Russian Cyberattacks Need an International Criminal Court Response

International law needs to keep pace with the changing nature of warfare. The ICC is best placed to take action.

In October 2020, the US Department of Justice unsealed a grand jury indictment charging six Russian military intelligence officers in connection with a series of destructive cyber-attacks. The indictment was noteworthy not only for what it contained, but also because of what was omitted — any mention of an armed conflict between Russia and Ukraine.  

The document charged the defendants with computer hacking, wire fraud, identify theft, and conspiracy, connecting targets across the globe from the French elections to the PyeongChang Winter Olympic Games to Ukraine’s critical infrastructure. But by failing to connect these cyber operations to the kinetic war underway in Crimea and Eastern Ukraine since February 2014, it missed the essential broader understanding of the true nature of these acts; they are not just computer crimes, they are acts of war.

Given that the International Criminal Court (ICC) has had jurisdiction over war crimes committed in Ukraine since 2014, the court’s Prosecutor has an opportunity to advance the laws of armed conflict by launching an unprecedented legal case: the first for cyber war crimes. Such a case could play an important role in ensuring that international law keeps pace with technological advances.

As argued in an Article 15 communication recently submitted to the ICC Prosecutor by the UC Berkeley Human Rights Center (for which the author works), at least two incidents of Russian cyberattacks against Ukraine’s power grid in December 2015 and 2016, which predate the most recent invasion, could be charged under the Rome Statute for the war crime of attacking civilian objects. Pursuing these charges, along with any additional cyberattacks since the start of this year that meet the requisite threshold, would be an important step towards modernizing international law and accountability mechanisms.

Both incidents detailed in the ICC submission are attributed to the GRU, the foreign military intelligence arm of the Russian armed forces, which played an integral role in the takeover of Crimea. Further, both cyberattacks shared a common military objective: to take possession of former Soviet territory, fortify Russian borders against NATO, and counter the power of the West. With Russia’s renewed aggression against Ukraine since February 2022, the argument to pursue cyber war crimes charges is further strengthened as the cyber domain becomes a critical area of the battlefield.

Russia’s actions in Ukraine reflect a well-articulated military strategy to dominate all five domains of warfare — land, air, sea, outer space, and cyberspace. This new multi-domain battle has significant implications for international security and presents a wholly new challenge for the global criminal justice community. War crimes investigators and prosecutors only have experience with three of these domains, having been primarily focused on crude non-international armed conflicts for the past two decades.

While many commentators have been quick to point out that Russia has not caused the level of damage that was anticipated, experts like US Cyber Command Director Gen. Paul Nakasone say that they are speaking too soon. At a Vanderbilt University conference, the general challenged the narrative that Russia has not launched destructive cyberattacks against Ukraine as part of its invasion and criticized those scoffing at the relative lack of cyber aggression outside of Ukraine. “This idea that nothing has happened is not right,” he said. National Security Agency (NSA) Director of Cybersecurity Rob Joyce agreed, stating that there has been “astronomical cyber pressure brought to Ukraine and their networks by Russia.” 

In a recent article, Yurii Shchyhol, head of Ukraine’s State Service of Special Communications and Information Protection, confirmed that hackers have attacked humanitarian organizations and “hospitals and first responders have been subjected to cyber-attacks designed to disrupt the provision of emergency services in the immediate aftermath of airstrikes.” Depending on the facts, targeting humanitarian organizations and emergency medical services could be classified as war crimes.

Prosecuting authorities with jurisdiction over this conflict are faced with an important decision — do they stick with what they know by pursuing accountability for “traditional” war crimes or do they expand their scope to include cyber military operations? Prosecutors should make this clear now so that valuable evidence is not lost, and so that individuals holding information with evidentiary value can recognize it and share it with the proper authorities.

We should not wait for a catastrophic cyber event with severe human casualties before we act. We already know the capabilities exist to poison the water supply, open a dam, down an aircraft, or shutdown life supporting hospital equipment by cyber means alone. While Russia has made clear that it does not intend to comply with international humanitarian law, prosecuting its cyberattacks against Ukraine’s critical infrastructure could have an important deterrent effect on other state actors. Perhaps China, which benefits from the status quo legal order, will think twice before crossing the line from cyber network exploitation to cyber network attacks against Taiwan.

There are several actions that can be taken now to better prepare the international legal order for the present and future of warfare. First, international criminal lawyers and investigators need to think about cyber war crimes in practical terms to identify what types of data have evidentiary value and where that evidence will be located. Just as with a physical crime scene in the field, there is a “golden hour” in the wake of a computer network attack where evidence can be collected and preserved, after which it can more easily be altered or destroyed. Second, cybersecurity researchers with possession of potentially relevant evidence should understand its importance, know how to preserve it in a manner that maintains its integrity and chain of custody, and share it with the proper investigating authorities.

Finally, there must be a means to share knowledge between the global criminal justice and cybersecurity communities. There are already models for successful public-private partnerships that could maintain an open line of communication between cybersecurity researchers and war crimes prosecutors.

As Yurii Shchyhol, the head of Ukraine’s State Service of Special Communications and Information Protection has said, “the Russo-Ukrainian War is the world’s first full-scale cyberwar but it will not be the last. On the contrary, all future conflicts will have a strong cyber component.” In the absence of accountability mechanisms to clarify and enforce the law, states are free to escalate with impunity, creating new vulnerabilities and unseen risks for civilians in an increasingly connected world. War crimes prosecutors should innovate and push for legal evolution to address the new character of war.

Russia’s cyberwar against Ukraine is happening right now and the ICC Prosecutor has an unprecedented opportunity to deliver justice for Ukrainians, prevent future harm through deterrence, strengthen the laws of war by ensuring international law keeps pace with technological development, and demonstrate the ICC’s relevance, legitimacy, and potential.

Lindsay Freeman is the Director of Technology, Law, and Policy at the Human Rights Canter, UC Berkeley School of Law. Freeman is an international criminal and human rights lawyer with experience working at the International Criminal Court and the Extraordinary Chambers in the Courts of Cambodia. She specializes in the use of technology, digital evidence, and online investigations for justice and accountability purposes, particularly in the investigation and prosecution of atrocity crimes.