Sergey Nivens - Stock.Adobe.com

News

The Security Interviews: Inside Russia’s Ukraine information operation

Computer Weekly speaks to Craig Terron of Recorded Future about delving deep inside the Russian disinformation machine, and how the Kremlin’s strategy is set to evolve

This article can also be found in the Premium Editorial Download: Computer Weekly: Inside Russia’s Ukraine information operations
Alex Scroxton
By
Published: 07 Jul 2022 5:00

Undaunted by the failure of its narratives to take root, the Russian-state information machine is changing up its tactics as it seeks to capitalise on the war in Ukraine – and as the war drags on, causing further disruption and economic pain, more refinements are coming imminently.

This is the view of Recorded Future’s Craig Terron, who spends his working days immersed in the pro-Russian propaganda, disinformation, misinformation and memes that have sprung up across the internet since the 24 February invasion, and has just produced a major new report on the subject.

“For this particular report, we looked at a Russian information operation where we’ve seen that Russian influence networks, like the state-controlled media, non-covert intelligence outlets affiliated or directed by the FSB [Federal Security Service] or the SVR [Foreign Intelligence Service], are conducting a multifaceted information operation to undermine and divide the Western coalition in Ukraine – so, think the US and European countries, and even Turkey – and to persuade European populations in support of Russia and their war against Ukraine,” says Terron.

“From that, we identified several different narratives as part of this wider information operations. One of them is directly trying to undermine and divide the Western coalition by stirring discontent between those countries – between Poland and Ukraine, for example – or between Germany and Poland.

“The others are more indirect, trying to portray Ukrainian refugees in a negative light and the impact that they have on their host countries to persuade those populations to be against [their own government’s] Ukraine policies and more pro-Russia as well.”

Terron spoke to Computer Weekly on the fringes of Infosecurity Europe 2022, which returned as an in-person event this year after a pandemic-enforced hiatus. He highlighted new intelligence that suggests Russia is moving on to sowing and exploiting divisions between member states within the European Union and Nato, while simultaneously targeting its own people – and people in former Soviet states – with misinformation designed to tempt people back to Russia’s side.

Much of this most recent intelligence stems from a leaked note purporting to originate from the Fifth Service of the FSB, published by the Security Service of Ukraine (SBU) on 5 June. The note discusses some of the Russian information operation’s failures during the war and provides some chilling recommendations for its efforts moving forward.

“Some of the initial failures, to take an example, was that their narrative around trying to de-Nazify Ukraine failed to have an emotional attachment,” said Terron. “It failed to detail things like Ukrainian Nazis [allegedly] killing children in the so-called Donetsk and Luhansk People’s Republics.

“Another example was that they failed to explain that Russia’s full-scale invasion was the only option that they had available, and that there weren’t other options.

“Then it talks about targeting four different audiences: the Russian population, the Ukrainain population, post-Soviet countries and the European population.”

According to Terron, some of the proposed narratives for former-Soviet states will likely focus on the opportunities for collaboration between them and the Donetsk and Luhansk puppet states when it comes to future reconstruction and development projects.

Populations within the EU, the UK and the US, on the other hand, will be targeted with narratives that try to portray their governments as at fault for the rising cost of living, especially food and fuel, and the resulting insecurity, saying it is European leadership that is responsible for such hardships for prioritising sending weapons and money to Ukraine.

Russia may also seek to “update” the Nazi narrative to draw direct lines between Ukraine today and Germany in the 1920s and ‘30s, and pose questions about the supposed hypocrisy inherent in banning Nazis at home while allegedly supporting them in Ukraine. This may draw on western sources, including the 2019 BBC documentary Rise of the Nazis and similar TV programmes.

Future operations will also target Russians themselves, particularly younger people who may be more inclined to be anti-war, enlisting pro-Russian celebrities, reality TV stars and sportspeople, while smearing those who have rejected Putin’s war.

The note also recommends “turning down the accusatory heat” within Russia on traitors, portraying young people instead as victims of American and European propaganda and welcoming them back into the fold.

Seize the memes of production

The Ukraine war being a conflict of its time, the Russian information operation focuses not just on fake news and manipulation of facts through its own propaganda mouthpieces – Russia Today (RT) and Sputnik are the main “mainstream” media outlets – but through memes.

“A very common thing that we saw was the use of memes,” says Terron, “some of them very creative memes, to try to influence audiences.”

Ref 1: Russian Meme produced by Z Memes. Image courtesy: Recorded Future

One such meme (Ref 1) seeks to undermine the integrity of the European Union (EU) response. It depicts a cartoon of the EU standing over Ukraine, which is trapped in a ditch. The EU tries to hand a rope down to Ukraine to help it out, but only ends up hanging itself on a nearby tree.

Others seek to sow divisions between European states, focusing on historical incidents or grievances. One meme (Ref 2),  uses the popular format of a conversation between the characters Anakin Skywalker and Padmé Amidala from the Star Wars film Attack of the Clones, to exploit narratives around the westward shift of Poland’s borders after the Second World War.

This redrawing of the map saw historically Polish cities, including Lviv (historically Lwów or Lemberg) ceded to the Soviet Union and latterly Ukraine, and a major population transfer as well. The meme kindles the idea that Poland should seek to reestablish its pre-1939 borders, possibly by force.

Ref 2: A Russian Star Wars meme produced by Cyber Front Z, translated: Poland: “We will free your territory.” Ukraine: “From the Russians?”. Image courtesy: Recorded Future

Just as Ukraine has created its own IT Army of friendly hacktivists, many of these meme operations comprise groups of Russian netizens who are tied to but not directly controlled by the Kremlin itself, such as the Cyber Z group, which is apparently located in St Petersburg and commissions memes from a troll farm, says Terron.

“There are also pro-Russian Telegram channels, which might just be members of the public who are also creating these types of memes. It’s very hard to tell whether they are being commissioned specifically,” he says.

The zone is flooded

Terron and Recorded Future shy away from referring to Russia’s information operation as an information war on the basis that influence and information are just another tool to be used in the service of a kinetic war.

“We typically use the term information operation if its more coordinated, or just influence operations and influence networks that are spewing disinformation and propaganda,” says Terron, “influence being more all-encompassing than both disinformation and misinformation.”

The Russian information operation seems to centre the tactic of “flooding the zone” with malicious misinformation – the alleged FSB note, translated from Russian by Recorded Future, uses the term “saturate the information space”.

“Russian disinformation and influence operations are…less targeted,” says Terron. “It’s more just: ‘Throw this disinformation everywhere that we can as long as it fits our audience and our goals’.”

For the average citizen, countering Russian misinformation is a nigh-on impossible task – unless you are one of the many people who have supposedly signed on to Ukraine’s IT Army – but there are steps that we can all be taking, says Terron.

“There are a few known outlets that operate within the West that have ties to the Russian intelligence services, so those ones, anything they put out, watch out for,” he says.

“One key area of focus when we assess the outlook is that as the war continues, and as economic hardships become more difficult and people have to endure them for a long period of time, Russia is very much going to try to exploit those hardships to turn people against sanctions of Russia, against their support of Ukraine, and prioritising domestic economic, energy and food security issues.

“Any stories around that narrative that are coming from suspect sources and Russian state media sources, or smaller outlets that are tied to Russian intelligence, are very much something to look out for,” he says. “For the average person, I’d say just look at a variety of news sources across the political spectrum.”

Persistent challenge

Looking ahead, Terron and his team predict that the Russian information operation will remain a persistent challenge through the war and beyond it.

Although the Western coalition on Ukraine is broadly united for now, the Kremlin is likely expecting its operations to yield results, particularly if the conflict drags on into the winter. Over time, says Recorded Future ,this will lead to a natural dwindling of support for the coalition and it is likely this will be exploited too.

On this basis, a “whole-of-community” response to identify, isolate, inform and counter the Russian information operation will be required.

The full report, including the translation of the alleged FSB note, can be accessed via Recorded Future’s Insikt Group.

Read more about information operations

Next Steps

A quick explanation of the splinternet

Read more on Privacy and data protection