Ukraine Claims Russian Cyber Attacks Are War Crimes

Ukrainian officials seek to convince the International Criminal Court (ICC) in the Hague to investigate whether certain Russian cyber attacks could constitute war crimes and officials are gathering digital evidence for the ICC to prosecute. 

In a statement by ICC Prosecutor, Karim A.A. Khan QC, on the Situation in Ukraine, “I have decided to proceed with opening an investigation. In particular, I am satisfied that there is a reasonable basis to believe that both alleged war crimes and crimes against humanity have been committed in Ukraine in relation to the events already assessed during the preliminary examination by the Office.” 

Cyber attacks have increasingly become a part of modern warfare and have been repeatedly used by Russian forces amid the country’s war in Ukraine to target critical infrastructure.  “Given the expansion of the conflict in recent days, it is my intention that this investigation will also encompass any new alleged crimes falling within the jurisdiction of my Office that are committed by any party to the conflict on any part of the territory of Ukraine...“I will continue to closely follow developments on the ground in Ukraine, and again call for restraint and strict adherence to the applicable rules of international humanitarian law,” says Khan’s statement.

Cyber attacks are not listed as a form of war crime under the Geneva Convention and legal experts have previously contacted the ICC with the aim to prosecute Russian cyber attacks, but the reported push from Ukrainian officials marks the first time a sovereign government has made such a request to the court. 

Last year, a group of human rights lawyers and investigators in the Human Rights Center at UC Berkeley's School of Law sent a formal request to the ICC in which it urged the ICC to consider war crime prosecutions of Russian hackers for their cyber attacks in Ukraine, even as the prosecutors gather evidence of more traditional, ongoing war crimes there. 

Ukraine’s chief digital transformation officer, Victor Zhora said that his country is gathering evidence of cyber attacks tied to military operations and are sharing information with the ICC in the hopes of potentially charging Russia for those crimes. Zhora argued that since Russia used cyber attacks to support its kinetic military operations that targeted Ukraine’s critical infrastructure and civilians, the digital attacks should also be considered as war crimes against Ukrainian citizens. “When we observe the situation in cyberspace we notice some coordination between kinetic strikes and cyber attacks, and since the majority of kinetic attacks are organised against civilians, being a direct act of war crime, supportive actions in cyber can be considered as war crimes,.. ”

Zhora also noted last year’s Russian attacks against Ukraine’s largest private energy electricity generator, an example of when cyber attacks are used in conjunction with kinetic warfare.

Under the UN Convention war crimes can include willful killing of civilians, torture or inhuman treatment, including biological experiments; willfully causing great suffering; and the taking of hostages, among other actions. Written before the modern technological era, the definition makes no mention of digital warfare. 

The cyber domain  has no borders, and it allows attackers to instantly reach across the world, regardless of distance, which makes holding Russia's most dangerous hackers accountable, say Ukraine government sources. 

If the ICC does find that destructive Russian cyber attacks targeting critical infrastructure and civilians constitute war crimes, that could open grounds for potential prosecutions against the perpetrators of such attacks and possible reparations for the victims. 

Ukrainian officials aren’t the only ones trying to make the case before the ICC.  Last year, a group of human rights lawyers and investigators in the Human Rights Center at University of California, Berkeley’s School of Law made a similar request to the court, urging it to look into whether a group of Russian hackers, known as Sandworm, could be prosecuted for launching destructive cyber attacks against Ukraine in 2015 and 2016. Lindsay Freeman, the director of technology, law and policy at Berkley told Wired that the ICC prosecutor’s office responded to the group’s request and was looking into its recommendations. 

In contrast, some experts aren’t convinced that making the case that certain cyber attacks could fall under war crimes is necessary, because there’s already there is already evidence of Russian war crimes in Ukraine using conventional warfare. “I’m not sure we need to reach into cyber to figure that out,” said Jamil Jaffer, founder and executive director of the National Security Institute at George Mason University’s Antonin Scalia Law School. 

Although he agrees that the Russians have improved the way they coordinate their land and air warfare with their cyber operations, Jaffir said that a lot of analysis must still be conducted to determine whether destructive cyber attacks targeting civilians and critical infrastructure could be classified as war crimes. “Cyber attacks are more of a novel application of war crimes, which you can still do and go through and figure out, but there are so many other very clear violations of the laws of war..

If the goal is to prosecute the Russians for their war crimes, you don’t need to go through the cyber analysis, you need to look at what they’re doing on the battlefield,” Jaffir said.

Russian linked hacker groups have ramped up operations targeting critical industries and high-profile public figures, according to an advisory issued by the British National Cyber Security Centre (NCSC) in an alert warning that a hacker groups, based in Russia, have escalated attacks against government organisations, defence firms, media publications, and non-profits.  The Russian group Seaborgium, also known as ‘Cold River’, was found to have waged an “expansive” spear-phishing campaign against UK targets. 

Social media and professional networking sites have been used to identify targets, the advisory read, which enables the groups to engage with potential victims.  

The Cold River hacker group has claimed responsibility for a number of high-profile attacks over the last year.  
Traditionally, the group hasn’t targeted the public and has instead focused on compromising public figures to create political disruption.  In May last year, security researchers at Google accused the group of hacking into and leaking emails belonging to Richard Dearlove, the former director of the MI6 spy agency.  

Cold River also claimed responsibility for attacks on US-based nuclear research centres at the beginning of this year. That incident saw the group create fake login pages for staff working at three laboratories and a phishing campaign aimed at encouraging workers to divulge passwords. 

United Nations:   Wired:      The Hill:     Politico:     ICC-CPI:      ITPro:     DW

You Might Also Read: 

Ukraine Signs Cyber Security Deal With NATO:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Microsoft To Invest $10b In OpenAI 
Turla Hackers Deliver Andomeda Malware  »

ManageEngine
CyberSecurity Jobsite
Check Point

Directory of Suppliers

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Perkins Coie LLP

Perkins Coie LLP

Perkins Coie LLP is an internationalk law firm with offices across the USA and Asia. Practice areas include Privacy and Data Security.

BakerHostetler

BakerHostetler

BakerHostetler is one of the largest law firms in the USA We have five core practice groups including a specialty practice team in Privacy and Data Protection.

Cyber Together

Cyber Together

Cyber Together is dedicated to advancing the cyber security industry by giving businesses access to Israel’s leaders, innovators and great minds in the field of cyber security.

Brinqa

Brinqa

Brinqa is a leading provider of unified risk management and security analytics.to manage IT governance and technology risk.

Foundation Futuristic Technologies (FFT)

Foundation Futuristic Technologies (FFT)

FFT is a global leader in computer forensics and digital investigation solutions.

SentinelOne

SentinelOne

SentinelOne is a pioneer in delivering autonomous security for the endpoint, datacenter and cloud environments to help organizations secure their assets with speed and simplicity.

BankVault

BankVault

BankVault is a new type of cyber technology (called remote isolation) which sidesteps your local machine and any possible malware.

Aporeto

Aporeto

The Aporeto platform protects cloud applications from attack by authenticating and authorizing all communications with a cryptographically signed identity assigned to every workload.

certSIGN

certSIGN

certSIGN develop innovative software for information security and information systems protection.

Caulis

Caulis

Caulis FraudAlert is a cyber security solution. It can detect fraud and identity theft based on users’ online behaviour.

Naukrigulf

Naukrigulf

Naukrigulf.com is one of the fastest growing job sites in the Gulf, with thousands of registered job seekers and a robust CV database across many sectors, including cybersecurity.

Optimum Speciality Risks

Optimum Speciality Risks

Optimum Speciality Risks are an experienced team of cyber insurance experts, backed by Lloyds of London.

Vertex Cyber Security

Vertex Cyber Security

Vertex provide Cyber Security Services to small to large businesses including Advise, Consulting, Adding Security Partnership, Penetration Testing, ISO 27001-2 and Audits.

ThreatNix

ThreatNix

ThreatNix is a tight knit group of experienced security professionals who are committed to providing competent cybersecurity solutions that adhere to international standards.

Heyhack

Heyhack

Heyhack is a SOC 2 Type II certified automated penetration testing platform for web apps and APIs.

RPost

RPost

RPost is the global leader in premium (yet affordable) electronic signature and cybersecurity services, and we’ve been continuously innovating for our customers the world over since 2000.