Karim Khan, the chief prosecutor of the International Criminal Court (ICC) in the Hague, announced a groundbreaking development: the court will, from now on, address cyber crimes, including cyber warfare crimes. Although the discussion regarding the possible application of the international law of war (the so-called Geneva Conventions) and other legal norms in cyberspace has been ongoing for years, it has largely remained theoretical. However, the chief prosecutor´s statement could bring about significant changes, potentially leading to the prosecution of previously unaccounted-for criminals. What implications might this have for Russia and its cyber campaign directed against Ukraine?
International Law vs. Cyberspace
The nature of international crimes is changing dramatically in the context of rapidly evolving technologies. Cyber attacks go beyond just infecting victims´ devices with malware demanding ransom; they can now lead to the loss of life and substantial material damage. In a brief article for Digital Front Line, prosecutor Khan has announced that such criminal acts will now be a subject of investigation by the ICC, particularly when critical sectors like health care are targeted. Legal proceedings will be anchored in the crimes defined by the Rome Statute, which empowers the Hague Court to initiate criminal proceedings. Khan’s statement can thus be regarded as an important step forward in ensuring justice. Indeed, the contemporary legal system is not always able to cope with activities taking place in cyberspace. As a result, many cybercriminals went unpunished, providing little incentive for these actors to halt their operations. Moreover, a large number of cyber operations receive direct backing from state actors and institutions, who financially incentivise hackers to carry out malicious activities against their adversaries. This dynamic could potentially be reshaped by the ICC´s new approach, holding not only the hackers themselves accountable but also those who give the orders for the attacks. For instance, if a state funds a specific hacking group responsible for a serious cyberattack, the leaders of that country could face legal repercussions. Khan´s determination to investigate cyber crimes is thus an important step toward achieving justice and creating a so-called deterrence effect. If hackers and their orchestrators are punished for their crimes, this fact may deter many from carrying out such activities. However, the exact application of current legal principles to cyber crimes by the ICC remains uncertain at this stage. Only the first case brought before the international court will give us a better idea.
Need for new legal framework
Although many regard this move as a dramatic improvement in cyberspace security, it is in fact, only a first step. Physical and cyberspace are fundamentally different in many ways. As a result, the laws for the physical world do not entirely cover the complexities of the cyber one. This means that in cases of highly impactful hacking activities, perpetrators might not be punished due to the absence of legal definitions in laws governing conventional crimes. Consider, for example, cyber warfare crimes; international law exclusively applies to operations occurring during armed conflicts. Therefore, international law may not be applicable to cyber attacks happening in times of peace. If we were to apply the law of war in peacetime, cyber attacks would need to reach a certain level of severity. This could mean causing injury or death to individuals or inflicting property damage comparable to what we see in conventional armed conflicts. Experts agree that it´s crucial to establish a new international treaty specifically tailored to the cyber realm. It could draw upon existing resources like the Tallinn Manuals created by the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE). However, these manuals are not currently legally binding even for member states of the alliance. Therefore, the initial step could involve the adoption of a treaty covering cyberspace on a global scale.
What does the new commitment mean for Russia?
Following Karim Khan´s official statement regarding the investigation of cyber warfare crimes, the question arises: who will be the first to face charges? Given that this announcement coincided with the ongoing war in Ukraine, suspicions naturally turned towards the Russian Federation. Alongside their conventional aggression, Moscow has launched an aggressive cyber campaign against Ukraine, targeting critical infrastructure. Russian hacking groups like Sandworm are accountable for attacks on civilian targets not only during the ongoing conflict but also for several years leading up to it. One of the more notable cyber attacks occurred at the beginning of the armed conflict, targeting Viasat satellites. This operation left thousands without internet access, affecting Ukraine and the whole of Europe. The Ukrainian government has taken the initiative to investigate Russian cyber crimes. The evidence they gather could be crucial in future proceedings at the ICC. However, the question remains for now: will prosecutors choose to bring criminal charges against Russia? Whether it is Russian cybercrimes or the cyber activities of another entity that become the initial focus of examination, it will mark a significant milestone for international criminal law.