{"id":17295,"date":"2022-04-22T08:00:00","date_gmt":"2022-04-22T06:00:00","guid":{"rendered":"https:\/\/voelkerrechtsblog.org\/?p=17295"},"modified":"2022-04-25T10:54:36","modified_gmt":"2022-04-25T08:54:36","slug":"attacking-through-or-against-data","status":"publish","type":"post","link":"https:\/\/voelkerrechtsblog.org\/de\/attacking-through-or-against-data\/","title":{"rendered":"Attacking Through or Against Data?"},"content":{"rendered":"

It is a well-established fact that cyber operations have permeated<\/a> the reality of armed conflict and have become a powerful weapon in the hands of a belligerent (as demonstrated lately<\/a>), reaching the ICRC\u2019s list<\/a> of the twelve most pressing issues for 2022. Primarily directed against military targets, the use of cyber warfare can also negatively affect civilians or be otherwise in violation of international humanitarian law, raising the question of their qualification as war crimes under the Rome Statute<\/a> (RS). In answering this question, the approaches taken so far (including on this blog<\/a>) have been to differentiate between physical consequences (further divided into the immediate and secondary effects) and non-physical effects, where such operation merely affects the computer data itself (see here<\/a>), and to then select the appropriate clause of RS.<\/p>\n

Below it will be argued that relying on traditional understandings of crime composition and its constituting elements might simplify qualifying cyber breaches under RS and make the whole concept of cyber warfare more organic to the RS system than it appears at a face value (not least due to its commonplace depiction as detached from the rest of the legal realm). Two main lines of argumentation are that, firstly, in some cases it will be more pragmatic and technically correct to qualify the deletion, appropriation, or other manipulation of computer data as part of a \u2018conduct\u2019 element of a crime, rather than a consequence thereof; and that, secondly, in criminal law terms, there is not much use in categorising immediate and delayed consequences. Instead, a unified approach to consequences shall be advocated.<\/p>\n

The \u2018Attack-Based\u2019 Crimes<\/strong><\/p>\n

The first war crime potentially applicable to unlawful employment of cyber means is \u2018intentionally directing attacks against civilian objects\u2019, provided under Article 8(2)(b)(ii) of RS. Efforts have been made to interpret \u2018objects\u2019 as including computer data, in order for a cyber operation to be prosecuted under this clause (see here<\/a>, pp. 39, 47-48; here<\/a> p. 1166; and here<\/a>). While this approach might also be useful, in most cases it is unlikely that the manipulation of data or disruption to the normal functioning of a system is what attack is primarily directed against. Instead, such activity is aimed at causing damage to other civilian objects through such disruption. Therefore, deletion, conversion, or another handling of data is more akin to the conduct element of crime and constitutes an \u2018attack\u2019 itself. Under this approach, there is no need to regard the computer data or its embedding system as an object against<\/em> which the attack is conducted \u2013 rather, the attack is conducted through<\/em> the use of such data or system (for a comparison see McKenzie<\/a>, p. 1170).<\/p>\n

One of the benefits of considering cyber activity as \u2018just another way of committing a crime\u2019 is that when the ultimate objective of the attack is damage to civilians, such operation can also be prosecuted under Article 8(2)(b)(i) RS, which criminalises \u2018intentionally directing attacks against the civilian population\u2019. Thus, decisive importance is given to the intended effect of harming civilians (directed against civilians) and as far as the Statutory formulation is concerned, a cyber operation is just another way of \u2018directing an attack\u2019. That cyber operations can generally constitute attacks was expressly confirmed, among others, in the Tallinn Manual<\/a> (p. 415; see also here<\/a>, p. 38).<\/p>\n

There are other benefits too. Notably, the above crimes \u2013 attacking civilian population or civilian objects \u2013 are inchoate in nature, which means that they are completed as soon as the perpetrator directed an attack. It is thus not necessary for the damage or injury to civilians to materialise. The crimes still presuppose an intention (or knowledge) on the part of the perpetrator to target an object or an individual other than the manipulated system itself, and a reasonable expectation of such damage being realised. However, the view adopted here is that the cases where a cyber operation is calculated solely on altering the configuration of a certain system, without some ultimate, real-life consequences are rare, and even more rarely would such conduct attain the high threshold of \u2018the most serious crimes of international concern (see also McKenzie<\/a>, p. 1191). Nevertheless, in the exceptional cases where the data itself is of utmost importance, the above approach of regarding computer data or its storing system as the standalone targeted object (McKenzie<\/a>, pp. 1171-2) will be more relevant.<\/p>\n

One more overlooked feature of the \u2018attack-based\u2019 crimes that provide greater protection to individuals from an offensive cyber activity is that attacks are directed against civilians or civilian objects in a general sense, and not necessarily against their life or limb. Hence, such offences even have the potential of addressing a threat to the general well-being of the civilian population (e.g., when cyber activity targets the health-care sector, electricity or water systems), or financial harms suffered by private companies (the example of Maersk incident invoked here<\/a>). In the same vein, deletion of medical files, instead of trying desperately to include them in the category of \u2018objects\u2019, can be considered as a cyber-attack directed against civilians under Article 8(2)(b)(i) RS.<\/p>\n

The Crimes of Destruction and Appropriation<\/strong><\/p>\n

Another set of crimes often referred to as potentially applicable to cyber warfare are offences against property, such as the extensive destruction and appropriation [Article 8(2)(a)(iv)] and the destruction or seizure of enemy\u2019s property [Article 8(2)(b)(xiii)]. The defining feature of such offences is (in contrast to the \u2018attack-based\u2019 crimes) that the intended consequence of destruction or appropriation should indispensably materialise for a crime to be completed. The scope of application of these crimes is limited, on the one hand, as only the outcomes of destruction or appropriation of a certain property can constitute the war crime. Yet, on the other hand, the means for achieving these outcomes are essentially unlimited, as the relevant clauses do not specify how exactly the negative consequence should be brought about. Consequently, destruction or appropriation\/seizure by employing cyber means can easily amount to the offences in question.<\/p>\n

As we compare the two types of offences (attack-based and consequence-oriented), it is important to clarify that the situations of their application are not as interchangeable as sometimes portrayed. Instead, it seems to be a well-established position that the crime of attacking civilians or civilian objects should be committed in the context of active hostilities, whereas only the property that has fallen into the enemy\u2019s hands can be destroyed or appropriated (e.g., in the context of occupation). The issue has attracted wider attention<\/a> as the International Criminal Court attempted to define the term \u2018attack\u2019 on its Ntaganda<\/em> judgment<\/a>. While most authors agree on the separation of \u2018conduct of hostilities\u2019 and \u2018occupation\u2019 crime categories, some allege<\/a> that such divergence is not grounded in the RS and instead originates from the underlying IHL norms. At any rate, when it comes to cyber operations and their qualification as war crimes, attention should be given not only to appropriate object and other constituting elements but also to the context in which they are committed \u2013 inside or outside active combat. Given the ever-changing landscape of protracted conflicts with territories under passing control, the identification of the proper context of a cyber attack will likely be an extremely complicated exercise, all the more so considering the supra-territorial nature of the cyber activity itself.<\/p>\n

Consequences<\/strong><\/p>\n

The approach<\/a> of differentiating between the first-hand, immediate effects and the secondary, protracted consequences raises questions as well. It appears that what here is described as immediate effects should rather be considered as part of extended criminal action. It seems unlikely that a cyber operation is aimed simply at changing the chemical composition of water (Florida<\/a> example) or the frequencies in a motor in a nuclear facility (Stuxnet incident<\/a>). Any kinetic changes in the environment that commission of criminal act is accompanied with (e.g., a bullet leaving firearm and entering someone\u2019s body) can be terminologically called an immediate effect and be relevant for certain legal analysis, but are fairly irrelevant for a criminal law determination of crime consequence (compare<\/a>). Instead, a consequence is normally the ultimate objective that the perpetrator is trying to achieve (poisoning population, destroying centrifuges, etc.), which becomes a constituting element of a crime whenever (a) a perpetrator intended or had an advance knowledge thereof and directed an attack to achieve it; (b) there is a causality link between attack and the consequence (in case of inchoate crimes, potential causality); (c) the consequence is of sufficient gravity to be prosecuted under RS. Any outcome of a cyber operation that satisfies these requirements can be, thus, relevant, regardless of these outcomes having a first- or second-level character.<\/p>\n

Bottom Line<\/strong><\/p>\n

The purpose of this article is to present additional, somewhat contrasting but mostly supplementary perspectives on approaching the criminalisation of cyber operations under the RS. Such approaches should be varied, considering the \u2018anonymous\u2019 and incalculable nature of cyber activities and their consequences, which challenge traditional understandings of legal concepts. The bottom line of the piece is that the crime formulations offered in RS have the potential to capture a wide range of unlawful cyber conduct and there is no need for introducing new offences (as argued here<\/a>). In this process, shifting the focus from interpreting computer data as targeted object to considering the data handling as a part and parcel of criminal act seems to have several advantages demonstrated above.<\/p>\n","protected":false},"excerpt":{"rendered":"

It is a well-established fact that cyber operations have permeated the reality of armed conflict and have become a powerful weapon in the hands of a belligerent (as demonstrated lately), reaching the ICRC\u2019s list of the twelve most pressing issues for 2022. Primarily directed against military targets, the use of cyber warfare can also negatively […]<\/p>\n","protected":false},"author":15,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[6639],"tags":[],"authors":[6742],"article-categories":[6000],"doi":[],"class_list":["post-17295","post","type-post","status-publish","format-standard","hentry","category-uncategorized","authors-mariam-bezhanishvili","article-categories-article"],"acf":{"subline":"Some Additional Considerations on Criminalising Cyber Operations under the Rome Statute"},"meta_box":{"doi":"10.17176\/20220422-182032-0"},"_links":{"self":[{"href":"https:\/\/voelkerrechtsblog.org\/de\/wp-json\/wp\/v2\/posts\/17295","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/voelkerrechtsblog.org\/de\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/voelkerrechtsblog.org\/de\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/voelkerrechtsblog.org\/de\/wp-json\/wp\/v2\/users\/15"}],"replies":[{"embeddable":true,"href":"https:\/\/voelkerrechtsblog.org\/de\/wp-json\/wp\/v2\/comments?post=17295"}],"version-history":[{"count":1,"href":"https:\/\/voelkerrechtsblog.org\/de\/wp-json\/wp\/v2\/posts\/17295\/revisions"}],"predecessor-version":[{"id":17297,"href":"https:\/\/voelkerrechtsblog.org\/de\/wp-json\/wp\/v2\/posts\/17295\/revisions\/17297"}],"wp:attachment":[{"href":"https:\/\/voelkerrechtsblog.org\/de\/wp-json\/wp\/v2\/media?parent=17295"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/voelkerrechtsblog.org\/de\/wp-json\/wp\/v2\/categories?post=17295"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/voelkerrechtsblog.org\/de\/wp-json\/wp\/v2\/tags?post=17295"},{"taxonomy":"authors","embeddable":true,"href":"https:\/\/voelkerrechtsblog.org\/de\/wp-json\/wp\/v2\/authors?post=17295"},{"taxonomy":"article-categories","embeddable":true,"href":"https:\/\/voelkerrechtsblog.org\/de\/wp-json\/wp\/v2\/article-categories?post=17295"},{"taxonomy":"doi","embeddable":true,"href":"https:\/\/voelkerrechtsblog.org\/de\/wp-json\/wp\/v2\/doi?post=17295"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}