An analysis of the activity of the use of the aggressor country's information resources by university educational process participants in 2021-2023 was carried out. Changes in the use of various resources before and after Russia's large-scale military attack on Ukraine are determined. Threats of using Russian information resources and data exchange systems are analyzed using Telegram as an example.
The VNS system on the Moodle platform is actively used throughout the academic year 2021-2023. VNS (https://vns.lpnu.ua/) users are all teachers and students of the Lviv Polytechnic National University. The total number of VNS users exceeds 30,000.
Google Analytics was used to obtain information about visits to the VNS website, count the number of user sessions, and analyze the sources of transitions [14. 23]. Google Analytics statistics do not include traffic from robots, crawlers, and other technical traffic to the VNS website.
For comparison, the indicator of the share of the number of sessions [2, 11] to the total number of
users’ sessions and the change of these indicators during three periods was used:
1. “I semester”. Academic year 2021/22 Fall semester (before the full-scale invasion of 2022).
Sample behavior of VNS users before a full-scale intrusion.
2. “II semester”. Corresponding autu
For further analysis, it is important to determine the means of communication used by users and the information resources from which users go to VNS.
More than 57% of user transitions to the VNS website do not have information about the external source of the transition (references). Most of them are direct transitions or transitions with missing information about the source.
Other options for hiding information about the source of transitions are: determining that source is a Proxy address, VPN, browser manufacturer's site, local network address, etc.; identification that source is a Browser hijacker or it`s search engines; identification that source is a technical address related to cyber attacks.
The distribution of unknown and hidden sources is shown in Table 1.
Let's consider the sources of transitions to the VNS website from identified sites, means of communication (mail systems, messengers, social networks, etc.), and means of e-learning and group work.
The diagram (Fig. 2.) shows the shares of the number of VNS users sessions for which the transition sources were various sites during three semesters. Search engines, direct links, local network addresses, etc. are excluded from the data in Fig. 2.
More than 61% of the sessions in Fig. 2. started after the transition from university sites, more than 13% from the Telegram messenger controlled by Russian representatives, 8.67% from e-mail services, and 1.85% from Russian sites and systems excluding Telegram.
The diagram (Fig. 3.) compares the number of sessions with defined user transitions during
particular semesters o
Taking into account the transitions of the university website and university divisions, the dynamics of changes in the frequency of various transitions sources use over three semesters is presented in Table 3. 5,23
Resources controlled by Russia (Telegram)
Websites of teachers and students
While the usage of Russian sites in Ukraine is gradualy decreasing, the growth of Telegram use is a reason to concern about.
The following sources are attributed to Telegram resources in the received transition data: transitions from mobile clients, desktop version of Telegram, and web version; transitions from unofficial and alternative clients; transitions from the telegra.ph blog platform developed for Telegram.
The following domains were used to identify transitions: “web.tlgrm.app” “web.telegram.org” “telegra.ph” “webz.telegram.org” “т.online” “телеграм.онлайн” “webogram.ru” Other Russian sites and means of communication identified in the study include: Yandex search engine and portal resources (yandex search sites from UA, RU and other national domains); Yandex email system; Email and sites of the domain *.mail.ru; Site top-page.ru; Vkontakte social network (website vk.com).
The study also found a small number of transitions from other sites in the RU and SU domains.
The study found that Telegram is the most popular communication service for sharing links to educational materials among university students and teachers. Even university corporate services (Email and MS Teams) are not used as actively as Telegram for exchanging links to educational materials and VNS resources.
Telegram's popularity increased after the Russian attack in 2022. Unfortunately, this popularity is a general trend in Ukraine.
The Telegram owner and team are formally independent of the government and the Russian Federation and call themselves an independent international company. Researchers of Telegram's development history and financing point to Telegram's dependence on Russian funding. The studies also provide information on Telegram's possible cooperation with security organizations of the Russian Federation (Federal Security Service, FSB, Federal Service for Supervision of Communications, Information Technology and Mass Media, Roskomnadzor) [17. 19, 25].
Telegram provides additional means of authenticating users and obtaining their biometric and passport data [6].
Security components of cryptographic protection and the MTProto protocol are discussed in [3, 6]. Researchers consider custom-designed encryption protocol MTProto to be a theoretical vulnerability [16].
System problems with data security in Telegram are presented in works [7, 20,24]. General issues of personal data protection of Telegram users are considered in [2, 4, 15].
The problem for Ukraine is the spread of fake news and propaganda of violence against Ukrainians in Telegram. Since 2014, Telegram has been regularly accused of promoting propaganda and information manipulation, influencing Ukrainian politics [8, 26].
The set of technical problems with the security of the Telegram platform and the facts given in the literature about the concealment of Telegram's connections with the authorities of the aggressor country indicate a risk for users of the university and Ukraine.
The habit of using Telegram at the university further increases the risks for the personal data of university graduates and the possibility of their manipulation by the aggressor country.
Russia's major aggression against Ukraine in February 2022 caused systemic social and technical communication problems. Due to hostilities, forced migration, lack of electricity, and access to the Internet, university students and teachers have changed information sources (communication platforms). It is confirmed by change of the ways students access the educational materials (VNS website).
Analysis of the collected data shows the following trends after the full-scale invasion of Russia on February 24, 2022: a significant change in the popularity of means of communication and typical Internet services by users of the VNS; decrease of transitions from e-mail by 2.6 times (possibly due to competition with Telegram); growth in the use of educational tools by 2-3 times; growth of transitions from university sites by 6-6.2 times; a significant increase in the use of Telegram by 12-15 times; reduction of switching from other Russian services by 7.3 times.
Positive trends are an increase in the use of university resources, teachers, or specialized communication systems in which classes are held. Also, the good news is the decrease in the use of Russian sites and services as search engines and means of exchanging links or information.
A negative trend is a significant increase in the use of Telegram services in Ukraine and the educational environment. The Telegram platform is considered as system with significant risks for user information and flaws in encryption algorithms. Telegram is also accused of having ties with the authorities of the aggressor country and concealing funding.
[1] A. Andrukhiv, D. Tarasov, M. Sokil, The system of information providing of educational
process in university, in: Proceedings of the 13th International Conference on Modern Problems
of Radio Engineering, Telecommunications and Computer Science (TCSET), Lviv, Ukraine,
2016, pp. 828-830, doi: 10.1109/TCSET.2016.7452197.
[2] A. Peleschyshyn, R. Korzh, O. Trach, M. Tsiutsiura, Building of Information Activity
Management System of Higher Educational Establishment in the Social Environments of the
Internet, in; 2019 3rd International Conference on Advanced Information and Communications
Technolo
URL: https://nixsanctuary.com/dear-telegram-stop-calling-cloud-chats-encrypted-let-aloneheavily-encrypted/. [8] D. Plakhta, Telegram as a tool for political influence and manipulation, TV and Radio
Journalism 19 (2020) 88–94. doi: http://dx.doi.org/10.30970/
D. Tarasov, O. Peleschyshyn, Experience in solving the problems of overloading the
distance learning system during quarantine [Dosvid vyrishennya problem perenavantazhennya
systemy dystantsiynoho navchannya pid chas karantynu], in: Proceedings of the 10th
International Academic Con
D. Tarasov, Z. Koval, M. Klymash, Efficiency evaluation of using social networks application in the university e-learning system, CEUR Workshop Proceedings 2392 (2019) 1222.
T. von Arx, G. Kenneth, G. Paterson, On the cryptographic fragility of the Telegram
ecosyste
Tokar.ua, Cooperation with the FSB and servers in Russia - What's wrong with
Telegra
Y. Vinnichuk, How did a network of anonymous Telegram channels appear in Ukraine [Yak v Ukraini ziavylasia sitka anonimnykh Telegram-kanaliv Dzherelo: https://biz.censor.net/r3151221], 2019, URL: https://biz.censor.net.ua/resonance/3151221/ yak_v_ukran_zyavilasya_stka_anonmnih_ telegramkanalv. [in Ukrainian].