The Digital Emblem – Signaling Legal Protection in Cyberspace
Conflict increasingly takes place online. And also aid providers, hospitals, and humanitarian organizations increasingly rely on digital infrastructure like servers and networks. In the physical world, the emblems of the Red Cross, Red Crescent, and Red Crystal identify protected sites such as hospitals, but no equivalent signal exists in cyberspace. The Digital Emblem project is building that missing signal: a machine-readable marker identifying digital infrastructure as protected under International Humanitarian Law.
The Digital Emblem is a protocol with an unusual threat model. Most security systems are built for the people you want to let in. The Digital Emblem is built for the people you want to keep out. Its most important users are those who want to attack digital infrastructure. The Digital Emblem project’s success hinges on whether attackers are willing to take the new signal into account. The Digital Emblem cannot put offensive operations at risk, and it must be verifiable and trustworthy.
Initiated by the International Committee of the Red Cross (ICRC) in 2020, the project has progressed far. In 2024, all states party to the Geneva Conventions adopted a resolution strengthening the ICRC’s mandate to develop the Emblem. In 2025, standardization work began at the IETF and ITU in parallel. The same year, a Digital Emblem prototype developed at ETH Zurich was first tested with NATO in a military exercise.
This talk covers where the project stands, the requirements a Digital Emblem must meet, the adversarial constraints that shaped them, and how both led to ADEM, the prototype for a Digital Emblem currently being tested.
AI Summary
Video chapters
0:00Origins of the protective emblems2:50Cyber conflict and the ADEM project5:10Why cyber operators might respect emblems8:10Requirements for emblem issuers10:01Requirements for validators13:26Signed emblems distributed via DNS16:10Public key commitments via Certificate Transparency18:34Design philosophy and further emblems22:14Questions and answers
Key facts
- ADEM was featured in a 2022 ICRC report as one of the potential solutions for a digital emblem and is now the ICRC's official prototype.
- Standardization of ADEM is under way at the Internet Engineering Task Force (IETF) and the International Telecommunication Union (ITU).
- In 2025, ADEM was tested with the Australian, British, Belgian and Bolivian Red Cross societies and in a NATO military exercise at the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE).
- At the end of 2024, a conference of all parties to the Geneva Conventions encouraged the ICRC by consensus to continue developing the digital emblem.
Ideas
- Validating an emblem must be undetectable; otherwise an infrastructure owner could treat emblem queries as an intrusion detection system or honeypot and retaliate against the cyber operator asking.
- Trust is decentralized so that no global root trust store is needed: emblem issuers and authorizing states identify themselves by domain names and commit to their signing keys through specially formatted Web Public Key Infrastructure (PKI) certificates logged in Certificate Transparency.
- Issuers keep full control and can remove an emblem whenever they judge that it makes them a target rather than protecting them. For the same reason, the design deliberately avoids anything resembling a central emblem registry.
- Technology cannot decide whether an asset legally deserves protection, so the design focuses on making misuse attributable: issuers and the authorities that endorsed them cannot deny having issued an emblem.
- Reusing existing technology (e.g. the Domain Name System (DNS) and Certificate Transparency) and placing emblems where attackers already look keeps adoption simple and cheap.
Keywords
- digital emblem
- ADEM
- international humanitarian law
- ICRC
- certificate transparency
- DNS-based signaling
- DNS
Quotes
- “The sign just like a stop sign cannot make your car stop, a sign of protection cannot stop a cyber attack. So to be effective, it requires a specific respect.”
- “Emblem issuers could misuse the system as a honeypot and an intrusion detection system. We must avoid this and thus the digital emblem must be undetectable.”
- “If you put it out, you cannot stop people from logging where they saw it.”
Recommendations
- Organizations that issue emblems should monitor Certificate Transparency logs for certificates linked to their domain names, so that they can detect impersonation and have fraudulent certificates revoked.
- Before deploying an emblem, issuers should assess for themselves whether it protects their assets or makes them a target, and remove it if the risk outweighs the benefit.
- Practitioners are invited to try the web-based verifier and to give feedback on the open-source designs and standards proposals.
Resources
- An Authentic Digital, Distinctive EMblem (ADEM) - Message Format and Authorization Model — Standard — The core technical specification for issuing and validating digital emblems.
- An Authentic Digital, Distinctive EMblem (ADEM) - Distribution and Discovery over the DNS — Standard — Explains the DNS integration that makes emblem validation undetectable.
- adem-wg/adem-proto — GitHub Repository — Libraries and command-line tools for experimenting with digital emblems.
About the speaker
Felix Linker
Read more …