Scenario 19: Hate speech

From International cyber law: interactive toolkit
Jump to navigation Jump to search
Image by Gerd Altmann from Pixabay (CC-0)

State A uses a social media platform headquartered in State B to incite racial and religious hatred against an ethnic and religious minority in its own territory. The resulting violence escalates into a non-international armed conflict involving cyber operations between State A and members of the ethnic and religious minority who organise themselves into an armed opposition group. The scenario analyses whether the incidents amounted to violations of international law, including international human rights law, international humanitarian law and international criminal law.

Scenario[edit | edit source]

Keywords[edit | edit source]

International human rights law, international humanitarian law, prohibition of genocide, non-international armed conflict, attacks against persons, individual criminal responsibility, hate speech, incitement of violence

Facts[edit | edit source]

[F1] Security agents of State A use a globally operating social media platform to spread hate speech against an ethnic and religious minority in the same State. The social media platform does not have a physical office in the territory of State A, but it directs its operations from its global headquarters in State B. Over a period of several years and with increasing intensity, the security agents use fake accounts, news pages, and trolls on the social media platform to spread false, inflammatory information about the religious and ethnic minority, labelling it as “ethnically inferior”, “terrorist”, “criminal” and “existential threat to State A that must be eliminated”. A high-ranking security official also posts on his profile that “the problem regarding the ethnic and religious minority will be solved soon”.

[F2] An independent international fact-finding commission establishes that this spread of inflammatory misinformation was a decisive factor in contributing to mass violence targeting the ethnic and religious minority, including killings, inhumane treatment, torture, and rape. It finds that these acts were perpetrated by non-State organisations representing the ethnic and religious majority and often aided or abetted by the military forces of State A. The government of State A does not take any measures to stop the spread of the misinformation by its security agents. Despite calls by civil society for the social media platform and State B to take action, the social media platform reacts only slowly in taking down the relevant pages and fake accounts. State B emphasises that the imposition of laws against hate speech would violate the freedom of speech as guaranteed under its constitution.

[F3] In response to the mass violence, the members of the ethnic and religious minority form an armed opposition group, Group C, which is headquartered in and assumes control over a province in State A that is predominantly populated by the ethnic and religious minority. Group C, led by several commanders appointed by the group’s General Staff, launches armed counterattacks against both the military of State A and associated non-State organisations with the proclaimed aim “to liberate the ethnic and religious minority from the systematic and violent oppression by State A”. As a result, those different actors engage in protracted armed violence, which causes a large-scale displacement of persons. To stop the spread of inflammatory misinformation about the ethnic and religious minority, hackers who are part of the armed opposition group attack government servers in State A, which are used by the security agents to disseminate the misinformation, by infiltrating them with ransomware. Because of the attack, the government servers lose their functionality, which also affects civilian infrastructure such as hospitals.

[F4] State A and State B are parties to the International Covenant on Civil and Political Rights (ICCPR),[1] the International Convention on the Elimination of All Forms of Racial Discrimination (ICERD),[2] the Convention on the Prevention and Punishment of the Crime of Genocide (the ‘Genocide Convention’),[3] the 1949 Geneva Conventions and Additional Protocols I (AP I) and II (AP II) thereto,[4] as well as the Rome Statute of the International Criminal Court (the ‘Rome Statute’).[5]

Examples[edit | edit source]

Legal analysis[edit | edit source]

For a general overview of the structure of analysis in this section, see Note on the structure of articles.

[L1] Focusing on the spread of hate speech on social media,[6] the analysis first examines whether State A and State B could be held internationally responsible for violations of international human rights law and the prohibition of genocide. In view of the possible escalation of the violence into an armed conflict, the analysis then discusses the international responsibility of State A for violations of international humanitarian law. Lastly, the individual criminal responsibility of State A’s security agents and Group C is considered.

[L2] The scenario assumes that the conduct of the security agents was attributable to State A. Pursuant to Article 4 of the ILC Articles on State Responsibility for Internationally Wrongful Acts, the conduct of any State organ, irrespective of its position within the State, its functions and its character as an organ within the central government or territorial unit, shall be considered an act of that State. Security agents of a State undoubtedly qualify as organs of that State. Therefore, any act of State A’s security agents is attributable to State A. According to Article 7 of the ILC Articles on State Responsibility, this is so even if the security agents exceed their authority or contravene instructions.

Violations of international human rights law applicable to cyber operations[edit | edit source]

International human rights law
International human rights law applies in cyberspace; individuals enjoy the same human rights online as they enjoy offline.[7] States are therefore bound by their human rights obligations to respect, protect and fulfil human rights in cyberspace. States also bear international responsibility for the violation of human rights obligations that are attributable to them.[8]

The source of these obligations is primarily treaty law. The two key global treaties are the International Covenant on Civil and Political Rights (ICCPR) and the International Covenant on Economic, Social and Cultural Rights (ICESCR);[9] many of these treaties’ provisions, along with the provisions of the Universal Declaration of Human Rights, are regarded as reflective of customary international human rights law, even though there is no universally accepted codification. Apart from the ICCPR and ICESCR, there are important regional human rights treaty systems, especially for Europe (based on the European Convention on Human Rights – ECHR),[10] the European Union (Charter of Fundamental Rights of the European Union – EUCFR),[11] America (American Convention on Human Rights – ACHR),[12] and Africa (African Charter on Human and Peoples’ Rights – ACHPR),[13] which provide for adjudicatory mechanisms by which individuals can assert their human rights against States and which have generated a considerable amount of case-law as a result.

In order to determine whether a State has breached its human rights obligations, the following steps of analysis should be conducted:

  1. Since cyber operations often take place in the cyber infrastructure of multiple States, the issue of jurisdiction must be addressed. Each human rights treaty has its own bespoke jurisdictional requirements and scope. In this regard, every State party to the ICCPR has undertaken “to respect and to ensure to all individuals within its territory and subject to its jurisdiction the rights recognized in the [ICCPR]”.[14] The UN Human Rights Committee (UN HRC) has understood this provision to mean that the human rights obligations recognized within the ICCPR apply not only to persons physically located within a State’s territory, but also to situations where the State exercises “power or effective control” either over the territory on which an individual is located (the spatial model of jurisdiction) or over the individual (the personal model of jurisdiction).[15] Likewise, the International Court of Justice (ICJ) has stated that the ICCPR “is applicable in respect of acts done by a State in the exercise of its jurisdiction outside its own territory”.[16] A few States (such as the US and Israel) have adopted the contrary view and maintain that human rights obligations do not apply extraterritorially. To date, however, these States remain in the minority.[17] As such, although the exact criteria for the applicability of human rights obligations to extraterritorial activities of States are not settled and are subject to ongoing academic and political debate,[18] the prevailing opinion at present is that human rights obligations do apply to some acts of a State outside its territory.[19]
  2. If an international human rights regime is applicable, the second question is whether a cyber operation attributable to a State constitutes an interference with a particular human right. The human rights that are often implicated by cyber operations include the right to privacy[20] and the right to freedom of opinion and expression.[21] Other rights such as the freedom of association,[22] the prohibition of discrimination, the right to life, to health or other social and economic rights may be also affected by cyber operations or cyber-related measures.[23] If the right in question is absolute – such as the right to be free from torture or slavery – then no interference with it is allowed.[24]
  3. For an interference with a qualified right – such as the right to privacy or to freedom of expression – to be legal under human rights law, it must fulfil certain conditions, namely:
    1. be in accordance with an accessible and foreseeable domestic law (“legality”),
    2. pursue a legitimate aim of public interest (such as national security, public order, public health, or morals) or for the protection of rights of others,
    3. be necessary to achieve that aim, and
    4. be proportionate in balancing the means and the end.[25]

Apart from the responsibility for human rights violations attributed to it, a State can also be held responsible for its failure to take all reasonable measures to protect the human rights of individuals in its territory and subject to its jurisdiction (for instance, if it unlawfully allows non-State actors to violate human rights).[26]

Publicly available national positions that address this issue include: Common position of the African Union (2024) (2024), National position of Australia (2020) (2020), National position of Canada (2022) (2022), National position of Costa Rica (2023) (2023), National position of the Czech Republic (2020) (2020), National position of Estonia (2021) (2021), National position of Finland (2020) (2020), National position of Ireland (2023) (2023), National position of the Italian Republic (2021) (2021), National position of Japan (2021) (2021), National position of Kazakhstan (2021) (2021), National position of Kenya (2021) (2021), National position of the Netherlands (2019) (2019), National position of New Zealand (2020) (2020), National position of Norway (2021) (2021), National position of the Republic of Poland (2022) (2022), National position of Romania (2021) (2021), National position of the Kingdom of Sweden (2022) (2022), National position of Switzerland (2021) (2021), National position of the United Kingdom (2021) (2021), National position of the United States of America (2012) (2012), National position of the United States of America (2016) (2016), National position of the United States of America (2021) (2021).

[L3] Although the security agents of State A used a social media platform that is headquartered in State B, the spread of inflammatory information took place in the territory of State A. The posts by State A’s security agents distinguished the minority inter alia based on ethnic origin. In addition, as the independent international fact-finding commission found, the dissemination of incendiary misinformation on the social media platform contributed to mass violence targeting the minority, which impeded their enjoyment of the right to life, the freedom from torture and possibly other human rights. The spread of inflammatory misinformation could thus be characterized as “racial discrimination” as defined in Article 1 of the ICERD.[27]

[L4] In terms of the specific obligations under the ICERD, it is conceivable that State A’s spread of inflammatory misinformation about the ethnic and religious minority violated its obligation set out in Article 2(a) of the ICERD. The provision prescribes that “[e]ach State Party undertakes to engage in no act or practice of racial discrimination against persons, groups of persons or institutions and to ensure that all public authorities and public institutions, national and local, shall act in conformity with this obligation”. By posting incendiary content and by aiding or abetting the discriminatory acts of non-State organisations representing the ethnic and religious majority, State A could have also violated its obligation “not to sponsor, defend or support racial discrimination by any persons or organizations” under Article 2(b) of the ICERD.

[L5] Moreover, State A might be internationally responsible for its failure to act. Pursuant to Article 2(c) of the ICERD, State A was under an obligation “to review governmental, national and local policies, laws and regulations and to amend, rescind or nullify any laws and regulations which have the effect of creating or perpetuating racial discrimination”. Such laws and regulations would include any internal policies against the ethnic and religious minority pursued by the State’s security apparatus. As State A failed to take measures to stop the spread of discriminatory information via the social media platform, it could have also violated its obligation under Article 4 of the ICERD to “condemn all propaganda and all organizations which are based on ideas or theories of superiority of one race or group of persons of one colour or ethnic origin” and to “undertake to adopt immediate and positive measures designed to eradicate all incitement to, or acts of, such discrimination”. Moreover, this conduct could also imply a breach of Article 20(2) of the ICCPR, which states that ‘any advocacy of national, racial or religious hatred that constitutes incitement to discrimination, hostility or violence shall be prohibited by law’, read together with State A’s obligation under Article 2(1) of the ICCPR to ‘respect and to ensure to all individuals within its territory and subject to its jurisdiction the rights recognized in the [Covenant], without distinction’.

[L6] Obligations under international human rights treaties do not directly bind corporations such as the social media platform.[28] To the extent that the social media platform did not take sufficient measures to prevent and end the spread of hate speech about the ethnic and religious minority, the platform could only be said to have acted inconsistently with its ‘responsibility’ to respect human rights under the non-binding UN Guiding Principles on Business and Human Rights.[29]

[L7] It could also be examined whether State B is internationally responsible for having failed to prevent and stop the spread of inflammatory misinformation. State B’s international responsibility might be based be on a breach on Article 2(d) of the ICERD, which prescribes that “[e]ach State Party shall prohibit and bring to an end, by all appropriate means, including legislation as required by circumstances, racial discrimination by any persons, group or organization”, and on the above-mentioned Article 4 of the ICERD (see para. L5). Moreover, Article 20(2) of the ICCPR includes the broader prescription that “[a]ny advocacy of national, racial or religious hatred that constitutes incitement to discrimination, hostility or violence shall be prohibited by law”.[30] State A disseminated inflammatory misinformation about the ethnic and religious minority over the course of several years. During that time, State B could have taken and enforced legislative measures to prevent or halt the incitement to racial or religious hatred through a social media platform based on its territory.[31] According to the interpretative guidance provided by the respective United Nations committees, the prescriptions under Article 4 of the ICERD and Article 20 of the ICCPR are fully compatible with the right of freedom of expression.[32] This suggests that it should be possible to enact hate speech laws that can be reconciled with the freedom of speech under the constitution of State B.[33]

[L8] Nonetheless, it is controversial whether the ethnic and religious minority in State A was subject to the jurisdiction of State B, which is necessary to trigger the applicability of the pertinent human rights obligations. The issue of the extraterritorial application of human rights obligations is governed by the relevant human rights treaties.[34] There is “no restriction of a general nature in [I]CERD relating to its territorial application”.[35] It could thus be argued that the obligations of State B under ICERD are triggered by the failure to prevent or stop the spread of inflammatory misinformation. In contrast, the ICCPR will likely not be applicable in the present scenario. State B only had spatial jurisdiction over the social media platform, which was operating from its territory.[36] The social media platform might have played a detrimental role in interfering with the ethnic and religious minority’s right to non-discrimination,[37] which underlies the obligation to enact legislation against discrimination in Article 20 of the ICCPR.[38] However, the minority was not subject to the physical control of State B.[39]

Violations of the prohibition of genocide through cyber means[edit | edit source]

Prohibition of genocide
The prohibition of genocide is a norm of customary international law and has the status of a peremptory norm of general international law (jus cogens),[40] which is also applicable in relation to cyber operations.[41] The prohibition of genocide applies to States and individuals.[42]

Article I of the Convention on the Prevention and Punishment of the Crime of Genocide (the ‘Genocide Convention’) specifies that “genocide, whether committed in time of peace or in time of war, is a crime under international law” and that the contracting parties to that Convention undertake to prevent and to punish it.[43] While these obligations are incumbent on all contracting parties, the International Court of Justice (ICJ) noted with regard to the obligation to prevent genocide that it depends on the State’s “capacity to influence effectively the action of persons likely to commit, or already committing genocide” and “varies greatly from one State to another”.[44]

The definition of the crime of genocide contained in Article II of the Genocide Convention is widely considered as authoritative,[45] and reads as follows: “genocide means any of the following acts committed with intent to destroy, in whole or in part, a national, ethnical, racial or religious group, as such: (a) Killing members of the group; (b) Causing serious bodily or mental harm to members of the group; (c) Deliberately inflicting on the group conditions of life calculated to bring about its physical destruction in whole or in part; (d) Imposing measures intended to prevent births within the group; (e) Forcibly transferring children of the group to another group.”

The definition of genocide thus consists of two elements: the “intent to destroy, in whole or in part, a national, ethnical, racial or religious group” stated in the opening clause, and the individual act.[46] The list of the individual acts of genocide is exhaustive.[47] Article III of the Genocide Convention further sets forth the different modes of liability and inchoate offences that shall be punishable, namely: (a) genocide; (b) conspiracy to commit genocide; (c) direct and public incitement to commit genocide; (d) attempt to commit genocide; and (e) complicity in genocide.

[L9] The spread of inflammatory misinformation via the social media platform might be in violation of State A’s obligations under the Genocide Convention and the prohibition of genocide under customary international law. The killings, inhumane treatment, torture, and rape committed against the ethnic and religious minority could potentially qualify as genocide under Article II(a)–(c) of the Genocide Convention.

[L10] While the acts in question were committed by members of non-State organisations representing the ethnic and religious majority, State A could be responsible for direct and public incitement to commit genocide under Article III(c) of the Genocide Convention.[48] Evidence of an intent to destroy the ethnic and religious minority in whole or in part may be found in the labelling of the ethnic and religious minority on the social media platform as “ethnically inferior”, “terrorist” and “criminal” and an “existential threat to State A that must be eliminated” by the security agents of State A, as well as in the post by a high-ranking security official that “the problem regarding the ethnic and religious minority will be solved soon”. The relevant posts were public because they were made on the social media platform.[49] The directness criterion may be fulfilled even if the State in question does not explicitly call for genocide.[50] However, State A would have to “specifically provoke another to engage in a criminal act”, which is more than “a mere vague or indirect suggestion”,[51] i.e. there would have to be a causal connection.[52] The post that the ethnic and religious minority was an “existential threat to State A that must be eliminated”, within the broader context of the campaign of spreading ethnic and religious hatred over a period of several years, could potentially fulfil this criterion.[53] As an inchoate crime, direct and public incitement to genocide does not necessitate that genocide actually follows.[54]

[L11] State A could have also breached its obligation to prevent genocide or the prohibition to be complicit in its commission.[55] While complicity in genocide presupposes actual knowledge of and aid or assistance in an imminent or ongoing genocide, the obligation to prevent genocide only requires the State to know of the serious risk that genocide may be committed.[56] As established by the independent international fact-finding commission, the spread of the inflammatory misinformation decisively contributed to potentially genocidal acts committed against the ethnic and religious minority. That finding indicates that State A had sufficient knowledge of the risk in question to suggest that it may have violated its duty to prevent genocide. In addition, not only did the military forces of State A fail to stop these acts from happening, but they also aided and abetted the perpetrators. State A may thus also have violated the prohibition to be complicit in the commission of genocide. Unlike incitement to genocide, a violation of the obligation to prevent genocide and complicity in genocide require that genocide actually took place.[57]

[L12] Other States parties to the Genocide Convention might equally be under an obligation to prevent the potential genocide in State A.[58] As highlighted by the calls by civil society, State B arguably had the capacity to stop the spread of inflammatory misinformation,[59] for example, by ordering the social media platform to take down the illegal content.[60] Given the status of the prohibition of genocide as a jus cogens norm, all States and international organizations are under an obligation cooperate to bring to an end through lawful means any serious breach of that norm,[61] and not recognize as lawful a situation created by the serious breach, nor render aid or assistance in maintaining that situation.[62] Accordingly, State B’s failure to act may have amounted to a violation of the said obligations under international law.

Violations of international humanitarian law applicable to cyber operations[edit | edit source]

Non-international armed conflict
The law of non-international armed conflict (NIAC) applies to all armed conflicts not of an international character.[63] As set forth by the ICTY Appeals Chamber in the Tadić case, NIACs are situations of “protracted armed violence between governmental authorities and organized armed groups or between such groups within a State”.[64]

This definition rests on two factors—the intensity of the fighting and the organization of the non-State group.[65] First, the hostilities between the parties must reach a certain level of intensity, which may be indicated by, among other factors, the seriousness and frequency of attacks and military engagements, the extent of destruction, or the deployment of governmental armed forces.[66] Second, the non-State group must have some minimum level of organization, indicators of which may include the presence of a command or leadership structure, the ability to determine a unified military strategy and speak with one voice, the adherence to military discipline, as well as the capability to comply with IHL.[67]

These same criteria of intensity and organization apply in situations involving (or even limited to) cyber operations.[68] However, cyber operations alone will only rarely meet the requisite level of intensity to trigger a NIAC.[69]

Publicly available national positions that address this issue include: Common position of the African Union (2024) (2024), National position of Costa Rica (2023) (2023), National position of Finland (2020) (2020), National position of France (2019) (2019), National position of Germany (2021) (2021), National position of Ireland (2023) (2023), National position of Japan (2021) (2021).

[L13] The hostilities between State A and Group C will likely meet the definition of a NIAC involving cyber operations, which triggers the applicability of international humanitarian law. The hostilities between State A and Group C led to protracted armed violence that caused a large-scale displacement of persons, thus reaching the level of intensity required for a NIAC.[70] In addition, the attacks by Group C on the government servers significantly damaged civilian infrastructure, which further speaks to the severity of the fighting.[71] Group C also had the necessary organisation to fulfil the second criterion for a NIAC. The group was headquartered in a particular province of State A, which it largely controlled.[72] It spoke with one voice,[73] and it acted under a unified command with a hierarchical structure led by a General Staff that clearly proclaimed the strategic aim of the group,[74] namely “to liberate the ethnic and religious minority from the systematic and violent oppression by State A”.


Attacks against persons

The principle of distinction is one of the fundamental principles of international humanitarian law and has the status of customary international law.[75] It obliges parties to an armed conflict to distinguish at all times between civilians and combatants.[76]

It is prohibited to direct an attack against civilians.[77] Furthermore, intentionally directing attacks against the civilian population or against individual civilians not taking direct part in hostilities qualifies as a war crime.[78] Acts or threats of violence that primarily aim at spreading terror among the civilian population are also prohibited.[79]

According to Article 48 AP I, parties to an armed conflict may “direct their operations only against military objectives”. Attacks may be directed against combatants insofar as they are positively distinguished from civilians and qualify as military objectives.[80] Civilians are protected from attack unless and for such time as they directly participate in hostilities.[81]

The principle of distinction is closely linked to the principle of proportionality.[82] The principle of proportionality prohibits attacks that may be expected to cause incidental injuries, death or destruction to civilians or civilian objects (incidental civilian harm), which would be excessive in relation to the concrete and direct military advantage anticipated.[83] Put differently, belligerents are obliged to refrain from attacks even against those persons who otherwise qualify as military objectives if such attacks are expected to cause disproportionate incidental civilian harm.[84]

Overall, an attack against a person may be lawful if it is directed at a combatant or a civilian directly participating in hostilities, without causing any incidental civilian harm. An attack against such a person, which does result in incidental civilian harm, may additionally be lawful if the expected incidental harm is not excessive in relation to the anticipated military advantage.

Publicly available national positions that address this issue include: Common position of the African Union (2024) (2024), National position of Costa Rica (2023) (2023).

[L14] It is unlikely that State A would have violated the prohibition to attack the civilian population through its involvement in the spread of hate speech against the ethnic and religious minority. Incitement to racial and religious hatred by cyber means per se does not qualify as an attack against the civilian population. Such incitement might rather be compared to other non-violent cyber operations such as psychological cyber operations and cyber espionage, which are not considered to be attacks.[85] State A could also submit that the spread of misinformation was a permitted ruse of war, for example, by leading Group C to falsely assume that that military operations are imminent or on-going.[86]

[L15] Even if the dissemination of inflammatory posts on the social media platform during the NIAC did not qualify as an attack, the threat of a kinetic attack by cyber means could violate the prohibition to spread terror among the civilian population.[87] A credible proclamation by a party to the conflict that “threaten[s] the annihilation of civilian populations” qualifies as a prohibited threat of violence.[88] In that regard, it is material that the security agents of State A called the ethnic and religious minority “criminal”, “terrorist”, “ethnically inferior” and, in particular, an “existential threat to State A that must be eliminated”. These proclamations, insofar as they were made in the context of an armed conflict, may therefore have violated the prohibition of threats of violence aimed at terrorizing the civilian population.

[L16] In addition, State A could have breached Common Article 1 of the Geneva Conventions, which provides that “[t]he High Contracting Parties undertake to respect and to ensure respect for the present Convention in all circumstances”. This obligation implies that they “may neither encourage, nor aid or assist in violations of the Conventions”,[89] including provisions that are applicable in NIACs such as the prohibition of acts of violence to life and person under Common Article 3.[90] The spread of misinformation by State A with a view to inciting violence against the ethnic and religious minority during the NIAC could be understood as such encouragement to violate the Geneva Conventions.[91]

Violations of international criminal law applicable to cyber operations[edit | edit source]

Individual criminal responsibility under international law
Acts committed by cyber means could lead to individual criminal responsibility under international criminal law for genocide (Article 6 of the Rome Statute),[92] crimes against humanity (Article 7 of the Rome Statute), war crimes (Article 8 of the Rome Statute) and aggression (Article 8 bis of the Rome Statute).[93] Individual criminal responsibility for each of these offences requires that the perpetrator committed the requisite actus reus with the corresponding mens rea.[94]

Pursuant to Article 25(3)(a) of the Rome Statute, different forms of incurring individual criminal responsibility may be envisaged: (1) individual commission; (2) joint commission; and (3) commission through others.[95] Criminal responsibility could also arise for instigating, assisting in, facilitating, and aiding or abetting the commission, or attempted commission by cyber means (Article 25(3)(b)-(d) of the Rome Statute). Furthermore, Article (3)(f) of the Rome Statute envisages individual criminal responsibility for attempts to commit a crime when the crime does not occur because of circumstances independent of the person’s intentions.

According to the Tallinn Manual 2.0, the principle of command responsibility, as stipulated in Article 28 of the Rome Statute and established in customary international law,[96] applies to cyber operations.[97]

[L17] The security agents and the military forces of State A as well as the members of Group C could incur individual criminal responsibility for their acts committed by cyber means.


Crime of genocide
The prohibition of genocide applies to States and individuals,[98] and it extends to operations and activities in cyber space.[99] While individuals may be held criminally responsible for genocide under Article 6 of the Rome Statute, the provision replicates the definition of the crime of genocide contained in Article II of the Convention on the Prevention and Punishment of the Crime of Genocide (the ‘Genocide Convention’),[100] which is widely considered to be authoritative.[101] It consists of two elements: the intent to destroy, in whole or in part, a national, ethnical, racial or religious group, and at least one of the requisite acts included in the exhaustive list in Article II.[102]

Article 25(3)(e) of the Rome Statute further provides that a person may be criminally responsible for directly and publicly inciting others to commit genocide.[103] Based on the Genocide Convention, a Trial Chamber of the International Criminal Tribunal for Rwanda defined direct and public incitement to genocide “as directly provoking the perpetrator(s) to commit genocide” through various means, including “audiovisual communication”.[104] It further explained that the “mens rea required for the crime of direct and public incitement to commit genocide lies in the intent to directly prompt or provoke another to commit genocide”, which implies that the perpetrator himself or herself intends to commit genocide.[105] Direct and public incitement to genocide is punishable even if it is unsuccessful.[106]

[L18] By spreading inflammatory misinformation on the social media network, the security agents of State A might be individually criminally responsible for directly and publicly inciting genocide pursuant to Articles 6 and 25(3)(e) of the Rome Statute.[107] Among the different “channels of communication” to incite genocide, social media could be considered particularly effective.[108] The labelling of the ethnic and religious minority as an “existential threat to State A that must be eliminated” and the post that “the problem regarding the ethnic and religious minority would be solved soon” might support a finding that the security agents, including their commanders, had the required intent to provoke or prompt to commit genocide.[109] While the killings, rape and torture of the ethnic and religious minority could be considered to amount to genocide on the different grounds of Article 6 of the Rome Statute, the commission of genocide is not required for a conviction for incitement to genocide.[110]


Crimes against humanity
Individuals may incur criminal responsibility for crimes against humanity based on Article 7 of the Rome Statute, which can be committed through cyber operations or cyber means.[111] As provided for in the chapeau to Article 7(1) of the Rome Statute, for an act to constitute a crime against humanity it must be “committed as part of a widespread or systematic attack directed against any civilian population, with knowledge of the attack”. Article 7(2)(a) of the Rome Statute further defines the term “[a]ttack directed against any civilian population” as “a course of conduct involving the multiple commission of acts referred to in paragraph 1 against any civilian population, pursuant to or in furtherance of a State or organizational policy to commit such attack”.[112] The attributes “widespread or systematic” are disjunctive.[113] The term “widespread” refers to the geographical scope of the attack and the number of victims.[114] The systematic nature of the attack refers to “the organised nature of the acts of violence and the improbability of their random occurrence”.[115]

Several of the acts listed in Article 7(1) of the Rome Statute could be committed by cyber means. When cyber operations are used to attack the civilian population and lead to the loss of life, the perpetrators could be responsible for murder under Article 7(1)(a) of the Rome Statute, provided that they had the intent to kill one or more persons.[116] Cyber means could also be used to persecute an identifiable group or collectivity on one of the prohibited grounds listed in Article 7(1)(h) of the Rome Statute.[117] Article 7(2)(g) specifies that persecution “means the intentional and severe deprivation of fundamental rights contrary to international law by reason of the identity of the group or collectivity”. The necessary mental element is the intent to discriminate.[118] It is also conceivable that an individual is criminally responsible for using cyber means to commit “[o]ther inhumane acts of a similar character intentionally causing great suffering, or serious injury to body or to mental or physical health” under Article 7(1)(k) of the Rome Statute. This residual provision suggests that the list of expressly named acts is not exhaustive.[119]

[L19] Considering the mass violence against the ethnic and religious minority in State A, it could be examined whether the security agents and members of the military forces of State A are responsible for crimes against humanity pursuant to Article 7 of the Rome Statute. In this context, the incitement to racial and religious hatred on the social media platform could arguably be part of a widespread and systemic attack directed against a particular part of civilian population, which included different acts that qualify as crimes against humanity listed in Article 7(1) of the Rome Statute. Those acts happened over a period of several years and seemed to have been part of a State or organisation policy to commit an attack against the civilian population, notably the ethnic and religious minority.[120]

[L20] An argument could be made that the spread of hate speech, and in particular the incitement to violence, amounted to persecution under Article 7(1)(h) of the Rome Statute.[121] The posts on the social media platform took place “in connection with any act referred to in this paragraph 1 or any crime within the jurisdiction of the Court”, namely killings, torture and inhumane treatment and rape committed against the ethnic and religious minority.[122] To constitute persecution, the incendiary social media campaign against that minority, which clearly is an identifiable group or collectivity, should also meet the required threshold of gravity as defined in Article 7(2)(g) of the Rome Statute.[123] It would have to be determined to which extent the posts labelling the ethnic and religious minority as “existential threat to State A that must be eliminated” deprived the minority of its fundamental rights, such as the right to security.[124] In this regard, the independent international fact-finding commission’s conclusion that such posts were a decisive factor in contributing to mass violence targeting the ethnic and religious minority is relevant. It then remains to be established whether State A’s security agents had discriminatory intent and were aware of the detrimental impact of those posts.[125]

[L21] It might also be argued that State A’s security agents, by posting of inflammatory misinformation, could be criminally responsible for instigating crimes against humanity as a mode of liability prescribed by Article 25(3)(b) of the Rome Statute. Instigation means “prompting another to commit an offence”,[126] which implies a causal nexus between the instigation and the commission of the crime.[127] In the present scenario, the relevant crimes under Article 7(1) of the Rome Statute, which were committed by the non-State organizations, include murder (subparagraph (a)), torture (subparagraph (b)) and rape (subparagraph (g)). State A’s security agents did not order the crimes, but Article 25(3)(b) also encompasses solicitation and inducement, which could possibly cover the inflammatory posts on the social media platform. While State A’s military forces might have “aided” in the commission of such crimes against humanity,[128] the continuous dissemination of inflammatory information by the security agents could also be characterized as “abetting” in terms of Article 25(3)(c) of the Rome Statute.[129]


War crimes
Individual criminal responsibility for war crimes is stipulated in Article 8 of the Rome Statute. Article 8(1) of the Rome Statute stipulates that the International Criminal Court has jurisdiction over war crimes “in particular when committed as part of a plan or policy or as part of a large-scale commission of such crimes”. War crimes, unlike crimes against humanity, do not have to be committed as part of a widespread attack against the civilian population,[130] but they have to be committed during an armed conflict.

As international humanitarian law applies to cyber operations during armed conflicts, serious violations of international humanitarian law committed by cyber means may qualify as war crimes.[131] The Tallinn Manual 2.0 explains that such war crimes under customary international law include the grave breaches in Articles 50, 51, 130, and 147 of the four Geneva Conventions respectively, Article 85 of AP I, as well as the offences stated in Article 8 of the Rome Statute regarding both international and non-international armed conflicts as war crimes under customary international law.[132]

[L22] For acts committed during the NIAC, the security agents and the military forces of State A could potentially incur individual criminal responsibility for war crimes. In particular, by posting false inflammatory information about the ethnic and religious minority on the social media platform, the security agents could be responsible for instigating non-State organisations representing the ethnic and religious majority to commit acts of violence to life and person under Article 8(2)(c)(i) and committing rape under Article 8(2)(e)(vi) of the Rome Statute. Moreover, the military forces might be responsible for abetting the commission of such crimes.

[L23] Commanders and other superiors in State A might be criminally responsible for not preventing the acts that constitute or contribute to genocide, crimes against humanity and war crimes.[133] It is likely that the commanders and superiors in State A knew or, owing to the circumstances at the time, should have known that their forces were committing or about to commit the relevant crimes.[134] Moreover, they failed to take all necessary and reasonable measures within their power to prevent or repress the commission of the crimes,[135] i.e. to stop the posting of inflammatory misinformation and the aiding and abetting of mass killings, torture and inhumane treatment and rape.

[L24] It may further be investigated whether members of Group C could have committed war crimes by attacking protected objects (i.e. the hospitals in State A) under Article 8(2)(e)(iv) of the Rome Statute, provided they did not qualify as military objectives. Nonetheless, the target of the ransomware attacks was not the hospitals, which could mean that the hackers did not have the required intent to attack the protected object.[136] Accordingly, the members of Group C would likely not incur individual criminal responsibility under this ground.

Checklist[edit | edit source]

  • International human rights law
    • Did State A violate the prohibition of incitement to hatred and the prohibition of racial discrimination?
    • Is State B under a positive obligation to prevent the spread of hate speech extraterritorially pursuant to the applicable international human rights treaties?
  • Prohibition of genocide
    • Is State A internationally responsible for direct and public incitement to genocide?
    • Did State A violate its obligation to prevent genocide and/or was it complicit in genocide?
    • Is State B (and possibly other members of the international community) under an obligation to prevent genocide?
  • International humanitarian law
    • Did the violence between State A and Group C qualify as a NIAC?
    • Did the spread of hate speech by cyber means violate the prohibition to attack civilians in an armed conflict?
    • Did the spread of hate speech violate the prohibition of threats of violence aimed at terrorizing the civilian population during armed conflict?
    • Did State A encourage violations of the Geneva Conventions by spreading hate speech on social media?
  • International criminal law
    • Did the potential perpetrators fulfil the material elements (actus reus) and mental elements (mens rea) of the offence?
    • Did the potential perpetrator commit the offence individually, jointly or through another?
    • Did commanders or superiors incur criminal responsibility (a) for ordering cyber operations that constitute international crimes, or (b) for failing to take all reasonable and available measures to prevent the commission of those crimes or to punish those responsible if they knew or should have known that their subordinates were committing the crimes?

Appendixes[edit | edit source]

See also[edit | edit source]

Notes and references[edit | edit source]

  1. International Covenant on Civil and Political Rights (adopted 16 December 1966, entered into force 23 March 1976) 999 UNTS 171 (ICCPR).
  2. International Convention on the Elimination of All Forms of Racial Discrimination (adopted 21 December 1965, entered into force 4 January 1969) 660 UNTS 195 (ICERD).
  3. 78/v78.pdf Convention on the Prevention and Punishment of the Crime of Genocide (adopted 9 December 1948, entered into force 12 January 1951) 78 UNTS 277.
  4. 75/volume-75-I-970-English.pdf Geneva Convention for the Amelioration of the Condition of the Wounded and Sick in Armed Forces in the Field (adopted 12 August 1949, entered into force 21 October 1950.) 75 UNTS 31; 75/volume-75-I-971-English.pdf Geneva Convention for the Amelioration of the Condition of Wounded, Sick and Shipwrecked Members of Armed Forces at Sea (adopted 12 August 1949, entered into force 21 October 1950) 75 UNTS 85; 75/volume-75-I-972-English.pdf Geneva Convention Relative to the Treatment of Prisoners of War (adopted 12 August 1949, entered into force 21 October 1950) 75 UNTS 135; 75/volume-75-I-973-English.pdf Geneva Convention Relative to the Protection of Civilian Persons in Times of War (adopted 12 August 1949, entered into force 21 October 1950) 75 UNTS 287; 1125/volume-1125-I-17512-English.pdf Protocol Additions to the Geneva Conventions of 12 August 1949, and Relating to the Protection of Victims of International Armed Conflicts (adopted 8 June 1977, entered into force 7 December 1978.) 1125 UNTS 3; 1125/volume-1125-I-17513-English.pdf Protocol II Additional to the Geneva Conventions of 12 August 1949 and Relating to the Protection of Victims of Non-International Armed Conflicts (adopted 8 June 1977, entered into force 7 December 1978) 1125 UNTS 609.
  5. 2187/v2187.pdf Rome Statute of the International Criminal Court (adopted 17 July 1998, entered into force 1 July 2002) 2187 UNTS 3. See also the Amendments on the crime of aggression to the Rome Statute of the International Criminal Court, Kampala, 11 June 2010, Resolution RC/Res.6 of the Review Conference of the Rome Statute.
  6. In the absence of an international legal definition, hate speech may be defined as “any kind of communication in speech, writing or behaviour, that attacks or uses pejorative or discriminatory language with reference to a person or a group on the basis of who they are, in other words, based on their religion, ethnicity, nationality, race, colour, descent, gender or other identity factor”. United Nations Plan Strategy and Plan of Action on Hate Speech (May 2019) 2.
  7. See, for example, United Nations Human Rights Council, The promotion, protection and enjoyment of human rights on the Internet, Resolution A/HRC/RES/32/13 (1 July 2016), para 1; NATO, Warsaw Summit Communiqué (9 July 2016), para 70; G8 Summit of Deauville, Declaration: Renewed Commitment for Freedom and Democracy (27 May 2011), para II/11; UNGA ‘Report of the Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security’ (22 July 2015) A/70/174, paras 13(e) and 28(b); UNGA, ‘Report of the Group of Governmental Experts on Advancing Responsible State Behaviour in Cyberspace in the Context of International Security’ (14 July 2021) A/76/135, paras 36 and ff. This has been reaffirmed by most States in their national positions, such as Australia, Canada, Czech Republic, Estonia, Finland, Italy, Japan, the Netherlands, New Zealand, Norway, Romania, Sweden, Switzerland, the United Kingdom and the United States.
  8. See, Application of the Convention on the Prevention and Punishment of the Crime of Genocide (Bosnia and Herzegovina v. Serbia and Montenegro) (Judgment) [2007] ICJ Rep 43 [170].
  9. International Covenant on Civil and Political Rights (adopted 16 December 1966, entered into force 23 March 1976) 999 UNTS 171 (ICCPR); International Covenant on Economic, Social and Cultural Rights (adopted 16 December 1966, entered into force 3 January 1976) 993 UNTS 3 (ICESCR).
  10. Formal title: Convention for the Protection of Human Rights and Fundamental Freedoms (opened to the signature in Rome on 4 November 1950, entered into force 3 September 1953), ETS 5 (ECHR); there are several protocols which significantly expand and amend the obligations of the original Convention.
  11. Charter of Fundamental Rights of the European Union, proclaimed on 7 December 2000 (EUCFR).
  12. American Convention on Human Rights (open for signature from 22 November 1969, entered into force 18 July 1978), 1144 UNTS 123 (ACHR).
  13. African Charter on Human and Peoples’ Rights (‘Banjul Charter’) (adopted 27 June 1981, entered into force 21 October 1986), CAB/LEG/67/3 rev. 5, 21 I.L.M. 58 (1982) (ACHPR).
  14. Article 2(1) ICCPR.
  15. UN HRC, ‘General Comment No. 31 (80): The Nature of the General Legal Obligation Imposed on States Parties to the Covenant’ (adopted on 29 March 2004, 2187th meeting), para 10.
  16. Cf, Legal Consequences of the Construction of a Wall in the Occupied Palestinian Territories (Advisory Opinion) [2004] ICJ Rep 136 [111]. See further, UN HRC, General comment No. 36, Article 6, Right to life (3 September 2019) CCPR/C/GC/36, para 63. See also the approach adopted by the European Court of Human Rights in Al-Skeini and others v. the United Kingdom, App no 55721/07 (ECtHR, 7 July 2011) [131] and ff; Loizidou v. Turkey, App no 15318/89 (ECtHR, 23 March 1995) [62], and recently in Carter v. Russia, App no. 20914/07 (ECtHR, 21 September 2021) [161]. For the position within the Inter-American System see Saldano v. Argentina, Report No 38/99 (Inter-American Commission of Human Rights, 11 March 1999) [17] and in particular the wide interpretation adopted by the Inter-Amercian Court of Human Rights in its Advisory Opinion 23/17 on the Environment and Human Rights, Series a 23 (IACtHR, 15 November 2017) para 104(h).
  17. See, Legal Consequences of the Construction of a Wall in the Occupied Palestinian Territories (Advisory Opinion) [2004] ICJ 136, para 110; UN HRC, Summary Record of the 1405th Meeting, CCPR/C/SR.1405 (31 March 1995) 6 [20].
  18. See, for example, Marko Milanovic, ‘Human Rights Treaties and Foreign Surveillance: Privacy in the Digital Age’ (2015) 56 Harvard International Law Journal 81.
  19. Switzerland has expressly stated in its national position that ‘Human rights obligations are equally binding upon states operating in cyberspace as in physical space. This also applies when the cyber operation in question is being carried out extraterritorially, to the extent that the States exercise their sovereign authority in doing so’. See Federal Department of Foreign Affairs, ‘Switzerland's position paper on the application of international law in cyberspace’ (May 2021) 8.
  20. Article 17 ICCPR; Article 8 ECHR; Article 7 EUCFR; Article 11 ACHR. The exact titles and scopes of the provisions vary. For example, this can be triggered be the practice of surveillance. See Helen McDermott, ‘Application of the International Human Rights Law Framework in Cyber Space’ in Dapo Akande and others (eds), Human Rights and 21st Century Challenges. Poverty, Conflict, and the Environment (Oxford University Press 2020) 194. See also Szabo and Vissy v Hungary, App no 37138/ 14 (ECtHR, 12 January 2016); Liberty and Others v United Kingdom, App No 58243/00 (ECtHR, 2008).
  21. Article 19 ICCPR; Article 10 ECHR; Article 11 EUCFR; Article 13 ACHR. The exact titles and scopes of the provisions vary, and include its counterpart, the right to access to information, as highlighted in the national positions of Estonia, Finland, Italy, Sweden, Switzerland and the United States. A violation of this right may be, for example by ‘a DDoS attack that inhibits access to the Internet or the voicing of views, and is attributable to a state’. See Helen McDermott, ‘Application of the International Human Rights Law Framework in Cyber Space’ in Dapo Akande and others (eds), Human Rights and 21st Century Challenges. Poverty, Conflict, and the Environment (Oxford University Press 2020) 194.
  22. As highlighted by many States in their national positions, including Australia, Canada, the Czech Republic, Estonia, the Netherlands and Sweden.
  23. See Helen McDermott, ‘Application of the International Human Rights Law Framework in Cyber Space’ in Dapo Akande and others (eds), Human Rights and 21st Century Challenges. Poverty, Conflict, and the Environment (Oxford University Press 2020) 195–197.
  24. See Soering v. the United Kingdom, App no 14038/88 (ECtHR, 07 July 1989) [88]; Ireland v. the United Kingdom, App no 5310/71 (ECtHR, 18 January 1978) [163]; Hurri Laws v. Nigeria, Communication No 225/98 (AComHPR, 6 November 2000) [41]; UN HRC, General Comment 20, Article 7 (Prohibition of Torture, or Other Cruel, Inhuman or Degrading Treatment or Punishment) (10 March 1992) para 3; CAT, General Comment 2 on the implementation of article 2 by States parties (24 January 2008) CAT/C/GC/2, paras 1 and 5.
  25. UN Human Rights Committee, ICCPR General Comment No. 34 (12 September 2011), paras 21-36; See also ICCPR General Comment No. 27 (1 November 1999), paras 14-16; UN HRC, General Comment No. 31 [80] The Nature of the General Legal Obligation Imposed on States Parties to the Covenant (26 May 2004) CCPR/C/21/Rev.1/Add. 13, para 6.
  26. See, Velásquez Rodríguez v. Honduras, (Merits) IACrtHR (Ser. C) No. 4 (29 July 1988) [177]. See also UN HRC, General Comment No. 31 [80] The Nature of the General Legal Obligation Imposed on States Parties to the Covenant (26 May 2004) CCPR/C/21/Rev.1/Add. 13, para 8; UN HRC, General comment No. 36, Article 6, Right to life (3 September 2019) CCPR/C/GC/36, para 7. See also the national positions of Finland and Switzerland.
  27. Article 1 ICERD (“In this Convention, the term ‘racial discrimination’ shall mean any distinction, exclusion, restriction or preference based on race, colour, descent, or national or ethnic origin which has the purpose or effect of nullifying or impairing the recognition, enjoyment or exercise, on an equal footing, of human rights and fundamental freedoms in the political, economic, social, cultural or any other field of public life.”).
  28. See Peter T Muchlinski, ‘Corporations in International Law’, in Max Planck Encyclopedia of Public International Law (OUP online, updated June 2014), para 31 (explaining in relation to the UN Guiding Principles on Business and Human Rights that corporations have “a ‘responsibility’ rather than a ‘duty’ given the absence of a general legal obligation for corporate actors to observe human rights under international human rights law”, which is essentially a soft law standard of expected conduct). See also Tallinn Manual 2.0, commentary to rule 34, para 3 (noting that the question whether and which extent entities other than States are bound by international human rights obligations is unsettled).
  29. UN Guiding Principles on Business and Human Rights, Part II (as endorsed by UN Human Rights Council res 17/4 (16 June 2011)). See for example, Amnesty International, ‘The Social Atrocity Meta And The Right To Remedy For The Rohingya’ (September 2022) 18, claiming that ‘All companies have a responsibility to respect all human rights wherever they operate in the world and throughout their operations. This is a widely recognized standard of expected conduct as set out in international business and human rights standards, including the UN Guiding Principles on Business and Human Rights (UN Guiding Principles) and the OECD Guidelines for Multinational Enterprises (OECD Guidelines)’.
  30. See also in this regard, Kazakhstan’s national position.
  31. See e.g. Eva Glawischnig-Piesczek v Facebook Ireland Limited, Judgment of 3 October 2019, CEJU, ECLI:EU:C:2019:821 (in which the Court of Justice of the European Union (EU) upheld an injunction by the Austrian Supreme Court and noted that EU member states may “orde[r] a host provider [Facebook] to remove information covered by the injunction or to block access to that information worldwide within the framework of the relevant international law” (para 53)).
  32. See UN CERD, ‘General Recommendation No. XV: Article 4 of the Convention’ (adopted on 17 March 1993), para 4; and UN HRC, ‘General comment No. 11: Article 20’ (adopted on 27 July 1983), para 20.
  33. On the difficulties to enact such legislation in relation to cyber space see James Banks, ‘European Regulation of Cross-Border Hate Speech in Cyberspace: The Limits of Legislation’ (2011) 19 Eur J Crime Crim L & Crim Just 1.
  34. Tallinn Manual 2.0, commentary to rule 34, para 11.
  35. Application of the International Convention on the Elimination of All Forms of Racial Discrimination (Georgia v Russian Federation), Order of 15 October 2008, [1998] ICJ Rep 353, para 109.
  36. UN HRC, ‘General Comment No. 31 (80): The Nature of the General Legal Obligation Imposed on States Parties to the Covenant’ (adopted on 29 March 2004, 2187th meeting), para 10.
  37. In this regard, see the Tallinn Manual 2.0 noting that the majority view (in the commentary to rule 34, para 10) that such physical control is necessary to establish jurisdiction, and the minority view (in the commentary to rule 34, para 9) that power or effective control over the enjoyment of a State over the enjoyment of a right is sufficient.
  38. See Stefanie Farrior, ‘Molding The Matrix: The Historical and Theoretical Foundations of International Law Concerning Hate Speech’ (1996) BerkeleyJIntlL 3, 5-6, also noting that “Article 20(2) does not declare a right that individuals hold vis-à-vis the government; instead, it requires governments to prohibit certain behavior of private actors vis-à-vis other private actors” (at 8).
  39. Tallinn Manual 2.0, commentary to rule 34, para 9 and commentary to rule 36, para 6; but see commentary to rule 34, para 10 (setting out the minority position on the issue).
  40. See ILC, Report of the International Law Commission at its seventy-first session (29 April–7 June and 8 July–9 August 2019), UN Doc A/74/10, para 56, Annex (b).
  41. Cf. Tallinn Manual 2.0, rule 14 and commentary to rule 14, para 9.
  42. On this “dual regime of responsibility for genocide” see Antonio Cassese and Paola Gaeta, Cassese’s International Criminal Law (3rd rev ed, OUP 2013), 112 (interpreting the ICJ’s findings in Application of the Convention on the Prevention and Punishment of the Crime of Genocide (Bosnia and Herzegovina v Serbia and Montenegro), Judgment, [2007] ICJ Rep 43, paras 163 and 173).
  43. 78/v78.pdf Convention on the Prevention and Punishment of the Crime of Genocide (adopted 9 December 1948, entered into force 12 January 1951) 78 UNTS 277.
  44. Application of the Convention on the Prevention and Punishment of the Crime of Genocide (Bosnia and Herzegovina v Serbia and Montenegro), Judgment, [2007] ICJ Rep 43, para 430.
  45. See Florian Jeßberger, ‘The Definition and the Elements of the Crime of Genocide’, in Paola Gaeta (ed), The UN Genocide Convention: A Commentary (OUP 2009) 87, 88.
  46. Ibid, at 88. The prohibition of genocide is thus a primary obligation whose violation requires intent in addition to the two elements of the internationally wrongful act prescribed in Article 2 of the ILC Articles on State Responsibility (Commentary in Part I, Chapter 1 on Art 2, para 10).
  47. See Florian Jeßberger, ‘The Definition and the Elements of the Crime of Genocide’, in Paola Gaeta (ed), The UN Genocide Convention: A Commentary (OUP 2009) 87, 94.
  48. Application of the Convention on the Prevention and Punishment of the Crime of Genocide (Bosnia and Herzegovina v Serbia and Montenegro), Judgment, [2007] ICJ Rep 43, para 167 (in which the Court interpreted the provisions to give rise to penal sanctions for individuals and to State responsibility). See also [https://www.icj-cij.org/files/case-related/91/091-19930913-ORD-01-00-EN.pdf Application of the Convention on the Prevention and Punishment of the Crime of Genocide (Bosnia and Herzegovina v Yugoslavia (Serbia and Montenegro)], Order of 8 April 1993, [1993] ICJ Rep 3, para 52.
  49. Prosecutor v Jean-Paul Akayesu (Judgement) ICTR-96-4-T (2 September 1998) [556] (defining “public” in terms of “the place where the incitement occurred and whether or not assistance was selective or limited”).
  50. Prosecutor v Nahimana (Media Case) (Appeals Judgement) ICTR 99-52-A (28 November 2007) [702]-[703].
  51. Prosecutor v Jean-Paul Akayesu (Judgement) ICTR-96-4-T (2 September 1998) [557]. See Prosecutor v Nahimana (Media Case) (Appeals Judgement) ICTR 99-52-A (28 November 2007) [701] (noting: “The principal consideration is thus the meaning of the words used in the specific context: it does not matter that the message may appear ambiguous to another audience or in another context.”)
  52. See Wibke Timmermann and William A. Schabas, ‘Incitement to Genocide’ in Paul Behrens and Ralph Henham (eds), Elements of Genocide (Routledge 2013) 145, 148.
  53. Prosecutor v Jean-Paul Akayesu (Judgement) ICTR-96-4-T (2 September 1998) [673] for a finding of direct and public incitement to genocide by means of speeches.
  54. See Jens David Ohlin, ‘Incitement and Conspiracy to Commit Genocide’, in Paola Gaeta (ed), The UN Genocide Convention: A Commentary (OUP 2009) 207, 212.
  55. Art I and Art III(e) Genocide Convention.
  56. Marko Milanović, ‘State Responsibility for Genocide: A Follow-Up’ (2007) 18 EJIL 669, 687.
  57. Application of the Convention on the Prevention and Punishment of the Crime of Genocide (Bosnia and Herzegovina v Serbia and Montenegro), Judgment, [2007 ICJ Rep 43], paras 431-432.
  58. See generally Andreas Zimmermann, ‘The Obligation to Prevent Genocide: Towards a General Responsibility to Protect?’ in Ulrich Fastenrath et al (eds), From Bilateralism to Community Interest: Essays in Honour of Bruno Simma (OUP 2011) 629.
  59. Application of the Convention on the Prevention and Punishment of the Crime of Genocide (Bosnia and Herzegovina v Serbia and Montenegro), Judgment, [2007] ICJ Rep 43, paras 430. See also Application of the Convention on the Prevention and Punishment of the Crime of Genocide (Bosnia and Herzegovina v Serbia and Montenegro), Judgment, [1996] ICJ Rep 595, para 31 (noting “that the obligation each State thus has to prevent and to punish the crime of genocide is not territorially limited by the Convention”).
  60. See Eva Glawischnig-Piesczek v Facebook Ireland Limited, Judgment of 3 October 2019, CEJU, ECLI:EU:C:2019:821 (implying that EU member states may force Facebook to delete content worldwide). See also Application of the Convention on the Prevention and Punishment of the Crime of Genocide (Bosnia and Herzegovina v Serbia and Montenegro), Judgment, [2007] ICJ Rep 43, paras 431(emphasising that “if the State has available to it means likely to have a deterrent effect on those suspected of preparing genocide, or reasonably suspected of harbouring specific intent (dolus specialis), it is under a duty to make such use of these means as the circumstances permit.”)
  61. ILC Articles on State Responsibility, Art 41 (1); ILC Articles on Responsibility of International Organizations, Art 42(1).
  62. ILC Articles on State Responsibility, Art 41 (2); ILC Articles on Responsibility of International Organizations, Art 42(2).
  63. Common Article 3 GCs.
  64. Prosecutor v Tadić (Decision on Jurisdiction) IT-94-1-AR72 (2 October 1995) [70].
  65. See also Prosecutor v Tadić (Trial Judgment) IT-94-1-T (7 May 1997) [562] (noting that the two criteria distinguish “an armed conflict from banditry, unorganized and short-lived insurrections, or terrorist activities, which are not subject to international humanitarian law”).
  66. Prosecutor v Boškoski and Tarčulovski (Trial Judgment) IT-04-82-T (10 July 2008) [177].
  67. Prosecutor v Limaj, Bala and Musliu (Trial Judgment) IT-03-66-T (30 November 2005) [129]; Prosecutor v Boškoski and Tarčulovski (Trial Judgment) IT-04-82-T (10 July 2008) [199]–[203].
  68. Cf. L Cameron et al, ‘Article 3: Conflicts Not of an International Character’ in ICRC (ed), Commentary on the First Geneva Convention (CUP 2016) 158 [436] (“In order to determine the existence of a non-international armed conflict involving cyber operations, the same criteria apply as with regard to kinetic violence.”).
  69. Tallinn Manual 2.0, commentary to rule 83, para 7; Yoram Dinstein, Non-International Armed Conflicts in International Law (CUP 2014) 35. For State views affirming this position, see, eg, French Ministry of the Armies, ‘International Law Applied to Operations in Cyberspace’, 9 September 2019, 12; Germany, ‘On the Application of International Law in Cyberspace: Position Paper’ (March 2021), 7.
  70. Prosecutor v Tadić (Decision on Jurisdiction) IT-94-1-AR72 (2 October 1995) [70]; Prosecutor v Limaj, Bala and Musliu (Trial Judgement) IT-03-66-T (30 November 2005) [84], [167]; Prosecutor v Haradinaj et al. (Trial Judgement) IT-04-84-T (3 April 2008) [49], Prosecutor v Boškoski and Tarčulovski (Trial Judgement) IT-04-82-T (10 July 2008) [185].
  71. Prosecutor v Haradinaj et al. (Trial Judgement) IT-04-84-T (3 April 2008) [49] (listing the various used by different Trials Chambers to assess the intensity of the fighting).
  72. Prosecutor v Slobodan Milošević (Decision on Motion for Judgement of Acquittal) IT-02-54-T (16 June 2004) [23-24]; Prosecutor v Limaj, Bala and Musliu (Trial Judgement) IT-03-66-T (30 November 2005) [158]; Prosecutor v Haradinaj et al. (Trial Judgement) IT-04-84-T (3 April 2008) [70-75].
  73. Prosecutor v Haradinaj et al. (Trial Judgement) IT-04-84-T (3 April 2008) [88]; Prosecutor v Boškoski and Tarčulovski (Trial Judgement) IT-04-82-T (10 July 2008) [para 203].
  74. Prosecutor v Tadić (Appeal Judgement) IT-94-1-A (15 July 1999) [120] (noting that “an organised group differs from an individual in that the former normally has a structure, a chain of command and a set of rules as well as the outward symbols of authority”); Prosecutor v Limaj, Bala and Musliu (Trial Judgement) IT-03-66-T (30 November 2005) [para 101].
  75. ICJ, Legality of the Threat or Use of Nuclear Weapons, ICJ Reports 1996, 226, para. 78-79.
  76. ICRC, CIHL Study, rule 1; Article 48 AP I (“the Parties to the conflict shall at all times distinguish between the civilian population and combatants”).
  77. Art. 48 and 51(2) AP I; Art. 13(2) AP II.
  78. Art. 8(2)(b)(i) and 8(2)(e)(i) Rome Statute of the International Criminal Court
  79. Art. 51(2) AP I; ICRC, CIHL Study, rule 2. See also Tallinn Manual 2.0, rule 98.
  80. Yoram Dinstein (ed), The Conduct of Hostilities under the Law of International Armed Conflict (3rd edn, CUP 2016) 105.
  81. Art. 51(3) AP I.
  82. See, eg, Michael N. Schmitt, ‘Fault Lines in the Law of Attack’ in S Breau and A Jachec-Neale (eds), Testing the Boundaries of International Humanitarian Law (BIICL 2006) 292 (noting that the principle of proportionality derives from the principle of distinction).
  83. Art. 51(5)(b) AP I.
  84. ICRC, The Principle of Proportionality in the Rules Governing the Conduct of Hostilities under International Humanitarian Law (Laurent Gisel ed.) (ICRC 2018) 5.
  85. Tallinn Manual 2.0, commentary to rule 92, para 2. See also Yves Sandoz, Christophe Swinarski and Bruno Zimmermann (eds), Commentary on the Additional Protocols of 8 June 1977 to the Geneva Conventions of 12 August 1949 (ICRC 1987) 600 [1875] (explaining that the word “operations” in Art 48 AP I (Basic rule of distinction of the civilian population and civilian objects) “refers to military operations during which violence is used, and not to ideological, political or religious campaigns”).
  86. See Article 37(2) AP I; Tallinn Manual 2.0, rule 123; see also ICRC CIHL Study, rule 57.
  87. Art 13(2) of AP II, and Tallinn Manual 2.0, Rule 98, para 6. See also ICRC, International Humanitarian Law and Contemporary Armed Conflict (ICRC 2019), 29.
  88. Yves Sandoz, Christophe Swinarski and Bruno Zimmermann (eds), Commentary on the Additional Protocols of 8 June 1977 to the Geneva Conventions of 12 August 1949 (ICRC 1987) 618 [1940]. See also Tallinn Manual 2.0, Rule 98, para 4.
  89. Jean-Marie Henckaerts, ‘Article 1: Respect for the Convention’ in ICRC (ed), Commentary on the First Geneva Convention (CUP 2016) 50 [158].
  90. Military and Paramilitary Activities in and against Nicaragua (Nicaragua v United States of America) (Merits) [1986] ICJ Rep 14, para 220 (finding that “[t]he United States is thus under an obligation not to encourage persons or groups engaged in the conflict in Nicaragua to act in violation of the provisions of Article 3 common to the four 1949 Geneva Conventions”).
  91. ICRC, International Humanitarian Law and Contemporary Armed Conflict (ICRC 2019) 28–29.
  92. Rome Statute of the International Criminal Court (adopted 17 July 1998, entered into force 1 July 2002) 2187 UNTS 3. See also the Amendments on the crime of aggression to the Rome Statute of the International Criminal Court, Kampala, 11 June 2010, Resolution RC/Res.6 of the Review Conference of the Rome Statute.
  93. See Kai Ambos, ‘International Criminal Responsibility in Cyberspace’ in Nicholas Tsagourias and Russell Buchan (eds), Research Handbook on Cyberspace and International Law (Elgar 2015) 118, 120, noting that the focus of the debate lies on the application of IHL to cyber space. In this regard, see Tallinn Manual 2.0, rule 84 (on “Individual criminal responsibility for war crimes”).
  94. See generally M. Cherif Bassiouni, Introduction to International Criminal Law (2nd rev ed, Martinus Nijhoff 2014), Chapter IV.
  95. Art 25(3)(a) Rome Statute.
  96. ICRC CIHL Study, Rules 152 and 153.
  97. Tallinn Manual 2.0, rule 85.
  98. On this “dual regime of responsibility for genocide” see Antonio Cassese and Paola Gaeta, Cassese’s International Criminal Law (3rd rev ed, OUP 2013), 112 (interpreting the ICJ’s findings in Application of the Convention on the Prevention and Punishment of the Crime of Genocide (Bosnia and Herzegovina v Serbia and Montenegro), Judgment, [2007] ICJ Rep 43, paras 163 and 173).
  99. See Marco Roscini, ‘Gravity in the Statute of the International Criminal Court and Cyber Conduct that Constitutes, Instigates or Facilitates International Crimes’ (2019) 30 CrimLF 247, 250.
  100. Convention on the Prevention and Punishment of the Crime of Genocide (adopted 9 December 1948, entered into force 12 January 1951) 78 UNTS 277.
  101. See Florian Jeßberger, ‘The Definition and the Elements of the Crime of Genocide’, in Paola Gaeta (ed), The UN Genocide Convention: A Commentary (OUP 2009) 87, 88.
  102. Those acts are: (a) killing members of the group; (b) causing serious bodily or mental harm to members of the group; (c) deliberately inflicting on the group conditions of life calculated to bring about its physical destruction in whole or in part; (d) imposing measures intended to prevent births within the group; (e) forcibly transferring children of the group to another group.
  103. See also the cases of Prosecutor v Ruggiu (Judgement and Sentence) ICTR 97-32-I (1 June 2000), and Prosecutor v Nahimana (Media Case) (Judgement and Sentence) ICTR 99-52-T (3 December 2003).
  104. Prosecutor v Jean-Paul Akayesu (Judgement) ICTR-96-4-T (2 September 1998) [559].
  105. Ibid, para 560.
  106. Ibid, para 562.
  107. See generally Wibke K Timmermann, ‘The Relationship between Hate Propaganda and Incitement to Genocide: A New Trend in International Law Towards Criminalization of Hate Propaganda?’ (2005) 18 LJIL 257; Richard A Wilson, ‘Inciting Genocide with Words’ (2015) 36 MichJIntlL 277; Shannon Fyfe, ‘Tracking Hate Speech Acts as Incitement to Genocide in International Criminal Law’ (2017) 30 LJIL 523.
  108. On this point see Gregory S Gordon, ‘Formulating a New Atrocity Speech Offense: Incitement to Commit War Crimes’ (2012) 43 LoyUChiLJ 281, 296.
  109. Cf Prosecutor v Jean-Paul Akayesu (Judgement) ICTR-96-4-T (2 September 1998) [673-674] (considering that certain speeches made by the perpetrator in public and in a public place confirmed his intent to directly create a particular state of mind in his audience necessary to lead to the destruction of a protected group).
  110. Prosecutor v Jean-Paul Akayesu (Judgement) ICTR-96-4-T (2 September 1998) [562].
  111. Kai Ambos, ‘International Criminal Responsibility in Cyberspace’ in Nicholas Tsagourias and Russell Buchan (eds), Research Handbook on Cyberspace and International Law (Elgar 2015) 118, 141.
  112. The Elements of Crimes explain that “[i]t is understood that ‘policy to commit such attack’ requires that the State or organization actively promote or encourage such an attack against a civilian population” but adds in a footnote that “[t]hat such a policy may, in exceptional circumstances, be implemented by a deliberate failure to take action, which is consciously aimed at encouraging such attack. The existence of such a policy cannot be inferred solely from the absence of governmental or organizational action.” (ICC, Elements of Crimes (ICC 2011), 5).
  113. CLICC commentary, Art. 7 (1).
  114. Ibid, relying inter alia on Prosecutor v Katanga and Ngudjolo (Decision on confirmation of charges) ICC-01/04-01/07-717 (30 September 2008) [394]; Prosecutor v Gbagbo (Decision on the confirmation of charges) ICC-02/11-01/11-656-Red (12 June 2014) [222]; Prosecutor v Katanga (Judgment pursuant to article 74 of the Statute) ICC-01/04-01/07-3436 (7 March 2014) [1123]; and Prosecutor v Bemba (Decision pursuant to Article 61(7)(a) and (b) of the Rome Statute on the charges of the Prosecutor) ICC-01/05-01/08-424 (15 June 2009) [83].
  115. Prosecutor v Katanga and Ngudjolo (Decision on confirmation of charges) ICC-01/04-01/07-717 (30 September 2008) [394]; and Prosecutor v Gbagbo (Decision on the confirmation of charges) ICC-02/11-01/11-656-Red (12 June 2014) [223].
  116. CLICC commentary, Art 7(1)(a).
  117. Prosecutor v Nahimana (Media Case) (Appeals Judgement) ICTR 99-52-A (28 November 2007) [988] (finding that “the hate speeches and calls for violence against the Tutsi made after 6 April 1994 [i.e., after the beginning of a systematic and widespread attack against the Tutsi] themselves constituted underlying acts of persecution”).
  118. CLICC commentary, Article 7(1)(h).
  119. CLICC commentary, Article 7(1)(k).
  120. ICC, Elements of Crimes (ICC 2011), 5.
  121. See Art 7(1)(h) Rome Statute, and the case law of the International Criminal Tribunal in Rwanda (ICTR) in cases such as Prosecutor v Ruggiu (Judgement and Sentence) ICTR 97-32-I (1 June 2000), and Prosecutor v Nahimana (Media Case) (Judgement and Sentence) ICTR 99-52-T (3 December 2003). See also Gregory S Gordon, ‘Hate Speech and Persecution: A Contextual Approach’ (2013) 46 VandJTransnatlL 303; and Andrey Fino, ‘Defining Hate Speech – A Seemingly Elusive Task’ (2020) 18 JICL 31, 31 (arguing that “incitement to violence, incitement to commit crimes, followed by actual violent acts, [..] may constitute hate speech amounting to the crime of persecution: incitement to discrimination or incitement to hatred do not qualify.”)
  122. See CLICC commentary, Article 7(1)(h). The case law is divided on whether mere hate speech would be sufficient to amount to persecution (see e.g. Prosecutor v Nahimana (Media Case) (Judgement and Sentence) ICTR 99-52-T (3 December 2003) [1073]) or whether explicit calls for violence are necessary (see e.g. Prosecutor v Kordić & Čerkez (Judgement) IT-95-14/2-T (26 February 2001) [209 and note 272]; and Prosecutor v Nahimana (Media Case) (Appeals Judgement) ICTR 99-52-A (28 November 2007) [986-988].
  123. Prosecutor v Šešelj, (Judgement) MICT-99-A (11 April 2018) [160-163] (finding that that “Šešelj’s speech rises to a level of gravity amounting to the actus reus of persecution as a crime against humanity” and thus reversing the finding of the Trial Chamber on this issue).
  124. Prosecutor v Nahimana (Media Case) (Appeals Judgement) ICTR 99-52-A (28 November 2007) [986-987].
  125. Prosecutor v Šešelj, (Judgement) MICT-99-A (11 April 2018) [164].
  126. Prosecutor v Jean-Paul Akayesu (Judgement) ICTR-96-4-T (2 September 1998) [482].
  127. Prosecutor v Brđanin (Trial Judgement) IT-99-36-T (1 September 2004) [269].
  128. Prosecutor v Jean-Paul Akayesu (Judgement) ICTR-96-4-T (2 September 1998) [484]; Prosecutor v Furundžija (Trial Judgement) IT-95-17/1-T (10 December 1998) [234] (holding that “assistance must have a substantial effect on the commission of the crime”).
  129. Prosecutor v Jean-Paul Akayesu (Judgement) ICTR-96-4-T (2 September 1998) [484] (defining abetting in terms of “facilitating the commission of an act by being sympathetic thereto”.) See also Tallinn Manual 2.0, commentary to rule 84, para 15.
  130. CLICC commentary, Art 8 (1) (noting that “it is unlikely that a single act would meet the gravity threshold in Article 17(1)(d)” of the Rome Statute).
  131. Tallinn Manual 2.0, commentary to rule 84, para 2.
  132. Tallinn Manual 2.0, commentary to rule 84, para 1. See also Kai Ambos, ‘International Criminal Responsibility in Cyberspace’ in Nicholas Tsagourias and Russell Buchan (eds), Research Handbook on Cyberspace and International Law (Elgar 2015) 118, 121.
  133. Art 28 Rome Statute. See also Tallinn Manual 2.0, rule 85.
  134. On this standard, see e.g. Prosecutor v Blaškić (Trial Judgement) IT-95-14-T (3 March 2000) [294]; Prosecutor v Kunarac et al (Trial Judgement) IT-96-23 & 23/1-T (22 February 2001) [395]; Prosecutor v Krstić (Trial Judgement) IT-98-33-T (2 August 2001) [604]-[605].
  135. Ibid.
  136. ICC, Elements of Crimes (ICC 2011), 36.

Bibliography and further reading[edit | edit source]

Contributions[edit | edit source]

Previous: Scenario 18: Cyber operators Next: Scenario 20: Medical facilities