Digital Rights in Armed Conflict and the Ukraine v. Russia Decision

On July 9, the Grand Chamber of the European Court of Human Rights (ECtHR) unanimously found in Ukraine and the Netherlands v. Russia that the Russian Federation was responsible for a broad array of human rights violations committed over more than eight years of armed conflict, beginning with the occupation of parts of Ukraine in 2014 and culminating in the full-scale invasion launched in February 2022.

In communicating the judgment to the public, Court Registrar Marialena Tsirli characterized it as “one of the most consequential judgments in the Court’s history.” Still, the decision comes at a moment when the court’s jurisdiction over Russia has been sharply curtailed. Following its expulsion from the Council of Europe in March 2022, Russia ceased to be a party to the European Convention on Human Rights (ECHR). Accordingly, the court’s jurisdiction extends only to acts attributable to Russia occurring on or before Sept. 16, 2022—which marks six months from that expulsion in line with ECHR Article 58—even as the war continues with undiminished intensity. Russia, for its part, formally ceased to recognize the court’s authority in June 2022, and has since refused to cooperate with its proceedings. Accordingly, the Russian government has summarily rejected the present judgment, with President Vladimir Putin’s spokesperson declaring it “null and void.” The decision’s immediate and practical effect on the ground, therefore, remains limited.

Still, this ECtHR ruling offers much more than just “symbolic” victory. Out of the ECHR’s 46 parties, 26 intervened as third parties in this case, a development that the judgment notes is without precedent and reflects the intervenors’ “perception of the importance of this case to the Convention system as a whole.” Moreover, the final ruling is a landmark not only in moral terms. Throughout its nearly 500 pages and 1,652 paragraphs, the unanimous judgment provides an important analysis of the application of international human rights law (IHRL) during war, setting doctrinal trajectories that will reverberate for decades to come.

Leading commentators—including Marko Milanović, Jasmine Sommardal, Dapo Akande and Miles Jackson, and Isabella Risini—have rightly focused on the court’s innovations in extraterritorial jurisdiction, the concurrent application of IHRL and international humanitarian law (IHL), and the law of attribution. Yet one critical dimension of the judgment has received comparatively little attention: the court’s treatment of digital rights protections, including the rights to informational privacy and data protection, and their violation by the Russian military and affiliated forces in the context of its occupation of parts of Ukraine and the broader ongoing armed conflict between the two countries.

Specifically, the court held that Russian military and affiliated forces violated Article 8 of the ECHR, which protects the right to private life and to informational privacy, including in one’s correspondence. The violation, the court said, related to Russia’s design and implementation of so-called filtration measures in occupied Ukrainian territory, by means of which it collected large swaths of private personal data from Ukrainian civilians. The court explicitly ruled that IHL does not override Article 8 privacy rights. Quite the opposite: It found that even in the absence of an explicit IHL prohibition on private data collection—indeed, IHL offers little explicit regulation of privacy or data protection—Russia was still bound by its ECHR commitments to protect Ukrainians’ informational privacy. Those commitments included substantive obligations, such as the obligation that any interference with privacy “be in accordance with the law” and for the advancement of a limited set of legitimate aims to the extent “necessary in a democratic society.” Moreover, these commitments also included procedural obligations, such as the requirement that Russia enact clear safeguards around data collection. Crucially, the court characterized the filtration measures not merely as a discrete violation, but as a “gateway” violation to graver abuses, including extrajudicial killings, unlawful detention, and ill treatment of civilians.

With this judgment, the court has marked a watershed moment in international law. For the first time since the Wall Advisory Opinion by the International Court of Justice (ICJ), an international judicial body has unequivocally recognized that the right to privacy applies during armed conflict and times of occupation. But more fundamentally, and unlike the ICJ, the ECtHR has gone further by clarifying that the right to privacy imposes specific legal and administrative constraints on military data collection programs. The decision therefore embeds digital rights protection within the very structure of the laws of war, and does so at a time when warfare is increasingly waged through the ubiquitous targeting and use of computerized networks, software code, and the digital data of both combatants and civilians.

Russian “Filtration” as a Tool for Digital and Physical Control

The process of filtration was and remains a central feature of Russia’s system of control over occupied regions of Ukraine. Purportedly introduced for security screening purposes, filtration refers to the compulsory processing of Ukrainian civilians by Russian and Russian-affiliated forces across occupied areas of Donetsk, Luhansk, Kherson, and Zaporizhzhia, as well as along evacuation routes into Russian territory. According to the Yale Humanitarian Research Lab, the process encompasses an extensive network of filtration points—including checkpoints, holding facilities, and detention centers—used to screen and sort Ukrainians during forced displacement operations.

Filtration typically begins in frontline or occupied areas, where civilians of all ages are stopped at checkpoints or ordered to report to improvised screening sites, which may consist of makeshift tents, converted schools, and repurposed sports halls. As the court recounts, the procedures involve biometric data collection (palms, fingerprints, and facial images); invasive searches of personal belongings including phones and computers (with compelled disclosure of passwords); the extraction of phone IMEI numbers (a unique 15-digit serial number that identifies specific mobile phones) and stored digital content such as photographs, messages, and browsing history; the confiscation of passports and identity documents; and interrogations into individuals’ political affiliations, family members, military connections, professional histories, and views on the war.

Civilians were often held in these locations for hours or even weeks, frequently in overcrowded and unsanitary conditions, with limited access to food, hygiene, and medical care. While some were eventually permitted to return home, others “failed” the filtration process, ostensibly on the basis of criteria such as perceived loyalty and ties to Ukrainian military or nationalist groups. These individuals were detained, interrogated, tortured, and in many cases disappeared into a network of unofficial detention sites, their whereabouts unknown even to close family members. 

A Human Rights Watch Report published in September 2022 described the filtration measures as a “mass illegal data collection exercise” carried out “with no legal underpinnings.” A Humanitarian Research Lab Report from August of that year highlighted that data collection at the sites was meant to produce a “robust and detailed corpus of data” with the precise purpose of supporting “further surveillance” of Ukrainians on the part of Russian authorities. Additionally, in a July 2022 press statement, then-U.S. Secretary of State Antony Blinken noted that “between 900,000 and 1.6 million Ukrainian citizens, including 260,000 children” had undergone filtration and related forced transfers to Russia or occupied zones. He proceeded to note that the filtration operations constituted “systematic abuses,” conducted with the ultimate purpose of changing “the demographic makeup of parts of Ukraine.”

The ECtHR, in its own assessment, largely corroborates these characterizations. It emphasizes that the filtration system constituted a systematic and institutionalized apparatus of digital surveillance and physical subjugation. As the court observed:

[T]he extensive database generated by the recording of all this information was likely of particular assistance in the further identification, screening and surveillance of persons who opposed Russian occupation of Ukrainian territory. The sheer number of filtration sites, the presence of necessary equipment to take digital photographs and carry out finger and palm printing and the existence of standardised certificates issued after filtration with custom-made stamps for each filtration site/point … indicate a level of organisation which excludes the possibility that these measures were random and isolated incidents. There is no doubt that, on the contrary, they were put in place in a systemic way across occupied territory and applied to anyone wishing to leave, move around or re-enter occupied territory.

In identifying the scale, organization, and motivations behind these measures, the court laid the factual foundation for its later finding of ECHR violations.

Reconstructing the Court’s Jurisdiction in Wartime: Confronting Georgia II

Before addressing those violations, the court first confronted two interrelated threshold questions central to the architecture of IHRL in armed conflict: the extraterritorial application of the convention and its concurrent operation alongside IHL. The court’s treatment of both issues is clear, constitutive, and commendably expansive. Yet the import of its analysis comes into full view only when situated within its fraught jurisprudential lineage.

Just three years earlier, in Georgia v Russia (II), the court had significantly circumscribed its own jurisdiction, casting a shadow over the scope of applicability of IHRL during periods of active hostilities. Arising from the five‑day 2008 war in South Ossetia and Abkhazia, the court drew a stark doctrinal line, holding that during the “active phase of hostilities,” it lacked jurisdiction over alleged rights abuses. The court’s reasoning was that the “very reality of armed confrontation and fighting between enemy military forces seeking to establish control over an area in a context of chaos … means that there is no ‘effective control’ over an area,” which is a prerequisite for the application of the ECHR. This ruling was met with critique by a number of international law scholars. Helen Duffy called the decision “bizarre” and suggested that by introducing the language of chaos, the court was conjuring up “outdated images of battlefields lost in the fog of war.” Milanović was even more blunt, describing the ruling as “exemplary only in its arbitrariness” and warning that it would “definitely make it more difficult to pursue any of the pending interstate and individual cases with an ‘active hostilities’ (context of chaos) component, e.g., those regarding Eastern Ukraine.”

In the wake of Georgia II, human rights scholars were rightfully apprehensive about how the court would rule in Ukraine and the Netherlands v. Russia. Would the court double down on the logic of Georgia II, effectively accepting that the ECHR’s normative obligations evaporate at the moment they are most critically needed? Or would it seize the opportunity to recalibrate its jurisprudence and reaffirm the convention’s extraterritorial and concurrent operation alongside IHL?

The court chose the latter path, while not fully disowning Georgia II. In reaffirming the raison d’etre of the ECHR, the court cited its mandate under Article 19 to ensure the observance of the convention by its members. The ECHR, it emphasized, is “not merely a declaration of rights,” but the juridical expression of a postwar European order committed to peace through law. Both the preamble and the travaux préparatoires, which translates to preparatory works or drafting history, confirm this foundational aim. Thus, in the circumstances of the present case in which Russia launched an unprovoked invasion against a fellow “High Contracting Party,” accompanied by public statements denying that party’s very right to exist, the court found itself obliged—as a matter of fidelity to the ECHR—to “reflect anew” on the scope of its jurisdiction. Embracing the unprecedented reaction of member states, the court thus translated a moment of institutional rupture—an act of aggression by a party to the convention and its follow-on expulsion—into a reaffirmation of legal continuity.

While the court chose to “reflect anew,” it nonetheless moved with deliberate restraint by distinguishing Georgia II rather than overturning that ruling outright. The court found that Russia engaged in an extensive, strategically planned campaign, carried out over a period of years “with the deliberate intention and indisputable effect of assuming authority and control.” Such a plan, the court reasoned, “is wholly at odds with any notion of chaos.” In other words, the court found that Russia’s motivations, as evidenced by both its words and its deeds, were enough to generate effective control in Ukrainian territory, and to evade arguments around “chaos,” regardless of whether such control is fully exercised in actuality.

With the court’s extraterritorial jurisdiction over Russian activities in Ukraine firmly established, it turned to the relationship between IHL and the convention. On this point, the court first rejected the idea—still advocated by some militaries—that IHL simply displaces IHRL wholesale during armed conflict. Yet the court went even further by declining to apply the traditional lex specialis framework, which a number of intervening states invited it to do. Under that approach, which the ICJ first articulated in its Nuclear Weapons Advisory Opinion, both IHL and IHRL continue to apply during war, but the scope of particular human rights obligations may be adjusted to account for a more specific, explicit, and directly applicable IHL rule. The ECtHR opted for a significantly bolder path. Relying on Article 31(3)(c) of the Vienna Convention on the Law of Treaties, it adopted a model of harmonious interpretation by ruling that IHL may guide the interpretation of convention rights in conflict settings. As a result, ECHR obligations remain binding in war absent a valid derogation under Article 15, which sets out the procedure for derogation in times of emergency.

A Watershed Moment: Ensuring a Respect for Privacy Rights in Wartime

This background helps explain how the court reached its determination that Russia’s filtration measures violated the right to privacy under ECHR’s Article 8. After all, there would be no way to apply the right to privacy in a time of active hostilities and occupation, unless the court had some theory of concurrent application between IHRL and IHL. In this regard, the statement of the Russian ambassador to the United Nations, Vasily Nebenzya, who informed the Security Council on Sept. 7, 2022, that filtration “has no clear definition under international humanitarian law,” seemed to suggest that, for Russia, IHL was the exclusive and controlling regime. Applying the logic of harmonious interpretation, the court adopted the view that “the absence of a general prohibition under [IHL]” regarding data collection measures, such as those employed in the filtration sites, does not relieve Russia of its “obligation to establish any such measures under clear legislation with strict procedural safeguards, in compliance with Article 8 of the Convention.”

With this ruling, the court thus established that the widespread and systematic collection of personal data across occupied Ukrainian territory, absent the requisite authority in law, one that includes safeguards to evade abuse, constituted an interference with Ukrainians’ right to privacy under the ECHR. It expressly rejected Russia’s assertion before the Security Council that the filtration procedures reflected a legitimate effort to identify criminals and combatants—a process Russia had characterized as “a normal practice for any army anywhere in the world.” As the court explained in support of its ruling, the filtration measures “went far beyond mere registration and screening.” Rather, it constituted “wide search measures and systemic collection of data” that—when conducted without basic guarantees concerning the methods of search and collection, the security and storage of data, the preservation of confidentiality, and the regulation of third-party access—amount to a violation of ECHR Article 8.

The court’s unambiguous ruling on the illegality of Russia’s filtration measures focuses attention on privacy issues in bello, which has been overlooked until quite recently. As one of us has observed elsewhere, there was “practically no international legal jurisprudence, commentaries, or academic literature that applies digital rights like the rights to privacy and data protection in times of armed conflict.” For many, the idea that informational privacy warrants protection in wartime is misplaced—an abstract concern in the face of more visible and visceral atrocities. As a result, digital rights have often been relegated to the periphery of legal attention, seen as technical or secondary. This reality is changing quickly, advanced by a growing and evolving body of international legal scholarship published in the past decade by a group of authors dedicated to the cause, with further support from NATO’s Cooperative Cyber Defence Centre of Excellence, among other institutions. The ECtHR’s judgment does not cite this scholarship, and it need not. By recognizing the right to privacy as fully applicable in armed conflict, and by holding that military data practices must be bound by law even in situations of occupation, the court has affirmed a central claim of this emerging scholarly field. It has done so at a time when that claim remains far from universally accepted. In doing so, it has given institutional expression to a legal argument that, until now, has lived primarily in the pages of academic texts.

***

The ECtHR has taken a bold and necessary first step by reasserting core convention rights, including the right to privacy, amid the brutal realities of Russia’s invasion and the ongoing war in Ukraine. Still, even this landmark ruling is far from comprehensive. The court refrained from a full analysis of the confluence of IHRL and IHL in the context of privacy protection, an analysis that in our view is critical and urgent.

Military forces require far clearer guidance on the specific parameters within which data collection may lawfully occur in wartime. This includes the legal justifications that may support such collection, the permissible scope and methods of surveillance, the cybersecurity and data protection frameworks that ought to accompany these efforts, the oversight measures that should extend to military data practices, and the conditions under which such data may be accessed, stored, and shared. In the specific context of the law of occupation, the court also stopped short of engaging in a more robust doctrinal analysis of the relevant rules. For instance, it offered no account of how the occupier’s authority to adopt “necessary measures of control and security” under Article 27 of the Fourth Geneva Convention is to be balanced against other core constraints in that same instrument, such as the obligation to respect the honor of protected persons found equally in Article 27, and the prohibition on “moral coercion” found in Article 31. This gap in the court’s reasoning leaves a crucial dimension of the legal framework underdeveloped, at precisely the moment when the regulation of military data privacy practices demands greater clarity, precision, and normative resolve.

Moreover, the judgment applies only within the framework of the ECHR. It leaves open broader questions concerning the application of digital rights within the International Covenant on Civil and Political Rights, other regional human rights treaties, and customary international law. As warfare becomes increasingly data-driven, there is a pressing need for more generalizable data protection standards applicable to military activity both on the battlefield and in times of peace. This need is especially acute given the rapid adoption of technologies such as biometric identification systems, integrated sensor platforms, automated decision-support tools, and large-scale data aggregation for population surveillance. These developments raise complex legal and ethical challenges that cannot be addressed through post hoc adjudication alone. They require forward-looking regulation grounded in both IHRL and IHL. The ECtHR has taken a significant step forward with this judgment, yet the way ahead will demand the active engagement of an array of additional actors: legislators, military experts, technologists, academics, and diplomats.