Ukraine's IT Army: What the 300,000 Volunteer Hackers Figure Meant

First published March 18, 2022.

Two days after Russia's full-scale invasion of Ukraine in February 2022, Ukraine's digital minister Mykhailo Fedorov announced an "IT Army" and invited volunteers worldwide to join a Telegram channel for cyber tasks. Within weeks the channel was reported to have around 300,000 subscribers, and that figure quickly became "300,000 hackers" in headlines. The reality was more modest and more interesting: a crowd of supporters, many of them not hackers at all, coordinating mostly simple attacks that knocked Russian websites offline, alongside a smaller core of skilled operators whose work is much harder to measure.

How the IT Army began

Fedorov, who was also a deputy prime minister, posted the call on Twitter on 26 February 2022. He promised that there would be tasks for everyone and that the first one was already waiting on the channel. Wikipedia's account notes that this was reportedly the first time a national government openly recruited hackers, hacktivists and ordinary computer users from around the world in this way.

We are creating an IT army. We need digital talents. All operational tasks will be given here: https://t.co/Ie4ESfxoSn. There will be tasks for everyone. We continue to fight on the cyber front. The first task is on the channel for cyber specialists.

— Mykhailo Fedorov (@FedorovMykhailo) February 26, 2022

The move followed an earlier appeal, reported by Reuters on 24 February, in which Ukrainian security figures asked the country's hacker community to help defend critical infrastructure. Accounts describe the effort as having two sides: an offensive group working against Russian targets and a defensive one helping protect Ukrainian systems such as power and water.

What "300,000" really measured

The number that made headlines in March 2022 counted subscribers to a Telegram channel. Joining a channel takes one tap. It does not show how many people actually took part, how often, or with what skill. Many subscribers will have been curious onlookers, journalists, researchers or sympathisers who never ran a single attack.

By early March, Wikipedia cites estimates of roughly 1,000 active Ukrainian and foreign volunteers. Treat both numbers with care: one is an audience, the other an early snapshot of participants, and neither tells us about results.

What the volunteers actually did

Most activity took the form of distributed denial-of-service attacks, known as DDoS. The idea is to flood a website with so much traffic that it slows down or goes offline. Volunteers were given lists of targets, mainly Russian and Belarusian state bodies, banks and companies, and used freely available tools to join in.

Reported targets over 2022 included the Moscow Exchange, Sberbank, the FSB security service, the Belarusian state news agency BelTA, the space agency Roscosmos and the Wagner Group. In September 2022, hackers claiming links to the IT Army and Anonymous were reported to have ordered dozens of Yandex taxis to one Moscow street, causing a traffic jam. Ukraine's digital ministry said more than 6,000 Russian web resources were attacked between late February and the end of July 2022.

Internet monitor NetBlocks observed outages on Kremlin and State Duma websites and at state media in the first weeks. Its director, Alp Toker, was quoted at the time saying the crowdsourced attacks had disrupted government and state-backed media sites.

Did it make a difference?

DDoS attacks are noisy and visible, but usually temporary. A site goes down for minutes or hours and then recovers, often after the target blocks foreign traffic. Several of the IT Army's most dramatic claims came from the group itself and were not independently verified. Security researchers generally see its value as partly psychological and political: it showed global solidarity, forced Russian organisations to spend effort on defence and kept the conflict in the headlines.

The cyber war ran both ways. Check Point Research reported that attacks on Ukraine's government and military sector rose by about 196 per cent in the first three days of the invasion. Russia generally denies carrying out cyberattacks, although Western governments have attributed many to Russian state units.

Volunteers came from many countries. One, who said he was Swiss, told The Guardian: "I wanted to help and use my attacking skills to help Ukraine." His hope that hacking Russian infrastructure might stop the war was widely shared and, in practice, unrealistic.

The legal and ethical risks

Joining attacks is not a harmless gesture. In most countries, attacking a computer system without permission is a crime, whatever the motive, and running DDoS tools can expose volunteers to prosecution or retaliation. Experts in international law also warned that civilians who take part in hostilities, including through cyber operations, risk blurring the line between combatants and civilians that the laws of war exist to protect.

In October 2023 the International Committee of the Red Cross published rules of engagement for civilian hackers, such as not attacking hospitals or causing civilian harm. The IT Army said it would follow them. This article is a record of events in 2022, not an invitation to take part in any operation.

Why the IT Army matters

The IT Army changed how people think about cyber conflict. A government openly crowdsourced cyber operations, used a messaging app as its command channel and drew in volunteers from dozens of countries. Researchers studying cyber warfare doctrine now treat it as a test case for questions that will come up again: who counts as a combatant online, how states should be held responsible for volunteer actions, and whether mass participation achieves anything beyond symbolism.

For readers, the main lesson is about numbers. Social media figures such as subscribers, followers and members measure attention, not action. Whenever a headline turns an audience into an army, it is worth asking what was actually counted.

Sources: Wikipedia: IT Army of Ukraine; Mykhailo Fedorov on X/Twitter, 26 February 2022. Earlier reporting by LADbible and The Guardian (15 March 2022); NetBlocks and Check Point Research figures as reported at the time.