State and Non-State Cyber Actors and the Primacy of National Courts in Individual Criminal Accountability
Year: 2026
Type: article
Abstract: The evolution of warfare and international criminality has increasingly moved into cyberspace, where state and non-state actors alike now possess the capability to inflict harm equivalent to that of traditional atrocity crimes: disabling hospital systems, crippling energy grids or destroying civilian infrastructure through purely digital means. The Rome Statute of the International Criminal Court, adopted in 1998, was drafted in an era of kinetic warfare and did not contemplate cyber conduct explicitly. Yet its framers drafted the instrument’s core provisions, such as individual criminal responsibility, command and superior responsibility and the mental element, in technology-neutral terms capable, in principle, of extending to new means of commission. The Office of the Prosecutor’s December 2025 Policy on Cyber-Enabled Crimes under the Rome Statute is the first formal confirmation by an international prosecuting authority that existing doctrine can be applied to cyberspace, covering conduct ranging from state-directed cyber units to hacktivist collectives and criminal proxies. Despite this doctrinal clarification, international criminal law faces a stark enforcement reality: no individual has yet been convicted by an international tribunal for a cyber-enabled international crime. This gap persists even as both state-sponsored and non-state cyber actors operate with increasing frequency. The paper distinguishes state from non-state cyber actors through the effective control test, the overall control test and the approach of the Tallinn Manual 2.0, and develops a multi-factor approach to cyber attribution built on factors such as institutional or organisational nexus, direction and control, object and target selection, and technical or forensic indicators. It argues that while the Rome Statute’s liability doctrine is formally actor-neutral, its practical application diverges sharply between state and non-state cyber actors, driven by attribution difficulties and the non-membership of major cyber powers. It further examines how national courts, operating through both domestic criminal statutes and universal jurisdiction, are structurally better positioned than the ICC to close this accountability gap for both types of actor.
DOI: 10.63108/ijlmh.12986
Author: Yashwant S C
Institution: SASTRA University
Language: English
Field: Social Sciences
Domain: Social Sciences
Open Access status: hybrid
OpenAlex ID: W7220440156