Russian Digital Rights Violations in Ukraine

First published Aug 23, 2022. Last updated to include additional information on infrastructural damage and internet outages.

Internet Infrastructure Damage

Ukrainain internet has shrunk by at least 16% nationwide
Accessible IP addresses in Kherson have reduced by 81%, 59% in Donetsk and 56% in Luhansk since the invasion
17% of all network-connected devices previously detectable via internet scans appear to have been lost

Internet Outages

There have been as many as 276 internet disruptions in Ukraine of varying severity, totaling almost 19,000 hours
At least 45 severe outages lasting over 3,800 hours have affected the country
Kherson has suffered the longest period of the most severe outages, with almost 1,500 hours in total

Digital Censorship

13 digital censorship initiatives have occurred in the occupied regions, including the blocking of Google, YouTube and Viber
17 measures aimed at taking control of Ukrainian telecommunications infrastructure have occurred.

Digital Rights Violations in Ukraine

Russian forces have dramatically undermined the digital rights of Ukrainians since the beginning of the invasion on February 24.

The overwhelming majority of violations have occurred in the occupied regions, where the aggressors have restricted access to the internet, introduced digital censorship measures, and taken control of the telecommunications infrastructure.

The initiatives have stifled Ukrainians’ ability to access potentially life saving information, prevented friends and families from communicating, and created conditions in which Russian propaganda can go unchallenged.

Digital rights and internet governance are often overlooked during times of war. However, the measures recorded here may contribute to a further deterioration of conditions and could even work to prolong the conflict.

We’ve searched through hundreds of local news reports, international media investigations and used a range of technical tools to quantify the extent of Russia’s digital rights violations in Ukraine. The full list of initiatives can be found on this public spreadsheet.

To contribute additional digital rights violations for inclusion, please email samuel@privacy.co

Some measures, including Russia’s disinformation campaigns and cyber attacks, have been largely excluded from the report due to their diffused nature and near-constant use. However, reference to both has been made in relation to internet disruptions and digital censorship practices.

We will continue to monitor Russia’s digital rights violations in Ukraine and update this page on a regular basis.

Internet Infrastructure Damage

Since the start of the invasion, Ukraine’s internet infrastructure has faced sustained military attacks.

The deliberate destruction of physical infrastructure, intentional internet outages and the large scale movement of people has led to unstable and reduced connections throughout the country.

Analysis of multiple data sources indicates that Ukraine’s internet space has been reduced by 16-17% nationwide.

Data from the Internet Outage Detection & Analysis (IODA) project shows a 16% drop in the number of accessible /24 blocks of IP addresses in the country between January and the end of August. A /24 block is a network of 256 IP addresses.

IODA’s active probing measurement tests the status of networks by automatically attempting to connect to millions of these blocks of IP addresses globally. Since the invasion began, the number of responses received from Ukraine IPs has dropped by 16%, indicating that the networks are no longer online.

Regions where there has been sustained military activity have been considerably more affected than others. In Kherson, there has been a 81% reduction in the number of accessible blocks of IP addresses.

The chart below shows the deterioration of internet infrastructure in the three most affected oblasts in comparison with the national trend. Each data point is calculated as a percentage difference from the number of blocks of accessible IP addresses at the start of February 2022.

The following table shows the change in the number of accessible IP address blocks by region in Ukraine. It includes the top 15 regions by percentage of change.

These findings are supported by analysis of data from Shodan, which scans the internet and collects metadata about online devices, from web servers and wireless routers to webcams and CCTV cameras.

The number of devices in Ukraine found by Shodan has steadily been declining since 2018, largely because of the replacement of older technology with newer products that can’t be picked up by the search engine.

However, since the beginning of the war there has been a dramatic decline in identifiable internet-connected devices, particularly in the areas most heavily impacted by the war.

Japan’s Computer Emergency Response Team Coordination Center has indicated this is likely to have been caused by physical damage to the infrastructure.^[1]

Between January and August, the total number of devices in Ukraine visible to Shodan scans dropped by 17%.

The following table shows the top 5 autonomous systems and the change in the number of devices found on their networks between January and August. Results are ordered by the highest total number of results in January.

The following table shows the top 20 devices identified nationwide by Shodan from January to August 2022. They are ordered by highest number identified in January.

Some areas have been significantly more impacted than others by the conflict. In the occupied regions, internet access has become severely disrupted. Kherson, in particular, appears to be one of the areas most heavily affected.

Case Study: Kherson

On average, there were 81% fewer responsive blocks of IP addresses in Kherson by the end of August compared with the start of February
There were 63% fewer visible internet-connected devices in the region compared with in January
Major internet service provider Ukrtelnet saw a 97% drop in connected devices in the region, with 101 devices visible to Shodan in August compared with 3,910 in January
There was a 71% reduction in the number of visible Hikvision cameras in the region in the same period
83% of all visible Apache web servers in Kherson were absent by August

Internet Outages

With the widespread disruption to the internet’s physical infrastructure, internet outages have become common throughout the country.

Disruptions to internet connectivity have prevented people from communicating with family during the conflict, blocked access to vital information, and prevented access to healthcare and online banking.

Unlike government mandated internet shutdowns, many of these network disruptions have been caused by infrastructural damage, cyber attacks and forced takeovers.

“The first thing that an occupier does when they come to Ukrainian territory is cut off the networks”
Stas Prybytko, Ukraine Ministry of Digital Transformation^[2]

We analyzed data from the IODA platform to determine the impact of network disruptions in the country.

Our findings show there have been 276 disruptions of varying severity totaling almost 19,000 hours nationwide.

Internet Outages by Severity

Critical outage: 8 incidents, totalling 320 hours
Major outage: 37 instances, totalling 3,315 hours
Significant instability: 231 instances, totalling 15,007 hours

Where possible, each incident of internet disruption has been corroborated through analysis of local news reporting. In some instances, the restoration of internet access remains incomplete, meaning disrupted access in specific areas may last considerably longer than our estimates indicate.

Note that due to the nature of the IODA detection process, which errs on the side of caution when definitively identifying drops in its detection signals as confirmed internet outages, what we have classified above as periods of “significant instability” contains incidents that are in fact more severe (see our methodology for more detail). Our analysis of local news reports corroborates this.

The reverse is also true that, despite best efforts to carefully clean the data, a number of these incidents of unstable internet access may potentially be due to factors other than the conflict.

The following table shows a consolidated view of all incidents of internet disruption and outages detected in the Ukraine in the listed regions (oblasts) between Russia’s invasion of Ukraine on February 24 and September 13, 2022. The 15 most-affected oblasts are listed. For full details of all outages, visit the public datasheet.

Not all outages have been of equal severity. Some may have affected just parts of the networks, while others indicate a total restriction on access. Additionally, the IODA data analyzed relates primarily to fixed line connections. Many additional cellular networks are likely to have been disrupted, however comprehensive data is not currently captured by the platform.

The following table shows the oblasts in Ukraine most affected by internet outages and disruptions, grouped by severity of incident. “Critical” and “major” incidents are internet outages detected with high confidence.

Note that many incidents classified as “disrupted” are also often very serious incidents. Frequently, local media reports indicate that internet access was extremely limited, however these incidents have been detected with a lower rate of confidence and have been classified accordingly. For further details, see our methodology.

As well as internet connectivity issues, telephone networks have also been blocked and broadcasts of Ukrainian television channels have been restricted.

Mayor of Melitopol Ivan Fedorov explained the situation, saying: “For almost a week now, the telephone lines and mobile communications have been blocked, and there is no Internet either. This is done to plunge residents into an information vacuum.”^[3]

Within the information vacuum, disinformation can spread unchallenged. In fact, the disruptions have themselves become a topic of disinformation.

According to Ukraine’s Center for Countering Disinformation at the National Security Council, Russian forces have been claiming that the disruptions have been caused by Ukrainians because “people in the occupation began to tell their relatives and friends about “good Russian soldiers” who do not kill and rob, but help people.”^[4]

Internet Infrastructure Takeover

The harsh digital censorship measures implemented in the occupied regions have been enabled by the takeover of the telecommunications infrastructure in the region.

According to the commissioner of Ukraine’s digital infrastructure and services regulator, Liliia Malon, there are now over 700 Ukrainian service providers that are under Russian occupation.^[5]

Under Russian control, internet providers may be forced to restrict access, block specific websites and apps, and re-route user traffic to Russia, where the country’s sophisticated surveillance system can monitor the internet activity of citizens.

The practice was first seen following the 2014 invasion of Crimea when Russia built new internet infrastructure and co-opted existing telecommunications networks to block content and monitor internet activity.

Infrastructural Russification in Occupied Ukraine

April: Kherstelecom re-routed traffic via Russian networks from April. Connections switched back to Ukrainian networks for May, before returning to Russian internet infrastructure at the end of the month.
May: ISP Status raided by Russian forces, forced to redirect traffic via Russian-occupied Crimea
May: Russian outlets report ISPs in Zaporizhzhya had switched to Russian networks
June: WIRED report that Kyivstar and Lifecell’s equipment was disabled by Russian forces, enabling greater control of local telecom networks
July: Russian official tells interfax.ru that 85% of Kherson is now covered by Russian mobile networks

Ukrainians wanting to verify information about their internet connection should use tools such as an IP checker tool, which confirms details about their ISP and ASN. Running the traceroute command built into desktop operating systems, or via a ping tool mobile app, will also show if a connection is being rerouted via Russia.

The dramatic shifts in the internet infrastructure since the war have come at a significant cost. According to a local news report, Ukrtelecom, a major Ukrainian ISP, lost “control over the infrastructure in almost 900 settlements in Luhansk, Donetsk, Zaporozhye, Kharkiv and Kherson regions.”

The shift is thought to have lost the company an estimated $12M dollars, or UAH 450 million.^[6]

The use of network disruptions, digital censorship and infrastructural occupation practices all dramatically undermine citizens’ right to freedom of expression and access to information. If they continue unabated, they risk prolonging the conflict by establishing an information vacuum in which citizens can only access Russian propaganda.

By bringing an increasing number of Ukrainian citizens under the purvey of Russian surveillance, these initiatives could also be used to identify, track down, and ultimately silence opposition voices.

Digital Censorship

Even when internet connectivity is available, digital content is heavily restricted in large parts of the occupied regions.

Since the beginning of Russia’s invasion, the Kremlin has blocked almost 3,000 websites because of content directly related to the conflict.

In the occupied regions, these websites are also largely inaccessible because the occupying forces have taken over the telecommunication infrastructure and begun re-routing data via Moscow, giving them control over what can be accessed online.

As this trend continues, there is a risk vital Ukrainian resources will become completely inaccessible for those living in conflict zones and occupied regions.

As well as blocking access to Facebook, Twitter, and Instagram, 590 Ukrainian news websites have also been blocked in Russia.

Other vital sources of information blocked include:

ukr.net
pravda.com.ua
meta.ua
president.gov.ua
moz.gov.ua
kharkivoda.gov.ua
armyinform.com.ua
dpsu.gov.ua
ukraine.ua
u24.gov.ua

The blocking of online governmental resources, including the likes of the health ministry website, poses a significant threat to the welfare of Ukrainians living under Russian occupation.

In parts of the occupied regions, digital censorship is even harsher than in Russia.

Censorship in Occupied Ukraine

May: YouTube throttled in the so-called Luhansk People’s Republic and Donetsk People’s Republic
June: Online banking and local news outlets inaccessible in parts of Kherson after return of connectivity on some ISPs
June: Viber messenger blocked in Donetsk and Luhansk
July: Instagram and YouTube blocked in the occupied regions of Kherson
July: Google blocked in Kherson, Donetsk and Luhansk

To bypass the restrictions, Ukrainian government agencies have been encouraging people to download VPN apps.

In May, the Committee on Digital Transformation wrote: “We would like to inform you that Ukrainians in the temporarily occupied territories, which are connected to Russian networks, can use VPN services.”

They go on to warn against the use of VPN services operated from Russia and Belarus and recommend people check the reputation of the VPN provider, specifically whether they have been accused of selling user data.^[7]

In July, the local administration of Kherson warned that many VPN services were being blocked, mirroring the widespread blocks of VPN apps in Russia.^[8]

Methodology

We searched through hundreds of local news reports and international broadcasts to collate information on digital rights violations ocurring in Ukraine. We used translation services and VPN apps to access local Ukrainian news and official Russian media.

To investigate the impact of network disruptions we analyzed internet traffic data from IODA from each out of the country’s oblasts since February 2022.

For the purposes of this research, internet outages were classified as per the following criteria:

Critical internet outage: A drop below the warning threshold on two IODA signals, with at least one of them also dropping below the critical threshold.
Major internet outage: A drop below the warning threshold on two IODA signals.
Significant instability: A drop below the warning threshold on one IODA signal (Activity Probing/BGP only).

Incidents of less than one hour were excluded from the dataset, while incidents less than one hour apart were considered to be a single unique incident of internet disruption.

The “significant instability” category contains incidents which don’t meet IODA’s criteria for definition as an internet outage with the highest confidence. However the situation in Ukraine differs from that of the majority of regions suffering government-imposed internet shutdowns in that it is an international conflict zone. Our analysis of local news reports shows that many of these periods of “significant instability” align with episodes of notable disruption to internet access.

Conversely, this category may potentially contain drops in signals caused by other factors, such as anomalies in the detection system for example or expected fluctuations in the signals.

Data on internet connected devices in Ukraine was accessed via Shodan using the historical trends tool. Figures from January and August were compared to verify the difference.

The total figure was gathered through analysis of the results in the country which also contained AS information.

Additional data collection and analysis by Agata Michalak

The authors of all our investigations abide by the journalists’ code of conduct.

References

^{[1] https://blogs.jpcert.or.jp/en/2022/06/shodan-trends-ua.html ↩}

^{[2] https://www.nytimes.com/interactive/2022/08/09/technology/ukraine-internet-russia-censorship.html ↩}

^{[3] https://www.pravda.com.ua/rus/news/2022/04/1/7336268/ ↩}

^{[4] https://www.rada.gov.ua/news/razom/223350.html ↩}

^{[5] https://www.bloomberg.com/news/newsletters/2022-06-08/ukrainian-internet-is-focus-of-new-fight-after-russian-invasion ↩}

^{[6] https://dev.ua/ru/news/zbytky-450-mln-hrn-v-ukrtelekomi-rozpovily-pro-robotu-pid-chas-viiny-1658816715 ↩}

^{[7] https://www.rada.gov.ua/news/razom/223350.html ↩}

^{[8] https://khoda.gov.ua/іnformacіja-shhodo-situacії-na-hersonshhinі-stanom-23-07-22 ↩}

Main image: Smoke rises over military and civilian infrastructure in Lviv, Ukraine after missile strikes by the Russian army on April 18, 2022. Credit: Vladyslav Sodel / Alamy Stock Photo.