Cyber Attack War Crimes and Ntaganda
Editor’s note: This post is based on a portion of the author’s work, “Addressing Unlawful Cyber Operations in Armed Conflict Through Human Rights Bodies Instead of the International Criminal Court,” published at 57 Vanderbilt Journal of Transnational Law 359 (2024).
In response to Russia’s large-scale use of offensive cyber operations—such as those conducted against the KA-SAT satellite network and Ukraine’s power grid—in the Russo-Ukrainian War, Ukraine and some observers have called for the International Criminal Court (ICC) to prosecute potential war crimes committed via cyber operations. And indeed, the ICC has announced that it is examining how acts of “cyber warfare” may violate the Rome Statute. It is also developing a policy on cyber-enabled crimes, expected to launch this year.
Because many of the Rome Statute’s core war crimes—codified in Article 8 of the Statute—are prohibitions on certain unlawful “attacks” (such as attacks directed against civilians or civilian objects and attacks causing harm to civilians or civilian objects that is “clearly excessive” in relation to the anticipated military advantage of the attack), some commentators have pushed to expand the traditional meaning of “attack” to facilitate the prosecution of more cyber operations.
However, the ICC’s previous interpretation of “attack” in its 2021 appellate judgment in the Ntaganda case indicates that a Prosecutor who charges a cyber operation as an unlawful “attack” has a low chance of securing a conviction because the vast majority of cyber operations do not meet the definition of “attack” reflected in Article 8 of the Rome Statute. The following analysis first summarizes the current, unsettled debate over what kinds of cyber operations constitute an “attack” under international humanitarian law (IHL) broadly. It then explains why the Ntaganda case demonstrates that the universe of cyber operations that may be prosecuted as unlawful “attacks” is quite limited.
Competing Stances on “Attack” Under IHL
The ICC’s Elements of Crimes (article 8) directs the court to adjudicate war crimes according to the “established framework” of IHL (the law that governs the conduct of hostilities during an armed conflict). However, the extent to which cyber operations may constitute war crimes under the Rome Statute is unclear. And the question of which kinds of cyber operations qualify as “attacks” for purposes of Article 8 of the Rome Statute remains unanswered.
Neither the Rome Statute nor the Elements of Crimes defines “attack” for purposes of Article 8 (p. 37–38). Furthermore, most cyber “attacks” defy traditional classification. Customary international law is also not dispositive. The first Protocol Additional to the Geneva Conventions of 12 August 1949, and relating to the Protection of Victims of International Armed Conflicts 1977 (AP I) defines “attacks” as “acts of violence against the adversary.” An International Committee of the Red Cross (ICRC) commentary to AP I notes that, as used in customary international law, “attack” is a term of art that means “combat action.” The text of the Rome Statute reflects this narrow character of the word “attack”; across Article 8, it distinguishes between “attack” and “destruction,” suggesting that the two are not synonymous (p. 78).
There are two main approaches to determining whether a cyber operation is an “attack” for the purposes of IHL. The first approach is “instrument-based.” It asks whether the damage caused by the cyber operation could “previously have been achieved only by a kinetic attack.” The second, the “effects-based” approach, evaluates the overall impact on the targeted State and raises a second question: can an operation that does not produce physical effects similar to those of a kinetic weapon be an “attack”? States and scholars have taken disparate positions on this question.
Cyber Operations that Cause Physical Effects
The scholarly consensus (see Ambos, § II) is that an “effects-based approach” applies to determine whether a cyber operation amounts to an attack. Under the effects-based approach, a cyber operation constitutes an attack when it causes tangible damage, death, or destruction. Many States (e.g., Australia, Denmark (¶ 4.4), Israel, New Zealand (¶ 10.18.7), Norway (¶ 9.54), the United Kingdom, and the United States (¶ 16.5)) and the influential Tallinn Manual 2.0 adopt the effects-based approach.
As my longer work explains (p. 378), although a hyper-literal interpretation of attack might exclude cyber operations altogether on account of the AP I, Article 51 use of the word “violence,” it is both overly formalistic and imprudent to disqualify cyber operations that cause harm or death from the definition of attack simply because its method of delivery is intangible. Furthermore, because the object and purpose of jus in bello targeting rules are to protect the population from harmful effects, a cyber operation that causes death or destruction should be treated as an attack for the purposes of IHL. There is broad agreement that when cyber operations have kinetic effects, IHL governs the harm from these operations just as it governs the harm caused by a conventional weapon.
Cyber Operations that Cause Only Intangible Effects
Whether cyber operations other than those that cause death or destruction can constitute attacks is an open question. As noted above, many States assert that only those cyber operations that cause death, physical destruction, or damage constitute attacks. While some States and scholars (including the majority of experts who contributed to the Tallinn Manual 2.0) take the position that “damage” includes a loss of functionality, this interpretation does not have the widespread State support necessary to establish a rule of customary international law.
While there is significant State support for the position that a cyber operation causing a kinetic effect constitutes an attack, States take a variety of positions concerning cyber operations that do not create kinetic effects or whose kinetic effects are negligible. Canada’s approach, for example, leaves room for interpretation as to what qualifies as damage or harm, including operations that have “harmful effects above a de minimis threshold on cyber infrastructure, or the systems that rely on it.” This suggests that Canada considers the definition of attack to be as much a question about the scale of a cyber operation’s effects as it is about the kind of effects.
At the other end of the spectrum, France employs a broad interpretation of attack that includes cyber operations “where the targeted equipment or systems no longer provide the service for which they were implemented, whether temporarily or permanently, reversibly or not.” Germany’s definition is similarly broad, defining an attack in cyber operations under IHL as “an act or action initiated in or through cyberspace to cause harmful effects on communication, information or other electronic systems, on the information that is stored, processed or transmitted on these systems or on physical objects or persons.” Meanwhile, Costa Rica takes a broad position that includes temporary or reversible losses of functionality and only explicitly excludes intrusion and data removal.
Because most cyber operations do not produce physical effects similar to those of kinetic weapons, commentators’ efforts to encourage increased protections for civilians from the harms of offensive cyber operations often place operations that produce only intangible effects under the attack umbrella. However, the number of States that either disavow—or at least qualify—the position that intangible effects alone can constitute an attack indicates there is currently no rule of customary international law that cyber operations constitute attacks under IHL if they produce only intangible or de minimis effects.
At the ICC, the court’s previous effort to interpret “attack” in the Ntaganda case establishes a similarly narrow definition, meaning that the vast majority of cyber operations do not constitute attacks under Article 8 of the Rome Statute.
The Ntaganda Case and “Attack” Under Article 8 of the Rome Statute
On July 8, 2019, an ICC Trial Chamber found Bosco Ntaganda—a former high-level commander of the political and militia group Forces Patriotiques pour la Libération du Congo (FPLC)—guilty of eighteen counts of war crimes and crimes against humanity committed in the Democratic Republic of the Congo between September 2002 and December 2003. However, the Trial Chamber acquitted Mr. Ntaganda of some alleged acts constituting the war crime of “attacking protected objects.”
The Trial Chamber held that two sets of conduct by forces under Mr. Ntaganda’s command did not constitute “attacks” within the meaning of the war crime of attacking protected objects: first, conduct by Mr. Ntaganda’s forces wherein they “set up a base inside [a church that had been the site of an assault by Mr. Ntaganda’s forces], broke the doors of the church, removed the furniture, dug trenches around the church, and started a fire inside to prepare their food;” and second, the looting/pillaging of items from a nearby hospital by Mr. Ntaganda’s forces. The first of these, the Trial Chamber held, did not constitute an attack because it occurred after the assault on the church had ended and thus did not occur “during the actual conduct of hostilities.” Likewise, the Trial Chamber held that the second was not an attack because the pillaging of protected objects was not “an act of violence against the adversary.”
The Prosecutor appealed both acquittals, contending (para. 5) that the Trial Chamber’s interpretation of “attack” was too narrow. The Prosecutor went so far as to assert (paras. 131–36) that “attack” could include acts of violence that merely interrupt an object’s ability to carry out its function, even if no damage or destruction results. The defense argued (para. 7) that the drafting history of the Rome Statute showed that the term “attack” in the Rome Statute was grounded in well-established international law that means actions during hostilities on the battlefield against an adversary, not simply any act of violence with some nexus to the area of conflict.
The Appeals Chamber rejected the Prosecutor’s appeal, although not because a majority definition of attack prevailed (paras. 1163–69). Two Appeals Chamber judges found that attack means “combat action.” In contrast, the remaining three judges found that the Trial Chamber’s conception of attack was too narrow (although two of those three rejected the Prosecutor’s appeal for other reasons) (paras. 1164–68).
Yet, the judges’ varying interpretations of attack did have common ground: even the broadest meaning of attack endorsed by the judges held that “attack” requires “injury, death, damage or destruction [and that these are] intended or foreseeable consequences” of the act in question. Thus, according to the Appeals Chamber, an “attack” requires, at minimum, a degree of tangible harm to a person or physical object. The Prosecutor’s argument that “attack” could be interpreted to require only interference with an object’s function was, therefore, squarely rejected.
Conclusion
Although it does not definitively define “attack,” Ntaganda shows that attacks require more than simple interference. They require physical harm to objects or injury to persons. Although some States have adopted definitions of “attack” that include cyber operations causing an object to suffer only a loss of functionality, thedefinition of “attack” in Article 8 of the Rome Statute is not so broad. In short, in a war crimes case at the ICC, there is no interpretation of established IHL that would permit a cyber operation causing only a loss of functionality to qualify as an “attack.”
To put it another way, in Article 8 of the Rome Statute, “attack” means attack (see para. 4). And to constitute an attack, a cyber operation must cause injury, death, damage, or destruction, not just mere interference with an object’s function or purpose. In reality, almost no cyber operations produce such tangible effects. If the ICC Prosecutor wants to prosecute cyber operations under the Rome Statute, a charge other than one of the forms of an unlawful “attack” under Article 8 will likely have to provide the means of conviction.
***
Photo credit: Unsplash
