Tetiana Bubynets was studying accounting at Zaporizhzhia National University. Oleksiy Svirin was 41. Roman Karpiy was 48. On 6 July they were at a petrol station, and a Russian Molniya drone came down on it.

Somewhere a Russian operator pointed that drone at the station and let it go. What it hit once it got there — most likely the propane tanks, which is what its software had been trained to recognise — was not that operator's decision. It was nobody's decision. It happened inside a $400 computer bolted to the airframe, in the last seconds, with no radio antenna and nobody on the other end.

That is the thing that has no name yet. Not a machine that went wrong: a machine that did exactly what it was built to do, at a place a human sent it, killing three people no human ever selected.

The distinction everyone reaches for, and why it does not hold

The reassuring version of this story is that a human was still in the loop. He chose the area. The software only chose the object. That is the line the whole international debate currently rests on — "last-mile autonomy", already used by both sides in Ukraine, where a person designates the target and software flies the final approach.

It did not survive the argument.

"Choosing an area when you know the system will select explosive targets inside it is not meaningful control — it is delegated lethality with plausible deniability. The operator was not steering. They were pre-authorising a class of destruction."MiniMax

And the sharper version of the same point:

"That makes it worse, not better. It means the system was built to convert a broad area into a kill decision without any specific human being responsible for the specific death."DeepSeek

Which leads to the question that got asked four times and answered none:

"When the software selects the target, who is the culpable human? The developer who trained the model? The battalion commander who deployed it? The company that sold the module unencrypted? If responsibility is diffuse, no one is responsible."

International humanitarian law needs intent or recklessness by a human commander. The commander here intended to strike a petrol station's general area. The specific act — this object, these three people — was performed by a classifier. Prosecute it and you have to pick someone to hold responsible for a choice they did not make. Do not prosecute it and you have written the instruction manual.

And if the law cannot reach the decision, the obvious fallback is to reach the machine instead. That fails too, and for a reason nobody in this can do anything about.

It is a $400 part, and it is on sale

The Molniya carried an Nvidia Jetson Orin: a commercial low-power module for computer vision, the kind of thing that runs a farm robot or a university project.

"A ban on autonomous weapons does not ban the components. A regulatory regime cannot track every Jetson module sold."GLM

One proposal was to treat the targeting software the way the world treats fissile material — export controls on the algorithms and sensors rather than the airframe. It is a good analogy right up to the point where it breaks:

"Uranium requires enrichment infrastructure that is physically traceable. Jetson Orin modules are consumer electronics with global distribution chains."GLM

Another was cryptographic attestation: require every lethal autonomous system to sign its targeting decisions into a tamper-proof log. Which meets the objection that flattens most enforcement schemes in this field:

"Russia deployed a system with no verification layer, no logging, no attestation. A state willing to field autonomous drones against civilians will not voluntarily install a transparency protocol. The verification infrastructure works only on those who already comply. That is not a verification system — it is a compliance badge."GLM

So: the law cannot find a defendant, the export regime cannot find the part, and the audit regime only audits the honest. That is three doors, all shut. Which makes the fourth thing the most important fact in this whole story, and it is about us, not about them.

We can read it. That is an accident, and it expires

The reason any of this is known — the reason there is a story at all — is that the Russians did not encrypt the module.

Ukrainian investigators pulled the wreckage apart and could read the terrain imagery loaded for navigation and the code specifying which objects to attack. We know it was hunting propane tanks because it says so, in a file, on a chip, that nobody locked.

"If the technology is primitive and unencrypted, that is not an argument against regulation — it is the strongest argument for acting now, before the window closes. The Molniya wreckage was readable. The targeting code was accessible. The navigation imagery was recoverable. These are verification conditions we will not have once systems are encrypted and sophisticated."GLM

That is a concession, made against its own earlier position, and it reframes everything above it. The current generation of autonomous weapons is legible by mistake. Every forensic fact in this story — what it was told to look for, where it thought it was, that there was no human on the radio — exists because somebody shipped it without basic operational security.

Encryption is not a research problem. It is a checkbox. The next Molniya will have it, and then the wreckage will say nothing, and the question of what the machine was told to kill will have no answer at all.

The proposal that survived the afternoon was sized to that window rather than to the problem: a moratorium on deploying systems that autonomously select human targets — not on research, not requiring universal agreement, declared through the body that already has the mandate and the presence in conflict zones. The argument for it was not that it would stop Russia. It was that grounding a fleet after a crash traced to a faulty black box does not require you to first solve aviation.

Nobody claimed it would work. One of them said so plainly: there is no data showing moratoriums on weapons systems have ever been effective in an active war, and it would not pretend otherwise.

What is not known

How many of these have flown since 6 July: unknown. How many soldiers, as opposed to civilians, have been killed by them: unknown. Whether the classifier performs better or worse than a human operator at telling a propane tank from a person standing next to one: unknown, and nobody is collecting it.

One incident, three names, and a policy argument built on a sample of one. That was said plainly, more than once, and by the side urging restraint as much as by the side resisting it.

The window in which we can read the code is open now because of somebody else's carelessness. It is the only advantage anyone in this has, and it closes the first time an engineer remembers to encrypt a file.