Introduction
The International Criminal Court (ICC) Forum describes cyberwarfare as “conduct of a cyber operation by military means in order to achieve military objectives.” The forum explains that cyber-attacks, like conventional military attacks, cause damage indirectly through the “alteration or destruction of data.” Furthermore, the far reaching effects of cyber-attacks may be equivalent, if not greater, than some conventional “kinetic” military operations. For example, the “temporary suspension of the use of a military base” or “widespread flooding caused by the deactivation of the regulating system of a dam” would have disastrous effects for thousands of people. However, whether cyberwarfare is a crime that can be prosecuted in the ICC is up for debate.
History of the international criminal court
The ICC, based in the Hague, was established in 2002 via the 1998 Rome Statute (RS). The ICC, according to Article 5 of the RS, has jurisdiction over the four main international crimes, including: genocide, war crimes, crimes against humanity, and crimes of aggression. The RS states that only “the most serious crimes of concern to the international community as a whole” have jurisdiction within the ICC. Cyber activities are not currently recognized as international crimes, but those that occur within armed conflict as a form of warfare may rise to the attention of the ICC.
What’s new
Karmin A. A. Khan KC, ICC Office of the Prosecutor (OTP), recently announced his intention to establish cyberwarfare as a crime that could be prosecuted within the ICC, using existing provisions within the RS. While cyberwarfare is not explicitly written into the RS, many of the RS provisions were written broadly without reference to the means used to accomplish the goal of the rule. For example, international humanitarian law (IHL) criminalizes “direct attacks against civilian objects,” but does not specify what method must be used to accomplish this. Therefore, the statute provides room for multiple means beyond conventional kinetic warfare, such as “cyber weapons and their associated systems.”
Why consider whether cyberwarfare could be prosecuted before the ICC?
The OTP states broadly that the ICC must be able to adapt to the changing times and methods of warfare in today’s landscape. Moreover, he argues that the ICC must be able to protect those on the “front lines, and those front lines are no longer just physical.” He explains that cyber-attacks on medical facilities and control systems for power would result in a profound impact for many, not just small groups. The International Committee of the Red Cross (ICRC) argues that cyber-attacks are a humanitarian concern, particularly because society is relying on technology to support humanitarian programs. The ICC’s cause is “the cause of all humanity” so the ICRC argues that cyber-attacks should be within the ICC’s purview. The ICRC further states that it is estimated that more than 100 States have or are developing military cyber capacities, which emphasizes the potential threat cyber-attacks may pose to humanity.
Beyond just enhancing the ICC’s ability to prosecute cyberwarfare, an article from the Lieber Institute analyzes that if the ICC were to start prosecuting cyberwarfare, it would help establish a future accountability mechanism for countries that do not have jurisdiction within the ICC, like Ukraine. The institute argues that the Russian war on Ukraine is an obvious modern-day example of a war of aggression comprised with cyberwarfare elements. Therefore, not only is there a growing need for cyberwarfare to be criminalized within the ICC to enhance protection from virtual attacks, but also to aid other jurisdictions in applying accountability structures.
Current legal authority and hurdles to prosecute cyberwarfare within the ICC
RS Article 17 details the rules of admissibility to the ICC. This article states that a case is inadmissible if it is not of “sufficient gravity to justify further action by the Court.” An application of the interpretation of “gravity” can be seen in the Abu Garda case, where the ICC held that “the issues of the nature, manner, and impact of the [alleged] attack are critical,” and that quantity and quality should be taken into account. Therefore, before a cyber-attack can be prosecuted before the ICC, the legal determination of whether cyber threats contain sufficient gravity as required by the RS must be considered.
Support and opposition
Those in favor of establishing cyberwarfare argue that the effects of cyber used in armed conflict situations, combined with traditional means of conflict, can reach the gravity requirement set forth by RS Article 17. Furthermore, proponents argue that cyber threats require “whole-of-society” responses. OTP urges that the prosecution of cyberwarfare through the ICC may be able to “deter offenders,” mitigate ambiguity by enforcing relevant law, and set an example for states to prosecute cyberwarfare under their own laws.
Those opposed to establishing cyber as an international crime argue that many cyber threats have historically not met the gravity threshold the RS requires. They argue that “kinetic warfare (such as bombs and missiles) is incomparably greater than what cyber capabilities may have caused thus far.” They caution their belief with the statement they do not think it is impossible for a cybercrime to reach the gravity needed to pass the requirements of the RS, but it is unlikely to happen soon.
Conclusion
International law has historically focused on traditional means of warfare, including physical and military attacks. However, the current atmosphere of today’s wars and military operations make it clear that international law, and the bodies that administrate it like the ICC, need to start shifting their focus to a virtual world of human rights violations, including cyberwarfare. A good start, as the OTP argues, is learning to apply existing statutory structures to the issues of cyber-attacks throughout the RS by using an effects-based approach.
Sources:
About the Court, INTERNATIONAL CRIMINAL COURT
Cyber Warfare: does International Humanitarian Law apply?, INT’L COMM. OF THE RED CROSS (Feb. 15, 2021).
Kai Ambros, Cyber-Attacks as International Crimes under the Rome Statute of the International Criminal Court?, ICCFORUM, (Mar. 7, 2022).
Karmin A. A. Khan KC, Technology Will Not Exceed Our Humanity, DIGITAL FRONT LINES (Fall 2023).
Kenneth Chann Yoon Onn, The Prosecutor’s New Policy on ‘Cyber Operations’ before the International Criminal Court (and its Implications for Ukraine): Some Preliminary Reflections, EJIL: TALK! BLOG (Sept. 15, 2023).
Kubo MaCak & Maxime Nijs, Hackers in the Hague? The Prospects of Prosecuting International Cyber Crimes Before the ICC, LAWFARE (Oct. 18, 2023, 10:34 AM).
Milena Sterio & Jennifer Trahan, Cyber Operations as Crimes at the International Criminal Court, LIBER INSTITUTE: ARTICLES OF WAR (Oct. 4, 2023).
Rome Statute of the International Criminal Court art. 17, July 17, 1998, 2187 U.N.T.S. 38544.