Strikes in both directions

Over roughly six weeks, Russia and Ukraine have each struck the other's data centers, and two Just Security analyses co-authored by Michael Schmitt map how the law of armed conflict applies, while a Council on Foreign Relations assessment supplies the infrastructure account.

According to Marko Milanovic and Schmitt, writing on October 29, the current series of Russian attacks, which began in mid-September 2026, hit Ukrainian facilities including De Novo in Kyiv on September 17 and Cosmonova on September 26, which Russia's Defense Ministry said supported the armed forces and Starlink-based military communications respectively. A September 23 attack left roughly 100,000 Kyiv-area households without connectivity. Ukraine answered in October with strikes on Yandex data centers, a Sberbank facility under construction, and, on October 18, a VK data center near Saint Petersburg. CFR's Connor Martin, writing on October 16, reported that the Yandex strikes disrupted email, payment, and navigation services.

The attacker's test

Milanovic and Schmitt apply Article 52(2) of Additional Protocol I, under which an object is a military objective by nature, location, purpose, or use if its destruction offers a definite military advantage. A data center built exclusively for military use qualifies by nature, a commercial facility qualifies by use when it makes an effective contribution to military action, and reliable intelligence of intended military use can satisfy the purpose prong.

The advantage prong is harder. Data centers are built with redundancy, often including backups abroad, so disrupting one site may yield a negligible advantage. The authors also canvass competing views on whether the "object" is the whole building, which they attribute to the United States, or only the relevant component, which they attribute to the ICRC, and favor treating permanently affixed equipment such as server racks as part of the building.

Russia's claims are orthodox but unproven

Russia has described its campaign as a "forced digital detox" and asserted that each targeted facility was in current military use, arguments Milanovic and Schmitt call "both legally orthodox and wholly contingent on the facts." Russia has offered no evidence, Ukrainian authorities have rejected the claims, and the facilities are visually indistinguishable from civilian ones, so the authors treat the claims skeptically while acknowledging that, if substantiated, they would rest on existing law.

Ukraine's stated rationales fare worse

By the authors' account, Ukraine has not asserted that its targets were military objectives, with the possible exception of VK. Its two stated rationales, reciprocity and disruption of bots and disinformation, fail on their reading: the first is a reprisal prohibited by Article 52(1), on which neither state has entered a reservation, and the second is doubtful on the facts and, even if true, propaganda outlets do not become military objectives. Martin notes that the bot claim "was soon disputed." Ukraine's VK statement cited "information support for the Kremlin's policies, as well as for the needs of the Russian army," which the authors read as a claim about the company rather than the facility.

The authors stress that Russia's use of force remains unlawful and that Ukraine holds "the moral and legal high ground," but conclude that Ukraine's current justifications "lack any legal footing," adding that legality cannot be assessed with certainty without classified intelligence.

Proportionality and the defender's duty

Even for a lawful target, Milanovic and Schmitt count foreseeable reverberating effects, such as hospital or emergency-service outages, as collateral harm, while mere inconvenience does not count, and they treat the status of lost civilian data as unresolved. The "constant care" duty may require striking only a military server hall while sparing shared power and cooling.

The companion piece by Klaudia Klonowska and Schmitt, published October 20, turns to the defender. Article 58 requires parties "to the maximum extent feasible" to protect civilians under their control, obligations the authors argue begin in peacetime because data centers take years to build. Article 58(b) directs states to avoid siting military objectives in densely populated areas, cutting against the commercial pull toward cities; dedicated military facilities and segregated server halls are offered as options. Backups abroad helped Ukraine, which legislated shortly before the 2022 invasion to let government data move to the cloud and then shifted it to AWS and European facilities, but a neutral state permitting belligerent use of a data center on its territory would "almost certainly" breach its duties. Whether the obligation covers only attacks or all military operations, and whether data is an object at all, remain unsettled. Martin adds that Russia's data localization law leaves few backup options.

What remains open

The two Just Security analyses converge on a narrow point: a data center can be a military objective, but only on facts neither belligerent has publicly supplied, and how the object is defined and whether civilian data counts as collateral damage remain to be settled.

Sources