Cybercrimes: What Is and What Ought to Be? Rethinking the Role of Recklessness and Negligence in the International Criminal Court

By: Adi Libsker-Hazut.

A. Background

Methods and means of warfare have been evolving since the dawn of history. Attempts to develop new weapons or improve existing ones have often led to technological break-throughs. While the primordial man sharpened stone spears and arrowheads, nowadays, warfare develops and adopts online technological tools – cyber warfare.

Over the past few years, developments in the field of cyber warfare have led many experts to estimate that states will use their cyber means of warfare more and more over future conflicts, especially as they realize that cyber-attacks may bear more significant results. Unlike other weapons, the production and manufacturing costs of a cyber-attack is affordable, and available to most states. It goes without saying that developed countries increasingly rely on technological means to operate their infrastructure. Therefore, they expose themselves to harm and increase the potential for damage. [1]

The complexity in defining cyberspace and cyber warfare does not mean that this domain is lawless and out of control. Over the years, interested international parties have made efforts towards expanding, adjusting and renewing traditional legal doctrines in order to deal with the difficulties cyberspace and cyber warfare pose.[2] Few agreements and understandings were made in the international arena over the past decade, regarding cyber-attacks. Yet there are fundamental difficulties in the application of international Law to cyberspace. Most of the difficulties stems from the physical uniqueness of cyberspace. For example, can "cyber warfare" constitute an "armed conflict"?[3] The means of cyber warfare vary in many ways from traditional weapons, and are very difficult to define in physical terms. These are usually computer programs, or even just a part of a code designed to cause harm. [4] They do not exist outside the cyber dimension, cannot be seen, smelt, touched, heard or tasted. Therefore, at first sight we may be able to accept the claim that cyber operations are unarmed. [5] In the following section I wish to point out another fundamental difficulty in the application of International law to cyberspace, which surprisingly stems from the mental elements of the crimes.

B. The current legal situation (in International Criminal Law)

On 17 July 1998, 120 states passed the International Criminal Court Statute (also referred to as the 'Rome Statute').[6] On 1 July 2002, following the UN decision, the court’s statute entered into force, and, for the first time in the history of international law, the criminal court (ICC) was established as permanent.[7] Article 5 of the court’s statute decided which crimes would be within its jurisdiction. Article 5(1) limits the court authority to try only the most serious crimes.[8] This article also defines four categories of the crimes that fall under the court’s jurisdiction, as stated in article 5(1):

(a) The crime of genocide;

(b) Crimes against humanity;

(c) War crimes;

(d) The crime of aggression.[9]

Article 9 of the statute set a mechanism that determines what elements may constitute crimes within the court’s jurisdiction.[10] In September 2002, the “Elements of Crimes” were published.[11]

The International Criminal Court statute has, for the first time in international criminal law, defined the mental element required for imposing criminal liability. Until then, no international law, nor any international charter, included a definition of the mental element.[12]

In a nutshell, according to Article 30 of The Rome Statute, all crimes included in the statute are crimes whose mental element is a 'guilty mind'. That is, knowledge of the nature of the action, the existing circumstances, and the possible consequences, as detailed in the particulars of the crime; As for the consequences, if included in the definition of the crime, an intent to cause those consequences, or, at the least, an awareness of their probability.[13]

Indeed, the most obvious lacunas are:

• Recklessness – that is, indifference to the possible consequences; or care-less-ness – taking an unreasonable risk with the intention of preventing such consequences from happening.
• Negligence – that is, an unawareness of behavior, circumstances or the possible consequences.
• Strict or Absolute Liability – that is, crimes that do not rely on evidence of guilty mind or negligence.

It is worth mentioning that a definition of recklessness was included in the court statute draft, under Article 29.[14] In the final text of the statute, however, the definition of recklessness was removed, because it was redundant.[15]

During the discussions, the issue of negligence, unlike that of recklessness, did not come up at all. It seems all parties agreed that international criminal law should not deal with crimes of negligence. Such crimes are simply not severe enough.

The perception of crimes of negligence and recklessness as less severe offences is based on a deontological idea, emphasizing one’s unintentional act and not the consequences of his act. However, from a teleological viewpoint that focuses on the consequences, negligent acts may be just as severe, or even worse than unintentional acts.[16]

Very little attention was given to how the Elements of Crimes ignore the element of negligence and recklessness. Many of the crimes in international criminal law have horrible consequences.[17] Don't these consequences justify giving precedence to teleological considerations over deontological ones? Is it not right and just to determine negligent genocide a crime?

In my humble opinion, the international community should consider crimes of negligence more seriously. However, this is not the aim of my study. My argument is of a more modest nature – I want to know whether the unique characteristics of cyber warfare justify and even necessitate an acknowledgement of the element of negligence and recklessness.

C. The Proper Legal Condition in Light of Technological Advances

In the following section I wish to examine whether the unique characteristics of cyber warfare justify expanding international criminal law to also include crimes of negligence and crimes of recklessness.

It is important to keep in mind that this is a work in progress, and that some of the following ideas have not yet fully ripened and are still incomplete.

1. The pace of developments and innovations – Unlike the physical world – which we are equipped to know and deal with – the cyber dimension is a new manmade dimension. The physical world has barely changed since the very beginning of human history, but the rate of change and innovation in the cyber dimension is very high.[18] In the physical world, each action may have unexpected consequences, but we know and can predict their absolute majority. In contrast, the consequences of a cyber-dimension action are unpredictable and very hard to anticipate.[19] Therefore, in order to uphold a higher standard of conduct within cyberspace, the international criminal law ought to ensnare those who were unaware of conduct, circumstances, or the possible consequences of their actions.

2. Internet of Things – In the near future, we will be able to see our cars communicate with the air conditioner and fridge in our homes, the shutters interact with the alarm clock on our cellphones, and our grandfather’s pacemaker will communicate with emergency services and his doctor's laptop.[20] We expect the network will expand as more and more objects can gather and exchange information.[21]

This communication may be very beneficial, but it carries with it an enormous potential for damage. A cyber weapon that infiltrates an appliance may cause massive damage by interacting with another appliance that wasn’t even a target.[22] Should we exempt the warring parties from taking a closer look at the possible consequences of whatever means of cyber warfare they use, we will not be able to prevent the terrible catastrophes that may be the result of negligent or reckless acts.

3. The Various Violated Rights – if someone was to point a missile, gun, knife or grenade our way, the possible consequences would be immediately obvious both to them and to us – we would know that our lives, health or property could come to harm.[23]

However, imagine a case in which a cyber weapon erases you from all governmental systems of information. You no longer exist, cannot leave the state, open a bank account, own a credit card, purchase a car, get married, work, file a legal complaint, and even your children are no longer yours.[24] Now imagine something like that happening to millions of people across the state simultaneously.

In fact, a well-planned and well-executed cyber-attack can damage every possible human right we can think of. With the press of a button, an attacker may violate over thirty such rights. Unless we include recklessness and negligence in international bans, criminals could easily defend themselves with the claim that they only meant to violate a non-protected right, and unintentionally violated protected rights as well.

4. Artificial intelligence – is, in fact, independent,[25] and therefore we cannot lay the blame with its programmer, even if it commits a crime against humanity.[26] Programmers allegedly had no intention that their actions would result in such terrible consequences. Let’s say, for example, that a state develops artificial intelligence that can independently identify an existential threat, and then launches weapons of mass destruction against its enemy. The AI misevaluates the situation as war, and independently launches weapons of mass destruction. Would we want and expect international law to capture the AI’s programmers and operators, who relinquished all human judgement by setting off weapons of mass destruction? Without including recklessness and negligence in the law, it would hardly be possible.

5. Fog of battle – Cyber warfare allows its “combatants” to fight from the comfort and safety of an airconditioned room, far from the battlefield, far from the Fog of War, and its stress and anxiety.[27]

In such cases, the implementation of International Criminal Law may also be applied to crimes of negligence and recklessness for two central reasons:

1. This situation justifies a less forgiving approach toward errors and mistakes that result in damages.
2. This situation may also cause an emotional disconnect between the combatant and the outcomes of the warfare itself, and thus increase risk and cause unnecessary suffering and needless harm.[28]

Adding the elements of negligence and recklessness to International Criminal Law will set a higher moral bar and reduce the potential danger that lies in emotional disconnect.

D. Conclusion

History teaches us that International Criminal Law oftentimes cannot realize its aspirations. This powerlessness is the result of the contractual components of international law, the absence of any real investigation and enforcement, and the dependency on strong countries and their budgets. It is hard not to surmise that International Criminal Law is often used as a tool by the winning sides of any war, and oftentimes international law is harshly criticized – albeit not always justly – for its levels of objectivity and neutrality. [29]

Despite the impotence of International Criminal Law, I do believe that its declarative values still rise in this age of globalization. The internet, global communication, and international culture lessen the national effects. Incompliance with the norms of international law incurs criticism from both within and without the state, and may have significant effects on its economic and national and international political fields. Thus, impotence within a limited legal framework does not equate to impotence in the field of culture.

Under these circumstances, I do believe that the practical difficulties of locating criminals and proving their actions in the cyber-dimension should not discourage regulation in this matter. Especially now, as this field gains momentum, it is important that criminal law pay attention to cyber warfare.[30] Additionally, we should examine whether the existing toolset (norms and laws) of International Criminal Law are sufficiently satisfactory and clear in light of the unique characteristics of cyber warfare, which includes innovative technology.[31] In my humble opinion, and as I have tried to show so far, in this context it is highly important to include crimes involving the mental element of recklessness and negligence. Though such a step may be strictly declarative, its influence over the future war field and the actions of the warring sides cannot be understated.

[11] Preparatory Commission for the Int'l Criminal Court, Finalized Draft Text of the Elements of Crimes,U.N. Doc. PCNICC/2000/I/Add.2 (Nov. 2, 2000), Available at :http://www.icc-cpi.int/NR/rdonlyres/ADD16852-AEE9-4757-ABE79CDC7CF02886/283503/RomeStatutEng1.pdf [Accessed: 16 February 2019].