A Single Comment — Permalink
© ICCforum.com, 2010–2024. All rights reserved. Policies | Guidelines
Featured Comments
- Jordan Murphy: The Extent to Which Cyberwarfare May Constitute Crimes Under the Rome Statute and Conditions for Accountability The International Court of Justice held in 1996 that international humanitarian law applies to all means of warfare, including those of the future.1 Such a concept must be applicable to the Rome Statute; if means and methods of war change, so too must the laws regulating them. The regulation of cyber... (more)
- Rory Razi: Cyber Attacks and the Crime of Aggression With rapidly advancing technology comes the disastrous reality of cyber attacks. This comment explores whether cyber attacks can be prosecuted at the International Criminal Court (ICC) as crimes of aggression. Section I discusses the Iran Stuxnet cyber attack. Section II, explores creative interpretation of the Rome Statute, Art. 8 bis, and... (more)
- SimonRuhland: Economic Cyber Crimes and the Rome Statute Summary This comment examines the possibility to prosecute perpetrators of economic cyber attacks under the Rome Statute. It considers economic cyber attack to be cyber attacks on financial institutions, businesses, or individuals with the primary goal of financial enrichment. The comment first assesses the possibility of prosecution under Article 8 and... (more)
- danielkim0610: Defining the Unique Issues Prosecuting Criminal Cyber Defense Actions Under the Rome Statute Presents: A Lost Cause? Cybersecurity has launched itself to the spotlight within both the scope of governmental organizations protecting national security and private industry keeping their own systems intact. Societal dependence on technology has brought with it the magic of efficiency, cost-effectiveness and widespread digital penetration on a scale... (more)
- Pankhuri97: Incorporation of Cyberwarfare in the Rome Statute: A Futile Endeavour Introduction How wars are conducted has evolved throughout history with nations adopting more and more efficient and sophisticated means of causing mass destruction. We are witnessing a transition from traditional weapons such as ammunition to cyber weapons. The Tallinn attack of 2007, the Georgia hack of 2008 and the Stuxnet worm detected in 2010 are already some... (more)
- Jeng2023: Tackling Territoriality: Fitting Cyber Crimes into the Crime of Aggression Introduction Territoriality has always been a key issue in national sovereignty. Wars have been fought over borders of nations, as territorial disagreements are often the precursor to war.1 This has led to conclusions where: “if you want to avoid war, learn how to settle territorial disputes non-violently.”2 However, the uniqueness of cyber activities... (more)
- JohnG: Distinguishing Cyberwarfare in the Law of Armed Conflict I. Introduction The dawn and parabolic expansion of the Internet over the last half-century revolutionized how individuals, businesses, organizations, and states interact with one another. As states and their militaries have become increasingly interconnected and dependent on these technologies, a new realm of warfare has evolved beyond the conventional battlefields of air, land,... (more)
- Smithp2022: Social Media May be Used to Commit Genocide Under the Rome Statute I. Introduction As technology progresses, cyber crime grows as a concern on a national, transnational, and international level. As the International Criminal Court pursues its goals of holding actors accountable for criminal violations of international law in 2022 and beyond, it will have to contend with a world that depends more and more on technology in all... (more)
- mschneer: Accountability for NotPetya: Why the International Criminal Court Can, and Should, Prosecute the Perpetrators of the NotPetya Cyber Attack as a War Crime I. Introduction In June 2017, a popular Ukrainian tax accounting software called M.E.Doc underwent a routine software update. Unbeknownst to the thousands of Ukrainians who use this software, that update served as the entry point for a destructive malware that would soon gain access to... (more)
Comment on the Cyberwarfare Question: “To what extent and under what conditions might cyber operations or cyberwarfare constitute crimes specified in the Rome Statute?”
Incorporation of Cyberwarfare in the Rome Statute: A Futile Endeavour
Introduction
How wars are conducted has evolved throughout history with nations adopting more and more efficient and sophisticated means of causing mass destruction. We are witnessing a transition from traditional weapons such as ammunition to cyber weapons. The Tallinn attack of 2007, the Georgia hack of 2008 and the Stuxnet worm detected in 2010 are already some existing examples of cyber attacks.1 It is predicted that more and more states in future conflicts are likely to make use of their cyber means for warfare as that can bear more significant results at much cheaper costs since production and manufacturing cost of a cyber attack is much more affordable, accessible, and available to most states. However, the inverse also comes at a cost, countries with advanced cyber capacity rely more on cyber technology to operate their infrastructure making them more vulnerable if a cyber attack is launched on them.2
For the purposes of this comment, I think it is also necessary to note the distinction between a cyber crime and a cyber attack. A cyber crime is punishable under the penal code of a nation and involves private perpetrators. It is a computer related and content related offense like fraud or forgery. The aim, however, is not to destroy, degrade or deny information that is residing in the computers or to compromise the computers. Whereas cyber attacks are launched with a focus of not just destroying information but harming connected systems and facilities that are external to a computer or network with the intent and potential to cause mass destruction and human loss.3
In recent years, there have been attempts made to formalize cyber offenses in international criminal law, however, nothing concrete has been formulated thus far in the cyber space realm. Scholars and experts have also made convincing arguments to read cyberwarfare within Article 8 bis (Crime of Aggression) of the Rome Statute. For convenience, I quote Article 8 bis4 below:
On reading of the article above, it becomes very apparent that the attempts to read cyberwarfare within this specific framework is a far reaching ideal and not without its shortcomings. The argument that I would like to make in this comment is that as the Rome Statute stands today, attempts of incorporating and reading cyberwarfare into this limited legal framework is a fanciful idea for various reasons that I would be enumerating below.
The Problem of Accountability
Chain of Command
This discussion is in the context of Article 285 of the Rome Statute with a focus specific to military/superior commanders under whose command cyber attacks are conducted and cause violation of international humanitarian law. Article 28, entitled “Responsibility of commanders and other superiors,” reads as follows:
Article 28 lays down two forms of command responsibility—active and passive i.e., responsibility for ordering crimes and responsibility for failure to punish or prevent crimes committed by subordinates respectively. Article 28 sets a higher threshold with respect to performance of duty of superiors as it criminalises inaction i.e., lack of supervision on part of the commander. The article makes a commander criminally liable for failing to prevent or punish crimes that are committed by his/her subordinates or for actions performed by persons who are under his/her command or authority. Thus, it prompts commanders to stay informed and apprised of the actions of their subordinates. The provision extends to both military and non-military superiors.
Command responsibility is triggered when cyber units are part of a nation’s army and form part of their operations. Outsourcing cyber operations to anonymous hackers can also trigger liability for command responsibility provided one can establish the link between the commander and the anonymous hackers.6 In theory, it sounds rather straightforward but practically, it would be hard to provide proof of such cyber operations and identify the brains and power behind the cyber attack. This is mostly due to the virtual and distributed nature of cyber operations that make it very hard to track down and identify the people responsible for a cyber attack. Jack Goldsmith in his article, How Cyber Changes the Laws of War summarizes the issue on the attribution problem of cyberwarfare very succinctly. He observes:
The Trial Chamber of the International Criminal Court (ICC) in the case of The Prosecutor v. Jean-Pierre Bemba Gombo (Bemba Judgment), held with respect to Article 28 that:
The Appeal Chamber of the ICC overturned this decision of the Trial Chamber and held with respect to the theory of command responsibility that:
This Bemba Judgment by the Appeal Chamber, in my opinion, has left open a floodgate of excuses for commanders to escape criminal culpability by taking advantage of the many vague, discretionary, and subjective factors that have been mentioned by the Court. How do you assess “operational realities” on the ground? or when do the “costs” of measures outweigh the “benefits” or what are the “parameters” to be considered, apart from the mentioned operational realities?
In the context of cyber attacks, the theory of command responsibility in practice is almost never going to secure any convictions because you cannot bestow criminal liability unless you can prove a nexus/link between the commander or his/her subordinates who were under his/her effective control and the offense committed. It is not a form of strict liability and owing to the nature of cyber attacks, it can be very hard to track down the source of the attack let alone the perpetrators behind it, making it almost impossible to establish a definite link and proving criminal liability on part of the commander for failing to anticipate and prevent such attacks.10
Establishing Mental Element
Article 30 of the Rome Statute11 prescribes the required mental element a perpetrator must have in order for him or her to be held criminally liable for crimes mentioned under Article 5 of the Rome Statute.12 Article 30 states:
From a reading of the article above, it can be construed that Article 30 only acknowledges direct intent and not indirect intent. What that means is that the perpetrator should have been aware that in the ordinary course of events, certain consequences “will” occur and not “may” or “could” occur, following his/her conduct. A person can only be convicted of a crime if they accept that they were aware of the risk of a particular consequence occurring following their actions. They need to be absolutely certain or it must be a practical or “virtual certainty” that their conduct would lead to certain consequences. This test of virtual certainty has been adopted from the case of Regina v. Woollin13 wherein the defendant out of frustration threw his three-moth old baby because he wouldn’t stop crying, causing the baby to die. The House of Lords in this case held that the original trial judge had enlarged the element for mens rea required for murder and blurred the lines between intention and recklessness by considering whether the defendant foresaw a “substantial risk”. The House of Lords affirmed the virtual certainty test introduced in the case of Regina v. Nedrick14 since recklessness is not sufficient to convict the defendant for a charge of murder. Thus, the threshold to prove mental element under Article 30 is very high. The ICC cannot hold a person criminally liable in cases where the perpetrator acted recklessly or negligently.
In the context of cyber crimes, this lacuna in Article 30 of not being inclusive of cases of recklessness, negligence and strict or absolute liability is a serious shortcoming. It appears that the issue of including recklessness and negligence was not highly considered because of the notion that such crimes are not severe enough. However, in the light of technological advances, unintended acts can have horrific consequences, necessitating acknowledgment of elements of negligence and recklessness in cyber space.15 The evolution and innovation in cyber technology has happened and continues to happen at a much rapid rate compared to changes that take place in the physical world, making cyber activities much more unpredictable and harder to anticipate. In the near future, there will be an increase in communication and integration between our everyday devices over virtual networks and as beneficial and efficient that may be, it can also prove to be very damaging if there was to be an infiltration via cyber weapons. Due to this inter-communication, the result of a cyber attack could be catastrophic because the intended target owing to its communication with other devices may increase the range of the attack and cause unintended destruction.16
Moreover, with increased reliance on computer systems and online databases for storage of crucial information ranging from loan records to dental records to legal records and-the-like of every individual/citizen of a country makes it even more easier for any hacker or a state to plan cyber attacks and target an entire nation by accessing and misusing these records or by completely erasing them from their system. Additionally, just like corporations, artificial intelligence is also independent and cannot be held criminally liable. The programmer and operators that created that artificial intelligence cannot be blamed for it since they may not have created the AI for purposes of causing damage or destruction, but it did so anyway by misevaluating a situation.17
In all these cases enumerated above, it is very easy for a perpetrator to wiggle out of criminal responsibility and defend themselves by claiming that they did not mean to cause any damage and the consequences that occurred were just incidental and not intended and/or foreseeable. Without inclusion of recklessness or negligence under Article 30 in the Rome Statute, it would be impossible to hold anyone down for charges of cyber attack. Therefore, it is very important that we uphold and ensure a higher standard of conduct in the realm of international criminal law with respect to cyber crimes and adopt a less forgiving approach.18
Limited Jurisdiction
As we know, cyber offenses have not been formally recognised in the Rome Statute and even though there have been efforts to read cyber offenses in Article 8 bis of the Rome Statute, there has been no inclusion of a formal definition that would enable ICC to prosecute and thus, the ICC does not have any official subject-matter jurisdiction over cyber attacks. Moreover, Article 8 bis was incorporated in the Rome Statute pursuant to Kampala Conference in 2010 and since then only thirty-four States have ratified the Kampala Amendments.19 None of which are states that are equipped with advanced cyber technologies or capacities, rendering ICC no jurisdiction if there was an attack on the territory of or an attack by a state that could potentially cause a lot of damage and destruction.
Conclusion
There have been efforts made in the international realm to create some regulations to govern and prevent cyberwarfare. Despite the complexities and fundamental difficulties in defining cyber space and cyberwarfare, experts are optimistic and believe that this domain is not lawless and out of control but honestly, in my opinion, I fail to see the reasons for such optimism. International law in general is heavily based upon contractual or treaty obligations between parties which are not governed or monitored by any stringent policies. There is a lack of enforcement and investigative mechanisms and dependency on monetarily strong countries. If today, a party falters or withdraws its ratification, what recourse is available? The only incentivizing or motivating factors that countries have to keep up compliance with international obligations is to prevent criticism from both inside and outside state organisations and to maintain their international political relations that in turn benefit their national and economic interests. Some may argue that this is reason enough for states to comply with international norms and laws, I still believe it to be a little superficial. More so in the sphere of cyberwarfare and the current legal framework around it, one just cannot ignore the practical difficulties that exist in locating cyber criminals and proving their criminal conduct.20
This is not to say that one should just give up on the idea of formalising a legal framework around cyber conduct. I think we would benefit from a more focused approach towards tackling this new era of cyber space. There have been suggestions to amend the Rome Statute to expand its jurisdiction to cover grave cyber offenses or to create a dedicated international tribunal or an international convention on cyberwarfare that solely deals with issues of cyber technologies and cyber space. An existence of a proper forum that deals exclusively with international cyber crimes and cyber criminals could also prove beneficial in deterring cyber offenses.21
Endnotes — (click the footnote reference number, or ↩ symbol, to return to location in text).
Elies van Sliedregt, Command Responsibility and Cyberattacks, 21 J. Conflict & Security L. 505 (Sep. 22, 2016), paywall, doi. ↩
Adi Libsker-Hazut, Cybercrimes: What Is and What Ought to Be? Rethinking the Role of Recklessness and Negligence in the International Criminal Court, Cyberlaw Blogospace (Jun. 11, 2019), available online. ↩
Sliedregt, supra note 1. ↩
Rome Statute of the International Criminal Court, Adopted by the United Nations Diplomatic Conference of Plenipotentiaries on the Establishment of an International Criminal Court, Jul. 17, 1998, U.N. Doc. A/CONF.183/9, as amended [hereinafter Rome Statute], Art. 8 bis, available online. ↩
Id. Art. 28. ↩
Sliedregt, supra note 1. ↩
Jack Goldsmith, How Cyber Changes the Laws of War, 24 EJIL 129 (Feb. 2013), available online, doi. ↩
The Prosecutor v. Jean-Pierre Bemba Gombo, ICC-01/05-01/08, Judgment pursuant to Article 74 of the Statute (TC III, Mar. 21, 2016), available online, archived. ↩
The Prosecutor v. Jean-Pierre Bemba Gombo, ICC-01/05-01/08 A, Judgment on the appeal of Mr Jean-Pierre Bemba Gombo against Trial Chamber III’s “Judgment pursuant to Article 74 of the Statute” (AC, Jun. 8, 2018), available online, archived. ↩
Sliedregt, supra note 1. ↩
Rome Statute, supra note 4, Art. 30. ↩
Id. Art. 5.
(“Crimes within the jurisdiction of the Court, The jurisdiction of the Court shall be limited to the most serious crimes of concern to the international community as a whole. The Court has jurisdiction in accordance with this Statute with respect to the following crimes: (a) The crime of genocide; (b) Crimes against humanity; (c) War crimes; (d) The crime of aggression.”). ↩
Regina v. Woollin, UKHL 28, 3 WRL 382 (Jul. 22, 1998), available online. ↩
Regina v. Nedrick, EWCA, 1986 WRL 1025 (Jul. 10, 1986), available online. ↩
Libsker-Hazut, supra note 2. ↩
Id. ↩
Id. ↩
Id. ↩
Alexandra Perloff-Giles, Transnational Cyber Offenses: Overcoming Jurisdictional Challenges, 43 Yale J. Int’l L. 191 (2018), available online. ↩
Libsker-Hazut, supra note 2. ↩
Perloff-Giles, supra note 19. ↩