective light the military’s
informational activity.
But while this inquiry may ultimately lead to new data protection
obligations on militaries, it may also raise new and complex questions. Here
is one: The “targeting banks” example speaks directly to intelligence
Casualties in Gaza, 7 J. Strategic Sec. 94, 101 (2014); THE 2014 GAZA CONFLICT (7 JULY –
26 AUGUST 2014): FACTUAL AND LEGAL ASPECTS, ISRAELI MINISTRY OF FOREIGN AFFAIRS,
¶ 246 (May 2015), https://mfa.gov.il/ProtectiveEdge/Pages/default.aspx (noting that the
“target planning process begins with the collection of intelligence” and describing how that
intelligence is preserved in a “Target Card.” The card includes operational directives and is
subject to legal review that takes into account, among other things, precautions that could be
taken upon execution).
45
See Interview with Major S., id., at 103-104.
46
Report of the International Law Commission on the Work of its Fifty-Eighth Session,
Annex IV: Protection of Personal Data in Transborder Flow of Information (2006) UN Doc
Supplement No 10 (A/61/10) (2006), 503
https://legal.un.org/ilc/reports/2006/english/annexes.pdf [hereinafter: ILC Data Protection
Report].
collected by the military for a clear wartime purpose. How far along the data
supply chain should we extend Article 57’s data protection reach? What
about intelligence originally collected for a non-combat purpose that is later
found of use for a military aim. At what point should the duty of constant
care latch on and should it retroactively introduce certain data protection
standards? I am unable to offer a definitive answer at this point, and can only
suggest that we employ a fact-intensive analysis that takes into account the
varied circumstances surrounding each case.
But the duty of constant care could theoretically be said to extend beyond
physical harms. Indeed, the parallel duty of defenders, in Article 58, refers to
an even broader category of “dangers” and not mere damages. This extension
of the harms prong of the duty also echoes the language of the 1970 UN
General Assembly Resolution 2675. That resolution introduced an obligation
on those engaging in military operations to make “every effort… to spare the
47
FRITS KALSHOVEN & LIESBETH ZEGVELD, CONSTRAINTS ON THE WAGING OF WAR:
AN INTRODUCTION TO INTERNATIONAL HUMANITARIAN LAW 113 (4th ed., 2011).
It may be suggested that the “damage” prong behind the duty should be
read broadly to include a range of “dangers” and “ravages of war” that go
beyond the physical. If our goal is to “dimmish the evils of war as far as
military requirements permit” 49 then it follows that commanders must
comply with “the laws of humanity, and the dictates of the public
conscience” 50 wherever possible – even where the harms are dignitary rather
than kinetic. In my introduction I listed a set of individual rights which have
digital manifestations—privacy, anonymity, access to information, online
freedom of expression, digital autonomy and dignity, and intellectual
property. As the examples I discussed in the introduction show, these rights
are constantly at risk of abuse in the age of informational warfare. It seems
to me that the duty of constant care may be able to serve a protective role for
some of these digital rights at this intermediate stage, until more developed
prescriptive frameworks take hold.
It is true that the duty of constant care is “poorly defined” 51 and therefore
that extracting actual requirements may be difficult. Nonetheless, it is well
established that the duty introduces a general obligation on a commander “to
bear in mind the effect on the civilian population of what he is planning to do
and take steps to reduce that effect as much as possible.” 52
The duty thus imposes a balancing act between “both the humanitarian
considerations in favor of taking a precaution and the military considerations
against taking that precaution.” 53 In balancing between the two
considerations “there may be occasions when a commander will have to
accept a higher level of risk to his own forces in order to avoid or reduce
48
Basic Principles for the Protection of Civilian Population in Armed Conflicts, UNGA
Res. 2675, U.N. Doc. A/RES/2675(XXV), para. 3 (1970) (adopted by 109 votes in favor,
none against and 8 abstentions) (emphasis added).
49
Convention (IV) Respecting the Laws and Customs of War on Land, 36 Stat. 2277,
207 Consol. T.S. 277, 18 October 1907 (Hague Convention IV), Preamble. See also
Convention (II) with Respect to the Laws and Customs of War on Land, 32 Stat. 1803,
Martens Nouveau Recueil, Series 2, Vol. 26, 29 July 1899, Preamble.
50
Hague Convention IV, Preamble; AP I, Art. 1(2) (the Martens Clause).
51
Michael N. Schmitt, Wired warfare 3.0: Protecting the civilian population during
cyber operations, 101 INT’L REV. RED CROSS 333, 354 (2019).
52
UK Ministry of Defence, The Manual of the Law of Armed Conflict, 2004 (UK Law
of War Manual), para. 5.32.1.
53
ADIL AHMAD HAQUE, LAW AND MORALITY AT WAR 155 (2017).
This multi-factor test perfectly aligns with the Duty of Constant Care
under IHL. Lacking specific criteria, States are left with a general “zone of
reasonableness” 57 within which they are called to “employ reasonably
available resources and to gather reasonably available information.” 58 Those
states are merely asked to exercise basic due diligence, to do what is
“practicably possible, taking into account all circumstances ruling at the
time.” 59
54
Id., at 158 (citing a British defense doctrine).
55
APV Rogers, Conduct of Combat and Risks Run by the Civilian Population, 21 MIL.
L. & L. WAR REV. 293, 310 (1982).
56
In re The Chagos Marine Protected Area Arbitration, ¶519 (March 18, 2015),
http://www.pcacases.com/pcadocs/MU-UK%2020150318%20Award.pdf.
57
AMICHAI COHEN & DAVID ZLOTOGORSKI, PROPORTIONALITY IN INTERNATIONAL
HUMANITARIAN LAW: CONSEQUENCES, PRECAUTIONS, AND PROCEDURES 199.
58
Krupiy, supra note 37, at 126.
59
ICRC CIHL, supra note 26, Practice Relating to Rule 15.
60
Final Report to the Prosecutor by the Committee Established to Review the NATO
Bombing Campaign Against the Federal Republic of Yugoslavia, ¶ 29 (June 2, 2000)
https://www.icty.org/sid/10052 (hereinafter: ICTY Expert Committee Report) (emphasis
added).
In the final section of this chapter, I try to propose specific ways by which
the duty of constant care may serve to restrain particular types of
informational activity. To be clear, I do not argue that the duty of constant
care as currently understood already encompasses a sufficiently clear menu
of lex lata rules and obligations on member States. I only think that it may be
read to encompass such rules through progressive interpretation. I argue that
this interpretation would be textually reasonable and in line with the historical
function that the duty of constant care was intended to serve since its drafting.
I also think that such an interpretation could serve as a temporary gap-filler,
either as a matter of recommended best practice or as a matter of binding law,
until such time as more formidable treaty frameworks are introduced by the
international community.
For this final section I suggest that we follow an actual case study that
might help demonstrate important ways by which a progressive interpretation
of the duty of care could assist in constraining certain military informational
activities. Consider in this regard biometric data processing. The UN Security
Council introduced a Chapter VII resolution which required Member States,
as part of the fight against terrorism, to “develop and implement systems to
collect biometric data, which could include fingerprints, photographs, facial
recognition, and other relevant identifying biometric data.”. 61
61
Threats to International Peace and Security Caused by Returning Foreign Terrorist
Fighters, UNSC Res. 2396, U.N. Doc. S/RES/2396, para. 15 (2017) (voted unanimously).
62
Sebastian Cymutta, Biometric data processing by the German armed forces during
deployment, CCDCOE, 4 (2021), https://ccdcoe.org/uploads/2021/05/Cymutta_Biometric-
data-processing-by-the-German-armed-forces-during-deployment_05.2021.pdf.
63
Id.
therefore that there was no need to consider data protection law in the context
of collecting this biometric data. But the recent developments in Afghanistan
with which this article began highlight the potential horrific consequences to
the civilian population from poorly managing data. The way personally
identifiable information is collected, stored, disseminated, and ultimately
deleted matters. Especially before, during, and after war. Not only that, but
the specific features of this operation—(1) the fact that data was transferred
between multiples members of a coalition force; (2) the fact that data was
processed against another external dataset; (3) the fact that the data
processing involved automated features; and (4) the fact that the data in
question included particularly sensitive and personally indefinable
information—make the lack of data protection standards particularly
troubling. Many of these features are typical to the big data age. They
demonstrate just how little attention militaries have given to data protection
in their rush to incorporate big data solutions in every segment of their
activities.
64
See generally ICRC Rules on Personal Data Protection, ICRC) (2019),
https://www.icrc.org/en/publication/4261-icrc-rules-on-personal-data-protection.
65
Report of the Special Rapporteur on the Promotion and Protection of Human Rights
and Fundamental Freedoms While Countering Terrorism, U.N. Doc. A/69/397, para. 40 (23
September 2014).
66
Id.
67
See Cymutta, supra note 62, at 4.
68
See ILC Data Protection Report, supra note 46, at 503.
CONCLUSION
In this short chapter I tried to suggest that IHL already possess a set of
legal hooks on which we may be able to rest contemporary data protection
best practices, thereby futureproofing the Geneva Conventions and
Additional Protections. I clarified that my proposal is one of progressive
interpretation and that its utilization should be temporary, until such time as
69
Data Protection Principles: A Guide for Policy Engagement on Data Protection,
Privacy International, 41 https://privacyinternational.org/sites/default/files/2018-
09/Part%203%20-%20Data%20Protection%20Principles.pdf.
70
Id., at 45.
To conclude let us revisit for one final time to the fictional countries
of Newtropia and Outlandia from the book’s underlying hypothetical.
Consider operation “Full Wrap” as described in the scenario. The operation
was launched 18 months before the war broke out. It involved private
contractors collecting huge amounts of data both domestically and globally
to feed the algorithms developed by the military. The operation further relied
on foreign commercial servers and a corporate cloud service provider for
storing the data. The operation thus perfectly demonstrates yet another
feature of the big data revolution––an over-reliance on public/private
partnerships. Contracting with the tech sector expands and speeds up existing
trends in the privatization of warfare. But where the corporate sector has been
the primary target of data protection rules, and therefore an early adopter of
data protection language (not least because of the Brussels Effects of
European data protection rules, like the GDPR), the military complex and
intelligence agencies have mostly persisted in their objections to it. 71 Here
lies the danger. By contracting with the military, certain corporate activity
which was up until recently prohibited under evolving data protection norms,
may be shielded under a cloak of national security. The introduction of data
protection rules for the military, through the duty of constant care, could thus
have the positive consequence of nipping this growing reality in the bud.
***
74
Tony Pfaff, Bungee Jumping off the Moral Highground: Ethics of Espionage in the
Modern Age, in 1 ETHICS OF SPYING: A READER FOR THE INTELLIGENCE PROFESSIONAL 66,
68 (Jan Goldman ed., 2006). Elsewhere Pfaff writes: “not only have [intelligence agents] felt
that the deceiving and harming they have done in service to their country have corrupted
their integrity, they feel this corruption is exacerbated by the “cloudy moral purpose” their
agency serves.” (Id.).