The International Criminal Court will begin prosecuting cyberwar crimes

The lead prosecutor of the International Criminal Court at the Hague has announced that the international judicial body will begin investigating and prosecuting any hacking crimes that violate existing international laws. Russian cyberattacks on Ukrainian critical civilian infrastructure may be the first case under this new policy. 

Unlike real-world crimes considered war crimes, the world of cyberwarfare doesn’t have an agreed-upon set of rules like the Geneva Convention. Digital activists and cybersecurity advocacy groups have long called for some kind of international criminal code that could mean attacks on power grids, hospitals, and other civilian targets have real-world consequences for their perpetrators. 

Karim Khan, the ICC’s lead prosecutor, isn't going to wait for an international body to agree on a new set of rules for cyberwarfare. He’s content to let existing law guide him to the bad actors no matter where they’re hacking from. Using the Rome Statute, a treaty that allows the ICC to prosecute those guilty of real-world crimes like genocide and crimes against humanity, his office will pursue criminals how do the same kind of attacks in cyberspace. 

“Cyberwarfare does not play out in the abstract. Rather, it can have a profound impact on people’s lives,” Khan wrote in a foreign policy journal. “Attempts to impact critical infrastructure such as medical facilities or control systems for power generation may result in immediate consequences for many, particularly the most vulnerable. Consequently, as part of its investigations, my office will collect and review evidence of such conduct.”

In the same article, Khan claims many international laws governing cyberwarfare are well-defined enough for prosecution in The Hague. Though Khan’s writing doesn’t specifically mention the conflict in Ukraine, there is growing evidence of Russian cyberattacks against Ukraine both before and during its February 2022 invasion. Russian cyberwarfare has also spilled over from the frontlines of the Ukrainian war and into networks across the world, including the United States. 

These attacks have caused mass blackouts, destruction of data, internet breakdowns and real-world damage to power infrastructures and hospitals in Ukraine, the U.S., Europe and beyond. Russian war crimes may have been the trigger for Khan’s announcement, but not mentioning the conflict specifically is a declaration that cyberwarfare crimes anywhere will no longer elude justice in The Hague. 

“We need to show that the law is able to deliver for those who find themselves on the front lines. And those front lines are no longer just physical: The digital front lines can give rise to damage and suffering comparable to what the founders of the ICC sought to prevent,” Khan wrote. 

Russian hackers are already facing serious charges in Ukraine and the United States, but if Khan can prosecute hackers in The Hague under the Rome Statute, the ICC’s jurisdiction over cyberwar crimes could take effect in 123 countries signatory to the Rome Statute. This could mean that countries who don’t have mutual extradition treaties would legally be able to extradite cybercriminals to The Hague based on the Rome Statute instead. 

It also means that the crimes aren’t just attributed to the people with their fingers on the keyboard but could apply to everyone in the chain of command, just like the prosecution of a real-world war crime. 

“International criminal justice can and must adapt to this new landscape,” wrote Khan.