Prosecuting cyberterrorists: applying traditional jurisdictional frameworks to a modern threat.

Author:Stockton, Paul N.
Position::III. International Law Grounds for Extraterritorial Jurisdiction Applied to Cyberterrorism B. Nationality Principle through Conclusion, with footnotes, p. 241-268
  1. Nationality Principle

    The "nationality theory," often referred to as "active personality," grants jurisdiction based on the nationality of the offender, regardless of where the crime took place. This theory derives from the recognition that a nation, by virtue of its sovereignty, exerts unlimited control over its citizens. Nations should therefore be entitled to exercise jurisdiction over their citizens regardless of their citizens' locations when they perpetrate a crime. Similarly, as long as nationals retain their citizenship, they should be expected to adhere to their countries' laws when they are abroad. As the U.S. Supreme Court articulated in United States v. Bowman, a case concerning a crime perpetrated by U.S. nationals in Brazil: "Clearly it is no offense to the dignity or right of sovereignty of Brazil to hold [the U.S. defendants] for this crime against the government to which they owe allegiance." (147) A decade later, in the widely cited case of Blackmer v. United States, the Supreme Court similarly reasoned,

    While it appears that the petitioner removed his residence to France in the year 1924, it is undisputed that he was, and continued to be, a citizen of the United States. He continued to owe allegiance to the United States. By virtue of the obligations of citizenship, the United States retained its authority over him, and he was bound by its laws made applicable to him in a foreign country. (148) In addition to the rationales of sovereignty and allegiance, the nationality theory of jurisdiction is also grounded on due process concerns. A citizen is expected to be most knowledgeable about his own country's laws. Therefore, the nationality principle would provide the perpetrator with sufficient notice about the criminality of his future actions. In contrast, applying another nation's criminal statute would limit the opportunity for fair warning.

    However, the due process justification underlying the nationality doctrine is obsolete in the context of cybertcrrorism. The Internet and other communications technology provide terrorists with unparalleled access to information regarding which nations have criminalized cybercrimes and cyberterrorism. The Internet is replete with newspaper articles, scholarly papers, and blogs addressing the criminal consequences for engaging in such activity. A terrorist who executed a technologically sophisticated cyberterrorist attack would be hard pressed to argue that he lacked fair notice concerning the unlawfulness of his actions.

    The nationality principle of jurisdiction is also impractical for prosecuting cyberterrorists due to the aforementioned attribution dilemma in cyberspace. As discussed previously, cyberterrorists can hijack botnets in multiple countries, route through proxy servers, and leave behind a "false flag," therefore "implicating an otherwise innocent individual, group, or government." (149) Following the 2009 cyberattacks against Google, Yahoo, Morgan Stanley, and other corporations, dubbed "Operation Aurora," Google accused China of designing the attacks to steal intellectual property and other company data. However, approximately a year later, an Atlanta-based security firm that carefully analyzed the malware posited that "new and amateur botnet operators" had designed the attacks. (150) Attribution efforts proved similarly inconclusive following the Estonian attacks and 2009 distributed denial of service attacks against United States and South Korean websites.

    Therefore, if prescriptive jurisdiction over a cyberterrorist were to be based on the nationality doctrine, the international community would have to reallocate jurisdiction as new information on the true source and nationality of the perpetrator was discovered. Such reallocation would generate high transaction costs and prosecutorial inefficiencies. Furthermore, nations would have less motivation to invest significant resources in prosecuting a cyberterrorist if they believed that other countries could usurp their jurisdiction once new revelations about the perpetrator's nationality emerged. Although U.S. attribution capabilities are improving, they are still not sufficiently robust to avoid the pitfalls associated with applying the nationality principle to cyberterrorism.

  2. Passive Nationality Principle

    The "passive nationality" doctrine, often labeled "passive personality," confers jurisdiction based on the nationality of the victim. It is premised on the principle that nations have a responsibility to protect their citizens, even when they are abroad. In a few instances, nations have extended the doctrine to exercise jurisdiction over crimes perpetrated against their domiciliaries or residents. However, such an extension has been rare and controversial. (151)

    Many nations and legal scholars consider the "passive personality" doctrine to be one of the most controversial bases of prescriptive jurisdiction under international law. (152) U.S. courts traditionally rejected the principle, reasoning that it would infringe on state sovereignty and territorial jurisdiction. Under this doctrine, criminals perpetrating crimes in their own countries would be subject to endless litigation under the criminal laws of every visitor's home state. Furthermore, the accused would be deprived of fair notice when the substantive laws of his country and that of the victim's nation differed. (153) Judge Moore's dissenting opinion in the S.S. Lotus case exhibited America's historical skepticism of the passive personality doctrine. Moore reasoned that "passive personality" is:

    [At] variance not only with the principle of the exclusive jurisdiction of a State over its own territory, but also with the equally well-settled principle that a person visiting a foreign country, far from radiating for his protection the jurisdiction of his own country, falls under the dominion of the local law and, except so far as his government may diplomatically intervene in case of a denial of justice, must look to that law for his protection. (154) Given the international community's widespread rejection of the passive personality principle, the Harvard Research Project's "Draft Convention" did not even recognize the principle as an independent basis of jurisdiction. (155) Although the Draft Convention did discuss this principle, it only acknowledged its potential application when jurisdiction would already be warranted under the universality doctrine. According to the drafters, when a universally recognized crime was perpetrated beyond the territory of any state, the state whose nationals were victims could receive jurisdictional preference. (156) The drafters believed that the nation whose citizens were victims would have the strongest motivation to prosecute the perpetrators. (157) When discussing the passive personality principle, the drafters repeatedly emphasized its controversial nature. They contended that passive personality "has been vigorously opposed in Anglo-American countries ... has been more strongly contested than any other type of competence," and "is the most difficult to justify in theory." (158)

    The passive personality doctrine continues to have the least support in customary international law among the other theories of prescriptive jurisdiction. (159) However, in recent decades, the international community has increasingly accepted the legitimacy of the passive personality principle when applied to international terrorism. (160) Numerous U.S. statutes, including the Hostage Taking Act of 1984 and the Omnibus Diplomatic Security and Antiterrorism Act of 1986, grant passive personality jurisdiction over crimes committed by foreigners against U.S. nationals abroad. The principle is also codified in international agreements, including Article 9 of the International Convention Against the Taking of Hostages (161) and Article 3(1)(c) of the Convention on the Prevention and Punishment of Crimes Against International Protected Personnel Including Diplomatic Agents. (162)

    Asserting passive personality jurisdiction over cyberterrorists is impractical for similar reasons to those elucidated above for why the effects based principle is inappropriate. Since cyberattacks would inflict damage across the globe, citizens of multiple countries would fall victim. Applying the passive personality doctrine to cyberterrorism would therefore engender infinite and competing claims for prescriptive jurisdiction.

    The fact that the passive personality doctrine, in comparison to other jurisdictional principles, constitutes such a significant encroachment on other nations' sovereignty also militates against extending this doctrine to cyberterrorism. International cooperation is critical for successfully investigating and prosecuting cyberterrorism. Other states would be less amenable to requests for investigative assistance and extradition if they believed that the United States encroached on their sovereign authority even though there was no direct threat to American national security. (163)

  3. Universal Jurisdiction Doctrine

    According to the principle of universal jurisdiction, any nation may assert prescriptive jurisdiction over certain crimes regardless of the locations of the crimes or the nationalities of the perpetrators and victims. States may therefore receive jurisdiction even when they lack any connection to the offense. (164) Historically, courts and legal scholars provided two rationales for exercising universal jurisdiction. The first rationale focuses on the sheer atrocity of the crime. Certain crimes are so nefarious that they constitute an "affront to humanity" and endanger the international community as a whole. (165) The perpetrators of such crimes are considered hostis humani generis--the enemy of all mankind. Therefore any nation, serving as humanity's representative, should be empowered to prosecute the individuals who are responsible. (166)

    The second historical rationale for universal jurisdiction focuses on the locus...

To continue reading