Lawfare Daily: The European Court of Human Rights Takes on Digital Rights in War

Podcast: The Lawfare Podcast
Date: August 22, 2025
Guests: Asaf Lubin (Indiana University Maurer School of Law), Deb Housen-Couriel (Hebrew University of Jerusalem)
Host: Scott R. Anderson

Overview of the Episode

This episode explores the landmark July 2025 decision by the European Court of Human Rights (ECtHR) in the joined cases of Ukraine and the Netherlands v. Russia. The discussion highlights the Court’s groundbreaking approach to digital privacy rights under Article 8 of the European Convention on Human Rights, especially as they relate to wartime activities and occupation. The conversation homes in on the so-called “filtration” systems used by Russian forces to collect massive amounts of personal data from Ukrainian civilians, examining the Court’s analysis, its jurisprudential innovations, and the practical and global implications for privacy, international humanitarian law (IHL), and national security.

Key Discussion Points & Insights

1. Background and Significance of the Case

• Scope & Size:

  • The July 9 judgment is monumental: 500 pages long, with approximately 18 pages focusing on digital privacy issues.
  • Out of 46 states party to the European Convention, 26 intervened as third parties—an unprecedented level of engagement ([03:57]).

• Procedural Context:

  • Applications arose from Ukraine (starting 2014) and the Netherlands (post-Flight MH17, 2020), culminating after Russia’s full-scale invasion in 2022 ([05:56]).

• Russia’s Status:

  • Russia was not present in the proceedings, having left the Council of Europe post-invasion and refusing to accept the Court’s jurisdiction ([06:58]).

• Timeframe Covered:

  • The decision covers up to six months after Russia’s expulsion from the Council of Europe (up to September 2022), implicating numerous human rights violations including in Crimea ([07:34]).

2. Filtration and Data Collection Practices in Occupied Ukraine

• What is Filtration?

  • Systematic, compulsory processing of over one million Ukrainians (1/4 minors) through at least 21 centers in occupied areas and at border crossings ([08:40]).

• Practices Included:

  • Forced provision of device passwords
  • Downloading contact lists, photos, emails
  • Registration of IMEI numbers
  • Collection of biometrics: fingerprints, palmprints
  • Passport scans
  • Surveillance via cameras at detention sites

• Consequences:

  • Beyond standalone Article 8 violations (privacy), filtration is deemed a “gateway violation," enabling forced disappearances, kidnappings (including minors), and broader abuses ([01:35], [08:40], [11:08]).

Quote:
"Filtration measures taken together not only are standalone violations of Article 8, but the court has characterized them as gateway violations that permit... Russian forces to violate additional human rights, including forced kidnappings, detentions, people who've simply been lost and cannot be contacted by their families. They've been disappeared."
— Deb Housen-Couriel ([01:35])

3. Legal Analysis: Article 8 and its Application in Wartime

• Article 8 (Right to Privacy):

  • Enshrines respect for private/family life, home, and correspondence—now interpreted to cover digital communications ([13:43]).

• Historical Application:

  • ECtHR previously allowed for some forms of bulk surveillance if certain safeguards are met—proportionality, legal authorization, oversight, review, remedial access ([16:41]).

Quote:
"The Court has not rejected the possibility of foreign mass surveillance. Rather, the Court tries to identify whether... you've taken all the necessary precautions to avoid abuse and to ensure protection."
— Asaf Lubin ([16:41] and [42:55])

• Novelty:
  • The decision marks the first time these standards are applied in the context of armed conflict and occupation, not just peacetime ([13:43], [16:41]).

4. Extraterritorial Application and Navigating Precedent (“Georgia II” Case)

• Key Legal Test:

  • Whether states’ obligations under the European Convention apply extraterritorially based on “effective control” over areas or people ([17:36]).

• Previous Precedent (Georgia v. Russia II):

  • In cases of active hostilities/“chaos,” Court previously limited Convention’s reach.
  • Here, Court distinguishes due to systematic, premeditated Russian conduct, not “chaotic” circumstances ([21:23]).

Quote:
"The court is very careful to emphasize in discussion of the Article 8 violations how systematic they were... it was very interesting to note that emphasis, especially in the light of the jurisprudence that went before."
— Deb Housen-Couriel ([21:23])

5. Findings: What Specifically Violates Article 8?

• Nature of Violation:

  • Compulsory, systematic harvesting of digital and biometric data from civilians constitutes a clear and severe Article 8 breach ([29:55]).

• Gateway to Other Rights Abuses:

  • Data utilized to enable detentions, separations, forced adoptions; compounded harms documented ([29:55], [32:16]).

• Importance of Privacy:

  • Court positions privacy as a “linchpin” or “gateway”—not auxiliary to wartime atrocities but enabling them ([32:16]).

• Court’s Approach to Overlapping Legal Regimes:

  • Harmonious interpretation advocated: human rights law (ECHR) does not yield entirely to IHL during conflict; privacy standards still apply ([32:16]).

Quote:
"What this court case does by referring to it explicitly as gatekeeping is to suggest this idea that privacy is a linchpin... once you've collected the information is when you can take actions to detain, to torture, to separate, to annex, to destroy."
— Asaf Lubin ([32:16])

6. Open Questions, Limits, and Critiques

• Court’s Omissions:

  • Did not reference Ukrainian law or possible peacetime privacy standards as baselines ([36:02]).
  • Did not provide operational military guidelines or recognize future technological challenges (e.g., routine DNA collection) ([44:14]).
  • No criteria on data retention, breach response, or cross-conflict misuse articulated ([44:14]).

• “Step Zero” Moment:

  • Most military data collection regimes currently carve out armed conflict/national security, meaning there is still not even a baseline acceptance of privacy obligations in practice ([46:26]).

7. Hypotheticals and Future Implications

a) Data Collection for Military Targeting to Protect Civilians

• Conditionally Legitimate:
  • Must be based in law, pursue a legitimate aim, use proportionate means, and employ robust procedural safeguards: access control, time limits, remedies ([39:45], [42:55]).

b) Data Use in Status Determinations / POW Tribunals

• Balancing Required, but Guidance Lacking:
  • Court did not supply granular answers for procedural questions or retention/abuse scenarios; left many practical uncertainties open ([44:14]).

8. Why This Matters Beyond Europe

• Evolution of Customary Law:
  • Though an ECtHR holding, the principles may influence regional and eventually customary international law ([48:32]).
  • US and other NATO partners will face operational reality of reconciling their standards with evolving European privacy laws in joint operations ([50:05]).

Quote:
"If you want to send American soldiers to train with German soldiers today, you have to take into account German standards of data protection... and so it will be in our interest to at least be aware of what the European data protection standards are if we are ever to collaborate."
— Asaf Lubin ([50:05])

9. Looking Ahead: Where Does the Law Go From Here?

• Academic and NATO Initiatives:

  • Ongoing projects within NATO and academia on practical guides for military data protection, including new books and practitioner handbooks ([52:24]).

• Trigger Event for Future Change:

  • Real-world breach of military-collected data could force rapid development of practical and legal responses ([54:06]).

Notable Quotes & Memorable Moments

• "Filtration measures taken together... are gateway violations that permit... Russian forces to violate additional human rights." — Deb Housen-Couriel ([01:35])
• "What this court case does... is to suggest that privacy is a linchpin... once you've collected the information is when you can take actions to detain, to torture, to separate, to annex, to destroy." — Asaf Lubin ([32:16])
• "The Court has not rejected the possibility of foreign mass surveillance... Rather, the Court tries to identify whether... you've taken all the necessary precautions..." — Asaf Lubin ([16:41], [42:55])
• "If you want to send American soldiers to train with German soldiers today, you have to take into account German standards of data protection..." — Asaf Lubin ([50:05])
• "There are too many unknowns... And at the end of the day the Court did not address even that uncertainty that you've raised." — Deb Housen-Couriel ([44:14])

Important Timestamps

• [03:57] — Case background and scope
• [08:40] — Description of filtration and privacy abuses
• [13:43] — Article 8 and its application to digital rights
• [16:41] — ECtHR approach to surveillance and mass data collection
• [21:23] — Navigating past legal precedent (“Georgia II”)
• [29:55] — Specific privacy violations and consequences
• [32:16] — Privacy as a gateway to other abuses
• [42:55] — Conditions for legitimate mass data collection in armed conflict
• [44:14] — Open questions and absent court guidance
• [50:05] — Practical implications for the US/NATO cooperation
• [52:24] — Academic, practitioner, and intergovernmental future developments

Conclusion

This episode offers a comprehensive, nuanced exploration of how the ECtHR has set a new global marker for digital privacy rights in wartime. The discussion underscores not just the legal milestone but also the significant operational and normative uncertainty that remains, foreshadowing years of future legal, ethical, and technological debate and development.

Listen if you want to understand:

• How European human rights law confronts modern digital and wartime abuses
• The details and consequences of Russia’s filtration systems in Ukraine
• How legal thinking on privacy, surveillance, and armed conflict is evolving worldwide

For further reading and updates:

• Check Lawfare’s coverage at lawfareblog.com
• Look out for forthcoming NATO and academic handbooks on privacy and armed conflict ([52:24]).