CYIL 2015

108

KRISTÝNA URBANOVÁ

CYIL 6 ȍ2015Ȏ

methods of warfare.

While the requirement of the state link in relation to criminal

responsibility for a crime of aggression might be correctly seen to be flawed, since

it ignores the reality that today “new wars” are increasingly conducted by non-state

actors, such an imperfection does not affect cyber-attack in a greater manner than

any other act of aggression committed by a non-state actor.

In relation to establishing criminal responsibility for an act of aggression committed

by a cyber-attack, the Prosecutor shall have to prove a necessary and sufficient

relationship between the private actor who possibly develops and executes the attack

and the state official who ordered the attack, gave the private actor instructions, or

financial and technological support, etc. It will be a task for the ICC judges to decide

whether the test of

effective control

proposed by the International Court of Justice in

the Nicaragua case,

or the test of

overall control

over non-state actors developed by the

ICTY judges in the Tadic

case shall be required for construction of the appropriate

link between the state official and the private individual. Since the ICC pursues the

same goal as the ICTY – to promote individual criminal accountability, the test of

overall control seemed to be a better option for establishing attribution,

but the

ICC judges can choose from both options.

While it might be objected that the factual private developers or executors of

the cyber-attacks thus escape punishment before the ICC, it is argued here that the

Rome Statute (and not only the part on the crime of aggression) was not designed

for prosecution of “ordinary” perpetrators, such as a low-ranked solider,

but rather

for punishment of those who stand at the highest rungs on the ladder. Employing

the Tadic test of overall control, such a result might be achieved for cyber-attacks as

well as for any other more conventional attacks constituting the act of aggression.

In cyber-attacks briefly outlined above in chapter 2, at least the state’s participation,

if not direct execution by a state, was under suspicion in each of the mentioned examples,

yet never has been proved. The question is whether the issues of state attribution would

be significantly different in case of a conventional attack committed by para-military

troops sponsored or supplied by a state. Not necessarily, for example investigation

of weaponry or other supply sources by a state might be comparable to a search

for supplying of technological support or funds necessary for the development of

malicious software. Even when non-state actors use the more classic kind of weapons,

BOAS, A.,

supra

note 4, p. 7.

International Court of Justice, Judgment of 27 June 1986,

Nicaragua v. United States of America

International Criminal Tribunal for the former Yugoslavia, Judgment of Appeal Chamber of 15 July

1999,

Prosecutor v. Dusko Tadic

, case no. IT-94-1-A.

GILLET, M., The Anatomy of an International Crime: Aggression at the International Criminal

Court,

International Criminal Law Review

, vol. 13, 2013, 829-864, p. 839.

See also Article 1 of the Rome Statute “An International Criminal Court (‘the Court’) is hereby

established. It shall be a permanent institution and shall have the power to exercise its jurisdiction over

persons for the most serious crimes of international concern”.