Disruptive Cyberwars Targeting Critical Infrastructures as a War Crime

Document Type : scientific

Authors

1 Associate Professor, Department of Criminal Law and Criminology, Faculty of Law, Shahid Beheshti University, Tehran, Iran

2 PhD in Criminal Law and Criminology, Faculty of Law, Shahid Beheshti University, Tehran, Iran

Abstract

In parallel with the expansion of cyberspace, cyber warfare has also expanded as a tool for exerting power against various countries. The imposition of legal restrictions on them has become inevitable. In the realm of international criminal law, imposing limitations of the laws of war on cyberattacks, which differ from conventional warfare, faces challenges. Because the regulations governing the laws of war and war crimes has been formulated to align with conventional warfare. Yet disruptive cyberattacks on critical infrastructure are a type of cyberwarfare that, without causing physical effects similar to conventional wars and solely through non-physical impacts on a country's vital infrastructure, are considered capable of producing consequences more severe than those of conventional wars. Employing a descriptive-analytical method and gathering materials through a library-based approach, this study addresses its central question whether under the existing framework of the Rome Statute, disruptive cyberattacks on critical infrastructure could constitute war crimes particularly Article 8 on war crimes. Ultimately, it holds the view that by adopting a dynamic interpretation of the concept of 'intensity' under existing regulations, it can be affirmed the possibility of cyber conflict and war crimes via  severe disruptions to critical infrastructure. However, this approach will face challenges when dealing with critical infrastructure with dual-use.

Keywords

References

  1. آهنی امینه، محمد؛ فتح‌اللهی، فاطمه‌زهرا. (1393ش). حقوق بین‌الملل مدرن در مواجهه با جنگی پست‌مدرن (نبرد سایبری). راهبرد، ش72، ص116-144.
  2. برادران، نازنین؛ حبیبی، همایون. (1398ش). قابلیت اعمال قواعد حقوق بین‌الملل بشردوستانه در جنگ‌های سایبری. مطالعات حقوق عمومی، 49(1)، 139-158. https://doi.org/10.22059/jplsq.2017.228162.1478
  3. بیگ‌زاده، ابراهیم. (1402ش). حقوق بین‌الملل، (جلد دوم). تهران: نشر میزان.
  4. پاکزاد، بتول. (1388ش). تروریسم سایبری. رسالۀ دکتری، (استاد مشاور: علی‌حسین نجفی ابرندآبادی). دانشکدۀ حقوق دانشگاه شهید بهشتی. گروه حقوق کیفری و جرم‌شناسی. تهران.
  5. خلیل‌زاده، مونا. (1393ش). مسئولیت بین‌المللی دولت‌ها در قبال حملات سایبری. تهران: مجد.
  6. داینیس، هیتر هریسن. (1395ش). جنگ سایبری و حقوق جنگ، (ترجمۀ سعید حکیمی‌ها و هومان شاهرخ). تهران: میزان.
  7. دهقانی، پریسا؛ رمضانی قوام‌آبادی، محمدحسین؛ علی‌پور، محمدرضا. (1401ش). شرط مارتنس در حقوق کیفری بین‌المللی، ماهیت و کارکردهای تفسیری. آموزه‌های حقوق کیفری، 19(23)، 123-156. https://doi.org/10.30513/cld.2022.3988.1634
  8. رضائی، مسعود؛ جلالی، محمود. (1397ش). جنگ سایبری و توسعۀ حقوق بین‌الملل منع توسل به زور. مطالعات حقوق عمومی، 48(3)، 697-713. https://doi.org/10.22059/jplsq.2018.217523.1365
  9. رنجبر، علیرضا؛ گرشاسبی، علی. (1399ش). موانع بنیادین فراروی تدوین حقوق بین‌الملل حاکم بر حملۀ سایبری. مجلۀ حقوقی بین‌المللی، 37(63)، 237-264. https://doi.org/10.22066/cilamag.2020.111943.1823
  10. شاملو، باقر؛ خلیلی پاجی، عارف. (1400ش). جرم‌انگاری در حوزۀ رمزارزها. آموزه‌های حقوق کیفری، 18(21)، 29-68. https://doi.org/10.30513/cld.2021.1420.1230
  11. شریفی طرازکوهی، حسین. (1395ش). حقوق بشردوستانۀ بین‌المللی. تهران: میزان.
  12. ضیایی بیگدلی، محمدرضا. (1397ش). حقوق جنگ؛ حقوق بین‌الملل مخاصمات مسلحانه. تهران: دانشگاه علامه طباطبائی.
  13. عسکری، پوریا. (1401ش). «حقوق بشردوستانه در جنگ سایبری»، در: دانشنامۀ رفتار سایبری، (به‌کوشش باقر شاملو). تهران: میزان.
  14. فقیه حبیبی، علی. (1395ش). جنگ مدرن و تخاصمات سایبری در چارچوب فضای بین‌الملل. جستارهای سیاسی معاصر، 7(19)، 115-144.
  15. کاسسه، آنتونیو؛ گایتا، پائولو؛ بیگ، لورل؛ فان، ماری؛ گاسنل، کریستوفر؛ ویتینگ، الکس. (1401ش). حقوق بین‌الملل کیفری، (ترجمۀ حسین پیران). تهران: نشر نو.
  16. کیهانلو، فاطمه؛ رضادوست، وحید. (1394ش). حملات سایبری به‌مثابۀ توسل به زور در سیاق منشور سازمان ملل متحد. تحقیقات حقوقی، 18(69)، 193-208.
  17. گیوکی، آذر؛ کفایی‌فر، محمدعلی؛ رضایی، محمدتقی. (1400ش). حملات سایبری و لزوم رعایت اصول اساسی حقوق بشردوستانه در آن‌ها. تحقیقات حقوقی تطبیقی ایران و بین‌الملل، 14(51)، 227-305. https://doi.org/10.30495/alr.2021.1872408.1562
  18. محقق هرچقان، علیرضا؛ اردبیلی، محمدعلی؛ بیگ‌زاده، ابراهیم؛ مهدوی ثابت، محمدعلی. «الف». (1402ش). حقوق بین‌الملل سایبری و توسعۀ صلاحیت دیوان کیفری بین‌المللی (با تأکید بر مذاکرات تالین 2017 میلادی). مطالعات حقوق عمومی، 53(3)، 1537-1559. https://doi.org/10.22059/jplsq.2022.329515.2869
  19. محقق هرچقان، علیرضا؛ اردبیلی، محمدعلی؛ بیگ‌زاده، ابراهیم؛ مهدوی ثابت، محمدعلی. (1401ش). اثربخشی دستورالعمل تالین 2017 میلادی بر صلاحیت دیوان کیفری بین‌المللی در ایجاد صلح و امنیت سایبری بین‌المللی. آموزه‌های حقوق کیفری، 19(23)، 269-296. https://doi.org/10.30513/cld.2022.3192.1502
  20. محقق هرچقان، علیرضا؛ اردبیلی، محمدعلی؛ بیگ‌زاده، ابراهیم. «ب». (1402ش). صلاحیت دیوان کیفری بین‌المللی و رسیدگی به جنایات بین‌المللی سایبری در عرصه‌های انسانی حقوق بین‌الملل. پژوهشهای حقوق جزا و جرم‌شناسی، 11(21)، 303-327. https://doi.org/10.22034/jclc.2023.389750.1827
  21. نامدار، سعید؛ قاسمی، غلامعلی. (1397ش). بررسی مفهوم دفاع مشروع در پرتو حملات سایبری (با تأکید بر حملۀ استاکس‌نت به تأسیسات هسته‌ای ایران). مطالعات حقوقی، 10(1)، 199-235. https://doi.org/10.22099/jls.2018.23191.2178
  22. نژندی‌منش، هیبت‌الله. (1394ش). حقوق بین‌الملل کیفری در رویۀ قضایی. تهران: خرسندی.
  23. نجفی ابرندآبادی، علی‌حسین. (1388ش). دربارۀ بزهکاری و جرم‌شناسی سایبری. تعالی حقوق (ماهنامۀ آموزشی دادگستری کل استان خوزستان)، 4(36).
  24. نجفی ابرندآبادی، علی‌حسین. (1395ش). «از جرم‌شناسی حقیقی تا جرم‌شناسی مجازی»، دیباچه بر: پیکا، ژرژ. جرم‌شناسی، (ترجمۀ علی‌حسین نجفی ابرندآبادی، ویراست 3). تهران: میزان.
  25. Akande, Dapo, and Hollis, Duncan. (2020). The Oxford Process on International Law Protections in Cyberspace. Oxford: Oxford Institute for Ethics, Law and Armed Conflict. https://www.elac.ox.ac.uk/the-oxford-process/.
  26. Barkham, Jason. (2001). Information Warfare and International Law on the Use of Force. New York University Journal of International Law and Politics, 34 (57).
  27. Bijleveld, A. (2018). Keynote Address, Diplomacy and Defence in Cyber Space. cyber seminar in Hague. 20 June 2018. https://english.defensie.nl/downloads/speeches/2018/06/21/keynote-address-by-the-minister-of-defence-ms.-ank-bijleveld-marking-the-firstanniversary-of-the-tallinn-manual-2.0-on-the-20th-of-june-2018.
  28. Brown G, and Tullos O. (2012). On the Spectrum of Cyberspace Operations. Small Wars Journal. 12 Nov. 2012. https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2400536.
  29. Bussolati, N. (2015). The Rise of Non-State Actors in Cyberwarfare. in Cyberwar: Law and Ethics for Virtual Conflicts. Edited by JD Ohlin, K Govern and C Finkelstein. Oxford. Oxford University Press.
  30. Cassese, Antonio. (2001). Terrorism is also Disrupting Some Crucial Legal Categories of International Law. European Journal of International Law.
  31. Creekman, Daniel M. (2001). A Helpless America? An Examination of the Legal Options Available to the United States in Response to Varying Types of Cyber-Attacks from China. American University International Law Review, Vol. 17 (3).
  32. Delerue, F. (2020). Cyber Operations and International Law. Cambridge University Press.
  33. Dinniss, H. Harrison. (2012). Cyber Warfare and the Laws of War. Cambridge. Cambridge University Press.
  34. Dinstein, Yoram. (2010). The Conduct of Hostilities under the Law of International Armed Conflict. 2nd edn. Cambridge. Cambridge University Press.
  35. Dörmann, K. (2004). The Applicability of the Additional Protocols to Computer Network Attacks: An ICRC Approach. International Expert Conference on Computer Network Attacks and the Applicability of International Humanitarian Law. Stockholm. 19 November 2004. https://www.icrc.org/eng/assets/files/other/applicabilityofihltocna.pdf.
  36. (2019). Assessment of Reported Malware Infection at Nuclear Facility. Dragos. 1 November 2019. available in: https://www.dragos.com/blog/industry-news/assessment-of-reported-malware-infection-at-nuclear-facility/.
  37. Duncan, Hollis B, and Benthem, Tsvetelina van. (2021). What Would Happen If States Started Looking at Cyber Operations as a “Threat” to Use Force?. LAWFARE. 30 March 2021. https://www.lawfaremedia.org/article/what-would-happen-if-states-started-looking-cyber-operations-threat-use-force.
  38. European Union. (2006). Communication from the Commission on a European Programme for Critical Infrastructure Protection. COM/2006/0786 final.
  39. European Union. (2004). Communication from the Commission to the Council and the European Parliament – Critical Infrastructure Protection in the Fight against Terrorism. COM/2004/0702 final.
  40. European Union. (2009). Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions on Critical Information Infrastructure Protection – "Protecting Europe from Large Scale Cyber-Attacks and Disruptions: Enhancing Preparedness, Security and Resilience". COM/2009/0149 final.
  41. European Union. (2008). Directive on the Identification and Designation of European Critical Infrastructures and the Assessment of the Need to Improve Their Protection. Council Directive 2008/114/EC., 2008, Annex I: ‘List of ECI sectors’.
  42. Focarelli, Carlo. (2015). Self-Defence in Cyberspace. in: Research Handbook on International Law and Cyberspace. Nicholas Tsagourias and Russell Buchan (eds.). Edward Elgar Publishing.
  43. General Assembly of the United Nations. (2023). Creation of a global culture of cybersecurity and the protection of critical information infrastructures. UNGA Res 58/199. 23 December 2003.
  44. Georgia, Beatty. (2021). War crimes in cyberspace: prosecuting disruptive cyber operations under Article 8 of the Rome Statute. The Military Law and the Law of War Review, Vol. 58 (2). https://doi.org/10.4337/mllwr.2020.02.17.
  45. Gisel, L, and Olejnik, L. (2019). The Potential Human Cost of Cyber Operations. ICRC. 29 May 2019. https://www.icrc.org/en/document/potential-human-costcyber-operations.
  46. Greenberg, A. (2023). The International Criminal Court Will Now Prosecute Cyberwar Crimes. Wired. 7 September https://www.wired.com/story/icc-cyberwar-crimes/.
  47. Hern, A. (2017). WannaCry, Petya, NotPetya: how ransomware hit the big time in 2017. The Guardian. 30 December 2017. https://www.theguardian.com/technology/2017/dec/30/wannacry-petya-notpetya-ransomware.
  48. Hoisington, Matthew. (2009). Cyberwarfare and the Use of Force Giving Rise to the Right of Self-Defense. International & Comparative Law Review. Vol. 32.
  49. Hollis, Duncan B. (2008). New Tools, New Rules: International Law and Information Operations. In THE MESSAGE OF WAR: INFORMATION, INFLUENCE AND PERCEPTION IN ARMED CONFLICT. Edited by G. David and T. McKeldin. Temple University Legal Studies Research Paper.
  50. Hoogh, André. (2009). Georgia’s Short-Lived Military Excursion into South Ossetia: The Use of Armed Force and Self-Defence. Ejiltalk. 9 December www.ejiltalk.org/georgia’s-short-lived-military-excursion-into-southossetia-the-use-of-armed-force-and-self-defence/.
  51. ICJ Report. (2005). Armed Activities on the Territory of the Congo (Democratic Republic of the Congo v. Uganda). (Judgment). ICJ Reports 168.
  52. ICJ Report. (1986). Military and Paramilitary Activities in and Against Nicaragua (Nicar. v. U.S.). Judgment. ICJ Report 14. 27 June 1986.
  53. ICJ Report. (2003). Oil Platforms (Islamic Republic of Iran v. United States of America). (Judgment). ICJ Reports 161, 2003.
  54. ICJ Reports. (1949). Corfu Channel (United Kingdom of Great Britain and Northern Ireland v. Albania). ICJ Reports 4, 1949.
  55. ICJ Reports. (2005). The Armed Activities on the Territory of the Congo Case.
  56. Inteernational Criminal Tribunal for the Former Yugoslavia. (1995). Prosecutor v. Tadić. Case No. IT-1-94-1. Decision on the Defense Motion for Interlocutory Appeal on Jurisdiction. 2 October 1995.
  57. International Committee of the Red Cross. (2019). International Humanitarian Law and Cyber Operations during Armed Conflicts. ICRC position paper. November 28, 2019. https://www.icrc.org/en/document/ international-humanitarian-law-and-cyber-operations-during-armed-conflicts.
  58. Joyner, Christopher C, and Lotrionte, Catherine. (2001). Information Warfare as International Coercion: Elements of a Legal Framework. European Journal of International Law, Vol. 12 (5). https://doi.org/10.1093/ejil/12.5.825.
  59. Kelsey, J. (2008). Hacking into International Humanitarian Law: The Principles of Distinction and Neutrality in the Age of Cyber Warfare. Michigan Law Review. Vol. 106 (7).
  60. Kerschischnig, Georg. (2012). Cyberthreats and International Law. Hague. Eleven International Publishing.
  61. Khan, Karim A.A. (2023). Technology Will Not Exceed Our Humanity. Digitalfrontlines. 20 August 2023. https://digitalfrontlines.io/2023/08/20/technology-will-not-exceed-our-humanity/.
  62. Kilovaty, I. (2016). Virtual Violence – Disruptive Cyberspace Operations as “Attacks” Under International Humanitarian Law. Michigan Telecommunications and Technology Law Review. Vol. 23 (1).
  63. Letter from the Minister of Foreign Affairs to the President of the House of Representatives on the International Legal Order in Cyberspace. (2019). Appendix, 5 July 2019. https://www.government.nl/documents/parliamentary-documents/2019/09/26/letter-to-theparliament-on-the-international-legal-order-in-cyberspace.
  64. Li, S. (2013). When Does Internet Denial Trigger the Right of Armed Self-Defense?. Yale Journal International Law, Vol. 38.
  65. Lin, Herbert S. (2010). Offensive Cyber Operations and the Use of Force. Cybersecurity Symposium: National Leadership, Individual Responsibility. Journal of National Security Law & Policy, Vol. 4(1).
  66. Lubin, A. (2021). The Rights to Privacy and Data Protection Under International Humanitarian Law and Human Rights Law. In: Research Handbook on Human Rights and Humanitarian Law: Further Reflections and Perspectives. Edited by R Kolb, G Gaggioli and P Kilibarda. Edward Elgar. Cheltenham.
  67. Max Planck Institute for Comparative Public Law and International Law. (2019). Report of the International Fact-Finding Commission on the Conflict in Georgia. ceiig,. ceiig.ch/Report.html.
  68. Milanovic, Marko, and Schmitt, Michael N. (2020). Cyber Attacks and Cyber (Mis)information Operations during a Pandemic. Journal of National Security Law & Policy. Vol. 11.
  69. Miller, K. (2014). The Kampala Compromise and Cyberattacks – Can There Be an International Crime of Cyber-Aggression?. Southern California Interdisciplinary Law Journal, Vol. 23.
  70. Ministry of the Armies. (2019). International Law Applied to Operations in Cyberspace (English version). Ministère des Armées. 19 March 2019. https://www.defense.gouv.fr/content/download/567648/9770527/file/international+law+applied+to+operations+in+cyberspace.pdf.
  71. Morgan, J. (2014). A Simple Explanation of the Internet of Thing. Forbes. 13 May 2014. https://www.forbes.com/sites/jacobmorgan/2014/05/13/simple-explanation-internet-things-that-anyone-can-understand/#69481bd01d09.
  72. Myjer, Eric. (2015). Some Thoughts on Cyber Deterrence and Public International Law. in: Research Handbook on International Law and Cyberspace. Nicholas Tsagourias and Russell Buchan (eds.). London. Edward Elgar Publishing.
  73. O’Connell, Mary Ellen. (2013). The Prohibition of the Use of Force. In: Research Handbook on International Conflict and Security Law: Jus ad Bellum, Jus in Bello and Jus post Bellum. Edited by Christian Henderson and Nigel White. London. Edward Elgar Publishing.
  74. Oeter, Stefan. (2008). Methods and Means of Combat. in: The Handbook of International
    Humanitarian Law. Dieter Fleck (ed.). Oxford University Press.
  75. Ophardt, J. (2010). Cyber Warfare and the Crime of Aggression: The Need for Individual Accountability on Tomorrow’s Battlefield. Duke Law & Technology Review, Vol. 9 (3).
  76. Porup, JM. (2019). How a nuclear plant got hacked. CSO Online. 9 December 2019. https://www.csoonline.com/article/3488816/how-a-nuclear-plant-got-hacked.html.
  77. Preparatory Commission for the International Criminal Court. (2000). Report of the Preparatory Commission for the International Criminal Court. Addendum. add. Part II Finalized draft text of the Elements of Crimes, U.N. Doc. PCNIC/2000/1/Add.2.
  78. Radziwill, Yaroslav. (2015). Cyber-Attacks and the Exploitable Imperfection of International Law. Leiden. Brill & Martinus Nijhoff Publishers.
  79. Rome Statute of the International Criminal Court. (1998). 17 July 1998, 2187 U.N.T.S. 90.
  80. Roscini, Marco. (2014). Cyber Operations and the Use of Force in International Law. Oxford. Oxford University Press.
  81. Roscini, Marco. (2016). Cyber Operations as a Use of Force. in: Research Handbook on International Law and Cyberspace. Nicholas Tsagourias and Russell Buchan (eds.). London. Edward Elgar Publishing.
  82. Ruys, Tom. (2014). The Meaning of “Force” and the Boundaries of the Jus Ad Bellum: Are “Minimal” Uses of Force Excluded from UN Charter Article 2(4)?. American Journal of International Law, Vol. 108 (2).
  83. Sandoz, Yves, Swinarski, Christophe and Zimmermann, Bruno (eds.). (2022). Commentary on the Additional Protocols of 8 June 1977 to the Geneva Conventions of 12 August 1949. International Committee of the Red Cross.
  84. Saxon, Dan. (2016). Violations of International Humanitarian Law by Non-State Actors during Cyberwarfare: Challenges for Investigations and Prosecutions.Journal of Conflict and Security Law. Vol. 21 (8). https://doi.org/10.1093/jcsl/krw018.
  85. Scheffer, David. (2022). Amending the Rome Statute to Cover Cyberwarfare as Aggression. ICC Forum, 7 March 2022. https://iccforum.com/cyberwar#Scheffer.
  86. Schmitt, Michael N, and Vihul, Liis. (2017). Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations. 2nd edn. Cambridge. Cambridge University Press.
  87. Schmitt, Michael N. (1999). Computer Network Attack and the Use of Force in International Law: Thoughts on a Normative Framework. Columbia Journal of Transnational Law, Vol. 37.
  88. Schmitt, Michael N. (2011). Cyber Operations and the Jus Ad Bellum Revisited', Villanova Law Review, Vol. 56.
  89. Schmitt, Michael N. (2013). Tallinn Manual on the International Law Applicable to Cyber Warfare. Cambridge. Cambridge University Press.
  90. Shackelford, Scott. (2009). From Nuclear War to Net War: Analogizing Cyber Attacks in International Law. Berkley Journal of International Law, Vol. 27.
  91. Silver, Daniel B. (2002). Computer Network Attack as a Use of Force under Article 2(4) of the United Nations Charter. International Law Studies, Vol. 76.
  92. Sklerov, Matthew J. (2009). Solving the Dilemma of State Responses to Cyberattacks: A Justification for the Use of Active Defenses against States Who Neglect Their Duty to Prevent. Military Law Review, Vol. 201.
  93. The Prosecutor v. Thomas Lubanga Dyilo. (2007). ICC-01/04-01/06. Decision on the Confirmation of Charges. PTC I, 29 Jan. 2007.
  94. Tsagourias, Nicholas. (2012). Cyber Attacks, Self-Defence and the Problem of Attribution. Journal of Conflict and Security Law, Vol. 17.
  95. US White House. (2013). Presidential Policy Directive - Critical Infrastructure Security and Resilience. Presidential Policy Directive/PPD-21, available in: https://obamawhitehouse.archives.gov/the-press-office/2013/02/12/presidential-policy-directive-critical-infrastructure-security-and-resil.
  96. Zetter, K. (2016). Inside the Cunning, Unprecedented Hack of Ukraine’s Power Grid. Wired. 3 March 2016, accessed 2 May 2024, https://www.wired.com/2016/03/inside-cunning-unprecedentedhack-ukraines-power-grid/.
  97. Ziolkowski, K. (2010). Computer Network Operations and the Law of Armed Conflict. The Military Law and the Law of War Review, Vol. 49.

Files

Share

How to cite

Statistics