Using online news and videos, cyber warfare draws in ordinary citizens with the risk of turning them into pawns. Russia sees the information space as “geopolitics,” while Ukraine is intent on sending messages to arouse sympathy across the world. What is going on in this unprecedented “information warfare”?

On February 24, 2022, Russia began its military invasion of Ukraine, calling it a “special military operation.” In the information space, cyberattacks have preceded the military invasion, while the spread of disinformation mostly along the Kremlin’s narrative has also been observed. Russia’s information warfare and Ukraine’s counterattack information warfare are attracting attention as a new phase of war—a hybrid warfare. Yet in various Japanese media, terms like information warfare, influence operations, disinformation, and fake news are jumbled, without a clear distinction of the actual state. Also, amid the Ukraine crisis, every one of us possessing a persona in cyberspace, including social media, is a party in this information warfare. However, “entering the war” in cyberspace via the weaponized social media with little sense of ownership can be perilous.

The Three Layers of Russia’s Information Warfare

In this military invasion, Russia implements influence operations in three layers:
　[1] Narratives targeting international opinion to justify Russia’s invasion
　[2] Disinformation to confuse Ukraine citizens and make them lose trust in their government
　[3] Military deception
There are cases where [2] or [3] are used as narrative, and [1] can function not only to justify Russia but also to erode social trust in the Western countries, and it must be noted they can have multiple roles.

According to Mark Laity, NATO’s former Chief Strategic Communications at the Supreme Headquarters Allied Powers Europe, in the security context, the narrative is more than merely a “story” but an explanation of events in line with an ideology, theory, or belief, and one that points the way to future actions. This narrative is presented in a story style and could be considered a strategy for influencing people’s cognition. A strategic narrative in security aligns the strategy and the narrative so they become mutually supportive and integrated. It includes disinformation that supports the strategic narrative.

Meanwhile, from the reports of the EU and various preceding studies, “disinformation” can be defined as malicious information to intentionally cause public harm. Besides false information, disinformation can include true information but proliferated in a wrong context or with manipulated details, so it can be true or false. Since disinformation by state actors is a type of information-manipulating cyberattack aiming to compromise democracy and divide and destabilize society, it is now recognized as a concept that broadly covers strategic narratives and some military deception.

As for [1], the typical narratives since the 2013 Euromaidan which became the source of the latest military invasion, and the Crimea crisis in 2014, are: “the Ukraine government is a neo-Nazi, committing genocide in the eastern pro-Russian regions,” “Russians and Ukrainians have a historical unity,” and “NATO threatens Russia’s security.” Grounded in these claims, the Kremlin states this military operation aims to protect Donetsk and Luhansk People’s Republics from Ukraine’s aggression.

The typical case for [2] is the February 15, 2022 cyberattack on Ukraine’s defense ministry and two national banks, and the related disinformation campaign. The banks’ websites were taken down by DDoS attacks, and around the same time, civilians in Ukraine received fake information via short message service (SMS) posing as the banks saying, “the ATMs cannot be used.” As this disinformation circulated, temporal confusion spread across the people, but they themselves confirmed the ATMs were working and refuted on social media. Major U.S. security firm Mandiant analyzed the series of attacks as having two objectives: “induce the public to the banks’ website and cause access concentration, making them take part in a pseudo-DDoS attack,” and “incite fear among citizens and damage their trust in the government.”

As for [3], the typical case is Russia’s ministry of defense announcement on that day, February 15, saying, “Russian troops are withdrawing after concluding military exercises.” This was deceptive information for accomplishing a “special military operation” like a blitzkrieg. But Western media debunked it by analyzing commercial satellite images and pictures and videos from social media. On February 18, based on U.S. intelligence, President Biden denied Russia’s announcement, saying, “I am convinced he (Putin) has made the decision (to invade Ukraine).”

From the start of 2022, with growing tension between Russia and Ukraine, the EastStratCom Task Force, established by the EU in 2015 to counter Russia’s disinformation campaigns, confirmed 263 cases of such disinformation (as of April 30, 2022). Since the task force was set up, it has found 5,290 cases of Ukraine-related disinformation, showing the Kremlin’s continuous attempts at influence operations. The web media and social media accounts of Russia’s state-sponsored RT and Sputnik, and the mass accounts generated by the Internet Research Agency (IRA), a private organization funded by the oligarch Yevgeny Prigozhin with close ties with the Kremlin, have been used for the disinformation campaigns. According to the U.S. Treasury sanction announced in January 2022 and April reports from Microsoft and Meta, government agencies such as Russia’s Federal Security Service (FSB), Main Intelligence Directorate of the General Staff (GRU), and Belarus’ State Security Committee are involved in these influence operations.

Wartime Ukraine Actively Strikes Back

In response to these Russian attempts, Ukraine is also engaging in influence operations as counter attacks in information warfare.

Coinciding with the Russian invasion on February 24, the information claiming, “President Zelensky and the Ukrainian troops fled from the capital of Kyiv” was posted on Facebook and other social media by Russia-related accounts. To this, Zelensky immediately posted a video from Kyiv and refuted it as disinformation. In this way, the Ukraine government has objected aptly to narratives and disinformation launched by Russia. The civilians in Ukraine are also actively uploading images and videos on social media and this has been effective in countering using on-site information. For example, a video of young Russian soldiers held captive saying they were taken to war while told it was just an exercise, went viral on social media and raised questions among international opinion on the ways of the Russian military. However, Article 13 of the Geneva Convention, relative to the Treatment of Prisoners of War, states, “prisoners of war must at all times be protected…… against insults and public curiosity.” So, despite being an effective method that appeals to people’s hearts, all such activities should not be tolerated.

The Ukrainian government has been very successful in sending out the narrative in various ways. Zelensky addressed the parliaments in several countries online, mentioning “Pearl Harbor” for the U.S. and “nuclear accident” and “sarin (nerve gas)” for Japan. Takahisa Kawaguchi, Principal Researcher at Tokio Marine dR Co., Ltd., evaluates this as a part of cognitive warfare, with Zelensky using tailored keywords and contexts to appeal to each country’s historic emotions.

The Zelensky administration is very skillful in forming the narrative of “Ukraine resisting against villainy Russia,” but caution is needed since not all of this comprises true information. For the battle of Snake Island (Zmiinyi Island) on February 24, Ukraine announced “Ukrainian border guards died in battle rather than surrender,” which was praised in the international community as a kind of glorious tragedy. But the Kremlin announced the guards were captured after they surrendered, debunking Ukraine’s claims. Later, the State Border Guard Service of Ukraine and the Ukrainian Navy admitted all the border guards were alive under Russian captivity. The mere loss of communication with the border guards was staged as “death for honor.” But the last words of the border guards before the line was lost, “Russian warship, go fuck yourself,” became the slogan at rallies in various countries by Ukrainians and their supporters. The phrase is quoted in comparison with “Remember the Alamo” from the Battle of the Alamo in the Texas Revolution in the nineteenth century. This is a typical way of forming a narrative that spurs historic memory.

The Ukrainian government not only addresses cyberspace but also takes physical measures. It hunted down and closed five bot farms that were sending fake news and seized the equipment. Revealing Russia’s bot-farm operations also promotes the pro-Ukraine, anti-Russia narrative.

Continues in #2

This is a translation of the Japanese article published in Vol. 73 (May/June 2022) of Gaiko (Diplomacy) magazine.

Tomoko Nagasako is a Research Fellow of Security Studies Program at the Sasakawa Peace Foundation. She earned double MAs from the Graduate School of Humanities and Sociology, the University of Tokyo and from the Graduate School of Information Security, Institute of Information Security. Her most recent work is, “Global Disinformation Campaigns and Legal Challenges,” International Cyber Security Law Review, Vol. 1. Springer.