Scenario 32: Crime of aggression

State A launches a cyber operation against State B, with malware deployed against the electric grid in State B, resulting in widespread power outages, including to hospitals. As part of the cyber operation, ransomware is deployed against hospital servers, which results in the destruction of hospital data (including medical records). In a later cyber operation, State A disables the military’s command and communications in State B and malware is deployed that permanently incapacitates and disables various weapon systems in State B’s military. The scenario analyses whether the incidents give rise to individual criminal responsibility for commission of the crime of aggression under Article 8bis of the Rome Statute of the International Criminal Court.
==Scenario==
===Keywords===
Act of aggression, crime of aggression, individual criminal responsibility under international law; Rome Statute of the International Criminal Court, use of force.
===Facts===
[F1] Prior to the events in question, State A and State B have had tensions at the political level, but relations have been peaceful.
[F2] State A launches a cyber operation, deploying malware against the electric grid in State B, which results in widespread power outages, including to hospitals. No fatalities result. As part of the same campaign, ransomware is deployed against hospital servers, which results in the destruction of hospital data (including medical records). Although no fatalities occur in the short term, the ability of large numbers of individuals to effectively seek future medical care is imperilled. 
 
[F3] This first cyber operation was launched by a lower-ranking officer in State A’s Cyber Command. He is part of a faction within State A’s government, known for its animosity towards State B. The officer knew of a contingency arsenal of cyber capabilities, pre-developed and maintained in a state of readiness by State A’s Cyber Command and activated them on his own initiative. Cyber Command is a unit within State A’s armed forces.
[F4] Following the success of the unauthorized operations and seeing that State B is unable to respond effectively, the hostile faction gains traction within State A’s leadership. Sensing a window of opportunity, the President of State A then issues a statement publicly congratulating the officer and noting that the officer’s actions have the official seal of approval of State A. 
[F5] Finally, the President of State A officially authorizes State A’s armed forces to launch another cyber operation against State B that disables the military’s command and communications in State B. Malware is also deployed that permanently incapacitates and disables various weapon systems in State B’s military.
===Examples===
*Stuxnet (2010)
*Use of malware to track and target Ukrainian artillery units (2014–2016)
*Water facilities attack (2020)
*Viasat KA-SAT attack (2022)
==Legal analysis==
For a general overview of the structure of analysis in this section, see Note on the structure of articles.
[L1] Focusing on the initial cyber operation resulting in power outages, including electricity being cut to hospitals and the destruction of hospital data, the analysis examines whether the crime of aggression has been committed, using the definition in Article 8bis of the Rome StatuteThe Rome Statute of the International Criminal Court (17 July 1998) 2187 UNTS 90 (as amended) [hereinafter, “Rome Statute”] art 8bis. of the International Criminal Court (“ICC”). Specifically, the analysis considers whether there has been a “use of armed force” by a State, which amounts to an “act of aggression,” and whether the act amounts to a “manifest” violation of the UN Charter. The scenario then considers the same criteria regarding the second cyber operation that disables military command and communications, and permanently incapacitates and disables weapon systems in State B. The analysis concludes by examining the individuals who potentially could be held internationally responsible for the crime of aggression.
=== Violations of international human rights law applicable to cyber operations ===
 
[L2] By launching cyber operations against State B, individuals in State A might incur individual criminal and/or superior responsibility provided that the criteria under Article 8bis of the Rome Statute are fulfilled. The mens rea requirements of Article 30 of the Rome Statute (intent and knowledge) would additionally need to be satisfied.
=== Crime of aggression ===
[L3] Turning first to the “act of aggression,” Rome Statute Article 8bis, paragraph 2, states that this must involve the “use of armed force.” It is unclear whether the first cyber operation involved the “use of armed force,” while the second one likely did. (For discussion, see use of force concept page: “A cyber attack that causes or is reasonably likely to cause physical damage to property, loss of life or injury to persons would fall under the prohibition contained in Article 2(4) of the UN Charter.”).See also Tallinn Manual 2.0 Rule 69 (“A cyber operation constitutes a use of force when its scale and effects are comparable to a non-cyber operation rising to the level of a use of force.”). The facts state that the first operation resulted in power outages, including at hospitals, but that no fatalities resulted at least in the short term. While the long-term harm should also be analysed, the facts, as presented, suggest no “physical damage to property, loss of life or injury to persons” resulting from the power outages. As to the destruction of medical records, there is controversy, at least for IHL purposes, whether this should be considered to be damage to property.Controversy has existed over whether data should be considered an “object” that is protected under IHL, although the debate seems to be resolving that it is protected. See Jeffrey T Biller and Michael N Schmitt, “Classification of Cyber Capabilities and Operations as Weapons, Means, or Methods of Warfare” (2019) 95 Intl Law Studies 179; Kubo Mačák, “Military Objectives 2.0: The Case for Interpreting Computer Data as Objects under International Humanitarian Law” (2015) 48 Israel Law Rev 55. If paper hospital records were destroyed, there would be destruction of “physical property”; it makes little sense to have the same information treated differently just because it is digitized. Alternatively, even if data were not protected under IHL, that does not preclude its being considered part of an act of aggression since IHL analysis and crime of aggression analysis are not coextensive; for example, combatants may be targeted under IHL but are victims of the crime of aggression. The second operation more clearly involves the “use of force” because the permanent incapacitation and disabling of weapon systems constitutes destruction of property.The Tallinn Manual does not close the door to other harm, other than physical damage to property, loss of life or injury to persons, being considered “use of force.” See Tallinn Manual 2.0 Rule 69, para 8. For factors to evaluate in determining when the level of harm of a cyber operation rises to the level of a “use of force,” see ibid, 333–36. 
[L4] The “act of aggression” must also be committed “by a State.” Both cyber operations meet this requirement. State A’s Cyber Command is a unit within State A’s armed forces. The first, initially unauthorized operation, is later endorsed by the President of State A when he publicly congratulated the lower-ranking officer who launched it and stated that the actions have the seal of approval of State A. This amounts to an acknowledgement and adoption of the conduct as State A’s own.See Int’l L Comm’n, Draft Articles on the Responsibility of States for Internationally Wrongful Acts, with Commentaries (adopted), UN Doc. A/56/10 (2001), art 11 (“Conduct . . . shall . . . be considered an act of [a] State under international law if and to the extent that the State acknowledges and adopts the conduct in question as its own.”). The conduct might also be attributable to State A even if the President did not acknowledge and adopt the conduct.See ibid, art 7 (“The conduct of an organ of a State or of a person or entity empowered to exercise elements of the governmental authority shall be considered an act of the State under international law if the organ, person or entity acts in that capacity, even if it exceeds its authority or contravenes instructions.”). 
[L5] If the attack on the electric grid and destruction of hospital data constitute use of force (see para. L3), and because the second attack more clearly does, one next considers whether they fall under any of the listed acts contained in the definition of “act of aggression” in Article 8bis, paragraph 2.See list of acts qualifying as aggression from Rome Statute art 8bis, para 2. The list is open-ended, so it is not imperative for the attack(s) to fall directly into the enumerated acts, see Permanent Mission of Liechtenstein to the United Nations, “The Council of Advisers’ Report on the Application of the Rome Statute of the International Criminal Court to Cyberwarfare” (Aug 2021) [hereinafter, “Council of Advisers’ Report”] 10, para 3, but a clearer case would be one where they do.
[L6] Both operations might fit into (b) “[b]ombardment by the armed forces of a State against the territory of another State or the use of any weapons by a State against the territory of another State.”Rome Statute art 8bis, para 2 (b) (emphasis added). The cyber operations involve “the use of any weapon,”For the question of whether cyber capabilities may qualify as weapons, see also Legal review of cyber weapons, means and methods of warfare (“Although the precise definition of a ‘cyber weapon’ is unsettled as yet, at the very least, all cyber tools capable of conducting ‘attacks’ as understood in IHL, that is, acts of violence against the adversary whether in offence or in defence, should be considered to qualify as cyber weapons . . . .”) (footnotes omitted). According to the International Court of Justice, “use of force” may be accomplished “regardless of the weapons employed.” Legality of the Threat or Use of Nuclear Weapons (Advisory Opinion) [1996] ICJ Rep 226, para 39. and the operations target the electric grid and hospital data, as well as military command and communications and weapon systems in the territory of State B. Thus, there is “the use of any weapon” by a State against the territory of another State. As mentioned, however, some sources suggest that a clearer case of “use of force” (a necessary precondition of a UN Charter violation, and hence, an “act of aggression”), is where there has been loss of life or limb, or destruction of physical property. Under this view, the second cyber operation would qualify as an act of aggression, but the first might not.L3. Arguably these requirements—suggested in the Tallinn Manual 2.0—are too narrow. Of course, the Tallinn Manual 2.0 does not make fatalities or physical destruction an absolute precondition when evaluating “use of force.” See Tallinn Manual 2.0 Rule 69, para 8. Simultaneously, expanding what constitutes “use of force” in the cyber domain is a “ground [that] must be trodden upon very carefully since it can result in dilution of the threshold for use of force more broadly”—eg, it could potentially expand what triggers a state’s right to use self-defence. See Council of Advisers’ Report 15, para 19. 
[L7] The second operation additionally fits within (d) as it is “[a]n attack by the armed forces” of State A’s Cyber Command (a unit in State A’s armed forces) against the “land, sea or air forces . . . of another State”—the military command and communications, and weapon systems in State B’s military.
[L8] As to the manifest threshold requirement in Article 8bis, paragraph 1, if one analyses the first cyber operation alone—if it constitutes “use of force” that qualifies as an “act of aggression” (that is, a UN Charter violation)See L3.—it is unclear whether it would meet the requirement of a “manifest” violation of the UN Charter. It may depend on how long the electric grid is incapacitated and what kind of harm results. Destroying hospital data is quite serious, but it would be a case of first impression whether this initial attack reaches the threshold of a “manifest” UN Charter violation by its “character, gravity and scale.” As noted above, some might not accept that the first cyber operation was a “use of force” or violated the UN Charter.See L3. Given that the “manifest” threshold is intended to require that the UN Charter violation be very clear or incontrovertible,See Carrie McDougall, The Crime of Aggression under the Rome Statute of the International Criminal Court (2nd edn, CUP 2021) 158. Understanding 6 agreed on at the 2010 Review Conference provides:
It is understood that aggression is the most serious and dangerous form of the illegal use of force; and that a determination whether an act of aggression has been committed requires consideration of all the circumstances of each particular case, including the gravity of the acts concerned and their consequences, in accordance with the Charter of the United Nations.; see also Understanding 6. the first cyber operation might well not rise to that level given the ambiguities involved, although the analysis might depend on the severity of the downstream consequences.
[L9] The second cyber operation that disables the military’s command and communications in State B and permanently incapacitates and disables various weapon systems in State B’s military is much more akin to a conventional military operation. Assuming command and communications are disabled for a significant period of time and a fairly large number of weapon systems are permanently disabled, this could meet the requirement of a “manifest” UN Charter violation by its “character, gravity, and scale.” It would be a clear UN Charter violation in terms of its “character,” and significantly serious in terms of its “gravity and scale.”Ambiguity whether all three terms must be satisfied. See International Criminal Court, Assembly of States Parties, Review Conference, ICC Doc. RC/Res.6.  The Crime of Aggression (11 June 2010) Annex III Understanding 6. Understanding 7 further states that “the three components of character, gravity and scale must be sufficient to justify a ‘manifest’ determination. No one component can be significant enough to satisfy the manifest standard by itself.” Ibid, Understanding 7. This leaves it open to interpretation whether all three terms must collectively satisfy the threshold, or whether two may suffice. See Robert Heinsch, “The Crime of Aggression after Kampala: Success or Burden for the Future” (2010) 2 Gӧttingen J Intl L 728, 729. 
[L10] A question additionally exists whether the cyber operations should be viewed separately, or cumulatively—with both considered part of one act of aggression. The law is uncertain on this. It is not fully clear whether an “act of aggression” may be achieved through an accumulation of events.Council of Advisers’ Report 15, para 18 (“This proposition suggests that a series of attacks, none of which would individually amount to an armed attack, could nonetheless collectively constitute an armed attack. The ICJ has not explicitly endorsed this argument, but some have argued that it has implicitly done so: it has on multiple occasions ruled that a series of individual attacks did not, on the facts, amount to an armed attack, while not rejecting this legal theory wholesale.”), citing Oil Platforms (Iran v US) (Judgment) [2003] ICJ Rep 161, para 64; Armed Activities on the Territory of the Congo (Dem Rep Congo v Uganda) (Judgment) [2005] ICJ Rep 168, para 147; Steven R Ratner, “Self-Defense Against Terrorists: The Meaning of Armed Attack” in Larissa van den Herik & Nico Schrijver (eds), Counter-Terrorism Strategies in a Fragmented Legal Order: Meeting the Challenges (CUP 2013). The accumulation of events theory should be accepted. A slow-moving genocide would still be genocide if the element of the crime are met. There is no reason the same should not be true vis-à-vis the crime of aggression. See also Tallinn Manual 2.0 Rule 71, para 11 (as to a series of cyber incidents, “there are grounds for treating the incidents as a composite armed attack” if “the same originator (or originators acting in concert) has carried out smaller-scale incidents that are related and that taken together meet the requisite scale and effects”). “This doctrine [of accumulation of events] has not yet been applied to the crime of aggression in any context, cyber or kinetic.”Council of Advisers’ Report 15, para 18. If the events are viewed cumulatively, because the second operation likely meets the “manifest” threshold, the two operations, if considered together, would do so as well. (It is also possible that one or more cyber operations could be evaluated cumulatively along with one or more kinetic operations, although that is not part of the instant fact pattern.)
[L11] Turning to the individuals involved, given that the President of State A ordered the second operation, he was involved in its “execution”; thus, one of the operative action words in Article 8bis, paragraph 1, has been satisfied. Additionally, his actions would qualify as “ordering” under Article 25 and could constitute superior responsibility under Article 28. The President of State A is also a person “in a position effectively to exercise control, over or to direct the political or military action of a state,” so the leadership clause is met.
[L12] The low-ranking officer who activated the first operation was involved in its “execution,” satisfying one of the operative words in Article 8bis, paragraph 1. He was also involved in committing the act, satisfying Article 25. However, his low rank suggests he may not be a person “in a position effectively to exercise control over or to direct the political or military action of a state.” Further analysis would be warranted, because, despite his low rank, his position appears to have allowed him to impact the military actions of State A.Some domestic criminal codes that contain the crime of aggression do not have the leadership clause. See Annegret Hartig, Making Aggression a Crime under Domestic Law (Springer 2023) 300 et seq; Astrid Reisinger Coracini, “(Extended) Synopsis: The Crime of Aggression under Domestic Criminal Law” in Claus Kreβ and Stefan Barriga (eds), The Crime of Aggression: A Commentary (CUP 2017) 309–12. 
[L13] While the President of State A later endorsed the first operation, because the endorsement occurred after the fact, a question exists whether it falls within “planning, preparation, initiation or execution.” Further factual information might be needed to evaluate whether the first operation was still ongoing at the time of the endorsement (in which case the crime is continuing), and/or whether the President of State A might bear superior responsibility for the acts of the lower-ranking officer, in which case the President could have superior responsibility for their execution. 
 
[L14] As to either individual, proof would additionally need to be obtained as to the perpetrator’s mental state (mens rea), such that the requirements of intent and knowledge in Article 30 of the Rome Statute are met. For example, with respect to the lower-ranking officer, this might entail proving that he intentionally activated the cyber capabilities while being fully aware of the potential consequences on State B’s critical infrastructure and healthcare systems. With respect to the President, evidence should show that he intentionally issued the order and understood that the order, if carried out, would significantly compromise State B’s military capabilities and effectively render their defenses inoperative.
[L15] This scenario does not evaluate the issue of ICC jurisdiction over the crime of aggression, but that would also need to exist for a case to proceed there, and, at present, the ICC’s jurisdiction over the crime is quite limited.For example, the nationals of non-States Parties and crimes committed on their territories are completely excluded from ICC jurisdiction over the crime of aggression. See Rome Statute art 15bis, para 5. For a proposal by the Global Institute for the Prevention of Aggression (“GIPA”) to amend the Rome Statute to harmonize the ICC’s jurisdiction over all four Rome Statute crimes, see <GIPA-model-amendment-proposal.pdf (crimeofaggression.info)>; see also GIPA’s reasons for the proposed amendment <GIPA-Proposal-Short.pdf (crimeofaggression.info)>; Jennifer Trahan, “Amending the Kampala Amendments: Proposal to Harmonize the ICC’s Jurisdiction Over the Crime of Aggression with Its Jurisdiction Over Its Other Core Crimes” (Opinio Juris, 2 Nov 2023) <Amending the Kampala Amendments: A Proposal to Harmonize the ICC’s Jurisdiction - Opinio Juris>. The scenario also does not evaluate the ICC’s gravity threshold, which additionally would need to be met.The ICC has not yet opined on the topic of gravity and cyber operations. A strong case can be made that a cyber operation that causes harm akin to a kinetic attack—for example, one that seriously injures or kills a number of persons or that causes significant damage to, or destruction, of property—could, depending on the facts, satisfy the ICC’s gravity threshold; however, other cyber attacks might do so as well, such as attacks on critical infrastructure, even absent loss of life or physical destruction. See Jennifer Trahan, “Contributing to Cyber Peace by Maximizing the Potential for Deterrence: Criminalization of Cyber-Attacks under the International Criminal Court's Rome Statute” in Scott Shackleford, Frederick Douzet, and Christopher Ankersen (eds), Cyber Peace: Charting a Path Toward a Sustainable, Stable, and Secure CyberSpace (CUP 2022) 138; Jennifer Trahan, “The Criminalization of Cyber-Attacks under the Rome Statute” (2021) 19 J of Intl Criminal Justice 1133, 1138–46. While the “manifest” threshold might satisfy the gravity requirement, there is as of yet no ruling whether these thresholds are coextensive. The analysis also does not consider responsibility under domestic criminal codes,For domestic legislation following the 2010 Review Conference, see Annegret Hartig, Making Aggression a Crime under Domestic Law (Springer 2023) ch 6. For legislation that preceded the 2010 Review Conference, see Astrid Reisinger Coracini, “(Extended) Synopsis: The Crime of Aggression under Domestic Criminal Law” in Claus Kreβ and Stefan Barriga (eds), The Crime of Aggression: A Commentary (CUP 2017). nor the issue of immunities at the domestic level.On functional immunities and the crime of aggression before domestic courts, see Annegret Hartig, Making Aggression a Crime under Domestic Law (Springer 2023), 422–57. On personal immunities, see Astrid Reisinger Coracini and Jennifer Trahan, “The Case for Creating a Special Tribunal to Prosecute the Crime of Aggression Committed Against Ukraine (Part VI): On the Non-Applicability of Personal Immunities” (Just Security, 8 Nov 2022) <The Case for Creating a Special Tribunal to Prosecute the Crime of Aggression Committed Against Ukraine (Part VI): On the Non-Applicability of Personal Immunities (justsecurity.org)>.
==Checklist==
*Did the cyber operation involve the use of armed force—for example, did it seriously injure or kill a number of persons or cause significant damage to, or destruction of property—or cause other harm comparable to a kinetic attack in its scale and effects? 
*Was the cyber operation conducted by a State?
*Does the cyber operation fall within the list of acts of aggression contained in the definition in Article 8bis, paragraph 2, of the Rome Statute (or, potentially, is it comparable in gravity and scale to a listed act)?
*Did the cyber operation (either on its own, or, potentially considered cumulatively with other operations) rise to the level of a “manifest” violation of the UN Charter measured by its “character, gravity and scale”?
*Is there an identifiable person who played a role in planning, preparation, initiation or execution of the cyber operation(s)?
*Was that person also in a position effectively to exercise control over or to direct the political or military action of the State? 
*Can the ICC’s mens rea requirements of intent and knowledge be satisfied vis-à-vis that person? 
==Appendixes==
===See also===
*Scenario 03: Cyber operation against the power grid
*Scenario 19: Hate speech
*Scenario 20: Cyber operations against medical facilities
===Notes and references===
===Bibliography and further reading===
*Ambos, K, “International Criminal Responsibility in Cyberspace” in Tsagourias, N, and Buchan, R (eds), Research Handbook on Cyberspace and International Law (2nd edn, Edward Elgar 2021)
*Ambos, K, “Individual Criminal Responsibility for Cyber Aggression” (2016) 21(3) Journal of Conflict & Security Law 495. 
*Biller, J T, and Schmitt, M N, “Classification of Cyber Capabilities and Operations as Weapons, Means, or Methods Of Warfare” (2019) 95 International Law Studies 179. 
*Efrony, D, and Shany, Y “A Rule Book on the Shelf? Tallinn Manual 2.0 on Cyber Operations and Subsequent State Practice (2018) 112(4) American Journal of International Law 583.
*Hathaway, OA, Crootof, R, Levitz, P, Nix, H, Nowlan, A, Perdue, W, and Speigel, J, “The Law of Cyber Attack” (2012) 100(4) California Law Review 817.
*Jensen, E T, “The Tallinn Manual 2.0: Highlights and Insights” (2017) 48 Georgetown Journal of International Law 735.
*Kress C, and Barriga, S (eds), The Crime of Aggression: A Commentary (CUP 2017).
*Mačák, K “Military Objectives 2.0: The Case for Interpreting Computer Data as Objects under International Humanitarian Law” (2015) 48(1) Israel Law Review 55. 
*Mačák, K “On the Shelf, but Close at Hand: The Contribution of Non-state Initiatives to International Cyber Law” (2019)113 AJIL Unbound 81.
*McDougall, C, The Crime of Aggression under the Rome Statute of the International Criminal Court (2nd edn, CUP 2021).
*Permanent Mission of Liechtenstein to the United Nations, “The Council of Advisers’ Report on the Application of the Rome Statute of the International Criminal Court to Cyberwarfare,” (Aug 2021).
*Roscini, M, “Gravity in the Statute of the International Criminal Court and Cyber Conduct that Constitutes, Instigates or Facilitates International Crimes” (2019) 30(3) Criminal Law Forum 247.
*Schmitt, M N (ed), Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations (2nd edn, CUP 2017).
*Trahan, J, “The Rome Statute’s Amendment on the Crime of Aggression: Negotiations at the Kampala Review Conference” (2011) 11(1) International Criminal Law Review 49. 
*Trahan, J, “From Kampala to New York: The Final Negotiations to Activate the Jurisdiction of the International Criminal Court over the Crime of Aggression” (2018) 18(2) International Criminal Law Review 197.
*Trahan, J, “Contributing to Cyber Peace by Maximizing the Potential for Deterrence: Criminalization of Cyber-Attacks under the International Criminal Court's Rome Statute” in Shackleford, S, Douzet, F, and Ankersen, C (eds), Cyber Peace: Charting a Path Toward a Sustainable, Stable, and Secure CyberSpace (CUP 2022). 
*Trahan, J, “The Criminalization of Cyber-Attacks under the Rome Statute” (2021) 19 Journal of International Criminal Justice 1133.
*Tsagourias, N, “Cyber Attacks, Self-Defense and the Problem of Attribution” (2012) 17(2) Journal of Conflict & Security Law 229.
===Contributions===
* Scenario by: Jennifer Trahan
* Analysis by: Jennifer Trahan
* Reviewed by: Christiane Ahlborn, Sina Alavi, Liina Lumiste
Previous: Scenario 31: Sharing degrading content
Category:Scenario
Category:Individual criminal responsibility under international law
Category:Crime of aggression