Cohen, Lisa M.

Rubner, Lorenz

English

<intR>²Dok

How Pressing ‘ENTER’ Gets You to TheHagueLisa M. Cohen, Lorenz Rubner 2022-03-02T08:00:03The offensive use of cyber capabilities is well documented. Most recently, theRussian invasion into Ukraine has been preceded and accompanied by multiplecyber operations both from State actors and civilian collectives. The employment ofoffensive cyber capabilities as part of international armed conflicts has now becomean evident reality – and it raises the question: Can the execution of cyber operationstrigger international individual criminal responsibility under Art. 8(2) of the RomeStatute (‘RS’) of the International Criminal Court (‘ICC’)? The short answer is yes.While the inclusion of cyber-specific war crimes within the RS has received little tono traction (see here), Rule 84 of the Tallinn Manual 2.0 plainly states that “cyberoperations may amount to war crimes”. In November 2021, the Council of Adviserson the Application of the Rome Statute to Cyberwarfare (‘Council’), a group ofinternational legal and technical experts, examined the details of how the RS’s corecrimes can be applied to cyberwarfare but only briefly linked cyber operations tospecific crimes under Art. 8(2) RS.This post aims to provide an overview of how different categories of cyber operationsmay fall within the RS’s framework for war crimes. To this end, it will distinguishbetween cyber operations with direct or indirect injurious or damaging effects (alsodubbed kinetic cyber or cyber-physical operations), and those operations which donot entail any such physical effect. For the purpose of this analysis, we assumethat an international armed conflict exists, attribution is possible, and the cyberoperations are not targeted at military objectives.Pulling the Virtual Trigger: Injury or Damage as Primary EffectsAccording to the Tallinn Manual 2.0, direct effects are the “immediate, first orderconsequences […], unaltered by intervening events or mechanisms” (p. 472).Imagine, for example, a malware causing a pacemaker to halt its functioning,foreseeably leading to the person’s immediate death; or consider State A attacking auranium enrichment facility in the enemy’s territory with malware “forc[ing] a changein the centrifuge’s rotor speed [and] inducing excessive vibrations or distortions thatwould destroy the centrifuge” (cf. Stuxnet) or causing a severe explosion.It is important to highlight that the physical effects a cyber activity can produce willnever be as immediate as with conventional weapons. Cyber operations’ primaryeffects will first and foremost be a change in or overwhelming of the target system(software). This, however, must not obscure the fact that – much like the pulling of atrigger initially merely releases the firing pin, which in turn initiates the next chain ofphysical (injurious or damaging) reactions – a cyber weapon’s immediate effects arenot the end of a causal reaction that is as foreseeable and intended as the entry of a- 1 -bullet into the envisaged target. Consequently, those physical injurious or damagingeffects should be considered the cyber operation’s direct effect.Due to the apparent similarities, such cyber operations should be treated nodifferently than traditional kinetic attacks when considering the application of theRS. This applies in particular to the term “attack” which is frequently used in Art.8(2) RS and serves as the entry point for the application of many core internationalhumanitarian law (IHL) principles protected by the RS (p. 37 ff. of the Report). Art.49(1) Additional Protocol I to the Geneva Conventions (API) defines an attack as“acts of violence against the adversary, whether in offense or defense”. It is wellsettled in IHL that attacks are not “limited to activities that release kinetic force” (p.415) but rather also include non-violent acts (e.g., pressing “ENTER”) with violenteffects. The described cyber operations would therefore be war crimes of willfulkilling (Art. 8(2)(a)(i) RS) or attacks against civilian objects (Art. 8(2)(b)(ii) RS). Asisolated incidents, however, both operations will likely not cross the gravity thresholdunder Art. 17(d) RS. ICC investigations would only be admissible with particularlysevere consequences or combined with other cyber or traditional military operations.Further Down the Chain of Causality: Injury or Damage as Secondary EffectsThe Tallinn Manual holds that indirect effects of a cyberattack include “the delayedand/or displaced […] higher-order consequences […] created through intermediateevents or mechanism” (p. 472). Consider the following cases: State A employs amalware targeted at a water treatment facility in the enemy’s territory, changing thechemical composition in such a way that the water becomes toxic (cf. the incidentin Florida), or one which halts the functioning of an enemy cities’ only natural gaspipeline with the intent of depriving the population of fuel. The civilian populationloses its only source of power, thereby foreseeably resulting in death due to harshwinter conditions (cf. the Colonial Pipeline hack).The primary physical effects – the poisoning of the water and blocking of gas – canequally be achieved by non-cyber means. As such, those cyber operations shouldbe treated identically to their kinetic counterparts. Even if the possible secondaryphysical effects – death of civilians – were not to materialize, such cyber operationscan constitute war crimes by virtue of their primary effects alone, cf. “employingpoison” (Art. 8(2)(b)(xvii) RS) and “depriving civilians of objects indispensable to theirsurvival” (Art. 8(2)(b)(xxv) RS). Rendering a gas pipeline useless may also in itselfbe an act of destruction or extensive damage of property (e.g., Art. 8(2)(a)(iv), (b)(xiii) RS). While the drafters of the Geneva Conventions and the RS clearly had morepermanent and physical destruction in mind (para. 3120), the ordinary meaning maybe construed to include the non-permanent loss of functionality (cf. pp. 417 f.).Focusing on the secondary physical effects in the abovementioned examples,death of civilians, these too may clearly constitute war crimes as long as the cyberoperation is a “substantial cause of the death of the victim” (para. 296). The ICChas not elaborated much further on the element of causation but generally seems toapply a simple but/for test (i.e., conditio sine qua non), which allows for significantfreedom to consider a range of actions as causation, including cyberattacks.- 2 -Intangible but Not Inconsequential: Non-Physical EffectsCyber operations causing (only) non-physical effects will likely be most problematicwhen it comes to the question of whether they can amount to war crimes. Considerthe following example: State A targets the enemy state’s largest transportationcompany with ransomware, encrypting most of its operating data and resultingin prolonged business interruption and immense financial losses (cf. the Maerskincident caused by NotPetya). Imagine, as a second example, State A gainingaccess to the network of a large corporation based within the enemy’s territory,copying business secrets and confidential employee data and publicizing partsthereof and using other parts for coercion (cf. Sony Pictures). Both these examplesbear consequences that are by no means confined to the cyber world. However,as opposed to the examples with (in)direct physical effects pictured above, cyberoperations categorized as non-physical do not carry injury or destruction as primaryor secondary effects.According to Germany’s cyber position paper, “[t]he occurrence of physical damage,injury or death to persons or damage or destruction to objects comparable to effectsof conventional weapons is not required for an attack in the sense of art. 49 para.1 [API]”, a view shared by the Council. Their Report, however, highlights that Art.49(1) API establishes “violence” as the essential criteria to differentiate attacks fromother military operations. “Cyber operations that are by their nature non-violent,such as espionage or psychological operations, cannot be considered attacks” (p.38). While the Report regards “disrupting or halting the functions of a State’s criticalinfrastructure or jamming military capabilities” (p. 38) to be a violent attack, even ifthere is no physical destruction, it is much more questionable whether the disruptionof a private company or the publication of data can be considered “violent”. The“mere intrusion into foreign networks and the copying of data” is specifically excludedfrom attacks by the German analysis (p. 8).While the definition of “attack” is highly relevant to many war crimes (see above), themost disputed issue of non-physical cyber operations lies outside of this element:Can data be construed as objects? While the Tallinn Manual 2.0 rejected this view(Rule 100), the Report now explicitly diverged from this analysis (p. 39), furtheradding to a contested debate (see e.g., here, here, and here). This dispute extendsto the definition of property under Art. 8(2)(a)(iv), (b)(xiii), and (e)(xii) RS.Returning to the examples on cyber operations with non-physical effects, theencryption of data may constitute a war crime if it also disables critical infrastructure.Under an extensive interpretation of the RS, the encryption of a private company’sdata leading (only) to financial losses may also be a war crime if data is consideredan object. In this case, the targeting of civilian data must either be considered anattack, i.e., an act of violence or be handled in such a way as to be considereddestruction, appropriation, or seizure of property. This aligns with the view of theCouncil, which advocated for the alteration or deletion of civilian medical datato be considered a war crime (p. 47). The copying of data and the mere (threatof) publication for coercion, however, will likely not fall under the RS unless it isconsidered a “violent” attack.- 3 -Cyber War Crimes: New Norms Needed?But should such cyber operations be considered war crimes? The public debate isoften quick to claim accountability gaps. But a cautious approach to the demand foran amendment to the RS is warranted. Clearly, unauthorized access to personaldata violates the right to privacy. As such, military operations targeting private datavictimize civilians during hostilities and thus infringe one of the core objectives ofIHL.Nonetheless, operations to access, copy, or even publish private data will alwaysremain significantly below the threshold of “acts or threats of violence the primarypurpose of which is to spread terror among the civilian population” (Art. 51(2) API).Whether the non-violent and non-destructive access to data would really be a “mostserious crime of international concern” (Art. 1 RS) is highly questionable. So far,espionage of civilians, as infringing on human rights as it may be, has equally notbeen considered a war crime (Rule 107). Such acts seem generally better governedby transnational criminal law (e.g., Art. 2 Budapest Convention). A combination ofextensive interpretation of the RS, general international law, and national criminallaw seems sufficient to govern currently conceivable cyber operations. Ultimately,hackers are not free from international criminal accountability and death anddestruction of civilian objectives brought about by pressing ‘ENTER’ can certainly getyou to The Hague. The “Bofaxe” series appears as part of a collaboration between the IFHV andVölkerrechtsblog.- 4 -

How Pressing ‘ENTER’ Gets You to The Hague

https://intr2dok.vifa-recht.de/servlets/MCRFileNodeServlet/mir_derivate_00011852/How_Pressing_ENTER_Gets_You_to_The_Hague.pdf

How Pressing ‘ENTER’ Gets You to The Hague

Abstract

Similar works

Full text

Available Versions

<intR>²Dok