Russian strikes on Ukrainian data centres that cut internet service to thousands have prompted expert scrutiny over when damage to digital infrastructure crosses the threshold into an international crime. The legal issue is not whether data centres matter to modern life, but under what circumstances they may lawfully be targeted under the laws of armed conflict.
Legal framework: civilian object or lawful military target?
Under the rules that govern conduct in armed conflict, civilian objects are protected from attack unless they meet the criteria to be considered military objectives. The test focuses on whether an object's nature, location, purpose or use makes an effective contribution to military action and whether striking it offers a definite military advantage at the time.
"Civilian objects may not be made the object of attack." (Additional Protocol I, Article 52)
That principle, enshrined in Additional Protocol I, has been adapted to the digital age by states and humanitarian organisations. A data centre remains a civilian facility unless the relevant facts at the time of an attack satisfy the military‑objective test.
Dual‑use complications and proportionality
Data centres commonly host a mixture of purely civilian services alongside systems used by government or armed forces. The International Committee of the Red Cross (ICRC) has urged that each facility be assessed on its particular circumstances: whether it stores military information, provides processing power or digital space for military applications, or otherwise contributes directly to operations.
Even where a portion of a centre is assessed to be a legitimate military objective, attacking forces remain bound by the principles of proportionality and precautions. Commanders must weigh the anticipated military advantage against the expected incidental harm to civilians who rely on those services for everyday life, emergency services and critical infrastructure.
- Nature: Is the facility inherently military or civilian?
- Use: Is it being used for military command, control, intelligence, or logistics?
- Consequences: What foreseeable indirect effects will loss of service have on civilians and essential services?
War crimes threshold and intent
Not every unlawful attack constitutes a war crime. For an act to be prosecutable as an attack on civilians under the Rome Statute, it is necessary to establish the requisite culpable mental element. Deliberately directing strikes at purely civilian objects is proscribed; similarly, launching attacks while knowingly accepting civilian harm that is clearly excessive compared with the concrete and direct military advantage is criminal.
Legal advisers and commentators stress that proving such cases requires evidence of intent or knowledge — for example, documents, orders, or patterns of conduct showing a deliberate campaign against civilian digital infrastructure — rather than the mere fact of civilian disruption.
Operational and investigative challenges
Practical assessment on the battlefield is difficult. Intelligence about how a data centre is being used may be fragmentary or contested. Attribution of strikes — whether conducted by conventional munitions, missiles, drones or cyber means — can also complicate both immediate legal assessments and later accountability efforts.
Investigators must piece together technical forensic evidence, operational intent and the pattern of effects. The indirect and cascading impacts of degrading internet connectivity — affecting hospitals, emergency services, banking and public communications — are central to any proportionality analysis.
| Criterion | Practical application to data centres |
|---|---|
| Nature | Physical facility hosting servers — ordinarily civilian |
| Use | May include military data, command systems or dual‑use services |
| Consequences | Loss can have widespread civilian ripple effects |
Implications for accountability and future conflicts
The recent disruption reported by Ukrainian authorities, affecting tens of thousands of users in and around the capital, underscores the centrality of digital connectivity in contemporary conflict. How states, courts and international bodies apply existing law to digital targets will shape both operational behaviour and accountability mechanisms.
Legal experts say that clear, timely evidence about a facility's military use and forecasts of civilian harm are essential to any lawful targeting decision. Where that evidence is lacking or where civilian costs outweigh the military gain, attacking such infrastructure risks breaching international law and, in certain cases, amounting to prosecutable offences.
The debate over data centres illustrates a broader adaptation challenge: translating long‑standing principles of protection for civilian objects into rules that retain effect in an increasingly connected and interdependent world.
