Russia’s war in Ukraine shows cyberattacks can be war crimes

Russia’s cyberattacks against Ukrainian civilian and critical infrastructure has shown what it looks like when cyberattacks are part of warfare. What remains to be seen is whether the world will treat them as war crimes.

“For too long, the world has been considering cyber terrorism as something unrealistic, too sci-fi-ish, and cyber weapons as not posing any serious threat,” says Victor Zhora, deputy chairman and chief digital transformation at the State Service of Special Communication and Information Protection of Ukraine (SSSCIP). “Russia’s war against Ukraine has proven such thinking wrong.”

According to SSSCIP research and military experts, the war is a hybrid one, with “clear correlations between cyberattacks, kinetic, and information attacks,” Zhora says. For example, the energy sector has been targeted by both cyberattacks and missile attacks since the start of the invasion.

Public authorities and local governments, which “operate for civilians’ benefit and are vital for the country,” are the most targeted, Zhora says. Last year the Computer Emergency Response Team of Ukraine (ERT-UA) manually processed 2,194 incidents, with only 308 specifically aimed at the security and defense sector. The situation has remained similar this year — between January and April, CERT-UA handled 701 incidents, with only 39 of them directed at the security and defense sector.

It’s not just critical infrastructure that is under attack. Zhora says the Russians have also deployed massive campaigns aimed at harvesting Ukrainian citizens’ personal data. The purpose of those activities remains unclear to him.

Cyberattacks as War Crimes

The events of the past year-and-a-half have prompted Zhora and other cybersecurity experts to gather evidence of cyberattacks against civilian and critical infrastructure, with the hope of convincing the International Criminal Court (ICC) in The Hague to classify those as war crimes.

“We can see that cyberattacks are a part of [R]ussia’s ‘hybrid’ warfare,” Zhora said during WithSecure’s The Sphere event this week in Helsinki. “So the ICC should properly recognize them as a component of the [R]ussian war machine.”

This action, while unprecedented, is necessary, he added.

“When the global democratic community faced the immediate threat, it found itself lacking efficient legal instruments to confront cyber terrorism and cyberattacks as war crimes,” he said. “Now we need to create such instruments from scratch.”

Zhora demands effective mechanisms to punish cyberattacks, although he recognizes that the road to achieving that goal is challenging.

To read the complete article, visit Dark Reading.