Resisting Russian information warfare: Lessons from Ukraine

Joyce Hakmeh

Good evening, everyone, and welcome to Chatham House for this panel discussion tonight on Resisting Russian Information Warfare: Lessons from Ukraine.” I’m Joyce Hakmeh, I’m the Deputy Director of the International Security Programme here at Chatham House and the Co-Editor of the Journal of Cyber Policy.

The cyber element to the War on Ukraine has been, arguably, one of the most interesting case studies on the role that cyber can play in conflict. At the beginning of Russia’s War on Ukraine, many expected that cyber will play a very big role and that we will witness several cyberattacks that will have devastating consequences on not only Ukraine’s capacity to defend itself, but also, will have a spillover impact on, potentially, you know, our Western allies.

What we have seen, however, is quite an impressive resilience on the Ukrainian front against the cyberattacks, but also, against information campaigns and influence campaigns, more generally. And basically, this was due, in part, or in large parts, to the public-private partnerships that we have seen, to the big role that civil society and citizens have played, to an international support that the Ukrainians have received, but also, importantly, due to thorough preparation and anticipation of some of those threats.

In a year that is increasingly being known as the year of elections, a very important question we want to ask and answer tonight, how can other countries who are, you know, going through those, sort of, democratic processes and elections, how can they learn from the Ukrainian experience and better prepare themselves against influence campaigns, whether these are from Russian actors or others? And to do that, we have a fantastic panel with us tonight. Let me introduce them very briefly. Although their bios are very long, I’m going to just pick and choose some of their highlights from their career.

I’ll start with Keir Giles, who the – who’s a Senior Consulting Fellow at the Russia and Eurasia Programme here at Chatham House. Keir has supported the institute, or Chatham House, since 2013. Previously, he worked with the BBC Monitoring service and the UK Defence Academy, where he wrote and advised on, basically, everything Russia. And he’s the author of multiple publications explaining the Russian approach to warfare, including “NATO’s Handbook of Russian Information Warfare.” We have few copies…

Keir Giles

I don’t.

Joyce Hakmeh

…on – we don’t?

Keir Giles

No.

Joyce Hakmeh

Okay, they’re gone, then.

Keir Giles

No, no.

Joyce Hakmeh

We don’t have copies. And he’s written, like, you know, like, several, sort of like, articles and papers. I’m not going to talk about all of them, but I will, however, mention a recent paper for Chatham House that Keir has written on the topic of the discussion today, entitled “Russian Cyber and Information Warfare in Practice.” I think we have some copies of that, so please do take them before you leave.

Our second speaker is Belén Carrasco Rodríguez, Project Director at the Eyes on Russia, the Centre for Information Resilience. This organisation was established to investigate, document and expose Russia’s human rights abuses, war crimes and information operations and its full-scale invasion of Ukraine, through open source investigation. And she’s going to be talking to us tonight about this. Prior to her current job, Belén worked at the NATO Strategic Communications Centre of Excellence, investigating covert influence techniques by state actors, Russia and their proxies. And she was also an Associate Director at open source intelligence consultancy, Neon Century. Welcome, Belén.

And finally, Olga Tokariuk, who is the Open Society University Network Academy Fellow at the Ukraine Forum here at Chatham House. Olga has a background in journalism, with a focus on international affairs and in counter-disinformation research. She’s a former Fellow at the Reuters Institute for the Study of Journalism at the University of Oxford and a non-resident Fellow at CEPA, the Center for European Policy Analysis.

So, welcome to all of you, and before we start the discussion, just a few housekeeping notes. So, this event is not under the Rule. It’s on the record and it is being recorded, so you’re free to take pictures, attribute, tweet. Everything you want to do, you’re free to do so. We are – we will have – the first part of this discussion will be a moderated discussion with the panellists, and then, we’ll turn to you for your questions online and in the room. So, please prepare those and we will make sure that we leave enough time for them.

So, with that, I’d like to start with you, Keir, and with my first question. Before we go into, sort of, talking about what happened in Ukraine, I was wondering whether you can walk us a little bit through the Russian approach and what does this, sort of, Russian approach to cyber and information warfare look like? And how is it different than how Western nations think about these two, kind of, fears? And what are the practical implications of these differences on defence and security thinking?

Keir Giles

I don’t think I’ll walk you through the whole of the Russian approach, because we have only…

Joyce Hakmeh

Will take a lot of time, yeah.

Keir Giles

Yeah, exactly. There is, unfortunately, not really a short way of saying it, except it is totally different from how information activities, information operations, were understood in Western militaries. This time ten years ago, I was doing quite a lot of going around explaining what Russia was thinking and how the doctrine on using information for strategic effect was developing, talking to bits of NATO, allied militaries, those parts of the UK system that could be induced to take an interest. And that made it very clear that there was a huge divergence between how Russia was thinking about developing this as a war winning tool and how it was seen in Western militaries. It was, sort of, not at all how NATO, as a whole, thought about information or its individual members. And then, of course, you had the Russian seizure of Crimea, which demonstrated some of those Russian ideas in practice.

If I – I’ll try to keep it brief and narrow it down to two key points which were so very different from how information confrontation was envisaged on our side. First of all, the fact that it is permanent. The name says ‘information warfare’, but this is something that happens all the time. It is not dependent on a state of peace or war. If you are a perceived adversary of Russia, whether you know it or not, then you are going to be the target of information warfare activities.

And secondly, it’s holistic. It brings into itself so many different disciplines that at the time, when this became prominent, most Western militaries would actually silo into different areas of activity. You had cyber, you had information operations like psychological operations, you had influence, you had strategic communications. All of these different disciplines for Russia, come under this single heading of information warfare, and for them, it was an artificial distinction to treat cyber as something different from information warfare.

The important point was the information. Cyber was just the technical representation of information. So, it was another means by which you would deliver the information that you are trying to get across to your target, and so, delivering something by email, for example, wouldn’t be conceptually different from delivering it via print media or walking up to somebody on the street and telling them. It would all be the same thing.

I’ve brought along a glossary, a Russian glossary of information security terms, that we borrowed a while back from the Academy of the General Staff, because the definition in here of information warfare is really enlightening. It includes so many different aspects of things that we think are totally different, including things which, see, even now, don’t form a part of our concept of disinformation confrontation, like electronic warfare, like acoustic security. How exactly do you intercept somebody else’s communications through acoustic insecurity, listening in, basically?

So, all of these different elements came together in the Russian idea and the really important part, of course, is that cyber – ten years ago there wasn’t even a Russian word for cyber activity. So, it was so unfamiliar was a separate context that they borrowed some of the Western terminology. So, it’s an integrated challenge in much the same way that China treats information in the same way, as an integrated challenge, and so, defences against them, similarly, have to be integrated and cover all of those different holistic aspects in order to be complete.

Joyce Hakmeh

Do you see Western countries going in the direction of, sort of, addressing those challenged – challenges in an integrated way, or do you still see that there’s still, like, some big separations that are impeding, like, a good and holistic response?

Keir Giles

No, that has happened. There has been what some Western countries have referred to a proc – as a process of ‘convergence’, where they’re bringing together all of these different aspects of the challenge and trying to see them as an integrated whole. Russia, by contrast, didn’t have to go through a convergence, because they never diverged in the first place. So, if you have the same conversations today, going to Western armed forces and talking about information operations, there’s a lot of very active thinking about how it can be used, and you have to respond, “Oh, yes, that’s all very nice.” Trouble is, the Russians were working this out 20 years ago, so there’s quite a lot of catching up to do.

Joyce Hakmeh

Hmmm hmm, particularly when you want to transla – or, like, take it outside of just the armed forces and, kind of like, at a whole of government level. But let’s talk about what happened in Ukraine and how did this approach manifest on the ground? You talked about it’s ‘permanent’, it’s ‘holistic’, it’s not related to, kind of like, ‘peace’ and ‘war’, but ultimately, there are some, sort of like, dimensions to their approach that will have – that we’ve seen in Ukraine that are, kind of, worth mentioning. What are they?

Keir Giles

Yes, things that we were expecting to happen when it did move to full-scale conflict. And I say expecting, because we were tracking. We were watching carefully, not only what the thinking part of the Russian Military and Intelligence Services were saying about what you can do with information, but also, the process of testing and implementation and trying out new tools. We saw that happening in Ukraine itself, we saw it happening in Syria. We even saw it happening across the frontier, with NATO, into the Baltic states. On each of these occasions, you can see Russia attempting something and then shelving it and then putting it aside, and then, it resurfaced when it was put into use in Ukraine in February of 2022.

So, there are lots of different examples of the things that we saw happening that came out. I’ll just take a few of them. One of them was information interdiction, information isolation, trying to make sure that the people who you are attempting to influence don’t have any outside sources of information, other than what is being provided to them by Russia.

Now, in that respect, Russia built on the success in Crimea, which for a while, was held up as the gold standard of conducting operations with the use of information, because it was a massive geostrategic gain which involved only a few shots fired and only one fatality, and that was an accident. And they said, “This is because we achieved complete information isolation,” first through print and broadcast media and then, moving to target the single points of failure for internet connection within Crimea so that they had no other sources of information of what was going on.

So, Russia looked around the world at other way – other places where that could be replicated. There aren’t many that reproduce the exact same conditions as Crimea, but that’s what lay behind the intensive programme that we observed in 2015 through 2017, of reconnoitring sub-sea networks, satellites, all of the different points of vulnerability that Russia could target to reproduce the same effect. So, that was attempted in Ukraine.

We also saw things like tailored, targeted disinformation, things which are not mass produced, but delivered directly to people’s connected devices with an attempt to make it specific to them. We saw use of cyber to assist both of those, not as a standalone tool, but actually facilitating all of these other aims and, of course, the external disinformation campaigns that were directed not at Ukraine, but at other audiences, like, for example, Russia itself domestically or at us, the West.

But some of the points that you mentioned about the expectations for massive destructive strikes were actually constrained by how Russia thought this operation was going to go. Because if you believe that this is a three-day special military operation, as opposed to a war, you’re going to take things over intact, as opposed to destroying them, and that includes the infrastructure that you would otherwise have eliminated in order to facilitate your war aims. So, there was limited disruption.

But one thing that did work very well, tragically, was the way in which Russia exploited personally identifiable information on individual people to conduct their campaign of rounding up individuals that they saw as a threat in the temporarily occupied territories for murder, torture, interrogation, filtration, whatever it might be. And there, they exploited information that was acquired through cyber means that we might not necessarily think as a national security challenge, things like health records, insurance records, things that you don’t necessarily think of as needing protecting, beyond privacy legislation. But here, it was exploited to reproduce in the invasion of Ukraine, the same procedures that we saw from Russia in past centuries, for example, moving into the Baltic states, rounding people up for deportation and enslavement. That tells us how much disinformation needs to be protected in order not to replicate that situation elsewhere.

Joyce Hakmeh

Great, thank you, and Belén, if I can go to you and – through the work that you do in Eyes on Russia, it’s all about documenting what’s been happening. So, Keir talked about, sort of, the information isolation, the targeted disinformation, cyber, but limited destruction, however cyber as a support of the influence, and this exploitation of personal information. What is it that you’ve seen from your view – your organisation?

Belén Carrasco Rodríguez

Yes, so for a bit of context, because I think that I am the only one that is not from the House today. So, Eyes on Russia has been documenting since December 2021, since before the beginning of the full-scale invasion, using open source investigations to document Russian crimes, like Russian military movements, and at the same time, influence operations. And at the same time, we spend a significant part of our times in Ukraine, working with prosecutors and law enforcement in war crime investigations, including Russian operations in the information on cyber domains.

So, from this work, I would say that what we’ve seen in the cognitive manip – like with regards to Russia’s cognitive manipulation and information operations, is that Russian information operation activities have had different levels of success and co-ordination, depending on the target. So, Russian information operations have had limited success when reaching Ukrainian audiences and main efforts have been driven towards influencing audiences within the temporarily occupied territories. Then, when it comes to global audiences, we see moderate and uneven level of success, with highest impact in those countries with lower levels of resilience or historical exposure to Russian influence operations. And finally, significant levels of success in what comes to influencing Russian audiences, specifically those audiences based in Russia, because pre-invasion levels of influence and other factors, like the isolation of the information environment.

So, in Ukraine, specifically, we have seen, as I said, limited instances of success, but some of them are – some of their attempts to control the information environment have been successful. For example, those attempts at trying to spin the narrative in their temporarily occupied territories or obscure or establish plausible deniabilities in the commission of war crimes or crimes against civilians. So, for example, what we have seen is they’re establishing this dichotomy between occupiers and liberators. So, there have been a lot of activities focused at delivering humanitarian aid, taking care of children, supporting women in temporarily occupied territories, just by – like, in order to provide protection and a feeling of comfort that detaches the audiences from, like, the occupation, like, perception and builds this image of liberators.

And this strategy has been amplified by embedding Russian or pro-Russian protagonists within specific units and battalions on the ground. So, they film, like, Russian units in delivering humanitarian aid or celebrating – organising celebrations for the International Children’s Day and children’s being happy and feeling grateful that the Russians are there. And they film this sort of content and they spread it in their different, several, social media channels, in order to build this image of Russians as liberators, versus, like, Russians as occupiers.

And other instances of success we can see when establishing shedding – casting doubt on attribution for crimes against civilians and this is the recurring narrative of legitimate military targets within civilian facilities in – that has – have been targeted, with significant levels of civilian casualties. Some of them – I’m not saying that it’s never true. Like, some – in some instances, there have been legitimate military targets inside these facilities, but this is a recurring narrative that Russia uses, sometimes in a misleading way, like, many times in a misleading way, to disrupt justice and accountability efforts.

And in temporarily occupied territories, these softer means of influence are always joined by, like, harder means of influence, just like a physical coercion, or indirect coercion, let’s say door-to-door visits or abductions, in order to spread fear, so inhabitants of a specific area do not share the reality on the ground. And, of course, like, the recruitment and establishin – establishment of a network of Ukrainian collaborators that take over communication platforms and actually take over the full, you know, communication of the regional administration and their basic service providers.

But beyond these specific instances, targeted instances of successful information operations, and as I said, mainly happening in temporarily occupied territories or in occupational activities, we can say that Ukrainian resistance and resilience against Russian influence effort has been extremely high. So, yeah, that would be my take.

Joyce Hakmeh

Yeah, a great way to end…

Belén Carrasco Rodríguez

Yeah.

Joyce Hakmeh

…your intervention. Olga, if I can come to you and ask you whether – I mean, we’ve heard Keir and Belén talk about how the, sort of, the Russians – the operation manifested in the Ukrainian context. Was any of it a surprise from the Ukraine point of view, and how did the Ukrainians respond?

Olga Tokariuk

Yeah, well, I think I won’t exaggerate if I say that it wasn’t a surprise, that most of the tactics that Russia used since February 22 were already used by Russia in Ukraine since 2014, when the invasion of Crimea and Donbas first started. So, that was accompanied by a massive disinformation campaign, by the – by an attempt to disrupt and penetration the information space, to pollute it, to, you know, wage war in the information space. And then, it caught Ukrainians by surprise, but since then, a lot of capacity has been developed, both on the government level and on the civil society level so that Ukrainians were already resilient enough to withstand Russian attacks.

Russian didn’t invent any, like, silver bullet. You know, they didn’t approach the full-scale invasion in a particularly innovative way. So, most of the actions that they planned were easily predictable and therefore, Ukraine managed to resist them, thanks to the capacity, thanks to the resil – experience that was already there. But also, thanks to co-operation with various foreign entities, again on the governmental level, on – in the private sector. I think we’ll elaborate on that a little bit later.

And, you know, talking about how Ukrainians responded. So, well, I am a Ukrainian and I was in Ukraine in the very first seven months of the Russian full-scale invasion, before I came here to the UK. And I saw with my own eyes how, you know, like, all society, basically, mobilised to not just defend Ukraine on the battlefield, like those people who felt the, you know, the energy and, you know, who felt that they had to do that, they took up arms, but those who didn’t even join the fight physically on the battlefield, they still asked themselves, “How can we help? How can we contribute?”

And therefore, this effort to resist Russian attack in the information space, while the Government did prepare for it, while the Government tried to do something by, for example, centralising their in – flow – the information flow by uniting Ukrainian TV channels in a so-called united TV marathon, so that people would have access to reliable information. Well, now, obviously, there are a lot of questions how, you know, that is still – whether it’s still necessary to have that united TV marathon two years into war. But in the early stage of the invasion, that proved to be a good decision to give people access to credible information.

But in addition to government level – to government actions, the actions of civil society were very instrumental. I would, you know, highlight the role of the media played, the Journalists played. So, not only the united TV marathons, but a lot of other Ukrainian independent media outlets that continued operating, reporting from the ground, that was really crucial. Then, you know, Ukrainian groups, hactivists, so-called hactivist groups, who, you know, repel Russian cyberattacks, warn about them and also, try to disrupt Russian and penetrate Russian information space and, you know – with the – in the interest of Ukraine. And many Ukrainian, also, tech companies, businesses, they joined the effort of resistance by, you know, offering the Government their services, their capacity. Some of them are using new technology, artificial intelligence and they co-operate with the Government to detect Russian disinformation and, you know, infor – influence campaigns.

And just – I just observed how ordinary citizens, they also were trying to do whatever they could by taking on social media. What must be noted is that Ukraine severely limited, also, the access of Russian actors to its – and their capacity to penetrate Ukrainian information space, by banning Russian TV channels, by banning Ukrainian TV channels that had links to Russia, in the years preceding the full-scale invasion. The decision that has been criticised by some organisations at the time, but it proved to be really crucial, because at the moment of the full-scale invasion, Ukraine didn’t have those hostile agents operating on its territory, so these decisions proved to be really important.

So, Russia, without having access to Ukrainian mainstream media and without having agents of influence who were allowed to operate freely in Ukraine, they relied increasingly on social media, on direct targeted messaging of Ukrainian citizens. And the Ukrainian citizens, in co-operation with the Government, were able to counter that and to even take a part of that information warfare to the territory of Russia, when – we’ve heard of the instances of Ukrainian hackers breaching Russian TV networks, transmitting their speeches of President Zelenskyy, for example.

So, yeah, and thanks to the capacity that has been there, Ukraine, I would say, was quite successful, which doesn’t mean that the situation is not changing. The situation is dynamic, and we have seen that in the last weeks and months, some Russian attempts to breach Ukrainian cyber defences have been successful. There were Russian cyberattacks on Ukrainian mobile network provider Kyivstar, just before New Year. Just last week, there were – several days ago, there were attacks on Ukrainian postal services, on Ukrainian banks, there were successful. So, some attacks are repelled, some attacks are successful. Russians keep trying, they keep learning, but Ukrainians keep learning, too.

Joyce Hakmeh

Brilliant, thank you, and I think this, sort of like, whole of society approach that the Ukraine has demonstrated has been the source of admiration for, you know, for many. But whether this can be replicated in other contexts, I think that’s something that we will come to towards the end of this part.

But Keir, I want to come back to you to ask you about – because we talked at the beginning, and you talk a lot in your paper about the role that the private sector has played in defending Ukraine. So, if you can tell us a little bit more about the role the international partners and industry played in that. How important was it and how did it manifest? What are the, kind of – some of the key trends that we saw that we haven’t seen before?

Keir Giles

Well, Olga’s already mentioned the international coalition that was supporting Ukraine before the full-scale invasion, that was trying to build resilience, both in cyber terms, information terms, to the best extent they could, the US, the UK, Canada, other international partners, but it wasn’t just state support. There were also private industry doing things which, again, had a new unique factor that we’ve not seen before, that’s played out in this conflict. And that is ordinary companies actually playing a direct role in ensuring the survival of Ukraine, by ensuring its resilience.

Now, some of those are companies that people may not necessarily have heard on, dealing with, for ins – just for example, cybersecurity. Like, organisations like Mandiant, for example, or the threat focused bits of Microsoft. Others are household names, and they were playing a key role in making sure that Ukraine could, in fact, survive. Amazon, for example, organising the evacuation of key government data when it looked as though there was a risk of where it was being held being overrun. Removing it to the cloud so that the country can continue to function. In the same way that, for example, countries like Estonia set up data embassies previously because they knew that this was a present risk.

Google extending its protection against low-level attacks over Ukrainian media and then, a whole range of other Ukrainian critical websites in the days before the invasion and therefore, thwarting a number of Russian attacks intended to take them offline. They stayed up because the – while as an individual website, they would’ve been no match for what was thrown at them by Russia, once they were under this extended protection of Google, the level of the attacks were described by them as ‘trivial’. All of these things, and particularly the way in which cybersecurity companies were ensuring the resilience of Ukrainian networks and Ukrainian information integrity, made it a hostile environment for Russian information and cyberoperations, because everybody was working against them.

Now, that brings up a whole load of other implications for where exactly that might go in the future, because there’s also the element that the long experience that Ukraine had of countering disinformation, of making sure that their information space was resilient, not just based on the previous eight years of war, but even before that, was a key factor. But without this additional outside support, which may or may not be conditional in future conflicts, it would have been very much harder for Ukraine to withstand the level of attacks that we’ve seen.

Joyce Hakmeh

And you talked about this importance of that this international coalition was in place before the attack happened and the importance of preparedness. That can be hard to, actually, sort of like, you know, materialise in other conflicts. But, of course, this, sort of like, the role – the big role that the private sector has played in this has also, sort of, like, you know, put, you know, in focus the role of new actors in conflict, particularly in this kind of context. So, what are some of the issues that have arisen as a result of the private sector engagement? And that’s the, kind of, the first part of the question. And the second part of the question is, how do you think the private sector will engage in future conflicts? What will make them decide yes, this is a conflict that we want to support, this is a conflict that we want to support? And what is – what are the, sort of – some of the risks of those approaches?

Keir Giles

Well, on your very first point, on the preparedness, on being ready ahead of it, of course, this – here, too, Ukraine was in a unique situation. That you didn’t see any of the surprise or any of the measures during what Russian doctrinal writers would call the initial period of war, because there was no initial period of war. It had already been ongoing. So, there was plenty of opportunity to recognise the challenge and put things in place.

But on the second point, the decisions that were made by large and small information and technology companies were largely based on a values choice. They saw what was happening to Ukraine. They thought that their values were consistent with defending Ukraine against aggression. Now, the long-term cost of that engagement and that support is becoming more clear, and, of course, for a company the size of behemoths like Microsoft, that is not significant. For others, it may well become a serious issue. So, that presents a choice in future. Do you, in fact, join in if you have an open-ended commitment and no guarantee that there is going to be support, for example, from state sponsors or financing from elsewhere?

There’s also the point that in many instances, the way in which these corporations have joined in, just like the activists, the IT Army from Ukraine, the people who are taking active part in withstanding, and sometimes counteracting, Russian information operations, erodes the line between civilians and combatants.

Now, that might be a very theoretic and academic distinction in the context of a war with Russia, because nobody is expecting for a moment that going – Russia is going to observe the defined distinctions of law of armed conflict in international humanitarian law. But it does have implications for how those develop in future, and in particular, it will complicate any possible eventual search for justice, complicate prosecutions, if those protections to which people would normally be entitled, because they are not actually taking part in hostile operations, become undermined and become eroded.

That’s a serious implication and it’s one of the things that needs to be worked out before we have the next iteration of this kind of conflict. Just like the long-term status of private industry, who is going to support them, who’s going to make sure that they make the right choice in future? So, to take a really simplistic example. If we have, in the future, a Chinese move against Taiwan, is there any guarantee that IT companies which have substantial exposure, still, to China, are going to be as willing to protect Taiwan as they were Ukraine?

Joyce Hakmeh

Hmmm, and of course, there are, sort of, this issue of accountability, right? And the issues of, like, you know, sort of, the decisions to go or not to go, or when, like – and we’ve seen that with Elon Musk and, like, you know, the support on all of that. So, I guess, then, the question is, how do you organise that relationship and that [trawl – 34:45]? What would be the best way to do that and who should lead the charge?

Keir Giles

That’s precisely the problem which the major IT companies are grappling with. Now, Elon Musk is a special case in so many ways. The example of Starlink and the way the Starlink system actually replaced a large sector of Ukrainian military and civilian communications is probably the most publicised example of how private industry has been this vital enabler for Ukraine to continue to survive. But it’s also, as a result of that and as a result of its unique ownership structure, it’s been the most obvious case where some of the problems with that relationship become clear. So, do you want, as a country fighting a war of national survival, to be in a position where one of your vital capabilities for survival is actually in the hands of somebody who can change his mind about whether it’s going to be provided or not at a moment’s notice? That’s an extreme example, but the same issues apply across the board for all of these organisations, external organisations, that are supporting Ukraine.

Joyce Hakmeh

Hmmm. Great, thank you. I want to now move to the, sort of, last part of this discussion, to talk about what are some of the lessons that other countries can take? Because, of course, there are some that can be applied and some that are context specific. So, I’d like to ask you for your opinion about what are some of the lessons that you would like to share with other countries, and what are some of the ones that you think well, no, these are very much Ukrainian specific? Can I start with you, Olga?

Olga Tokariuk

Yes. So, I think, well, the lessons are what I mentioned in my first answer, that there should be decentralised effort, or at least, it shouldn’t be centralised the effort to, you know, resist the aggression in the information space. So, the Government shouldn’t monopolise, kind of, this effort, because it can’t be as fast, it couldn’t be as creative if it is just led by the Government. So, the role of civil society is crucial and building that capacity in civil society can start well ahead of any possible attack. So, you know, increasing awareness about the information threats, about, you know, the ways Russia and other authoritarian hostile states, they wage war in the information domain. So, increasing awareness of – in the society, increasing the resilience of the society, or – it’s not just media literacy. There are various tools, but just, you know, just, like, not being silent about that and raising the awareness about the threat, is really important.

Then, what Ukraine, I think, actually was very good at, and that’s the – sometimes can be applied in other contexts, that if we’re talking about disinformation, just debunking is not working. You need to apply other tools to – how to counter disinformation, and Ukraine was using prebunking as a tool a lot. So, actually – and warning and saying that, you know, “This is about to happen, we see signs of this and that based on data,” so that sending the signal to the population that, you know, “This is likely to happen so better be prepared,” that worked really well. In this, actually, Ukraine used a lot of – because Russia is obviously using technology and AI, at least tries to use that to provide – to – or, you know, manufacture deepfakes. Zelenskyy’s illusionary deepfakes that Russia released were not particularly convincing, but still, they are trying. They are playing with the technology. They are playing with it to achieve their goals.

But Ukrainians are using that too in order to actually do these prebunking campaigns, because thanks to AI tools, they collect a lot of data, what is happening in the information space, so they are able to monitor and predict some of Russia’s movements. And if – you know, this is already, kind of, being released in the information space, or the same thing as with intelligence sharing before the full-scale invasion, when everybody, or at least a lot of actors, were aware that this was going to happen, it allowed the time and space to prepare to take it more seriously, to take contingency measures. So, here, prebunking is really a good lesson, I think.

And then, the third lesson is the importance of creative approach, the importance of using humour, for example, to counter disinformation. It’s – this might not be the might obvious tool, but both me and Keir, we published papers on how Ukrainians used humour in strategic communications and countering disinformations – disinformation. There are lessons to be learned from those. Go and read our papers, please. You have taken the opportunity to advertise them. And then, the last one is – I think what is important is co-operation with tech companies. Without that, the governments, or just, you know, the civil societies, they are unable to do many things if there is no support, not just from other governments, but from Big Tech. So, co-operation with Big Tech is essential.

Joyce Hakmeh

Hmmm hmm. Are there any lessons that you can think of that you say, well, you know, these are just for this context and cannot be transferrable, particularly as countries are thinking about how to protect their elections?

Olga Tokariuk

Well, I think I – these are all lessons that can be implemented in other contexts. I don’t think any of them cannot be implemented, but maybe my colleagues have something to add.

Joyce Hakmeh

Thank you. Belén?

Belén Carrasco Rodríguez

Yeah, so, I think I’m going to be brief because we probably need some time for Q&A. But I would say that some lessons that we can take from the Ukrainian example are, first of all, like, productivity and forward planning. So, Ukraine was great at proactive strategic communications, supported by Western governments and multilateral organisation, disclosing, for example, secret intelligence ahead of Russia’s full-scale invasion, that then, it could be used to assess Russia’s intentions and capabilities. And, also, what Ukraine was great at is at spreading moral boosting messages amplified by a highly active diaspora, that actually kept the morale very high before the full-scale invasion. And this made society more resilient.

I would say that, also, an lessons learned that we can take is catching the incentive monitoring or – and sanctioning those collaborators that are benefitting from the amplification of Russian influence operations in domestic media environments. So, not only Ukraine had collaborators. Russia uses, like, as an – like, the main – well, one of the main doors for Russian influence are domestic actors, that – networks of domestic actors that speak the language, understand societal divisions, understand audiences. So, Russia can use them to reach audiences and actually disrupt processes like elections. So, these individuals, these networks, happen globally and they are transnational, but they’re, like, domestic networks that could be identified and could be disrupted. And I think that either – like, there have been, in the previous years, like, more efforts to – even towards disrupting these sort of networks, but there should be a huge focus ahead of an heavy electoral year.

And finally, I would jump on the boat of the whole of society approach for – like, to replicate from the Ukrainian example, in any sort of effort to counter Russian influence abroad. I would add two notes. I think that the Ukrainian example is unique in terms of, like, time being exposed to Russian influence operations and, like, some, like, countries that might be late to a lesser level, it would be just like Eastern Europe. So, there has to be just, like, a long-term exposure to Russian information operations which make them, like, more resilient and with better systems, build – and societal resilience, build to counter these, sort of like, threats, and also, high morale. So, Ukrainians are defending their territorial integrity, their country, they are seeking justice. This is an element that helps resilience, that other countries and jurisdictions don’t have. Ukrainians are fighting and that unifies the country against a common threat.

Joyce Hakmeh

Thank you, and Keir, same question to you, and I guess we’ve talked a lot about how much 2014 was – helped prepare the Ukrainians for, you know, for these kind of you know, operations, but also, like, because they have been exposed for a long time, they know what to expect. Nothing was a surprise, as we heard from Olga. So, this makes Ukraine particularly – you know, quite an interesting, and to a certain extent, a unique case study. So, what other countries can learn from that experience?

Keir Giles

Well, the biggest lesson is how significant Russian information warfare capabilities can be if not countered, and that’s one of the things that really should be driven home from the experience of Ukraine.

This – back in 2016, one of the things that NATO Handbook of Russian Information Warfare tried to emphasise was the different levels of ambition for what Russia thought it could achieve using information, tactical and operational and strategic, right up to bringing about regime change in the target country. And so, by complete coincidence, just a few months later, there was the US 2016 Election, demonstrating precisely what they actually meant by that.

The problem, of course, with that, is that you have to be prepared and ready and actually understanding the implications of getting this problem wrong, and Ukraine gives us the case study. Imagine what would have happened if Russia’s intelligence and security agencies, reporting back to the Kremlin on the state of Ukrainian society and the readiness for it to be deposed and overthrown by a swift military operation has been correct. And the long-running campaigns that they had undertaken to subvert Ukrainian society, to sow distrust between people, between people and institutions, between people and government, had been successful. Then, we would be looking at a very, very…

Joyce Hakmeh

Defensive.

Keir Giles

…different war and the loss of Ukraine altogether. This is what is at stake when Russia undertakes these campaigns.

Joyce Hakmeh

Hmmm hmm.

Keir Giles

Now, in this particular case, it was a combination of Ukraine being in the sweet spot for so many reasons. It sounds a bizarre thing to say looking at the trauma that Ukraine is going through, but all of these things that we’ve discussed were counting in Ukraine’s favour. The international support, the societal resilience, the threat perception, all of these things. How many other places around the world are there that can rely on all of those advantages? Particularly because as you look across Europe, North America, the West, even the world, you see this patchwork of different regulatory and legislative and social and constitutional environments which mean some things can be emulated, that we’ve seen Ukraine do, many absolutely cannot. And we heard just now about the wrapping up of the networks of agents of influence working on behalf of Russia. It is only in November last year that in this country it actually became illegal to work as an agent of a hostile power against this country. We’ll see sooner or later when that actually becomes enforced.

So, that’s the first step here, locally, for taking action against those enablers and facilitators for Russian information warfare campaigns. We know who they are, we know what they do, we know why they do it, but nothing’s been done about it. Replicate that across the whole of Europe and you’ve got all of the different constraints that militate against actually being in that position to resist effectively.

Joyce Hakmeh

Just very quickly, before we open the floor, there is the – in a lot of what we’ve talked about, there is that the Russian actions were almost predictable, right? Like, the Ukrainians knew what Russia’s was preparing and they prepared accordingly, and the international coalition came and stepped up and helped. What does this tell us about how the Uk – how the Russians might adapt their approaches? How – what should we expect? Because I guess, you know, now they’ve realised “Well, we can’t do what we’ve been doing because they know what we’re doing. We need to change the approach.” What do you think – how do you think that will influence their ways, going forward?

Keir Giles

It’s hard to say, because when Russia observes that what it is trying to do is not particularly competent or effective, there are different ways in which it responds. Sometimes it comes back with a better implementation of the same thing, sometimes it regresses. Look at the current efforts at reconstitution of Russian land forces following their evisceration in the early stages of the Ukraine War. It’s not another attempt to build what they saw as a hi-tech modern army ready for 21st Century warfare. Instead, it’s falling back on older methods.

So, when we see, for instance, some of the information warfare tools being used in Ukraine that were tested in 2015, 2016, 2017, and then put on the shelf and not updated, and the – we heard about the crudeness of the deepfakes that have been used. They were weeks out of date in that they were deployed far too late to have an impact on public opinion. It should’ve been right at the very beginning of the invasion. But also, years out of date because they were so behind where technology actually is.

What we haven’t seen yet is Russia adapting to that – at least not seen in public, of course, is Russia adapting to that by actually updating to what could be achieved. But that could be just around the corner, because we’ve known for some time that artificial intelligence, machine learning, will vastly increase the speed and the scale and the customisation of disinformation campaigns. This is going to be a tsunami like challenge in terms of resisting disinformation, much on the same scale as with the arrival of the internet, in that transformation of the challenge that happened then.

Joyce Hakmeh

Great, thank you. Okay, let’s open the floor. Let’s – I’m going to take three at a time. The lady here and then, the gentleman and lady here, please.

Dr Nadaud

Thank you for speaking today. Dr Nadaud, member of Chatham House, a contractor with the US Air Force here in the UK. Given Russia’s growing ties with Iran and probably their advice and support that’s going on behind the scenes, how do you expect Iran to maybe adopt, or adapt, or allow Russia to guide them or help them in their own disinformation campaign and in further destabilising the Middle East?

Joyce Hakmeh

Great, thank you. Please.

Theo Barker

Hi, Theo Barker from Imperial College. You spoke a bit about the use of healthcare data and, kind of, different datasets. How concerned should we be about large-scale data breaches of private companies? There was recently 23andMe was breached, was a DNA sequencing company. Do we know if Russia is using this data yet, and how hyper-personalised will the disinformation campaigns be using this data? Thank you.

Trisha de Borchgrave

Very quickly, I hope. Trisha de Borchgrave, Current Affairs Writer. I thank you very much. This is absolutely fascinating. I think we all find that. Was there any evidence that Russia, sort of, fooled itself by its own disinformation when it came to Crimea in 2014? ‘Cause there was a book written that touched upon that, that it seemed like a lot of Russian speakers in Crimea were terrified of Ukrainians coming to kill them and all sorts of things. And it’s a great book, I forget its name, but it was very much that sense that they were on Russia’s side because they were terrified of Ukrainians and the Nazis coming to, you know, pillage them.

And then, secondly, is there any evidence that, you know, when you look at – and I don’t mean the disaffected in America voting for Trump. I’m meaning MAGA voters who seem to be isolated in terms of information, is there any evidence that the Trump camp is using any sorts of disinformation on American voters? And thirdly, very quickly because you do so much work in this, in the end, what was the Havana syndrome, because I’ve heard that nobody really – you know, apparently it wasn’t some terrible thing? Although it’s hard to believe that people with brain injuries weren’t subjected to something.

Joyce Hakmeh

Thank you so much. Great, thank you. So, let’s do, like, a quick round. You pick whatever question you’d like to answer, but very briefly so we can take a round or two, please.

Keir Giles

Sure, super briefly. Do threat actors, like Russia, Iran, China, the Trump campaign, learn from each other? Absolutely, yes, they do, because you see it now, the Trump campaign picking on elements that have been seen in successful Russian information campaigns and reusing them. And it’s not just them, of course, this is around the world, it’s been observed that this works, so bad people pick it up and use it.

Just last week, there was a threat advisory from the NCSC here in the UK, which was describing spearfishing attempts at targeting us, effectively, including some of the people in this room, including – it’s something that’s going to be written up probably this week, Alexander? Very good, it’ll be written up this week. But the really interesting thing about it is it describes campaigns that are running in parallel by Russia and Iran, using precisely the same methodology because it works. Because they’re actually achieving the effects in targeting the people that they want to target and extracting the information that they want to use, which comes onto the data breaches question.

Is Russia using it? Well, not visibly, as far as anybody has documented yet. Would Russia be willing and able to use it? Absolutely, yes, because it provides that leverage. And, of course, let’s not forget, when we look at what’s happening online, we shouldn’t think that that is necessarily the centre of gravity of malign influence, because human factors are so absolutely vital. It’s not all about trolling on social media, it’s not disinformation there. The – having the right person influenced to say the wrong thing in the wrong ears at the wrong moment is going to be vastly more important for Russia than thousands of troll armies on Twitter. So, leveraging those human factors, including, for example, by exploitation of personal information that they’ve extracted, will be extremely useful.

In Crimea, yes, absolutely, the fact that they had cut off all of these other sources of information, so people only had what they were being told by Russia to go on, did leave people convinced that as the Russians were telling, “The Russian Soldiers are here to protect you from fascists from Kyiv are coming to kill you.” If you’ve got no counterpoint to that, how do you know not to believe it? But again, it’s a technique that has been observed in use by Russia and frontline states again, taking countermeasures. Because with the information isolation, one thing that people expected was it would be accompanied by calls for surrender, in precisely the same way as we saw from Zelenskyy. So, the crisis preparedness booklets that are distributed to everybody in the population in countries like Latvia and Sweden, including big red letters, “If you hear that the central authorities have told you to give up resistance and surrender, this is disinformation, this is fake news,” because people are ready for it.

And the Havana syndrome, that I – the honest answer is I do not know, but I am equally untrusting of the most recent descriptions of what that is and where it comes from, and what it isn’t, as you are.

Joyce Hakmeh

Hmmm hmm, yeah, thank you. Belén?

Belén Carrasco Rodríguez

It’s – hmmm hmm. Just probably very quick, yeah, I would jump on the fact that yes, a different type of disinformation or information operations actors learn from each other. Not only learn from each other, they interact with each other. So, information in information laundering networks, like information operations, are transnational and sometimes overlap interest, and I can put an example. So, for example, in July, there was a strike on a café in Kramatorsk in July, on the 27th of July 2023. And a Russian disinformation apparatus, just, like, took a picture of the debris of the missile and disseminated the idea that this was – it – this was a Storm Shadow missile that had been – just, like, hit the café.

So, this was picked by a MAGA network and suddenly, became a US conspiracy theory that the West was killing civilians in Ukraine, right? So, these networks interact with each other, they feed each other with content and therefore, they could be still monitored, to be honest. So, yeah, not only learn, but also interact. I would say that yes, if Russia can – I don’t know if, like, they – and I’m not going to say we’re expert, but I say just, like, if Russia can get any sort of compromised valuable information from any potential targets, it’s going to use it and it can use it tailoring disinformation activities to the individual level.

And then, also on the Crimea example, I would say that right now, I mean, we can see, like, parallels with the – what happened in Crimea, in other occupied territories, like, for example, Mariupol. Mariupol has been almost for two years with an absolutely isolated information environment, subjected constantly to Russian propaganda, with a completely replicated, so they are – the regional administration, of course, is in exile, is in [inaudible – 56:28] and now, there is just, like, a completely duplicate administration structure that, like, communicates with the citizens and portrays this life of – like, they are Russians, right? And we are talking about not only communication from, like, regional administrations. It’s also, like, the public service providers or even in schools, they have replaced the – like, in their books and the history books and the books for first graders from Ukrainian to Russian and with Russian history. So, this kind of thing, just, like, it’s happening right now in temporarily occupied territories and is highly concerning.

Joyce Hakmeh

Right, Olga.

Olga Tokariuk

Just very briefly, on co-operation between Russia and other authoritarian regimes, just one short example from my context in journalism. A Journalist from the Philippines told me that there were trainings organised by RT for pro-government Journalists in the Philippines. So, the RT stuff was brought from Russia to Philippines to train Journalists there how to cover, and so, that’s just one example how they co-operate.

And yeah, also about Crimea. They – why this intimidation by propaganda was so successful, also, is because as I said, in 2014, Ukraine was not prepared for it and Ukraine learned a lesson. And actually, you know, it was not working in 2022 for Russia, because when people saw, you know, the Russian missiles fly on the cities, like in Kharkiv, and you know, that side, and those people who may have had favourable attitudes to Russia, they very quickly changed them. So, no amount of propaganda can change that if a missile is hitting your house, you know. That is not going to change your opinion if you’ve seen that.

But then, as Belén very importantly mentioned, it – what is important is what then happens if Russia is allowed to occupy this territory, and then, it’s a completely cleared out information space. People don’t have access to any information, huge-scale repression, so that any dissenting thought is repressed. People are being tortured, per – killed, persecuted and so on. So, then, of course, it’s a completely different information environment.

Joyce Hakmeh

Okay. Think maybe we have time for a couple of questions. The gentleman over there and the lady here.

Alexander Martin

Thank you very much. Alexander Martin, UK Editor for Recorded Future News here. I missed the first part of the panel discussion, so I apologise if this has been answered already. How do the panel members expect societal resilience – what do the panel members expect the societal resilience to look like, particularly in countries such as the UK and the US, and not just in terms of winning the arguments, but preventing the adversary from having an effect?

Joyce Hakmeh

Hmmm.

Sarah Hooper

Hi, Sarah Hooper, Metro newspaper. Going back to the information bubble that you mentioned. Obviously, you’ve harped on, sort of, the importance of human-to-human connection in combating misinformation. If we look back to the beginning of the end of the Soviet Union, obviously, Russia’s involvement in Afghanistan, which had a significantly less higher number of casualties than they have seen in Ukraine, it’s said to have contributed partially to the downfall of the information that had been pumped into Russian citizens about that.

So, my question is, as deaths continue to grow among Russian Soldiers and, obviously, that information is entering Russia in reaching the people and they’re feeling that, will this be enough to help break through the narrative that Putin has pumped out that the war is going well?

Joyce Hakmeh

Thank you, and before you answer, and you’ll have, like, maybe 30 seconds to answer, couple of, like, very quick questions fro – or from the online crowd. They’re talking about “how feasible” it is “that Russia might target the infrastructure of a NATO country to distract the attention from Ukraine,” and “the role that telegram plays in spreadings Russian disinformation.”

Keir Giles

Do we have another hour?

Joyce Hakmeh

So…

Keir Giles

Okay.

Joyce Hakmeh

Very quickly, I’m sorry.

Keir Giles

Super, super briefly.

Joyce Hakmeh

Yeah, yeah.

Keir Giles

Alexander, how does societal resilience look in other target countries? Extremely shaky, for a number of different reasons, but most of all, the lack of the threat perception, the lack of political leadership, the lack of actually taking any steps to protect ourselves against a very obvious threat.

And Sarah, the problem with the – with Russians learning about what is being done by their leadership in their name is that Russia has worked exceptionally hard at preventing that from happening. Not just all of the soft filters that prevent information coming into Russia, but also, for instance, eliminating the organisations that previously would’ve shared that information within civil society. So, as with so much else, Russia has been prepared for this for a long time in advance, and that is why, as we discussed at great length here in Chatham House yesterday, Russia is likely to be resilient in these appalling conditions that they’ve inflicted on themselves for longer than we would like to see.

Olga Tokariuk

Yes, if I may…

Joyce Hakmeh

Yes.

Olga Tokariuk

…politely disagree with Keir. I think that, actually, there is – information is reaching Russians, and this is, you know, from, like, personal experience even of my relatives, who have relatives in Russia, who’ve been trying to tell them – reach out to them and tell them what’s happening. Many people just don’t want to hear, because if they accept that, you know, what the Government is telling them is lies and the war they’re waging in Ukraine is unjust, is unfair, is not the war with the West or with Nazis and so on, then they have to do something. And many of them are intimidated to the point that they just do not see the space to do anything. So, I would say that the information is reaching many Russian citizens.

The – another issue is that the society in Russia is not prepared to rebel to do something with that, you know, to stand up to the Government and to put a stop to the war. Also, because many people are not prepared to see Russia losing. Many people agree that Ukraine, somehow, is a sphere of Russian influence and needs to be brought back into the fold.

And very briefly, also, on telegram, yeah, there was a question about telegram from online. Telegram now, I would argue, is the main vehicle of Russian disinformation in Ukraine. So – with, you know – and the access of Russian media, such as RT, Sputnik, Russian TV channels, Russian speakers, Russian agents of influence completely restricted in Ukraine. Russian social media are not present there, such as VK and Odnoklassniki. Telegram has become the main vehicle, with a lot of anonymous channels.

Telegram allows this anonymity that other messaging other platforms do not allow. It is not secure and there are a lot of doubts. And there actually has been – have been testimonies of Ukrainians who have been held in Russian occupied territories and been held there in torture chambers, that these people from FSB, from Russian Secret Services, they had access to all direct messages and exchanges on telegram. So, that that was somehow leaked and available to them.

Joyce Hakmeh

Brilliant, thank you. Belén?

Belén Carrasco Rodríguez

Very quick. So, I think that in terms of, like, societal resilience, very low. I think that we are suffering a hangover from post-COVID societal divisions, still, and this is going to play a role in the year that we have ahead. There is an – like, there’s still, you know, like, high divisive online discourse and an increase in the use of hate speech in online social media platforms, plus the proliferation of framed social media platforms that isolate audiences and exacerbate this, kind of like, very divisive discourse. So, not looking good in that side.

Then, I think that – I mean, I’m between both of you. I think that, yes, like, that information is reaching Russian audiences, but not enough to make a significant impact. And then, finally, on the telegram, how use – like, how is it used for spreading disinformation? Oh, my God, yes. Like, it’s the main vehicle for Russian disinformation in the context of the full-scale invasion of Ukraine, but at the same time, it’s the main vehicle to expose Russian actions in Ukraine and sometimes debunk Russian disinformation based upon the same Russian sources. So, it’s bad on one side, but actually, just, like, a very valuable resource in the other side.

Joyce Hakmeh

Brilliant. Thank you very much. Unfortunately, we’ve reached the end of our time together tonight. The security of elections, protecting democratic processes from malign interference, remains, like, a topic of, you know, huge importance in Ukraine and all over the world. And as we said, this will be a very big year for a lot of countries going to the ballot. I think the conversation today has been very, very rich and I am sure a lot would have found it very useful, and we’ve identified some really very important lessons. I think we need to, kind of, continue this conversation and see how will the lessons be applied in other contexts.

Well, I’d like to thank you very much for your time and for such a rich discussion, and please join me in [applause] thanking our panellists. Thank you [applause].