According to the State Sanctions Registry, five sectoral sanctions have been imposed on foreign countries (russia, Belarus, Iran, and Nicaragua). At the same time, sanctions were applied against russia only in the military-industrial and banking sectors.
There have been restrictions on access to certain russian resources through the application of personal sanctions to their managers (Yandex, Vkontakte, Mail.ru) since 2017. However, the use of programs of russian origin and the viewing of thousands of other russian Internet resources remains permitted.
This issue remained controversial long before the outbreak of the full-scale war.
This situation poses a security threat to both individuals and the state as a whole. The unrestricted availability of russian internet resources and software in domestic markets fosters an environment for the spread of hostile cybercrime, data breaches, and hybrid operations against Ukraine.
Moreover, the use of software and viewing of russian content contributes to the aggressor country’s budget, which is entirely unacceptable. In the third year of the great war, the state appears to have found a solution: implementing sectoral sanctions by banning software and restricting access to all of the aggressor’s internet resources.
Offer
To this end, draft law No. 11492 was registered in August 2024. It provides for the expansion of the list of sectoral sanctions.
The document proposes banning Ukrainian companies from distributing or using software and components originating from a sanctioned state, developed by residents of a sanctioned state, created by legal entities partly owned by a sanctioned state, or by individuals or entities linked to terrorist activities. It also includes software developed by individuals or entities under sanctions or using code or components subject to sanctions.
The State Service of Special Communications explained: “Legal entities will be prohibited from using programs created in the aggressor countries or related companies.”
Another sectoral sanction involves banning access to all internet resources and information systems originating from the sanctioned state. While earlier personal sanctions targeted specific internet resources, access to the .ru domain may soon be restricted.
Will there be time to replace it?
The current version of the draft law does not include a transitional period for replacing the software. However, the adoption of the law does not automatically impose sanctions. The decision to apply sectoral sanctions to a specific state is made by the National Security and Defence Council, enacted by the president, and approved by the Verkhovna Rada. Only then the use of hostile software will be prohibited.
At the same time, a transitional period for replacing software used by businesses may be determined by a presidential decree. The authorities will decide on the approach to take.
Responsibility
Currently, violations or circumvention of sanctions are not criminalised. EU countries must introduce such liability by May 2025 to comply with the EU Council directive. In Ukraine, the Ministry of Justice has announced its intention to submit a draft law to the Verkhovna Rada criminalising the violation or circumvention of sanctions.
If adopted, the law would also impose criminal liability for breaching or circumventing the ban on using sanctioned software.
The proposed amendments to the Criminal Code include liability for violations or circumventions of sanctions that result in serious consequences. This means not every violation will be criminalised. Serious consequences could include receiving a certain sum of money from distributing sanctioned software or using software intended for military purposes.
Challenging aspects
- Prohibition of Software Use and Criminal Liability: The prohibition on using software and the introduction of criminal liability represent legal pressure on businesses from law enforcement. This combination could provide the Security Service of Ukraine (SBU) with grounds for searches, equipment seizures, and investigations into the presence of sanctioned software. It is proposed that the SBU will be responsible for investigating sanctions violations. In practice, there is often a delay in returning seized equipment, leading to business disruptions.
- Unclear Definition of «Originating» from a Foreign Country: The amendments do not clarify what is meant by «originating» from a foreign country. Any software or its components could be re-registered or duplicated in a country that is not subject to sanctions. It remains unclear how the use of software that is a «twin» or has changed its country of origin will be monitored.
- Risk of Selective Prosecution of Ukrainian Companies: There is a risk of selective criminal prosecution of Ukrainian companies. The methods for tracking the use of hostile software by businesses are currently unclear, and it may lead to random checks of specific individuals. As a result, criminalising such violations could become a tool for law enforcement to exert influence over businesses that are under scrutiny.
Draft law status
The draft law has been registered in the Verkhovna Rada and submitted to the National Security Committee. In practice, the draft law may «linger» in the main committee for years. However, given the urgency of the issue, we can expect it to be seriously considered and included in the agenda.
Additionally, an alternative draft law has been registered. It proposes introducing the same sectoral sanction to ban software, but in a more limited form. However, there is no mention of banning the aggressor’s internet resources.
The benefits of the proposed changes are clear. Ukrainian businesses will be encouraged to switch to domestic software, which will help fill the budget and foster positive competition in the IT market.
The experience of 2017, when access to certain websites was partially banned, showed that within just two weeks, Ukrainians halved their visits to sanctioned resources. We expect that the complete closure of russian websites will yield even better results.
For Ekonomichna Pravda
