ANALYSIS: Yandex and Mail.Ru Group blocking in Ukraine in the context of information warfare

Centrum Analiz Propagandy i Dezinformacji
Author: Centrum Analiz Propagandy i DezinformacjiEmail: This email address is being protected from spambots. You need JavaScript enabled to view it.

So far, the most popular social network in Ukraine has been VKontakte, followed by Facebook, which shared its position with Odnoklassniki in certain ranking lists. Imposing sectoral sanctions on Russian entities was not motivated by social pressure. Although the political aspect is important, the major reason was economy and security, and the decision was supposed to impact the aggressor state financially and prevent its enterprises to make money on the Ukrainian market. However, there is a range of serious threats for the Ukrainian state resulting from this decision.


On 15 May 2017, Ukrainian President Petro Poroshenko signed a decree giving effect to the decision by the National Security and Defence Council (NSDC) on sectoral sanctions (for 1 year or 3 years) for 468 legal persons and 1,228 natural persons. The 36 months’ variant was the most common among the 81 Russian enterprises and their branches in Ukraine operating in the IT sector. They included, apart from social networks, i.a. software and other IT solution suppliers, two of which were Russian companies producing anti-virus software: Dr.Web and Kaspersky Lab, but also Russian and Ukrainian enterprises selling licences for popular Russian ERP (Enterprise Resource Planning) and CRM (Customer Relationship Management) systems, such as: 1C, Parus (Парус), etc.

Yet it is obviously the sanctions imposed on limited liability companies: Yandex, with its registered office in Moscow; Yandex Ukraine, its subsidiary based in Kyiv; Mail.Ru Group, with its registered office in Moscow; Kyiv-based Mail.Ru Ukraine; VKontakte, with its registered office in Saint Petersburg, and VKontakti, its subsidiary with its registered office in Kyiv, that have the greatest impact on the Ukrainian society.

The measures applied against the six aforementioned enterprises (in various combinations) include:
- blocking of assets;
- restriction of business operations;
- prohibition of profit relocation outside Ukraine;
- cancelation or withholding of licences and other permits required for running an economic activity;
- a full or partial prohibition of performance of legal transactions on the securities issued by such companies;
- prohibition for Internet providers to provide services with granting access to web users to the resources of the mentioned companies (according to the address directory);
- prohibition of issue of permits and licences of the National Bank of Ukraine for investments in other countries, and of transfer of foreign currency funds on accounts and deposits to another country;
- discontinuation of performance of economic and financial obligations;
- restriction or prevention of the provision of telecommunications services and of the use of general purpose telecommunication networks;
- prohibition of public contract award;
- withholding of issue of the licences and permits for foreign currency import to and export from Ukraine and restriction of cash withdrawals with payment cards issued by foreign banks;
- prohibition of sales of technologies, intellectual property rights.


Yandex (Yandex N.V. from the Netherlands and subsidiaries) is the most expensive company of the Russian Internet (Runet) according to Forbes’ ranking list of 2016. The company bases its activity on competing with Google, mainly as regards search engines on the local market, and provision of services similar to those of Google. An analysis of the data invoked by the Russian edition of that paper shows that the Russian Yandex’s share in the Ukrainian market of search engines is 25%-30%. The Ukrainian market alone accounts for 1%-3% of its profits. From the financial point of view, given the official 2016 data, i.e. RUB 75.9 billion (ca. EUR 1.2 billion), the amount ranges from RUB 0.76 billion to RUB 2.28 billion (i.e. from ca. EUR 12 million to ca. EUR 36 million).

However, there are also opinions of analysts from the Russian Promsvyazbank (Russian: Промсвязьбанк), who are not affiliated with Yandex, that Yandex blocking by Kyiv can bring an even ca. 10% loss for the company relative to 2016. For the sake of comparison, the number of Yandex users in Russia is 52.8 million and in Ukraine – 10.8 million. According to this bank’s estimates, Yandex is used by ca. 56.2% of all Ukrainian Internet users. They provide that the Ukrainian consumers account for as much as 17.6% of the total traffic in the Russian search engine.

Yet the data presented by Russians should be approached with scepticism. In April 2017, the monthly number of queries (search phrases) by Ukrainian consumers of all websites with the and domains was 62.3% (5th position). In comparison, websites with the and domains had a reach of 87.2% of consumers (1st position) in the same month. This results from the data from TNS Ukraine, a market research agency.

As noticed by Forbes, the drop in Yandex’s income will not be directly proportional to the above indicators, but it will be lower. A majority of the websites related to Yandex did not operate in Ukraine and the average income generated by the company on a Ukrainian user was 30%-40% lower than in Russia (RUB 87 in the RF per month). The Russian experts who commented on the matter for Forbes note also that the losses arising from the Ukrainian market blocking could be compensated by development of the Russian market, in particular the enterprise market. The expected 2017 growth will be between 19% and 27%.

Moreover, the company itself believes that it is almost 11 million Ukrainian users that will lose most as a result of Kyiv’s decision rather than Yandex. In accordance with the NSDC’s decision, all websites of the company with the “.ru” and “.ua” domains, including e-mail, search engine, thematic websites, online radio stations, research tools, or places where documents are stored or archived, are to be blocked.

Quotations of Yandex N.V.’s depositary receipts on the NASDAQ Stock Market are relatively stable. An insignificant drop was observed only on the day of publication of the Ukrainian President’s decree approving the NSDC’s decision. Probably the company’s Management Board successfully convinced investors that losses on the Ukrainian market would be insignificant.

Mail.Ru Group

In the aforementioned Forbes’s ranking list, Mail.Ru Group Limited from the British Virgin Isles is the second most expensive company of the Runet. The Group (Mail.Ru Group Limited and subsidiaries) is composed of “VKontakte” (VK) and “Odnoklassniki” (OK) social networks, “My World” (Russian: Мой Мир), an e-mail service, a recruitment web portal, and a web portal under the same business name as the company. The entire Group handles also online game distribution. The list of the Ukrainian sanctions contains the four enumerated companies owned by the Group. All sanctions were imposed on them, with the exception of public contract award. Ukrainian Internet providers are obliged to block access to the Mail.Ru website and home pages of VKontakte and Odnoklassniki social networks – and

According to the Group, the number of its users affected by Ukrainian sanctions was 25 million Ukrainian citizens. Its social networks were among the most popular in Ukraine. The data obtained from the said TNS Ukraine agency’s research show that the monthly reach of all Mail.Ru Group websites among Ukrainian Internet users was 62.3% in April this year (4th position). The monthly reach of VKontakte, in turn, was 78.3% (3rd position), and Odnoklassniki – 46.9% (9th position). For the sake of comparison, Facebook was ranked 6th with its reach of 54.2%.

The official standpoint of the company is that it provided services to a small portion of the Ukrainian market and does not need to adjust its plans to the Kyiv policy. For the time being, the Ukrainian sanctions have not been reflected in the quotations of depositary receipts of shares of Mail.Ru Limited’s on the London Stock Exchange. 

Effects of the sanctions imposed on Yandex and Mail.Ru Group for the Ukrainian market

The decision of NSDC and Petro Poroshenko will certainly influence the digital marketing and advertising market in Ukraine. It will also change the conditions on which the Ukrainian Internet functions to a some extent – as stated by Maxim Savanevsky, a partner in PlusOne Digital Agency.

The major beneficiaries of the changes will be the American tycoons: Google and Facebook. Yet it needs to be emphasised that they began to win with the Russian competitors even without the sanctions. Over the past 6 years, the Facebook growth rate has fluctuated between 25% and 30%, while VKontakte and Odnoklassniki recorded negligible growth. It is not the Russian web portals that were leaders in the ranking lists of the Ukrainian business marketing budgets – Facebook was. It was also the leader in the SMO (Social Media Optimization) and SMM (Social Media Marketing) areas. The present situation will reinforce the trend even more.

Google will benefit from the departure from the web analytics based on Yandex tools. Experts forecast that it will be followed by an increase in prices for video advertisements on the Internet, which will be favourable mainly to YouTube, but also to Ukrainian websites. As regards the entire advertising service market, inflation is predicted – an increase in the advertisement prices on the websites which have not been affected by sanctions (YouTube, Google AdWords, Facebook) and the simultaneous surplus of qualified employees from that area. The situation will be similar in the e-commerce field. There will be less work and more competition on the market. Small business, which used to use VKontakte as a platform for selling their goods or services, will be forced to adapt quickly to new conditions, most probably through migration to Facebook and Instagram.

One of the crucial components of the changes will be a considerable decrease in access to pirate audio and video files and other contents which were easily accessible on the VKontakte website. The change in the habits of Ukrainian Internet users and the increase in the use of the Western substitutes and, what follows, standards will be extremely beneficial to the Ukrainian economy and society in the long run. This can be effectively used by authorities in terms of image as one of the forms of success in the area of reforms and transformations.

Problems involved in the effectiveness of the sanctions imposed on Yandex and Mail.Ru Group

Concerns about the effectiveness of the sanctions imposed in this area are common among Ukrainian experts. Six legal entities from Ukraine and the Russian Federation have been entered to the list so far: two of them are affiliated with Yandex N.V. (the Netherlands) and four with Mail.Ru Group Limited (the British Virgin Isles). However, both holdings control the entities governed by jurisdictions other than Russia or Ukraine, in particular in the European Union member states. Apart from that, they may establish new companies in other countries exclusively for the purpose of settlements with Ukrainian contracting parties, but, in the case of suspicions, the National Bank of Ukraine may block such payments.

Both Yandex and Mail.Ru Group intend to retain some of their current users in Ukraine. After the publication of the President’s decree, regular users of VK, OK, and Mail.Ru have been receiving, via different channels (in particular e-mail) various specific instructions on how to circumvent the blocked access to these servers. The recommendation is to use popular extensions and add-ons for browsers or VPN (Virtual Private Network) application, which are supposed to bypass the Ukrainian cyberspace by sending encrypted information between the user and service provider servers, regardless of the device used. Additionally, a description of the use of TOR (The Onion Router) network can be found in these instructions. The network relies on distributing data through various servers, which ensures anonymous surfing within the structure of this network. Yandex has a free browser with a built-in VPN client on offer. The browser is available for all popular platforms: Windows, iOS, and Android.

Apart from that, as has been revealed, Mail.Ru Group promotes the FreeU browser for Windows, created on the basis of its own product of this kind – Amigo and the TOR technology. Yandex and Mail.Ru Group have not provided the information about the number of Ukrainian users using Yandex or FreeU browsers in their country yet.

A disadvantage of using the TOR network browsers for circumventing the blocking is a low bit rate. Moreover, together with the FeeU browser the users install a range of other Mail.Ru services, owing to which the company receives reports on their online activities. The use of the VPN add-ons or the Yandex browser for smartphones increases expenses incurred by mobile telephone network subscribers. Before the sanctions were introduced, most users normally, through agreements between operators and Yandex or the companies belonging to Mail.Ru Group, had free direct access to Yandex, Mail.Ru, VKontakte, and Odnoklassniki services, like to Facebook, Google, and some other Western services. Since mobile operators were among the first ones to block access to Russian web services, subscribers will either increase their expenses on the Internet now or resign from using the blocked services.

For the time being, according to the data from LiveInternet, a Russian web statistics aggregator, the daily Ukrainian auditorium of all Russian websites has decreased from 20-22 million visitors in the first half of May to 6-7 million as at 26-27 May this year. The number of German users, in turn, increased by nearly 700 thousand, American ones – by almost 500 thousand, and the Dutch ones – by 850 thousand. This German-American-Dutch growth in the number of consumers of the Russian Internet might reflect the transfer of nearly 2 million Ukrainian users to various VPN add-ons and a browser with a built-in VPN function.

Social effects of the sanctions imposed on Yandex and Mail.Ru Group

Undoubtedly, the presence of Russian web services in Ukraine significantly increases Russians’ opportunities to reach various groups of recipients with disinformation, manipulation, and narration schemes that are comfortable for themselves. This is because, unlike their Western counterparts, Russian web portals take an active part in political combat but they are not much concerned with law, reliability or credibility issues. The example of Nadiya Savchenko’s false account is worth mentioning, which – despite numerous protests and notifications – has still been functioning and cannot be deactivated.

Furthermore, Russian web portals cooperate closely with the Federal Security Service (FSB) by sharing complete information about their users, their activities and entries, without receiving injunctions. Moreover, there are countless possibilities of penetrating Russian servers by all force and security structures, which can take over an e-mail box, account or simply block them, thus cutting the user off his or her data and receiving an in-depth insight into his or her activities, at any time. This is in fact permitted by the Russian law, which provides the FSB with the possibility to follow VK and OK users in the real time, even without correspondence with the services’ administration (the Federal Act On Information, Information Technologies and Information Protection of 27 July 2006, No. 149-F3; the Federal Act On the Amendment of the Federal Act «On Information, Information Technologies and Information Protection» of 5 May 2014, No. 97-F3). Kremlin’s aggressive operations in the information and security space arise from the new Russian 2017-2030 Strategy for the Development of an Information Society in the Russian Federation.

The policy pursued by Western web portals is much more effective – it is more difficult to distribute extremist, racist, xenophobic or other contents that pose a threat to the public order even in the short term. This problem does not apply to Russian social networks if only this is consistent with Russia’s interests. They also ensure a considerably higher security level.

Generally, the Ukrainian society is displeased with the fact that popular Russian services are blocked, which is explained by the dependence of many Internet users on them. For the time being, the dissatisfaction level has not been measured by sociologists yet. The decision on the blocking was miscommunicated by the authorities – the reasons behind it were explained insufficiently. Apart from that, the NSDC activities struck the interests of various political forces, which will appeal to their electorate to circumvent the blocking. However, the circumvention will not necessarily be a mass phenomenon.

An interesting aspect is the narration adopted by Russian entities. Both enterprises emphasise how little they will lose on the Ukrainian market as a result of Kyiv’s decision, at the same time endeavouring to encourage their users to bypass the sanctions in diverse manners. You can even see the following question on the portal: “if Yandex earned nothing in Ukraine, why was it there in the first place?”.

One of the answers is given by the recent events. On 29 May, the Security Service of Ukraine, upon the instruction of the General Prosecutor’s Office performed a series of searches in Yandex offices in Kyiv and Odessa. They were related to the fact that the company’s management staff had illegally collected and stored private data of Ukrainian citizens (personal information, data about their work, place of residence and workplace, income, telephone numbers, addresses of their electronic mail and social network accounts) and forwarded them to Russia.

The information about law enforcement authorities and soldiers of the Armed Forces or National Guard of Ukraine enjoyed an exceptional interest. As communicated by SBU, these data were provided to the secret services of the Russian Federation for the purpose of planning, organisation and performance of intelligence, diversion and information activities. An investigation is pursued under Article 111 of the Ukrainian Criminal Code, i.e. treason. Operations aimed at explaining the fact that data on Internet activities of Ukrainian users have been forwarded to Russian servers will also be carried out.

What is particularly dangerous is the consequences of low awareness of risk on the web among many Ukrainian citizens who decide to use the tools offered by the aggressor state. Regardless of whether it is for practical, ideological, or economic reasons that some Ukrainian users choose to circumvent the sanctions by means of the instruments recommended by Russia, they provide access to their data, including confidential ones, to Russian entities and thus to the services with which they collaborate. Bypassing sanctions itself can be a piece of information that discredits a given person, especially a governmental official.

Furthermore, as noted by Volodymyr Kolesnikov on the InformNapalm portal, the increase in the use of proxy servers (connections routed directly from the user’s computer to the indicated server with the national network infrastructure partly bypassed – this concerns communication with websites) in new Russian browsers and routing transfer via them in order to circumvent the sanctions does not need to mean that no actions for further reinforcement of control over the users will be taken in the future. One of such actions could be redirecting traffic in the web via their own servers also in relation to the web portals which have not been blocked, such as Facebook or Google, but also other national services. Another threat will be the shift from proxy servers to the SOCKS protocol (the next generation of proxy protocol, which provides better possibilities for the general data transfer between selected servers). This will increase the capabilities of the new system designers at the expense of the user even more (it will be possible, for instance, to replace contents or restrict access to selected IP addresses).

Political effects of sanctions imposed on Yandex and Mail.Ru Group

Many Ukrainian politicians enjoy similar ratings and will seek various opportunities to stand out. At the same time the position of the incumbent President is quite weak, particularly in West Ukraine, coupled with the very high distrust level (ca. 80%). Since Ukrainian-speaking electors from West Ukraine will be extremely important, issues related to Russia, its political or linguistic influences, might become a significant part of the coming election campaign.

Any decisions which will be presented as addressed against Russia, such as the fight against the Russian influence in the information sphere, might become a basis for increased trust level to Petro Poroshenko. Sanctions imposed on Yandex or Mail.Ru Group might exert greatest impact on groups of moderate electors: Ukrainian-speaking and pro-Western ones, at the same time independently of accusations by his internal political opponents that censorship was introduced. So far, the Ukrainian media that have traditionally promoted the Russian point of view, have persuaded their recipients that the blocking is ineffective due to the broad spectrum of the possibilities to circumvent it, which they actually describe.

The consequence of public appearances of politicians or social activists related to the protection of citizens’ rights to have direct access to the blocked websites will be their discrediting in the eyes of the electors who regard Russia as the aggressor and threat to national security. For this reason, even these anti-Russian ;political forces that actively use VKontakte for recruiting new members and maintaining contacts with them, i.e.: Svoboda, Right Sector, National Corps and all the organisations affiliated with them, did not object to the decision by NSDC, although they talk about their dissatisfaction with it.

The decision is openly criticised above all by pro-Russian political parties: Opposition Bloc and “For Life” (Ukrainian: За життя) or the legally banned Communist Party of Ukraine. Apart from them, it is also criticised by certain representatives of pro-Western parties, in particular “Democratic Alliance” (Демократичний альянс) and “Movement of New Forces” (Рух нових сил). The negative standpoint is expressed also by representatives of numerous anti-system movements, which currently have no chance to participate in parliamentary elections, namely Anarchists, Communists, Trotskyists, National Anarchists, Autonomous Nationalists, National Socialists, etc.

There is threat that certain users who are vulnerable to Russian propaganda and disinformation will remain on VKontakte and Odnoklassniki. Over time, their vulnerability will be increased due to the lack of alternative thoughts or viewpoints in this space. Moreover, activists of nationalist parties, in particular Svoboda, Right Sector, National Corps, the affiliated organisations or various activists from other anti-system structures, who are not necessarily vulnerable to Russian propaganda contents, might stay on VKontakte. However, their self-isolation on VKontakte can facilitate their radicalisation.

The decision by the President and NSDC might have also other consequences. It is very easy to take advantage of the topic of Russian website blocking to reinforce social polarisation, especially as a broader strategy to take up the fight in the area of language. On the one hand, the aspect (liked by Kremlin) of the rights of the Russian or Russian-speaking minority might be addressed. On the other hand, a counterbalance might appear and used in an instrumental manner. Actions related to the “defence of the Ukrainian language” might be ridiculed and become an element of numerous provocations, including uncoordinated activities addressed against other nationalities: not against Russians but against other ethnic minorities. By means of activists or hired provocateurs, Russian propagandists might also effectively attack Ukraine’s image on the international stage as a country with growing xenophobic sentiments (only the Russian and Russian-speaking minority is persecuted, but dangerous sentiments are continuously intensifying). However, the primary aim will be to increase the internal chaos level and to escalate political conflicts.


The majority of Ukrainian experts, in particular those dealing with national security or media market, judge that this is a positive decision – albeit belated by about three years. Generally, this is true but there are also opinions that due to the low communication quality on the part of the authorities a part of society might not only have a critical attitude to it but also put up real resistance.

What is often repeated by a range of Western experts and organisations, various Ukrainian circles, including radical and pro-Russian ones, voice accusations against the authorities that this actually means introduction of censorship on the Internet. Thus, a whole spectrum of factors related to security or economy are ignored. On the other hand, also such statements appear that this direction of action should be strengthened and a number of other websites or web services, which violate Ukrainian law, incite ethnic hatred or stand up against Ukrainian territorial integrity or sovereignty, be blocked.

Kyiv’s decision involves multiple aspects. Due to the complex socio-political situation of the country, it can be speculated whether such activities would face greater favour or understanding already in 2014, given the fact that the pending war did not change the perspective of many citizens. The actual problem is the manner in which this was carried out, without proper communication of the purposes and motives, and especially without giving the society some time to adapt to new circumstances. On the other hand, it can be replied that there were over 36 months for that, and regardless of whether someone is a soldier, a state official or an ordinary Internet user, they shall not store any sensitive data on the servers of the aggressor.

It is due to the issue of armed conflict that so significant political decisions are not communicated well beforehand. It is possible that Kyiv’s aim of such action was to achieve certain goals. Nevertheless, there is no slightest doubt that the response of the Russian side displays all signs of a well-thought and planned reaction. Kremlin must have been long prepared for such a scenario. Also for this reason communication between Ukrainian politicians and the society becomes a vital point – its quality determines the effectiveness of national security strengthening and of the potentially fundamental social change. The blocking of Russian social networks and portals might become a milestone on Ukraine’s path towards the West, effectively recovering the country from the long-term influence of its Eastern neighbour.

Dmytro Borysov, Adam Lelonek, PhD