News

A month into the Russian invasion, Ukraine is still mostly online

A month into the Russian invasion of Ukraine, the country’s internet is still largely online thanks to its diverse telecommunications ecosystem and frontline technicians braving a warzone to keep Ukraine connected. 

“There’s definitely been lots of outages and damages to the internet of Ukraine, but for the most part the country’s online and that’s been an important aspect of the conflict,” said Doug Madory, director of internet analysis at Kentik. 

The robust telecommunications ecosystem, combined with those worker’s efforts, have helped many Ukrainians share the devastation rocking their country with the world. 

“The good thing is that when we chose how to cover the country with a fixed internet, we decided to make a free market where small providers can compete with each other,”

Mykhailo Fedorov, the Ukrainian Minister of Digital Transformation, told Forbes

The country features more than 5,000 internet providers, though only 100 are particularly active, according to Fedorov.  

“Therefore, there will be no situation when the enemies will seize one provider, cutting off the whole country from the internet. Decentralization saves us,” he said.

Despite some early fears about Ukraine’s capacity to keep itself online, the country has been able to stay connected while also appearing to combat cyberattacks related to the onslaught. 

Global traffic patterns over the past month show mostly limited localized outages even as Russian bombs rained from above for weeks — and technicians worked to repair disrupted networks. 

Some cyberattacks on such infrastructure have also been reported, including at local broadband provider Triolan and satellite provider Viasat, while the expansion of the Starlink satellite amidst the conflict may come with its own set of physical risks. 

But so far, efforts to keep Ukraine online have worked, allowing the world to see the gruesome results of attacks on civilian targets and Ukrainian President Volodymyr Zelenskyy’s digital diplomacy overtures. 

“I am proud of our telecommunications sector — it is a separate front, people are dying there, but they are working to keep Ukraine connected,”  Fedorov said. 

“Invisible heroes”

Technicians on the frontline are heading into recently bombed-out buildings to repair or upgrade digitial infrastructure to keep the country online.

Ukraine’s State Service of Special Communications and Information Protection described them as “invisible heroes” of the conflict. 

“That shit is heroic,” agreed Riana Pfefferkorn, a research scholar at the Stanford Internet Observatory.

“The images you see of people out there in war-torn, bombed-out zones, trying to get the internet back online are just incredible,” she added. 

Their efforts also appear to show up in data being watched by people like Madory. “Things go down, and then a few hours later they come back,” he noted. 

Thousands of workers at the local telecom company Veon are living out of bomb shelters as the conflict continues, the company’s CEO told Reuters, helping move around equipment to border areas to support refugees. 

Kyiv authorities started to set up Wi-Fi in bomb shelters on March 12, and fixed broadband has since become a feature of many shelters — helping those hiding from bombardments stay connected. Hundreds of such shelters have been wired by major local providers including Kyivstar, Volia and Tenet, Developing Telecoms reported. 

Only three operators control the cellular telecom market in Ukraine: Kyivstar, with over 26 million active users, Vodafone Ukraine, with 20 million, and lifecell, with roughly 8 million users.

Although major rivals during peacetime, the companies came together amid the war to keep Ukrainians connected with a “national roaming” program that means subscribers could quickly switch to the network of other operators if their main provider went down.

But local networks have also faced attacks on the digital front. Triolan, a major Ukrainian internet service provider, was hacked twice – on Feb. 24 and March 9.

Some of Triolan’s internal computers stopped working because the attackers reset devices to factory settings. Restoring the computer systems was difficult because in some cases the technicians needed physical access to servers, which was not possible due to the hostilities in Kharkiv.

Triolan said that “key nodes of the network” had been hacked on Feb. 24 and that some routers couldn’t be recovered. Triolan is based in Kharkiv, which has been severely bombarded by Russians.

Ukrainian internet service provider and monopolist telephone company Ukrtelekom suffered a distributed denial-of-service attack on March 22. The company managed to repel the attack quickly and operations weren’t significantly disrupted.

Another small provider — Vinasterisk — had been targeted by hackers and suffered significant downtime earlier this month, according to internet monitoring firm NetBlocks.

Source: Vitaly Sedler/Facebook, CEO of Intellias, President at IТ Ukraine Association

Looking to the stars

Satellite internet service providers have also played a central role in the conflict in Ukraine. On February 24, a cyberattack against satellite provider Viasat disabled the modems of many European customers, including Ukrainian military and police units. 

Elon Musk’s Starlink has also made significant inroads in Ukraine during the conflict. 

“One of our priorities before the invasion was a stable Internet connection, so we turned to Elon Musk for Starlink,” Fedorov recently told Forbes, adding that they had a meeting with the company to provide licenses to get the service operation the day before the invasion.

“Apart from terminals, we received solar panels from Elon Musk to charge Starlink, as well as equipment that helps satellites to work with different networks,” Fedorov added. 

Who can use Starlink in Ukraine:
Critical infrastructure (like hospitals)
State railway Ukrzaliznytsia
Ukrainian troops
Ukraine’s largest state-owned bank PrivatBank
Local authorities
IT companies (they said Fedorov helped them to receive the terminals)

However, using satellite Internet service in a conflict zone may come with its own set of risks. 

“Even a few moments of use is enough for Russian electronic intelligence systems to triangulate a ground station for airstrike,” Josh Lospinoso, the CEO of cybersecurity firm Shift5 and a former officer in the US Army Cyber Command told Vox.

Musk confirmed that Starlink signals could be tracked by Russians and tweeted that Ukrainians should use them “with caution.”

“There are no such warnings from the relevant Ukrainian security authorities,” Fedorov told Forbes, adding that there are too many terminals in the country for them to be reasonably targeted. 

“Everything could always change today or tomorrow”

A review of data provided by Kentik reflected apparent regional outages or disruptions to online access largely along areas facing fierce bombardment throughout the early weeks of the invasion. 

More about Ukraine’s Internet infrastructure

One of Fedorov’s goals when he came to the government was to provide Internet access for 95% of the population. In 2019, almost 70% of Ukraine was covered with high-speed internet.

In 2021, more than 2,500 villages were connected to high-speed internet. People see the difference — it used to be difficult to even listen to songs on Spotify in the suburbs of Kyiv, but now the Internet is powerful enough to watch Netflix even in villages.

Trains had notoriously bad internet. There was no point in paying with a card in the buffet, because the transaction took 30 minutes to process due to poor internet.

Ukraine doesn’t officially disclose how many terminals it has, but a source told The Washington Post that over 5,000 Starlink terminals are active in Ukraine.

But even as online access appears fairly robust for many Ukrainians, some areas have had extended outages — including the city of Mariupol that has largely been without internet access for weeks.

Mariupol, an industrial port city in the east of the country, has been under siege by Russian forces for three weeks and the city continues to come under bombardment.

On March 17, Russian bombs flattened Mariupol’s Drama Theater, where hundreds of people had been sheltering. The word “children” spelled out on two sides of the theater didn’t stop Russian forces from destroying it.

The city appears to have been offline since March 2, according to Madory. 

Outages also have continued at the sites of fighting in recent days, including a five-hour outage in Zhytomyr, west of Kyiv. 

Networks still look stable, for now, but there’s no guarantee there won’t be further efforts to undermine online communications as the invasion continues, according to Madory. 

“Everything could always change today or tomorrow,” Madory said. 

Daryna Antoniuk & Andrea Peterson

Daryna Antoniuk is a reporter at Forbes Ukraine. She’s a former tech journalist at the Kyiv Post, and studies journalism and communications at Taras Shevchenko National University in Kyiv. She covers cybersecurity, investment and the technology industry in Eastern Europe. Andrea Peterson (they/them) is senior policy correspondent at The Record and a longtime cybersecurity journalist who cut their teeth covering technology policy ThinkProgress (RIP), then The Washington Post from 2013 through 2016, before doing deep dive public records investigations at the Project on Government Oversight and American Oversight. Their work has also been published at Slate, Politico, The Daily Beast, Ars Technica, Protocol, and other outlets. Peterson also produces independent creative projects under their Plain Great Productions brand and can generally be found online as kansasalps.

Recent Posts

Chinese cyber agency signals support for tech industry

CAC officials set a conciliatory tone towards tech Friday, but are still supervising rides-hailing giant’s…

3 hours ago

Apple releases emergency patch for two iPhone, Mac zero-day vulnerabilities being exploited

Apple said hackers are actively exploiting two zero-day vulnerabilities in iPhones, iPads and Macs. In…

3 hours ago

Google says it stopped the largest DDoS attack ever recorded in June

One of Google’s customers was targeted with the largest distributed denial of service (DDoS) attack…

4 hours ago

European Commission’s Despina Spanou on why cyber officials must ‘learn lessons from crises’

When it comes to privacy and cybersecurity regulations, the European Union often sets the standards…

5 hours ago

Cyber insurers weigh in on latest cybersecurity trends, threats

The numbers speak for themselves: more companies are opting in for cyber insurance coverage than…

1 day ago

TikTok asks House of Representatives to rescind cyber advisory about company

Short-form video giant TikTok refuted claims made by the Chief Administrative Officer (CAO) of the…

1 day ago