Sarrah Hammerl
Legal Research Fellow
Over the past decade, the ontological understanding of harm in international law has expanded to encompass conduct occurring within or facilitated by digital spaces. In its Policy: Cyber-enabled crimes under the Rome Statute (2025), the OTP laid out its strategy to approach ‘the crimes of tomorrow’ which are facilitated by new and emerging technologies.
The OTP maintains that the Rome Statute is ‘technology-neutral’, meaning the law applies to the effects of an act regardless of the digital or kinetic means used. Rather than creating a new legal category, the Policy defines cyber-enabled crimes as existing Rome Statute crimes that are committed by or facilitated through digital means. However, the Policy also recognises that the digital activities of perpetrators can provide important contextual or evidentiary value, irrespective of whether the crimes have been committed or facilitated by technologies. Hence, it concluded that nearly all modern criminal investigations now have a cyber component and thus ‘the issues addressed in this Policy may increasingly be relevant to all the Office’s investigations’.
The OTP Policy highlights how digital platforms might be exploited for criminal communication, in particular for direct and public incitement to genocide.
Drawing on the OTP Policy, this post analyses how digital conduct is legally classified as an international crime and how responsibility is attributed under the Rome Statute. As the first comprehensive statement of how the ICC intends to interpret and apply existing Rome Statute provisions to digital conduct, the Policy provides a unique lens through which to examine which emerging forms of harm, responsibility, and legal uncertainty international criminal law is likely to confront. Rather than offering a comprehensive review of the Policy, the post uses it to highlight key legal questions that illustrate how digitalisation is reshaping the boundaries of international criminal responsibility.
Specifically, the following sections explore to what extent cyber-enabled conduct might satisfy the elements of an existing Rome Statute crime, focusing on cyberattacks, surveillance, speech crimes, and digital repression, which also includes conduct affecting the fact-finding process itself. Once potentially criminal digital conduct has been identified, the last two sections shift to attribution—who is legally responsible —and finally jurisdiction—which court or State has authority to prosecute it?
Cyber-enabled crimes under the Rome Statute may include cyberattacks against computer networks and digital infrastructure governing water, electricity, heating, medical facilities, or food production with the intent to cause death or serious bodily or mental harm. Depending on the context and scope, the Policy links such conduct to the crime of genocide, crimes against humanity, war crimes, or crimes of aggression.
There is a persisting debate on whether cyber operations that cause only a loss of functionality qualify as an ‘attack’ for the purpose of war crimes under the Rome Statute. Relatedly, no consensus exists whether digital or electronic data as such count as a ‘civilian objects.
Some States take a narrow view, arguing data is intangible and thus cannot be an object. Others such as the International Committee of the Red Cross (ICRC) advocate for an expansive view, noting that excluding essential civilian data like pension databases or medical records would create a dangerous protection gap, with the OTP asserting that deleting data that leads to physical harm can qualify as a war crime.
[C]yber operators may bear responsibility if their surveillance methods are used to identify victims who are then killed or severely harmed.
Moreover, the assessment of attacks on infrastructure as a war crime that serves both military and civilian purposes such as cloud platforms, computer networks, or power grids are especially challenging. The OTP takes the position that the intentional use of self-replicating destructive malware that proliferates across civilian and military systems without discrimination may constitute an intentional, indiscriminate attack.
Furthermore, the OTP Policy addresses digital surveillance as both a tool for crimes and a specific element of persecution. If intrusive surveillance, particularly AI-enabled or biometric surveillance, is used intentionally to severely deprive an identifiable civilian group of fundamental rights, or to locate, identify, or track civilians who are then killed or severely harmed, such conduct might amount to persecution as a crime against humanity.
Speech Crimes and Social Media: When Does Online Behaviour Become Criminal?
The OTP Policy highlights how digital platforms might be exploited for criminal communication, in particular for direct and public incitement to genocide.
Likewise, declarations to not leave any survivors or making public threats to kill hostages via the internet or social media by a high-ranking official might amount to war crimes. Furthermore, the online publication of humiliating images of captives or deceased persons—shared for propaganda—is prosecuted as the war crime of outrages upon personal dignity.
Discussions remain around whether other speech acts shared on digital media platforms are criminal in and of themselves rather than actions that facilitate criminal acts, such as communicating orders or providing moral encouragement (abetting) for a crime using digital means.
At the same time, the Policy acknowledges an inherent tension between the prosecution of digital speech acts and the right to freedom of expression. In practice, the OTP will have to determine when a social media post crosses the line from ‘mere expression of disagreement’ to a criminal act.
Digital Repression & the Integrity of Justice
The OTP Policy asserts that justice must not be ‘outpaced by the speed of global change’ and that digital means are vital to ensuring technology is not exploited to ‘obscure the fact that crimes are committed at all’. In that sense, and in addition to questions around whether algorithmically amplified hate campaigns constitute specific human rights harms, it is necessary to likewise explore whether algorithmic repression of truth or organised denial does too.
This is echoed in the OTP Policy where the use of systematic internet outages to interrupt documentation and the reporting of crimes, misinformation campaigns to disguise that crimes were committed or who is responsible, and online hate speech or reputationally harmful AI-generated deepfakes to intimidate or retaliate against witnesses or officials of the Court, are recognised as offenses that interfere with the systematic pursuit of truth and justice. The OTP further emphasises that it will rigorously prosecute espionage and tampering with the Court’s IT to protect the integrity of justice institutions.
A major challenge for attributing liability arises from the use of autonomous AI systems, where outcomes may be unforeseen or unintended by human operators.
Individual Criminal Responsibility and Attribution Standards in the Age of AI
According to the OTP Policy, the distinction between committing and facilitating Rome Statute crimes by cyber means is based on the specific mode of individual criminal responsibility involved. Individuals may incur criminal responsibility as direct or indirect perpetrators where their cyber conduct satisfies the elements of a crime or constitutes an essential contribution to its commission, such as through hacking essential service systems like water, electricity, or hospitals to cause death or injury.
The Policy uses ‘facilitation’ in a non-technical sense to cover forms of responsibility other than commissions listed in the Rome Statute. This includes ordering, inducing, soliciting, aiding, and abetting, for instance using digital communication technology to transmit an order to commit a crime. Moreover, cyber operators may bear responsibility if their surveillance methods are used to identify victims who are then killed or severely harmed.
The Policy further emphasises that the OTP will investigate the potential liability of CEOs of digital service providers that knowingly assist the commission of international crimes, such as providing the technical infrastructure for hateful rhetoric with the purpose of facilitating such crimes, irrespective of whether these crimes are committed in the context of commercial activity. In grave cases, the OTP may also investigate natural persons for sharing or disseminating speech acts.
In addition, military and civilian superiors may be held responsible for crimes committed or facilitated through cyber means by their subordinates where they exercised effective control and failed to prevent or punish the conduct, irrespective of their technical expertise. This principle extends to the civilian leadership of digital service providers or heads of State overseeing cyber units.
[T]he very nature of cyberspace might pose challenges to the principal of territoriality
A major challenge for attributing liability arises from the use of autonomous AI systems, where outcomes may be unforeseen or unintended by human operators. If a human operator cannot understand or predict how an AI system reaches a conclusion, they likely lack the necessary intent and knowledge to bear individual criminal responsibility under the Rome Statute, particularly when digital systems involve multiple human and non-human actors.
Jurisdiction in Distributed Digital Spaces
The OTP maintains that the Court’s jurisdiction over conduct in cyberspace is governed by classical principles of territoriality and personality. The OTP reasons that for commissions by cyber-means, territorial jurisdiction exists if at least one element of the crime occurred on a State Party’s territory, including territories where the conduct began (subjective territoriality) and where it was completed or where the consequences occurred (objective territoriality).
Hence, the Court has jurisdiction if a person facilitates a crime that is eventually completed on the territory of a State Party, even if the accomplice acts from outside that territory. Furthermore, the use of cloud computing may mean a crime occurs in the territory of more than two States simultaneously, allowing for concurrent jurisdiction resolved through the principle of complementarity.
However, the OTP admits that Currently, the OTP does not view the mere transit of data through cables or servers located in a certain State as sufficient basis to establish jurisdiction based on territoriality. However, it adds that this does not preclude jurisdiction based on the nationality of the perpetrator.
Transforming Responsibility
This blog post aimed to analyse how digitalisation affects what forms of conduct constitute or facilitate international crimes, and how responsibility can be attributed under the Rome Statute. The OTP´s Policy adapts existing Rome Statute rules to digital contexts while emphasizing that the law remains technology-neutral, meaning that justice should focus on the effects of conduct rather than the technological means through which crimes are committed or facilitated.
In that sense, digitalisation expands the concept of legally relevant harm beyond direct physical violence to encompass conduct committed or facilitated through digital technologies. The OTP Policy recognises cyberattacks against critical infrastructure, AI-enabled surveillance, online incitement to genocide, the publication of degrading images of victims, digital witness intimidation, deepfakes, internet shutdowns, and coordinated misinformation campaigns as conduct that may constitute or facilitate Rome Statute crimes.
[V]ictims include not only those directly affected by physical violence but also individuals and communities harmed through digital persecution, surveillance, intimidation, or manipulation.
In doing so, it recognises that harm can arise not only from physical destruction but also from digital repression, violations of dignity, interference with truth-seeking, and attacks on the administration of justice. Consequently, victims include not only those directly affected by physical violence but also individuals and communities harmed through digital persecution, surveillance, intimidation, or manipulation.
Moreover, the OTP Policy broadens the range of actors who may participate in the commission of international crimes. Beyond direct perpetrators, criminal responsibility may extend to cyber operators, digital surveillance providers, military and civilian superiors, and executives of technology companies whose services knowingly facilitate international crimes. At the same time, digitalisation complicates legal concepts such as territorial jurisdiction, evidentiary assessment, attribution, and intent. Cloud computing, cross-border data flows, and AI systems challenge traditional jurisdictional principles and make it more difficult to identify responsible individuals. Autonomous AI systems produce harmful outcomes that are difficult to explain or trace to individual intent.
Lastly, the OTP Policy frames the digitalisation of its own operations as essential to ensuring that accountability keeps pace with technological change. Because nearly every contemporary investigation contains a cyber component, digital evidence has become central to establishing criminal responsibility. The Policy therefore expands both the categories of harm and potential perpetrators, and the Court´s engagement with technology companies and digital intermediaries that aid its investigations.
However, digitalisation not only creates new forms of harm and criminal conduct, but also expands the group of actors engaged in the reporting of such violence. Hence, Part III of this series explores how digitalisation has transformed access to justice by decentralising documentation and investigation efforts, while the unequal politics of participation simultaneously create new hierarchies of visibility and expertise.
This post is part of a series. Click here to access Part I. Come back next week for Parts III and IV.
Support our work!
We can only do our work thanks to the support of brave, passionate people like you!
Your donation will help us to keep fighting for human rights and access to justice for everyone, everywhere.
