Ukraine as a Laboratory of Internet Resilience

Defining Internet resilience has never been a purely technical exercise. It is, at bottom, a question about what we want a network to do under pressure, who is responsible for ensuring it does so, and who bears the cost when it fails. Ukraine has demonstrated that resilient networks are not simply networks with good hardware. They are networks embedded in diverse markets, supported by local and international cooperation, separated from hostile dependencies, and ultimately sustained by the resourcefulness of the people who maintain them.

Today, on the 4th anniversary of the Russian full-scale invasion of Ukraine, we will take a glance at how Internet connectivity is maintained in Ukraine based on the researched concept of resilience.

Connectivity in Ukraine

Few places in the world have stress-tested the concept of Internet resilience as severely as Ukraine. Since the beginning of the Russian invasion of Ukraine in February 2022, Ukraine’s digital infrastructure has suffered heavily across every dimension. Cables get damaged, power stations get destroyed, and whole communities keep getting separated from the global network. Internet service providers and governmental bodies suffer from both cyberattacks and overheard missiles daily. By August 2023, the European Union estimated that roughly 25% of Ukraine's telecommunications infrastructure had been damaged or destroyed, with the World Bank placing the total cost of damage at $1.6 billion as of February 2023.

And yet the Ukrainian Internet did not collapse. It adapted and rerouted and in some ways emerged even stronger. This experience raises a question that engineers and policymakers are only beginning to answer properly: what, precisely, do we mean when we say the Internet is resilient and how would we know if it weren't?

The concept of Resilience

Network resilience originated in the field of ecology. According to Holling (1973), resilience is the ability of ecosystems to eliminate the impact of external disturbances and maintain stability through their own repair. The concept has since migrated into discussions of engineering, disaster risk management, and eventually into the study of complex digital networks.

In telecommunications specifically, the concept has been defined in several overlapping ways. Aggelou (2008) frames network resilience as the ability to cope with (both resist and recover automatically from) three types of severe threats: difficult network conditions, coordinated attacks, and traffic anomalies. Each of these categories maps directly onto the Ukrainian experience. Difficult network conditions become apparent as destroyed physical infrastructure and power failures. Coordinated attacks are the sustained cyber offensives against major operators. Traffic anomalies emerge when people get displaced or enormous volumes of traffic are suddenly redirected in unexpected directions.

Sourlas at al. (2018) approached things slightly differently, focusing not on the threats themselves but on outcomes. In their view, resilience is the capability of a network architecture to provide and maintain acceptable service levels for clients, regardless of whether individual nodes or links fail. The Internet Society has adopted a similar standard of an “acceptable level of service in the face of faults and challenges to normal operations”, while demonstrating a shift towards a human-centric, whole-of-society approach to security. This outcome-oriented perspective matters because it shifts the question from what happened to the network toward what users actually experience.

Blake et al. (2019) consider that to be resilient is to be able to “resist, absorb and adapt to disruptions and return to normal functionality”. OECD (2019) defines infrastructure resilience as 'the capacity of critical infrastructure to absorb a disturbance, recover from disruptions and adapt to changing conditions, while still retaining essentially the same function as prior to the disruptive shock’.

Across all these definitions, a clear pattern emerges. Despite their differences in emphasis and origin, each framework points toward the same set of characteristics through which resilience becomes measurable in practice.

The architecture of Resilience – four pillars

The Internet Resilience Index Methodology, developed by the Internet Society's Pulse platform, identifies four foundational pillars that together determine how resilient a country's internet ecosystem actually is. Together, they contribute to the smooth operation of the Internet:

1. Infrastructure - the physical existence and reach of cables, data centers, IXPs, and the hardware that ties them together.
2. Performance - whether the network delivers seamless, reliable access to Internet services for end-users under real conditions, not just in theory.
3. Security - the capacity to resist deliberate disruption, encompassing adoption of security technologies, routing integrity, and best practices across the ecosystem.
4. Market readiness - whether a competitive, diverse market of providers exists and is capable of self-regulation (so that the failure of any single actor does not produce catastrophic consequences).

Beyond these pillars, the OECD and some of the researchers (at different points of time) have identified four distinct qualities that resilient systems must combine:

• Robustness means the systems are strong enough to withstand low-probability but high-consequence events (like missile strike or coordinated cyberattack);
• Redundancy ensures that substitute systems stand ready when critical components fail;
• Resourcefulness is the human dimension - the ability to manage a shock event as it unfolds, identify options, prioritise damage control, and communicate decisions to those responsible for implementing them (depends primarily on people, not technology);
• Adaptability means absorbing the lessons of a catastrophe and building them into the system going forward.

All these features are expected to be present in a system that wishes to be regarded as resilient, and must go all the way from the infrastructure layer of the Internet to the logical one.

Technical and sociopolitical dimensions

Pillars and features are not the whole recipe for ‘preparing’ (for) resilience. One of the most productive distinctions in recent discussions is the separation of technical resilience from sociopolitical resilience. Even though both dimensions represent the ability of the system to recover from unexpected events, technical resilience concerns the technological systems themselves, while sociopolitical resilience focuses on human networks, organisations, and groups that maintain and uphold those technological systems and ensure they remain accessible and useful even under extraordinary pressure.

Ukraine's wartime Internet history illustrates why both dimensions matter. Technically, early decisions by private cloud providers to extend infrastructure support to Ukraine and sustained efforts to build Ukrainian cyber-defence capabilities were pivotal in preventing complete internet shutdowns. Just one week before the Russian invasion, the Ukrainian Parliament passed a law that ended the strict rule requiring government and private data to be stored within Ukraine, while allowing a shift to a foreign cloud. Even before that, the country's gradual separation from Russian transit networks since the 2014 occupation of Crimea and Donbas removed a critical vulnerability. Sociopolitically, the decisions of private companies, international organisations, and non-state actors to prioritise Ukrainian connectivity had as much to do with political will and international solidarity as with network architecture. The Internet didn't save itself. People decided to save it, and those decisions weren't made in a vacuum. Together, these metrics tell a more nuanced story than any single definition or number.

How people saved the Internet in Ukraine

The sociopolitical dimension of resilience relies on people. To ensure access to the Internet in Ukraine during the war, people have to coordinate and join their efforts. They also need to share the best practices and support each other. That is what the Network Operators Group of Ukraine - the technical community of engineers who work in the development, implementation, and support of networks, cloud infrastructures, and related infrastructure solutions - does.

The Network Operators Group of Ukraine holds its conference, NOGUA, annually for internet service providers and Internet enthusiasts, both from Ukraine and abroad. The uniqueness of NOGUA is hard to overestimate. The fact that the organisers from Ukraine manage to gather various professionals at one place inside the country for several days for the second time now, amid ongoing damage to critical infrastructure, is itself remarkable. This is the sociopolitical dimension of resilience: while the infrastructure - without which the Internet is just a word - suffers from Russia’s deliberate attacks, people come together not only to share the challenges of the hard times but to envisage the future and create an action plan to keep the system functioning, not just surviving. We participated in NOGUA in November 2025, and saw first hand the spirit of the professionals and policymakers.

In 2024, NOGUA interviewed eight different Internet service providers, mostly small and medium-sized. The initiative to conduct the interviews was managed in cooperation with the Best Current Operational Practices (BCOP), which initiated the community-led process of identifying and documenting Best Practices to Survive Natural Disasters or War at RIPE 86 in Rotterdam.

The interviewed ISPs did not have vast teams or departments; instead, they usually operated as small groups of workers who brought the Internet to different regions of Ukraine, mainly those that were close to the frontline. The ISPs were all asked similar questions about the war and its influence on the works, blackouts, and the operational capacity of the providers. We carefully reviewed each interview and found a striking similarity between the respondents’ answers when it came to the challenges of their work. All of them spoke about resilience and the need to continue providing services despite the critical challenges of the war.

For instance, the ISP from Nikopol (QUADRONET), a city in the Dnipropetrovsk region that borders the Donetsk region (at the time of writing this article, the Donetsk region is an active battlefield zone), mentioned that it was forced to work in the area where FPV drones were constantly flying. Before getting to the area, the worker was supposed to leave his car aside and then operate in the open space, awaiting the drones to fly to him, making him a potential object for an aerial attack. This is what the OECD calls resourcefulness and daily adaptability, which depends entirely on people, not technology. No backup systems or cables can replace a worker choosing to walk into a drone corridor to restore connection.

Another ISP from the Kherson region, Viner Telecom, was asked what motivated its employees to continue their work on renewing the damaged cables under the constant air raid alerts (Kherson region as well as Kherson itself are being heavily attacked by Russians from the air and are notoriously known as ‘kill zones’ due to the amount of drones attacking civilians on the streets). The answer was the occupation. The motivation of the ISP’s installers to work under the constant threat was that they had been under occupation and had witnessed the atrocities committed by the Russians, so they knew what the occupation was and did their best to provide the cities access to the Internet. What we see here is that the Nikopol case shows resourcefulness as physical courage under immediate threat, while the Kherson case shows it as a motivation deeply rooted in collective trauma, the sociopolitical dimension. Resilience had nothing to do with infrastructure. The network stayed on because the people maintaining it understood from their own experience what losing it would actually mean.

It is the people who have been saving the Internet in Ukraine on a daily basis. Behind each smooth connection, there is the work of people cooperating. And that is why the sociopolitical dimension of resilience lies there where people can gather and do teamwork as well as exercise flexibility under pressure. That said, the example of Ukrainian ISPs demonstrates that the sociopolitical dimension of resilience depends on human resilience, too.

Decentralisation is key

Apart from the sociopolitical dimension of Internet resilience, Ukraine offers a lesson in technical strength. Analysis of various interviews confirm something both RIPE and other experts have already pointed out: the Ukrainian Internet has been resilient and viable during the full-scale invasion and blackouts due to its high level of diversification and interconnectivity. The connection of the backbone data networks is decentralised. Most Ukrainian ISPs manage their communication networks independently.

For instance, an ISP from the Sumy region - the northern part of Ukraine that borders Russia and has been suffering from numerous aerial attacks - described the situation in the region as follows: “There is a lot of interaction. Providers help each other and share equipment despite the competition. The more players are in the market, the stronger the connection is”.

Viner Telecom, in an interview, responded to the question: “If there is no help from the government/donors or volunteers, how long will it take for your work to stop?”. It said: “We will keep going and enduring. Others will help us. We have invested a lot in our work, so it will be very painful to lose it”.

The technical dimension of resilience is, therefore, maintained in Ukraine, among other things, through diversification and interconnection. The interview participants have mentioned that diversification is necessary as well as support for small providers, since they are the ones who work close to the frontline cities and bring the Internet to the households. Interconnection means small providers shall unite and help each other with equipment and other things to continue their work.

Other initiatives to keep Ukraine connected

Of course, resilience, both technical and sociopolitical, plays a vital role in ensuring access to the Internet. Yet, there are additional factors and initiatives worth mentioning in this context.

One of the governmental bodies actively engaged in keeping Ukraine connected to the Internet is the Ministry of Digital Transformation. Together with the private company, LUN, it introduced an interactive map of the Internet in 2025. The map helps Internet users check their provider's readiness for power outages, and find out the cost of connection and the monthly subscription fee for Internet services, as well as contact the provider and apply for a connection to the Internet that is resistant to power outages.

In interviews, some ISPs have referred to the Keep Ukraine Connected initiative as the source of funding in the process of replacing the damaged equipment. Introduced by the Global NOG Alliance and backed up by the Ministry of Digital Transformation, the Ukrainian Internet Association, and the association of Rights Holders and Content Providers, the initiative gathers intelligence on what the Ukrainian government, ISPs, and network engineers on the ground really need to keep the Internet and essential communication systems running. Based on the gathered info, the initiative connects vendors and donors directly with the people requesting the equipment.

Moreover, in 2025, new interviews with the Ukrainian ISPs were conducted and recorded. They will soon be analysed to continue the monitoring efforts of the Network Operators Group of Ukraine and BCOP RIPE. So, the work on researching resilience in the context of Ukraine is far from being finished yet.

All these initiatives are particularly valuable as Russia continues its war of aggression, and Ukraine needs our support in different aspects, including access to the Internet.

Summary

Needless to say that the resilience of the Internet is a complex thing. Various experts across numerous fields have attempted to define it. In the present context, the two that matter most in our opinion are the technical and the sociopolitical aspects of resilience. The sociopolitical dimension shows that the Internet's resilience directly and fully depends on the resilience of the people who ensure it. The technical one demonstrates that diversification and interconnection are two key points to hold the ISPs together and make them survive under attacks.

Both of the dimensions are visible in the context of Ukraine, which makes it best to be connected with the rest of the world even during the harshest blackouts. After all, Ukraine offers a lot to rethink: are we resilient in the time of uncertainty? How can we ensure to remain connected when obstacles arise? What shall we do to strengthen access to the wonder of the modern world - the Internet?