![](\"https:\/\/media.wired.com\/photos\/62a943d8c5ef5252e52865d7\/master\/pass\/Russia-Controlling-Ukraine-Internet-Security-GettyImages-1239081296.jpg\"\/)
<\/p>\n<\/p>\n
Credit to Author: Matt Burgess| Date: Wed, 15 Jun 2022 11:00:00 +0000<\/strong><\/p>\n Matt Burgess<\/a><\/span><\/span><\/p>\n To revist this article, visit My Profile, then View saved stories<\/a>.<\/p>\n To revist this article, visit My Profile, then View saved stories<\/a>.<\/p>\n Web pages in<\/span> the city of Kherson in south Ukraine stopped loading on people\u2019s devices at 2:43 pm on May 30. For the next 59 minutes, anyone connecting to the internet with KhersonTelecom, known locally as SkyNet, couldn\u2019t call loved ones, find out the latest news, or upload images to Instagram. They were stuck in a communications blackout. When web pages started stuttering back to life at 3:42 pm, everything appeared to be normal. But behind the scenes everything had changed: Now all internet traffic was passing through a Russian provider and Vladimir Putin\u2019s powerful online censorship machine.<\/p>\n Since the end of May, the 280,000 people living in the occupied port city and its surrounding areas have faced constant online disruptions<\/a> as internet service providers are forced to reroute their connections through Russian infrastructure. Multiple Ukrainian ISPs are now forced to switch their services to Russian providers and expose their customers to the country\u2019s vast surveillance and censorship network, according to senior Ukrainian officials and technical analysis viewed by WIRED.<\/p>\n The internet companies have been told to reroute connections under the watchful eye of Russian occupying forces or shut down their connections entirely, officials say. In addition, new unbranded mobile phone SIM cards using Russian numbers are being circulated in the region, further pushing people towards Russian networks. Grabbing control of the servers, cables, and cell phone towers\u2014all classed as critical infrastructure\u2014which allow people to freely access the web is considered one of the first steps in the \u201cRussification\u201d of occupied areas.<\/p>\n \u201cWe understand this is a gross violation of human rights,\u201d Victor Zohora, the deputy head of Ukraine\u2019s cybersecurity agency, known as the State Services for Special Communication and Information Protection (SSSCIP), tells WIRED. \u201cSince all traffic will be controlled by Russian special services, it will be monitored, and Russian invaders will restrict the access to information resources that share true information.\u201d<\/p>\n KhersonTelecom first switched<\/span> its internet traffic to a Russian network on April 30, before flipping back to Ukrainian connections for the majority of May. However, things appear to have shifted permanently since May 30. All of KhersonTelecom\u2019s traffic is now being routed through Miranda Media, a Crimea-based company that\u2019s itself connected to Russian national telecom provider Rostelecom<\/a>. (Miranda Media was set up after Putin annexed Crimea in 2014<\/a>). The day after KhersonTelecom made its latest switch, state-controlled Russian media outlet RIA Novosti claimed<\/a> the Kherson and Zaporizhzhia areas were officially being moved to Russian internet connections\u2014days earlier, the outlet said<\/a> the regions were also going to start using the Russian telephone code +7.<\/p>\n Zohora says that across occupied regions of Ukraine\u2014including Kherson, Luhansk, Donetsk, and Zaporizhzhia\u2014there is a patchwork of around 1,200 different ISPs. \u201cWe understand that most of them are forced to connect to Russian telecom infrastructure and reroute traffic,\u201d Zohora tells WIRED. \u201cUnfortunately, there are cases of massive routing of traffic of Ukrainian operators across Russian channels,\u201d says Liliia Malon, the commissioner of Ukraine\u2019s telecom regulator, the National Commission for the State Regulation of Electronic Communications. \u201cUkrainian networks are partially blocked or completely disconnected.\u201d<\/p>\n Technical analysis confirms that the connections are switching. Internet monitoring company Cloudflare has observed<\/a> KhersonTelecom\u2019s traffic passing through Miranda Media for more than two weeks in June. Doug Madory, director of internet analysis at monitoring firm Kentik, has observed around half a dozen networks in Kherson connecting to the provider. \u201cIt's not a one-time thing,\u201d Madory says. \u201cEvery couple of days, there's another company getting switched over to Russian transit from Ukraine.\u201d<\/p>\n Since the start of Putin\u2019s war in February, disrupting or disabling internet infrastructure has been a common tactic\u2014controlling the flow of information is a powerful weapon. Russian missiles have destroyed TV towers<\/a>, a cyberattack against a satellite system had knock-on impacts across Europe<\/a>, and disinformation has tried to break Ukrainian spirits. Despite frequent internet blackouts, Ukraine\u2019s rich ecosystem of internet companies<\/a> has rallied to keep people online. While Ukrainian troops are successfully launching counterattacks<\/a> against Russian occupation in the south of the country, Kherson remains controlled by invading forces. (In March, it became the first major city to fall into Russian hands, and its residents have lived under occupation for around 100 days, reporting numerous incidents of torture<\/a>.)<\/p>\n \u201cIt's one thing to take over a city and to control the supply lines into the city, the flow of food or fuel,\u201d says David Belson, head of data insight at Cloudflare, who has written about internet control in Kherson<\/a>. But, he says, \u201ccontrolling internet access and being able to manipulate the internet access into an occupied area\u201d is a \u201cnew front\u201d in the conflict.<\/p>\n There are multiple ways Russian forces are taking over internet systems. First, there is physical access\u2014troops are seizing equipment. Spokespeople for two of Ukraine\u2019s biggest internet providers, Kyivstar and Lifecell, say their equipment in Kherson was switched off by Russian occupying forces, and they don\u2019t have any access to restore or repair equipment. (Throughout the war, internet engineers have been working amid shelling and attacks to repair damaged equipment<\/a>). The SSSCIP says 20 percent of telecommunications infrastructure across the whole of Ukraine has been damaged or destroyed, and tens of thousands of kilometers of fiber networks are not functioning.<\/p>\n Once Russian forces have control of the equipment, they tell Ukrainian staff to reconfigure the networks to Miranda Media, Zohora says. \u201cIn case the local employees of these ISPs are not willing to help them with the reconfiguration, they are able to do it by themselves,\u201d Zohora says. The SSSCIP, he adds, has advised staff not to risk their own lives or the lives of their families. \u201cWe hope that we are able to liberate these lands soon and this temporary period of blackmailing of these operators will pass off,\u201d Zohora says, adding it is unlikely that communications in the region can be restored before the areas are liberated.<\/p>\n For the time being, at the very least, this means connections will be routed through Russia. When Gudz Dmitry Alexandrovich, the owner of KhersonTelecom, switched his connection to Miranda Media for the first time at the start of May, he claims some customers thanked him because he was getting people online, while others chastised him for connecting to the Russian service. \u201cOn May 30 again, like on April 30, everything absolutely everything fell and only Miranda's channels work,\u201d Alexandrovich says in a translated online chat. In a long Facebook post<\/a> published on the company\u2019s page at the start of May, he claimed he wanted to help people and shared photos of crowds gathering outside KhersonTelecom\u2019s office to connect to the Wi-Fi.<\/p>\n Russia is also trying to control mobile connections. In recent weeks, a mysterious new mobile company has popped up in Kherson. Images show blank SIM cards\u2014totally white with no branding<\/a>\u2014being sold. Little is known about the SIM cards; however, the mobile network appears to use the Russian +7 prefix at the start of a number. Videos reportedly<\/a> show crowds of citizens gathering to collect the SIM cards. \u201cThe Russian forces realize they're at a disadvantage if they keep using Ukrainian mobile networks,\u201d says Cathal Mc Daid, the chief technology officer at mobile security company AdaptiveMobile. The company has seen two separatist mobile operators in Donetsk and Luhansk<\/a> expanding the territory they are covering to newly occupied areas.<\/p>\n Who controls the<\/span> internet matters. While most countries place only limited restrictions on the websites people can view, a handful of authoritarian nations\u2014including China<\/a>, North Korea<\/a>, and Russia, severely limit what people can access.<\/p>\n Russia has a vast system of internet censorship and surveillance<\/a>, which has been growing in recent years as the country tries to implement a sovereign internet project that cuts it off from the rest of the world<\/a>. The country\u2019s System for Operative Investigative Activities, or SORM<\/a>, can be used to read people\u2019s emails, intercept text messages, and surveil other communications.<\/p>\n \u201cRussian networks are fully controlled by the Russian authorities,\u201d Malon, the Ukrainian telecom regulator, says. The rerouting of the internet in occupied Ukrainian areas, Malon says, has the goal of spreading \u201cKremlin propaganda\u201d and making people believe Ukrainian forces have abandoned them. \u201cThey are afraid that the news about the progress of the Ukrainian army will encourage resistance in the Kherson region and facilitate real activities,\u201d Zohora says.<\/p>\n Geoffrey Cain<\/span><\/span><\/p>\n Morgan Meaker<\/span><\/span><\/p>\n Lukasz Olejnik<\/span><\/span><\/p>\n At the heart of the rerouting is Miranda Media, the operator in Crimea that appeared following the region\u2019s annexation in 2014<\/a>. Among \u201cpartners\u201d listed on its website are<\/a> the Russian security service known as the FSB and the Russian Ministry of Defense. The company did not respond to a request for comment.<\/p>\n In many ways, Crimea may act as an example of what happens next in newly occupied areas. \u201cOnly in 2017, Crimea was completely disconnected from Ukrainian traffic. And now, as far as I know, it's only Russian traffic there,\u201d says Ksenia Ermoshina, an assistant research professor at the Center for Internet and Society and an affiliated researcher at the Citizen Lab. In January last year, Ermoshina and colleagues published research<\/a> on how Russia has taken control of Crimea\u2019s internet infrastructure.<\/p>\n After it annexed Crimea in 2014, Russian authorities created two new internet cables running along the Kerch Strait, where they connect with Russia. This process took three years to complete\u2014something Ermoshina calls a \u201csoft substitution model,\u201d with connections transferring slowly over time. Since then, Russia has developed more advanced internet control systems. \u201cThe power of the Russian censorship machine changed in between [2014 and 2022],\u201d Ermoshina says. \u201cWhat I'm afraid of is the strength of Russian propaganda.\u201d<\/p>\n It\u2019s likely that rerouting the internet in Kherson and the surrounding areas is seen by Russian authorities as a key step in trying to legitimize the occupation, says Olena Lennon, a Ukrainian political science and national security adjunct professor at the University of New Haven. The moves could also be a blueprint for future conflicts.<\/p>\n Alongside internet rerouting in Kherson and other regions, Russian officials have started handing out Russian passports<\/a>. Officials claim<\/a> a Russian bank will soon open in Kherson. And the region has been moved to Moscow\u2019s time zone<\/a> by occupying forces. Many of the steps echo what previously happened in Crimea, Donetsk, and Luhansk. \u201cRussia is making it clear that they're there for a long haul,\u201d Lennon says, and controlling the internet is core to that. \u201cThey're making plans for a long-term occupation.\u201d<\/p>\n