Nuremberg on the cloud: Re-imagining crimes against humanity in the cyberspace

The concept of “crimes against humanity” first emerged in international law during the 1945 Nuremberg trials to prosecute German war criminals. Almost a century later, those same legal systems are struggling to keep pace with a new frontier of violence: one where the battlefield is digital and the weapons are lines of code.

Following the atrocities of World War II, the international community—through the United Nations International Law Commission founded in 1945—worked to define those crimes that fell outside the scope of existing international humanitarian law. This pursuit of justice was further refined by the “second generation” of international tribunals, such as those for the former Yugoslavia (ICTY) in 1993, and Rwanda (ICTR) in 1994. These efforts culminated in 2002 with the permanent International Criminal Court (ICC), operating under the Rome Statute to define the elements of such crimes with greater precision.

In pursuit of justice

Much of the credit for this new legal framework goes to the Independent Commission of Experts established by former UN Secretary-General Boutros Boutros-Ghali. The commission was founded and led by the late Egyptian jurist Cherif Bassiouni, a professor of international law at Syracuse University’s center in Italy, with whom I worked from 1998 until his passing in 2017.

I witnessed Bassiouni’s pivotal role in drafting the Rome Statute. In 2002, he was the world’s leading candidate to serve as the ICC’s first president, a move only blocked by the Egyptian government’s refusal to ratify the court’s treaty—a significant story I intend to detail in the future.

 Every crime against humanity listed in Article 7 could now be committed by digital means

Under Article 7 of the Rome Statute, a crime against humanity is defined as any specific prohibited act committed as part of a “widespread or systematic attack directed against any civilian population.” Crucially, the crime must be carried out pursuant to, or in furtherance of, a state or organizational policy.

The statute lists 11 such acts, including murder, extermination, rape, enslavement, persecution, and torture. For these acts to qualify, the “contextual elements” must be met: they must be part of a large-scale or methodical attack, the perpetrator must have knowledge of that attack, and the act must be supported by a state or an organization.

Old crimes, new tools

Today, nearly 25 years after the ICC began its work, the court and the legal community face a profound challenge: the rapid evolution of the digital sphere and artificial intelligence.

It is no exaggeration to state that every crime against humanity listed in Article 7 could now be committed by digital means. While international criminal law was traditionally built on identifying physical acts of violence, the digital age has shifted the battlefield.

For example, murder as a crime against humanity could be committed by hacking the control systems of water plants, sewage facilities, power grids, or hospitals. If an individual carries out such an attack knowing it will result in mass fatalities, the legal threshold is met.

Similarly, extermination—the act of mass killing—can now be achieved by disrupting medicine and food supply chains or by compromising aviation and surveillance systems to cause mass-casualty crashes.

Persecution of a group based on religious, ethnic, cultural, or sexual grounds is another crime that can be perpetrated in cyberspace. By inciting violence or systematically depriving a specific group of their fundamental rights—such as the rights to life, expression, privacy, or belief—actors can carry out persecution through digital platforms.

Expanding the umbrella of justice

Consequently, it should be possible to prosecute digital conduct that mirrors the acts specified in Article 7 as crimes against humanity, provided it remains part of a widespread or systematic attack against civilians.

Because these crimes must be committed according to the policy of a state or an “organization” acting on its behalf, the rise of cyber operations expands the list of potential defendants. Under the Rome Statute, an “organization” may now include any group with the technical capacity to execute repeated, systematic criminal operations.

This shift suggests that crimes against humanity online are not limited to individuals acting for states. Potential defendants now include members of rebel or insurgent groups, terrorist organizations, hacking collectives, employees of digital platform corporations or AI developers, as well as state-sponsored troll farms.

These new actors, who utilize the digital frontier to facilitate atrocities, are now potential perpetrators of crimes against humanity and so potential targets for prosecution before the International Criminal Court as war criminals.