The International Criminal Court (ICC) is investigating a cyber attack that compromised its systems with sensitive information about ongoing cases.
On September 19, 2023, the ICC said it responded promptly after it “detected anomalous activity affecting its information systems.”
The ICC took immediate measures to respond to the cybersecurity incident and to mitigate its impact. However, the ICC withheld information about the intruder’s identity, raising speculations about the potential culprits who have previously targeted the court or are currently under investigation.
Sources say that the incident leaked “a large number of sensitive documents” related to multiple ongoing cases, including criminal evidence, names of persons of interest, and witnesses.
Established under the Rome Statute in 2002, the International Criminal Court has jurisdiction to try war crimes and has indicted high-profile individuals, including heads of state, for alleged war crimes.
Hague cyber attack is under investigation
The Hague, Netherlands-based intergovernmental organization is working with the Dutch Intelligence Agency to investigate the cyber attack and determine its impact.
“Additional response and security measures are now ongoing with the assistance of the Host country authorities,” ICC said in a statement.
The ICC also ensured the cyber attack did not disrupt its operations as investigations progressed.
“As the Court continues to analyse and mitigate the impact of this incident, priority is also being given to ensuring that the core work of the Court continues.”
However, the ICC did not divulge information on the nature of the cyber attack, the data accessed, or the threat actor’s identity.
Commenting on The Hague cyber attack, Nick Tausek, Lead Security Automation Architect at Swimlane, said threat actors aggressively targeted those who speak against their criminal activities.
“Just weeks after the International Criminal Court (ICC) announced it would begin prosecuting cyberwar crimes, the ICC disclosed on Tuesday that its systems had been breached,” said Tausek. “This breach highlights that threat groups are becoming more aggressive with their targets and actively targeting those who speak out against threat actors,” said Tausek.
Russia’s complicated history with the International Criminal Court
The International Criminal Court has been the target of Russian cyberattacks following investigations into alleged Russian war crimes in Ukraine and Georgia. Russia withdrew from the treaty in 2016 after the court described Crimea, Ukraine, as an “ongoing occupation.”
In June 2022, the Dutch authorities apprehended a Russian spy, Sergey Cherkasov, posing as a Brazilian national, Victor Muller Ferreira, and attempting to infiltrate the ICC.
According to Dutch authorities, Cherkasov worked with the Russian military intelligence agency GRU and intended to recruit internal sources and enable access to ICC’s digital systems. The United States has indicted Cherkasov, who is currently serving a 15-year sentence in Brazil for falsifying documents.
In March 2023, the court issued arrest warrants for Russia’s President Vladimir Putin and the Commissioner for Children’s Rights, Ms. Maria Lvova-Belova, for the deportation of Ukrainian children from the occupied regions. Subsequently, Putin became the first head of state of a permanent member of the U.N. Security Council to face ICC charges.
In July 2023, ICC opened The International Centre for the Prosecution of the Crime of Aggression (ICPA) to investigate Russian war crimes in Ukraine.
Following Putin’s arrest warrant, Russia put several ICC officials on its wanted list. Thus, the cyber attack could endanger people’s lives if Moscow was involved and obtained information about Russian nationals secretly working with the Court.
Russia’s cyber attacks could amount to war crimes
Indicating that cyber attacks “do not play out in the abstract” and could have “a profound impact on people’s lives,” ICC lead prosecutor Karim Khan said the ICC would start investigating cybercrimes that contravene the Rome Statute.
Cybercrimes that the ICC would investigate include cyber attacks on civilian critical infrastructure such as hospitals, control systems, power grids, and disinformation campaigns amplifying hate speech.
Ukraine has experienced a barrage of cyber attacks since the invasion began, with “cyber-attacks supportive to kinetic effects” in some cases, according to the SSSCIP Deputy Head, Viktor Zhora.
Apart from giving Russia a military advantage, the cyber attacks also increased the “genocide effects of conventional warfare” by targeting humanitarian organizations and logistics.
Similarly, Russian disinformation campaigns depicting Ukrainians as “Nazis” amounts to hate speech that could lead to violence against civilians.
Although Khan did not specifically pinpoint Russia’s cyber activities in Ukraine, diplomats are pressing the ICC to investigate the country for cyber war crimes.
