The Case of Hacker Lawyers. How NABU Found Parasites

The National Anti-Corruption Bureau (NABU) has announced suspicion to three lawyers of the Guarantee of Your Rights company. They are accused of systematic illegal interference in the work of the Unified State Register of Court Decisions (USRCD). The defendant in the case is the head of the firm, Dmytro Borzykh, who used to be the right-hand man of Anatolii Matios, the chief military prosecutor. The scale of the uncovered scheme is comparable to the largest corruption scandals in Ukrainian judicial history, from the Vovk clan to the Kniazev case and the mafia of economic courts during the Yanukovych era.

According to the investigation, lawyers, including the aforementioned Borzykh, had unauthorized access to the materials of court decisions on at least 100 criminal proceedings of law enforcement agencies, including 30 cases of NABU on corruption among high-ranking officials. In other words, this is not a private episode but a deep crisis at the intersection of justice, digital security and anti-corruption control system. It shows that the system has been invaded — invaded by parasites that suck out not only documents but the very essence of the legal profession, legislation and law as such.

First of all, the cluster of anti-corruption institutions itself is in jeopardy. The gross violation of investigative secrecy has led to the leakage of confidential information, warnings to clients about searches, destruction of evidence, falsification of expertise and bribing of judges. These actions undermine the legitimacy of investigations and pose a direct threat to the security of the state at war.

Secondly, the situation reveals a profound crisis of lawyers' self-governance and a decline in professional standards. There is neither internal reflection nor readiness for self-purification. The Ukrainian National Bar Association (UNBA), headed by Lidiia Izovitova, stood up for the defendants by filing a petition with the Office of the Prosecutor General, demanding that a case be opened against the NABU detectives, allegedly for “violation of attorney-client privilege.” It is now being investigated by the SBI.

Thirdly, the Borzykh case is another marker of how the authorities, led by the Presidential Office, take advantage of the institutional chaos in the judiciary and law enforcement system. Instead of restoring control with constitutionally permissible tools (particularly laws), the Presidential Office prefers to manage this chaos for political and economic dividends. The figure of Oleh Tatarov, who has been repeatedly mentioned in journalistic investigations as an informal coordinator of the security and law enforcement agencies, only reinforces this feeling. This is all the more so considering Borzykh's active contacts with both Tatarov and other people from the president's entourage.

The Borzykh case allows us to once again point out systemic pathologies in justice and capture personal responsibility in wartime conditions, when the destruction of institutions assumes strategic importance for the state.

The essence of the case and the undermining of the anticorruption cluster

The vast majority of the lawyers of the Guarantee Your Rights company are former employees of the military prosecution and the Office of the Prosecutor General. On May 15, 2020 Anatolii Matios and 14 other prosecutors received lawyers' licenses by decision of the Bar Council of the Volyn region. After complaints from colleagues about violations in admission and examinations, a working group was created, and the High Qualification and Disciplinary Commission of the Bar of Ukraine canceled their results. However, the ex-prosecutors challenged this in the courts and won. After the decisions of the district administrative courts, the head of the UNBA, Lidiia Izovitova, did not file a cassation appeal to the Supreme Court. Why? The question remains open.

In 2020, the newly minted lawyers — former military prosecutors — founded their own law firm. According to ZN.UA sources, by 2022, they found an “exclusive” way to protect their clients with the help of hacker Kostiantyn Saibel. In 2019, he was sentenced to two years of probation in the case, which was then investigated by the same future lawyers of the Guarantees of Your Rights company. A few years later, they gave him a key role in their “digital scheme.” Saibel penetrated state registries and collected classified information, including on movements of the current head of the Main Intelligence Directorate. According to sources, it is likely that some of the cases to which the lawyers gained access and from which data was leaked to clients are now being investigated by the Security Service. The scale of threats to the state, which Borzykh and his associates created by trading official information, is anyone’s guess.

It is important to understand this: the investigation into the activities of the group, qualified by the NABU as “criminal” (under suspicion today are lawyers Dmytro Borzykh, Andrii Filiuk and Maksym Komarnytskyi; detectives pay special attention to six of the twenty employees of the office), began in 2023. At that time, the Bureau's detectives regularly encountered information leaks in a number of criminal proceedings. Here is just one example. On October 4, 2023, the investigating judge of the High Anti-Corruption Court (HACC) issued a ruling on searches of residential and office premises in the case of former Minister of Agrarian Development, Mykola Solskyi. NABU and the Specialized Anti-Corruption Prosecutor's Office (SAPO) soon detected a leak: one of the offices promptly shut down its work, the defendants changed their phones and reinstalled messaging apps. As it later became known, the lawyers illegally viewed about 100 court decisions issued in the framework of this proceeding, all for the sake of their client.

The list of cases in which the lawyers had a hand —as participants in the process or as shadow counselors — includes quite well-known names: Ihor Kolomoiskyi (oligarch), Borys Kaufman (real estate developer in Odesa), Dmytro Isaienko (real estate developer, former official of the Ministry of Regional Development), Hryhorii Kozlovskyi (Lviv businessman, supervisor of an underground tobacco business), Bohdan Yakymets (criminal fixer (reshala), who is associated with “servicing” the cases of top corrupt officials), Oleksandr Nasikovskyi (co-owner of DIM Group), Oleksandr Hranovskyi (former MP, businessman from Petro Poroshenko's entourage), Kyrylo Shevchenko (former head of the National Bank, wanted), Vadym Novinskyi (businessman, former MP, former shareholder of Metinvest, associated with the Ukrainian Orthodox Church of the Moscow Patriarchate). There are also NABU cases on State Special Communications Service of Ukraine, National Cinematheque of Ukraine, etc. In each of these proceedings, the investigation has lost part of the evidence. In some of them, according to sources, the key ones.

The NABU had several versions of the origin of the leaks. It was within the framework of one of them — by the decision of the investigating judge — that a wiretap was installed in the office of the law firm. (The lawyers of the defendants are now trying to challenge the legality of the wiretap, but the case opened by the SBI based on their tip-off and on the initiative of the UNBA will not have any consequences for NABU).

Investigative activities of NABU lasted a month and a half, from mid-November to the end of December 2023. Everything happening in the office was recorded in real time. However, according to our interlocutors in law enforcement agencies, the investigative work had to be terminated prematurely due to force majeure: against the background of the well-known scandal in the media around the wiretapping in the office of Valerii Zaluzhnyi, the defendants became vigilant and invited technical experts. Detectives had to act earlier than planned. Then the office of the company and a number of lawyers were searched. In the course of further investigative actions, so too was their hacker accomplice. Electronic devices were seized, including phones and laptops of Saibel and lawyer Andrii Filiuk. (According to sources in the National Police, Saibel managed to flee Ukraine last September.)

The investigation lasted a year and a half. After the recent announcement of suspicion, a version emerged that the NABU had been under pressure from the Presidential Office all this time and allegedly decided to bring less severe charges, despite the fact that the recordings made during the month and a half of wiretapping provide grounds for much greater liability.

Let me explain. According to our information, two criminal proceedings were initially opened against Dmytro Borzykh and his associates under the following articles of the Criminal Code of Ukraine:

1) receipt of improper advantage by officials (part 3 of Article 28, part 3 of Article 368);

2) interference with the work of automated workflow systems of courts (part 2 of Article 376-1).

Both proceedings are united by the prosecutor. This is the reason why the Borzykh case is directly under the jurisdiction of NABU, which is what the defendants' lawyers are now trying to contest.

Qualifying the episodes of bribery, detecting each case and proving guilt requires a long operational work and much more resources than NABU has today. According to our interlocutors, such work requires at least ten detectives.

As far as we are aware, the two criminal proceedings were conducted in parallel. However, after the premature operation and seizure of equipment, the investigation managed to collect enough evidence to issue notices of suspicion to three defendants for the episode of interference with the register. Investigation of other episodes, including corruption, is ongoing.

According to our sources in law enforcement agencies, during the investigation there were also recorded signs of preparation to provide improper advantage, both to the judge and experts, for a judgement that could form the basis of an acquittal. On these facts, a separate proceeding was initiated, which was later merged by the prosecutor with the main one. As ZN.UA previously reported, after the resignation of the odious Oleksandr Ruvin from the post of head of the Kyiv Research Institute of Forensic Expertise, Borzykh retained his influence in the Institute. As our our sources in law enforcement agencies claim, the scheme of buying up and reselling expertise by his team continued to work.

“To obtain classified information, the lawyers used not only digital tools but also simple human connections,” the source says. “Bribed judges, their assistants and court staff systematically informed the lawyers about the search requests filed by the investigation. Borzykh had quite stable contacts with Pecherskyi and Shevchenkivskyi courts in Kyiv. Moreover, the chairman of the Pechersk court Ruslan Kozlov is his cousin.”

(I should note that in the process of preparation of the material I asked lawyer Vladyslav Kulinich for a comment. The computer of his client Andriy Filiuk, according to the investigation, became one of the key sources of information that allowed painting a general picture of the events under investigation. No reply was received. Nevertheless, the defense is actively using media platforms affiliated with the group to promote its position and “whitewash” the defendants.)

The investigation was conducted in several stages, each focusing on separate tasks. According to our information, not all of them were solved.

Data Analysis. The full scheme of digital interference in the register was recreated only in the mid-2024, when specialists of NABU and Cyberpolice hacked into the laptops of the defendants. According to one of the sources in the law enforcement system, the work with the seized devices took about six months. Only after repeatedly analyzing the audio recordings and comparing them with the actions in the register were investigators able to understand how the scheme was organized: who coordinated it, who executed it, how the data was transmitted and what impact it had on the investigations.

In January, investigators seized additional materials from the provider: a fragment of the digital infrastructure was located on its server. Despite the partially deleted data, specialists managed to restore the work of the software script. This was the BAS system, a fully automated platform for accessing the Unified State Register of Court Decisions. It was installed both at the hacker's place and on the server. Authorization took place allegedly through the LIGA:ZAKON platform using the login and electronic key of one of the judges.

According to our sources, the attackers probably used the login of a judge of the Shevchenkivskyi Court of Kyiv, presumably Vasyl Voloshyn. The judge himself claims that he allegedly was unaware of the use of his data. Investigators will have to find out whether this is true and whether he passed the login to third parties, particularly his assistants, or whether the key was compromised in some other way.

The algorithm of access were well-honed. The hacker monitored the system on a daily basis, manually updated it and built a Telegram bot that allowed looking for court decisions by keywords. Authorization took place through a proxy server abroad: the request was transmitted to the registry, the necessary decision was opened and returned to the user.

From the laptop of Filiuk, it became clear to the law enforcers that each user of the bot accessed the cases he or she was interested in — by surname, number or keyword. The system filtered and gave the desired result with a full text. Automatic monitoring was launched every 12 hours, covering more than 10,000 decisions for 18 months of operation.

Based on the results of the analysis, the investigators recorded more than 600 decisions for which a targeted search was conducted. In total, the system conducted more than 39,000 automatic queries and provided access to more than 7,500 court decisions.

On some days the number of unauthorized actions in the register exceeded 1,000 requests.

According to our information, lawyers were interested in the decisions of judges concerning not only searches but also temporary access, preventive measures, arrests (including property) in criminal, civil, administrative and economic proceedings. However, criminal cases involving corruption among high-ranking officials are their priority.

According to our information, more than 600 illegally downloaded decisions were stored on Filiuk's computer. Sources say that one thing is obvious for the investigators: the work was coordinated by the head of the group, Dmytro Borzykh, who set tasks and controlled the result. He did not meddle in the system himself.

As one of our interlocutors noted, it is only on the basis of the volume of requests that one can estimate the scale of the operation. If we assume that the average cost of searching the register for information about planned investigative and procedural actions for the persons involved in the investigations was about $10,000 (according to people who know the market), then, multiplying this amount by the number of unauthorized actions, it is easy to calculate the bottom line.

The key job of the investigators was to match each inquiry and reviewed decision with the conversation recorded in the wiretap so as to tie the digital trail to a specific client, case and episode. And to confirm this with the conclusions of the phonoscopic examination (the wiretap materials contain thousands of conversations), which should become one of the key pieces of evidence at trial, together with evidence of interference of about 2,500 pages.

Formal examination. Although the wiretap was completed back in late December 2023, the examination was not scheduled until November 2024. Why not sooner? There are several reasons, including the considerable amount of material, the need to assemble it into a coherent picture, red tape and resistance within the system. Initially, the audio recordings were submitted for phonoscopic examination to the Center for Forensic Expertise of the Ministry of Internal Affairs. However, in January 2025, the experts reported that they could not give an unambiguous conclusion, allegedly due to technical incompatibility of the firmware. This decision looked dubious: by that time, the investigation already had a clear picture — conversations, actions recorded in the register and a link to the accused.

After that, the records were transferred to the Lviv Research Institute of Forensic Expertise, subordinate to the Ministry of Justice. It was then, as we have already reported, that the specialized deputy justice minister was pressured by the Presidential Office to delay or disrupt the examination. Nevertheless, the Lviv experts did their job professionally and eventually recognized the recordings as authentic, providing a legal basis for the next stage of the criminal proceedings. (At the time of publication, our sources in law enforcement agencies reported that the methods of pressure applied to the experts and the deputy minister were quite “inventive.” Andrii Haichenko was “exposed” on the Borzykh-controlled website UNN (Ukrainian National News). Back in 2017, colleagues from Bihus.Info reported on this connection at length. Threats were made — up to “sending the deputy to the frontline.” Quite an arsenal for a law firm. According to sources, similar methods were used against an expert who, after signing the examination report, was detained by employees of the territorial recruitment and social support center at the exit from the institute. The expert, who was exempt from conscription, stayed at the military registration and enlistment office until 3 am. According to our interlocutors, the examination was completed three days earlier, and the plan of forcibly sending the deputy to the frontline had to be implemented in a frantic mode. People familiar with the situation claim that the entire operation was personally supervised by Oleksandr Poklad, deputy head of the Security Service of Ukraine.)

Legislative Loopholes. Since the implementation of the operation in 2023 and the seizure of the materials, the investigation has managed to effectively block the operation of the scheme. However, this story is not just about an unmasked group. It is also about systemic vulnerabilities that require an immediate legislative response.

Today, all judicial acts, including pre-trial decisions, are published in the public domain. The Unified State Register of Court Decisions is accessible to judges, investigative bodies, prosecutors and others. This makes the system vulnerable to abuse. Human error and the lack of protection of access channels allowed attackers to use a judge's electronic keys to obtain information and resell it.

For specialists, it is obvious that access to pre-trial decisions should be closed. The publication of such data should take place only after the start of the trial. It is worth recalling that the new High Council of Justice tried to restrict access to these materials, but the Grand Chamber of the Supreme Court overturned the decision of the High Council of Justice, thus leaving a loophole, which continued to be used by participants in the scheme. Someone else may still be using it.

The specialized parliamentary committee is well aware of the problem. Its chair, Denys Maslov, registered a compromise bill No. 7033-d in 2023 to patch the holes in the system. In 2024, the document passed the first reading. But no further steps were taken. Without a signal from the Presidential Office, MPs do not dare to eliminate the loopholes through which justice is leaking out.

In addition, there are still unsafe markers in the interface of the register and on the websites of courts. For example, each court decision contains a case number, and the court websites feature information on which judge the case is assigned to and who initiated the petition. This is enough to track the logic of case allocation and workload, whether it is a search or another investigative action. All this should also be removed from public access.

Despite the suspicions, the law firm, according to our data, continues to work: its connections in the courts have not gone anywhere. And Dmytro Borzykh, who was released on bail of UAH 10 mln by a judge of the High Anti-Corruption Court, continues to boast about allegedly having his associates in NABU, who “continue to solve their issues.” It is indeed impossible to completely rule out information leaks from the anti-corruption bureau. But it is also impossible to deny the fact that it is NABU detectives who are investigating this case. For NABU, this investigation is a concentrated confrontation not only with the lawyer mafia but also with turncoats inside the Bureau itself. Because the law firm of Borzykh has the image of the most effective “fixers” in NABU.

Debacle of the lawyers' self-governance

The precedent with Borzykh and his law firm is a marker of complete degradation of the system. If a lawyer acts, to put it mildly, “illegally,” and the association covers him, it is no longer a legal system; it is a simulacrum. Despite public information about the participation of lawyers in corruption schemes and illegal access to the register, the leadership of the National Bar Association publicly sided with the suspects and initiated the opening of a criminal case against NABU detectives. At the same time, no disciplinary proceedings were initiated, and no commission demanded explanations from Borzykh and his men. The body created for oversight has de facto turned into a corporate shield. In our opinion, the the UNBA led by Lidiia Izovitova has lost control over the ethical standards of the profession.

What we are witnessing is a “gray zone” in lawyers' practice, where the legal shell simply fulfills the functions of crisis support for top corrupt officials. The use of technical means to circumvent procedural guarantees is a sign of the “hybrid bar,” which simply imitates the law.

This threatens international legitimacy. In accession negotiations with the EU, the bar is one of the criteria for the rule of law. If Ukraine fails to demonstrate its ability to reform professional associations, its position will weaken. A restart of the lawyers' self-governance is necessary. The UNBA in its current form is not capable of responding to crises. There will be either reform or a definitive loss of confidence both inside and outside the country.

But the question is who will carry it out.

Power managing “chaos”

The apparent chaos in the justice system has long been a system itself. Who manages it and how interconnected everything is can be seen even from the facts lying on the surface. As you will know, Oleh Tatarov, the curator of the cluster of security and law enforcement institutions from the Presidential Office, was recently a suspect in the NABU/SAPO case. He was accused of participating in the falsification of expertise (well, what a coincidence) in the case of real estate developer Maksym Mykiyas: the case was related to bribing an expert of the Ministry of Internal Affairs for underestimating the value of the property involved in the exchange between Mykytas and the National Guard. (The story with the state-run Ukrbud construction company.)

So, as soon as the information about the suspicion became public, the UNBA, headed by Izovitova, immediately rushed to Tatarov’s defense, claiming he was not a person involved, but a lawyer whose rights were violated. Formally, he was not a practicing lawyer at the time, but the UNBA stated that any investigation against him should be conducted only with the consent of the Office of the Prosecutor General. Because “he's an attorney.”

That status, as can be easily guessed, blocked the NABU/SAPO from prosecuting the case. Detectives cannot automatically carry out actions against lawyers — only by authorization of the Prosecutor General (Kholodnytskyi quit at that time and SAPO was without a chair who would have the appropriate authority). As a result, we can conclude that the UNBA provided Tatarov with a procedural shield and facilitated the transfer of the case to the Security Service. This did happen — at the behest of the then Prosecutor General Iryna Venediktova. You don't think that the connection between the Presidential Office and the UNBA has lost its relevance, do you?

According to our sources in the law enforcement agencies, the incumbent Deputy Prosecutor General Ihor Mustetsa, in addition to influential clients, allegedly visited Borzykh's office as well. By the way, let me remind you: since December, Ukraine has not even had a legally appointed acting prosecutor general. And why do we need one if the Presidential Offic has one of its own?

Here, by the way, it makes sense to return to Anatolii Matios. According to our interlocutors in the judiciary, Matios and Borzykh at one time came to Pavlo Vovk, head of the District Administrative Court of Kyiv, and asked him to retain their posts in the military prosecutor's office through court decisions. However, these positions had already been promised to other people. Matios also “pulled” Borzykh out of the criminal firing line. We are talking about the NABU case regarding inaccurate declaration of property, when the National Corruption Prevention Agency gave Borzykh the opportunity to correct the classified (by decision of the chief military prosecutor Matios) part of the declaration. Although Anatolii Matios now maintains a modest official legal practice in Lutsk, sources in the Presidential Office say he still keeps “stellar ties” with both Tatarov and the Presidential Office. Borzykh, who is currently involved in the NABU criminal case, communicated not only with Tatrov, but also with Andrii Smyrnov, former deputy head of the Presidential Office, and Oleksii Kuleba. All these connections are definitely not about reforms.

At the same time, anyone who is well-versed in the subject matter (in the process of working on the material I talked to many experts), understands that in the context of the Borzykh case the following aspects are critically important for the state:

Firstly, at the legislative level, to strengthen the protection of classified information in court registries. Access to unpublished decisions should be limited and be provided only to the judge, prosecutor, detective and the accused after the delivery of suspicion. There is a separate article of the Criminal Code for unauthorized access. Audit of the USRCD is mandatory: multi-factor authentication, logging, indication of the case number.

Secondly, to reform the procedure of lawyers' access to investigation materials. Before the delivery of suspicion, access should be provided only by way of exception. A public register of lawyers in NABU/SAPO cases and a ban on representation of several defendants in one proceeding are necessary. The Criminal Procedure Code should stipulate that unauthorized access is a reason to exclude a lawyer from the process.

Thirdly, to block automatic scanning of court registers. Mass parsing and unauthorized API-access have to be prohibited. The HACC has to be in a separate protected section, with special access only. A personal digital key with a log of actions, as in the Prozorro procurement system, is mandatory.

Fourthly, to protect anti-corruption proceedings from internal sabotage. The documents of NABU and SAPO should be under special treatment, up to and including “classified” stamps. The Criminal Procedure Code should enshrine a “special procedural regime” for cases of the HACC and recognize interference in such cases as a qualified crime.

Fifthly, to introduce personal liability of lawyers. In case of confirmed sabotage or illegal access, automatic deprivation of license should ensue. Lawyers in NABU/SAPO cases should undergo integrity checks: asset declarations, absence of ties with the Russian Federation, control of conflicts of interest.

Otherwise, two parallel systems will coexist in Ukraine: an official one with electronic registers, openness and procedure, and a shadow one where information is sold before it is delivered. In order for the former to survive, the latter must be eliminated at the legislative level.

Now about the influence of the state on the self-governing organization that has become a de facto monopoly: the Ukrainian National Bar Association. This issue is extremely sensitive because the Constitution of Ukraine guarantees the independence of the Bar (Article 59) and the principle of self-governance. However, the UNBA is a self-governing, but not autocratic, structure. At least it should be. Self-governance is not an indulgence from control. If a lawyers' organization turns into a closed club of untouchables, which ignores its members, blocks congresses and makes decisions behind the scenes, this is no longer independence; this is self-acquisition. And the state is obliged to intervene. By legislative, judicial, administrative or anti-monopoly methods of its own choosing.

It is clear that it is up to the lawyers themselves to reform the legal profession. But it is the state that must lay the conditions for this. And to destroy the illusion that in a state governed by the rule of law someone can enjoy impunity. Especially if this “someone” wears the mantle of self-regulation and covers those who peddle justice.

Will the current powers-that-be take the matter into their own hands? Well, you have read this text carefully, haven’t you?..