Act’s description and legal basis
When the full-scale invasion of Ukraine commenced on 24 February 2022 and martial law was imposed, all the providers of electronic communication networks were demanded to immediately block all the autonomous systems (ASs) used by the Russian Federation for cyberattacks by the Letter of the NCON – an authority specially designated to regulate electronic communications during wartime. In total, 642 autonomous systems were blocked by the Letter.
The legal basis of the NCON’s powers to issue such orders during the martial law period was primarily contained in the Order of the Cabinet of Ministers No 812 “Some Issues of Operational and Technical Management of Telecommunication Networks During Emergency Situations and Martial Law” issued under the provisions of the Law of Ukraine “On the Legal Regime of Martial Law”. Within its competence, the NCON is empowered to issue orders on managing telecommunication networks that are mandatory for providers. The scope of such orders is unspecified.
In case of non-compliance with the rules, the National Commission for State Regulation in the Fields of Electronic Communications, Radio Frequency Spectrum and the Provision of Postal Services (the NCEC), being the supervisory authority, can impose a fine in the amount of 1700-5100 UAH (42-127 EUR as of March 2023) for each violation under the provisions of the Code of Ukraine on Administrative Offences. The Law of Ukraine “On Electronic Communications” did not contain any sanctions at the time of the Letter’s issue.
Consequences
Since the commencement of the full-scale invasion of Ukraine, the NCON issued only one additional order regarding ASs, where it required providers to block two ASs, although not specifying the reasons for such blocking. Some orders also asked the providers to deblock certain ASs: for example, on 6 May 2022, the NCON ordered to deblock AS52000. Notably, when issuing such orders, the NCON did not substantiate its decisions by any specific legal provisions apart from the reference to martial law and simply obliged providers to comply.
The NCON’s discretion in issuing orders during wartime remains rather broad. There had been, however, legislative attempts to specify the NCON functions. The Law of Ukraine “On the Amendments to the Law of Ukraine “On Electronic Communications” Regarding the Improvement of the Efficiency of the Organization of the Work of Providers of Electronic Communication Networks and/or Services During Martial Law”, adopted on 3 May 2022, has strengthened the legal basis for the NCON’s competence in this respect.
This Law authorizes the NCON to directly issue binding orders regarding the operational-technical management of electronic communication networks, which was previously established only on sub-legislative level. The subject matter of such orders remains unspecified anywhere on the legislative or sub-legislative level. In terms of providers’ liability, according to the latest amendments, failure to comply with the order of the NCON can additionally lead to the exclusion of providers from the Registry of Telecommunications Providers and Operators by the NCEC after the promulgation by the Cabinet of Ministers. It can be appealed in the administrative courts. After such a decision, the providers lose the possibility to re-register for one year. This sanction can be acceptable and proportionate during martial law.
One area of possible improvement for the NCON is its transparency. While its decisions clearly reach the affected subjects (Internet access providers), civil society organizations and the general public would benefit from the possibility of conveniently accessing the NCON’s decisions which do not contain classified information. At present, only some of them are published on the outdated website of the NCEC. This transparency will be crucial for conducting civic control over lifting the wartime restrictions after the cancellation of the martial law regime.