Ships in intl waters are still governed by the laws of their flag state. I don’t see why this wouldn’t also apply to the ISS as a US-flagged vessel

Edit: I assume the modules are flagged differently. I imagine Zvezda and the Soyuz’s are flagged Russian, etc. or maybe the ISS is jointly flagged under US and Russian laws at the same time. Or the laws of the citizens home country is applied individually or something.