Research Article: Journal of Drug and Alcohol Research (2026) Volume 15, Issue 7

Operational-Search and Administrative Activity of the National Police of Ukraine in Countering Drug-Related Crime: Principles, Methods, Legal Regulation

Volodymyr Ogurchenko11*, Olena Dzhafarova2, Igor Artemenko2, Denys Denyshchuk2 and Maksym Kryvonos3
 
1National Academy of Internal Affairs, Kyiv, Ukraine
2Kharkiv National University of Internal Affaire, Kharkiv, Ukraine
3Donetsk State University of Internal Affairs, Kropyvnytskyi, Ukraine
 
*Corresponding Author:
Volodymyr Ogurchenko1, National Academy of Internal Affairs, Kyiv, Ukraine, Email: Ogurchenko_V@ukr.net

Received: 15-Jun-2026, Manuscript No. JDAR-26-194940; Editor assigned: 17-Jun-2026, Pre QC No. JDAR-26-194940 (PQ); Reviewed: 01-Jul-2026, QC No. JDAR-26-194940; Revised: 08-Jul-2026, Manuscript No. JDAR-26-194940 (R); Published: 15-Jul-2026, DOI: 10.4303/JDAR/236522

Abstract

Aim: Ukrainian police officers who deal with drugs today face a seller they rarely see: The deal is concluded in a chat, settled in cryptocurrency and completed through a stash left in a park or an entrance hall. This paper asks how two branches of police work that the law keeps apartcovert intelligence gathering under the operational-search statute and open public-order work governed by administrative law-can be joined into one workable response to such a market.

Methods: Doctrinal analysis of Ukrainian statutes and by-laws was combined with a comparison against the 1988 United Nations (UN) convention and the entrapment case law of the European court of human rights. Official drug-situation reports for 2017-2025 were processed with simple descriptive statistics, and two stages of the 2026 police operation “Rubicon” served as case material.

Results: Registered drug offences grew from roughly 28 thousand in 2017 to 48.6 thousand in 2025, and the share of supply offences reached 37% in 2024; yet sentences for supply made up only about one in thirteen of all drug convictions that year. The authors describe three layers of guiding rules for police anti-drug work, group the covert and open techniques actually used, and point to five weak spots in regulation: Open-Source Intelligence (OSINT) and blockchain tracing have no statutory name, online test purchases lack a recording standard, the entrapment line is drawn only after the fact, data from administrative protocols are wasted, and cross-border controlled deliveries depend on ad hoc arrangements.

Conclusion: A two-tier model is offered: Open policing supplies signals and lowers demand, covert work follows the money and the servers up to organisers. Concrete wording is proposed for amending the statutes on operational-search activity and on the police.

Keywords

Introduction

Three numbers frame the problem. In 2024 about 331 million people around the globe took an illicit drug at least once [1]; a year earlier the United Nations (UN) agency counted 316 million [2]. In Europe, the European Union (EU) drugs agency warns that cathinones, nitazene-type opioids and high-potency cannabis products are spreading faster than control lists are updated, and it is building an early alert system to keep up [3]. In Ukraine, police registered 38,670 drug offences in 2023 [4], 47,617 in 2024 [5] and 48,629 in 2025 [6].

The longer view is even more telling. In 2017 the ministry of internal affairs reported about 28 thousand such offences and, for the first time, singled out 143 groups that sold drugs through the internet [7]. Eight years and a full-scale war later, the annual figure is roughly 1.7 times higher, and selling online has turned from a niche into the default business model. A customer now picks a product in a messenger bot, sends coins to a wallet and receives the coordinates of a hidden stash. The police therefore meet a market without storefronts, in which the street courier is replaceable and the organiser is invisible.

This shift changes what is asked of the national police. Its patrol officers, juvenile inspectors and community officers still encounter the consequences-intoxicated drivers, teenagers with a first dose, neighbours complaining about a flat-while its drug-crime and cyber units have to reach people who never appear on the street. Whether these two worlds exchange information determines how far up the chain a case can go. Wartime adds a security angle: Drug revenue feeds organised groups, while displacement, trauma and the presence of armed people in public life widen the pool of potential users. The government’s drug policy strategy to 2030 likewise insists on decisions that rest on data and on joint action by police and health services [8].

Scholars have covered many separate pieces. Bezpalova, et al. listed the gaps in police competence-no dedicated unit at the time, poor coordination with customs, a weak preventive component [9]. Kushnirenko, et al. treated tactical police work against drug offences as a meeting point of administrative, criminal and information law [10]. Holdberh, et al. offered a fresh definition of controlled delivery [11]; Dusiak, et al. looked at informants [12]; Hrets wrote on cooperation between operational units of different agencies [13]; Shynkarenko called for scientific backing of anti-drug policy [14]. Senko [15] and Skok with Shevchenko [16] traced causes and statistical dynamics. Contactless sales were studied by Batyrhareieva [17], and their criminal-law qualification by Shevchenko [18]. Our own earlier papers dealt with administrative and criminal features of drug offences [19], with offences by minors [20] and with foreign regulatory models [21]; investigative specifics were addressed by Korniienko, et al. [22], and international cooperation in covert policing by Davydenko, et al. [23].

What these works rarely do is look at the seam between covert and open policing. Authors who write on operational-search activity seldom discuss protocols on administrative offences, and administrative lawyers seldom ask what happens to their data after a protocol is signed. Yet it is at this seam that many drug cases are either built or lost.

Aim and tasks: The paper seeks to show how the covert and the open branches of police work against drug crime should be guided, which tools each of them uses and where their legal basis needs repair. We therefore (1) separate and link the two branches; (2) set out the rules that should guide them; (3) read the 2017-2025 figures with an eye to results rather than volume; (4) describe the tools of each branch and their weak points; (5) put forward amendments.
 

Methods

The analysis moved from the general to the particular. A dialectical approach let us treat the two branches as parts of one police function that pull in different directions-one towards transparency, the other towards secrecy. Doctrinal reading covered the operational-search statute [24], the police statute [25], the two framework drug laws [26,27], the codes on administrative offences [28], crimes [29] and criminal procedure [30], as well as by-laws that fix drug lists and threshold quantities [31,32]. International sources included the 1988 United Nations (UN) convention [33], the Ukraine-European Union Agency for Law Enforcement Cooperation (Europol) agreement [34] and Strasbourg case law on entrapment [35-37]. European preventive practice served as a comparator [38].

The figures come from the national drug-situation reports [4-6], the ministry’s 2017 summary [7], an academic digest of 2025 court statistics [39] and the United Nations (UN) reports [1,2]. Press releases on the two 2026 stages of operation “Rubicon” [40,41] were used as a case study. We calculated growth, shares and ratios; because a conviction may follow registration by years, the ratios are read as signals, not as clearance rates. Finally, modelling was used to sketch how the two branches could share information.

Results and Discussion

Two branches, one function: The police statute entrusts the national police both with preventing offences and with covert work under a separate law [25]. The open branch is staffed mostly by patrol, juvenile and community officers; it relies on preventive measures, coercion permitted by statute and proceedings on administrative offences. The covert branch belongs to the drug-crime, cyber and criminal intelligence units; the operational-search statute defines its activity as a combination of public and secret measures aimed at finding and recording facts about unlawful conduct [24].

The line between them is not only about secrecy. They pursue different ends (order and prevention as opposed to uncovering concealed criminal enterprise), they are carried out by different staff, they are subject to different procedures and they intrude into privacy to a very different degree. Since 2012 there is a further twist: Once a criminal case has been entered in the register, covert steps must take the form of covert investigative actions under chapter 21 of the criminal procedure code [30]. Operational-search work is thus pushed mostly to the stage before a case exists, and any sign of a crime it uncovers has to be handed over to investigators [24,30].

In practice a typical drug episode crosses all three regimes. A patrol finds a few grams on a passer-by (open branch); intelligence officers check where the dose came from (covert branch); investigators then document the sales channel and its owners (criminal procedure). Each transition is a point where information can be lost. Shevyakov, et al. point out that community officers know their districts better than anyone [42], but that knowledge only helps if it is written down in a usable way and actually reaches the drug unit. Hrets identified poor cooperation between operational units as the bottleneck as early as 2016 [13]; the 2026 operations show progress, but the problem has not disappeared.

International and European benchmarks: Ukraine’s covert tools rest on international law. Article 11 of the 1988 United Nations (UN) convention obliges parties to allow controlled delivery “if permitted by the basic principles of their respective domestic legal systems” and to agree case by case on its use across borders [33]. The agreement on operational and strategic cooperation with European Union Agency for Law Enforcement Cooperation (EUROPOL), signed on 14 December 2016 and ratified on 12 July 2017, gave the national police access to analytical support, the exchange of operational data and joint investigation teams [34]. Comparative research confirms that controlled deliveries succeed where such channels are used routinely rather than improvised [23].

Strasbourg case law sets the outer limits. In Teixeira de Castro v. Portugal the Court held that officers who incite a person with no prior intent to commit a drug offence deprive the trial of fairness from the outset [35]. Ramanauskas v. Lithuania extended this to undercover agents acting through private intermediaries [36]. Bannikova v. Russia then formulated a two-step test: A substantive one-would the offence have happened without the state’s involvement, did the agents remain “essentially passive”, was there objective prior suspicion-and a procedural one-could the defence raise the incitement plea effectively and did the court examine it adversarially [37]. These criteria translate directly into what an operational officer must record before and during a test purchase.

Guiding rules: We distinguish three layers. The first is formed by the general principles of police work: Rule of law, respect for human rights, lawfulness, openness, political neutrality, partnership with the public and continuity [25]. For drug policing they mean, above all, that every preventive step must have a clear statutory basis and must be explainable to the person concerned and, later, to a judge. The second layer comes from the operational-search statute: Lawfulness, respect for rights, cooperation with authorities and citizens, the mix of open and secret methods, and confidentiality [24]. The third layer, in our view, must be added by doctrine to reflect what is specific to drug markets (Table 1).

Layer and rule What it means in drug cases Where it comes from
I. Police-wide principles Lawful, transparent and rights-respecting use of preventive measures; partnership with communities Police statute, Articles 6-11 [25]
II. Covert-work principles Mix of public and secret methods; confidentiality of sources; judge’s permission for intrusive steps Operational-search statute [24]; Criminal Procedure Code (CPC), chapter 21 [30]
III-a. Proactivity Interrupting supply and production before harm occurs, rather than counting users caught [10,12]
III-b. Working up the chain Resources go to organisers, cooks, shop administrators and money handlers Practice of 2026 operations [40,41]
III-c. No incitement Agents may join an offence already under way, never provoke one; prior suspicion must be documented [35-37]; Criminal Procedure Code (CPC) Article 271 [30]
III-d. Court-ready evidence Online material is captured with hash values, logs and witnesses so that it survives judicial review Criminal Procedure Code (CPC) Articles. 99, 256 [30,43]
III-e. Health-sensitive differentiation A user in need of treatment is handled differently from a dealer; referral to services Strategy to 2030 [8,44]

Table 1: Layers of guiding rules for police work against drug crime.

Rule III-b deserves emphasis because it runs against a habit inherited from earlier reporting systems, in which a unit looked successful when it registered many cases-and the easiest cases are possession without intent to sell. Rule III-c is not an abstract safeguard either: A test purchase that fails the Bannikova criteria will cost the prosecution its central evidence, so careful compliance is in the police’s own interest. Its procedural half matters just as much: If the undercover agent or the informant cannot be questioned by the defence and the file says nothing about how the target was chosen, the court is likely to find the trial unfair even where the accused was a genuine dealer [37]. Operational files should therefore be prepared from the outset with a possible court hearing in mind, and decisions to keep a source secret should be weighed against the need to let the defence test the evidence.

What the numbers say: Table 2 brings together the main indicators.

Indicator 2017 2023 2024 2025
Drug offences registered ≈ 28,000 38,670 47,617 48,629
Change on previous column, % - +38.1 +23.1 +2.1
Possession without intent to sell (Article 309), % of total n/a 52.1 43.3 n/a
Supply offences (Article 307), % of total n/a n/a 37.0 n/a
Persons convicted, all drug articles n/a n/a 12,320 ≈ 11,000
Of whom: Convicted under Article 307 n/a n/a 933 n/a
Laboratories shut down 113 n/a 87 70

Sources: [4-7,39]. n/a: Not published in these sources; 2017 and 2025 conviction figures are rounded.

Table 2: Drug offences and court outcomes in Ukraine.

Four points stand out: To begin with, the 2024 jump was not a one-off: In 2025 the count stayed at almost the same height, about 74% above the 2017 level. Next, the mix of offences is moving towards supply. Article 307 cases made up 37.0% of the 2024 total, or 17,601 episodes, while possession without intent to sell fell from 52.1% to 43.3% over two years [4,5]. Stash-based selling explains this well: One organiser employs dozens of couriers, and each courier caught produces a separate supply case.

The third point is the decisive one. Among 12,320 persons convicted in 2024, sentences under Article 307 were handed down to 933, against 10,783 under Article 309 [5]. Put differently, supply convictions were equal to roughly one in nineteen registered supply episodes, and to about one in thirteen of all drug convictions. Delays between registration and verdict cannot explain a gap of this size. In 2025 the number of convicted persons went down to around 11,000 although registrations kept rising [39]. The obstacle lies in proof: Without covert steps, digital forensics and tracing of payments it is almost impossible to show who stands behind an anonymous shop and that the drugs were meant for sale-exactly the difficulties catalogued by Korniienko, et al. [22].

Fourth, fewer but larger laboratories are being found (87 in 2024, 70 in 2025, compared with 113 in 2017) [5-7]. Production is concentrating, which makes each laboratory a more valuable target and raises the importance of precursor control and of financial investigation. Predmestnikov, et al. rightly warn that seizure volumes and case counts alone say little about effectiveness [45]. A meaningful yardstick for the police would be the share of finished cases against organisers and producers.

Covert tools

Drawing on Article 8 of the operational-search statute [24] and chapter 21 of the procedure code [30], we group covert techniques in four families.

Human sources: Interviews, recruitment of informants and infiltration by undercover officers still give the richest picture of how a network is organised, what it charges and where it stores goods. Their weakness is the reliability and integrity of the source, so recruitment and handling need tight internal oversight [12].

Controlled crime: Test purchases, controlled deliveries and special investigative experiments let officers watch an offence develop. Holdberh and Polishchuk describe controlled delivery as a blend of operational, procedural, organisational and technical steps allowing drugs to move under surveillance within Ukraine or across its border [11]. Once a case is open, these steps fall under Article 271 of the procedure code, which explicitly bans provocation [30].

Technical surveillance: Audio and video monitoring, interception of data from communication networks and electronic systems, and observation of persons and premises are the most intrusive tools and therefore require an investigating judge’s ruling [24,30]. (d) Analytical tools. This fastest-growing family includes open-source intelligence, monitoring of messengers and darknet marketplaces, tracing of cryptocurrency flows and link analysis of large datasets, more and more often aided by artificial intelligence [10,46]. The practical value of this family is that it targets the parts of a drug business that cannot be made anonymous for long: A shop needs advertising to attract buyers, a wallet leaves a permanent trail on a public ledger, and a courier has to send photographs with geotags. Each of these traces can link the street level to the organisers if it is captured promptly and lawfully. Byba notes that Open-Source Intelligence (OSINT) has no settled legal status in Ukraine, which puts the admissibility of its results at risk [43]; Saienko says the same about investigations that involve virtual assets [47].

Operation “Rubicon” illustrates how these families combine. Its first stage in February 2026 involved more than 500 searches in 21 regions [40]. During the second stage in June 2026, over a thousand officers took part, more than one hundred test purchases were carried out, one alpha-PVP (Pyrrolidinopentiophenone) and three amphetamine laboratories were closed, and about 90 kg of drugs together with over 570 litres of precursors were seized; investigators relied on Open-Source Intelligence (OSINT) and blockchain analytics, identified more than 400 people linked to the network and served notices of suspicion on 146 of them [41]. The lesson is that striking at the whole chain-precursor supplier, cook, shop administrator, money mule-yields far more than arresting couriers one by one.

The same operation shows the weight of precursor control. In Poltava region two organisers of a scheme involving phenylnitropropene-a precursor of amphetamine-were exposed and about 14 kg of the substance was seized, enough to make a similar quantity of the final drug [40]. Earlier stages of the investigation had traced precursors purchased in European Union (EU) countries and a production and sales network spanning Ukraine, Poland, Georgia and Moldova [41]. Controlling the legal market of chemicals is thus not a matter for licensing bodies alone: When suspicious purchases are reported by suppliers and checked by operational units, the police can intervene before a single dose is made. The framework drug law provides the basis for such reporting and for the duty of banks, customs and other bodies to share information on transactions of persons suspected of drug trafficking [26,27].

Five weak spots remain. First, neither Open-Source Intelligence (OSINT) nor blockchain tracing is named among operational-search measures; officers rely on general clauses, and courts are left uncertain. Second, there is no standard for recording an online test purchase made through a messenger and paid in coins, so the defence routinely challenges screenshots, account ownership and the moment the offence was completed. Third, the entrapment line is drawn by judges only after the event, which leaves officers without guidance in advance. Fourth, Ukraine lies on transit routes [48], yet each cross-border controlled delivery still requires improvised coordination with partners despite the European Union Agency for Law Enforcement Cooperation (EUROPOL) framework [34]. Fifth, as shown below, a large stock of data produced by the open branch is never analysed.

History also shows that open and covert means reinforce each other when they are planned together. In 2017, during the annual operation against illegal crops, aerial reconnaissance carried out jointly with patrol police helped to find about 170 hectares of hidden poppy and hemp plantations, including on a Danube island at the Romanian border; in the same year the police detained 901 street dealers and 27 organised groups responsible for 270 drug offences [7]. A routine public-order resource-patrol crews and aircraft-thus produced information that the drug units could not have collected alone.

Open tools: Administrative police work in this field has three dimensions. The preventive one includes individual talks, work of juvenile units with children and parents, lessons in schools and joint local programmes with municipalities [42]. Our earlier study found that for minors a mix of administrative and criminal-law measures works best when it starts early [20]. European police systems show that prevention built on partnership with residents tends to last longer than mere extension of coercive powers [38].

The protective dimension covers the preventive police measures listed in the police statute, such as checking identity documents, a superficial inspection of a person or vehicle, stopping a vehicle or entering premises in situations defined by law [25]. In drug matters these steps are frequently the first moment a substance is discovered or intoxication is noticed. If the step was taken unlawfully, everything found may later be excluded from the criminal file, so legality here is a practical matter.

The jurisdictional dimension concerns minor drug offences. The administrative code punishes, among other things, handling small quantities of drugs without intent to sell (Article 44), illegal growing of opium poppy or hemp (Article 106-2) and driving under the influence (Article 130) [28]. What counts as a “small” quantity is fixed by a ministerial table of threshold amounts [32], and the substances themselves by the government’s list [31]. Police officers draw up the protocols and send the person for a medical examination; the procedure is described in detail in teaching literature [49]. Chyshko’s analysis of the period when drug-impaired driving was formally a crime but was still handled administratively shows how easily the boundary between the two kinds of liability can blur [50].

Administrative measures also carry a health function. A person stopped with a small quantity is often at the beginning of a dependence, and the encounter with an officer may be the only contact with the state before serious harm occurs. The 2030 strategy envisages referral to treatment and harm-reduction services as part of the public response [8], and Shapovalov shows how closely pharmaceutical, medical and criminal law are intertwined in this field [44]. A short information leaflet on local services, handed over together with a copy of the protocol, costs little and fits the differentiation rule set out above.

The open branch has a blind spot: Its output is counted but hardly ever read. A protocol under Article 44 records where and when a substance was found, which substance it was, how it was packed and, often, how it was bought. Ten similar protocols from one district within a month-the same substance, the same zip bags, the same bot mentioned-point to an active local shop. Such patterns are rarely mapped and passed on to the drug unit. Shynkarenko’s call for information-analytical support of anti-drug policy [14] fits this situation precisely.

A shared model: We therefore propose a model in which each branch keeps its own tasks but both work from the same pool of information (Table 3).

Element Open (administrative) branch Covert (operational-search) branch Contact point 2025
Purpose Prevent use, keep public order, register minor offences Expose supply, production and organised networks Fewer drugs available 48,629
Who acts Patrol, juvenile and community officers Drug-crime, cyber and analytical units Joint task forces +2.1
Main tools Preventive measures; programmes; protocols under Arts. 44, 106-2, 130 Informants; test purchases; controlled delivery; Open-Source Intelligence (OSINT); crypto tracing Hand-over of primary signals n/a
Weak spot Data not analysed; focus on users Unclear status of new tools; entrapment risk No common database n/a
Remedy Structured fields in protocols; district risk maps Statutory listing of tools; recording standard Shared analytical register ≈ 11,000

Table 3: Division of labour and points of contact between the open and covert branches.

To put the model into effect, four legal changes are suggested. (1) Article 8 of the operational-search statute should list, as separate measures, the gathering and analysis of publicly accessible information, including online sources, and the analysis of virtual-asset transactions, together with their limits and the way results are recorded [24,43]. (2) The police statute should grant the power to send a reasoned demand to a platform owner or hosting provider to disable a resource used for selling or advertising drugs [25]. (3) A ministerial instruction should regulate online test purchases: How correspondence is captured, how accounts and wallets are linked to persons, how digital copies are preserved in line with the procedure code [30], and what prior suspicion must be written down to satisfy the Bannikova test [37]. (4) A common analytical register should pool administrative protocols, intelligence files and criminal cases, with graded access and data protection.

Criminal-law reform, such as adding online selling as an aggravating feature of Article 307 [18], lies beyond our scope, but it is linked: Without better covert support, harsher sanctions will again hit mainly the couriers who already dominate the conviction statistics. Likewise, until the regime for virtual assets is completed, freezing and confiscating the profits of drug shops will remain difficult [47].

Success should be judged by outcomes: The proportion of supply and production verdicts among all drug convictions, the number of networks and laboratories dismantled, the value of assets-virtual ones included-confiscated, the number of online shops blocked, and changes in public-health indicators [8,45].

Conclusion

Covert and open police work against drug crime are two sides of one function. The open side prevents use, maintains order and detects minor offences; the covert side uncovers concealed supply, production and organisation. Because a single drug episode usually travels through the administrative, the operational-search and the criminalprocedure regimes, the result depends on how well information moves between them.

Three layers of guiding rules apply: Police-wide principles, principles of covert work and rules specific to drug marketsproactivity, working up the chain, no incitement in line with the Bannikova test, court-ready evidence and healthsensitive differentiation.

The data show a steep rise-from about 28 thousand drug offences in 2017 to 48,629 in 2025-and a growing share of supply. Yet in 2024 only 933 people were sentenced for supply, about one in thirteen drug convictions. The justice system still catches users far more often than suppliers, and the reason lies chiefly in insufficient covert and digital support of proof.

Covert tools fall into four families: Human sources, controlled crime, technical surveillance and analytics. Open tools have preventive, protective and jurisdictional dimensions. The main weaknesses are the missing statutory status of Open-Source Intelligence (OSINT) and crypto tracing, the absence of rules for online test purchases, after-the-fact entrapment control, improvised cross-border deliveries and unused administrative data.

We propose to name the new analytical measures in Article 8 of the operational-search statute, to give the police a power to demand blocking of drug-selling resources, to adopt an instruction on online test purchases and to set up a shared analytical register. Further research could address legal limits of artificial intelligence in covert policing and a standing mechanism for international controlled deliveries.

Acknowledgment

None.

Conflict of Interest

Authors have no conflict of interest to declare.

References

Copyright: © 2026 Volodymyr Ogurchenko, et al. This is an open access article distributed under the terms of the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.