VPNs with servers in Ukraine

Access to information about the consumer and the services supplied, including data processed to carry the information, is allowed only on the decision of a prosecutor, a court or an investigating judge (article 121(1)). Providers must give authorised bodies access to their networks (article 18(3)(10)) and a connection point for the single system of technical means those bodies use (article 121(2)–(3)). Whether a VPN operator is a provider under the Act is not established.

On a court decision, providers must restrict their subscribers’ access to resources that distribute child pornography (article 18(3)(13)).

They must also restrict access to websites named in a decision of the National Council of Television and Radio Broadcasting imposing a ban on online media, or in a court ruling banning online media (article 18(3)(15)), and restrict or restore access to websites that a decision of the Council adds to or removes from its list of on-demand audiovisual services of the state that Parliament has recognised as the aggressor (article 18(3)(16)).

Article 436-2 of the Criminal Code, added by Law 2110-IX of 3 March 2022 and amended by Law 3342-IX of 23 August 2023, makes it an offence to justify, recognise as lawful or deny what the article calls the armed aggression of the Russian Federation against Ukraine begun in 2014, or the temporary occupation of part of Ukraine’s territory, or to glorify those who took part.

Paragraph 1 carries corrective labour for up to two years, probationary supervision for up to three years, or imprisonment for up to three years. Making or distributing such material carries up to five years (paragraph 2), and five to eight years where an official, a repeat offender, an organised group or the media is involved (paragraph 3).

In an emergency or under martial law, operators must carry out the orders of the National Centre for Operational and Technical Management of Electronic Communications Networks, except for networks used for broadcasting, where the National Council of Television and Radio Broadcasting decides (article 18(3)(14)). The order of the rows is the security score, and a server’s location is not a recommendation.