CYIL vol. 13 (2022)

CYIL 13 ȍ2022Ȏ ANIMUS AGGRESSIONIS: THE ROLE OF INTENT IN THE ANALYSIS OF ARMED … Hypothetical situation 1: State A conducts a cyber espionage operation against computers in State B by deploying spyware. In State B, however, this malware unintentionally causes the computer systems of a nuclear power plant to become inaccessible, forcing the plant to shut down, resulting in extensive material damage in State B. Hypothetical situation 2: State A conducts a cyber operation against State B to disable a specific radar at a well-specified airport (this fact follows from the way the malware was programmed) in order to allow a military aircraft to fly undetected over part of State B’s territory. However, there will be an unplanned spread of the malware to a number of commercial airports in State B where radars will also be decommissioned. This operation will result in the crash of a commercial aircraft and the deaths of several hundred people. Hypothetical situation 3: State A conducts a cyber operation against State B in order to disable all SCADA systems, 44 that have a user interface set to the language of State B (assuming it is a language officially used only in State B). This operation will result in widespread disruptions to the critical infrastructure of State B and associated material damage and loss of life. Assessing the intent through international criminal law framework From the perspective of the doctrine of scale and effects, one could easily conclude that the elements of armed attack were met in all three examples, since in each case there was extensive material damage or loss of life (the objective element). But what was the intention of the attacking State (subjective element)? It has already been shown in the first part of the article that animus aggresionis is a defining feature of an armed attack. If there is no animus aggressionis , there is no armed attack. The fulfilment of the objective element is derived from the extent of the consequences, and therefore the subjective element must also be examined in the sense of whether the attacker intended to cause those consequences (or at least was aware of the possibility of causing them, as will be explained below). However, neither international law, state practice nor the academic literature provide us with a clear answer to the question to what extent the consequences caused by a cyber operation can be attributed to the attacking state for the purposes of assessing the fulfilment of the subjective element of an armed attack. Given the presumption of animus aggressionis in kinetic operations and their high predictability, it was not previously necessary to address this question. In the case of cyber operations, however, this question became paramount. There is no choice but to try to find an answer outside the law of armed conflict. Fortunately, one solution is available – it can be found in Article 30 of the Rome Statute of the International Criminal Court. There can be no doubt about the close link between the law of armed conflict and international criminal law. Two of the four crimes enshrined in the Rome Statute (hereinafter “RS”) are even entirely dependent on the existence of armed conflict, namely war crimes and crime of aggression. 45 And it is the crime of aggression that can be of great assistance in assessing the subjective element of armed attack.

44 Supervisory Control and Data Acquisition systems. 45 Rome Statute of the International Criminal Court, art. 8 and art. 8 bis.

57