The untold story of Ukraine’s Starlink crisis

The crisis in Ukraine over restrictions on the military use of SpaceX’s satellite constellation in the Russia-Ukraine war won’t be readily resolved. US lawmakers and the European Commission have now joined the fray, raising questions about the accountability of Trump administration officials and SpaceX executives. Nobody likes being held accountable, so even lifting the restrictions is unlikely to end the dispute. As is often the case in the Ukraine war, much of the commentary concerns less the facts than their fragmentary portrayal in the Western press. October’s events were only the second act in the Starlink drama. The first unfolded in July and passed unnoticed by the media and commentariat alike. At the heart of the Starlink drama lies an irreconcilable structural contradiction. A platform freely available to civilian users on a mass scale cannot reliably prevent malicious actors from exploiting its military capabilities. Either civilian purchase and use must be restricted, or the risk of abuse must be accepted, with consequences that are hard to predict and potentially severe. The prologue came in December 2025, when Russian forces began using Starlink to guide their military drones at scale, as Ukrainian forces had done successfully for years. Russia had used Starlink for stationary battlefield communications since the end of 2023 at the latest, and by 2025 the practice was widespread. The turning point came on January 26, when a Starlink-controlled drone circled over Kyiv unchallenged for several hours. Ukraine responded by introducing speed restrictions and a so-called “whitelist”, a wartime access-control system for this dual-use satellite infrastructure. Under rules in force since February 2, a Starlink terminal anywhere in Ukraine can operate only if its identifiers appear on the whitelist. Ukraine compiles the list of authorized terminals; SpaceX permits or blocks access at the network level. Civilians register their terminals through post offices and administrative service centers, while businesses, the military and other security services have separate channels. This arrangement applies only to Starlink, SpaceX’s publicly available civilian service. SpaceX administers access to its military counterpart, Starshield, separately. The technical specifics of how the two services are separated, including February’s restrictions, have never been disclosed. This fits the whitelist’s initiator, former Defense Minister Mykhailo Fedorov, favored approach: security through obscurity. It is a Victorian philosophy, which holds that if girls are never told where babies come from, none will ever arrive. The restrictions appeared to end Russian use of Starlink on drones almost overnight and sharply curtailed Russian capabilities along the front. Over the next five months, reports of Russia’s use of Starlink were scarce. The occasional discovery of Starlink terminals on Russian drones was put down to old stock fitted with terminals that no longer worked. In the early months, the Security Service of Ukraine, or SBU, reported fewer than 10 cases in which Russian-held terminals were registered or attempted to be registered. Those early cases generally involved casual recruits, small payments and only a handful of terminals. Western media, outside observers and the whitelist’s own authors took all this, and still do, as proof of unqualified success. Fedorov is so proud of the measure that he lists denying Starlink to Russian forces first among his achievements as defense minister. That is where the popular version of the story ends. In February, Aleksandr Turkhanov and I published a paper on the risks Starlink’s weaponization poses to maritime security. We examined Ukraine’s new restrictions and the prospects of denying a determined adversary access to this infrastructure’s military capabilities. Years of studying Ukrainian administrative procedures led us to predict that civilian registration would not reliably keep the adversary out, and to describe how it would likely be circumvented. In June, with little publicity and no explanation, Ukrainian authorities tightened registration procedures. Soon afterward, reports surfaced of Russian forces using Starlink terminals on the battlefield and in unmanned systems, including naval drones. The moment of truth came on July 24, when the SBU reported uncovering a scheme in which a postal employee helped register 76 Starlink terminals. The next day, the scale jumped to a previously unthinkable level: the SBU said it had caught a Russian agent who had registered more than 1,000 terminals. It must now be conceded that Russian forces are once again using Starlink. The scale and nature of that use remain unclear, but the whitelist can no longer be described as an unqualified success. That is what July’s crisis revealed. Ignorance of these developments makes it impossible to draw the right lessons. At best, commentators remark on the folly of relying on foreign digital platforms and call for technological sovereignty. More often, the story is reduced to a tale of a capricious oligarch who won’t let the good guys kill all the bad guys. Yet the lessons of Ukraine’s Starlink-Starshield crisis go much deeper, and its consequences reach much further. The events of July and October exposed the central problem with the world’s largest satellite constellation being widely and successfully weaponized. First, the Ukrainians made Starlink a key component of extremely cheap, mass-produced strike systems. That brought them phenomenal battlefield successes, including defeating Russia’s Black Sea Fleet. Then the Russians followed suit, closely copying the Ukrainian approach almost to the letter. Attempts to deny the enemy access to Starlink’s capabilities met with only limited, unreliable success. Finally, the current crisis has exposed the fragility of treating foreign technology platforms as indispensable elements of national military power. A second lesson concerns America’s failure to manage its own technology platforms once they become dual-use systems. Whether the two weeks of unseemly buck-passing between Elon Musk, the Pentagon and the Trump administration reflected the by-now-familiar administrative chaos or a calculated game of “strategic ambiguity” makes little difference. The result is an erosion of trust across the board: in SpaceX, US operators of low-Earth-orbit systems, in the wider US high-tech industry and in the US as a power with global ambitions. By licensing mass-market civilian satellite connectivity, Asian states acquire significant military capabilities along with the problem of controlling access to them. Ukraine’s experience shows the cost of tackling the problem after the fact. Governments in the region should already be developing access-control systems, ones that account for the threat of abuse by malicious actors. They should decide how much risk to accept, who may restrict access and who answers for those decisions, before the first serious incident forces them to act in haste and at considerable cost. Roman Khimich is an independent Ukrainian telecommunications analyst with more than 20 years of experience.