|
technicians|starlink-dude-ukraine

A month into the Russian invasion, Ukraine is still mostly online

A month into the Russian invasion of Ukraine, the country’s internet is still largely online thanks to its diverse telecommunications ecosystem and frontline technicians braving a warzone to keep Ukraine connected. 

“There’s definitely been lots of outages and damages to the internet of Ukraine, but for the most part the country’s online and that’s been an important aspect of the conflict,” said Doug Madory, director of internet analysis at Kentik. 

The robust telecommunications ecosystem, combined with those worker’s efforts, have helped many Ukrainians share the devastation rocking their country with the world. 

“The good thing is that when we chose how to cover the country with a fixed internet, we decided to make a free market where small providers can compete with each other,”

Mykhailo Fedorov, the Ukrainian Minister of Digital Transformation, told Forbes. 

The country features more than 5,000 internet providers, though only 100 are particularly active, according to Fedorov.  

“Therefore, there will be no situation when the enemies will seize one provider, cutting off the whole country from the internet. Decentralization saves us,” he said.

Despite some early fears about Ukraine’s capacity to keep itself online, the country has been able to stay connected while also appearing to combat cyberattacks related to the onslaught. 

Global traffic patterns over the past month show mostly limited localized outages even as Russian bombs rained from above for weeks — and technicians worked to repair disrupted networks. 

Some cyberattacks on such infrastructure have also been reported, including at local broadband provider Triolan and satellite provider Viasat, while the expansion of the Starlink satellite amidst the conflict may come with its own set of physical risks. 

But so far, efforts to keep Ukraine online have worked, allowing the world to see the gruesome results of attacks on civilian targets and Ukrainian President Volodymyr Zelenskyy’s digital diplomacy overtures. 

“I am proud of our telecommunications sector — it is a separate front, people are dying there, but they are working to keep Ukraine connected,”  Fedorov said. 

“Invisible heroes”

Technicians on the frontline are heading into recently bombed-out buildings to repair or upgrade digitial infrastructure to keep the country online.

Ukraine’s State Service of Special Communications and Information Protection described them as “invisible heroes” of the conflict. 

“That shit is heroic,” agreed Riana Pfefferkorn, a research scholar at the Stanford Internet Observatory.

“The images you see of people out there in war-torn, bombed-out zones, trying to get the internet back online are just incredible,” she added. 

Their efforts also appear to show up in data being watched by people like Madory. “Things go down, and then a few hours later they come back,” he noted. 

Thousands of workers at the local telecom company Veon are living out of bomb shelters as the conflict continues, the company’s CEO told Reuters, helping move around equipment to border areas to support refugees. 

Kyiv authorities started to set up Wi-Fi in bomb shelters on March 12, and fixed broadband has since become a feature of many shelters — helping those hiding from bombardments stay connected. Hundreds of such shelters have been wired by major local providers including Kyivstar, Volia and Tenet, Developing Telecoms reported. 

Only three operators control the cellular telecom market in Ukraine: Kyivstar, with over 26 million active users, Vodafone Ukraine, with 20 million, and lifecell, with roughly 8 million users.

Although major rivals during peacetime, the companies came together amid the war to keep Ukrainians connected with a “national roaming” program that means subscribers could quickly switch to the network of other operators if their main provider went down.

But local networks have also faced attacks on the digital front. Triolan, a major Ukrainian internet service provider, was hacked twice – on Feb. 24 and March 9.

Some of Triolan's internal computers stopped working because the attackers reset devices to factory settings. Restoring the computer systems was difficult because in some cases the technicians needed physical access to servers, which was not possible due to the hostilities in Kharkiv.

Triolan said that “key nodes of the network” had been hacked on Feb. 24 and that some routers couldn’t be recovered. Triolan is based in Kharkiv, which has been severely bombarded by Russians.

Ukrainian internet service provider and monopolist telephone company Ukrtelekom suffered a distributed denial-of-service attack on March 22. The company managed to repel the attack quickly and operations weren’t significantly disrupted.

Another small provider — Vinasterisk — had been targeted by hackers and suffered significant downtime earlier this month, according to internet monitoring firm NetBlocks.

Source: Vitaly Sedler/Facebook, CEO of Intellias, President at IТ Ukraine Association

Looking to the stars

Satellite internet service providers have also played a central role in the conflict in Ukraine. On February 24, a cyberattack against satellite provider Viasat disabled the modems of many European customers, including Ukrainian military and police units. 

Elon Musk’s Starlink has also made significant inroads in Ukraine during the conflict. 

“One of our priorities before the invasion was a stable Internet connection, so we turned to Elon Musk for Starlink,” Fedorov recently told Forbes, adding that they had a meeting with the company to provide licenses to get the service operation the day before the invasion.

“Apart from terminals, we received solar panels from Elon Musk to charge Starlink, as well as equipment that helps satellites to work with different networks,” Fedorov added. 

Who can use Starlink in Ukraine:
Critical infrastructure (like hospitals)
State railway Ukrzaliznytsia
Ukrainian troops
Ukraine’s largest state-owned bank PrivatBank
Local authorities
IT companies (they said Fedorov helped them to receive the terminals)

However, using satellite Internet service in a conflict zone may come with its own set of risks. 

“Even a few moments of use is enough for Russian electronic intelligence systems to triangulate a ground station for airstrike,” Josh Lospinoso, the CEO of cybersecurity firm Shift5 and a former officer in the US Army Cyber Command told Vox.

Musk confirmed that Starlink signals could be tracked by Russians and tweeted that Ukrainians should use them “with caution.”

“There are no such warnings from the relevant Ukrainian security authorities,” Fedorov told Forbes, adding that there are too many terminals in the country for them to be reasonably targeted. 

“Everything could always change today or tomorrow”

A review of data provided by Kentik reflected apparent regional outages or disruptions to online access largely along areas facing fierce bombardment throughout the early weeks of the invasion. 

More about Ukraine’s Internet infrastructure

One of Fedorov’s goals when he came to the government was to provide Internet access for 95% of the population. In 2019, almost 70% of Ukraine was covered with high-speed internet.

In 2021, more than 2,500 villages were connected to high-speed internet. People see the difference — it used to be difficult to even listen to songs on Spotify in the suburbs of Kyiv, but now the Internet is powerful enough to watch Netflix even in villages.

Trains had notoriously bad internet. There was no point in paying with a card in the buffet, because the transaction took 30 minutes to process due to poor internet.

Ukraine doesn’t officially disclose how many terminals it has, but a source told The Washington Post that over 5,000 Starlink terminals are active in Ukraine.

But even as online access appears fairly robust for many Ukrainians, some areas have had extended outages — including the city of Mariupol that has largely been without internet access for weeks.

Mariupol, an industrial port city in the east of the country, has been under siege by Russian forces for three weeks and the city continues to come under bombardment.

On March 17, Russian bombs flattened Mariupol's Drama Theater, where hundreds of people had been sheltering. The word "children" spelled out on two sides of the theater didn’t stop Russian forces from destroying it.

The city appears to have been offline since March 2, according to Madory. 

Outages also have continued at the sites of fighting in recent days, including a five-hour outage in Zhytomyr, west of Kyiv. 

Networks still look stable, for now, but there’s no guarantee there won’t be further efforts to undermine online communications as the invasion continues, according to Madory. 

“Everything could always change today or tomorrow,” Madory said. 

Get more insights with the
Recorded Future
Intelligence Cloud.
Learn more.
Tags
No previous article
No new articles
Daryna Antoniuk

Daryna Antoniuk

is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.

Andrea Peterson

Andrea Peterson

(they/them) is a longtime cybersecurity journalist who cut their teeth covering technology policy at ThinkProgress (RIP) and The Washington Post before doing deep-dive public records investigations at the Project on Government Oversight and American Oversight.