Cyberspace makes for a strange battlefield. Attacks are launched from offices, combatants fight with keystrokes, and the targets are usually just information, financial data, and trade secrets. For the vast majority of cyber attacks, that is as big as the threat will be. The biggest exception: cyber attacks that become part of a larger war. When that happens, according to a set of proposed international rules commissioned by NATO and written in conjunction with the International Committee of the Red Cross and the US Cyber Command, even civilian hackers participating in the conflict can be targeted. By bombs and bullets.

That has generated lots of panicky headlines across the web, as you might imagine. The document, called the "Tallinn Manual on the International Law Applicable to Cyber Warfare", was written by 20 legal scholars and practitioners, and represents those experts' best reasoning at how current international law applies to cyber war. It covers everything from how to avoid civilian casualties to who's considered a combatant in a court of law. Here's the part folks are really riled up about:

Civilians are not prohibited from directly participating in cyber operations amounting to hostilities, but forfeit their protection from attacks for such time as they so participate.

That's legalese, and the sentences almost reads better backwards, so here it is in plain talk: Civilians, normally off-limits as targets in war, stop being off limits if they engage in cyber attacks. This rule explicitly carves out an exception to Geneva Convention rules against targeting civilians, noting that civilians engaged in cyber attacks are participating in the conflict, but hardly proper armed combatants. The Tallinn Manual goes on to specify that these civilians enjoy all the other protections of civilians, except the exemption from targeting.

So in cyber warfare, anyone is fair game? This gets worse and worse.