Earlier this year, investigators from the Security Service of Ukraine (SBU) sought full access to the internal document-management system of the High Anti-Corruption Court (HACC), a key part of Ukraine's anti-corruption infrastructure that completes the chain from investigation and prosecution to conviction or exoneration.
Several civil-society organizations monitoring government transparency and corruption risks among officials and law enforcement agencies would later call the move part of a series of attacks on anti-corruption bodies in Ukraine, where citizens and activists say high-level graft undermines the country’s defense against the full-scale Russian invasion, now in its fifth year.
The hearings on the access request at Kyiv’s Shevchenkivskiy District Court were held behind closed doors at the insistence of an SBU officer, who cited the confidentiality of the investigation. He also objected to the presence of civic activists, asserting that they could harm the investigation.
The judge granted the motion for closed hearings but ultimately rejected the request. While extensive access was denied, activists said the attempt exposed a possible means of undermining the independence of Ukraine’s main anti-corruption system -- the National Anti-Corruption Bureau (NABU), the Special Anti-Corruption Prosecutor’s Office (SAPO), and the HACC.
It came a year after large street protests in cities nationwide prompted President Volodymyr Zelenskyy to retract a law he had signed two days earlier that critics in Ukraine and the West said robbed NABU and SAPO of their independence and set back years of progress on justice and the rule of law.
A new chapter in the confrontation between the SBU and the anti-corruption bodies has unfolded this week with the release of NABU recordings concerning suspected criminal activity by SBU officials, among others, as part of an investigation dubbed Operation Carthage. On November 5, NABU said it had served notices of suspicion on a senior SBU official and two National Police officials, among other suspects.
Schemes, the investigative unit of RFE/RL’s Ukrainian Service, was given the opportunity to review the full text of the Shevchenkivskiy court's confidential August 26 ruling. Reporters established how SBU representatives justified their request for temporary total access to the HACC database, what might have provided formal grounds for such a step, why the request may have been so sweeping, and who argued for it in court.
The timing of the request raises questions about the motive for an attempt to gain such broad access to the court’s document-management system.
The background of the request is complex.
In late August 2026, SBU investigators were in the throes of a probe into possible interference by HACC employees in the anti-corruption court’s database during the automated assignment of a case to a judge.
The case concerns an alleged corruption scheme involving the sale, at below-market prices, of seized property entrusted to the Asset Recovery and Management Agency (ARMA). NABU and SAPO, which have handled the case since 2019, said they established losses exceeding 440 million hryvnyas ($9.7 million).
The 11 defendants included former ARMA head Anton Yanchuk and Viktor Vyshnyov, a former director of SETAM, a state enterprise established by the Justice Ministry to organize transparent online auctions of seized property. Investigators allege that the property was sold to “controlled companies at reduced prices on a controlled trading platform” and have identified lawyer Andriy Dovbenko as the alleged organizer. Controlled, in this case, means controlled by the defendants or their associates.
According to recordings quoted at hearings in the case, participants in the alleged scheme referred to the assets involved as 'shashlik' -- skewered grilled meat -- and to the auctions as “grilling shashlik.”
In May 2025, the indictment was sent to the HACC, whose automated document-management system selected the presiding judge on the second attempt. This set in motion what followed: a new investigation, expert examinations, court hearings, and what activists would later call an attack by the SBU on the anti-corruption system.
Almost a year later, in April 2026, SBU investigators opened an investigation into possible interference with the HACC system. They requested the software and temporary full access to a copy of the court's database.
The software, called D-3, stores documents submitted to the anti-corruption court by NABU detectives and SAPO prosecutors, among other things. It includes material that must remain unknown to anyone other than the investigators until the last possible moment, such as applications for search warrants and authorization for other investigative measures.
Why did the SBU suddenly take an interest in the HACC's automated judicial assignment in the so-called Shashlik case, many months after it took place? That question was raised by Vyshnyov, the defendant and former SETAM director.
In late February of this year, Vyshnyov’s lawyer complained to the SBU about what he claimed was possible interference with the automated assignment system by HACC administrative staff, including their head.
Schemes examined records in the public register of court decisions in an effort to determine whether HACC staff had in fact manipulated the system and whether the SBU was within its rights to investigate the case.
'Insufficient Grounds'
An April 1 ruling by the Shevchenkivskiy court shows that after Vyshnyov complained to the SBU, the agency promptly decided the matter was outside its investigative jurisdiction and forwarded it to the State Bureau of Investigation (SBI). The SBI also declined to register a case based on Vyshnyov's complaint, citing "insufficient grounds" for a pretrial investigation.
Almost 10 months after the assignment of the case in May 2025, Vyshnyov took the matter to court, where the investigating judge, Vadym Kovtunenko, determined the fate of the prospective investigation.
In his ruling, Kovtunenko effectively compelled the SBU to open a case, the register indicates. The judge did not examine which agency had jurisdiction over the alleged offense by HACC employees. He ruled that because the complaint had originally been filed with the SBU, it was the SBU that had to make a procedural decision -- within 24 hours of receiving the decision.
Was there anything in the anti-corruption court employees' actions for SBU investigators to investigate? The HACC's own May 14 ruling on the recusal of the judge initially assigned to the ARMA/SETAM case sheds some light on that issue, pointing to alleged problems with the automated case-assignment system.
The judge recused himself because of previous involvement in a related case.
“In effect, several successive attempts to assign this indictment automatically took place on a single day, May 1, 2025, some of which were erroneous,” says the 11-page recusal ruling, which details all the assignment attempts and shows that the case was indeed registered several times in the system.
The court described these as “technical errors corrected in accordance with procedure” -- an explanation provided by court staff that the judge found “entirely logical.”
In response to a request from Schemes for further information, the HACC said it had reviewed the case-assignment actions from that day and established that the mistakes “resulted from human error and do not indicate interference with the system.”
At the same time, the HACC said those events led to disciplinary proceedings against the senior specialist who registered and assigned the case. On May 30, 2025, the court's disciplinary commission found that she had committed a disciplinary offense -- “improper performance of official duties” -- and she was reprimanded on June 9.
Thus, Vyshnyov complained about events that were 10 months old, even though the judge with a potential conflict of interest -- who had recused himself due to previous involvement in a related matter -- had ultimately not heard his case. Nevertheless, the SBU began investigating, apparently out of necessity following Judge Kovtunenko's decision.
The confidential August 2026 ruling examined by Schemes shows that just over two weeks after the proceedings were registered in April, SBU investigators obtained access to D-3 data -- but only data concerning the assignment of the case Vyshnyov had complained about.
The Shevchenkivskiy court authorized this access, and the HACC complied. Law enforcement sources told Schemes that Judge Inna Romanyshena had issued the limited-access order -- which covered only the day of the assignment attempts, May 1, 2025 -- without summoning the parties.
The matter might have ended there. It did not, because the SBU sought broader access.
To determine whether the case had been assigned correctly, the agency’s representatives in court said they now needed to extract copies of all D-3 database records from May 1, 2025, through the hearing date, August 26, 2026.
HACC representatives objected, saying that extracting a copy of the entire database was “excessive” and would lead “to the disclosure of data concerning other court cases that are not the subject of the pretrial investigation.”
The investigating judge who heard the arguments, Yulia Matvyeyeva, rejected the SBU's request for access to the much larger body of HACC data. She noted that investigators had already received limited access in April in relation to a specific case, and said the request for a copy of the entire database failed to justify why it was necessary.
“The investigating judge considers these circumstances to go beyond the scope of the subject of the criminal investigation and therefore denies the application,” Matvyeyeva's ruling states.
As a result, the SBU did not obtain access to the full HACC database or, consequently, to information about other NABU and SAPO investigations.
That raises a pertinent question, given the broad societal tensions over wartime corruption in Ukraine and the series of prominent anti-graft cases that have unfolded in the past 16 months or so: What did the SBU want to look for in the database, and what could it have seen?
Coincidence?
The active phase of the SBU investigation into the automated assignment in one particular case, followed by its request for access to nearly a year and a half of HACC database records, coincided with other NABU and SAPO investigations, including the high-profile probes the agencies have dubbed Midas, Forrest Gump, Themis, and Carthage.
In Operation Carthage, NABU and SAPO investigated, among other things, whether National Police officers and senior SBU officials may have provided protection to call centers and the drug trade and helped track people who were subsequently allegedly tortured.
On November 5, NABU said it issued a formal notice of suspicion to a senior SBU officer and four other people it accused of involvement in a criminal group that it said ran fraudulent call centers, sold drugs, and produced counterfeit foreign currency.
A day earlier, when the anti-graft agencies published recorded conversations between suspected group members, the SBU said its chief, Oleksandr Poklad, had dismissed two senior SBU officials implicated in the investigation.
Schemes has asked the SBU whether it had known about possible unlawful activity by its personnel before the recordings were published, but has not received a response.
Were these merely parallel processes that happened to coincide? The timing of the SBU request and the anti-corruption cases line up as follows:
- May 1, 2025: In its August 2026 motion, the SBU requested full access, including copying rights, to the HACC's internal document-management database from May 1, 2025, through the end of August 2026. The start date was the date of the unsuccessful automated assignments in the ARMA/SETAM case, but it’s unclear why the SBU set the end date so much later.
- May 2025 to summer 2026: The covert phases of multiple NABU/SAPO investigations. While detectives and prosecutors secretly intercepted suspects' conversations for months, conducted surveillance, and documented the actions of people involved in operations including Midas, Forrest Gump, and Themis, information about searches and other measures authorized by the HACC accumulated in the court database.
- Mid-2025: According to NABU and SAPO, Prosecutor-General's Office official Serhiy Kropyva -- codenamed 'Chancellor' in NABU recordings -- created and headed a criminal organization whose members allegedly established a system of regularly receiving bribes in exchange for not obstructing the illegal activities of allegedly fraudulent call centers.
- July 2026: According to media reports, NABU conducted a series of searches in an investigation into prosecutors' purchases of apartments in Bukovel, a ski resort town in the Carpathians. Recordings released by the bureau indicate that after these July investigative actions, Kropyva and his associates began actively discussing how to transfer luxury apartments and other assets to front men. Kropyva told the court that the recorded phrases “do not belong” to him, that the property cited was not his, and that he had “fought evil all my life.”
- August 2026: The culmination of the Themis and Forrest Gump cases. NABU and SAPO publicly announced the results of their operations, searched the presidential office -- the headquarters of Zelenskyy’s administration -- on Bankova Street in Kyiv, and served notices of suspicion on senior officials. Those named included a former deputy head of the presidential office, Iryna Mudra, who denies wrongdoing and says she has been pressured by a “verdict in the public sphere;” former lawmaker Maksym Mykytas, who calls the case against him “political manipulation;” and sitting lawmaker Vadym Stolar, who denies the allegations.
On August 19, investigators released details of the Forrest Gump investigation, describing an alleged “criminal group” that arranged the laundering of funds to post bail for former energy and justice minister Herman Halushchenko.
According to investigators, the group used the state-owned Sense Bank for this purpose. Details of Themis appeared on August 20, describing how the same “criminal group” allegedly organized corporate raids to seize properties and businesses in Kyiv.
On August 26, the Shevchenkivskiy court heard the SBU's request to download a copy of the HACC system covering the period starting May 1, 2025.
What The Authorities Say
The SBU's official justification was a complaint about the improper assignment of judges in a different case, unrelated to these high-profile operations. But civic activists drew attention to the extraordinary scope of the request: the security service sought a copy of the system containing all rulings, detectives' applications, and authorizations for covert searches covering the HACC's work over 16 months -- precisely the period in which, among others, the Forrest Gump and Themis cases were being investigated.
Activists raised suspicions that the timing may not have been a coincidence -- and that the SBU request may have been an attempt to obtain confidential NABU investigation materials after the fact and to learn about other nonpublic investigations targeting senior officials.
Seeking answers, Schemes requested comments from all parties involved: the SBU, HACC, SBI, and Prosecutor-General's Office.
The SBU confirmed receiving a complaint about possible violations at the HACC in February 2026, but said the matter was “outside the investigative jurisdiction of SBU investigators,” so it initially forwarded it to the SBI. It subsequently registered the case in accordance with the complaint and the ruling of the Shevchenkivskiy court. The SBU said its investigators “conduct [an] investigation until a prosecutor assigns jurisdiction to another body.”
Asked by Schemes about a possible change in investigative jurisdiction, the Prosecutor-General's Office said it was supervising the proceedings and that the “investigative jurisdiction remains unchanged.” It confirmed that a prosecutor had approved the application to the court for temporary access to the D-3 database for a forensic examination, but the court had denied it. Citing the law, the office declined to disclose further details of the pretrial investigation.
Reporters separately asked the complainant, Vyshnyov, why he had contacted the SBU about alleged interference with the automated assignment system almost 10 months after the assignment itself and the HACC staff's explanation of what it said were technical errors. Speaking to Schemes by phone, he said his defense team had contacted the HACC “for some time.” Because “the court's internal investigations yielded no result,” he said, they eventually “turned to other institutions.”
Vyshnyov answered the remaining questions in writing. He and his defense team maintain that the events involved interference, not errors: the case was assigned three times, each time under a different number, and mistakes were corrected with correction fluid, which could indicate “an attempt to send the case to a judge selected in advance.”
He also said his team had raised the assignment issue in spring 2025, sent requests to the HACC and the state enterprise Information Judicial Systems, and sought the judge's recusal. They approached law enforcement once they had collected all the documents.
Asked why they approached the SBU specifically, Vyshnyov said the agency “plays an exceptionally important role in ensuring state security under martial law” and its investigators “have positive experience” handling such cases. He stressed that any agency is obliged to register a complaint and that a prosecutor can subsequently reassign investigative jurisdiction. Vyshnyov and his lawyers said they know nothing more about the case's status beyond the fact that it is ongoing.
The HACC declined to comment on the status of the criminal proceedings.
Who's Asking?
Seeking clues about the SBU’s possible motives in making the broad request for HACC access, Schemes examined the backgrounds, ties, and assets of the two officers who appeared in court.
The August request to the Shevchenkivskiy court was prepared by Vladyslav Burykin, 32, a senior investigator for particularly important cases in Section 3 of the pretrial investigations division of the SBU's Main Investigations Directorate, according to the ruling seen by Schemes. The other officer who appeared in court was his supervisor, Oleksandr Vovnyuk, 37, the section’s deputy chief.
Since both officers are involved in other public proceedings and their surnames appear in the public court register and notices of suspicion, Schemes is identifying them by name.
Burykin was born in Snizhne, a Donetsk region city occupied by Russia since 2014. According to public sources, he previously worked at the SBU's Main Directorate for the Donetsk and Luhansk regions, based in Mariupol. In 2024, he held the rank of major of justice.
His asset declaration, like those of other SBU officers, is not publicly available. Journalists established that Burykin purchased a 2017 Audi Q5 in 2025. He was still driving it this year and has received speeding tickets in Kyiv.
Reporters also examined other cases Burykin had investigated at the SBU.
In 2021, an indictment was sent to court against a man who lived in the Russian-occupied Debaltseve in the Donetsk region from May 2015 to April 2019 and, according to investigators, supported the occupation authorities in the region for “ideological reasons.”
Reporters found another case in the court register in which Burykin served as investigator. It concerned a resident of Russian-held Horlivka who, according to the SBU investigation, supported the Russian occupation of the Donetsk region, obtained Russian documents, supported Russia's military aggression, and ran for local office. In 2024, Burykin served the Horlivka resident with a notice of suspicion of “collaborationist activity.”
Relatives of Burykin appear to have remained on Russian-occupied territory, and their views can be traced through their social-media activity. On VKontakte, a Russian social network banned in Ukraine, reporters found a video dated May 2023 showing the SBU investigator's sister performing in a Soviet military uniform, singing a song about military pilots against a backdrop of symbols frequently used in Russian commemorations of victory in World War II.
In another video, uploaded in March 2024, she sings 'We Have One Motherland' -- an echo of Russian President Vladimir Putin’s inaccurate assertion that Russians and Ukrainians are “one people.” In a video from 2020, she poses with a Russian dictionary and extols “the mighty Rus.”
On VKontakte, Burykin’s father has expressed nostalgia for Soviet dictator Josef Stalin and posted images evoking far-right Russian chauvinism, as well as video about the difference between “Russian Easter bread and the fascist Easter of the First Reich.”
Through leaked databases, Schemes established that after the start of the full-scale war in February 2022, relatives of Burykin exchanged their so-called “Donetsk People’s Republic” documents for Russian ones, as many in occupied areas have done. In 2023, his sister and parents obtained new Russian passports, and they remain valid.
Other evidence indicates that they remain in Snizhne, where Burykin’s father has a small retail business that took in 50,000 to 150,000 rubles ($610 to $1,830) a month from April to August.
Former SBU officer Ivan Stupak, an expert at the Ukrainian Institute for the Future, a Kyiv think tank, said that “many people have relatives in occupied territory” and suggested that having relatives who are pro-Russian does not necessarily present a conflict of interest.
“But such circumstances definitely need to be checked, and the officer should have disclosed them in an internal report to the Internal Security Directorate -- 100 percent,” he told Schemes.
The SBU confirmed to Schemes that Burykin's family lives in the occupied part of the Donetsk region and said he had informed his superiors, as required, but that “he is not in contact with them.”
According to Stupak, under the SBU's internal vetting procedures, the relevant department must assess the risks associated with such information, whether reported by the officer or obtained through other channels, including the possibility of recruitment.
“The Russians very often use this approach: they start finding people on our territory through their relatives. They tell them, ‘Blood is thicker than water’ and ‘You don't choose your homeland,’ and try to bring them over to their side,” he said. “So, of course, there is a vulnerability to recruitment, and both the officers themselves and their superiors must keep this constantly in mind in such circumstances.”
Burykin, whom Schemes reached by telephone, declined to comment on his family. He also declined to explain why he sought access to a copy of the D-3 database or whether he saw risks to the anti-corruption infrastructure. He cited 'the confidentiality of the pretrial investigation' and 'lack of the relevant authority' to comment.
Cars And Homes
At the closed Shevchenkivskiy court hearing, Vovnyuk supported the request filed by Burykin. Neither of them provided a substantive comment about their participation in the hearing.
Vovnyuk's asset declarations are also unavailable to the public, and he has no public social media accounts. Reporters sought to investigate his background and his family's assets through public sources and registers, which indicate he is originally from the western Rivne region and previously worked in the Kirovohrad region, in central Ukraine.
Vovnyuk owns a Tesla purchased in 2025, and was involved in a traffic accident in the vehicle this summer. His wife, a former lawyer, became the owner of a 2022 Audi Q3 in October 2025.
Reporters found no residential property owned by the couple. Officially, Vovnyuk has only one plot of land registered in his name outside Kyiv, with no buildings on it. However, leaked Ukrainian databases showed that he and his wife regularly ordered goods online in 2025-26 and collected them from a postal branch in a different location, the affluent village of Kozyn near Kyiv, suggesting they may live there.
Schemes found a number of properties in Kyiv and the surrounding region registered to the investigator's parents. Despite this, they may still live in the Rivne region, as suggested by social assistance his mother regularly received from the local council in 2020-23 and traffic fines his father received there between 2017 and 2024.
In addition to property in the Rivne region, Vovnyuk’s mother has owned a house and land in the Kyiv region since 2025, and is listed as the owner of an apartment in a residential complex in Kyiv's Kurenivka neighborhood.
Vovnyuk’s father also owns property in the capital: two nonresidential premises, whose size suggests storage rooms, and an apartment in a residential complex in the Solomyanka neighborhood.
The financial accountability of SBU officers has been a contentious issue for years because their assets and expenditures are hidden from public scrutiny.
'We need to reconsider whose declarations should be nonpublic and whether classifying them is actually justified,' said Kateryna Ryzhenko, deputy executive director for legal affairs at Transparency International Ukraine.
She told Schemes that checking declarations is the responsibility of the National Agency on Corruption Prevention (NACP), but special reporting procedures apply to operational officers to preserve secrecy. Although checks have not been abandoned altogether, martial law allows some personnel to postpone filing declarations, while others submit them through the SBU's internal system. This makes NACP oversight more dependent on information supplied by the security service itself.
The quality of lifestyle monitoring also raises questions: For example, the NACP's examination of the assets of former SBU Cybersecurity Department head Illya Vityuk, which found no discrepancies, was subsequently contradicted by a notice of suspicion issued by NABU and SAPO concerning illicit enrichment and false declarations, she said.
Using leaked Russian databases, journalists also established that Vovnyuk's parents traveled to occupied Crimea and Russia multiple times after the annexation of Crimea and the start of the war in the spring of 2014.
Schemes asked Vovnyuk about the origins of his family's property. He said the information in the registers “does not correspond to reality,” stating that his parents do not live in Kyiv and own no real estate in the capital or the surrounding region. Vovnyuk did not answer follow-up questions about his alleged residence in Kozyn or his purchase of a Tesla.
Vovnyuk’s parents declined to comment to reporters. Asked about the property, his mother clarified that she owned only a share of it, but did not elaborate and ended the conversation. At the same time, according to the State Register of Property Rights to Immovable Property as of publication, the real estate in Kyiv and the Kyiv region is registered to both parents, and the register contains no information about a division of the property or other encumbrances.
The SBU confirmed that Vovnyuk's parents had traveled to Crimea and Russia and that he had notified management in accordance with established procedures. However, its response said Vovnyuk “has not lived with or shared a household with his parents since 2006” and therefore does not include their property in his declaration.
According to Schemes sources, the two SBU officers were also involved in other actions involving NABU and SAPO personnel. Both Vovnyuk and Burykin refused to answer questions about the request to the Shevchenkivskiy court, saying that "information about the pretrial investigation is provided only in response to official requests.”
Responding to Schemes' request, the SBU declined to comment further on the substance of the case, citing the confidentiality of the pretrial investigation.
