IT Army of Ukraine

Two days after the Russian invasion began, on 26 February 2022, Ukraine's minister of digital transformation publicly called, on a messaging app, for volunteers worldwide to join an IT army. Hundreds of thousands of people subscribed to the channel, which published daily lists of Russian targets, government sites, banks, media, payment platforms, and tools to flood them with denial of service. The military effectiveness of these attacks is debated: most cause brief interruptions. Their legal significance, however, is considerable. A government was publicly coordinating civilians, including nationals of neutral countries, in operations against a state at war. International humanitarian law distinguishes combatants and civilians, who lose their protection when they take direct part in hostilities. The International Committee of the Red Cross published in 2023 rules of conduct for civilian hackers, restating the prohibitions. For insurance, the episode blurs the distinction on which clauses rest: the same act can be spontaneous hacktivism, a state-encouraged operation, or an act of war depending on who decided it. Characterizing an attack suffered by an insured then depends on evidence of organization and direction that the underwriter almost never has.