Russian Deception Ops Raise Risk of Surprise Attack on Ukraine

KYIV, Ukraine — Russia has positioned enough military firepower near Ukraine to launch a major offensive on short order. Yet, despite the public nature of the buildup — much of which has been documented in detail on social media — some experts warn that a surprise attack is still possible.

“What the deployments suggest to me is that they are looking to keep the timing, final disposition of forces, and likely vectors hidden,” said Michael Kofman, director of the CNA Corp.’s Russia Center and a fellow at the Woodrow Wilson International Center’s Kennan Institute.

It’s difficult to conceal a large-scale military buildup from the US government’s sophisticated suite of intelligence gathering technologies — as well as from the prying eyes of social media observers relying on open-source intelligence, or OSINT, such as commercial satellite imagery and social media feeds.

Some experts contend that the visibility of recent Russian movements suggests that Moscow is looking for diplomatic leverage rather than laying the groundwork for a major military offensive. However, Russia’s constant shuffling of units and hardware may be part of a deception operation intended to create confusion and maintain an element of operational surprise.

“In general it is not possible to deploy a force of any meaningful size without it being detected and tracked by intelligence, but [Russia] can retain the initiative and keep foreign observers guessing via these [deception] tactics,” Kofman told Coffee or Die Magazine. “This is standard operational deception from a doctrinal perspective. If [Russia] were considering a strategic offensive operation, they would be taking care to ensure they concealed indications and warnings until fairly late into the game.”

For more than a month, the buildup and redistribution of Russian forces on Ukraine’s borders have spurred assessments — both from civilian experts as well as military officials in the US and Ukraine — that a major Russian offensive may be imminent.

According to a recent Ukrainian military intelligence estimate, Russia may have some 120,000 troops staged for an assault on Ukraine. Recent Western media reports, citing US intelligence assessments, say Russia may be able to mobilize 175,000 military personnel to attack Ukraine on short notice. These military assessments are presumably based on classified information, including satellite imagery, signals intelligence, and human intelligence.

On the other hand, civilian assessments of Russia’s offensive potential are largely dependent on information in the public domain. OSINT observers often reference videos posted to social media by Russians who witness military movements. Also, commercial satellite imagery has been the crux of much OSINT data regarding Russian military activities.

“The best way to bait OSINTers are images of troop movements,” said Sean McFate, a senior fellow at the Atlantic Council who is a professor at Georgetown University’s School of Foreign Service.

“But like all intelligence, the ‘fake out’ is only as good as the analysts watching it,” McFate told Coffee or Die. “Sloppy OSINTers are easy to trick, but good ones are not. This is the pro and con of OSINT: it democratizes intelligence, but dilutes rigor since amateurs now play in the space. Some think tanks especially come to mind.”

ржд pic.twitter.com/i1Mk4P6QMm

— IgorGirkin (@GirkinGirkin) December 13, 2021

Within the Russian military, deception, or “maskirovka,” operations are meant to “hide” military units from the enemy and “mislead” the enemy’s interpretation of the Russian military’s intent and capabilities, according to the Russian Ministry of Defense.

“The concept of military deception, or ‘maskirovka,’ is built into every operation at scale; Russian doctrine is very clear that this uses information, diplomatic, economic, and military tools as needed to influence how an enemy perceives the threat and how they can act against it,” said Molly McKew, an information warfare expert who served as an adviser to the former president of Georgia.

“Russia is manipulating information streams that we use in our decision making all the time. Online, offline; in virtual or physical space; in media and diplomatic inputs; through traditional intelligence inputs and what we now call open-source intelligence,” McKew told Coffee or Die. “We do not question enough what the purpose of information we are seeing is. This is particularly true with open-source intelligence analysis, which has become hugely influential in shaping public and policy perceptions.”

Kamensk-Shakhtinsky, Rostov Oblast, Russia.

A large number of tanks, BMPs (and MT-LBs?) missing from their home base, the 91st Central Automotive Equipment Reserve Base, as of November 16, 2021. pic.twitter.com/ASiSKEk4w9

— Status-6 (@Archer83Able) December 12, 2021

Russian deception operations are broken down into “strategic camouflage” and “operational camouflage.”

According to the Russian Ministry of Defense: “Strategic camouflage is carried out by decision of the Supreme Command and includes a set of measures to keep secret the preparation of a strategic operation […] as well as to disorient the enemy regarding the grouping of the armed forces, their state and intentions. It is planned and organized by the General Staff of the [Russian Federation’s] Armed Forces.”

Operational camouflage, on the other hand, “is carried out by conducting demonstrative actions, imitating the concentration and disposition of troops, military facilities, disinformation about the state of their troops and the nature of forthcoming actions in the preparation and conduct of operations. It is carried out in order to achieve surprise in the actions of troops (forces) and to ensure their survivability.”

While Russian deception operations target adversaries’ spy satellites and signals intelligence, deceiving OSINT watchers also allows Russia to sway much of the media and think tank narrative regarding its possible military plans.

“It’s not about analysts at the Pentagon, it’s about the politicians and the press and their perceptions. It is these perceptions that limit policy options,” said Matt Armstrong, a former governor on the Broadcasting Board of Governors who now specializes in Russian political warfare. “Russian leadership would be stupid to not manipulate the public narrative. They have the demonstrated capability [to do so].”

The use of information warfare is nothing new in the annals of warfare. Even so, Russia’s ability to exploit modern media technologies — social media, in particular — has been a potent force multiplier for its contemporary kinetic military operations. Notably, Russia used information warfare to deny its overt role in military operations in Ukraine’s Crimean Peninsula and Donbas region in 2014.

“Russia is trying to manipulate OSINT, like everything else. It’s a part of their centuries-old strategic culture of strategic deception,” McFate said. “OSINT is the future, and people would be shocked to learn how much can be gleaned by scraping the dark web. Unfortunately, the US Intelligence community pooh-poohs anything that’s not labelled ‘top secret.’ It’s creating a strategic vulnerability.”

There’s also the risk that Russian intelligence services are selectively steering the dispersion of open-source intelligence to craft a public narrative that complements planned military action. Unlike the information gathered by state intelligence services, which typically remains classified, Russian intelligence agencies are able to gauge the effectiveness of their OSINT deception efforts in real time.

“The danger of relying too much on OSINT is that you don’t know what percentage of activity OSINT is actually seeing, and therefore you have no idea as to the actual size and disposition of the force in question, only a shadow outline of the reality,” Kofman said. “This is why news sources have to rely on credible analysis and a diversity of sources.”

Брянська обл. 14.12.2021 pic.twitter.com/VJ7ISvzwZV

— 4emberlen (@4emberlen) December 14, 2021

According to McKew, when it comes to open-source intelligence, analysts should not only question whether information is true, they should also question why each item of information is available in the first place.

“So when everything seems to be in the open, why?” McKew said. “Is it because Russia doesn’t care that we know, or because it isn’t the thing to focus on? What are we not looking at because we are looking at this torrent of info?”

A full-scale Russian offensive against Ukraine would be a far different type of operation than the ongoing war in the Donbas. For one, Russia will not attempt to conceal its participation in the war — with airstrikes and advancing tank columns, that fact would be impossible to deny. Thus, the role of OSINT manipulation may not be as important in a large-scale, conventional military operation.

“I don’t think [the Russians] care about OSINT as much, which is more collateral damage, they care more about deceiving national intelligence services,” Kofman said. “The way they have gone about it is concentrating units in smaller numbers or groups to make it more difficult to track equipment, moving them back and forth, and drawing attention to specific sectors by releasing information to encourage people looking there.”

Russia built up military forces around Ukraine in April, similarly sparking fears of an imminent invasion. In addition to probing Western diplomatic responses, the April buildup may have been a dry run to gauge the ability of foreign intelligence agencies and OSINT watchers to monitor Russian movements.

“I think the April event served a few purposes,” Dara Massicot, a senior policy researcher at the Rand Corp., said. “Internally it was a learning event for them to see how their own transportation and logistics worked and coercively signal Ukraine and the West. Also, I presume they were learning about how they were observed from the outside. They have changed some of their behaviors since then, but some large movements they cannot change.”

The current crisis, however, is generally seen by Western experts and officials as more serious than in April. By moving units at night and taking steps to curtail social media documentation, the current buildup has been done more covertly. Also, the Russian units near Ukraine are more capable of short-notice combat action, and the information messaging from Moscow is much more aggressive than in April.

“There is a much bigger plan going on here and I think very few — to include even in the Russian military — truly know what the intent or plan is along the Ukraine border,” said John Spencer, chair of urban warfare studies at West Point’s Modern Warfare Institute.

“So yes, OSINT is feeding a collective hive opinion on Russia’s intentions that is very likely, almost surely, wrong.”

Read Next: Exclusive Front-Line Report: Modern Trench Warfare in Eastern Ukraine