Civilian Defence Against Russia

Russia’s war against Ukraine and the widespread documentation of civilian participation therein sheds new light on the civilian national defence. This paper examines historic and contemporary Baltic and Ukrainian defence strategies against Russian and previous Soviet aggression and how national policies envisage and perhaps encourage civilians to engage in resistance and potentially in defence.

The focus rests on the role of civilians who are not employed or subcontracted by the military but engage in acts ranging from singing national anthems to launching offensive cyber operations. The paper examines when such civilian participation amounts to direct participation in hostilities and the types of legal implications which follow from such activities. This paper takes a closer look at recent civilian participation in hostilities as seen in Ukraine, particularly focusing on intelligence gathering and cyber activities as conducted by the Ukrainian information technology (IT) army to illustrate the risks to which civilians expose themselves.

This paper concludes that while there are legitimate reasons for States to include civilians in their defence strategies, it is key that where civilians engage in direct participation in hostilities, they must do so on an informed basis, setting out the legal implications of their actions. Where a State (passively) encourages such activities, it has at least a moral, if not also a legal obligation, to inform civilians of the risks of their actions.

1 Introduction

While Russia’s latest aggression against Ukraine was not its first attempt to wage territorial warfare against Ukraine or indeed other Eastern European states, the 2022 invasion is receiving a lot more international attention. However, in contrast to their Western neighbours, Eastern European states were not surprised by the attack on Ukrainian sovereignty and territorial integrity – rather they had prepared strategies and warned that such an event could occur. What is of particular interest to the authors is the way in which civilians are addressed in these strategies and how (if at all) customary international humanitarian law (IHL) addresses civilian defence in an international armed conflict (IAC).

Civilians have played an important role in both the Baltics and Ukraine in strategies against Russian and previous Soviet aggression. The Baltic countries – Estonia, Latvia, and Lithuania – in particular, have had a lot of experience with civilian defence as an alternative to military defence during times of occupation. More recently, all three Baltic countries have included civilians in their respective defence strategies, primarily in response to Russian geopolitical and military objectives. Ukraine, similarly, explicitly addresses civilians in its current defence strategy and its civilians are involved most prominently in hybrid warfare against Russia. The first part of this paper analyses the national defence strategies of the Baltic countries and how IHL can be applied to them. The second part will focus on Ukraine’s civilian defence strategy before and after the Russian aggression. The in-depth analysis and application of its civilian defence strategy to IHL is limited to the IT army.

While civilians often supplement a military force, either as contractors or as civilian employees, this paper focusses yet on a different phenomenon. The authors are interested in the participation of civilians who are not employed or subcontracted by the military. Conversely, this could mean the general public or specific groups of civilians, like IT-experts, who are included in defence strategies outside of conscription or employment of any sort. The Baltic countries and Ukraine have demonstrated how vital the inclusion of civilians can be, both in times of occupation, and during an active armed conflict. We are, therefore, exploring what lessons are to be learnt for future (Western) defence strategies, and the types of possible implications for the application of IHL which follow.

1.1 Civilian Non-violent Defence: A Preliminary Definition

Unlike traditional military defence, civilian defence relies on the participation of ordinary citizens to resist and undermine an aggressor’s ability to exercise control. In the event of an on-going occupation, civilian defence strategies, at their core, aim to protect social values and the social structure of the society. Yet, it remains unclear how civilian defence could look in the context of deterrence, or in an active IAC.

Looking at Geneva Convention IV on the protection of civilian persons in time of war for guidance, one realises that Art. 63 prohibiting “any changes in the personnel or structure of these societies” also only applies to occupation, and furthermore, only addresses relief efforts of either relief societies following the Red Cross principles, or other special organisations of a non-military character whose aim is to ensure the living conditions of the civilian population, the maintenance of essential public utilities or organising relief and rescue.

While Chapter VI of API (Art. 61–67) defines and addresses civil defence in an active IAC, its scope is also limited to traditional relief and rescue efforts, not addressing actions to safeguard values, or inhibiting the aggressor through passive means. What also remains out of scope of both the Geneva Convention and API are actions not undertaken by an organisation in the broadest sense. Individuals or groups of civilians who are not part of an organisational structure are, therefore, not included in this definition. Therefore, one needs to ask the question as to what activities conducted by civilians which are not mentioned in either the Geneva Convention or API still qualify as permissible civilian actions? Civil defence organisations are not, under any circumstances, allowed to conduct activities that are harmful to the enemy – they would lose their special protection under Art. 62. Given that individuals or groups who are not part of such an organisation are not entitled to this special protection anyway, the only possible outcome could be, that they are either considered to be engaging in unlawful behaviour, or would lose their status as a civilian altogether.

Investigating the role of civilian defence in different scenarios is consequently vital to appropriately situate them in IHL. Recently, owing to the emergence of hybrid warfare, some civilian defence strategists propose “deterrence through both denial and offense”, including civilians in these efforts short of using force. Indeed, contemporary strategies are different to previous examples: they are intended to be used in an on-going IAC and arguably aim to achieve more than securing societal values. Therefore, one needs to investigate if such actions have the potential of becoming offensive in nature, crossing the threshold to DPH.

1.2 Goals and Research Question

The authors aim to take a closer look at the concept of civilian defence and how it is used, both in a preparatory or perhaps deterrent way, as well as in an ongoing international armed conflict. In doing so, they first explore historical examples of civilian defence as well as current defence strategies in the Baltics on the one hand, and the current usage of civilian defence in Ukraine on the other.

What is of particular interest to the authors is how civilians are addressed in these strategies and how (if at all) customary IHL addresses civilian defence in an IAC. When do civilians cross the threshold of direct participation in hostilities (DPH)? Can this threshold be met through non-violent civilian action? How can cyber operations conducted by civilians during an IAC be assessed? Are Baltic and Ukrainian civilian defence strategies the next logical step in (hybrid) warfare?

2 Civil Defence under International Humanitarian Law

While IHL does not prohibit civil defence – or even civilian direct participation – per se, civilians’ actions may nevertheless carry consequences under humanitarian law. Civilians are normally protected from direct attack under the principle of distinction, which requires all parties to the conflict to always distinguish between combatants and civilians, and to only focus direct attacks against combatants or military targets. Except in the case of a levée en masse, individuals who do not belong to organised armed forces but engage in hostilities sporadically, spontaneously, or in an unorganised manner, remain civilians under IHL.

The principle of distinction, however, ceases to apply to civilians temporarily for the time they are directly participating in hostilities (DPH) – a concept which is not defined in treaty law nor clearly defined in customary international law. API provides a starting point, stating that a civil defence organisation loses its protected status if it engages in activities that are harmful to the enemy. The ICRC’s guidelines identify that DPH is comprised of two elements, hostilities, and direct participation.

For an act to qualify as DPH, it must meet three cumulative criteria: it must meet a threshold of harm, there must be a direct causal link between the act and such harm, and the act must be designed to support one party to the conflict to the detriment of the other (belligerent nexus).

According to the ICRC’s guidelines, the threshold of likely harm, must generally be similar to that of military force. While killing and wounding individuals or inflicting structural or functional damage to military objects has an obvious similarity to military force, one must also consider that even non-violent sabotage has the potential to adversely affect the enemy and cause harm. Examples thereof could be disturbing logistics and communications through cyber-attacks against the military computer network of the enemy. Determining whether an act has “adverse military effect” requires having enough information on the act itself and the likely outcomes. Moreover, there must be a causal link between the (likely) outcome of the act and the harm. Acts merely building up capacity to cause such an effect, like engaging in propaganda, repairing roads, or even manufacturing and shipping weapons would not satisfy the causal link. Lastly, the belligerent nexus and intent of the act must be “specifically designed to do so in support of a party to an armed conflict and to the detriment of another”.

If one agrees to accept the ICRC’s three requirements and a civilian has indeed satisfied them, the civilian loses their protection from direct attack “for such a time as they take a direct part in hostilities”. Civilians engaging in DPH are not entitled to immunity from domestic prosecution, but may be subject to criminal charges. This paper relies on the ICRC’s interpretation to assess whether actions of civilian defence or resistance mean the individuals in question lose their protection from direct attack, as to this date, it is the most established way to determine whether a civilian is partaking in DPH. Having said that, in practice it is often challenging to operationalise the application of such thresholds: it seems unlikely that a member of enemy armed forces would undertake an in-depth analysis of whether a civilian fulfils all of these criteria, particularly where the factual assessment is challenging to conduct at speed. Moreover, civilians engaging in these activities need to take into account the possibility that the enemy power entirely disregards the jus in bello and targets civilians irrespective of whether they engage in DPH or not. We can see this behaviour, for example, in some of the activities conducted by the Russian armed forces and the Wagner group in Ukraine. However, the authors still feel it is important to identify what the law says and how it can be applied – not least because a violation of the law might constitute a war crime that can be prosecuted at the national or potentially the international level.

3 Using Civilian Defence as a Strategy Primarily against Russia – Past and Present Approaches

To examine how States address civilians in their defence strategies, the authors focus on the Baltic States and Ukraine, which have a long history of being targeted by Russian attacks. Analysing their individual and collective defence strategies can provide valuable insights in how to use civilian defence against Russia’s hegemonial threat, destabilisation attempts, and even aggression.

3.1 Estonia, Latvia and Lithuania – A Long History of Successfully Using Civil Defence

The Baltic countries suffered Soviet aggression and occupation from 1940 to 1941 and again from 1944–1991. During the Soviet occupation and some would argue annexation, the population of the Baltic countries was subjected to mass deportations, forced collectivisation, and other forms of oppression. Despite these atrocities, non-violent resistance prevailed in the civilian population across all three Baltic countries, leading to ordinary citizens organising alternative election lists, tearing down Soviet symbols and flags, or displaying national symbols or signing national songs prohibited by the Soviets. Thereby, the Baltic population preserved their own respective identities, keeping spirits high and making it as unpleasant and costly as possible for the occupying force, without using armed force. All of these civilian efforts, growing in scale over time and using the economic and political crises in the USSR, culminated in a strong, public independence movement across all three countries. Lithuania ultimately declared the restoration of its independence on 11 March 1990, Latvia on 4 May 1990, and Estonia on 21 August 1991. Ultimately, the Soviet government recognised the independence of all three states on 6 September 1991.

In more recent history, Estonia, Latvia, and Lithuania have been subject to Russian strategic information operations and experienced Russian forces deploying close to their borders. Many wondered if the Baltic countries would be next, especially after the Russian annexation of the Ukrainian peninsula Crimea in 2014.

Consequently, they have jointly – and separately – formulated strategies to deter Russian aggression and the revisionist agenda. Notably, these strategies explicitly include civilians. The authors are particularly interested in how exactly civilians are addressed, particularly in situations outside of foreign occupation, i.e., in defensive manoeuvres against an on-going aggressive attack from an enemy state. Based on the previously discussed history, and the permanent Russian threat, two defensive concepts that also include civilians have been integrated in the national defence strategies of the three countries: total defence and unconventional warfare.

3.1.1 Estonia

Between 1993 and 2010, Estonia’s National Defence Concept focussed on total defence as well as territorial defence – prioritising a traditional military approach. While Estonia had a history of civil disobedience which included asking its citizens to refuse any actions that would be breaking Estonian laws, a policy of strict non-cooperation with the Soviets, and the documentation of any activities by the Soviet forces, civilian defence did not play a role after regaining independence. However, there is the Kaitseliit (Defence League) which is a militarily organised voluntary defence organisation. Its roots go back to guerrilla groups which fought against the Soviets.

Having become a victim of massive hybrid attacks in 2007, the Estonians acknowledged that due to changing potential threats, especially such hybrid challenges, military means alone would not be enough to meet new defensive demands. This realisation was also reflected in its 2011 defence strategy which amended the previous total defence approach to an integrated defence and comprehensive security approach, listing civilian support to military defence as one of the six pillars of this new strategy.

Estonia affirmed and updated its 2010 National Defence Strategy in 2017, branding it “integrated defence and comprehensive security”. This new approach consists of six pillars, one of which is civilian support to military defence, relying e.g., on the Kaiseliit. In the event of an armed conflict, the Kaitseliit will split. The military wing will operate under the Estonian armed forces whilst the civilian wing will engage in non-violent defence. Whereas, members of the military wing would be classified as ordinary combatants, members of the civil wing would remain civilians and would not be legitimate targets as long as they do not take part in DPH. Whether an enemy soldier would understand and recognise this distinction might, however, be a different question.

Estonia’s 2017 defence concept vastly expanded a reference to civilian contribution to defence. It acknowledges that networks of civilian volunteers play an important role, and includes civilian contribution to psychological defence. Such measures seem rather close to previously successful Baltic attempts at civilian defence and would not be likely to cross the threshold to DPH as these are non-violent actions directed inwards.

3.1.2 Latvia

Similarly, Latvia initially encouraged its citizens to non-violent resistance. Latvian total non-cooperation was part of the Latvian Popular Front strategy in 1990. They called on all citizens “to ignore the attackers’ orders, not to participate in any elections or referendums, and to document all crimes perpetrated by the attackers”. Civil defence was intended to be a constant supplement to military defence. Alas, civilian defence did not find its way into Latvia’s defence strategy after it regained independence. The Zemessardze (National Guard) is a militarily organised unconventional defence group the main task of which is to support the regular land forces units. While it is also responsible for civilian crisis management, the organisation cannot reasonably be considered to be part of non-violent civilian defence.

Latvia’s 2016 edition of its National Defence Concept outlines a duty for its civilian administration (state, regional, and local) to coordinate “the readiness and actions undertaken by individual and legal entities during times of peace, threats and war” to support national defence, and to implement national defence measures. For the first time since regaining independence, the defence concept hints at the fact that civilians could also have a role during armed conflict: “The state informs society on what actions should civilians undertake during a military conflict”. While this is a rather vague statement, it would be reasonable to assume that the state would give advice similar to previous strategies, i.e. total non-cooperation, classical peaceful civilian defence methods. A recently published brochure titled “What to do in case of crisis” gives citizens some suggestions on how they could support national defence: join the National Forces, report any movement, actions, or marks and transmitters of the aggressor, offer practical support to National Forces and NATO, help build fortified structures, use deception (remove road signs), help salvage peace and help motivate your colleagues, family members and friends to support national defence, support your company’s continuity planning, or create a local Unit of the National Guard. While some of these suggestions are certainly below the threshold of DPH, some may, depending on the circumstances, cross the line.

3.1.3 Lithuania

As early as 1991, shortly after regaining independence, the Lithuanian Supreme Council adopted a resolution, reminding its citizens to continue to follow the principles of disobedience, non-violent resistance, and non-cooperation in their struggle for independence. Having developed the concept further, Lithuania has referred to civilians in its defence and security strategies since 1992. From this time, Lithuania has relied on the participation of civilians in its defence strategy: “State defence consists of military security, as well as civil resistance.”

Lithuanian citizens are, by law, asked to engage in non-violent resistance (not further defined), disobedience and non-collaboration, as well as armed resistance. To help its citizens fulfil these duties, Lithuania has established a Civilian Resistance Training Centre at the Ministry of National Defence in 2000 – alongside preparing civilians, its goal is to also act as a deterrent for any potential aggressor. However, a further noteworthy shift in strategy occurred once Lithuania joined NATO in 2004. Now, protected under Art. 5 and geared towards collective security, civilian defence seems to have been placed on the backburner for some time now.

More recently, the Lithuanian Ministry of Defence updated its strategy regarding Russian hybrid warfare. In May 2022, the Minister of Defence, Arvydas Anušauskas, stated: “With the Strategy in place, we will begin a consistent and comprehensive education of the public on civil resistance. Such preparations will rest on three components: civil resilience, will to resist, and practical skills in both, armed and civil resistance. We aim to build on each of these. Another important aspect is that the preparation for civil resistance will cross over into the National Defence System area of expertise.”

Even more recently, in April 2023, a Seimas Committee started preparing to advise citizens on how the strategy of civil resistance has evolved since Russia’s attack against Ukraine and how it should be implemented in the future. Lithuania plans for both unarmed and armed civil resistance, educating school children and adults alike, and ultimately planning to raise the share of civilians willing to undertake non-armed violence to 70%. Having briefly analysed Lithuania’s updated approach, it becomes apparent that it has updated and upgraded its capacity for civilian defence. The choice of whether to engage in armed or unarmed resistance would be up to citizens – however Lithuania’s strategy does not necessarily demand a distinction and could, therefore, very likely mean that civilians will cross the threshold to DPH in some situations.

3.2 Impact of National Strategies on IHL

After examining the national defence strategies of the Baltic countries, a fundamental question arises: do these strategies align with existing IHL, or do they represent the development of new, (possibly regional), customary international law? To address this, we must explore whether any of the acts outlined in the strategies of the Baltic states potentially violate IHL. As previously analysed in section 2, for any act to qualify as DPH, it must meet three cumulative criteria: it must meet a threshold of harm, there must be a direct causal link between the act and such harm, and the act must be designed to support one party to the conflict to the detriment of the other (belligerent nexus). This threshold can only be met by violent actions – Estonian’s duty to engage in psychological warfare, refusing to follow orders from enemy soldiers would not meet such a threshold. Likewise, engaging in other non-violent acts such as building fortified structures or removing road signs cannot be classified as DPH. Therefore, if it does not “even” meet the threshold of DPH, how could it violate established IHL?

How would the law then be applicable to violent defensive action, particularly such action that does indeed qualify as DPH? As mentioned previously, civilians are not prohibited from using force or otherwise partaking in hostilities; rather, the legal consequence of such behaviour is losing the protection of a civilian. Hence, the principle of distinction no longer applies to them, and they become legitimate targets. Moreover, as they do not qualify for combatant privileges, they potentially could be prosecuted for any violations of domestic criminal law, e.g., murder or destruction of property. These consequences are clearly laid out in IHL without any mention of a prohibition; one could not, therefore, argue that they are a violation. Yet, it should be noted that the spirit of the Geneva Convention very much reflects the strict separation of civilians and combatants. Civilians can only be protected if this separation is adhered to. Any grey-area situation might very well result in the targeting of the civilian in question. While a possible defense to that argument is a reference to the Lotus case and the long-standing principle that everything in international law, that is not prohibited, is allowed, the authors would like to pose the question of whether it is necessary to encourage violent civilian defense, knowing the potential consequences. One would hope that states feel a higher moral – if not also a legal – obligation to safeguard their civilian citizens than to argue that they are allowed to engage in such action, because it is not prohibited. At the very least, States should take said responsibility seriously and inform their citizens of potential consequences which would then enable each and everyone to make an informed choice. This is also in line with States’ obligation to ensure respect for the Geneva Conventions which clearly promote the protection of civilians.

To summarise, neither non-violent nor violent civilian defence constitutes a violation of IHL per se. While both forms can be read in conjunction with existing IHL, the authors argue that violent civilian defence certainly goes against the spirit and purpose of the Geneva Conventions.

3.3 Ukraine’s Civil Defence before and after Russia’s Attack(s)

Ukraine’s defence strategy before the war was primarily regulated by the Law “On Fundamentals of National Security of Ukraine” which was passed in 2003. While this law does not address civil defence in the way the Baltic Republics have, it does mention the civil service and its role in Ukraine’s defence. However, the role of civil servants in Ukraine’s defence service was defined as supplemental to the military service. This means, civilians were used, e.g., on a fixed-term contract basis in a specialist function. Their role was to fill positions and provide expertise that the military itself did not have, or to free up the military’s capacity to focus on their original duty: combat and defence.

Since Russia’s invasion on 24 February 2022, the Ukrainian population had to endure unspeakable things: mass destruction of cities, atrocities, including even the abduction of children. Not to speak of the experiences of Ukrainian soldiers who are subject to atrocious crimes. However, for the purpose of this paper, the authors would like to take a closer look at civilians. How does the civilian population engage in defensive actions – be it a defence of democratic values and the protection of Ukrainian identity, or actions more geared towards restoring territorial integrity. Understandably, information is hard to come by, as this is still an on-going conflict. No one on the ground has, for good reason, shared anything that could potentially be of use to the Russians, hence whatever we can analyse here will remain on the surface. The following sections will, nevertheless, attempt to situate different examples of known Ukrainian civilian defence actions in IHL (if applicable).

3.3.1 Conventional Means of Civilian Resistance

Media coverage was astonished by the bravery of resistance of Ukrainian civilians facing their occupiers, particularly at the beginning of the Russian invasion of Ukraine 2022. Videos and photos of unarmed civilians in Ukraine emerged and were shared widely, documenting how inhabitants of attacked villages and towns greeted their invaders: with protests, by singing the Ukrainian national anthem, with road blockades, by stopping moving vehicles from progressing further.

For example, in the city of Berdyansk, civilians protested against Russian soldiers occupying the city. Civilians have also blocked road access to Zaporizhzhia, the Ukrainian nuclear powerplant now in control of Russian forces. Other video material shows how civilians actively stopped moving vehicles from progressing en route. The bravery of unarmed civilians facing their occupiers is exemplary, but do their activities meet the relevant thresholds to alter their status of protection under international humanitarian law?

Civil resistance, e.g. in the form of protests or singing the national anthem, do not amount to DPH. Clearly, these activities do not fulfil the necessary harm threshold. Nor is this the case where civilians merely refuse to collaborate with invading or occupying forces. Where civilians join war-sustaining efforts, e.g. by producing camouflage nets or even making Molotov cocktails, they also do not fulfil the requirements of DPH, as these wider activities lack direct causation to hostilities. Constructing road blockades only constitutes DPH where these blockades result in an adverse impact on the military operations or military capacity of a party to the conflict: where no such effect is given and the activity in question is also not likely to cause death, injury, or destruction, building a road blockade would not meet the necessary harm threshold to speak of DPH. Civilians thus have a range of options to take up activities that support the defence of their State and that constitute war-sustaining efforts without losing their civilian protection from direct attack.

Is this still the case though where civilian resort to more drastic measures? How about inhabitants who pick up arms and use force and violence to defend themselves against their occupiers? Their exact status depends on the circumstances under which they resort to the use of force. Firstly, where civilians engage in violent civil unrest against occupying forces, such activities would likely not amount to DPH, as they are missing the belligerent nexus that is necessary for such activity to qualify as DPH. Instead, they would fall under the regular law enforcement paradigm. Where civilians, in an unoccupied territory, spontaneously use force to resist invading forces, carry their arms openly, adhere to IHL and wear a distinctive emblem, they might qualify as participants in a levée en masse. As a result, they enjoy combatant privilege and prisoner of war status. However, this requires a level of spontaneity that is not always given.

Shortly before the Russian invasion, Ukraine had passed new legislation in January 2022 that legitimises ad hoc resistance, e.g. when civilians join the territorial defence forces (TDF), and which incorporates these groups into its military command structure. They have been provided with weapons and wear a distinctive emblem, a yellow taped band around their arm. In these instances, those who are fighting would be part of a command structure and likely wear a distinctive emblem. If they also carry their weapons openly and conduct their operations in line with IHL, they could qualify as a volunteer group which is part of the armed forces and therefore enjoys prisoner of war status when captured. However, with this level of organisation, they would no longer be qualified as participating in a levée en masse.

Civilians who do not join organised volunteer groups, and individuals who are not members of a levée en masse, but are also directly participating in hostilities, lose their civilian protection for the duration of their activities when such activities are likely to inflict death, injury or destruction or their activities are integral to a military operation (see section 2). Examples here would include acts of sabotage or using delayed or remote weapons, including booby traps, missiles or mines, and also drones.

While these examples of activities potentially amounting to DPH are not new – after all, these are examples of civilians reacting to or participating in conventional warfare – and established rules of IHL apply to them, the wide availability of video and photographic footage recording these activities brings them closer to those outside the war zone. One still relatively new way in which civilians can participate in hostilities is through cyber means, which will be examined more closely in section 4.

3.3.2 Intelligence Gathering by Civilians

In any armed conflict, information is key: information about road conditions, the enemy’s location, the equipment used or the enemy’s morale are only a few of the examples on which a party may want to collect data. To do so, it needs information or intelligence, typically obtained through a number of sources, including professional intelligence agencies but also informants in the civilian population.

In Ukraine, for example, civilians have been sending intelligence information, especially via Telegram chats or via the Ukrainian government app Diia that allows users to “report the movements of Russian troops, sending location-tagged videos directly to Ukrainian intelligence”, reportedly receiving tens of thousands submissions a day. The intelligence gathering effort benefits from a wide availability of smart phones that can record sound and photographic material that can be passed on quickly. A Ukrainian intelligence official confirmed in news reports that the local population is “supportive” but did not want to expand on the details of the activities conducted by civilians. Relying on public reporting makes the following examples of information gathering by individuals an anecdotal reference rather than confirmed activities, but they raise a range of interesting questions about civilians gathering intelligence in support of Ukrainian forces: Who organises this? Where do civilians report? What is the information used for? Do civilians know what their information is used for? And finally, does intelligence gathering by civilians amount to DPH?

Intelligence gathering would amount to DPH and meet the relevant harm threshold and meets the direct causal link criterion if it forms an integral part of a military operation to the adverse affect of a party to the conflict, e.g. because it is considered a preparatory act for a specific hostile act. For example, it has been reported that one informant passed on information obtained by a farmer who had identified the position of a Russian missile launcher – which was replaced by a hole in the ground the next day. While difficult to confirm, it would seem that the relevant information here was used to provide targeting coordinates and, therefore, was an integral part of a specific military operation. Similarly, Ukrainian informant Dollar, a civilian who had been providing targeting coordinates and other information on Russian operations, provided information on a hotel hosting Russian officers to his handler at the Security Service of Ukraine, with the hotel later being bombed. A further example of civilian involvement stems from U.S. officials who noted that an underground of intelligence informants helped lead to Russia’s withdrawal from Kherson – providing little insight on the information structure and in how far information was used for distinct military operations. In contrast, Reuters reports on an interview with a former policeman who has been gathering intelligence on collaborators, leading to criminal investigations. Such general information gathering, or the reporting of information on potential war crimes, would not be considered DPH given that there is no direct causal link, the belligerent nexus is missing and the intelligence obtained does not form an integral part of a military operation.

The value of civilian intelligence gathering is clear: a wide net of undercover informants, who can quickly communicate essential information with the help of smart phones, is critical to the war effort. The Ukrainian Defence Minister has reportedly even awarded decorations to civilian informants for cooperation with the armed forces. However, again it must be noted that it is pivotal that civilians understand the risks and consequences of their activities, including under international humanitarian law, and can, therefore, come to an informed decision about their activities. This is especially key given that enemy soldiers may not be able to distinguish between regular use of a phone and intelligence gathering amounting to DPH in the fog of war, and while any party must adhere to the principle of distinction and, when in doubt, consider civilians to be protected, such legal rule may not in practice always be adhered to. It is thus key that civilians gathering intelligence are aware of such risks and implications.

4 Hybrid Warfare, the Ukrainian IT Army and Civilian Cyber Defence

On 26 February 2022, Kykhaylo Fedorov, Ukraine’s Deputy Prime Minister and Minister for Digital Transformation announced the launch of an IT Army on Twitter and called upon “digital talents” to join a Telegram channel “to continue the fight on the cyber front”, promising “tasks for everyone”. While many of the details about their activities are unknown or at least not confirmed by official sources, some suggest that over 400 000 people have joined the Ukrainian IT army, many of whom are from outside Ukraine. Although there have been repeated statements that there is no coordination between the Ukrainian government and the cyber IT army, a list of targets, including a number of Russian and Belarussian businesses, banks as well as governmental departments, was initially published in the Telegram chat in which administrators continue to post targets.

So far, knowledge of the IT army’s activities remains limited, especially from official sources. Initially, it had been reported that members have conducted a number of distributed denial of service (DDoS) attacks against Russian and Belarussian targets, including against the Kremlin, the Foreign Ministry and the Ministry of Defence, as well as the Moscow Stock Exchange. Furthermore, members of the IT army have been said to patch vulnerabilities and thereby defend Ukrainian networks from Russian attacks. Other reported activities include gathering intelligence through espionage operations. However, some reports find that the IT Army is “purely offensive in nature” and conducts offensive cyber operations against a number of targets, including Russian civilian infrastructure or online pharmacies. As there is little authoritative information on the IT army’s activities, these activities must be assessed with caution but even if they are hypothetical, they raise key questions for the application of IHL.

In light of the considerations raised in Section 3 on the question of what is considered to be direct participation in hostilities by civilians, this IT army raises new questions for the concept and its application to hybrid warfare and especially to civilians who participate in the conduct of cyber operations in the wider context of armed conflicts. Against this backdrop, this section considers whether members of the cyber IT army constitute civilians who are directly participating in hostilities (4.1), whether they form a levée en masse (4.2) or whether they indeed must be considered combatants under new reform proposals (4.3).

4.1 Are the Members of the IT Army Civilians Directly Participating in Hostilities?

The Ukrainian IT army is also sometimes referred to as cyber volunteers or civilian volunteer hackers. Such names carry a different connotation than describing the group as an IT army. What is in the name then, and are the participants of this group actually civilians? According to Art. 5 of the ICRC customary international humanitarian law study, civilians are negatively defined as those who are not combatants. Combatants, in turn, are members of the regular armed forces of one of the parties to the armed conflict. For the purpose of this section, the IT army is not incorporated into the regular structures under the Ukrainian armed forces (on reform plans, see section 4.3). However, some distinguish between the core team of the IT army which may have different, governmental support and assumes a coordinating function, than the wider membership of the IT army. While such distinction could have implications, particularly as to the status of the core group under IHL, this paper does not have further information to analyse the separate status of the “core group” of the IT army, but in line with the paper’s main theme, focuses on the implications of individual civilian participation. This paper also assumes that the Ukrainian IT army does not constitute a separate organised armed group fighting against the Russian armed forces and thereby engaging in a separate non-international armed conflict. To do so, the group in question would have to be sufficiently organised, able to implement IHL norms and also be “capable of engaging in sufficiently intense violence with their adversary”. Even where the organisational requirement is interpreted loosely, the IT army does not identify itself as distinguished group, but instead, members have indicated in interviews that they see themselves as part of the Ukrainian army and they do not fulfil the necessary threshold of violence or intensity of protracted armed violence as set out in the Tadic judgment. The analysis is thus based on the assumption that the individuals of the IT army are civilians in an international armed conflict.

If the members of the IT army are not combatants but indeed civilians, do their activities nevertheless carry consequences for the application of IHL? If participants in the IT army are not combatants, but civilians, they can nevertheless lose their civilian protection if they are directly participating in hostilities. As explained above, DPH requires three elements, i.e. a threshold of harm, direct causation and belligerent nexus.

Assessing whether the activities of the IT army meet the harm threshold requires a case-by-case analysis. The reported activities of the IT army have so far included DDoS attacks and fixing vulnerabilities, both activities that arguably do not meet the threshold of harm, as they do not lead to death, injury or destruction and arguably, depending on the exact target, do not adversely affect Russian military operations or military capacity. However, this does not mean that cyber operations cannot principally reach such threshold given that cyber operations that do successfully interrupt the ability of Russian armed forces to communicate or conduct logistics would adversely affect Russian military operations. Soesanto’s examples of offensive cyber operations against Russian (civilian) infrastructure mentioned previously would seemingly reach such threshold and potentially even violate the principle of distinction. Likewise, intelligence collection has in the past been considered to amount to DPH in specific circumstances. Such collection could also be conducted via cyber means. Thus it seems that irrespective of the geographical location of the members of the IT army, some of these (potential) activities may arguably still meet the relevant harm threshold to constitute DPH. This has also been confirmed by the ICRC’s guide on DPH that finds that “Electronic interference with military computer networks could also suffice” to meet the threshold of harm. The authors of this paper find that it is unlikely that general defensive activities, such as patching the vulnerabilities of Ukrainian networks to protect them from Russian cyber- attacks, would meet the harm threshold, but that certain offensive cyber operations, e.g. to interrupt Russian military communications, would indeed meet such threshold.

Even where they do, these activities would also still have to fulfil the other two requirements of DPH, i.e. have direct causation and belligerent nexus. To establish a direct causal link, the activity in question must result or be likely to result in harm or be an integral part of a coordinated military operation causing such harm. Currently, little is known about how the activities of the IT army link to other military operations or their direct impact on Russian capabilities. Thus it is not always evident that there is a direct causal link between some of these activities and the harm caused, especially where they contribute to the wider defence of Ukrainian networks or general intelligence efforts. In light of Ukrainian claims that the IT army does not coordinate with the Ukrainian military, it also has not been confirmed that these activities form an integral part of coordinated military operations. However, depending on the activities and the context of each of these, and possibly coordination that is not publicly acknowledged, it is generally feasible that activities conducted by members of the IT army could fulfil the direct causation requirement.

Finally, the activities in question must be committed to directly cause the required threshold of harm in support of a party to the conflict and the detriment of the other (belligerent nexus). It seems likely that activities by a hacktivist or a civilian joining the IT army, out of support for the Ukrainian state fighting against the Russian enemy, would meet this requirement. However, little is publicly known about the exact involvement of the participants or their link to the hostilities. One news report states that participants “have different motives, and they use different cyber weapons, from simple tools for online vandalism to sophisticated cyber operations. But they are united in their goal: to support besieged Ukraine”. In that sense, it seems likely that belligerent nexus can be established for specific activities. However, the question arises how loosely such requirement can be interpreted. While some might argue any cyber security measure taken by one party has, in turn, a negative impact on the enemy’s military capacity, such interpretation would go too far in the eyes of the authors of this paper who consider that generic cyber security measures such as fixing vulnerabilities, therefore, do not have a sufficient belligerent nexus.

Overall, it is thus possible that where members of the IT army conduct cyber operations that have an adverse affect on the military operations or capacity of the enemy, have a direct causal link with the hostilities and have a belligerent nexus, they qualify as civilians directly participating in hostilities. However, where this is not the case and the activities in question do not meet the relevant criteria, as is the case for passive defences protecting Ukraine’s networks or limiting the impact of Russia disinformation campaigns, Väljataga concludes that such activities would merely constitute indirect participation in hostilities. Indirect participation in hostilities, e.g. in the form of activities that are part of the general war effort or war-sustaining, however, does not mean that a civilian loses their protection from direct attack.

It follows that civilians participating in the IT army that stay below the relevant threshold of harm and do not meet the three requirements of DPH, do not lose their civilian protection. Nevertheless, they may be violating domestic law and could be criminally charged for their activities. However, where the relevant three requirements are met and the individual in question is directly participating in hostilities, they could be directly targeted under IHL provisions for the time they are DPHing, even if such direct targeting could violate other norms of public international law where such civilian is located in a State that is not party to the conflict. Although the publicly available information on the IT army’s activities is limited, it is likely that adversarial forces may hold different information, influencing their judgment on whether or not civilians who have joined the IT army are indeed directly participating in hostilities. Furthermore, Russia has in the past advanced broad interpretations of what support of Ukrainian forces would amount to direct participation in hostilities and thus, who could be directly targeted. Nevertheless, all parties must be reminded that, where doubt as to their legal status exists, individuals must be treated as civilians.

Finally, the authors of this paper would like to stress that civilians who are supporting Ukraine’s cyber efforts are not principally acting in violation of IHL but need to be able to do so on an informed basis. As such, they must be made aware about the legal and practical consequences of their actions. However, where “a growing number of (…) volunteers with little experience in cybersecurity who run hacker programs without fully understanding how they work” are joining these efforts, it is highly questionable whether they are sufficiently informed about the consequences their activities may carry. Arguably, it is up to them to inform themselves before joining such group and conducting these cyber operations, but it is at least questionable whether a State that directly benefits from their activities, if not at least passively supports their activities, has at the very least a moral – if not a legal – obligation to provide information that helps participants to make a conscious decision as to their levels of participation and the possible consequences thereof. After all, all High Contracting Parties to the Geneva Conventions are obliged to ensure respect for the Geneva Conventions under all circumstances.

4.2 Are the Members of the IT Army Participants in a Levée en Masse?

While this paper has so far argued that the members of the IT army do not form part of the regular armed forces or a separate organised armed group, it could also be considered whether they are participants in a levée en masse. Participants in a levée en masse are “inhabitants of a non-occupied territory, who on the approach of the enemy, spontaneously take up arms to resist the invading forces, without having had time to form themselves into regular armed units, provided they carry arms openly and respect the laws and customs of war”. Where participants of the IT army are indeed also participants in a levée en masse, they enjoy prisoner of war status and combatant immunity. However, the application of these requirements to the Ukrainian IT army is unclear, especially given the lack of detailed information on its operations.

Firstly, it is unclear as to how far participants of the IT army are “inhabitants” of Ukraine. Whereas, some members may certainly be, it is suspected that a number of individuals who hail from across the globe, i.e. non-inhabitants of Ukraine, have also joined the IT army, or at least have joined the respective Telegram channel. However, those non-inhabitants of Ukraine – whether they are Ukrainian or not – cannot form part of a levée en masse. This first requirement is thus likely only fulfilled in part. Even where non-inhabitants of Ukraine use Ukrainian infrastructure to conduct cyber operations, such limited involvement is not permanent enough to consider them inhabitants of Ukraine.

Secondly, participants of the levée en masse must act within an unoccupied territory and to resist the invading forces. In this context, it is clear that the activities in question must be conducted against Russian armed forces. However, what constitutes occupied territory may be less clear, as the situation continues to develop dynamically. The factual uncertainties aside, where it can be established that the Russian armed forces hold effective control and occupy a certain area, inhabitants in such territories could not be participants of a levée en masse.

As a third requirement, spontaneity is key. Whereas little is known about the actual level of organisation and planning within the IT army, Buchan and Tsagourias elaborate that in their view, “the critical question is whether the group has been organised by the invaded government”. They conclude that the mere invitation or encouragement by government to join such a group does not amount to commanding or organising the relevant participants. Rena Uphoff also finds that the IT army “stood up in an ad-hoc manner without a clear structure and proven plan”. This is in line with Ukrainian officials who have repeatedly claimed that there is no coordination between the government and the cyber IT army, which they see as a volunteer group with multiple leaders. However, some have described the IT army as “government-led” and others consider that “its level of organisation and subordination to the Ukrainian government seems a degree too high for it to be viewed as a levée en masse”. The level of coordination and organisation between the IT army and the Ukrainian government and, therefore, the degree of spontaneity, thus remains subject to speculation.

Finally, it is unclear whether the members of the Ukrainian IT army carry their arms openly – or what this requirement even constitutes in cyberspace – and whether they adhere to IHL. Given that the ICJ held in the Nuclear Weapons advisory opinion that a weapon can be any instrument that causes harmful effects, this means that the necessary hardware and software used by the members of the IT army could constitute such weapons. However, carrying them openly is also needed. Buchan and Tsagourias argue that for the levée en masse, this means visibly in line with the 1960 Commentary. However, visibility with respect to “cyber weapons” is of course of limited practicality. While a laptop or computer may very well be visible, it is arguably invisible components such as malware that are decisive, especially given that any civilian would nowadays also be likely to carry around a phone or laptop, thus being indistinguishable from members of the IT army.

Given the limited information available, it is also unclear whether the members of the IT army currently comply with the IHL rules. Victor Zhora, a senior Ukrainian cyber official, stressed that the IT army only targets military targets, but some have questioned these assessments, e.g. by pointing out that the Moscow Stock Exchange is a civilian target. Similarly, Soesanto finds that civilian infrastructure has been targeted by the Ukraine IT army. While formerly civilian objects may under certain conditions constitute legitimate military targets, it is nevertheless uncertain to what extent the members of the IT army adhere to IHL rules.

To conclude, the participants of the Ukrainian IT army are – at least given the limited information available – unlikely to meet the requirements necessary to constitute a levée en masse. This is especially in light of the continued operations throughout the armed conflict and the level of coordination and, therefore, lacking the spontaneity that must be assumed. It follows that they do not enjoy combatant privilege nor are they entitled to prisoner of war status.

4.3 Will the IT Army Be Integrated into the Ukrainian Armed Forces?

New developments indicate that Ukraine wants to incorporate its IT army into its regular armed forces. While aiming for an established cyber command section within the Ukrainian armed forces is not a surprise, the proposal seeks to continue to involve volunteer hackers. Such structure has also been implemented by the Estonian Cyber Defence Unit on which the Ukrainian plans have been modelled, seeking to build a cyber reserve, after training personnel as part of their mandatory service.

While there are currently no further updates on the restructuring of the IT army, if active members of the IT army assume a role within the Ukrainian armed forces, this could change their legal status under IHL. If their plans are indeed based on the Estonian Cyber Defence Unit, it is likely that the Ukrainian model would also constitute a volunteer corps that is, however, part of the armed forces as it also falls under army command structures in armed conflict. As such, active members would then qualify as combatants in line with Article 4(a)(2) GCIII assuming that they fulfil the respective requirements. Where this is the case, members of the IT army would gain combatant privilege, meaning they can lawfully participate in the ongoing armed conflict against Russia, but they would, therefore, also lose their civilian protection and could be directly targeted, both by cyber and conventional means.

The details of this plan, however, are currently unclear. For example, it is not evident how the Ukrainian army would treat foreigners located outside Ukrainian territory who have so far informally joined the IT army. Nevertheless, further steps taken by the Ukrainian government will likely clarify this. Until then, their participation in Ukrainian cyber operations or in support thereof must be assessed with caution. While volunteers provide effective support for Ukraine’s defence against an unlawful intervention and brutal invasion from Russia, their activities can carry severe consequences – not all of which may be clear to those who are civilians and have not been educated and informed about their status and its legal implications under IHL.

5 Concluding Thoughts

Estonia, Latvia, and Lithuania offer valuable insights into how civilian populations can be effectively incorporated into national defence strategies, drawing from their extensive experience in successful non-violent civilian defence. While civilian defence was initially regarded primarily as a non-violent means of maintaining social cohesion and upholding national values, this perception has evolved over time. Our analysis of the Baltic Republics’ defence strategies reveals that civilians are not only encouraged to engage in typical non-violent civilian defence work but to also participate in activities that may potentially meet the threshold for DPH. Non-violent defensive actions cannot cross the threshold to DPH. On the other hand, engaging in violent civilian defence can potentially lead to civilians engaging in DPH. However, such strategies are not in violation of IHL per se – whether they might violate state responsibility is yet another question that cannot be addressed here.

Over time, and in response to the increasing threat from Russia, civilian defence has morphed into a more blended approach, combining non-violence and violence. A civilian secretary is likely aware that picking up a rifle to join in their country’s defence (irrespective of whether it is a case of levée en masse or not) will mean they are participating in hostilities and, therefore, become a legitimate target. However, a student who is skilled in it and participates in certain cyber-attacks, might not be aware that they are crossing the threshold to DPH and can become a target for lethal force.

The Baltic countries have shown examples of how civilians can be included in resisting foreign aggression. While it may not be necessary to allow or encourage civilians to engage in violent acts, and such civilianisation of conflict comes with considerable risks, it certainly is necessary to, at the very least, address civilian resilience against hybrid threats. Consequently, NATO and Western states should urgently consider the Baltics’ example.

Indeed, the 2022 invasion of Ukraine by Russia further underlines the crucial element that civilians play in national defence. Whether in the form of civilian protest, keeping up morale and Ukrainian identity, or by war-sustaining efforts on or offline – examples of how civilian Ukrainians contribute to their defence are manifold. Yet the war in Ukraine also underlines that, whereas civilian contributions may continue to take place in traditional forms, like making camouflage covers or Molotov cocktails, civilian defence contributions in the 21st century may also entail a cyber element.

The war in Ukraine also exposes the challenge of determining the legal consequences of civilians’ actions, especially assessing when civilian activities qualify as DPH, particularly in the absence of adequate factual information. Civilians often have limited access to comprehensive information, both due to their relative lack of resources and the complex nature of conflict information. Consequently, assessing the extent to which their contributions are integral to military operations and potentially amount to DPH becomes difficult. This means that both based on the limited information that civilians may hold, but also a likely lack of information and understanding about the legal consequences their activities may carry, it will be difficult for civilians to assess the degree to which their contributions are, for example, integral to military operations, and, as a result, amount to DPH which would mean that they lose their protection from direct attack.

Therefore, informing civilians about the implications of their actions is key. While the need for the Ukrainian government to recruit digital skills for their cyber defence or for civilians supplying information is evident and understandable when defending themselves in an armed conflict that seeks to eliminate a sovereign state, this does not mean that the Ukrainian government does not hold at least a moral, if not also a legal, responsibility to inform its civilians about the consequences of their involvement under international humanitarian law. The same applies to any other State seeking to develop defence strategies that include civilian participation of a violent and non-violent kind. Of course, the two researchers writing this paper have limited access to information that confirms the degree to which information sharing on such matters occurs already, for example through warning notifications when using relevant apps or cyber tools. Therefore, this section has been written with caution, merely confirming the central importance of educating all participants – civilian or not – of an armed conflict, about their rights and obligations, but also of the legal consequences of their involvement.

The last question the authors sought to address in this paper was whether Baltic and Ukrainian civilian defence strategies are the next logical step in (hybrid) warfare? While civilian direct participation in hostilities per se is compatible with existing IHL, the authors hope that States refrain from encouraging their civilian populations to engage in acts that cross the threshold to DPH. Otherwise, the principle of distinction could lose its bite and dramatically increase civilian deaths and suffering – the very thing the Geneva Conventions sought to minimise.

---

Saskia Millmann is the Research Affiliate at the Glasgow Centre for International Law & Security, University of Glasgow (UK).

Pia Hüsch is the Research Fellow in cyber, technology and national security at RUSI. Her research focusses on the impact, societal risks and lawfulness of cyber operations and the geopolitical and national security implications of disruptive technologies, such as AI.