Internet became yet another battlefield in the war of words waged by Russia after 2014 against Ukraine. Considered an area of almost unrestricted freedom, the Worldwide Web was used to abuse and manipulate the debates around crucial political, social, and cultural issues. It also became a breeding ground for disseminating hate speech, incitement to violence, and propaganda for war under the moniker of free media. Despite the apparent threats emanating from the outlets using the Internet for illegal speech, until the recent adoption of the Law on Media, there were no mechanisms in the legislation to block websites outside the contexts of child pornography, unlicensed gambling, and copyright; the broad provisions in martial law legislation similarly provided such an opportunity. This did not prevent Ukrainian authorities from using other mechanisms, most notably sanctions. In this piece, we will describe how the situation with the website blocking changed after February 2022 and measure the old and newly adopted mechanisms against the current and emerging international standards in this area.
Website blocking and international law
Once again, the analysis of any restriction on free speech should be based on the assessment of whether a particular measure complies with the three-part test. Any interference with the freedom of expression, as stipulated by the ECHR and ICCPR, shall be prescribed by law, pursue a legitimate aim, and be necessary in a democratic society. This test also applies to situations when the States derogate from the provisions proscribing free speech in times of war: any restrictive measures must be strictly required by the exigencies of the situation and be consistent with the other obligations under international law.
Soft law comes in handy when it comes to blocking standards. In 2011, three documents were issued regarding the issue of website blocking. The first one, UN HRC’s General Comment No 34, envisioned that permissible restrictions should be content-specific, while generic bans on the operation of specific sites and systems are incompatible with international law.
The second one was UN Special Rapporteur Frank LaRue’s report on key trends and challenges to the right of all individuals to seek, receive and impart information and ideas of all kinds through the Internet. Therein, he opined that any determination on what content should be blocked must be undertaken by a competent judicial authority or a body which is independent of any political, commercial, or other unwarranted influences.
The third one, Special Rapporteurs’ Joint Declaration on Freedom of Expression and the Internet, proclaimed that mandatory blocking of entire websites, IP addresses, ports, network protocols or types of uses is an extreme measure which can only be justified in accordance with international standards, for example where necessary to protect children against sexual abuse. They reiterated their position in 2017’s Joint Declaration, further clarifying that such blocking can only be justified where it is provided by law and is necessary to protect a human right or other legitimate public interest, including in the sense that it is proportionate, there are no less intrusive alternative measures which would protect the interest and it respects minimum due process guarantees. Both Declarations also underlined that content filtering systems imposed by a government and not end-user controlled are not justifiable as a restriction on freedom of expression.
Soft law documents developed under the Council of Europe auspices are not as strict as the abovementioned ones. Recommendation CM/Rec(2016)5 of the Committee of Ministers on Internet freedom underlined the need to assess any blocking measures under the three-part test under Article 10 and allocated the users Article 6 rights to appeal any action restricting their ability to receive and impart information. In Recommendation CM/Rec(2014)6, the Committee of Ministers opined that filtering measures might be taken by State authorities only if the filtering concerns specific and clearly identifiable content, based on a decision on its illegality by a competent national authority which can be reviewed by an independent and impartial tribunal or regulatory body.
In interpreting Article 10 of the Convention in the context of website blocking, ECtHR predominantly focused on safeguards from abuse, such as the independent review of the imposed measures. In its four 2020 judgments against Russia (Vladimir Kharitonov, Bulgakov, Engels, OOO Flavus and Others), which concerned various types of blocking by Russian authorities, the Court underlined several essential requirements for analyzing whether such blocking is compliant with Article 10 standards:
- existence of procedural safeguards: the blocked website owners shall be notified about the measures’ application and provided with the opportunity to be heard regarding the grounds for blocking as a part of due process;
- pre-imposition assessment of effects of any blocking measures, giving due regard to the possibility of collateral blocking of lawful content;
- use of ECtHR case-law and the balancing of interests of website owners, users, and the state by the authorities imposing the blocking;
- clarity of categories of prohibited content that can cause the blocking;
- existence of a legal basis for any blocking measures employed and developed by the authorities (including the judiciary) in the national legislation;
- separate assessment of the content’s and the blocking measure’s lawfulness in accordance with the Court’s case-law.
It is interesting to note that the Court had mentioned the fact that some blockings were imposed not by an independent authority only in passing, which is broadly in line with the standards developed by the Council of Europe. In one later judgment, the Court additionally underlined that blocking new websites under the old order since these websites are the mirrors of the previously blocked ones contradicts Article 10 of the Convention. At the same time, neither the Court nor soft law documents commented on the issue of website blocking in times of war, concentrating on Internet shutdowns instead.
Blocking post-February 2022: a two-headed effort
On 24 February 2022, the President of Ukraine signed the decree introducing martial law in Ukraine, which the Parliament approved later the same day to answer the full-scale Russian invasion. By doing this, Ukraine officially derogated from its obligations under the ECHR and the ICCPR and introduced additional restrictions, which continue to be in force until the moment of this analysis preparation.
One of the measures interfering with the Internet freedom and introduced in February stemmed from the Law of Ukraine “On Legal Regime of Martial Law” – the imposition of special regime of operational and technical management of electronic communication networks. Such management is performed by the National Center for Operational Management of Electronic Communications Networks (NCON), a special body created for this regulatory purpose by the State Service of Special Communications and Protection of Information of Ukraine. NCON’s powers to issue orders binding for Internet service providers are continuously used to restrict access to certain websites under three separately employed mechanisms described below.
Another blocking instrument survived from the pre-February times. Since 15 May 2017, the day of the first such action, the President of Ukraine issued more than 20 decrees approving the decisions of the National Security and Defense Council of Ukraine (NSDC), imposing sanctions in the form of website blocking on various natural and legal persons on the basis of the Law of Ukraine “On Sanctions”. This practice continued during 2022-2023, both with the continuous blocking under the pre-February decrees, renovation of older sanctions imposed on different persons, and the new decrees introduced after the imposition of the legal regime of martial law.
Sanctioning done wrong
The Law of Ukraine “On Sanctions” was chronologically the first mechanism in Ukrainian history used for blocking websites en masse. It empowers the President of Ukraine to impose personal sanctions on foreign states, foreign legal persons, legal persons under the control of foreign legal or non-resident natural persons, foreign citizens, stateless persons, and subjects engaged in terrorist activities by approving the NSDC’s decisions. The legal grounds for sanctions’ imposition are:
- actions that create real and/or potential threats to the national interests, national security, sovereignty, and territorial integrity of Ukraine, promote terrorist activities, and/or violate the rights and freedoms of a person and a citizen, the interests of society and the state, lead to the occupation of the territory, expropriation or limitation of property rights, cause property damages, create obstacles to sustainable economic development, full exercise of rights and freedoms by citizens of Ukraine;
- resolutions of the General Assembly and the Security Council of the United Nations;
- decisions and regulations of the Council of the European Union;
- facts of violations of the Universal Declaration of Human Rights, the Charter of the United Nations.
The Law also provides a non-exhaustive list of sanctions that can be imposed on natural and legal persons on the condition that such sanctions comply with the sanctions’ imposition principles established by this Law. These principles are legality, transparency, objectivity, fitness for a purpose, and effectiveness. This provision of the law was used by the NSDC in 2017 to block major Russian online platforms by imposing the “prohibition for the Internet service providers to provide Internet users with access to resources/services/socially oriented resources”. As of May 2023, 750+ websites are blocked under various sanction decrees. The terms of sanctions’ imposition varied from 1 year to 3 years. Post-February 2022 decrees blocked certain websites for 5 and 10 years, while gambling resources were blocked for 50 years. In rare instances predating February 2022, some websites without any apparent logic behind the decision were blocked indefinitely, while the terms for blocking the others were not mentioned.
The blocked websites are predominantly the websites of Russian media and quasi-media, Russian authorities on the occupied territories of Ukraine, including Crimea, Russian online platforms, payment systems, and gambling services. At the same time, sanctions were also applied to Ukrainian natural persons and their online media, which shall only be possible if they are engaged in terrorist activities. Somehow comically, some sanctions have targeted social media pages and accounts, mentions (such as @stranaua), and even email addresses, and were also at least once imposed on the deceased persons, connecting the authorities on the occupied territories and their resources with the killed leader of the so-called “DPR” Aleksandr Zakharchenko.
Unilateral sanctions’ status under international law remains ill-defined, though the UN Special Rapporteur underlines that they have to be corroborated with the right to judicial review by the targeted parties, time-bound limitation of the measures, monitoring and review, and be reversible. While sanctions on most foreign legal entities and natural persons, whose websites were blocked under the Law of Ukraine “On Sanctions”, might have been considered as pursuing a legitimate aim of protecting national security even prior to the martial law, there are several critical flaws regarding the sanctions’ use for website blocking even despite Ukraine’s recent derogation. Since sanctions were imposed under the norm, which provided for the imposition of “other sanctions which comply with the sanctions’ imposition principles established by this Law”, they had to comply with the legality, transparency, and objectivity principles.
However, neither legislation nor other by-laws contained the possibility of blocking websites and social media pages that host illegal content for national security reasons prior to the Law of Ukraine “On Media” adoption, which provides the mechanism of blocking online media websites and some aggressor state services by the court or independent media regulator. Moreover, the decrees imposing these sanctions did not contain the necessary reasoning, which limited the possibility of appealing them in courts and, thus, deprived the potential applicants of significant procedural safeguards. This lack of reasoning automatically raised questions about whether blocking Ukrainian citizens’ web resources was legitimate and whether state authorities possessed credible evidence that targeted individuals were engaged in terrorist activities. Additionally, since one of the embodiments of the objectivity principle is the limitation of sanctions’ application to a certain time, imposing sanctions for indefinite periods or long terms, such as 10 and 50 years, effectively eliminated any possibility of their review. Lastly, both Presidents Poroshenko and Zelenskyi were unsystematic and inconsistent in using the sanctions: some were imposed for a limited term despite being previously blocked indefinitely, and sanctioning the deceased is uncomprehensive.
NCON: the new umpire
The legal regime of martial law brought a new player to the blocking game. NCON’s authority in this regard is based on the Laws of Ukraine “On Legal Regime of Martial Law” and “On Electronic Communications”. The latter was additionally amended in March 2022 to reflect the growing role of NCON and fill the gaps in legislation that was not fully prepared to govern the regulators’ activities during martial law. These acts and the by-laws adopted under their provisions vested NCON with authority to issue binding orders regarding the operational-technical management of electronic communication networks during the said legal regime. The subject matter of such orders remains unspecified anywhere on the legislative or sub-legislative level, leaving the regulator with broad discretion on the issue. In practice, NCON has so far used its powers in three areas:
- blocking of autonomous systems (ASs);
- blocking of websites;
- filtering of phishing domains.
The first measure was swiftly adopted on the first day of the invasion and demanded all the providers of electronic communication networks (essentially – Internet service providers (ISPs)) to immediately block 642 ASs used by the Russian Federation “for cyberattacks”. This effectively led to blocking the entire Russian Internet segment, which is proportionate enough considering the risks posed by existing information aggression and constant cyberattacks from the aggressor state. There is, however, anecdotal evidence that blocking ASs affected access to the websites from other countries (such as Kazakhstan and Uzbekistan) connected to the global Internet via Russian networks.
On that same day, NCON demanded that the ISPs block one Ukrainian online media domain name, citing the abovementioned legislation. In the upcoming days, the wartime regulator blocked several websites providing retransmission of the banned Russian TV channels and Russian online media. Further orders of NCON targeted phishing domains, alcohol and tobacco shops, and gambling websites, among others, though the reasoning was only seldom specified. Overall, during martial law, NCON issued more than 100 orders to block various domains, targeting more than 6000 websites. However, no evidence exists that any significant or socially important resources became inaccessible to Ukrainians.
The last of the three measures is the most recent: the system of phishing domain names filtering was introduced on 30 January 2023. It is specifically designed to combat fraud in financial and banking spheres and shall not apply to websites disseminating propaganda and disinformation, as follows from the order establishing the system. The system should reroute the user who attempts to accede the phishing link to a special landing page and shall preserve such user’s data, including IP address and user-agent data. The cybersecurity incident team of the National Bank of Ukraine is empowered to include or exclude the domain names from the list of prohibited domains. This team should also biannually publish the statistics on the system’s efficiency. The ISPs shall register with this system and comply with the filtering requirements. Internet Association of Ukraine raised concerns about the potential breaches of privacy and insufficient guarantees against using the filtering system for purposes other than preventing phishing, notwithstanding the direct norm prohibiting the system’s use for other purposes.
Given Ukraine’s derogation from the ECHR and ICCPR, all the measures applied by NCON can be broadly considered legitimate under martial law. They are predominantly aimed at restricting access to harmful content or illicit products or services and are strictly limited time-wise. While the discretion of the body remains undefined, in the circumstances of an ongoing armed conflict, this may be necessary to allow space for flexibility of its powers in an ever-changing environment. The legislation would, however, still benefit from the clearer delineation of the NCON’s spheres of expertise in the spheres of website blocking.
At the same time, NCON’s transparency can be improved. Primarily, it should provide the reasoning for targeting specific websites in its decisions, demonstrating the particular nature of the threat the blocked website constitutes to national security. While its decisions clearly reach the affected subjects (ISPs), civil society organizations and the general public would benefit from the possibility of conveniently accessing the NCON’s decisions which do not contain classified information, and checking the list of alleged phishing domains inserted in the filtering system. At present, only some of the NCON orders and decisions are published on the outdated website of the peacetime electronic communications regulator, the National Commission for State Regulation in the Fields of Electronic Communications, Radio Frequency Spectrum and the Provision of Postal Services (the NCEC). This transparency will be crucial for conducting civic control over lifting the wartime restrictions after the cancellation of the martial law regime. Any potential risks to user privacy stemming from phishing filtering should also be eliminated.
Conclusions
The State’s desire to restrict information on the Internet during wartime is understandable, given the move of modern warfare into the digital realm. In Ukraine’s context, this led to the establishment of blocking measures under the sanctions’ legislation which went beyond the legislative wording itself and the standards of the three-part test. Ukrainian authorities continued using this mechanism well into the post-February 2022 full-scale invasion. While its use can be more justified now than in the period between 2017 and 2022, the potential extension of its reach beyond the martial law situation requires legislative clarifications.
The regulation of NCON activities can, in principle, remain flexible in order to answer pressing questions arising from the opposing belligerent party’s actions. Utmost attention, however, shall be paid to the withdrawal of any restrictions imposed by NCON after the cessation of martial law. To control this, civil society and industrial actors shall obtain convenient access to the regulator’s orders.
Introducing more nuanced legislation can mitigate problems arising from the described blocking mechanisms. It shall contain the following:
- amendments to the Law of Ukraine “On Sanctions” clarifying the powers to block websites in national security contexts, establishing the requirement to publish the reasoning for sanctions’ imposition, and eliminating the opportunity for indefinite blocking, thus providing additional safeguards to such decisions;
- requirement for revision of previously imposed sanctions by the NSDC to reassess them against the changing circumstances after the cessation of martial law;
- improvement of NCON’s transparency by clarifying the spheres of its blocking powers, requiring it to publish its orders and decisions which do not contain classified information, substantiating these decisions and orders, pointing to the reasons for such blocking and the purported threat a specific resource poses during wartime, and report after the cessation of martial law on the imposed blocking measures and their withdrawal.
Maksym Dvorovyi, DSLU Head of Digital Rights