Ukraine Symposium – Doxing Enemy Soldiers and the Law of War

This post was prepared in academic consultation with Major Inna Zavorotko, a lawyer with the Ukrainian Ministry of Defense Legal Division. A fuller treatment of wartime doxing, including in the context of non-international armed conflict and human rights law considerations, will be available in an article.

The term doxing is a colloquial shortening of the phrase “dropping documents.” It describes the online publication of personal or private identifying information. Doxers often acquire information without consent and publish it to publicly shame, harass, or threaten their victim. It has long been an electronic aspect of interpersonal squabbles, political grudges, and economic feuds. But doxing also increasingly features in modern armed conflict. This post evaluates doxing of enemy soldiers under the law of war. While not per se unlawful, doxing enemy fighters requires careful attention to their legal status and a clear link to concrete operational objectives.

Doxing Operations

Near the start of the conflict between Ukraine and the Russian Federation, reports emerged of a doxing campaign against Russian soldiers. Initial accounts attributed the publication of the soldiers’ names, dates of birth, addresses, military units, and passport numbers to the private online group Anonymous. Later, Ukrainian media leaked the identifying information of as many as 120,000 Russian soldiers, though the recency and accuracy of those data have been questioned.

More reliable data on Russian soldiers have been doxed by Ukrainian authorities including the Office of the President of Ukraine, the Main Directorate of Intelligence of the Ministry of Defense, the State Security Service, and the Prosecutor General’s Office. These agencies ultimately published a “Book of Executioners of Ukraine” used to dox Russian military leaders suspected of war crimes. Intelligence agency officials also reportedly published information identifying 1,600 Russian troops involved in operations in the town of Bucha, the site of numerous suspected Russian atrocities. A second release of data reportedly included names and other information connected to spies working with the Russian FSB security agency.

Wartime doxing has not been limited to Ukraine or to international armed conflicts. In 2015, reports confirmed the online publication of information identifying more than 1,300 U.S. military and other personnel by a pro-Islamic State group. These doxes were apparently designed as kill lists to encourage and facilitate attacks on the service persons identified. A study published by the West Point Countering Terrorism Center concluded that extremist hacking campaigns will continue to resort to doxing. Meanwhile, the U.S. Central Command labeled doxing a “new norm” under which “any CENTCOM teammate or family member could be targeted.”

Law of War Applicable to Doxing During International Armed Conflict

If doxing enemy soldiers is indeed a new norm of armed conflict, how is it regulated by the law of war? Doxing clearly implicates privacy. And although war between States often suspends or alters the operation of some civil and human rights, the law of war is not unconcerned with personal privacy and dignity.

The Geneva Conventions’ Personal Scope of Protection

The law of war focuses its privacy-related provisions chiefly on persons who fall under belligerents’ physical control, such as prisoners of war and civilians under enemy control. Enemy soldiers who have not “fallen into the power of the enemy” by virtue of surrender or capture are not prisoners of war. The 1949 Third Geneva Convention relative to the Treatment of Prisoners of War applies chiefly to fighters who are hors de combat by virtue of capture. Therefore, doxing enemies who are otherwise eligible for prisoner of war protection but remain at liberty presents no legal difficulties under the Third Convention.

The 1949 Fourth Geneva Convention relative to civilians, however, offers a distinct personal scope of protection. Where the Prisoner of War Convention’s “fallen into the power” standard clearly anticipates capture and physical custody, the civilian Convention’s “in the hands of” standard does not. Under the Fourth Convention a civilian may be a protected person merely by virtue of presence in territory belonging to an enemy power, or their own territory that an enemy power has occupied (or by an expansive view to invaded territory). Thus, by contrast with prisoners of war, civilian protected persons, including persons suspected of or who have engaged in hostile acts, enjoy protection under the Convention even if they are not in the physical custody of an enemy power.

“Respect and Protect” Provisions

Both the Third and Fourth Geneva Conventions include protections reminiscent of privacy concerns respectively to prisoners of war and to civilian protected persons. The Third Convention’s Article 13, for instance, generally addresses humane treatment of prisoners of war. It requires that they “at all times be protected, particularly against acts of violence or intimidation and against insults and public curiosity.” Article 27 of the Fourth Convention similarly prohibits insults and exposure to public curiosity. States originally intended these provisions to end the practice of parading captured enemies for propaganda purposes. As recently as the Vietnam war, these parades exposed prisoners of war to physical violence. Article 13 has since been interpreted to apply more broadly, including to publication of photographs and motion pictures as well as to harmful propaganda.

In a 2020 update of its scholarly Commentary to the Third Convention, the International Committee of the Red Cross (ICRC) argues that exposure of prisoners of war to the public, even if not accompanied by insult, is “humiliating in itself and therefore specifically prohibited” (para. 1624). The ICRC further advises a broad understanding of the Article 13 term “public.” It maintains that the term refers not only to the general population but also to anyone not directly involved in prisoner of war internment operations (para. 1624). The Commentary contends that even release to members of a Detaining Power’s own armed forces may be considered “public” (para. 1624). The ICRC concludes, “any materials that enable individual prisoners to be identified must normally be regarded as subjecting them to public curiosity and, therefore, may not be transmitted, published or broadcast” (para. 1627).

This broad reading of Article 13 should be regarded cautiously. The 2020 Commentary’s 1960 predecessor included no such elaborations on the notion of public curiosity nor such an expansive understanding of the term “public.” Generally, the 2020 Commentary claims to ground its interpretive expansions in State practice subsequent to adoption of the Third Convention and publication of the 1960 Commentary (para. 93). Yet States appear, as supporting notes to the 2020 Commentary concede, to have reserved authority to publish images of prisoners of war in many cases (notes 119-21). This is particularly so when prisoners will not be individually identified by such images.

Still, because it involves publication of identifying information, doxing likely does not involve the carveouts lodged by States for anonymous public exposures of prisoners of war. So, it is unlikely that doxing prisoners of war and civilian protected persons is consistent with the Third and Fourth Conventions’ protections from public curiosity. Just as the original scope of the public curiosity prohibitions evolved from parades to also cover photographic and motion picture exposures of prisoners of war, they may similarly prohibit electronic dissemination of their personal data. Doxing is almost certainly prohibited for the purpose of directing negative attention amounting to insults or public curiosity, toward prisoners of war and civilian protected persons. according to the plain meaning of those terms.

Additionally with respect to specific law of war rules applicable to situations of control or custody during international armed conflict, 1977 Additional Protocol I, Article 75 affords fundamental treatment obligations to persons “who are in the power of a Party to the conflict . . . .” It has been referred to as providing “basic human rights-like” protections (p. 200) and judged to “fill gaps in treaty law” (p. 514, emphasis in original). Indeed, the article applies to persons “who do not benefit from more favourable treatment” under the law of war. The United States, for one, has indicated it regards Article 75 as reflective of customary international law.

Article 75 prohibits “outrages upon personal dignity, in particular humiliating and degrading treatment,” effects that may well be achieved by some virulent forms of doxing. But, like the Third Convention with respect to prisoners of war, the article appears to anticipate conditions of physical custody not only from the term “in the power of” but also by reference to the accompanying protections it affords, nearly all of which relate to conditions of arrest, detention, or internment. Thus, only persons in the physical custody of a State are likely to be protected from doxing through Article 75 and only from effects that amount to humiliating outrages on their dignity. Publications of identity and anodyne personal information including enlistment in enemy armed forces are unlikely to implicate the article’s fundamental protections.

Targeting Law

The law of war prescribes an elaborate regime of precautions applicable to targeting operations. But many of these obligations are limited in their application to operations that amount to “attack.” The term attack is understood to refer to “violence against the adversary.” And it describes “only one specific military operation, limited in time and space” rather than entire campaigns (p. 329). Meanwhile, violence for purposes of attack has been referred to as “an act that causes injury or damage” with injury referring to “personal . . . . illness or death” (para. 2.1) and most often resulting from “physical force” (p. 329), though not always (p. 415, para. 3).

While doxing enemy soldiers is certainly directed “against the adversary,” it is unlikely to involve direct violence as understood by the attack threshold.  And the fact that a doxing operation supports or even forms part of a larger campaign or operation that clearly involves violence does not convert the dox into an attack. Doxing may form part of a campaign against an adversary, but the specific operation involving doxing itself must produce the required violence to be regarded as an attack, an unlikely event in nearly all cases.

A further targeting law limit on operations directed against enemy soldiers concerns offers of rewards for killing. The 1907 Hague Convention IV Regulations have long been interpreted to prohibit putting a price on the head of an enemy (para. 31). “Dead or alive” solicitations are thought to too greatly risk undisciplined or disordered violence (p. 630-31, n. 100, 127). But mere solicitations to capture have been distinguished as lawful, as have requests for information, even to facilitate later lawful attack (§ 5.26.3.1). So, while enemy soldiers may be doxed to draw out information useful to countering their effectiveness, to permit capture, and even for later attacks, doxing may not support a reward offer to the public for killing them.

All the same, prohibited solicitations for the public to kill must be distinguished from focused efforts by a belligerent itself. The fact that doxing involves identifying and singling out specific enemy soldiers presents no law of war-based objections. While it may be true that most war operations are directed against enemy forces without respect to their personal identity, States have long carried out military operations, including lethal attacks, against specific enemy individuals (§ 5.4.6.4, & n. 116).

Law of War Principles

Finally, at a far greater level of generality, the law of war addresses the conduct of hostilities through principles. Although States’ and others’ expressions of the principles of the law of war vary greatly, two principles, “humanity” and “military necessity,” are almost universally included.

As the U.S. Law of War Manual concedes, “Military necessity is a difficult concept to define and apply” (§ 2.2.3). It identifies the principle as that which “justifies the use of all measures needed to defeat the enemy as quickly and efficiently as possible that are not prohibited by the law of war” (§ 2.2). For its part, the Ukrainian Guidance on Implementation of IHL in the Armed Forces, Order N. 164 states that the “main purpose of the hostilities is to achieve the enemy’s defeat with a minimum loss of time, personnel and physical resources from both parties to the conflict: attacking party as well as attacked party” (§ 10). In this sense, military necessity allows for but, by contrast with the targeting rules discussed above, also functions to limit military operations short of attack.

It’s not difficult to imagine how doxing enemy soldiers may contribute to their efficient defeat. Morale, fighting spirit, and ability to maintain operational and tactical focus are essential components of effective fighting forces. States devote significant resources to preparing and sustaining soldiers in these respects. In addition to tactical training, pre-deployment procedures often involve steps to prepare soldiers’ professional, personal, legal, and financial lives for the turmoil of combat. Steps taken to undo this work, to distract enemy soldiers’ attention from their fighting duties, or to cause them to doubt their efforts are sustainable in a personal sense, may be quite effective at undermining morale and commitment to their State’s war effort and therefore may be entirely necessary. Similarly, publishing enemy soldiers’ contributions to an unpopular or internationally unlawful campaign may deter their continued participation and prove in that sense militarily necessary. Ukraine has specifically indicated that encouraging surrender is a goal of their doxing operations. One such project candidly titled “Want to Live” has reportedly secured more than 2,000 responses.

Humanity, or as it is often negatively expressed, prohibited “unnecessary suffering,” is a further, widely recognized law of war principle (para. 79). The United Kingdom Manual of the Law of Armed Conflict instructs, “Humanity forbids the infliction of suffering, injury, or destruction not actually necessary for the accomplishment of legitimate military purposes” (¶2.4.1).

Classically, the suffering addressed by the law of war rules that animate humanity has been associated with physical pain and injury. However, there is increasing attention to adverse mental effects of hostilities on victims of war, including combatants. While doxing is very unlikely to inflict physical suffering or injury in a direct sense, doxing that cruelly reveals extraordinarily sensitive personal details may result in significant mental suffering or anguish—perhaps sufficient to implicate consideration of the principle and the balancing it calls for against military necessity.

Neither the principle nor its implementing rules prohibit such suffering per se. Only suffering that is superfluous, not reasonably related to achieving enemy defeat, or clearly disproportionate to resulting military advantage is prohibited. Thus, while gratuitous doxing of especially sensitive personal details of enemy soldiers may be inconsistent with humanity, doxing that produces mental suffering may nonetheless be justified if reasonably expected to achieve a concrete military advantage such as inability, unwillingness, or perhaps even reluctance on the part of enemy soldiers to continue participation in hostilities.

Doxing the Deceased

Further concerns with respect to doxing concern treatment of the dead. Reports indicate that Ukraine has posted pictures of dead Russian soldiers online to “combat Kremlin censorship of its deadly invasion.” There have also been reports of Ukrainian outreach to the families of the dead. The notifications have included pictures or other documentation. Other recent conflicts have also featured controversial treatment of the dead.

As aptly explained by another post in this symposium, the Third Geneva Convention does not protect soldiers who have died in battle. Yet the First Geneva Convention’s Article 15 requires Parties to “search for the dead and prevent their being despoiled.” For Additional Protocol I parties, Article 34 requires that the remains of the dead be “respected.” Further, the ICC’s Elements of Crimes uses a footnote to include “outrages upon personal dignity” carried out on dead persons as a war crime (n. 49 to art. 8 (2) (b) (xxi)). The U.S. DoD Law of War manual notes that “Enemy military dead must be protected from disrespectful or degrading acts” (§ 7.7.1.1).

In compliance with the First Convention’s requirement to search for the dead, as well as to record the “date and place of . . . death” and “particulars concerning [the] cause of death,” Ukrainian armed forces have actively gathered the dead bodies of Russian soldiers (art. 16). These efforts to identify the dead may include the gathering of specific data such as “measurements and description of the body and its physical features, examination of the teeth, fingerprints, photograph, etc” (art. 17). To that end, Russia and Ukraine have conducted exchanges of the dead. The Ukrainian government has also notified the ICRC, as the Central Tracing Agency, of the names of the dead in compliance with the First Convention, Article 16 obligation.

The First Convention neither commands nor prohibits enemy government notification of the families of the dead directly. It requires only that the Party “transmit this information to the Power on which these persons depend through the intermediary of the Protecting Power and of the Central Prisoners of War Agency” (art. 16). Therefore, the legal standard upon which to review Ukrainian actions is whether this notification qualifies as degrading to or disrespectful toward the dead bodies, or allowing despoliation.

Consistent with its policy of confidentiality, the ICRC—which performs many of the Conventions’ tracing and notification functions—has not opined publicly on Ukrainian doxing of dead enemy soldiers. And we are aware of no State practice on this issue nor of prior examples of direct notification of soldier deaths to families by an enemy power. But so long as the Ukrainian government is notifying the families or posting the information online to inform family members, this practice does not amount to a breach of the First Convention. However, publication or notice undertaken to mock the dead, to terrorize families, or for some other non-informational purpose, may be unlawful.

Doxing as Information Operations

Ultimately, doxing enemy soldiers might best be understood as a form of information operation. Information operations (IO) refer to “the use and management of information to pursue a competitive advantage, including both offensive and defensive operations.” Although frequently associated with misinformation or disinformation, IO also use factual information including propaganda for strategic and operational purposes. Reportedly, the latter are often more effective than deceptive operations.

Clearly, doxing may accomplish many of the goals of propaganda such as influencing enemy opinions, achieving psychological effects, and undermining morale. Propaganda, despite recent and enduring bad publicity, are not prohibited by the law of war. However, law of war restraints apply to them, including many of those analyzed above. The U.S. DoD Law of War Manual advises, for instance, that propaganda may not be used to expose detainees to public curiosity or to humiliating or degrading treatment. (§ 5.26.1.3). Nor may they be intended or designed primarily to intimidate or terrorize a civilian population. Doxing enemy soldiers to instigate, inflict, or solicit mental or physical harm on enemy fighters’ families is also prohibited.

A further consideration of doxing as an information operation may equate it to war crimes wanted posters. In that vein, commentators have defended Ukraine’s publication of photos of Russian prisoners of war as legitimate efforts to address alleged war crimes. All States, even States not party to an armed conflict, are required by each of the 1949 Geneva Conventions to search for and to prosecute or extradite persons suspected of committing grave breaches of the Conventions. In some cases, doxing enemy soldiers may prove an effective means of identifying and facilitating efforts to bring war criminals to justice. The Office of the President of Ukraine has couched some of its doxing in these terms, particularly the “Book of Executioners” dox described above. Ukraine has indicated the project has already yielded useful evidence for criminal investigations. The better tailored such doxing is to the goal of enforcing the Conventions, the better its prospects of being justified in these terms.

Conclusion

The impacts of military operations against the private lives and personal information of combatants have not been widely addressed in political, military, or legal literature. Concerns with privacy and data protection during armed conflict are mounting. Yet most analysis concerns the interests of civilians and the private business sector. From a purely humanitarian perspective, an ideal law of war would no doubt insulate combatants from operations that reach beyond their military capacity and into their private and personal lives. Yet today, evidence of such a rule applicable to doxing is lacking.

At present, belligerents enjoy relatively wide license to conduct doxing operations against enemy soldiers who are not hors de combat through capture. While prisoners of war and persons who qualify as protected under the Fourth Geneva Convention enjoy protection from doxing that amounts to insults or exposure to public curiosity, soldiers who remain at large are susceptible to releases of personal information intended to reduce their capacity or willingness to fight. Additionally, doxing may be a legitimate means of fulfilling States’ obligation to search for and prosecute or extradite soldiers suspected of committing grave breaches of the Geneva Conventions and their First Additional Protocol. While capacious understandings of law of war principles, particularly of humanity, may suggest to some that doxing is an intolerable and unconscionable widening of war beyond soldiers’ capacity to fight, present State understandings of these principles and lack of clarity concerning their legal effect do not support such views. To be sure, gratuitous and cruel doxing untethered to articulable war aims is unlawful. However, doxing, per se, appears to be a lawful form of modern information operation with potentially effective though regrettably personal impacts.

***

Eric Talbot Jensen is a Professor of Law at Brigham Young University.

Sean Watts is a Professor in the Department of Law at the United States Military Academy, Co-Director of the Lieber Institute for Law and Land Warfare at West Point, and Co-Editor-in-Chief of Articles of War.

Photo credit: Anton Holoborodko