Screenshot from Euronews YouTube channel showing how people in Kyiv seek shelter in the subway while staying informed via mobile internet. In Ukraine, the internet has become the major front of defense against the Russian invasion. It is how the military informs Ukrainians about incoming Russian attacks, how humanitarian aid is organized, how cyber vigilantes are brought together, and how the rest of the world learns about the war. It has become Ukraine’s most prominent weapon, dominating the narrative of the war and resisting Russian disinformation. The internet is also the way Western companies like Microsoft have been able to analyze and patch vulnerabilities in Ukraine’s networks, creating an effective defense against Moscow’s cyber attacks. Many experts have been asking why Russia has not tried to destroy Ukraine’s internet infrastructure. In 2014, Russia’s control of Crimean internet networks was one of the primary causes for the peninsula’s successful referendum to join the Russian Federation. Moscow expected a similar maneuver to work during its invasion of Ukraine. Since February 24, Vladimir Putin has relied on the Ukrainian internet to organize domestic opposition to Volodymyr Zelenskyy and urge Ukrainians to take up arms against their own government. While Russia’s narrative has not been heeded by most Ukrainians, it has convinced some to assist the Russian military by marking landing ground and bombing targets. If the war drags on and Russia remains unable to control the narrative inside of Ukraine, it could target central telecommunication infrastructure. So far, much of Russian military maneuvers have been centered on Ukraine’s urban internet hubs. In anticipation, companies and governments across the world have helped to strengthen Ukraine’s communication networks. United States business magnate Elon Musk donated an unknown number of Starlink satellite communication systems in case of major disruption to the internet. European telecom operators have offered free services to Ukrainians. While kind and helpful, these gestures will prove ineffective if Russia decides to target fiber optic and undersea cables. Cyberspace can be best understood through three layers. The most fundamental layer is the physical infrastructure: submarine fiber-optic cables, and satellites that transmit data. The second layer is made up of the protocols that allow computers and subnetworks to communicate with each other: TCP/IP, Border Gateway Protocol (BGP), and the Domain Name System (DNS). Both of these layers are extremely vulnerable to manipulation. Fiber and undersea cables can be bombed; DNS servers can be hacked; IP traffic can be rerouted. The final layer is made of the ultimate destinations that users are most familiar with: government websites, Telegram, Facebook, etc. This is the most resilient layer because sites can be mirrored, misinformation deleted, and hacked pages quickly restored. VPNs (Virtual Private Networks) that operate on the second layer can be used to bypass restrictions to websites on the third layer. The primary layer, the physical infrastructure, has the most potential to influence the dynamics of military conflict on the ground. The main role of internet nodes is to house “autonomous systems (AS), a collection of connected Internet Protocol (IP) routing [nodes] that network operators control, which defines routing policy to the internet.” Control over the AS allows the operator to restrict or reroute the path of data. If Russia took control of Mariupol, Zaporizhia, Dnipro, and Odesa, they could almost fully control the flow of Ukraine’s internet traffic. On February 24, the day of Russia's invasion, Ukraine faced widespread internet outages. The Triolan internet service provider, servicing most of Ukraine and particularly Kharkiv, faced partial outages due to cyber attacks on its facilities. Triolan’s DNS servers, which route device traffic to websites, were partially jammed. Since the war began, Ukraine’s internet has stayed mostly intact, and outages remain local. When Russian forces occupied Zaporizhzhya on March 7, they disconnected mobile and internet networks. Zaporizhzhya is home to Europe’s largest nuclear power plant and is one of Ukraine’s main telecommunication nodes. After the occupation, the International Atomic Energy Agency reported “phone lines, as well as e-mails and fax, were not functioning anymore” preventing communication with the nuclear power plant. In order to fully disconnect Ukraine’s internet networks, multiple ISPs across the country must be disrupted. This is possible either through sustained cyberattacks or direct bombing. Lanet, a Ukrainian broadband provider, suffered outages in the city of Sievierodonetsk when its cables were damaged during combat.