Cyberwarfare Attacks, Substantive Law and Legal Definitions

Cyberwarfare Attacks, Substantive Law and Legal Definitions Presented by: Prof. Šepec Date: 7 March 2024 Cyberwarfare - Definition - using computer technologies to disrupt or destroy an adversary's information systems and networks, which amount to an armed attack - Cyberwarfare is connected with the army of an individual country - i.e. it is a military operation - The range and scope of the tort is significantly wider, as it attacks more important targets with significantly more repulsive motives - paralyzing the country's national security via attacks on its infrastructure, technological centers etc. The UN CHARTER - The rule of prohibition against the use of force is codified in Article 2(4) - the UN member state cannot threaten or use force against the territorial integrity or political independence of another state, or in any way that diverges from the purposes of the UN - As Article 2(4) does not use "armed" or a similar word the question remains whether the article only prohibits military force and excludes non-military forms of coercion such as economic sanctions or cyberattacks - Force in the sense of Article 2(4) in the context of cyberwarfare attacks can only be understood when territorial integrity or political independence of a state is actually threatened by such attacks. - Article 51 of the UN Charter, countries can also use self-defense as an exception to the prohibition against the use of force - allows a state to use force in response to an armed attack by another state - Denying the possibility to defend against cyberwarfare attacks would also be completely contrary to the ideology of the United Nations and the idea of a just war. - Two possible solutions: • 1. We deny that cyberwarfare attacks are a form of modern armed warfare - and therefore are not regarded as the use of force in the sense of Article 2(4) - a grey zone and countries fight against these forms of attacks independently • 2. Modern solution, according to which cyberwarfare attacks, when they attack the territorial integrity or political independence of a state, can be considered the use of force according to Article 2(4), and self-defense is possible against such force according to Article 51 of the UN Charter International Humanitarian Law - The Hague Conventions and the Geneva Conventions - The conventions limit all forms of attacks and warfare that attack civilians or civilian facilities, medical facilities or represent other forms of war crimes - if these attacks are conducted through classic military operations or by cyberattacks. - A more complex question is whether a cyber operation can itself trigger the application of international humanitarian law? - International armed conflicts >>>exists whenever there is a resort to armed force between States<<. But when is this point reached in situations involving cyber operations that do not physically destroy or damage military or civilian infrastructure? - Hybrid solution or hybrid model - cyberattacks can constitute a violation of Hague and Geneva law only together with traditional war crimes, however, not by themselves. Rome Statue of the International Criminal Court - Rome statue limits the jurisdiction of the Court to the most serious crimes against the international community as a whole. The Court has jurisdiction for the following crimes: (a) The crime of genocide; (b) Crimes against humanity; (c) War crimes; (d) The crime of aggression - Genocide: killing a group with cyberattacks seems highly unlikely, deliberately inflicting on the group conditions of life calculated to bring about its physical destruction in whole or in part is imaginable through attacks on the basic life sustaining infrastructure (e.g. water, electricity). Cyberattacks can also be used in combination with traditional war crimes (the hybrid model). - Crimes against humanity: mostly physical<< in nature (such as rape, murder, enslavement...). Such attacks must be part of a widespread or systematic attack on the population and not just a singular attack against the national security of a country. When attacking critical infrastructure of the population and thereby intentionally causing great suffering, or serious injury to people, even cyberattacks could be a method of execution. - War crimes: Committed as part of a plan or policy or as part of a large-scale commission of such crimes and are grave breaches of the Geneva Conventions. Cyberattacks on their own will not be defined as war crimes. However, in combination with traditional war crimes (the hybrid model) that would be possible. - Aggression: Highly unlikely that cyberattack on itself could be perceived as an act of aggression. Convention on Cybercrime (2001) - Cybercrime is a predominantly international phenomenon - need for harmonization of international criminal legislation Effective international cooperation between countries is necessary for the prosecution of cybercrime offences - Contains a basic list of crimes - in 2001 this list was considered to be extremely advanced and contained practically all the most important forms of criminal acts in information systems - In 2003 the Additional Protocol on racist and xenophobic crimes committed through information systems - In 2022 the Convention received its Second Additional Protocol on enhanced cooperation and disclosure of electronic evidence - Substantive measures to be taken at the national level: • Article 2 - Illegal access • Article 3- Illegal interception • Article 4 Data interference • Article 5 - System interference • Article 6 Misuse of devices • Article 7 - Computer-related forgery • Article 8 - Computer-related fraud • Article 9 - Offences related to child pornography • Article 10 Offences related to infringements of copyright and related rights Directive EU 2013/40/EU On Attacks Against Information Systems, 2013 - Substantive measures to be taken at the national level: • Article 3 Illegal access to information systems • Article 4 - Illegal system interference • Article 5 Illegal data interference • Article 6 Illegal interception • Article 7 - Tools used for committing offences Criminal Law of the European Union - Is there a European criminal law in the sense that the EU acts as a sovereign state, formulates criminal acts, carries out criminal prosecution and sanctions perpetrators of criminal acts? - We could speak of European criminal law, when the EU protects its financial interests through legislation that is enforced on its members. - There is no comprehensive, self-contained European criminal law or justice system on its own, but more of an umbrella-like system that connects different entities, organs and EU legislations with the goal to investigate and prosecute transnational crimes. - Debates whether the EU should have its own Criminal Code - harmonizations and unification of criminal offences in the EU? - Article 83/1 TFEU the European Parliament and the Council may adopt directives to combat cross-border crimes that threaten the (economic) interests of the EU. The areas of crime that this criminal unification is possible is also defined in Article 83/1. These areas are the following: terrorism, trafficking in human beings and sexual exploitation of women and children, illicit drug trafficking, illicit arms trafficking, money laundering, corruption, counterfeiting of means of payment, computer crime and organized crime. Conclusion - For the purpose of prosecuting cyberwarfare attacks within the EU, there is no essential need to amend the EU legislation or to adopt new EU Directives on the criminal material level, as the adopted legislation already covers the main offences. However, current EU legislation is written mainly for purposes of normal cyberattacks (by hacker groups or individuals), it is not written for purposes of war attacks or war operations against member states of the EU