Cybersecurity and the Fight against Cybercrime: Partners or Competitors?

Abstract

In the early 2000, cybersecurity breaches were classified as “Internet crimes” and therefore managed through the tools of the criminal justice system. The Budapest Convention on Cybercrime forged new incriminating provisions and new procedural guidelines, updating the categories of criminal law and criminal procedure for the digital age. This style, unfortunately, has proved to be insufficient. To face the growing number of threats, the EU has shifted towards a much more preemptive, administrative-law-based approach to cybersecurity, with a view to protect critical infrastructure and industries from disruptive attacks. The criminal layer, however, has not been replaced: the relevant, international instruments are still there, and they have been recently extended to cover more ground. The essay will examine the new wave of legislation on cybercrime such as the United Nations Cybercrime Treaty, trying to identify the interactions and the frictions between two different contrast strategies to abusive cyber operations.

I. Introduction

An ever-increasing number of threats come from the digital world, which influences everyone’s life off-screen. Critical infrastructure can be sabotaged digitally¹; communication systems can be shaken through cyberattacks²; elections can be manipulated by cyber-espionage³; land attacks can be aided by remotely sabotaging the alert systems.⁴ The impact of digital malfeasance is impressive: in 2024, the global cost of cybercrime will reach 9,5 trillion $, making it the third global economy after the United States and China. According to the same estimate, the impact is projected to rise by 15% per year, reaching 10,5 trillion $ by 2025.⁵

This increase and the variety of threats prompted a shift in the institutional response. The European Union in particular has taken up a prominent role in the fight for cybersecurity, aiming at reducing disparities across the digital single market and reaching a common, high standard of security for institutions, infrastructure, companies, and individuals. To achieve these results, the EU has issued a growing number of directives and regulations: it has given a clear, permanent mandate for ENISA,⁶ and it has imposed a set of security requirements for products with digital elements.⁷ It has proposed schemes to issue cybersecurity certificatins to products and services,⁸ as well as a joint solidarity structure to prevent, analyze, and respond to attacks.⁹ All these initiatives have been based on the need to reduce fragmentation among EU Member States, to perfect the single market (Article 114 TFEU), and to ensure the competitiveness of European companies (Article 173 TFEU).

This recent wave has left aside a traditional tool in the fight against cyber threats: criminal law and the criminal justice system at large. Even repressive policies have been moving away from the traditional, criminal punishment, as the European Union has come to impose sanctions on individuals allegedly responsible for cyber-attacks.¹⁰ And yet, almost every conceivable cyber threat¹¹ is described by an incriminating provision and has the potential to trigger a criminal investigation.

This essay will examine the interplay between the two tiers of legislation, starting with a historical perspective on the emergence and development of criminal law in the digital domain. It will then delve into the reasons why the criminal justice system has ceased to be the preferred option when it comes to countering cyber threats and, finally, it will examine some new instruments and strategies aimed at revamping its effectiveness. I will finally articulate a proposal aimed at creating stronger synergies between the two domains.

II. From punch card attacks to the Budapest convention

As new technologies emerge, misuse soon follows, and the history of ICT is no exception. With a means of accessing more and more information, malign actors figured out ways to use networks to their advantage. Abusive operations started as soon as the technology existed, and they evolved together: the first cyberattack dates back to 1962, and it was performed via punch card to (successfully) steal all the passwords that would grant access to the MIT computer system.¹² In the first manual on computer crime, published in 1979, the concern is palpable: in the span of the previous 8 years, the reported cases were already 669,¹³ but the majority of incidents would not be reported to the authorities. Back then, prosecutors would “frequently refuse to accept the cases for a variety of reasons, including their lack of understanding of the technology […]. On the other hand, prosecutors and investigators indicate that victim’s records and documentation of crimes associated with computers in the business community are inadequate for effective prosecution.”¹⁴

The first laws and guidelines to fight “cybercrime” were developed in that environment, with two main aims: reducing “the incidence of any type of crime in which a knowledge of computer technology is needed to understand the intentional acts that result in losses”; and successfully prosecuting the perpetrators.¹⁵ This new avenue for antisocial behavior required new incriminating provisions, new methods of investigation, and a specific trial strategy. In the late 1970s and during the 1980s, a growing number of states criminalized conduct such as illegal access to data; illicit interception; damaging of data; and forgery of digital records. Some old notions, such as documents, where refurbished and newly defined to include also their digital counterparts¹⁶. Criminal law, however, was the “weapon of choice”: it was perceived as being the proper tool to update and extend, to contain the phenomenon.

The effort was welcome, but not sufficient. As computers started to enter private homes and the World Wide Web started to be more and more available, the devices were set to be ever more connected and numerous, multiplying the opportunity for digital misbehavior.¹⁷ Cybercrime changed accordingly: a growing number of individuals had first-hand access to computers, hence the number of potential targets increased, and technical ability ceased to be the only relevant factor. Social engineering became a key component of the first organized phishing campaigns, that targeted the vulnerabilities of the users as well as those of the machines. Such operations became the most common and the most profitable in less than a decade, bringing danger to every doorstep.

On the legal front, the difficulties multiplied. The number of incidents was growing, but the investigation was becoming more difficult: an internet connection was enough to elude borders and complicate the inquiry. The need for a shared dictionary and better coordination emerged soon, and the Council of Europe was the first institution to rise to the challenge. In 1997, its Committee of Ministers established the Committee of Experts on Crime in Cyberspace (PC-CY), which received the mandate to draft an international convention on the subject. From its initial stages, the project was meant to be more than a regional agreement. The United States of America, Canada, Japan, and South Africa were also called to the negotiating table: the global dimension of cybercrime was emerging, and broadening the scope as much as possible seemed like an essential trait of a functioning agreement.¹⁸

The Budapest Convention on Cybercrime was adopted in 2001 and has been an important milestone. It has been drafted to be flexible enough to serve as a widespread guideline – the Convention has currently seventy-six parties¹⁹ – and it has been a fundamental tool to harmonize criminal law and to raise awareness on topics that were still seen as somewhat unusual, such as the correct gathering and handling of digital evidence.

The Convention contains a set of substantive law provisions, addressing the need for a common understanding of what conducts should be criminalized in the cyber realm. The provisions cover four main areas. The first one details the offences against the confidentiality, integrity and availability of computer data and systems, which the explanatory report to the Convention calls “the basic threats”²⁰ such as illegal access, data interference, system interference and misuse of devices. These infringements have become the “ground zero” of cybercrime: they are indeed the first situations that have been criminalized across borders, and they are the most relevant also in the domain of cybersecurity, as they aim to preserve the integrity of all ICT systems.²¹

The other areas respond to a different logic, at least in part. They do not focus on the integrity of information and systems per se, but on “ordinary” crimes that could find a new dimension online. The second one addresses the most widespread “computer-related crimes”: computer-related forgery and computer-related fraud. The drafters of the Budapest convention were fully aware that most States had already criminalized such behaviors, online or offline: the added value of these provisions did not reside in their novelty but in their capability to provide a blueprint for harmonization. The Convention then moves to the criminalization of offences related to child pornography, which are defined as a “content-related” offence. The fight against the sexual exploitation of children online has been a signature issue, as technology has made victims more accessible to predators and has made it easier for criminals to groom or persuade children under false pretenses – i.e.: reaching out to them online by pretending to be a young girl in search of new friends²² – and has simplified the circulation of illicit material. Lastly, the convention focuses on the offences related to the infringement of copyright, aimed at protecting intellectual property in an age of increasing importance of intangible goods – and increasing ease in appropriating and sharing them illicitly.²³

The other two sections of the Budapest Convention on Cybercrime contain procedural provisions focused on the correct gathering and handling of digital evidence and the mutual legal assistance (MLA) procedures needed to ensure the repression of cybercrime across borders.

As for the procedural provisions, they were conceived as a much-needed update to investigation techniques. As ICT was being used to perpetrate crimes, investigators needed to keep up, hence the Convention provided the basic notions and tools for an accurate digital investigation. Article 19 distinguished between data and physical storage for searches and seizures. It also provided for rules on the expedited preservation and disclosure of content and traffic data (Articles 16 and 17), on production orders (Article 18), on the live monitoring of traffic data, and on the interception of content data (Articles 20 and 21). This apparatus had the immediate effect of elevating forensically sound interventions to “best practice”: the somewhat mixed approaches of the past were not swept away,²⁴ but the Budapest Convention was instrumental in raising awareness on the correct handling of digital material.

The heftier part of the Convention, however, deals with MLA (Articles 23–45), to regulate cooperation among different nations’ law enforcement agencies, prosecution services, and judiciaries. The transnational aspects of cybercrime, after all, were one of the main reasons to resort to an instrument such as an international treaty in the first place: it is only natural that the final text was specially devoted to ensuring smooth and swift cross-border cooperation.²⁵ The text provides for a comprehensive set of general principles on MLA – including principles on extradition – as well as specific provisions that regulate the duty to help preserve, intercept, and access data abroad. Finally, the Convention sets up a 24/7 network, a system of national contact points that should ensure continuous and immediate assistance to foreign investigators, to build a permanent, reliable structure to fast-track cybercrime cases and quickly obtain aid from other nations. Among these provisions, Article 32 stirred controversy. It allows a party to access information that is either publicly available or stored in foreign territory without the authorization of other parties. Russia took issue with the provision, claiming it would infringe on state sovereignty by allowing unauthorized cross-border investigations. On these grounds, Russia has always refused to join the Budapest Convention.²⁶

III. Mismatch of notions?

The Budapest Convention on Cybercrime has served as a watershed: it has harmonized legal frameworks, raised awareness of innovative investigation techniques, and underlined the need for close and quick cooperation almost a decade before the acknowledgment of cybersecurity as a forefront issue, at least for the European Union. Moreover, it has been at the center of countless activities held by the Council of Europe’s Cybercrime Programme Office, which has been hosting capacity-building programs and assisting countries in strengthening legislation, training, and policies related to cybercrime, as defined by the Budapest Convention. To make a long story short, the Budapest convention is widespread, highly regarded, and well-supported.

And yet, despite its success, its impact on cybersecurity has been marginal. Cyberattacks have been multiplying; their impact – economic and societal – has been growing, and it is projected to rise further. The situation might appear paradoxical, but it finds both theoretical and practical explanations.

Firstly, the Budapest Convention on Cybercrime is somewhat of a general tool, too unfocused to be effective from a cybersecurity perspective. The international instrument – and the national provisions that derived from it – is concerned with a multitude of problems: it is aimed at bridging an awareness gap on a wide variety of harmful behaviors that could manifest differently, or at a different intensity, thanks to the developments in communication technology.²⁷ In other words, its scope is much broader than the strict “cybersecurity” area, hence: it is not specifically concerned with the question of how to preserve confidentiality, integrity, and the availability of information, which is the main essence of cybersecurity.²⁸ “Cybercrime” has to cover a somewhat vaster, vaguer area, as the notion is not clearly defined²⁹; it encompasses a whole range of harmful situations, that have been classified in countless ways by criminologists: according to one account, cybercrime should be classified into at least three categories.³⁰ The first one encompasses the so-called “crimes against the machine,” such as unauthorized access to computer systems or information. The second one provides for the crimes committed “using the machine,” such as fraud, theft and extortion. The last one includes the “crimes in the machine,” which corresponds to the “content-related” section of the Budapest Convention: it includes extreme content such as child pornography, hate speech and radical material, eg, terrorist propaganda. Other authors have proposed different arrangements,³¹ and the classifications are bound to grow ampler and more complex, but they do not seem to converge with the categories that are employed to classify cybersecurity threats.³² As an increasing number of human activities display a digital component, as technology changes, the very same notion of “cybercrimes” is bound to change, encompassing more reproachable conducts and stigmatizing new digital harms. The same goes for the investigation techniques, that were once used in a small fraction of cases, where the digital dimension was inevitable. Nowadays, it is rare to encounter a criminal case that does not require the forensic copy of a computer; the decryption of a cellphone; or the authentication of some messages. Unexpectedly, the Budapest convention has done more to raise awareness of the investigation techniques deployed in the everyday work of law enforcement than for cybersecurity in a stricter sense.

From a cybersecurity perspective, this can lead to particularly dysfunctional consequences: the early warnings of potential cyberattacks come from crimes such as illicit access or misuse of data, that tend to be treated as minor cases (if they are treated at all). They can occur at distressing rates, but, on their own, they do not seem to be so harmful to take priority over other infringements. From the observatory of law enforcement agencies, phenomena like the sexual exploitation of children or big frauds deserve to be treated with the utmost urgency – and understandably so. Chances are that the mere crimes “against the machines” risk being left behind by the criminal justice system until they have been brought to more severe consequences, which would make them impossible to ignore.³³

IV. A crisis of effectiveness

Let us assume that a cybercrime has occurred and that it has been harmful enough to be caught by the authorities’ radar. Let us assume it has been duly investigated and that there is a reasonable assumption regarding the identity of the perpetrator. Normally, the authorities would go forward with the process, formalizing charges and/or arresting the suspect according to the legal framework that the investigators are operating under.

If the accused happens to be on the territory of the state, the law enforcement agencies will be perfectly self-sufficient. One example will suffice: an Italian 24-year-old has been recently placed in precautionary detention, as he is accused of having repeatedly hacked the servers of the Italian Ministry for Justice, as well as almost fifty individual accounts of public prosecutors. He was allegedly able to exfiltrate dossiers and to directly follow the development of the case that was being built against him, so much so that the lead prosecutor declared that the investigative team started communicating only with handwritten notes: the old-fashioned paper letters were much harder for a skilled hacker to intercept.³⁴ The investigators, eventually, identified the hacker; they discovered where he lived and followed through as they would have in any other case: upon the authorization of a judge, they arrested the suspect, searched the premises and they seized all relevant material that they could find – in this case: several terabytes of digitally stored information, as well as millions of digital assets. The suspect in this case has been formally charged and he will stand trial in Italy.

Often, however, things are not so easy. The nature of networks, and the internet in particular, makes it all too easy to attack systems that are located outside the nation, hence, outside the jurisdiction, beyond the physical reach of the law enforcement agency that has investigated the crime. At that point, the law enforcement agencies encounter two different types of hurdles. First, the investigation can be hindered, and the precise responsibility of an individual can become more difficult to ascertain. According to the 2024 ENISA Threat Landscape, 34 per cent of threats can simply not be attributed³⁵ – not to an individual, a company, or a group.

Even when investigators manage to at least identify the area from which the attack came, cooperation is not always smooth. LEAs, at that point, could require the help of at least one foreign authority that should assist in locating the suspect, and in preserving all potential evidence connected to the case. The complexity of the inquiry, hence, raises, and with it the time that it requires: bringing in another authority and asking for cooperation is not necessarily a speedy process, and it does not necessarily yield results in a short time. First of all, the foreign authority must show the political will to cooperate with the investigation of another country. Within the EU, the point does not normally pose issues, but the landscape of threats is much wider than that, and the rising international tensions do not help to ensure smooth cooperation. The principal sources of the detected cyber threats are the so-called “state-nexus actors”³⁶: they are organized groups, connected to nation-states, that are normally well-organized and well-financed. They are supposed to do their government’s bidding; hence, they enjoy a good level of protection from prosecution: they can operate with the relative certainty that they will never be surrendered to a foreign authority. The criminal justice system, in such cases, simply cannot work, which does not mean that the perpetrators – if identified – must go unpunished. Where this expression of state sovereignty fails, others could fill in: states can react with a wide variety of tools, including targeted sanctions on the individuals deemed responsible³⁷ for a state-sponsored cyber-counterstrike³⁸; it is the fast-evolving realm of cyber-diplomacy³⁹ and cyber-warfare.⁴⁰

State-nexus actors are not the only ones who can benefit from this kind of de facto immunity from foreign prosecution. Also group of cyber-criminals, motivated by profit, can be based in states that routinely refuse cooperation, often on the grounds of geopolitical interests and alliances. The lack of cooperation can either make the investigation impractical – making it harder to identify the offending individual or confirm suspicions – or it can make the enforcement impossible. If a sovereign nation refuses to hand over the alleged perpetrator, the criminal justice system is practically toothless: in some jurisdictions, suspects can be tried in absentia ⁴¹ but, even if the criminal proceedings ended up in a conviction, it would be very difficult – if not straight out impossible – to see the sentence carried out. In the majority of cases, the wheels of the expensive criminal justice machine would have turned to no avail, which makes alternative approaches much more convenient. The imposition of administrative sanctions does not require a complex, contradictory proceeding that ensures all the guarantees that the criminal justice system should respect. Furthermore, it does not require the cooperation of any other subject: it is a unilateral decision that puts the state (or the regional entity, such as the EU) back in control of its response. The effectiveness of the two tools appears to be the same, but the latter comes faster and at a lower cost.

V. The UN convention on cybercrime: a step towards an improved international cooperation?

Against such a background, one might believe criminal law to be a semi-abandoned tool. The assumption, however, would be wrong. International and regional organizations are renewing and reshaping the tools of criminal law and criminal procedure, with a variety of initiatives that often differ in style and overall objectives.

Many European efforts, led by the Council of Europe and the European Union, have been focused on the relationship between state authorities and service providers with at least three significant instruments: the Second Protocol to the Budapest Convention, the Digital Service Act, and the e-Evidence package. All deal with the same issue: disciplining the direct relationship between LEAs and service providers to ensure the swift disclosure and exchange of electronic evidence.⁴² These novelties largely mirror preexisting national or regional policies,⁴³ whereas other multilateral initiatives – which we will examine more closely – aim to face the global challenge of cyber threats with a worldwide, coordinated effort that should supersede national or regional initiatives. The endeavor is taking two, main roads: the proposal of a new international convention on cybercrime on the one hand, and the interest towards an international jurisdiction for cybercrime cases.

In 2019, the UN’s General Assembly adopted a resolution that established an “open-ended ad hoc intergovernmental committee of experts, representative of all regions, to elaborate a comprehensive international convention on countering the use of information and communications technologies for criminal purposes.”⁴⁴ The action was led by Russia, soon followed by other states like China, North Korea, Syria and Belarus, to negotiate a new international instrument with the potential to overshadow the 2001 Budapest Convention both in scope and in political support. The negotiation at the UN level was bound to involve all countries that did not have a seat at the table in the drafting, the implementation, and the possible amendment of the European instrument, which has been criticized on multiple occasions for being more focused on countries that host ICT infrastructure – namely: the “first world” – rather than on nations that host potential victims, such as small and developing countries.⁴⁵ The push to develop a new global standard, however, was received with alarm,⁴⁶ fearing that the treaty could be used as a trojan horse by autocratic regimes: under the guise of fostering cooperation, they could introduce provisions aimed at hampering free speech, investigating dissidents, whistleblowers, researchers and journalists. To facilitate the negotiations, some actors suggested adopting a narrow focus: according to this perspective, the treaty should have concerned itself only with the illicit conducts that are most relevant to the cybersecurity domain, such as unauthorized access to data; unauthorized interference with the systems – with a specific aim at DDoS attacks; and unauthorized data interference, with a focus of phishing campaigns. Such a lens would have allowed the divide to be bridged between the Budapest Convention’s notion of cybercrime and the concept of cybersecurity: the criminal law layer would have had a guideline specifically aimed at conceptualizing cyber-threats as crimes, developing a blueprint on how to cooperate to prosecute them globally. Moreover, such a concentrated effort would have allowed a content-neutral discussion: the differences on what constitutes inflammatory speech, hate speech or even extremist propaganda could have been avoided.⁴⁷ Although wise, this view has not prevailed at the negotiating table. The United Nations Convention on Cybercrime, adopted by the U.N. General Assembly on 24 December 2024, largely overlaps with the Budapest Convention.⁴⁸ The incriminating provisions also cover conducts such as fraud (Article 13); child pornography and online child abuse (Article 14); grooming, solicitation “or making any arrangement through an information and communications technology system for the purpose of committing a sexual offence against a child” (Article 15); non-consensual dissemination of intimate images (Article 16); laundering of the proceedings of crime (Article 17). This choice has made the treaty, once again, too broad to be an effective guideline on cybersecurity, as it is not specifically concerned with its needs.⁴⁹ Moreover, including content-related infringements has made the negotiation more contentious: cultural standards on subjects such as intimate pictures vary widely, and countries such as Iran have pushed hard for stricter provisions against the firm objections of other parties.⁵⁰

Moreover, the procedural provisions establish powers that, according to the private sector representatives participating in the negotiations, could actively harm national security, force companies to reveal vulnerabilities, and hamper cybersecurity research. The first worry arises from Articles 29 and 30, which regulate the real-time collection of traffic data and the interception of content data. They ask the adherent states to allow the convert collection of data – to be done directly or with the assistance of a service provider. These powers can be deployed only in the investigation of “serious crimes,” and Article 24 of the U.N. Convention contains a general call to respect human rights and the principle of proportionality; to ensure the right to an effective remedy and judicial (or other independent) oversight; to establish rules to narrow the scope and the duration of the measures. However, Articles 29 and 30 do not provide for any specific guardrail: the text fails to establish a minimal common guideline in the exercise of such penetrating powers, which has led organizations such as Microsoft – as an ISP that would have to cooperate in these investigative measures – to ask for the elimination of the two articles, equating them to a “de facto blessing” of “surveillance and intelligence collecting […] under the guise of combating cybercrime.”⁵¹

The broad definition of these investigative powers is much more worrying if one considers their scope: according to Article 23 of the draft, such procedural measures should apply not only to the offences established by the Convention, but also to other criminal offences “committed by means of an information and communications technology system,” and, even more broadly, to the collection of electronic evidence.

The second red flag has been raised about Article 28(4), which prompts the states to “empower its competent authorities to order any person who has knowledge about the functioning of the information and communications technology system in question, the information and telecommunications network, or their component parts, or measures applied to protect the electronic data therein, to provide, as is reasonable, the necessary information” to search and seize electronic data. The provision would not only force the disclosure of access credentials; it has a much broader scope than that: it would require “any person” to share information on how an IT system works, how it is built, how it is balanced and, therefore, where it is vulnerable. From a cybersecurity perspective (and from an intellectual property viewpoint as well), the provision could not be more problematic, especially at a time when a good number of cyber threats come exactly from nation-states, that would be able to leverage the measures of the convention to their benefit.⁵²

Finally, the text does not contain safeguards for “white hat” hackers and penetration testers, which – according to the Cybersecurity Tech Accord – are “aggressively targeted” in some jurisdictions.⁵³ The Convention does little to protect good-faith cybersecurity practitioners from criminal liability,⁵⁴ which has caused concerns: many companies rely on their efforts to identify and fix vulnerabilities, and some jurisdictions have carved specific safeguards in legal provisions⁵⁵ or prosecutorial guidelines.⁵⁶

Despite the last-minute calls for its rejection,⁵⁷ the Convention has now been adopted and is currently open for signature: it requires forty instruments of ratification by 31 December 2026 to enter into force.⁵⁸ According to the first declaration, the final text is a compromise that does not fully satisfy the interests of liberal democracies, which see the potential threats to fundamental rights; nor does it satisfy states such as the Islamic Republic of Iran, which objected repeatedly to the provisions that it deemed too lax. The ratification process will probably mirror the concerns of individual nations: many countries will reasonably try to minimize exposure, limiting the provisions that could be used as trojan horses while concluding bilateral treaties with nations they can trust.⁵⁹ The space for cooperation with foreign authorities will reasonably be restricted to protect national interests, such as its security and the protection of human rights. In other words, this multilateral effort will depend on the unilateral willingness to cooperate, and given the heightened international tension, it is unrealistic to assume that this tool, alone, could mark a decisive improvement in cooperation.

VI. An international criminal court for cybercrimes?

Another set of proposals has stemmed from the need for transnational cooperation: if cyberthreats and cybercrimes are organized on a global playfield, some scholars have advocated for an ad hoc international institution, ie, an International Criminal Court for Cyberspace.⁶⁰ The proposal is for sure authoritative and fascinating: such an institution, run effectively, could at least coordinate and direct investigations in an independent way, acting as a global watchdog rather than as the guardian of one individual nation. If taken seriously, such an effort could help reign in the “state-nexus” actors or at least provide an independent, authoritative account of the phenomenon. This new international tribunal, according to its proponents, should work as a new, additional permanent organism; it should have its statute and its jurisdictional perimeter; in other words: it should not be a mere expansion of the International Criminal Court (ICC) and its Rome Statute. The suggestion is captivating, but it does not seem feasible, at least in the short term.⁶¹

Another similar avenue, however, has been studied for years and has recently shown some interesting developments. In particular, the discussion has been focusing on the International Criminal Court of the Hague and its mandate: can it already adjudicate cybercrime cases? At what conditions? The Rome Statute limits the scope of the ICC to “the most serious crimes of concern to the international community as a whole” (Article 5), leaving the “minor” episodes to the national authorities. Moreover, the jurisdiction only regards a narrow list of crimes: genocide, crimes against humanity, war crimes, and crimes of aggression. On the one hand, according to some scholars, the provisions can be interpreted in such a way to include cyberattacks: to all intents and purposes, they are an essential part of modern warfare, and they can be construed as “use of force,” and therefore they should be evaluated by the competent international authority.⁶² Other voices, on the other hand, argue for an amendment of the statute: cyberattacks can have devastating effects and they should be included in the list of crimes that fall under the Court’s scope. Doing it without modifying the statute would mean adding a crime through case law: even if cyberattacks are undoubtedly part of modern warfare, their adjudication by the court would be “a novelty,”⁶³ infringing upon the nullum crimen sine lege principle established by Article 22 of the Statute. A third position strikes quite a realistic balance: it argues that cybercrimes could already be conceived as war crimes as defined by the Statute, but this simple acknowledgment would not automatically bring results in terms of deterrence. Building a solid case would require an unshakable attribution, as well as a precise assessment of the consequences of the cyberattack: it should always clear the gravity threshold set by Article 5 and be so severe to constitute a “concern to the international community as a whole.” These two requirements are typically not easy to satisfy, which would hamper the dissuasive power of the entire system.⁶⁴ Moreover, prosecutors could focus on different, “easier” cases rather than on an investigation that could be long, complex, and expensive, and that could very well lead to uncertain attribution.⁶⁵

The theoretical inquiry could soon be tested. After some encouraging statements by the ICC’s prosecutor,⁶⁶ the Berkeley Law’s Human Rights Center has filed an Article 15 communication with the ICC prosecutor’s office asserting the occurrence of cyber war crimes perpetrated by Russia on Ukraine’s critical infrastructure.⁶⁷ The communication appears to be based on a Grand Jury Indictment unsealed in 2020 by the U.S. Department of Justice, which leveled charges against six Russian military intelligence officers allegedly responsible for a series of cyberattacks.⁶⁸ The case, hence, could benefit from a previous investigation, carried out by a single nation, that has arrived to a precise attribution; of course, it is for the ICC prosecutor’s office to evaluate the credibility of all information that they receive, but the information has been shared, and the question has been formally asked. Reportedly, the Prosecutor’s office is considering the label of “war crimes” for the cyber-attacks against civilian infrastructure in the Russia–Ukraine war.⁶⁹

Whatever conclusions it will reach, the investigation will surely be groundbreaking for the assessment of cyber-attacks as war crimes. From a practical point of view, however, the problem of effectiveness would not change much: a full investigation requires time; attribution and the gravity threshold pose serious issues, and, finally, even if the process would end in a conviction by the ICC, the question of enforcement would remain open. The decision would have a huge symbolic value, but it could be less significant in terms of concrete deterrence.

VII. Conclusions

Despite all its flaws, and all the hurdles of mutual legal assistance, the criminal justice system is still a sought tool in the fight against cyber threats, and for good reasons. It can neutralize criminals by detaining them while protecting the accused through all the procedural rights that a criminal trial guarantees – and that could be practically eluded by bestowing administrative sanctions. At the same time, the perspective of being caught and having to face real-life consequences can be much more dissuasive than receiving another kind of sanction. A functional criminal justice system, hence, is a very valuable device also from a strict cybersecurity perspective. For the partnership to be profitable, though, the effectiveness gap needs to be bridged.

A first, useful step could consist in the abandonment of the label “cybercrime,” as it frames the discussion in a somewhat unhelpful way. In the beginning, it was conceived to focus the attention on those illicit acts that required the “knowledge of computer technology […] to understand the intentional acts.”⁷⁰ Nowadays, the investigation and the ascertainment of any crime needs some degree of ability – or, at least, of awareness – when it comes to digital technologies: that criterion cannot be productively used to identify a class of similar situations, that share methods, investigative needs, legal and operative problems. It is time to unpack the notion of “cybercrime,” which would allow us to focus more on the issues to solve (and on the possible solutions) rather than on the technology alone.

This simple change of perspective could lead to significant changes in policy. The organization of LEAs, for instance, would follow a different path. Instead of having units of specialists devoted to “cybercrimes” – ranging from IP theft to cyberbullying, from cyberattacks to child pornography – the police forces would set a baseline of digital skills that should be common to every unit, as they are a necessary tool of daily practice. Some units, at that point, could specialize by subject: some would work on child pornography, some on international terrorism, but some would comprehensively work on the offences that tend to be more significant from a cybersecurity perspective.

The reporting system would change accordingly: it would not lump together all “cybercrimes,” but it would distinguish the type of scenario from the beginning. Similar models already exist: F.B.I., for instance, provides a good example of a similar structure. Its Internet Crime Complaint Center (IC3) has such a “narrow” scope. Its website clearly explains its mission to the public and allows them to file a report; at the same time, the opening page makes clear that the IC3 does not deal with terrorism, child pornography, or sources of imminent danger: it indicates the proper channels for each of these possibilities, but it explicitly declines to treat with those affairs. The United Kingdom offers a similar service with the National Fraud & Cyber Crime Reporting Center: its website contains information on the most widespread types of online fraud and presents a simple and transparent way to report phishing, fraud, and other cybercrime-related incidents.⁷¹

If such structures were widespread, adequately equipped and funded,⁷² citizens would have a clear reference point to report facts that are normally perceived as minutia, not severe enough to investigate or even to relate to the police. Having a dedicated unit would signal to the public that identity theft and system interference are not facts to be taken lightly, or circumstances that the authorities would not even bother to review. The victims would know who to address. They could talk with someone who understands the harm they have received, and who has all the background information that one needs to appreciate the gravity of the occurrence. Individuals would probably report more incidents, allowing LEAs to paint a granular picture of cyber threats.

The shift would reinforce communication between investigators and individuals, creating public trust. At the same time, it would generate a stream of information that would be crucial in mapping ongoing threats: there would be more data points to reconstruct, investigate and prosecute them. The proposal, of course, would not solve all issues. For instance, it would not do much to prosecute effectively foreign state-nexus actors: in that scenario, the available countermoves would still be referring the case to intelligence services, or imposing administrative crime-based sanctions as discussed above. The investigation, however, would be more accurate: attribution could be more precise and definitive, providing a better indication of what could constitute a proportionate response. Moreover, data would also be crucial from a preemptive point of view: cybersecurity strategies are as good as the knowledge they are based on, and having a more precise idea of the threat landscape would help improve them.