Ukraine's Ministry of Digital Transformation has tightened the rules governing who may keep a Starlink terminal switched on. Under an update to the country's satellite-terminal "whitelist" published on the Diia government portal, individuals must now present every terminal in person — not just their first one — at a Citizen Service Center (TsNAP), Ukrposhta branch, or Nova Poshta outlet, supplying both a KIT number (the factory serial on the box) and a UTID (the unique identifier found in the Starlink app). Companies, meanwhile, face a hard cap of 10 registered terminals unless they hold "critically important enterprise" status, and must now have existed in the Unified State Register for more than a year — up from just one month previously (Diia, "Оновлюємо верифікацію Starlink,"; Diia service page).
The Legal Basis
The whitelist itself dates to Cabinet of Ministers Resolution No. 115, approved February 1, 2026, which established the procedure for registering Starlink terminals during martial law and empowered the Digital Transformation Ministry to maintain a daily-updated registry shared directly with SpaceX (Cabinet of Ministers of Ukraine, Resolution No. 115). Only whitelisted terminals — plus devices used by the military, police, and security services through separate channels — are permitted to operate; everything else is disconnected. Defense Minister Mykhailo Fedorov, who announced the original resolution, called it "the only technical solution to counter the use of the technology by Russian forces" (Kyiv Independent).
The Case for the Crackdown
The strongest argument for this system is not abstract. Russian forces had begun fitting Geran kamikaze drones with Starlink terminals, giving them internet-grade guidance and control links that are far harder to jam than conventional radio, because the signal hops across a low-earth-orbit constellation rather than a single frequency a defender can target. One military drone specialist told Al Jazeera that after SpaceX cut off unauthorized terminals in Russian-controlled territory, those drones became "like blind kittens" — a real, if temporary, degradation of a weapon system that had been evading Ukrainian electronic warfare (Al Jazeera). A whitelist that requires physical verification and named accountability for every dish is a rational response to an adversary that had been smuggling and repurposing commercial hardware for exactly this purpose. No functioning state can leave a satellite-internet backbone that also carries military command traffic open to anonymous, unverified use in wartime.
Why the Design Still Matters
That said, the specific mechanics of this tightening deserve scrutiny, because Starlink in Ukraine is not a discretionary consumer product — it is, for large stretches of the front line and for civilians in de-occupied or contested areas, the only connectivity available. Requiring every individual to show up in person for every terminal, rather than just the first, adds friction precisely for users least equipped to absorb it: rural households, elderly residents far from a TsNAP, and small businesses near the line of contact who now must also prove a full year of registered existence. The Ministry says registration is free and "as simple as possible," and the option to verify at any Ukrposhta or Nova Poshta branch — rather than only at government offices — is a genuine concession to accessibility. But a 10-terminal cap for ordinary companies, with no general appeals mechanism described in the published procedure, risks catching logistics firms, hospitals, and reconstruction contractors that are not "critical infrastructure" by statute but that need more than 10 links to operate across multiple sites near contested territory.
The Better Fix Is Faster Classification, Not Fewer Rules
The policy answer here is not to loosen verification — the security case for that is thin given what Russian forces were doing with unregistered terminals. It is to make the "critically important enterprise" designation itself fast and transparent, so legitimate high-need users are not forced to either break the cap or go dark. Ukraine's government has, to its credit, already iterated on this rule twice within the year — first launching TsNAP-based registration in February, then adding Ukrposhta/Nova Poshta verification points and online terminal-deletion tools for both individuals and companies. That is the right instinct: treat the whitelist as a live system to be tuned against real friction data, not a one-time lockdown. The daily sync with SpaceX also means enforcement can be as fast as the paperwork, which argues for the ministry publishing turnaround-time data for critical-infrastructure applications the same way it already publishes registration status ("Saved" vs. "Rejected") for ordinary terminals.
The Wider Lesson
The episode is also a reminder of the dependency this newsletter has flagged before: Ukraine's frontline connectivity runs through a single private constellation whose commercial terms, technical changes, and access decisions sit outside Kyiv's control. A whitelist tightened unilaterally by Kyiv is a sovereign, defensible act of network hygiene. But it does not change the underlying fact that when SpaceX chooses to throttle or restore access — as it did to Russian-linked terminals this February — an outcome with direct battlefield consequences is being made by a private company, not a state. Proportionate domestic regulation of who may use the terminals is sound policy; it does not substitute for the harder, longer-term question of diversifying Ukraine's satellite-connectivity options so that no single vendor holds this much leverage over a democracy's ability to communicate in wartime.