Ukraine: still a ‘not so cyber’ conflict?

The ongoing war in Ukraine has resulted in devastating consequences for the Ukrainian people and global community. At GPD, we continue to monitor the situation and advocate for the protection, safety and security of individuals impacted by the conflict, as well as working towards rights respecting approaches by all relevant actors.

At the outset of Russia’s invasion of Ukraine, various commentators (including GPD) remarked on the surprisingly conventional, ‘non-cyber’ nature of the conflict. But six months on, is this still the case?

It’s true that the war remains a conventional military conflict with hybrid elements, including cyber operations and disinformation campaigns. However, early assertions about the more limited role of cyberattacks may have been downplayed or inaccurate. This summer, Microsoft reported that Russian entities launched several waves of destructive cyberattacks against Ukrainian government agencies and critical infrastructure (including nuclear power plants) within the first few months of the invasion. The Atlantic Council has even claimed that the invasion is “the world’s first full-scale cyberwar” and highlighted the direct coordination of cyber operations with conventional forms of warfare—providing one example where a cyberattack on the Odessa City Council was timed to coincide with missile strikes against the city.

The way these cyberattacks have coincided with kinetic military operations is noteworthy; but equally significant is the scale and extent of negative impacts on the civilian population— disrupting the distribution of basic services, medicines, food and humanitarian relief. At the same time, Russia is also restricting access to online platforms (both domestically and in occupied areas of Ukraine), and subjecting the information environment to increased surveillance.

The pronounced impacts of these cyber-related acts on the human rights of both Russians and Ukrainians pose urgent questions to the international community, including around the legality or permissibility of such actions.

Meanwhile, the environment in which such norms are debated is being reshaped by the conflict. Since the invasion, we’ve seen two notable (if predictable) trends at the international level: more geopolitical tensions; and the increasing isolation of Russia.

Since the start of the invasion, Russia has been suspended from the UN Human Rights Council and formally announced its withdrawal from the Council of Europe (after a majority of member states voted for its suspension). The impact of these parallel actions is yet to fully materialise. It might result in greater transparency and accountability around human rights violations (for example, the EU and human rights organisations will now be pressing the Human Rights Council to create a mandate of UN Special Rapporteur on the situation of human rights in Russia). It might also have the opposite impact, as checks and existing oversight over Russia are removed (the country will no longer be a party to the European Convention on Human Rights as of 16 September 2022 with serious consequences for human rights

The effect on other forums and processes has been, broadly, inertia. The recent G20 meeting failed to produce a final communique due to disagreement over the invasion of Ukraine. On the cyber side, substantive sessions of the UN Ad-Hoc Committee on Cybercrime and the UN First Committee’s Open-Ended Working Group on ICTs (OEWG) have been marked by bitter disagreements and intractable fault lines between states. The conflict has also seeped into the issue of non-governmental participation. One of the most disappointing outcomes of the recent OEWG meeting was the “tit for tat” veto on stakeholder inclusion by Russia and Ukraine, which will create further obstacles for groups seeking to engage and advocate for human rights perspectives in these discussions.

At the beginning of the conflict, some commentators predicted a broader paradigm shift in geopolitics: with major shifts in alliances and blocs. There’s evidence that Russia had also hoped for this; Chatham House has highlighted the state’s deployment of “narratives that play on the broad themes of anti-colonialism and Western imperialism”, as well as launching disinformation campaigns in South Africa, India, Brazil and elsewhere to build empathy against Western sanctions.

So far, there’s scant evidence that this has happened. While some non-aligned states voted in favour of or abstained from the UN General Assembly resolution condemning Russia’s invasion, there hasn’t been a notable shift in support among states in Africa, Asia or the LATAM region (although, as mentioned, it is complicating efforts to find consensus in forums such as the OEWG). The voting pattern and statements of these countries during the ongoing United Nations General Assembly will be revealing in this regard.

Taking all these trends together, the picture that emerges is of a conflict with deep implications for the cyber environment. If the technologies and methods used in this war—cyberattacks, disinformation, network shutdowns—are not themselves new, there may be something novel about the ways they are being combined and integrated. It’s crucial that human rights defenders continue to closely monitor and unpack these developments, as well their echoes and traces in international policy forums and processes.