8 rules for “civilian hackers” during war, and 4 obligations for states to restrain them