With increasing frequency, digital attacks are becoming part of many countries’ military arsenal, and the Russian invasion of Ukraine is no exception. In fact, Russia’s DDoS attacks on media websites, mass reporting of social media accounts, and malware distribution started in Ukraine long before the war did.

Not only have these attacks continued, but many have increased in frequency and intensity. Malware activity and phishing have spiked, digital attacks on media and journalists have increased, and Internet access has been blocked in the regions under Russian control.

With DDP’s support, Digital Security Lab Ukraine (DSLU), a Ukrainian team of digital security experts that strengthens civil society organizations’ holistic security practices, is helping activists and journalists facing digital attacks during the war.

DSLU’s response to digital threats

In essence, DSLU does the same kind of work as before the war by providing technical support and advice. But the crisis has forced the team to respond to threats while being relocated. And it has had to get creative. For instance, the war disrupted the supply chain, making it very difficult to acquire new devices to replace damaged or lost hardware. So the team now repairs, cleans and tunes up disused equipment.

DSLU is now also helping journalists securely clean their devices and delete any content that may be considered compromising when crossing checkpoints. The same goes for any “suspicious activity” on their social media that could put them at risk. DSLU provides VPNs and other circumvention tools in areas that have to access the Internet through Russian ISPs after the Ukrainian telecommunications infrastructure was destroyed.

The digital impacts of war, however, affect everyone, as inhabitants of Ukraine massively seek refuge in neighboring countries. “Imagine losing your phone while fleeing: you try to connect from a new country with a new phone number, device, and IP address. Platforms identify this sudden change as suspicious activity and block the account, leaving users without access,” a DSLU expert tells us. But since they have a direct line with service providers, DSLU has been helping people recover access to their accounts.

Lessons learned during wartime

Now several months into the war, Digital Security Lab Ukraine has learned that the organizations they had worked with during peacetime were better positioned to face digital attacks. “They know how to identify malware and report it, their websites are still up and running, and they have their accounts and devices securitized. All the previous preparation paid off and made them very resilient,” the DSLU expert explains.

Long-term support, such as the one Digital Defenders Partnership provides, allowed DSLU to create a support network for people facing digital threats. “We have built trust, which takes time,” the experts points out. DSLU is now a digital security reference for activists in Ukraine.

Many challenges ahead

In any case, there are still many challenges ahead. DSLU experts emphasize that in a crisis such as this, they must be flexible enough to support people who are starting to engage in activism without any digital security skills. In addition, the changing nature of DSLU’s tasks requires flexibility in financing to allocate funds quickly.

Hivos recognizes that human rights defenders, social justice activists, and independent media are increasingly vulnerable to digital threats like surveillance, theft and misuse of sensitive data, targeted disinformation, and deep fakes. This is why Digital Defenders Partnership will continue to help organizations and activists in Ukraine, and the Ukrainian diaspora, to respond to ever-intensifying digital threats and attacks.