Inter-State cyber attacks and the State act element of the crime of aggression
Item statusRestricted Access
Embargo end date09/07/2020
Clearwater, Darin Michael
With the recent activation of the jurisdiction of the International Criminal Court (ICC) over the crime of aggression, the Court is finally in a position to begin hearing prosecutions of individuals for the most egregious violations of the prohibition upon the inter-State use of force. However, the precise parameters of many aspects of the definition of the crime of aggression that is contained within Article 8bis of the Rome Statute remain unclear. In particular, it has not yet been definitively resolved whether the State act element of Article 8bis could conceivably encompass a cyber attack carried out by one State against another. Throughout the first two decades of the 21st century, the international community witnessed numerous incidents of cyber attacks upon States, many of which were seemingly carried out by, or at the behest of, other States. While the consequences of these attacks were mostly intangible in nature, on at least one occasion actual physical harm was caused. Thus, given the proven potential for such attacks to cause not only adverse non-physical consequences but physical harm as well, and given the likelihood that such attacks will not only continue to occur in the future but will also intensify both in frequency and severity, now is an opportune time to consider whether inter-State cyber attacks could conceivably amount to crimes of aggression. This thesis will provide a step-by-step analysis of the various requirements of the State act element of Article 8bis as these requirements will apply to inter-State cyber attacks. First, it will be argued that an inter-State cyber attack will amount to a use of force within the meaning of Article 2(4) of the UN Charter if it causes, or has the realistic potential to cause, violent consequences to the victim State. Second, it will be argued that a cyber attack which amounts to a use of force within the meaning of Article 2(4) will also amount to an ‘act of aggression’ within the meaning of Article 8bis(2) of the Rome Statute, under conditions which are substantially similar — though not identical — to those of Article 2(4). Third, it will be argued that such a cyber attack can potentially also amount to a ‘manifest violation’ of the UN Charter within the meaning of Article 8bis(1) of the Rome Statute, provided that: (a) it actually does cause violent consequences of a particularly high degree of severity; and (b) the cyber attack’s unlawfulness under the UN Charter is beyond reasonable dispute. It will be concluded that, provided that these criteria are fulfilled, and provided that the necessary conditions for the ICC to exercise jurisdiction over this crime are also fulfilled, the political or military leader of a State that carries out such an attack will potentially be able to be held criminally responsible by the ICC for having committed a crime of aggression.