Ukraine enters uncharted territory with request to investigate Russian cyberattacks as war crimes

Ukrainian officials are breaking new ground — and possibly reshaping the future of cyberwarfare — as they seek to convince the International Criminal Court (ICC) in the Hague to investigate whether certain Russian cyberattacks could constitute war crimes.

Cyberattacks have increasingly become a part of modern warfare in recent years, and have been repeatedly used by Russian forces amid the country’s war in Ukraine to target critical infrastructure.

Such attacks, though, are not listed as a form of war crime under the Geneva Conventions. Legal experts and researchers have previously made the case for the ICC to prosecute Russian cyberattacks, but the reported push from Ukrainian officials marks the first time a sovereign government has made such a request to the court — and could be a game-changer.

“News that Ukrainian officials are weighing cyberattacks as potential war crimes is reflective of how seriously governments are taking these growing and evolving threats,” said Paul Martini, CEO and chief technology officer at cybersecurity firm iboss.

Earlier this month, Ukraine’s chief digital transformation officer, Victor Zhora, told Politico that his country is gathering evidence of cyberattacks tied to military operations and are sharing information with the ICC in the hopes of potentially charging Russia for those crimes. 

Zhora argued that since Russia used cyberattacks to support its kinetic military operations that targeted Ukraine’s critical infrastructure and civilians, the digital attacks should also be considered as war crimes against Ukrainian citizens.

“When we observe the situation in cyberspace we notice some coordination between kinetic strikes and cyberattacks, and since the majority of kinetic attacks are organized against civilians — being a direct act of war crime — supportive actions in cyber can be considered as war crimes,” Zhora told Politico.

“We are discussing completely new terms and ideas on how to classify these attacks, which happened during the war, which have never happened before,” he added.

Zhora also noted last year’s Russian attacks against Ukraine’s largest private energy investor, DTEK, as an example of when cyberattacks are used in conjunction with kinetic warfare.

“Their thermal power plant was shelled, and simultaneously, their corporate network was attacked,” he said. “It’s directed and planned activity from Russians, which they did both in conventional domain and in cyber domain.”

Convincing the ICC could prove difficult, however, says David Hickton, founding director of the University of Pittsburgh’s Institute for Cyber Law, Policy and Security, due to cyber crimes not being explicitly enumerated as war crimes under the Geneva Conventions.

Under the 1949 treaties, war crimes can include willful killing of civilians, torture or inhuman treatment, including biological experiments; willfully causing great suffering; and the taking of hostages, among other actions. Written before the modern technological era, the definition makes no mention of digital warfare.

Though they’re not included in the list, however, Hickton said cyberattacks could still be considered war crimes.

“It is quite possible, depending upon the facts, that cyber crimes could constitute war crimes, and I would support the effort to develop the evidence if a cyber medium was being used in warfare illegally,” he said. 

“I think just because cyber is not listed doesn’t mean cyber crime couldn’t be a war crime,” he added.

It is not clear whether or how the ICC has responded to the reported request from Ukrainian officials.

If the ICC does find that destructive Russian cyberattacks targeting critical infrastructure and civilians constitute war crimes, that could open grounds for potential prosecutions against the perpetrators of such attacks and possible reparations for the victims. 

Ukrainian officials aren’t the only ones trying to make the case before the ICC. Last year, a group of human rights lawyers and investigators in the Human Rights Center at University of California, Berkeley’s School of Law made a similar request to the court, urging it to look into whether a group of Russian hackers, known as Sandworm, could be prosecuted for launching destructive cyberattacks against Ukraine in 2015 and 2016, Wired reported.

That request followed the announcement made days after Russia invaded Ukraine by the ICC’s chief prosecutor, Karim Khan, that he was opening an investigation into possible war crimes committed by the Russian army.

“I am satisfied that there is a reasonable basis to believe that both alleged war crimes and crimes against humanity have been committed in Ukraine in relation to the events already assessed during the preliminary examination by the Office,” Khan said at the time. 

He added that his investigation would expand as the Russia-Ukraine war continued to include any potential future crimes falling within the ICC’s jurisdiction.

The researchers at Berkeley asked Khan to “expand the scope of his investigation to include the cyber domain in addition to traditional domains of warfare – land, air, maritime, and space – given the Russian Federation’s history of hostile cyber activities in Ukraine.”

Lindsay Freeman, the director of technology, law and policy at the Human Rights Center, told Wired that the ICC prosecutor’s office responded to the group’s request and was looking into its recommendations. 

But some experts aren’t convinced that making the case that certain cyberattacks could fall under war crimes is necessary, because there’s already evidence showing that the Russians did commit war crimes using conventional warfare. 

“I’m not sure we need to reach into cyber to figure that out,” said Jamil Jaffer, founder and executive director of the National Security Institute at George Mason University’s Antonin Scalia Law School. 

“I think there’s plenty of other stuff to chase down,” he said, adding that there are other types of war crimes that the Russians have committed that can be proven more easily in court than cyberattacks.

Although he agrees that the Russians have improved the way they coordinate their land and air warfare with their cyber operations, he said a lot of assessment and analysis must still be conducted to determine whether destructive cyberattacks targeting civilians and critical infrastructure could be classified as war crimes. 

“[Cyberattacks] are more of a novel application of war crimes, which you can still do and go through and figure out, but there are so many other very clear violations of the laws of war,” Jaffer said. 

“If the goal is to prosecute the Russians for their war crimes, you don’t need to go through the cyber analysis, you need to look at what they’re doing on the battlefield,” he added.