At a small anniversary display in Dnipro on Monday, residents examined a scorched router and a timeline of the 11-hour signal blackout that disrupted municipal services on 26 October 2022. The city had blamed damaged equipment and unstable power. A new audit says the relay provider, Kestrel Arc, was also sending location records from thousands of terminals to a Prague-based analytics contractor.
The telecom regulator’s review counted 32,418 location pings from 1,106 devices, including terminals used by city departments and local businesses. It found that the copies were retained for 14 months and that device identifiers could be matched to customer accounts. The audit does not say the data were used to track anyone, but says the company’s privacy controls failed.
A copy beyond the city
The anniversary brought the finding to light after the city archive published the blackout’s service timeline and procurement records. Viktorija Nikolić, a municipal records officer, said the archive’s list of affected terminals did not match the provider’s public account of how many devices had been involved. The regulator then compared those records with a technical review commissioned by the city.
That review found a diagnostic setting that copied location pings to an overseas contractor whenever a terminal reconnected after losing service. Kestrel Arc described the setting as a temporary tool for mapping weak coverage, but its configuration remained active for 14 months after the blackout. The audit found no evidence that the copies were deleted when the repair work ended.
“We were told the silence came from broken equipment. Now we know the network was also making a map of who came back online.” — Viktorija Nikolić, municipal records officer
Kestrel Arc’s communications director, Conny Josefsen, said the data were collected to improve service and were not sold. “The contractor was bound by a confidentiality clause, and we have found no indication of onward transfer,” she said. The company has disabled the setting and offered to notify customers whose terminals were included in the export.
Who could see the traces
The regulator’s report says the contractor received device identifiers, connection times and coordinates precise enough to distinguish nearby buildings. It found that the provider had described the data as “pseudonymised”, although a separate account table could reconnect the identifiers to subscribers. The regulator has given Kestrel Arc 30 days to explain why that table was accessible to the contractor.
Venkat Jaggi, a data-security specialist who reviewed the audit for the city, said the files did not include message content. But location records can still reveal patterns, he said, especially when a terminal appears repeatedly at the same municipal depot or office. “Removing a name is not enough if the route still points to a specific door,” he said.
The city council has paused negotiations on a 48 million hryvnia (about €1 million) extension of its service contract while it considers whether to seek compensation. Kestrel Arc says it will cooperate with the regulator and contest any claim that the data were improperly shared. The regulator can impose a fine, but has not yet announced one.
At the anniversary display, the old router sat beside a handwritten list of public buildings that lost service in 2022. Nikolić said the city would add the audit’s findings to the archive once the regulator completes its review. For residents who came to remember a blackout, the date now marks a second failure: the network kept working, but its records travelled somewhere they were never told about.
