Data Centers as Military Objectives: The Russian and Ukrainian Justifications

Since mid-September, Russian forces have launched a series of attacks on data centers in Ukraine.^[1] Ukraine has responded by attacking data centers in Russia, including those of the Russian company Yandex,^[2] one under construction for Sberbank,^[3] and, most recently, a VK social network data center.^[4] Russia had earlier struck Ukraine’s governmental data center in a cruise missile attack soon after launching its full-scale invasion in February 2022.^[5] Meanwhile, Iran struck Amazon data centers in the Gulf in the spring, which were likely the first recorded attacks on data centers during that armed conflict.^[6]

Such attacks raise numerous questions under international humanitarian law (IHL). We will not repeat Mike and Klaudia Klonowska’s earlier analysis of Iran’s attacks, which applies mutatis mutandis here.^[7] Instead, we focus on four questions raised by the Russian and Ukrainian data center attacks:

1. When, in principle, do data centers qualify as military objectives under IHL, such that attacks may lawfully be directed against them in accordance with the principle of distinction?
2. What justifications have Russia and Ukraine officially given for the data center attacks, and are they based in IHL?
3. Do the facts bear out those justifications?
4. Assuming at least some of the data centers were military objectives, did the attacks comply with the rule of proportionality and the requirement to take precautions in attack?

The answers depend on the facts. Although we have access to open-source material, we cannot assess the legality of the attacks with complete certainty without classified intelligence. But we can assess the justifications offered by the parties (so far). To catalog them, we instructed the Google Gemini Argon AI model to search for statements by Russian and Ukrainian officials regarding each strike. We then used a ChatGPT model to verify the accuracy of the statements and their English translations, and we manually spot-checked a selection. Of course, politically motivated statements are not comprehensive legal explanations. Nevertheless, they tell us whether the State making them is at least attempting to justify its operations on legal grounds, regardless of whether the facts support that justification. The resulting tables can be viewed here.

The bottom line is somewhat surprising. Russia has offered justifications for each strike, claiming that the relevant Ukrainian data center was being used for military purposes. If borne out by the facts, these justifications satisfy a traditional military objective analysis under IHL. By contrast, Ukraine’s justifications so far do not satisfy such an analysis, even if interpreted charitably. Ukrainian statements seem to rely on prohibited reprisals and on disrupting Russian disinformation, which, by themselves, would not qualify the data centers as military objectives. The one exception is a statement concerning the most recent VK attack. That statement mentions support for the Russian armed forces but does not clearly connect that support to the particular facility attacked. Ukraine may have stronger legal arguments to justify its strikes than it has offered, but so far, it is not making them.

When Do Data Centers Become Military Objectives?

According to Article 52 of Additional Protocol I, to which both Russia and Ukraine are Party, civilian objects are objects that are not military objectives.^[8] Military objectives are “those objects which by their nature, location, purpose or use make an effective contribution to military action and whose total or partial destruction, capture or neutralization, in the circumstances ruling at the time, offers a definite military advantage.” The definition undoubtedly reflects customary law binding on all States.^[9]

If a data center is exclusively dedicated to military use, like those of the French armed forces,^[10] it is a military objective by “nature.” A commercial data center utilized for military purposes also becomes a military objective by “use” when that use makes an effective contribution to the defender’s military operations and destroying or neutralizing it would provide a definite military benefit to the attacker. Examples include storing military data there and using its computing power to support AI-enabled battlefield intelligence generation or enhance its command and control. Finally, if reliable intelligence indicates that the enemy has decided to use a data center for military purposes in the future, the data center would become a military objective by “purpose,” even if it has not yet been so used.^[11]

In this sense, data centers are no different from other kinds of critical infrastructure, including roads, bridges, railways, electricity grids, or telecommunication networks used or intended for use by both the military and civilians. Such so-called “dual-use objects” are not a separate legal category; once an object qualifies as a military objective, the object (see below) is targetable, even if the vast majority of its uses are civilian.^[12] Targetability also depends on applying the rule of proportionality (see below)^[13], but as a matter of distinction,^[14] the whole object is a military objective. This raises the question of how to define “the whole object,” which we address below.

The second prong of the military objective test, definite military advantage, may be difficult to satisfy in the case of data centers. It requires a “concrete and perceptible” military advantage rather than a “potential or indeterminate” one. In this regard, data centers are engineered for redundancy, often relying on backup facilities, some of which may be abroad. Ukraine learned this lesson early in the full-scale war when Russia struck Ukraine’s governmental data center. Ukraine “successfully sustained its civil and military operations by acting quickly to disburse its digital infrastructure into the public cloud, where it has been hosted in data centers across Europe.”^[15] If redundancy is effective, the disruption to military use of any particular data center may be so de minimis that it provides no definite military advantage. This would be especially true when redundancy is achieved through infrastructure that cannot feasibly be attacked, as when it is located overseas.

But before determining whether an object is a military objective, the logically prior question is how to define the “object” in the first place, an issue that looms large when considering the rule of proportionality and the requirement to take precautions in attack. In some cases, the answer is easy. For example, if the enemy armed forces use a single building in a sprawling hospital compound, only that building is the relevant “object” and a military objective. Other structures making up the compound remain civilian objects.

But many structures, including buildings, consist of multiple components. A paradigmatic example is an apartment building in which the enemy uses only one floor. The question is whether the building or its components (floors, apartments, etc.) is the object. If the former (the building is the object), the entire building is a military objective (the U.S. military’s position^[16]). In such a case, everything permanently affixed to it, such as server racks and the cooling system, is part of the military objective, no matter how slight the facility’s military use. But in the latter case (if the components are the object), only the floor is a military objective; the remainder of the building retains its civilian character (the ICRC position^[17]). A third view holds that whether the component of a larger object can itself qualify as a distinct object depends on whether the component can be attacked individually, for instance because reliable intelligence identifies which aspect of the structure is used for military purposes and the attacker can conduct a precision strike against that component.^[18]

Complicating matters, a distinct object can also be located within another distinct object without being its component or part in any sense. For example, a missile (an object that qualifies as a military objective by “nature”) can be located in a warehouse (itself an object that, through the missile’s storage, is a military objective by “use”). But the warehouse may also include other objects that would not independently qualify as military objectives. This was the case with the Wildberries warehouses in Russia that Ukraine struck earlier this year.^[19] If the warehouses stored military objectives such as military drone-related items, as Ukraine claimed, both the warehouse itself and those items qualified as military objectives. The question is whether the other objects inside the warehouses are appropriately considered part of the targeted warehouse or were separate civilian objects.

Data centers raise exactly these issues. On the one hand, we can treat the data center building (essentially a specialized warehouse) as a single object or as a collection of connected but separate and distinct objects. On the other, we must consider whether servers and other equipment within that building are separate objects. This raises two questions: the nature of the building itself and the relationship between the building and the objects or components it contains.

The first question depends in part on whether the data center building is a single, non-compartmentalized structure or is instead split into separate structures, floors, or halls. If it is a single structure, the building as a whole is the relevant object that can become a military objective by use. However, views will differ over compartmentalized data centers. Consider a data center containing multiple server halls, only one of which is being used for military purposes. The question is whether the data center is a single object that qualifies as a military objective, or whether only the hall used by the military qualifies, making each hall a separate object. The answer depends on the three views cited above: 1) the entire data center is an object qualifying as a military objective; 2) only the hall (or floor or sub-structure) being used for military purposes is; and 3) it depends on whether the attacker can discriminately strike only that hall being used by the military.

The second question is the relationship between the building (and its components) and items contained within it. Some aspects of a building are not severable from the building, such as its electrical wiring, plumbing, doors, and windows. In our view, any equipment or other items permanently affixed to the data center building, such as the warehouse’s cooling system or server racks, are part of the relevant object and become a military objective together with that object. (“Permanently affixed” may of course be a matter of appreciation, but the core set of cases here is, we think, clear.)

When it comes to movable objects located within the building rather than being part of it, two views exist. According to the first, everything within a structure that qualifies as a military objective is part of that military objective, whether movable or not. The second view (which we share) is that movable objects retain their civilian status even when located in a military objective. The Wildberries attack is illustrative. While the warehouse itself may have qualified as a military objective by use, and the drone parts within it were objects that independently qualified as military objectives, the commercial products stored there awaiting shipment did not; they are clearly severable from the building. By analogy, whereas permanently affixed racks or other equipment might be part of the data center structure as a broader military objective, removable servers and other movable equipment are not. The servers are separate objects, some or all of which (depending on how they are used) may independently qualify as military objectives.

We recognize that, vis-à-vis the principle of distinction, this difference may matter little in practice. But as we will explain, it makes a significant difference when applying the rule of proportionality and the requirement to take precautions in attack.

We flag the issue of determining whether the object attacked is a military objective for all the data centers attacked by Russia and Ukraine, but the public record does not let us resolve it for any of them, regardless of which view we apply.

Russian Justifications

Russia has described its campaign as a “forced digital detox”^[20] of Ukraine, a phrase that, standing alone, suggests that the real target is Ukraine’s civilian digital life. Yet, in each case, Russia claimed that the data center struck was being used by the Ukrainian military. That claim was always one of current use, never purpose (future use). The details are in our tables, but by way of example, when Russia struck the De Novo data center in Kyiv on Sept. 17, the Russian Defense Ministry described it as “the largest center ensuring the operation of server equipment used for military purposes, as well as the processing, transmission, and storage of data, including intelligence data, in the interests of the Armed Forces of Ukraine (AFU).”^[21] Similarly, when Russia struck the Cosmonova data center on Sept. 26, the Ministry claimed it was used to provide “mobile internet service and support” for Ukraine’s Starlink use.”^[22]

These are precisely the kinds of claims that, if true, would render the facilities military objectives by use. Storing and processing military intelligence and supporting military communications are paradigmatic effective contributions to military action, and denying Ukraine such support would afford Russia a clear military advantage. The difficulty is that they are wholly unsubstantiated. Just because Russian authorities claim something is true does not make it so; given Russia’s record of systematic lying, we are not predisposed to believe them. Based on our review, Ukrainian authorities have rejected Russian claims that the data centers were used for military purposes.^[23]

It is difficult for outside observers to test these claims. One can find visual evidence that, for instance, a road or a bridge is used militarily, as with the Kerch Strait Bridge attacked by Ukraine (our analysis here).^[24] But nothing visible distinguishes a data center used for military purposes, such as processing battlefield intelligence, from one engaged in purely civilian activities, like streaming entertainment videos for viewers. For the same reason, it is difficult to gauge whether a data center contributes effectively to military action and, even if so, whether destroying or otherwise neutralizing the center would provide a definite military advantage.

All we can say is that Russia’s arguments are both legally orthodox and wholly contingent on the facts. At a minimum, the Russian attacks on the data centers were not obviously directed at civilian objects (even if they are part of Russia’s overall unlawful war of aggression against Ukraine and unlawful on that jus ad bellum basis). That said, Russia has offered no evidence whatsoever that the Ukrainian data centers were, in fact, being used as its statements allege.

Ukrainian Justifications

By contrast, Ukraine has not claimed that the Russian data centers it attacked were military objectives by either use or purpose or otherwise. The only possible exception is the VK statement, which points to the company’s support for the Russian military, but even that statement does not clearly connect the support to the facility struck (discussed in more detail below; see also our tables for the details). Indeed, for the Sberbank data center, which was still under construction, it is difficult to see how that argument could even be made in theory. Ukraine has instead advanced two obviously political justifications; they presumably do not show how Ukrainian authorities would formulate legal reasoning to justify the strikes. Both are unworkable under IHL.

The first is reciprocity, the idea that Ukrainian attacks on Russian data centers are an in-kind response to prior Russian attacks (see our second table with quotes from President Zelenskyy). While this argument will likely persuade the Ukrainian public and others sympathetic to Ukraine that the attacks are justified, IHL categorically precludes it. As Article 52(1) of Additional Protocol I unambiguously sets out, “[c]ivilian objects shall not be the object of attack or of reprisals.”^[25] Reprisals are IHL violations by an aggrieved party designed to compel the enemy to desist from its own ongoing IHL violations. That Russia has attacked, and is continuing to attack, civilian objects in Ukraine (on the assumption that the data centers were indeed such) cannot justify Ukraine attacking any civilian objects in Russia.

Not all States view the Article 52 ban on reprisals as customary. As the DoD Law of War Manual notes, “The United States has expressed the view that AP I’s provisions on reprisal are counter-productive and that they remove a significant deterrent that protects civilians and war victims on all sides of a conflict.”^[26] And some Parties to Additional Protocol I, like the United Kingdom, have issued a reservation that would, in theory, permit them to engage in reprisals in some circumstances.^[27] But Russia and Ukraine are Party to the instrument, and neither has reserved on the matter.

Clearly, a meaningful moral difference exists between reprisals against corporate commercial objects and those against civilians, their homes, or livelihoods. We shed few tears for the physical and economic harm to Yandex and the other Russian commercial entities, especially considering Russia’s blatant unlawful attacks on the Ukrainian population. The Ukrainian strikes may even successfully deter further Russian attacks on data centers. But the rationale behind the absolute nature of the AP I prohibition is easy to comprehend. Reprisals can easily spiral into non-compliance, with civilians and civilian infrastructure bearing the cost. In short, as a matter of law, the fact that Russia attacked Ukrainian data centers first or then repeatedly is irrelevant. Russian data centers could be lawfully attacked only if they qualified as military objectives.

The second justification is that the strikes disrupted Russian bots and disinformation. At the Warsaw Security Forum on Oct. 12, President Zelenskyy asserted that once Ukraine struck Yandex data centers, “it suddenly became a little easier to breathe on many social media platforms. . . . And there was less hate, less division, and fewer provocations. Because there were fewer bots.”^[28]

The factual accuracy of this statement has been questioned. In particular, some argue that the Yandex attacks disrupted Yandex search engine bots, not bots spreading disinformation on social media.^[29] That seems likely to us. Nevertheless, on Oct. 15, the Ukrainian Center for Countering Disinformation published a report meant to bolster claims that the attack disrupted disinformation.^[30]

Zelenskyy’s remarks may have concerned the attack’s unintended, incidental effects, not its purpose. However, even if those claims were about the attack’s purpose and the claimed interruption of such communications were true, the Yandex data centers would not be military objectives. The disinformation in question would need to make “an effective contribution to military action,” and disrupting it would need to offer “a definite military advantage.”

In that regard, the Committee that reviewed NATO’s 1999 bombing campaign against the Federal Republic of Yugoslavia for the International Criminal Tribunal for the Former Yugoslavia concluded that if a media outlet “is merely disseminating propaganda to generate support for the war effort, it is not a legitimate target.”^[31] A further source of authority for the proposition that media outlets disseminating unfavorable communications or propaganda are not legitimate targets is an international body that criticized Russian attacks on Ukrainian media facilities. According to the OSCE Moscow Mechanism, “The important role of media in maintaining the fighting spirit of the population or even their involvement in propaganda does not turn them into military objectives.”^[32]

While Russia’s propaganda efforts in Europe are undoubtedly harmful, it would need to be shown that they meaningfully contribute to Russia’s military actions and that disrupting them would produce a definite (not remote or speculative) military advantage for Ukraine. We see no evidence of any such effect. Nor would other parts of Russia’s propaganda machine, such as its state TV, be military objectives under IHL.

The VK data center strike, launched on Oct. 18 as part of a massive drone attack on Saint Petersburg, marks a shift. VK is Russia’s largest social media company and operates, inter alia, e-mail and messaging services, as well as a video service. This time, the Ukrainian military explained that VK assets provided “information support for the Kremlin’s policies, as well as for the needs of the Russian army, law enforcement agencies and military-industrial complex.”^[33] However, that is a claim about the corporation, not about the particular facility struck. That the armed forces use the company’s services does not render every facility the company operates a military objective. A properly framed claim would identify the specific military data or activity at the data center and the advantage expected from disrupting such.

Finally, we note that Ukraine has so far not argued that the data centers are targetable because of their economic importance to the war effort, such that they are so-called “war-sustaining” objects, in the way it has justified attacking Russia’s oil infrastructure. The United States defines war-sustaining objects as “economic objects of the enemy that indirectly, but effectively supports and sustains the belligerent’s war-fighting capability.”^[34] Like most States and experts, we reject the notion that “war-sustaining” objects qualify as military objectives under IHL. But even if such a category existed, the importance of data centers to the Russian economy is hardly comparable to that of oil exports. If they were classified as war-sustaining, so too would almost any aspect of the Russian economy.

The legally soundest option for Ukraine would be to argue that the Russian military was using the data centers it has struck. But Ukraine has not made that argument so far, and we do not see how it could apply, for instance, to the Sberbank data center. A facility still under construction could qualify only by purpose, and only on concrete information that the Russian armed forces intended to use it for military ends once completed. Ukraine’s arguments do not support classifying the Russian data centers as military objectives.

Proportionality and Precautions

Whether the data centers qualify as military objectives determines whether the rule of proportionality and the requirement to take precautions and attack come into play. The former prohibits “an attack which may be expected to cause incidental loss of civilian life, injury to civilians, damage to civilian objects, or a combination thereof, which would be excessive in relation to the concrete and direct military advantage anticipated.”^[35] The latter requires an attack to take feasible precautions to minimize injury or death of civilians or damage to civilian objects. That obligation includes verifying the target to the extent feasible; selecting targets, weapons, and tactics that can reduce harm to civilians and civilian objects without sacrificing military advantage; and providing warning of attack if circumstances permit.^[36]

As noted, Ukraine’s public justifications for attacking the Russian data centers do not justify treating them as military objectives. Even if they did, neither retaliation nor interference with propaganda constitutes a “concrete and direct military advantage” that would be factored into a proportionality analysis. Therefore, solely for the sake of analysis, we treat Russia’s claims as accurate and ask what these two rules — proportionality and precautions in attack — require of attacks on data centers like those in Ukraine. We will also assume, arguendo, that Ukraine will be able to come up with arguments justifying its strikes on Russian data centers as military objectives that go beyond those made so far.

With respect to “concrete and direct military advantage,” the redundancy issue mentioned above looms large. As the ICRC commentary to article 57 observes, the anticipated advantage must be “substantial and relatively close, and that advantages which are hardly perceptible and those which would only appear in the long term should be disregarded.”^[37] Ukrainian providers appear well prepared for the attacks.^[38] For instance, one hosting company reported that approximately 95% of its clients experienced no disruption during the attacks and that services continued to operate on backup capacity located in Poland and the Czech Republic. Indeed, after the Sept. 23 data center attack that left roughly 100,000 households in and around Kyiv without connectivity, most providers restored services within 24 hours, again partly because of prior data and capacity backups abroad.

If the military intelligence that Russia claims was stored in commercial data centers was similarly backed up, the advantage of destroying the facilities would have been limited and fleeting. And the less the military advantage, the less it is possible to justify incidental injury and collateral damage to civilians. The attack on the Cosmonova data center would merit a somewhat different analysis because degrading Starlink-supported military communications would offer a greater military advantage, particularly if timed to coincide with ongoing operations, but this assumes that such disruption actually occurred or was in fact anticipated.

As to the civilian harm that factors into a proportionality assessment, what counts as collateral damage depends on how the scope of the military objective is defined, a topic we examined above. The difference is not academic. For instance, De Novo reportedly hosts Ukraine’s largest banks.^[39] Whether its equipment enters the proportionality calculation turns entirely on how that issue is resolved.

Analyzing any single attack from a proportionality perspective is, in principle, straightforward. Any data center building (and its fixtures), components (e.g., server halls) of that building, or movable items therein that are considered military objectives are not included as collateral damage in the proportionality assessment. However, expected damage to any severable components or items within the building that are not military objectives and are likely to suffer physical damage must be factored into the collateral damage assessment. This will depend entirely on the different approaches we examined above for defining the relevant object or objects.

The easy case is a non-compartmentalized, dual-use data center, consisting of a single building in which any server may at any time be put to military use. In this case, all the servers qualify as military objectives by use or purpose, depending on whether they are being used that way at the time of attack. So is the whole building in which they are contained. An attack on that building that damages some or all of the servers would not directly damage any civilian object, and no proportionality issue would arise with regard to the damage to the building or the servers and the cost of replacing them. This would hold even if the great majority of these servers’ uses were civilian, although, as we will shortly explain, a proportionality assessment would need to factor in certain reverberating effects on civilians.

Then there is a compartmentalized data center, where each hall, floor, or sub-structure can be treated as a separate and distinct object (Mike would add the condition that the attacker can strike them separately). Further, because they are movable, the servers within the halls are also separate objects rather than simply aspects of the data center building. In our view, if the servers devoted to military use are contained within a severable hall, and the other servers in other halls are used exclusively for civilian purposes, then only the servers put to military use, and only the hall in which they are located, are military objectives. Incidental damage to other halls or servers (e.g. due to a fire) must then be factored into a proportionality analysis. We realize this will invite debate over what is operationally feasible and what is movable or permanently affixed, but we believe the principle reflects a fair balance between military necessity and humanitarian considerations.

Foreseeable reverberating effects that cause death, injury, or physical damage also count, although remote harm need not be considered.^[40] The outages in Ukraine caused by the Russian attacks were extensive. However, there is no evidence in the public record that we have seen indicating that the targeted facilities supported services, such as hospital systems or emergency communications, the loss of which would foreseeably result in physical harm to civilians. If such indirect reverberating effects were foreseeable, they would clearly need to be included in a proportionality analysis.

By contrast, mere inconvenience for civilians does not, in the current state of the law, count as collateral damage, even if it is widespread. For example, Marko learned of the Ukrainian attacks on the Yandex data centers when he tried to call a taxi in Belgrade using the Yandex app (which now unfortunately has a quasi-monopolistic position in Belgrade) – the inconvenience caused to him (and millions of others) is irrelevant from a proportionality perspective, on the assumption that the Yandex data centers were military objectives in the first place.

But economic losses to companies that rely on data centers cannot be dismissed as mere inconvenience; at a minimum, they warrant more consideration. Companies relying on data centers in Russia and Ukraine likely suffered millions of dollars in costs directly resulting from the attacks and the resulting inability to provide the relevant service. There is something incongruent in considering that the proportionality analysis must include “damage to civilian objects,” such as physical damage to an adjacent garage that can be repaired for, say, $10,000, but not intangible economic harms in the tens of millions of dollars, which are equally direct and foreseeable. The directness and foreseeability are not really in question; many kinds of businesses rely heavily or exclusively on data centers, and disruption to them can be easily quantified and predicted. (As a footnote, if data centers were attacked under a war-sustaining military objective theory, the premise would be that the economic contribution of such objects to the military effort, and the advantage gained from disrupting that contribution, can be quantified and predicted.)

As a textual matter, it must be acknowledged that the economic harm to, say, a Ukrainian bank that has been unable to provide services to its clients for several days does not qualify as “damage to civilian objects.” But de lege ferenda, at least, we do not see how ignoring such harms can be justified. That said, it is in our view clear de lege lata that the value of civilian objects that are physically damaged can be assessed in part by reference to the economic importance of their use.^[41] That is, if it is accepted that at least some parts of the data centers attacked were severable from those parts that were military objectives, the value of the remaining civilian parts is not simply to be assessed by reference to the cost it would take to rebuild them and replace the destroyed components, but also by reference to the immediate economic harms imposed on businesses reliant on the center.

A further wrinkle is that when civilian servers are destroyed, the data on them is also lost; absent a backup, that loss is permanent. This raises the question of whether that lost data is an object the loss of which must be included in the anticipated collateral damage calculation. There is a long-standing debate over the matter that lies beyond the scope of this article.^[42] Suffice it to say that States have expressed two views – that it is an object and that it is not.^[43] A State’s position on the issue will determine whether data stored on a server that qualifies as a civilian object is itself treated as anticipated collateral damage.

The precautions in attack obligation is likewise particularly significant in a data center strike. First, everything feasible under the circumstances must be done to verify that the data center qualifies as a military objective. This could require intelligence on, inter alia, the nature of the data stored in the data center, its activities, connectivity to military users, backup arrangements, and where any military processing or storage takes place in the facility. Should doubt remain as to whether an object “normally dedicated to civilian purposes” is being used to make an “effective contribution to military action,” Article 52(3) of Additional Protocol I requires that it “be presumed not to be so used.”^[44] It might be questioned whether a data center is “normally dedicated” to civilian purposes, but that issue has been mooted by the prevailing view that the presumption applies to all persons and objects. For instance, the United States now agrees that commanders “must presume that persons or objects are protected” unless the available information indicates otherwise.^[45]

The requisite certainty is that which a reasonable commander would require in the same or similar circumstances; thus, the threshold of requisite certainty increases with the severity of the expected civilian harm if an error occurs.^[46] In this regard, a mistaken data center attack could generate widespread consequences that affect that determination. Russia’s facility-specific claims seemed to indicate at least a claim that verification occurred, although it offered no evidence to that effect.

An attacker must also choose means, methods, and targets that minimize “incidental loss of civilian life, injury to civilians and damage to civilian objects.” Data centers pose a unique target set in this regard, because they are vulnerable to hostile cyber operations in ways most other potential targets are not. By the rule, a cyber operation that disables military processing or targets military-related data, without damaging civilian servers, would be required in lieu of a kinetic attack if it could achieve the desired effects. Similarly, if the Cosmonova attack was meant to degrade Starlink-supported military communications, planners should have considered alternative targets that might have offered a similar military advantage with less risk to civilians, such as military terminals or nodes.

Warnings of impending data center attacks, a precaution cited in Article 57 and applicable whenever an attack “may affect the civilian population,” pose a dilemma. Effective warning would allow the staff to evacuate and the operator to mitigate the loss of civilian client data. But it would also give the enemy a window within which to mitigate effects on its military activities, defeating the attack’s purpose. In that situation, a warning would not be required. But if the aim was to destroy the data center’s physical capacity, as in the Starlink claim, a warning might be feasible without compromising those military benefits.

Finally, beyond these specific measures, Article 57(1) of Additional Protocol I requires that “constant care shall be taken to spare the civilian population, civilians and civilian objects.”^[47] Unlike proportionality, the provision is not textually limited to death, injury, and damage. Indeed, the Tallinn Manual 2.0 experts agreed that it requires commanders “to be continuously sensitive to the effects of their activities on the civilian population and civilian objects, and to seek to avoid any unnecessary effects thereon.”^[48] That reading matters for data centers, as it reaches economic losses to banks and other businesses that rely on them. The duty does not bar an attack that causes such losses. But it does require attackers to avoid those losses when feasible, for example, by using cyber means, where available, to disable only the military workload, or, if kinetic force is necessary, by selecting aimpoints that disable the military tenant’s hall without destroying the shared power and cooling systems on which every civilian client depends.

Again, all of this is on the assumption that a specific data center (or part thereof) would qualify as a military objective in the first place. (As to the defenders’ obligation to take precautions, see Klonowska and Schmitt).^[49]

Concluding Thoughts

Russia’s continued use of force against Ukraine is manifestly unlawful as a matter of jus ad bellum, and its conduct of hostilities has provided a master class in IHL violations and war crimes. Yet, Russia has framed its attacks on Ukrainian data centers in arguments that are grounded in existing IHL, offering justifications that, if factually substantiated, could establish that the facilities were military objectives. Of course, invoking the law is not the same as complying with it. We repeat that we have no reason to trust Russia, and that Russia has not publicly provided any evidence supporting its claims. That said, it is within the realm of possibility that some of Russia’s claims are factually true.

Ukraine, meanwhile, occupies the moral and legal high ground in this conflict. To retain that position, it must scrupulously comply with IHL. Its status as the victim of aggression does not excuse unlawful attacks during hostilities. Every violation sacrifices some of that hard-earned ground. The justifications that Ukraine has offered so far regarding its attacks on Russian data centers – retaliation and disinformation suppression – lack any legal footing. We hope Ukraine has better, factually supported arguments at its disposal than those it has made so far … and that it will start making them.

– – – – – – – –

1. Paul Lipscombe, Russian Drones Strike Ukrainian Telcos and Data Center Operators as Part of Targeted Attacks, DatacenterDynamics (Sept. 28, 2026). ↑
2. Brawley Benson, Ukraine’s Strikes on Yandex Data Centers, Explained, Moscow Times (Oct. 12, 2026). ↑
3. Ukrainian Drones Hit Sberbank Data Center After Yandex Attacks, Moscow Times (Oct. 14, 2026). ↑
4. Roman Pryhodko, Drones Strike VKontakte Data Center and Oil Terminal in Russia’s Leningrad Region, Militarnyi (Oct. 18, 2026). ↑
5. Brad Smith, Defending Ukraine: Early Lessons from the Cyber War, Microsoft: On the Issues (June 22, 2022). ↑
6. Klaudia Klonowska & Michael Schmitt, Iranian Attacks on the Amazon Data Centers: A Legal Analysis, Just Security (Mar. 12, 2026). ↑
7. Id. ↑
8. Protocol Additional to the Geneva Conventions of 12 August 1949, and Relating to the Protection of Victims of International Armed Conflicts (Protocol I) art. 52(1)–(2), June 8, 1977, 1125 U.N.T.S. 3 [hereinafter AP I]. ↑
9. See, e.g., 1 Jean-Marie Henckaerts & Louise Doswald-Beck, Customary International Humanitarian Law rr. 8–9 (2005) [hereinafter CIHL Study] (rules on civilian objects and military objectives); Brian Egan, Legal Adviser, U.S. Dep’t of State, International Law, Legal Diplomacy, and the Counter-ISIL Campaign, Remarks at the Annual Meeting of the American Society of International Law 9 (Apr. 1, 2016), reprinted in 110 Am. Soc’y Int’l L. Proc. 300 (2016); U.S. Dep’t of Def., Law of War Manual § 5.6.3 (June 2015, updated July 2023) [hereinafter DoD Law of War Manual]. ↑
10. Elise Vincent, Military AI: France Challenges US Dominance over NATO’s Classified Networks, Le Monde (Oct. 1, 2026). ↑
11. DoD Law of War Manual, supra note 9, § 5.6.6; Int’l Comm. of the Red Cross, Commentary on the Additional Protocols of 8 June 1977 to the Geneva Conventions of 12 August 1949 ¶¶ 2020–22 (Yves Sandoz, Christophe Swinarski & Bruno Zimmermann eds., 1987) [hereinafter AP I Commentary]. ↑
12. DoD Law of War Manual, supra note 9, § 5.6.1.2; Int’l L. Ass’n Study Grp. on the Conduct of Hostilities in the 21st Century, The Conduct of Hostilities and International Humanitarian Law: Challenges of 21st Century Warfare, 93 Int’l L. Stud. 322, 336 (2017); Michael Schmitt, When Civilian Infrastructure Becomes a Lawful Target, Just Security (July 23, 2026). ↑
13. Int’l Comm. of the Red Cross, Proportionality, How Does Law Protect in War?. ↑
14. Distinction, in How Does Law Protect in War?, supra. ↑
15. Smith, supra note 5. ↑
16. DoD Law of War Manual, supra note 9, § 5.6.1.2; U.S. Air Force, Air Force Doctrine Publication 3-60, Targeting 9 (May 1, 2026). ↑
17. Int’l Comm. of the Red Cross, The Principle of Proportionality in the Rules Governing the Conduct of Hostilities Under International Humanitarian Law, International Expert Meeting, 22–23 June 2016, at 37–38 (Laurent Gisel ed., 2018) [hereinafter ICRC Proportionality Report]. ↑
18. Michael N. Schmitt, Targeting Dual-Use Structures: An Alternative Interpretation, Articles of War (June 28, 2021). ↑
19. Schmitt, When Civilian Infrastructure Becomes a Lawful Target, supra note 12. ↑
20. Russia Called Its Strikes on Ukrainian Data Centers a “Forced Digital Detox.” Zelensky Says Kyiv Has Answered by Hitting a Data Center Belonging to Russian Tech Giant Yandex, Meduza (Oct. 8, 2026). ↑
21. Minoborony RF soobshchilo o porazhenii krupnogo data-tsentra v Kieve [Russian Defense Ministry Reports Striking a Large Data Center in Kyiv], INTERFAX (Sept. 17, 2026) (see attached table). ↑
22. Russian Forces Strike Starlink Data Center in Ukraine, Newsweek (Sept. 26, 2026(see attached table). ↑
23. Dzvenyslava Andrusiv, Udary po data-tsentrakh: chy spravdi Rosiia mozhe zalyshyty Ukrainu bez internetu [Strikes on Data Centers: Can Russia Really Leave Ukraine Without the Internet?], 24 Kanal (Sept. 29, 2026)(reporting that Ukraine has detected no signs of damage to the AFU’s communication channels or to State institutions). ↑
24. Marko Milanovic & Michael N. Schmitt, The Kerch Strait Bridge Attack, Retaliation, and International Law, Articles of War (Oct. 12, 2022). ↑
25. AP I, supra note 8, art. 52(1). ↑
26. DoD Law of War Manual, supra note 9, § 18.18.3.4. ↑
27. United Kingdom, Reservations and Declarations upon Ratification of Protocol I, Reservation (m) (Jan. 28, 1998), reproduced in Int’l Comm. of the Red Cross, IHL Treaties Database. ↑
28. Volodymyr Zelenskyy, President of Ukr., Address by the President of Ukraine to the Participants of the Warsaw Security Forum (Oct. 12, 2026). ↑
29. Aisha Down, Did Ukrainian Strikes on Russian Datacentres Reduce Online Disinformation?, Guardian (Oct. 13, 2026); Renée DiResta, The Russian Bots Went Silent. Or Did They?, Lawfare (Oct. 14, 2026). ↑
30. Ctr. for Countering Disinformation (Ukr.), When Bots Go Silent: What the Strikes on “Yandex” Data Centers Affected (Oct. 15, 2026). ↑
31. Int’l Crim. Trib. for the Former Yugoslavia, Final Report to the Prosecutor by the Committee Established to Review the NATO Bombing Campaign Against the Federal Republic of Yugoslavia ¶ 47 (June 13, 2000), reprinted in 39 I.L.M. 1257 (2000); see also S.C. Res. 1738, ¶ 3 (Dec. 23, 2006) (“media equipment and installations constitute civilian objects, and in this respect shall not be the object of attack or of reprisals, unless they are military objectives”); S.C. Res. 2222, ¶ 10 (May 27, 2015) (verbatim same). ↑
32. Wolfgang Benedek, Veronika Bílková & Marco Sassòli, Report on Violations of International Humanitarian and Human Rights Law, War Crimes and Crimes Against Humanity Committed in Ukraine Since 24 February 2022, at 27, OSCE Doc. ODIHR.GAL/26/22/Rev.1 (Apr. 13, 2022). ↑
33. Anastasiia Akhtyrska, Ukrainian Drones Struck the VKontakte Data Centre in Russia, Censor.NET (Oct. 19, 2026). ↑
34. U.S. Navy, U.S. Marine Corps & U.S. Coast Guard, The Commander’s Handbook on the Law of Naval Operations, NWP 1-14M/MCTP 11-10B/COMDTPUB P5800.7A, §§ 7.4, 8.2.5 (Mar. 2022); see also DoD Law of War Manual, supra note 9, § 5.6.6.2. ↑
35. AP I, supra note 8, art. 51(5)(b); CIHL Study, supra note 9, r. 14; DoD Law of War Manual, supra note 9, § 5.12; Michael N. Schmitt, Parsing Proportionality, Articles of War (Nov. 25, 2025). ↑
36. AP I, supra note 8, art. 57; CIHL Study, supra note 9, rr. 15–21; DoD Law of War Manual, supra note 9, § 5.11. ↑
37. AP I Commentary, supra note 11, ¶ 2209. ↑
38. Andrusiv, supra note 23. ↑
39. Barney Dixon, Russia Claims Strikes on De Novo Data Center in Kyiv, Ukraine, DATACENTERDYNAMICS (Sept. 18, 2026) (reporting the operator’s own description of its clients). ↑
40. DoD Law of War Manual, supra note 9, § 5.12.1.3. ↑
41. ICRC Proportionality Report, supra note 17, at 41–43. ↑
42. Michael N. Schmitt, A Policy Approach for Addressing the “Cyber Attacks” and “Data as an Object” Debates, Articles of War (Sept. 19, 2024); Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations r. 100 ¶ 6 (Michael N. Schmitt gen. ed., 2017) [hereinafter Tallinn Manual 2.0]. ↑
43. Data as an Object, International Cyber Law: Interactive Toolkit (NATO Coop. Cyber Def. Ctr. of Excellence). ↑
44. AP I, supra note 8, art. 52(3). ↑
45. DoD Law of War Manual, supra note 9, § 5.4.3.2. ↑
46. Michael N. Schmitt & Michael Schauss, Uncertainty in the Law of Targeting: Towards a Cognitive Framework, 10 Harv. Nat’l Sec. J. 148 (2019). ↑
47. AP I, supra note 8, art. 57(1); see also CIHL Study, supra note 9, r. 15. ↑
48. Tallinn Manual 2.0, supra note 43, r. 114 ¶ 4. ↑
49. Klaudia Klonowska & Michael Schmitt, Data Centers at War: The Defender’s Duty to Protect Civilians, Just Security (Oct. 20, 2026). ↑