Obviously, the (Russian-Ukrainian) conflict is also fought by hitting technological infrastructures. It is not surprising, then, that, on the one hand, Ukraine is pushing for the ‘recruitment’ of a ‘foreign legion’ of people capable of using computers offensively. Also, it is not suprising that, on the other hand (more or less), spontaneous aggregations of groups are springing up that fight for one or the other side using information technology. Lastly, the cunning subject of actions committed by so-called ‘state-sponsored’ subjects or criminal groups comes into play. They take advantage of the institutions’ ‘accidental distractions’ —if not blind eye— and commit crimes to the detriment, as it happens, of hostile countries. In this case, it is often difficult to draw a line between a state’s inability to prosecute offenders and its interest in creating a confused and uncertain situation, of which it can indirectly take advantage by Andrea Monti – Initially published in Italian on Strategikon – an Italian Tech blog
At least under Italian law, going to fight under a foreign flag is not only a crime but also justifies the application of special preventive measures. It applies to those who physically take up arms in the name of a cause and those who, with the same motives, attack the technological infrastructure of a belligerent party. In other words, attacking the information systems of a country at war means, to all intents and purposes, being a party to the conflict.
These behaviour violates Article 244 of the Penal Code, which provides for imprisonment from 6 to 18 years for anyone who, without government authorisation, takes up arms or performs hostile acts against a foreign State, in such a way as to expose the Italian State to the danger of war. The provision increases the penalty to life imprisonment if war actually breaks out due to these actions and punishes with heavy penalties the ‘mere’ exposure of Italy or its citizens to retaliation and reprisals. If retaliation occurs or diplomatic relations are interrupted, imprisonment can go up to fifteen years.
The Milan Public Prosecutor’s Office has already started investigating Italians’ presence in Ukraine. It would be interesting to see if it will extend the file to those carrying out cyberattacks from Italy. It also worth pointing out, on this issue, a paradoxical regulatory short-circuit that concerns the possibility of charging the authorities of the ‘recruiting’ country (whatever it may be). The relevant offences would be incitement and criminal association, as well as the violation of Article 288 of the Penal Code (Whoever in the territory of the State and without government approval enlists or arms citizens, so that they may serve or in favour of a foreigner, shall be punished by imprisonment from four to fifteen years). Since a state of war has not been declared and alliances have not been formally determined if a foreign State recruits persons on Italian territory to commit offences (also) in another country, the ‘principle of ubiquity’ of criminal prosecution applies. It is enough for a crime to start, ‘pass through’ or end in Italy for the public prosecutor to start an investigation.
The case of (more or less spontaneous) aggregations of entities that, while not serving under another flag, decide to attack a country’s infrastructure is different. Remaining within a purely legal perspective (and which therefore cannot enter into the merits of the ethical value of individual choices), we are faced with common criminal offences for which it would not even be possible to prove the defence of having been formally incorporated into a foreign army. Moreover, uncoordinated actions and clearly committed without being framed in an overall strategy risk being even counterproductive. Finally, there remains the question of covert and clandestine operations in times of (formal) peace – a subject not regulated by Italian law – and therefore subject to the ordinary rules of the criminal code. It is largely conceivable that the involvement of Western states in actions in support of Ukraine and the Russian reaction results in activities below the threshold of (public) perception and whose existence must be deniable and disproved if something goes wrong. If this were not the case, then the certain attribution of a cyber attack to a state would fall into the category of hostile acts under undeclared war, with all the appropriate consequences.
In conclusion, whichever way you look at it, responding to a foreign country’s ‘call to arms’ or directly intervening in a conflict outside of any norm are illegal actions and should be punished. This, at least until right of war is applied.
Although, then there will be more to worry about.