Kyiv argues Russian cyberattacks could be war crimes

One of Ukraine’s top cyber officials said some cyberattacks on Ukrainian critical and civilian infrastructure could amount to war crimes.

Victor Zhora, chief digital transformation officer at the State Service of Special Communication and Information Protection (SSSCIP) of Ukraine, said Russia has launched cyberattacks in coordination with kinetic military attacks as part of its invasion of Ukraine, arguing the digital warfare is part of what Kyiv considers war crimes committed against its citizens.

“When we observe the situation in cyberspace we notice some coordination between kinetic strikes and cyberattacks, and since the majority of kinetic attacks are organized against civilians — being a direct act of war crime — supportive actions in cyber can be considered as war crimes,” Zhora told POLITICO in an interview.

Ukrainian officials are gathering evidence of cyberattacks linked to military strikes and are sharing the information with the International Criminal Court (ICC) in the Hague, in an effort to support potential prosecutions into Russia’s actions, Zhora said.

Classifying Russia’s digital attacks on Ukrainian infrastructure as part of war crimes would be a first. Academics and researchers have been making the case for it since earlier this year, asking the Office of the Prosecutor at the ICC to add cyberattacks to their investigations into the war in Ukraine.

Zhora, who leads cybersecurity operations at Ukraine’s communications security authority SSSCIP, pointed to attacks by Russia on DTEK last July, Ukraine’s largest private energy investor, as an example: “Their thermal power plant was shelled, and simultaneously, their corporate network was attacked. It’s directed and planned activity from Russians, which they did both in conventional domain and in cyber domain.”  

Zhora has seen similar coordinated activity in Odesa, Lviv, and Mykolaiv, where shelling “is supported with [cyber] attacks on local authorities, websites, or on local internet service providers,” he said. These attacks have “direct impact” by disrupting data services, IT infrastructure, power grids, telecommunications, and critical infrastructure, he said, adding Ukrainian citizens “depend on the availability of these resources.”

Russian state-backed groups have targeted Ukrainian infrastructure and attempted to disrupt efforts from allies in Europe and the West to support Kyiv in the war. NATO officials have also flagged that cyberattacks could “spill over” into NATO countries, potentially escalating the conflict.

Moscow isn’t sticking to cyberattacks only, Zhora said about the war in the digital space. Russia has launched efforts to sow panic through propaganda and disinformation, as well as attempts to penetrate networks and extract data that it can use to identify and target people who might be a threat to their military offensive. 

“Russian troops often use filtration procedures on occupied territories to identify people who support Ukraine, who were engaged in public service, or military service, so they capture them, then torture, kill,” Zhora said.

The Ukrainian official said it was time the international community debated the impact of these attacks — cyber, disinformation and digital targeting — and how to respond to it. “We are discussing completely new terms and ideas on how to classify these attacks, which happened during the war, which have never happened before.”