In the modern world, cyber-attacks targeting vital infrastructure like power grids and healthcare facilities are an undeniable reality, overwhelmingly affecting the safety and well-being of citizens worldwide. These attacks have led stakeholders to demand action and guidance from international leaders and organizations in the form of a “Digital Geneva Convention.”[1] However, this Digital Geneva Convention may not be necessary if enforcement and prosecution efforts occur, which is exactly what the International Criminal Court (ICC) intends to do.[2]
Karim Khan, the ICC’s lead prosecutor, recently announced recently that, due to the profound impact of cyber warfare, the ICC is committed to investigating and prosecuting these crimes in accordance with the Rome Statute.[3] The Rome Statute is a multilateral treaty establishing the ICC as a permanent international court.[4] It serves as the foundational legal framework for the ICC, which is designed to prosecute individuals for serious international crimes, such as genocide, crimes against humanity, war crimes, and aggression.[5] The ICC is a court of last resort, stepping in only when national authorities are unwilling or unable to prosecute individuals responsible for the aforementioned crimes.[6] Although the Rome Statute does not specifically mention cybercrimes, Mr. Khan notes that cybercrimes “may potentially fulfill the elements of many core international crimes as already defined.”[7]
Mr. Kahn’s statement represents a substantial step in confronting the consequences of cyberwarfare and guaranteeing accountability in accordance with international law.[8] By prosecuting cybercrimes, the ICC would recognize these offenses as potentially falling under the category of international crimes, expanding the ICC’s current jurisdiction to include a new category of offenses.[9] Furthermore, the ICC’s involvement in cybercrime cases could help clarify and establish international legal norms regarding cyber-related offenses.
It seems that Mr. Kahn’s announcement coming at a time of increasing global attention on cyberattacks by Russia directed at Ukraine is not a coincidence. The announcement itself did not mention Russia; however, it is fair to assume that, upon making this statement, the first case on the ICC’s new agenda could likely involve Russia’s cyberattacks against civilian critical infrastructure in Ukraine,[10] especially as Victor Zhora, the deputy chairman of the State Service of Special Communications and Information Protection of Ukraine, urges officials to bring war crime charges against Russia for its cyberattacks.[11] The ICC may be even further incentivized to prosecute cybercrimes, as it just recently fell victim to a cyberattack that many speculate was perpetrated by Russian hackers in response to ICC judges issuing arrest warrants against Russian President Vladimir Putin for war crimes unrelated to cybercrimes.[12]
With this potential prosecution may come challenges to the ICC’s ability to proceed in a case involving cyber operations. Because the purpose of the ICC is to investigate and prosecute only “the most serious crimes of concern to the international community as a whole,”[13] one major challenge facing the ICC is whether a case regarding cyber operations is sufficiently grave so as to be admissible to the Court, per Article 17(1) of the Rome Statute.[14] Gravity will be assessed based on “the nature, scale and manner of commission of the alleged crimes, and their impact on victims.”[15] Proving that particular cybercrimes meet this gravity threshold will likely prove difficult if the operations do not cause loss of life or serious physical destruction.[16] Another factor limiting the ICC’s authority over cyber operations is the ICC’s ability to attribute activities linked to cyber operations, as identifying the perpetrators of cyber attacks is particularly difficult given that anonymity is one of the main characteristics of cyber operations.[17]
Challenges to ensuring a fair and effective legal process, not to mention possible blowback from the international community regarding sovereignty and the scope of the ICC’s authority, are expected to when investigating and prosecuting cybercrimes. However, Prosecutor Khan emphasized in his announcement that the ICC plans to “forge and enhance partnerships” with states and technology companies holds particular significance.[18] These alliances could significantly contribute to bolstering the ICC’s capability to effectively investigate and prosecute cyber activities, hopefully resulting in justice and, in the words of Mr. Khan, “a more humane world.”[19]
[1] Joseph Guay & Lisa Rudnick, What the Digital Geneva Convention means for the future of humanitarian action, THE UN REFUGEE AGENCY (June 25, 2017), https://www.unhcr.org/innovation/digital-geneva-convention-mean-future-humanitarian-action/#:~:text=In%20February%20this%20year%2C%20Microsoft,from%20state%2Dsponsored%20cyber%20attacks.
[2] Andy Greenberg, The International Criminal Court Will Now Prosecute Cyberwar Crimes, WIRED (Sept. 7, 2023), https://www.wired.com/story/icc-cyberwar-crimes/.
[3] Karim A.A. Khan, Technology Will Not Exceed Our Humanity, DIGITAL FRONT LINES, https://digitalfrontlines.io/2023/08/20/technology-will-not-exceed-our-humanity/ (last visited Sept. 12, 2023).
[4] Rome Statute of the International Criminal Court, art. 1, entered into force July 1, 2002, 2187 U.N.T.S. 90, https://www.icc-cpi.int/sites/default/files/RS-Eng.pdf.
[5] Rome Statute, supra note 4, at art. 5.
[6] Q&A: The International Criminal Court and the United States, HUMAN RIGHTS WATCH (Sept. 2, 2020, 12:00 AM), https://www.hrw.org/news/2020/09/02/qa-international-criminal-court-and-united-states.
[7] Khan, supra note 3.
[8] See Greenberg, supra note 2.
[9] See Khan, supra note 3.
[10] Greenberg, supra note 2.
[11] Jessica Lyons Hardcastle, Ukraine’s Victor Zhora: Russia’s cyber ‘war crimes’ will continue after ground invasion ends, THE REGISTER (Aug. 9, 2023), https://www.theregister.com/2023/08/09/ukraines_victor_zhora_russias_cyber/.
[12] Jessica Lyons Hardcastle, International Criminal Court hit in cyber-attack amid Russia war crimes probe, THE REGISTER (Sept. 20, 2023), https://www.theregister.com/2023/09/20/icc_hack/.
[13] Rome Statute, supra note 4, at art. 5.
[14] Kubo Mačák & Maxime Nijs, Hackers in the Hague? The Prospects of Prosecuting International Cyber Crimes Before the ICC, LAWFARE (Oct. 18, 2023), https://www.lawfaremedia.org/article/hackers-in-the-hague-the-prospects-of-prosecuting-international-cyber-crimes-before-the-international-criminal-court.
[15] Prosecutor v. Al Hassan Ag Abdoul Aziz Ag Mohamed Ag Mahmoud, Case No. ICC-01/12-01/18, Decision on the Admissibility Challenge, ¶ 47 (Sept. 27, 2019), https://www.icc-cpi.int/sites/default/files/CourtRecords/CR2019_06328.PDF.
[16] Milena Sterio & Jennifer Trahan, Cyber Operations As Crimes At The International Criminal Court, LIEBER INST. (Oct. 4, 2023), https://lieber.westpoint.edu/cyber-operations-crimes-icc/.
[17] Mačák, supra note 14.
[18] Khan, supra note 3.
[19] Id.
