Ukraine Ukraine internet infrastructure Starlink dependency

Ukraine's Starlink Whitelist Worked. The Fix for Concentration Risk Is More Constellations, Not Public Control

The Pentagon confirms Ukraine retook ~400 km² after Russian Starlink terminals went dark — proof of the network's leverage and the case for backups.

The Whitelist That Moved a Frontline People of Internet Research · Ukraine ~400 km² Territory recaptured Ukrainian gains across Zaporizhzhi… ~75% Starlink traffic drop Decline in Starlink usage in Russi… <1,000 Eutelsat terminals in Ukraine Versus more than 50,000 Starlink t… peopleofinternet.com

Key Takeaways

On May 18, 2026, the Pentagon's Lead Inspector General quietly published the second-quarter report on Operation Atlantic Resolve. Buried in it is the single most consequential admission yet about how the war in Ukraine is actually fought. According to the Defense Intelligence Agency and U.S. European Command, Russian forces' capabilities were "temporarily yet significantly degraded" in February after Ukrainian officials, working with SpaceX, deactivated thousands of Starlink terminals that Russian units had been using to coordinate movements and direct unmanned-aircraft strikes. In the weeks that followed, Kyiv recaptured roughly 400 square kilometers — its first meaningful territorial gains since 2023.

That paragraph, lightly redacted in the IG report, doubles as a thesis statement about the wartime internet. A single commercial satellite network, owned and unilaterally controllable by one private company, decided who could communicate across part of a 1,200-kilometer front. The case for treating that as an unacceptable concentration of power is real and serious. The case for fixing it by nationalizing the network, or replacing it with a state-run multilateral substitute, is not.

The whitelist that moved a frontline

The mechanism was prosaic. On February 2, 2026, Ukraine's Cabinet of Ministers approved a resolution requiring every Starlink terminal operating on Ukrainian territory to be registered on a "whitelist" maintained jointly with SpaceX. Civilians register through Administrative Services Centers; businesses use the Diia eGovernment portal; military units use the encrypted DELTA battlefield-management channel. Anything not on the list — including the thousands of terminals Russia had smuggled in through Dubai and ex-Soviet jurisdictions on falsified paperwork — was cut off. Defense Minister Mykhailo Fedorov, who moved from Digital Transformation to Defense late last year, framed it bluntly in the Ministry of Defence's official announcement: "This is a response to russia's use of Starlink. russian drones equipped with terminals are difficult to shoot down."

The effect was immediate and measurable. Network observability data compiled by Kentik analyst Doug Madory and cross-checked against Cloudflare showed Starlink traffic in occupied territories collapsing roughly 75% on February 4 and never recovering past 25–30% of its prior baseline. By the time the Pentagon IG report was finalized in May, that drop had translated into recaptured villages across Zaporizhzhia and Dnipropetrovsk oblasts.

Steelman: why this looks like an argument for public control

If a U.S. company can unilaterally decide which side of a kinetic war has working communications, the argument goes, then satellite connectivity has become indistinguishable from a strategic weapon — and democratic societies do not let weapons sit in the hands of a single CEO. We regulate the export of cryptography. We regulate dual-use technologies. We have treaty regimes for nuclear material and chemical precursors. By that logic, Starlink is a textbook case for either common-carrier obligations, public ownership, or transfer to a multilateral body like NATO or the ITU. The 2023 reporting on SpaceX's refusal to extend coverage over Crimea during a Ukrainian naval-drone operation — a private company making what was effectively a real-time targeting decision — only sharpens the point.

That critique is not wrong about the diagnosis. It is wrong about the cure.

Why the cure is worse than the disease

A nationalized or treaty-controlled equivalent of Starlink does not exist and cannot be built on any timeline that matters. Eutelsat OneWeb, the only operating LEO alternative, has fewer than 1,000 user terminals on the ground in Ukraine against Starlink's 50,000-plus, and CEO Eva Berneke's stated near-term goal is 5,000–10,000 — a fraction of what Ukrainian medics, mayors, and battalion commanders already rely on. The EU's IRIS² constellation is contracted but not flying, with first services targeted for 2030. ITU-coordinated spectrum and orbital slots are allocated, not manufactured; you cannot multilateralize your way to launch cadence.

More importantly, the very feature that made the February whitelist possible — that one operator could distinguish authorized from unauthorized devices and act in 24 hours — is exactly what a sprawling intergovernmental body would lose. A NATO-run constellation would acquire thirty vetoes and inherit every member state's domestic dispute about who counts as an authorized user. Brussels would attach data-localization riders. Procurement would extend the deployment window by years. The wartime story of February 2026 is not "private control failed." It is "private control worked, on a timeline no public body could match, because a defense minister could pick up the phone."

The right lesson: redundancy, not replacement

The pro-innovation reading of the Pentagon disclosure is that concentration risk is real and the response is competition, not consolidation. That means three concrete moves.

First, underwrite a second commercial LEO operator on the demand side. Germany's quiet financing of Eutelsat terminals in Ukraine is the right model — public money buying private capacity, not public ownership of orbital assets. Brussels should expand the practice through the European Defence Fund and condition IRIS² contracts on interoperability with existing private constellations.

Second, codify dual-use rules of the road. A short, clear statute — not a 200-page directive — should require operators of dual-use satellite broadband above a usage threshold to publish their geofencing and service-denial policies and to notify customer-states before unilateral changes during armed conflict. This is FAA-style transparency, not common-carrier conscription.

Third, hard-wire Ukraine's whitelist into the playbook. The Diia/DELTA registration system Fedorov stood up in 72 hours is a reusable artifact. NATO members planning for contested communications environments should adopt the same registry pattern now, not after the next emergency.

The 400 square kilometers Ukraine took back in February were a gift from a working public-private relationship, not a vindication of unilateral corporate power. Preserve the former by building a second, third, and fourth Starlink — and resist the temptation to dismantle the first.

Sources & Citations

  1. DoD Lead IG, Operation Atlantic Resolve Q2 Report (Jan–Mar 2026)
  2. Ukraine Ministry of Defence — Starlink terminal verification rollout
  3. Ukrinform — Ukraine regains 400 km² after Russian forces lose Starlink access
  4. Militarnyi — Starlink data traffic in occupied territories drops 75%
  5. Kyiv Independent — Germany finances Ukraine's use of Eutelsat alternative