A 0.8-second test packet has exposed a startling failure in Ukraine’s national cyber-reporting network: messages logged as shared between agencies were looping back to their senders. The network’s own figures marked 12,806 reports as delivered since January, but a check by Kyiv-based researchers found that 97% had not reached a second agency.
The result, recorded on 21 October, came from a routine measurement of the Kolo Relay system, used by 64 municipal cyber-response desks to pass on reports of software outages, phishing campaigns and suspicious network activity. Researchers say the test showed that a “receipt” from a server could be counted as delivery, even when no other office had received the report.
A receipt mistaken for delivery
Kolo Relay was built by Obert Systems, a fictionalised-sounding but locally registered software contractor based in Dnipro, and introduced in 2024. Its dashboard gives each report a green status once the sending desk receives a server acknowledgement. The test found that the acknowledgement could return from the sender’s own system, completing a loop while the report remained unseen elsewhere.
“We sent one harmless test message and watched the system congratulate itself,” said Ethel Dare, a systems engineer with the Kyiv Civic Technology Lab, which conducted the check. “It was not a network-sharing tool. It was a mirror with a delivery badge.”
It was not a network-sharing tool. It was a mirror with a delivery badge.
Ethel Dare, systems engineer
The lab used timed test messages and matching digital fingerprints to track whether a report arrived at a second desk. In 97 of every 100 trials, the sender’s dashboard changed to “delivered” within a second, but the receiving desk had no matching record. Researchers say the result was consistent across 18 regions and three versions of the software.
Agencies demand a fix
The failure does not mean every report was lost: teams could still contact one another by phone or through separate channels. But municipal responders say those workarounds are slower, difficult to search and unreliable when an incident affects several cities at once. Harraz Hafizam, who coordinates a cyber-response desk in Kharkiv, said his team had relied on the dashboard to decide which neighbouring offices had been told.
“We were looking at green marks and assuming the other side had the same information,” Hafizam said. “If a report matters, the difference between ‘sent’ and ‘seen’ is not a technical detail. It is the whole point.” The lab said it found no evidence that anyone had deliberately altered reports or exploited the flaw.
A spokesperson for the state’s digital-resilience office said the network had been placed under review and that agencies were being told to confirm urgent reports by a second channel. The office said Obert Systems had been asked to disable the automatic delivery indicator until it could demonstrate that acknowledgements came from a separate recipient.
Obert Systems said its software had “processed messages according to the configured protocol” and that the company was working with the state office to correct how delivery was displayed. It did not say how many reports had failed to reach another desk, or whether customers had been warned before the researchers’ test.
The state office has ordered a 30-day review of the network and said it will publish revised delivery rules by 24 November. Dare’s team wants the new system to show three separate stages—sent, received and opened—rather than treating a server response as proof that another agency has the information.
