The International Criminal Court (ICC) is conducting an unprecedented investigation into alleged Russian cyberattacks on Ukrainian civilian infrastructure, considering them possible war crimes. This marks the first time international prosecutors have delved into cyber warfare, potentially leading to arrest warrants if sufficient evidence is gathered.
Prosecutors are examining cyberattacks on infrastructure that jeopardised lives by disrupting power and water supplies, cutting connections to emergency responders, or knocking out mobile data services that transmit air raid warnings. An official familiar with the case, who requested anonymity, confirmed the ICC's focus on cyberattacks since the onset of Russia’s full-scale invasion in February 2022. Additionally, sources close to the ICC prosecutor's office indicated that the investigation might extend back to 2015, following Russia's annexation of Crimea.
Ukraine is actively collaborating with ICC prosecutors, collecting evidence to support the investigation. While the ICC prosecutor's office has declined to comment on ongoing investigations, it has previously stated its jurisdiction to probe cybercrimes. The investigation could set a significant legal precedent, clarifying the application of international humanitarian law to cyber warfare.
Among the cyberattacks being investigated, at least four major attacks on energy infrastructure stand out. Sources identified the hacker group "Sandworm," believed to be linked to Russian military intelligence, as a primary suspect. Sandworm has been implicated in several high-profile cyberattacks, including a 2015 attack on Ukraine's power grid. Additionally, the activist hacker group "Solntsepyok," allegedly a front for Sandworm, claimed responsibility for a December 2022 attack on the Ukrainian mobile provider Kyivstar.
The investigation raises questions about whether cyberattacks can constitute war crimes under international law. The Geneva Conventions prohibit attacks on civilian objects, but there is no universally accepted definition of cyber war crimes. Legal scholars, through the Tallinn Manual, have attempted to outline the application of international law to cyber operations. Experts argue that the foreseeable consequences of cyberattacks, such as endangering civilian lives, could meet the criteria for war crimes.
If the ICC prosecutes these cyberattacks as war crimes, it would provide much-needed clarity on the legal status of cyber warfare. Professor Michael Schmitt of the University of Reading, a key figure in the Tallinn Manual process, believes that attacks like the one on Kyivstar meet the criteria for war crimes due to their foreseeable impact on human lives. Ukraine’s intelligence agency, the SBU, has provided detailed information about the incident to ICC investigators.
Russia, which is not an ICC member, has dismissed accusations of cyberattacks as attempts to incite anti-Russian sentiment. Despite this, the ICC has issued four arrest warrants against senior Russian figures since the invasion began, including President Vladimir Putin. Ukraine, while not an ICC member, has granted the court jurisdiction to prosecute crimes on its territory.
The ICC's probe into Russian cyberattacks on Ukrainian infrastructure could redefine the boundaries of international law in cyberspace. As the investigation unfolds, it may establish a precedent for holding perpetrators of cyber warfare accountable under international humanitarian law.