Estimated reading time: 12 minutes
A belligerent can train or run a military AI model on compute in a State outside the conflict. That compute sits in neutral territory. By AI compute I mean processing capacity in a data centre, owned or rented. Training builds a model from data. Running it, often called inference, produces its outputs.
Klonowska and Schmitt mention reports that Israel’s armed forces used Azure cloud infrastructure in the Netherlands. The law of neutrality applies only in an international armed conflict, and this post takes no view on how that conflict is classified. The analysis below works with hypotheticals. This post states the law. It does not assess any ongoing operation or the conduct of any State.
Take four actors. State A and State B are belligerents in an international armed conflict. State N takes no part in it and is neutral. Provider P runs a data centre in State N. State A uses it to train or run a military model.
The law of neutrality applies only once a conflict reaches a certain duration or intensity (ZDv A-2141/1, para. 1202; translations mine). And Hague Convention V of 1907 binds only if every belligerent is a party (Article 20). I therefore treat its rules as custom, as Tallinn Manual 2.0 does (Rules 150–152).
Three questions follow. Does Article 8 of Hague V cover State A’s use of AI compute in State N? Is State A using State N as a base of operations? And what follows for State N and State B?
I. Relay, Not Generation: The Limit of Article 8
The basic rules, and where Article 8 fits
The law of neutrality rests on a bargain. A neutral State’s territory is inviolable (Article 1 Hague V). In return, belligerents may not use that territory for the war, and the neutral State must not let them. Hague Convention V, the treaty on neutrality in land war, spells out the core. Belligerents may not move troops or convoys of munitions or supplies across neutral territory (Article 2). They may not set up communications stations there (Article 3), or form fighting units or open recruiting offices (Article 4). The neutral State must not allow any of these acts on its territory (Article 5).
Some things the neutral State need not stop. It need not prevent the export or transport of arms, or of anything else useful to an army (Article 7). Nor need it forbid or restrict belligerents’ use of telegraph or telephone cables or wireless telegraphy apparatus, whoever owns them (Article 8). Any restriction it chooses must apply to both sides alike (Article 9).
Article 8 matters here because State A’s queries and P’s answers travel over networks. These are the modern counterpart of the cables of 1907. If the whole process counted as communication, State N would not need to act at all. The question is how far the exemption reaches.
On the prevailing reading, the exemption covers transmission and nothing more. Wolff Heintschel von Heinegg stresses that “Article 8 only applies to communications” (at p. 40). State positions keep that line.
The US Department of Defense’s Law of War Manual (DoD Manual) treats relaying information over neutral infrastructure as generally lawful. The facilities must be open to both sides alike. The Manual explains that screening public lines for belligerent traffic was seen as impractical (§ 16.4.1). Under Costa Rica’s position, a neutral State need not stop belligerents using its networks “solely for communication purposes” (para. 65). Most Tallinn Manual experts apply Article 8 to cyber communications and treat it as custom (Rule 151, para. 4).
As I see it, stretching Article 8 from cables to computation would assume that a 1907 rule fits very different facts. The DoD Manual warns against exactly that assumption (§ 15.1.4).
Where generation begins
In my view, running a hosted model splits into two parts. State A’s inputs travel to State N and the outputs travel back. That is relay. The output itself is produced on Provider P’s compute inside State N. That is generation, and Article 8 does not reach it.
The distinction is older than AI. In its 1999 assessment of information operations, the DoD’s General Counsel saw a limited exception in Hague V (76 International Law Studies 459, at p. 473). It covered communications relay systems. But nothing in the Convention, it said, suggests that the exception applies to “systems that generate information, rather than merely relay communications”.
The General Counsel had other systems in mind: satellite imagery, weather data and navigation provided from a neutral nation. It did not consider a belligerent’s own model on neutral hardware. Applying its line to AI compute is my inference.
The obvious objection is that the whole process is one transmission with a calculation in the middle. State A sends a query and receives an answer, much like a telegram. However, the analogy breaks at the decisive point. A telegraph line delivers a message composed elsewhere. P’s compute produces the answer in State N. None of the sources discussed here extends Article 8 to that step.
Nor is it an export
Nor does this use of compute fit the rules on trade. Article 7, as seen, spares the neutral State from stopping exports. Discussing what a neutral State may supply, Nicholas Tsagourias treats services as in principle outside war material. The practitioner reading is that Article 7 and that view both concern things that leave neutral territory. Here only inputs and outputs cross the border. The processing stays in State N. Export controls are a separate matter, left aside here.
II. A Base of Operations: Own and Rented Compute
Belligerent rights and bases of operations
If Article 8 does not apply, is State A using State N for the war in another way? Hague V answers only part of this. Article 3 bars belligerents from erecting communications apparatus on neutral territory. It also bars them from using such installations, set up before the war, for purely military purposes. Article 3 thus reaches installations the belligerent itself established. Renting capacity in P’s existing data centre falls outside its wording. The DoD Manual confirms that neutral States need not bar belligerents from privately owned communications facilities (§ 15.5.3.1).
Customary law fills the gap with two concepts, which von Heinegg lists as separate prohibitions (at p. 38). The first is the exercise of belligerent rights. These are the measures that the law of armed conflict lets a belligerent take against the enemy or others. They go beyond attacks; von Heinegg names capture and interception as examples (at p. 39, n. 30). Tallinn Manual 2.0 carries the prohibition into cyberspace. Its Rule 151 forbids belligerents to exercise such rights by cyber means on neutral territory. A belligerent’s armed forces may thus not conduct cyber operations from there, even by taking remote control of neutral infrastructure (para. 1). The second concept is the base of operations. A belligerent may not operate against its enemy from a base on neutral soil. The neutral State must prevent this (DoD Manual, § 15.5).
In my opinion, the two concepts fit AI compute differently. Running a model that feeds State A’s operations helps State A. It is not a measure taken against the enemy. It fits the base concept better. The belligerent-rights concept comes into play where P’s servers carry out an operation itself. If State A ran a cyber operation against State B from P’s servers, Rule 151 would forbid it directly. Either way, customary law gives the neutral State a clear task: it must not let its territory become a base. Section III asks what that requires.
Own compute: the sources converge
Where State A owns or controls the compute, the sources converge. State A may not use it in State N for military purposes, and State N may not allow it. Tallinn Manual 2.0 counts computing devices as cyber infrastructure (Glossary, at p. 564). A neutral State may not let a party use the party’s own existing cyber infrastructure there for military purposes (Rule 152, para. 2). Nor may the party build new infrastructure for those purposes. The experts reach this by adapting the purpose of Hague V.
Von Heinegg reaches the same result through Article 3, read beyond its telegraph wording (at pp. 39–40). The DoD Manual brings a belligerent’s own communications facilities on neutral soil under the base rule (§ 16.4.1). German doctrine bars a neutral State from permitting the establishment of military bases or telecommunications facilities for a party (ZDv, paras. 1207, 1212). Von Heinegg also drafted text for the Tallinn Manual (at p. xii). The convergence therefore rests chiefly on the experts as a group and on the US and German manuals.
Rented compute: the sources diverge
The harder case is State A renting compute from Provider P. Here the expert group and the States divide.
Tallinn Manual 2.0 takes the narrow view. For infrastructure the party does not own, the neutral State’s duty covers only belligerent rights exercised through it (Rule 152, para. 3). In the words of the rule, a neutral State “may not knowingly allow the exercise of belligerent rights” (Rule 152). Private providers fall outside the rule unless their acts can be attributed to a party (Rule 151, para. 2). That limits who can breach the rule. It does not take State A’s own use outside it (Rule 151, para. 1).
The States read the rule more widely. The DoD Manual allows commercial dealings with neutral companies. But supplying goods or services “must not convert neutral territory into a base of operations” (§ 15.3.2.1). That prohibition extends to equipping hostile expeditions, including with services (§ 15.5). Costa Rica draws no line by ownership. It bars a neutral State from knowingly tolerating hostile use of any cyber infrastructure on its territory (para. 65).
My reading
My conclusion is that, on the DoD reading, renting compute can make State N a base of operations. The case is clearest where State A runs its own military system on P’s compute. It is weaker where State A uses a model that P hosts, which comes closer to buying a service. On the Tallinn reading, either case engages Rule 152 only if it is an exercise of belligerent rights. As shown above, ordinary use of a model will rarely be one. Neither source addresses compute expressly. The sources reviewed here give one answer for owned compute and two defensible answers for rented compute.
III. What the Neutral State Must Do
The duty and its source
Knowledge, and terminate versus prevent
In my assessment, a neutral State need only terminate violations of its neutrality through cyber infrastructure on its territory, including AI compute. It need not prevent them in advance. Von Heinegg rejects a general duty of prevention (at p. 44). Most Tallinn experts require only termination (Rule 152, para. 7). Constantine Antonopoulos agrees (at p. 214). In his view, a duty to prevent would breach the neutral State’s own duty of abstention. The DoD Manual, by contrast, states a general obligation to prevent violations (§ 15.3.2.2). For cyber infrastructure, my view departs from it.
Termination turns on what State N knows and what it can do. Von Heinegg and the Tallinn experts require knowledge, actual or constructive (von Heinegg, at pp. 43–44; Tallinn, Rule 152, para. 5). Actual knowledge exists where State N’s organs detect the activity or State B credibly informs it. Constructive knowledge exists where State N should reasonably have known. The Tallinn experts split on whether this implies a duty to monitor; most found none.
Hosted inference: a continuing use
Von Heinegg noted that cyber attacks are usually over before the neutral State learns of them (at p. 43). Hosted inference is different. State A uses P’s compute for as long as it needs the outputs. State N can therefore learn of the use while it continues. The practitioner reading is that the speed objection carries little weight for a continuing use.
Training to order: trade, not fitting out
Suppose P trains a model for State A, which takes it home. Article 8 of Hague XIII concerns vessels meant for hostile operations. A neutral government must employ its available means to prevent their fitting out on its soil, or their departure once adapted there. Nicholas Tsagourias applies this logic to cyber war material made to a belligerent’s specific order. His source, Antonopoulos, is more sceptical. Following Oppenheim, he finds the line between such an order and a purchase artificial (at p. 97). In my opinion, he is right. Stretching a 1907 rule on warships to model training would repeat the mistake Section I warned against. I therefore conclude that training to order is a commercial transaction and, like a purchase, falls outside State N’s duty of due diligence. This view departs from Tsagourias, and from von Heinegg’s tentative example of a cyber weapon developed for a belligerent (at p. 44).
IV. Neutrality First, Targeting Second
Suppose State N does nothing. As I see it, State B then faces two questions in a fixed order. May it act on State N’s territory at all? And only then: is P’s data centre a military objective?
For the first question, the sources share one trigger: State N is unwilling or unable to end the violation. They differ on the basis. The DoD Manual ties the response to the jus ad bellum rules on self-defence (§ 15.4.2). The Tallinn experts treat it as self-help. They require a serious violation, an immediate threat and prior notice, save in emergencies (Rule 153, paras. 3–5). Von Heinegg calls it a specific form of countermeasure that also requires notice first (at p. 45).
Tallinn Manual 2.0 marks the two routes by location. On neutral territory, neutral infrastructure can lose its protection through the self-help rule. Outside neutral territory, it may be attacked if it is a military objective (Rule 150, para. 5). Whether a data centre is a military objective is analysed by Klonowska and Schmitt and is not pursued here.
Conclusion
The law of neutrality answers more of the compute question than the debate suggests. Article 8 covers the queries and answers crossing State N’s border, not the step that produces the answer there. Own compute in neutral territory is off limits on every reading. Rented compute divides the sources: the States read the base rule broadly, the Tallinn experts narrowly. State N must take feasible steps to end a continuing use it knows of. On my reading, training to order is trade and does not trigger State N’s duty of due diligence. Before striking a neutral data centre, State B must meet the conditions for acting on neutral soil.