International Criminal Court Investigates Russia's Cyberattack In Ukraine As A War Crime

Illustration of the Prosecutor's meeting at the International Criminal Court (ICC) with the Ukrainian side (photo: x @IntlCrimCourt)

JAKARTA - Prosecutors at the International Criminal Court (ICC) are investigating Russia's alleged cyberattack on Ukraine's civilian infrastructure as a possible war crime.

This is the first confirmation that attacks in cyberspace are being investigated by international prosecutors, which could result in arrest warrants if sufficient evidence is collected.

The investigation examined attacks on life-threatening infrastructure by disrupting electricity and water supplies, cutting ties with emergency respondents, or destroying mobile data services that sent airstrike warnings, an official said.

The ICC prosecutor is working with the Ukrainian team to investigate "the cyberattacks carried out since the start of the full-scale invasion" in February 2022, the official said, who declined to be named because the investigation had not yet been completed.

Two other sources close to the ICC prosecutor's office confirmed that they were investigating a cyberattack in Ukraine and said they could return as far as 2015, a year after Russia's unilateral seizure and annexation of the Crimean Peninsula from Ukraine.

Moscow had previously denied carrying out cyber attacks, and its officials regard such accusations as an attempt to spark anti-Russian sentiment. Ukraine is gathering evidence to support the investigation of the ICC prosecutor.

The ICC prosecutor's office declined to comment on Friday, June 14, but previously said it had jurisdictions to investigate cybercrimes. The office also said it could not comment on issues related to ongoing investigations.

The court has issued four arrest warrants for senior Russian suspects since the start of the invasion. This includes Russian President Vladimir Putin, who is suspected of committing war crimes over the deportation of Ukrainian children into Russia.

Russia, which is not a member of the ICC, rejects the decision as "corruption by law." Ukraine is also not a member, but has given jurisdiction to the ICC to demand crimes committed on its territory.

In April, a pretrial chamber issued an arrest warrant accusing two Russian commanders of crimes against humanity with attacks on civilian infrastructure. The Russian defense ministry did not respond to a request for comment at the time.

At least four major attacks on energy infrastructure are being investigated, two sources familiar with the investigation said.

A senior source said a Russian hacker group that focuses on the ICC was known in the cybersecurity research circle as a "Sandworm," and was believed by Ukrainian officials and cyber experts linked to Russian military intelligence.

War Crime

"Cyber attacks targeting industrial control systems, the technology underlying most of the world's industrial infrastructure are rare, but Russia is one of the few countries that has the ability to do so," cybersecurity researchers said.

The ICC case, which can set precedents for international law, is being followed closely. The international legal entity governing the armed conflict, immortalized in the Geneva Convention, prohibits attacks on civilian objects, but no universally accepted definition of what constitutes a cyber warfare crime.

Legal experts in 2017 compiled a handbook called Tallinn Manual on the application of international law for cyber warfare and cyber operations.

But experts interviewed by Reuters said it was unclear whether the data itself could be considered an "object" of an attack banned under international humanitarian law, and whether its destruction, which could be catastrophic for civilians, could be a war crime.

"If the court handles this issue, it will create great clarity for us," said Professor Michael Schmitt of the University of Reading, who leads the Tallinn Manual process.

Schmitt believes that the Kyivstar hack, which is owned by Dutch company Veon, meets the criteria for being defined as a war crime. "You always see the predictable consequences of your operations. And, you know, it is an predictable consequence that puts humans at risk," Schmitt said.

The Ukrainian intelligence agency said it had provided details of the incident to ICC investigators in The Hague. Kyivstar said it was analyzing the attack in partnership with international suppliers and SBU, the Ukrainian intelligence agency.