This expert research was carried out by Internews-Ukraine CSO in the framework of the Promoting Internet Freedom in Ukraine project funded by the U.S. Department of State through the American Bar Association and its Fund for Justice and Education. The sole responsibility for the content of this publication lies with Internews-Ukraine CSO which does not necessarily reflect the official position of the American Bar Association.
By: Vitalii Moroz, Ihor Rozkladai
Internet Decentralization in Ukraine: Overview and Advantages In late January 2022, Ukrainian outlet Ekonomichna [Economic] Pravda published a survey addressing the most frequently asked questions, Blackout, Disconnection of Mobile Communications and the Internet: Is It Possible and What to Do. Despite understanding that the Russian regime will continue to play the card of the occupied areas in Donetsk and Luhansk regions, an ordinary Ukrainian could not imagine that in less than a month, one of the bloodiest pages of modern Ukrainian history would open with the tragedy in Bucha, Borodianka, and bombing of Mariupol… Occupation of territories is accompanied with destruction of civil infrastructure — gas pipelines, water supply, electricity. It is extremely difficult to repair such infrastructure due to pre-emptive strikes or mines. Damage of information channels was no exception. Already during the first days of aggression, the TV equipment tower in Kyiv was attacked causing deaths of civilians close to the Holocaust victims memorial. Russists’ hopes that they would manage to cut off the Ukrainians from information and communication with the world, and also hide their own crimes did not come true. In the occupied territories, due to the absence of electricity or physical control over providers, problems with the Internet were created, yet the all-Ukrainian blackout did not happen. There are several reasons for this: decentralized channels, lack of strict control over the networks, and Elon Musk’s support with his Starlink satellite Internet. Early appearance of the Ukrainian Internet and its rapid development is not a coincidence, because Ukraine has long been known for its engineers, and one should not forget about the first Soviet МЕОМ computer assembled back in 1948–1950 in Kyiv. Academician Glushkov, the founder of the Cybernetics Institute of the Academy of Sciences of the Ukrainian SSR, had a concept of a nationwide automated system for collecting and processing information, which could have become the first network in the state already in the 1960s. Yet, the Soviet leadership did not support this idea, and everything was reduced to a few specialized narrowly focused projects for the military. Apparently, economic orientation of the network suggested by Glushkov was frightening for the Soviet leadership that was pursuing not the ideas of efficiency but the maximum level of employment as means of ideological struggle in the ‘rotten West’. Automated processing of information, even with those primitive speeds and memory volumes, would sooner or later demonstrate that ‘the king is in fact naked’. Slow disintegration of the USSR, caused by a collapse of the world oil prices, Afghanistan, Chernobyl disaster, decentralization processes, and disruption of logistic chains forced the state and the apparatus to focus its activities on more important problems. That is why the state overlooked the first attempts to join the World Wide Web. 1
On December 19, 1990 Yurii Yanovskyi’s historical connection to the network from the Technosoft Inter-Sectoral Research Center for Programming Technology through the Moscow node laid the foundation for the idea of the Ukrainian Internet development as a purely grassroots initiative. In spring 1991, Technosoft with the then unofficial domain ts.kiev.ua began to perform the function of an Internet service provider (ISP). And this happened only two years after the first ISP, the World, which started to provide commercial access to an average consumer in November 1989. On December 1, 1992 IANA delegated the.ua domain to two Internet-specialists, Oleh Voloshchuk and Ihor Svyrydov, who were selected by the community. And in 2001, administration of the.ua domain was transferred to the specially created Hostmaster LLC. Unlike Russia, were administration of the.ru domain was transferred to the state-affiliated institutions in 1994, the.ua domain, even despite an attempt in 2003–2009 to transfer it to the Ukrainian Network Information Center (currently administrating the Cyrillic domain.укр), is still being administered by the Hostmaster, which is a private company. Establishment of the first Internet provider was a very pragmatic decision. The cost of telephone communication posed a question bluntly: either to make money on it, or to stop these experiments. Everyone who used a dial-up communication line in the late 1990s- early 2000s knows this story. In addition to high Internet tariffs as such, they also had to pay phone bills regardless of the fact that the quality of phone connection did not allow them to get even a half of the speed of a 56‑kilobit modem. At the same time, informatics lessons at schools and universities, as well as the youth culture that promptly understood all the advantages of the new phenomenon with its legal and more often also illegal content — software, music, books, and the ability to communicate quickly and without borders — created the mass consumer market, which in the pandemic times demonstrated that the Internet as a source of information dominated over traditional media. The state has been trying to regulate activities of Internet providers for a long time. Constant battleground are the attempts to regulate installation of special equipment for monitoring traffic and detecting violators. Such practices are widespread in the authoritarian Russia, which implies imposing administrative fines and criminal prosecution of Internet users. Another area is introduction of the so-called notice and takedown system, which providers have to follow in the event of copyright violations. A draft law on the media obliges Internet providers to block grave violators. Furthermore, the presidential decree of 2017 on blocking Russian social media did not always work in practice: some providers opposed blocking deliberately, yet with the beginning of the war, it cost them their business. Is a large Ukrainian Internet shield like the Great Chinese Firewall possible? It is difficult to answer such a question unambiguously. However, it is known that no country has managed to achieve absolute purity of the Internet, except for North Korea that has single access to the Internet, which is tightly controlled by the state. For years, Ukrainian Internet providers have been building their physical networks both to the end user and connecting them with all neighboring countries accessing foreign traffic exchange points. For instance, in a publication of 2011 by the no longer existing portal ProIT, the following destinations of the communication channels are mentioned: Slovakia, Poland, Hungary, Germany, Austria, the Netherlands, Belarus, and Russia with a channel capacity of up to 10 gigabits/second. Already in 2016, according to the analysis of the Liga.net portal, 2
the bandwidth of external channels was more than 1.2 terabits/second. Whereas in the early 2000s, there was only a single point of traffic exchange (similar to subway transfer stations) between the UA-IX providers, there are minimum three such points today: UA-IX, DTEL–IX, and Giganet.ua. Of course, in this entire configuration, a Ukrainian consumer would be worried about the question concerning channels in the Russian Federation? As of 2015, at least four large providers in Ukraine had Russian origin or affiliation. Ekonomichna Pravda analysis mentions 60% control of traffic from Russia. However, this was before the sanctions. Network topology problems are mentioned in both materials, and search in the open sources furthermore shows that such data are not publicly available. After the invasion of the Russian Federation, providers became a target for attacks for Russian occupiers. For instance, traffic in occupied Kherson was redirected through the occupied Crimea. Obviously, such switching did not become a problem because after the 2014 occupation, the Crimeans continued to receive traffic from Ukraine, and the channels were never disconnected. The situation with occupied Donetsk and Luhansk regions is more complicated. Traffic was routed through Rostov-on-Don, St. Petersburg, and in some cases Traceroute showed the traffic route through China. Damaged infrastructure, critical infrastructure facilities, and the military received a new way to restore connection with Starlink terminals from Elon Musk. These actions led to countermeasures from Russia that tried to jam communications and GPS. It was not without threats to Elon Musk from a former supporter of Russian Nazism and now the head of Roskosmos, Dmitry Rogozin. Absence of a single Internet entrance to the country is an obvious advantage in terms of information security when the occupiers cannot block the entire access to the World Wide Web: there are several high-level providers in Ukraine, and each has more than one Internet channel. In case of interruptions or external interference, providers have ways to restore traffic. Starlink support became a significant slap in the face of occupiers, and at the same time it was the biggest test-drive of this system in extreme conditions, in particular with regard to jamming. However, due to the lack of transparency in the market, there were incidents when users experienced troubles with traffic caused by special operations of the Russian Federation against its own citizens since even a year ago, part of the traffic was going through the aggressor country.
3
Internet Failures Chronology during the War Cyber-attacks as part of a hybrid war are often one of the preliminary stages of the deployment of full-scale military operations. When preparing for the invasion, Russia carried out super massive DDoS-attacks against Ukraine on January 14 and February 15, 2022. They were aimed at governmental websites and information networks. For some period, the key government websites were unavailable for users, and information networks possibly were damaged. 12 hours before the invasion, on Wednesday February 23 approximately at 16:00, a new DDoS-attack on Ukraine started — for about half an hour, websites of the Cabinet of Ministers of Ukraine, the Ministry of Foreign Affairs of Ukraine, the Security Service of Ukraine, Kyiv police, the Ministry of Interior of Ukraine, the Ministry of Defense of Ukraine, the Verkhovna Rada of Ukraine and other institutions could not be opened. At the same time, Russia initiated more complex attacks: on February 23, it launched a Trojan virus, HermeticWiper, to compromise Ukrainian government computers. There are no exact data on the losses, but cyber security experts assume that the virus affected hundreds of government computers in Ukraine. On the first day of war, Russia attacked not only Ukraine but also the EU states in order to disrupt internal communications inside the Ukrainian government and among the military. On February 24, the RF launched AcidRain, malicious software that affected modems and routers of satellite communications from German company Viasat. This company provided equipment for Ukrainian government’s communications. As a result, AcidRain erased all data in the system and disabled the terminals. Researchers estimate that it caused failure of 30, 000 terminals. The Ukrainian government stood up to all these attacks. Moreover, it foresaw the risks of a possible invasion of the Russian Federation and prepared solutions for the country’s defense capabilities, in particular protection of critical infrastructure. These solutions were aimed at ensuring stability of communications in the country under the conditions of war by expanding technical capacities of communication networks.
February 24, 2022 The National Commission for Electronic Communications (NCEC) approved a decision allowing three key operators to use reserve frequencies in the 3G and 4G range. Such expansion of frequencies was accompanied with significant migration processes during the wartime, and it covered not only western regions of Ukraine but also the entire territory of the country.
4
On the same day, mobile operators and Ukrtelecom announced that they would provide communication services even to those subscribes who had zero or negative account balances. According to Ukrtelecom representatives, this concerned approximately 50,000 of their subscribers.
February 25, 2022 Minister of Foreign Affairs of Ukraine Dmytro Kuleba said that mobile operators of 15 countries canceled the fee for phone calls to Ukraine as a sign of solidarity with Ukraine.
February 26, 2022 Mobile operators Kyivstar, Vodafone Ukraine, and Lifecell blocked access to their networks for subscribers from Russia and Belarus. This was an unprecedented decision because such actions are contrary to the international communication rules. As a result, subscribers of Russian and Belarussian communication networks — mostly military personnel — were not able to use Ukrainian networks in roaming, and therefore eventually they were hunting for the Ukrainian SIM-cards and mobile phones.
March 4, 2022 Kyiv city authorities addressed Internet providers asking them to provide Wi- Fi connection in the city shelters since “currently communication and quick access to information are of great importance”. As of March 16, more than 200 bomb shelters had Wi-Fi access while the 19 providers supported this initiative. A similar movement spread to other cities and towns in Ukraine. In Kyiv, one can monitor connection with the help of the website https://wifi.kyivcity.gov.ua/. As of May 15, Wi-Fi access was available in 815 bomb shelters.
March 7, 2022 Mobile operators Kyivstar, Vodafone Ukraine, and Lifecell launched a national roaming service that enabled subscribers to switch manually between the networks in the event of problems with communication. The operators announced that national roaming would be available first of all in Kharkiv, Kherson, Sumy, Poltava, Dnipropetrovsk, Zaporizhzhia, Donetsk, Luhansk, Kirovohrad and Mykolaiv Oblasts, then in Chernihiv, Zhytomyr, Cherkasy, and Vinnytsia Oblasts, and later — in the entire territory of Ukraine.
March 12, 2022 In Odesa, the first Starlink satellite communication terminals were installed, which were provided to Ukraine by Elon Musk in order to ensure satellite Internet access in the event of problems with access to the traditional network. Starlink was delivered to Ukraine first in late February, after the head of the Ministry of Digital Transformation, Mykhailo Fedorov, appealed to Elon Musk in Twitter asking him to provide Ukraine with satellite Internet access.
5
March 13, 2022 The regulator, NCEC, announced they would accept requests from providers for restoring communication networks damaged as a result of hostilities. The funds for restoration works were expected to come in the form of support from European regulators and partners.
March 17, 2022 PayPal international electronic payment system began to function in Ukraine. This was a temporary decision, and it will be valid in the Ukrainian territory until June 30. It provided a possibility for residents of Ukraine to transfer and withdraw money to the Ukrainian bank cards. In order to use PayPal, one needs to create an account by registering an e-mail address and phone number as personal identifiers for transferring funds. Ukrainian volunteers now use PayPal actively to raise funds for the army and humanitarian needs.
April 6, 2022 In order to support Ukrainian providers during wartime, international association Global NOG Alliance launched the Keep Ukraine Connected initiative. Its goal is to provide humanitarian digital aid in the form of supplying equipment from global telecommunication companies. In cooperation with the Association of Copyright Holders and Content Providers (ACHCP) and the Internet Association of Ukraine (InAU) as well as with the government’s support, western partners collect and send necessary telecommunication equipment to Ukraine.
March — April 2022 Since the beginning of hostilities, the aggressor has caused significant damage to the infrastructure of populated areas in many regions of Ukraine. As a result of shelling, both equipment and communication channels of the providers in cities and between cities and towns were destroyed. As a result, wired Internet users lost connection — from Irpen to Mariupol. Ukrainian providers did not stop working even during hostilities and restored damaged infrastructure as soon as cable breaks were fixed. Photos of specialists from the Best provider in Irpen who were restoring cables during the evacuation of the population under fire reverberated around the world. In general, communication problems were experienced by residents of all regions where hostilities were taking place, but providers restored the operation of networks promptly in Kyiv, Chernihiv, Sumy, Kharkiv, Donetsk, and Mykolaiv Oblasts. Decentralization of the Ukrainian Internet played a significant role in ensuring stable connection for residents of Ukrainian localities. At the same time, providers suffered losses inflicted by the infrastructure damage, destroyed and looted offices (Best), as well as mass population migration that totaled 6.5 million people as of May 2022. Due to decreased income, providers also began to ask their subscribers to pay the subscription fee on time.
6
Government Response to Russian Aggression in Terms of Internet Technologies On February 26, Minister of Digital Transformation Mykhailo Fedorov announced creation of the Ukrainian IT-army for fighting on the cyber front. The community currently has over 270, 000 users, and the Telegram-channel administrators invite users to join DDoS-attacks on Russian websites. The IT-army channel has already announced that hacking the Russian service, RuTube, was the biggest victory in the cyber war. At the same time, the international hacker group, Anonymous, joined the cyber-attacks actively from the first days of the war to support Ukraine. They claim that corruption of the RuTube code was their contribution. Ukrainian websites are also being attacked from the territory of the Russian Federation. In mid-March, the Ministry of Justice jointly with Middleware launched a chatbot in Viber and Telegram for reporting crimes against humanity committed by the Russian Federation during the Russian-Ukrainian war. With the help of this chatbot, users can send information about violations of human rights, seizure of territories, killings and tortures of the Ukrainians, bombing of cities, etc. Lawyers record, formalize and process the reported situations, which will be used later on as a basis for Ukraine’s inter-state plea against the Russian Federation in the European Court of Human Rights. Furthermore, the leading human rights organizations in Ukraine created a coalition for documenting war crimes called Ukraine. Five in the Morning. The coalition works with the government while its lawyers process the information submitted by users through the chatbot. There is also a Ukrainian coalition of civil society organizations, Tribunal for Putin, which also documents facts containing the signs of crimes under the Rome Statute of International Criminal Court (genocide, crimes against humanity, war crimes). The Ukrainian government, with support from developers, took an active part in creating chatbots in order to counter the aggressor through collection of information from the Ukrainian citizens. The list of such chatbots includes: @stop_russian_war_bot created in the Security Service of Ukraine. With its help, users can report about troops and equipment of the occupiers, as well as about the RF sabotage and reconnaissance groups. @ukraine_avanger_bot created in the cyber-police for reporting about the discovered marks left by the occupiers for aiming shelling targets.
7
@evorog_bot created in the Ministry of Digital Transformation. With its help, users can report about movement of Russian equipment or occupiers, indicating their exact geolocation, as well as attaching photos and videos. @DzvinokDruguBot created in the team of businessperson Dmytro Dubilet. DzvinokDrugu (Call a Friend) bot allows you to call friends and relatives in Russia and Belarus to tell them the truth about the war in Ukraine.
Initiatives for Decentralization of Internet and Work in Conditions of External Internet Disconnection With the beginning of the full-scale Russian invasion of Ukraine, access to a stable and reliable Internet has become one of the critical issues both inside and outside Ukraine. Experience of attempts of authoritarian regimes to suppress online voices as in Belarus in 2020 and in Kazakhstan in 2021, did not provide optimistic forecasts about full-scale functioning of free Internet in Ukraine in the wartime conditions. Regions that were occupied by the enemy (such as Kherson Oblast) were the first to find themselves in the risk zone because of a potential disconnection from the Internet or the traffic routing redirection through the censored Russian servers. On February 24, 2022 a team of technical specialists with assistance of a Canadian company, eQualit.ie, opened access for the Ukrainian users to the encrypted Matrix chat servers based on the Element client working in providers’ local networks. The first servers started working in Kyiv, Kharkiv and Odesa, so hundreds of local users began to communicate with one another exchanging messages about the situation in cities and towns during the war, and keeping in touch with relatives through closed rooms. Subsequently, Mykolaiv, Kherson, Rivne, and Lviv joined the https://dcomm.net.ua/ server network. Meanwhile the number of offered decentralized Internet services increased to five, including Briar and Delta Chat messengers, CENO browser, and NewNode VPN. The key features of dComms services include maximum privacy protection (fully encrypted communications) and the possibility to be deployed on local servers to enable users to stay within the “limited” online in offline conditions and be in touch with the outside world. As of May 2022, the services had not become widespread, but were used as backup platforms for users since the beginning of 8
the Russian invasion. A significant number of global technology companies began to offer the opportunity for Ukrainian users to use their services for free or on an extended basis. First of all, we are talking about de-anonymization in the Internet, namely the use of VPN services: Tunnerbear offered 100 GB free traffic to users from Ukraine; Vpnunlimited provided a year of free use for Ukrainian users; ClearVPN became free in the territory of Ukraine. At the same time, participants of the Ukrainian Cyber-Alliance organization updated a free VPN-service based on the OpenVPN client for Ukrainian users. Internet disconnection and traffic re-routing became one of the acute problems in temporarily occupied regions, such as Kherson. From the first days of the Russian invasion, Kherson Oblast was under occupation, but for some time, Ukrainian operators and providers were able to ensure stable communication in the region. On April 30, the Internet from Ukrainian providers was completely disconnected in Kherson Oblast as the occupation troops damaged the infrastructure. Ukraine’s attempts to restore connection through communication equipment in Mykolaiv Oblast failed. At the same time, mobile communication was also disconnected in Kherson Oblast. Partial access to the Internet for residents of the region was restored after several hours, but the metrics showed that since the beginning of May, Internet traffic has been routed through Russia. The occupiers began implementing a plan to disconnect Kherson Oblast from the Ukrainian infrastructure and directed traffic through Russian infrastructure from the occupied Crimea. In its turn, this increased the risks of surveillance and censorship in the Internet by Russia. The routing was changed for one of the local providers, SkyNet. The SkyNet owner tried to justify routing through Russia by saying it was to ensure Kherson residents’ access to the Internet. Four days later, connection was temporarily restored, as the Ukrainian side was able to find a technological solution to restore it. However, on May 13 the Russian military seized premises of the Kherson-based provider, Status, disconnected the communication equipment and threatened to take it away for refusing to connect to the network in Russian-occupied Crimea. Connection with local servers was lost again.
9
Cooperation with Tech Giants during Wartime and Countering Disinformation Since the beginning of Russian aggression, major Internet giants such as Meta, Google, Twitter and Microsoft had different responses to the war-related challenges.
Meta In recent years, Meta has been actively studying the Ukrainian experience, interacting with various actors and researching such phenomena as disinformation and the use of algorithms for improper purposes, as well as catching coordinated inauthentic behavior. Apparently, such efforts were coordinated after the scandals with Cambridge Analytica over the Myanmar genocide. Even before the war, the company began to establish cooperation with local actors forming a network of so-called trusted partners and fact-checkers. Essentially, we are talking about cooperation with governmental agencies such as cyber police, which address the problems of child protection or combating suicides, as well as with civil society organizations. On March 27, 2020 two respected fact-checking organizations, StopFake and VoxCheck, became Facebook partners in combating disinformation and fighting violations of the community standards. A year before, CEDEM, one of the first Ukrainian CSOs, became a trusted partner. According to Facebook’s policy, the names and the number of partners are not disclosed, but since the beginning of the war, following recommendations of the existing partners, their number has increased. The principal benefit of such cooperation is receiving alerts about dangerous trends and local contexts, which allow for better tuning of artificial intellect or performing manual moderation. Such cooperation is especially important in the context of media protection and moderation of highly complex categories such as humor and satire. In addition to this, Meta actively blocked bot farms as a manifestation of inauthentic behavior. The most famous case was blocking of popular but at the same time absolutely non-transparent websites, Znaj and Politeka. On February 26, 2022 Meta announced creation of a special operations center, in which experts from the entire company work to monitor the platform around the clock. Already in March, the mechanism for foreigners to support international humanitarian organizations that provide assistance to Ukraine became operational. New blocks were added with current news from reliable mass media such as Public Broadcasting, Livyi Bereh [Left Bank], and others. In addition to 10
this, the “Block profile” function was introduced that disables access of people who are not “friends” in a person’s profile, which is especially important for people in the occupied territories. As to the Russian media, Meta added a flag that marks them as a government agency and so it was prohibited to promote them on Facebook. The most controversial story is still the one with blocking of posts for mentioning the Azov fighters. Users received warnings or blocks for a simple mention in the news, and with the beginning of the war — in the posts, of Azovstal defense. The reason for this may be a list unwanted actors leaked in the network (Facebook Dangerous Individuals and Organizations List), in which the Azov battalion (as well as its founder, Andrii Biletskyi) was mentioned as an organization spreading hatred. This blocking even was the subject of a discussion between Meta and the Ministry of Digital Transformation.
Google Google and its video hosting YouTube support Ukraine actively in its defense against Russian occupation. Well-known cases include blocking the mail and the channel of the State Duma of the Russian Federation, disclosure of the data on all Russian military facilities, blocking payments from the RF territory as well as channels of propagandist Solovyov and DPR leader Pushylin. Furthermore, YouTube deleted over 70, 000 channels that justify or support Russian aggression. On May 24, 2022 Head of the Ministry of Digital Transformation Mykhailo Fedorov announced that his agency together with the Ministry of Education and Science were able to come to an agreement on partnership with Google for Education, which envisages transfer of 43, 000 Chromebook laptops to Ukraine for teachers with support from UNESCO. Google also has a program of trusted partners, yet there is no publicly available information about the sphere of activities of this initiative. Yet, when users noticed suspicious marks, the company responded quite quickly and carried out investigations. Also, for the period of war the company prohibited maps editing. Similarly, non-governmental organizations can send complaints to working contacts, and these are promptly considered. At the same time, Ukrainian YouTube bloggers complain that they have problems with the video hosting because of the use of epithets for the occupiers. Facebook also has a similar problem.
Twitter Twitter, like other platforms, announced its activities. Already since 2020, Twitter has been flagging Russian state-owned media refusing to promote them on its platform. Since February 28, more than 280, 000 tweets were marked as ones linked to Russian information resources and having lower coverage. Similar to Meta, Twitter deletes disinformation. In addition to this, Twitter promotes news about Ukraine in its streams.
11
Microsoft With the beginning of the war, Microsoft suspended its activities in Russia and offered free use of its cloud services for Ukrainian users until the end of 2022. Furthermore, the Ukrainian government plans to cooperate with Microsoft on documenting the war crimes of the Russian Federation. In early April, the company announced that it had prevented a hacker attack on government institutions. The work of large technology platforms is visible and useful. At the same time, in the conditions of war in Ukraine, any blocking, even for 24 hours, can have a high price — from a failure to receive information in a timely manner to the death of a human being; from impossibility to present accurate and important information for the threatened communities to a chilling effect on freedom of speech and pushing users toward freer but non-transparent platforms like Telegram. Developing the rules for sharing and moderating content under the conditions of warfare, especially defensive war, is a necessary step to balance interests of the platform and preserve healthy environment, protect interests of the people in the attacked country, as well as freedom of speech.
12