In an article published last month in Foreign Policy Analytics, Karim Khan – the lead prosecutor at the International Criminal Court (ICC), based in the Hague – declared that his office will now be investigating and potentially prosecuting “war crimes” committed in cyberspace. This comes after Joe Biden ordered his administration to begin sharing evidence of alleged Russian war crimes committed in Ukraine with the ICC.

Khan wrote that his office will investigate cyber crimes that possibly violate the Rome Statute. “Cyber warfare does not play out in the abstract. Rather, it can have a profound impact on people’s lives… Attempts to impact critical infrastructure such as medical facilities or control systems for power generation may result in immediate consequences for many, particularly the most vulnerable. Consequently, as part of its investigations, my Office will collect and review evidence of such conduct.”

On Thursday, Washington and London sanctioned 11 people allegedly affiliated with Trickbot, a Russian hacking group accused of targeting businesses and government infrastructure, as well as hospitals, during the coronavirus pandemic. A US Treasury statement describes the individuals as “key actors involved in management and procurement” for Trickbot, which is claimed to be connected with Russian intelligence.

Lindsay Freeman – the director of technology, law, and policy at Berkely’s Human Rights Center – explained that the ICC’s remit extends beyond hackers themselves to the command structure above them, which could lead to charges against higher level military officers or Russian President Vladimir Putin himself. The ICC issued an arrest warrant for Putin, he has been accused of kidnapping, and unlawfully deporting to Russia, thousands of Ukrainian children as well as teenagers.

According to a report in Wired, Khan’s office confirmed the new cybercrime mandate with the outlet. “The Office considers that, in appropriate circumstances, conduct in cyberspace may potentially amount to war crimes, crimes against humanity, genocide, and/or the crime of aggression.” The spokesperson continued, “…such conduct may potentially be prosecuted before the Court where the case is sufficiently grave.”

Disinformation, vaguely defined, is listed as one of Khan’s concerns in his article, “We are likewise mindful of the misuse of the internet to amplify hate speech and disinformation, which may facilitate or even directly lead to the occurrence of atrocities.” He suggests the ICC could prosecute people for leaking confidential information as well, writing “disinformation, destruction, the alteration of data, and the leaking of confidential information may obstruct the administration of justice at the ICC and, as such, constitute crimes within the ICC’s jurisdiction that might be investigated or prosecuted.”

It is noted, in the Wired report, that Kiev is currently conducting its own investigation into Russian “war crimes carried out via cyberattacks.” Evidence collected as part of the Ukrainian government’s investigation could also be provided to the ICC’s prosecutors to assist with their cases.

Regarding the legal precedent, Bobby Chesney – director of the Strauss Center for International Security and Law at the University of Texas Law School – says “I don’t think anyone who’s serious about international law would dispute that there are at least some circumstances in which intentional harm to civilians can be carried out through cyber means in a way that qualifies as an attack” that violates the Rome Statute’s principle that warring parties distinguish between military targets and civilians. Neither Russia, Ukraine, nor the United States, are parties to the Rome Statute.

Last June, Gen. Paul Nakasone, the head of US Cyber Command, revealed to Sky News that Washington has been aiding Ukraine by conducting “offensive” cyber-attacks against Russia. Nakasone said the US has “conducted a series of operations across the full spectrum; offensive, defensive, information operations” aimed at Russia, without offering more details.

Ukraine formally joined the North Atlantic Treaty Organization’s Cyber Defense Center earlier this year. Biden has previously warned that cyber conflicts are liable to start a real war with Russia and China. “If we end up in a war, a real shooting war with a major power, it’s going to be as a consequence of a cyber breach of great consequence.”

As with the United States, Russia is not a member of the ICC and does not recognize the court. In 2002, President George W. Bush signed into law the American Servicemembers’ Protection Act, also known as the “Hague Invasion Act.” The bipartisan legislation goes as far as to authorize military action against the Netherlands – a fellow founding member of NATO – to prevent US officials and military personnel accused of war crimes from facing accountability before an international tribunal.

During the Donald Trump administration, the US sanctioned ICC officials for attempting to investigate American war crimes committed in Afghanistan. Former Secretary of State Mike Pompeo charged the court is an “unaccountable political institution masquerading as a legal body.”