Corporate Human Rights Liability in U.S. Courts Over Russia's Drone War in Ukraine

A newly filed lawsuit in the Southern District of New York may be a harbinger for further technology-liability cases arising out of the war in Ukraine. In Kovalenko et al. v. Ubiquiti, Inc., Ukrainian civilians allegedly injured or displaced by Russian drone attacks seek to hold liable a New York-based networking company for allegedly supplying communications infrastructure that supported Russia's battlefield command-and-control network. 

At first glance, the case resembles other lawsuits brought against manufacturers whose products found their way into foreign conflicts. And in important respects, the theory is not unprecedented. Plaintiffs have previously sought to hold U.S. manufacturers responsible for alleged human-rights abuses committed abroad using their products. But the Kovalenko complaint extends that concept into a different technological and factual setting. Rather than alleging that a specific device directly caused a specific injury, plaintiffs contend that the company’s airMAX radio bridge technology became part of the underlying communications architecture that enabled Russian forces to coordinate and execute drone attacks against civilians. 

The lawsuit arises from what plaintiffs describe as Russia's "human safari" campaign, a pattern of drone-assisted attacks on civilians in Kherson, Chernihiv, and other regions of Ukraine. According to the complaint, Russian forces use drones, reconnaissance feeds, and communications networks to identify, track, and attack civilians far from traditional front lines. The plaintiffs include civilians allegedly wounded in drone strikes, as well as relatives of individuals killed in such attacks. 

Corporate Responsibility for Downstream Uses of U.S. Products

The heart of the lawsuit is not whether Russian forces committed atrocities. Rather, the dispute concerns whether a private American technology company may bear civil liability for supplying equipment that allegedly helped facilitate those acts. 

That question has an important historical analogue. In a case filed in the Western District of Washington, the parents of a deceased 23-year-old American protestor and several Palestinian families sued an equipment manufacturer over bulldozers used by the Israeli military in demolitions that killed or injured civilians. The plaintiffs alleged, for example, that the company aided and abetted war crimes and other human-rights violations by providing the bulldozers while knowing they would be used to demolish civilian homes, and they also asserted wrongful-death, public-nuisance, and negligence claims. The Ninth Circuit ultimately affirmed dismissal on political-question grounds because the bulldozers had been financed through U.S. military assistance to Israel; the court therefore did not decide whether the company had aided and abetted war crimes.

The comparison is instructive because both cases attempt to impose civil liability on an American company based on allegations that their products facilitated human-rights abuses committed by a foreign military. But the theories diverge in important ways. The Washington case involved physical equipment supplied to the Israeli military and alleged to have been used directly in the demolitions that caused the plaintiffs’ injuries. Kovalenko, by contrast, alleges that networking technology became part of a broader communications architecture supporting Russian drone operations, without tying a particular device to a particular attack. 

The plaintiffs allege that the company’s long-range radio bridge devices are subject to extensive U.S. export restrictions and that exports of those products to Russia effectively became prohibited after Russia's 2022 invasion of Ukraine. The complaint alleges that despite those restrictions, these products continued flowing into Russia through distributors and intermediaries operating in jurisdictions such as Turkey, Kazakhstan, and Czechia. Plaintiffs further allege that the company knew or should have known that its products were reaching Russian military users. 

According to the complaint, evidence of that knowledge includes public reporting, Russian military broadcasts showing the company’s equipment in use, trade data reflecting continued imports into Russia, and device telemetry allegedly allowing Ubiquiti to determine where products were operating after deployment. Plaintiffs contend that the company not only retained visibility into those devices but also maintained contractual authority over distributors and therefore possessed meaningful control over the relevant supply channels. 

Arguably, the proximate cause arguments in the Washington case were stronger as the American equipment manufacturer there supplied the equipment directly to the Israeli military, whereas the equipment in Kovalenko allegedly ended up in the hands of the Russian military through a more circuitous route. 

On the other hand, in contrast to the Washington case, the Kovalenko complaint also emphasizes alleged post-sale visibility and control, including device telemetry, firmware updates, distributor relationships, and technological measures that plaintiffs contend could have restricted the equipment’s use. The complaint also alleges that the company continued providing firmware updates to devices operating in Russia and occupied Ukraine for years after the invasion and could have implemented technological safeguards such as geofencing, whitelisting, or kill-switch capabilities to disable unauthorized military use. Plaintiffs point to the deactivation of Russian Starlink terminals as evidence that such measures were technologically feasible. 

Transforming Export Compliance into Tort Liability

What makes the case especially significant is not the general proposition that a U.S. company might face liability based on its products’ alleged use in human-rights abuses abroad. Rather, the case is notable for its attempt to use alleged export-control violations and sanctions-compliance failures, together with allegations about a company’s continuing knowledge and control over its products, into traditional state-law tort claims.

The complaint asserts causes of action for negligent entrustment, public nuisance, strict products liability based on design defect, negligent product design, negligent infliction of emotional distress, and several aiding-and-abetting tort theories. Plaintiffs argue that the company’s equipment was not reasonably safe because it lacked safeguards preventing prohibited military end users from deploying the devices in a war zone. They further contend that the company negligently entrusted dangerous technology to actors it allegedly knew or should have known would misuse it. 

Historically, product-liability litigation has focused on defects in the product itself, failures to warn, or product misuse. This lawsuit seeks something different. Plaintiffs argue that liability may arise not because the radio bridges malfunctioned, but because they allegedly worked exactly as intended and thereby enabled harm when deployed by sanctioned military actors. 

A Key Challenge: Foreseeability and Causation

The viability of plaintiffs’ negligence theory may first depend on whether the alleged misuse of the company’s technology was reasonably foreseeable. In the corporate context, that inquiry may focus on what a reasonably prudent technology company with the company’s alleged information, technical capabilities, and control over its distribution network would have anticipated and done. The complaint identifies several alleged warning signs, including export restrictions, continued imports into Russia through intermediaries, public reporting, Russian military broadcasts depicting the company’s equipment, and device telemetry allegedly revealing where products were operating. Plaintiffs also allege that the company retained contractual authority over distributors and could have deployed technological restrictions against unauthorized uses.

The foreseeability inquiry therefore may not turn on whether the company could have predicted the precise drone strike that injured each plaintiff. Instead, the question may be framed at a higher level of generality: whether a reasonable technology company, confronted with the alleged warning signs, would have foreseen a substantial risk that communications equipment reaching sanctioned Russian military users would facilitate attacks against civilians. That framing highlights a key legal question for the court: the broader the relevant risk is defined, the easier it may be for plaintiffs to establish foreseeability. The more narrowly it is defined, the more attenuated the asserted duty of care becomes.

The reasonable-company inquiry also raises an important question about prevention. The inquiry would examine whether the precautions allegedly available to the company were reasonable in light of the probability and gravity of the asserted harm, the company’s ability to identify affected devices or distribution channels, and the costs and consequences of intervention. Plaintiffs point to measures such as strengthened distributor controls, geofencing, whitelisting, and device deactivation. Their theory is that a reasonable company allegedly aware of military diversion would have investigated those options and implemented proportionate safeguards. 

Without minimizing the predicate analysis of foreseeability, the case may turn on causation.

The complaint does not identify a specific device connected to a particular attack. Instead, plaintiffs advance a network-level theory, arguing that the company’s products formed part of the communications infrastructure necessary for Russian drone operations. According to plaintiffs, battlefield communications are indispensable to reconnaissance, target selection, command coordination, and strike execution. Therefore, they argue, supplying and maintaining that infrastructure substantially contributed to the attacks that injured them. 

This issue mirrors a recurring challenge in litigation involving military supply chains. Several recent lawsuits against semiconductor manufacturers faced dismissal because plaintiffs could not plausibly allege that a particular defendant's component was present in the specific weapon that caused injury. Courts viewed the chain of causation as too attenuated. 

The plaintiffs in the instant case attempt to avoid that obstacle by shifting the focus from individual devices to a broader communications network. Their theory is that liability does not depend on identifying the precise component involved in each attack if the defendant supplied infrastructure that allegedly enabled the entire system to function. Whether courts accept that distinction may determine the outcome of the case. 

At its core, the lawsuit asks a question that extends well beyond wartime technology: When a company allegedly knows of a serious risk, possesses the ability to reduce or eliminate that risk, and chooses not to act, when does a compliance issue become a tort? The answer may shape not only the future of technology liability, but also the evolving expectations for corporate governance, compliance programs, and risk management across the modern workplace.

Why Employers Should Care: The Rise of Business and Human Rights Liability

Although Kovalenko et al. v. Ubiquiti, Inc. arises from a wartime context, the case sits within a broader trend that employers across industries should be watching closely: the expansion of business and human rights principles from voluntary corporate commitments to “hard law” compliance requirements that permeate an employer’s “value chain,” and related sources of litigation risk. 

The New York lawsuit reflects a trend pressuring courts to impose consequences on companies that allegedly fail to prevent foreseeable human-rights harms connected to their products or business relationships. This type of theory has taken traction in Canada and the United Kingdom.¹

For employers, this represents a potentially significant shift. Historically, human-rights-related litigation often focused on direct participation in misconduct or labor abuses within a company's own operations. Cases like this one seek to impose responsibility further downstream – i.e., within the “value chain,” a concept broader than “supply chain” – based on allegations that a company supplied products, services, or business support that enabled third parties to commit human-rights violations

Regardless of whether the Kovalenko plaintiffs ultimately prevail, the case reflects a growing expectation that companies will identify human-rights risks, investigate red flags, document their decision-making, take reasonable steps to mitigate foreseeable harms and redress adverse impacts. As human-rights due diligence increasingly becomes part of ordinary corporate governance, the line separating workplace compliance, ESG commitments, and civil liability may continue to blur.