EU General Court endorses sanctions on cybersecurity firm connected to Russian intelligence services

The General Court of the European Union has upheld the EU’s decision to maintain restrictive measures against Positive Group PAO, active in Russia’s IT sector, following its judgment in Case T-573/23. The court dismissed the company’s challenge, reinforcing the legitimacy of the so-called “IT criterion” employed by the Council of the EU. This criterion targets entities operating with FSB-issued or military/arms-related licenses.  


Key highlights

  • IT Criterion Validated: The Court ruled that the criterion adheres to principles of foreseeability and legal certainty, as it defines a specific and narrow group—those operating in IT under certain Russian state licenses.  
  • Proportionality Upheld: The measure is deemed not manifestly disproportionate, given the goal of pressuring Russia to halt its aggression and information warfare. Legal ties to Russian security services justify the inclusion—even without proving direct involvement in hostile actions.  
  • Business Freedom Not Violated: Interference with business operations is considered appropriate and necessary, within the Council’s discretion, to uphold EU objectives.  
  • No Errors in Assessment: Although Positive Group PAO and its subsidiary are legally distinct, the Court recognized the company’s decisive influence over its subsidiary, which holds the relevant FSB license—thus validating its inclusion on the sanctions list.  

What it means

This ruling strengthens the EU’s ability to apply targeted sanctions more effectively—especially against entities that are part of Russia’s technological or security infrastructure. It underscores the Court’s support for broad measures aimed at curbing Russian aggression through economic and informational pressure, even when direct participation in hostile actions isn’t proven.


Leave a Reply

Your email address will not be published. Required fields are marked *