Our initial investigation into international crimes in Ukraine focused on the cyber component of the armed conflict since 2014, identifying specific Russian cyberattacks against Ukrainian critical civilian infrastructure that could constitute war crimes. The International Accountability team focused its investigation on the use of new methods of warfare—in particular cyber operations and drone attacks—that raise urgent legal and evidentiary challenges. These investigations provide crucial support to strategic litigation efforts and accountability processes at both national and international levels.
Investigation into Cyberattacks
Our team has investigated cyber operations conducted by Russia’s military intelligence service targeting Ukraine’s civilian infrastructure. These operations—including malware attacks against energy facilities and hospitals—have disrupted essential services and placed civilians at direct risk. We have worked to document these cyberattacks, mapping the command structures behind them and verifying digital forensic evidence that links operations to state actors. This work contributes to groundbreaking efforts to hold cyber warfare accountable under international humanitarian and criminal law, establishing that cyberattacks on civilian infrastructure may constitute war crimes.
Investigation into Drone Operations
The rapid escalation of drone warfare in Ukraine has introduced new challenges for civilian protection and accountability. Russia’s extensive use of unmanned aerial systems, including loitering munitions (“kamikaze drones”) and long-range drones targeting cities, has caused widespread destruction and civilian casualties. Through the analysis of satellite imagery, open-source videos, and geolocation techniques, our team is documenting the dynamics of drone warfare and unlawful drone strikes against civilian targets. These investigations not only establish evidence of indiscriminate attacks but also contribute to a broader understanding of how new technologies are reshaping the conduct of war.
Investigation into Sabotage Operations
Alongside conventional warfare, Russia has deployed a range of sabotage and subversion tactics across Ukraine and Europe. These operations include attacks on energy infrastructure, rail networks, undersea cables, and other critical systems, as well as covert campaigns designed to destabilize democratic societies and weaken support for Ukraine. We are investigating these activities through the collection and verification of open-source data, including geospatial analysis, forensic mapping of incidents, and the identification of links to state and proxy actors. By situating sabotage operations within the framework of international humanitarian and criminal law, we work to demonstrate that such acts are not isolated disruptions but form part of a broader strategy of hybrid warfare. This work highlights how sabotage, cyber operations, and disinformation are deployed together to erode the rule of law and civilian security beyond Ukraine’s borders.
Publications
March 2, 2022
The Int’l Criminal Court’s Ukraine Investigation: A Test Case for User-Generated Evidence
Image of Kyiv, Ukraine by Eugene via Unsplash Commentary — Just Security: The Int’l Criminal Court’s Ukraine Investigation: A Test Case for
July 19, 2022
Russian Cyberattacks Need an International Criminal Court Response
Commentary — Center for European Policy Analysis: Russian Cyberattacks Need an International Criminal Court Response, an op-ed by Lindsay Freeman.
April 14, 2023
Ukraine Symposium – Accountability for Cyber War Crimes
Commentary — Articles of War: Ukraine Symposium – Accountability for Cyber War Crimes, by Lindsay Freeman.
April 4, 2023
The Gravity of Russia’s Cyberwar against Ukraine
Commentary — Opinio Juris: The Gravity of Russia’s Cyberwar against Ukraine, by Lindsay Freeman, Amanda Ghahremani, and Sophie Lombardo. Left: Russian
June 10, 2024
The Role of International Justice in Cyber Defense and Deterrence
Commentary — Digital Front Lines: The Role of International Justice in Cyber Defense and Deterrence, authored by Lindsay Freeman.
March 13, 2024
Evidence of Russian Cyber Operations Could Bolster New ICC Arrest Warrants
Commentary — Lawfare: Evidence of Russian Cyber Operations Could Bolster New ICC Arrest Warrants, authored by Lindsay Freeman.
News
May 12, 2022
The Case for War Crimes Charges Against Russia’s Sandworm Hackers
HRC in the News — WIRED: The Case for War Crimes Charges Against Russia’s Sandworm Hackers, featuring Lindsay Freeman and her team’s research and submission to the International
September 7, 2023
The International Criminal Court Will Now Prosecute Cyberwar Crimes
HRC in the News — WIRED: The International Criminal Court Will Now Prosecute Cyberwar Crimes, interviewing Lindsay Freeman and citing HRC’s second Article 15 submission
January 11, 2023
The war in Ukraine tests how cyberattacks fit into rules for war crimes
HRC in the News — The Washington Post’s Cybersecurity 202 Newsletter: The war in Ukraine tests how cyberattacks fit into rules for war crimes, referencing HRC’s
October 18, 2023
Hackers in the Hague? The Prospects of Prosecuting International Cyber Crimes Before the ICC
HRC in the News — Lawfare: Hackers in the Hague? The Prospects of Prosecuting International Cyber Crimes Before the ICC, citing Lindsay Freeman on the ICC’s decision to investigate
October 13, 2023
September 15, 2023
HRC in the News — EJIL: Talk!: The Prosecutor’s New Policy on ‘Cyber Operations’ before the International Criminal Court (and its Implications for Ukraine): Some Preliminary
July 19, 2022
Russian Cyberattacks Need an International Criminal Court Response
Commentary — Center for European Policy Analysis: Russian Cyberattacks Need an International Criminal Court Response, an op-ed by Lindsay Freeman.