Content Assessment: Cyber Vigilantism? A Legal Analysis of Ukraine Support (CCDCOE)
Information - 96%
Insight - 98%
Relevance - 92%
Objectivity - 94%
Authority - 95%
A short percentage-based assessment of the qualitative benefit of the paper by the NATO CCDCOE on the topic of cyber vigilantism.
Editor’s Note: From time to time, ComplexDiscovery highlights publicly available or privately purchasable announcements, content updates, and research from cyber, data, and legal discovery providers, research organizations, and ComplexDiscovery community members. While ComplexDiscovery regularly highlights this information, it does not assume any responsibility for content assertions.
To submit recommendations for consideration and inclusion in ComplexDiscovery’s cyber, data, and legal discovery-centric service, product, or research announcements, contact us today.
Background Note: Shared for the non-commercial educational benefit of cybersecurity, information governance, and eDiscovery professionals, this recently published working paper from the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE) explores from a legal perspective the considerations, challenges, and consequences of cyber vigilantism in support of Ukraine.
Paper from CCDCOE*
Cyber Vigilantism in Support of Ukraine: A Legal Analysis
Hacktivist initiatives in support of Ukraine have been met with both praise and reprimand. As much as they are clever and innovative in taking a bottom-up grassroots approach to countering injustice and violence, they are also legally ambiguous and disposed to more serious consequences than initially planned. This ad hoc working paper seeks to explain what is at stake from the international law perspective and analyses three specific factors that have a particular effect on the legal evaluation of hacktivist cyber operations in times of armed conflict. First, the position of the hacktivist is looked into, following that the importance of the structure, organization, and state affiliations of the different hacktivist groups is analyzed and last, the paper proceeds to explain the breach of due diligence obligation as a potential avenue for evoking state responsibility.
Reportedly, around 40,000 people from 52 countries have taken President Volodymyr Zelensky up on his offer to ‘join the defense of Ukraine, Europe, and the world,’ and enrolled in the International Legion of Territorial Defence of Ukraine. An additional 300,000 (and counting) have responded to the Tweet from Ukraine’s Minister of Digital Transformation, Mykhailo Fedorov, which called for IT professionals from around the world to join Ukraine’s IT army. There are also independent cyber vigilantes organizing themselves in a more nebulous fashion and thus escaping any association with state agencies. Shortly before the invasion, a Belarusian-based hacktivist group called the Belarusian Cyber Partisans encrypted ‘the bulk of the servers, databases and workstations’ of Belarusian Railway to ‘slow down the transfer’ of Russian troops and succeeded in stopping railway traffic in Minsk, Orsha and Osipovichi. Should Russia not pull back, Anonymous has threatened to take industrial control systems hostage. AgainstTheWest’s (ATW) Russian-oriented prong announced on Twitter that it had breached the systems of the Russian Space Forces, the Ministry of Transport of Russia, and Russia Air. Initiatives of active cyber resistance have been met with both praise and reprimand. As much as they are clever and innovative in taking a bottom-up grassroots approach to countering injustice and violence, they are also legally ambiguous and disposed to more serious consequences than initially planned. Robert M. Lee, CEO of an industrial cyber security company Dragos, who led the investigation of the cyber attacks against Ukrainian power grids in 2015, put it bluntly by saying that, ‘[a]nyone not working on behalf of a government having serious conversations about ‘hacking back’ or launching cyber attacks against Russia please understand – respectfully – you’re an idiot and only going to make matters worse’. Such assessments aside, this paper seeks to explain what is at stake from the international law perspective and analyses three specific factors that have a particular effect on the legal evaluation of hacktivist cyber operations in times of armed conflict.
Cyber-Vigilantism-in-Support-of-Ukraine - CCDCOE
- [Annual Update] International Cyber Law in Practice: Interactive Toolkit
- Defining Cyber Discovery? A Definition and Framework
Have a Request?
If you have information or offering requests that you would like to ask us about, please let us know and we will make our response to you a priority.
ComplexDiscovery is an online publication that highlights cyber, data, and legal discovery insight and intelligence ranging from original research to aggregated news for use by cybersecurity, information governance, and eDiscovery professionals. The highly targeted publication seeks to increase the collective understanding of readers regarding cyber, data, and legal discovery information and issues and to provide an objective resource for considering trends, technologies, and services related to electronically stored information.
ComplexDiscovery OÜ is a technology marketing firm providing strategic planning and tactical execution expertise in support of cyber, data, and legal discovery organizations. Focused primarily on supporting the ComplexDiscovery publication, the company is registered as a private limited company in the European Union country of Estonia, one of the most digitally advanced countries in the world. The company operates virtually worldwide to deliver marketing consulting and services.