Intelligence and the War in Ukraine: Part 1
Almost every descent into war comes with speculation, accusations, and counter-accusations of intelligence failure. And, indeed, it is obvious to note that intelligence agencies are most often criticized when things apparently go wrong. Politicians especially enjoy the deflective properties of the term “intelligence failure.” It redirects attention from poor political decisions toward the usually anonymous technocrats of the intelligence world, a community as consistently doubted and demonized in the public discussions as it is lauded and lionized. Since the Bush administration’s dissembling over Iraq’s weapons of mass destruction, intelligence communities derided the public use of intelligence products. Once bitten, twice shy. The role of intelligence during the run-up to, and since, the invasion of Ukraine represents an entirely new chapter in the political and diplomatic use of intelligence in international affairs. This is for two distinct but related reasons. First, the year preceding the Russian invasion represents a resounding and instructive success in a branch of intelligence more notorious for its miscalls: strategic warning intelligence. Second, decades of growing public transparency about intelligence, paired with unprecedented transformations in the capabilities and availability of open-source intelligence, made it possible for politicians, diplomats, and defense communities to reveal, challenge and warn of Russia’s warlike preparations and intentions.
In this first part of our discussion, we shall pay particular attention to initiatives taken by the United Kingdom, the United States, and some of Europe’s smaller states, whose effective use of warning intelligence allowed Western states to confront Russia and support Ukraine well in advance of Feb. 24. Successful warning offered lead time to assist, equip, and train the Ukrainians in their defensive preparations. Western governments were willing to declassify information and assessments to support warnings of imminent Russian aggression. They, and media organizations, also drew from open-source intelligence instead of averring obliquely to unspecified secret sources to make their warnings more compelling to the public and allied governments. This made it possible to seize the initiative from Russian attempts at denial, deception, and prevarication, refuting and discrediting such efforts before they could happen through a policy of pre-emptive “prebuttals.” While the invasion could perhaps not be prevented, this live case study represents a step-change that demonstrates the positive use of intelligence for “impact.”
Success or Failure?
In almost every conflict and crisis, accusations of “intelligence failure” arise almost automatically. This may be to allocate or shift blame, and it often appears that strategic warning is particularly susceptible to both. Warning intelligence utilizes the ‘indicators and warning’ methodology in which one tries to identify the detectable footprint of concealed intentions and capabilities. No system is perfect, and the risk of surprise persists, as cases like the Argentine attempted seizure of the Falklands in 1982 and the successful Russian conquest of the Crimea in 2014 attest.
Warning is always, however, a judgment call. Despite the impressive abilities demonstrated by Western allies to detect Russian activities and the willingness to share that information, not all allies and partners reached the same conclusions. They also shared this data and their assessments with their Ukrainian counterparts who, as we shall see, struggled with their own appreciation of the situation. Naturally, while more pieces of the jigsaw have yet to emerge, the feast of open-source — and often real-time — information on Moscow’s military build-up gave an apparently solid foundation for assessment. The role of the private sector and the wider open-source community allowed even journalists and the public to watch Russia’s buildup. Imagery from U.S. space technology company Maxar, and collected social media posts portrayed a very public build-up of Russian forces, a picture no doubt even clearer to those with access to state-based intelligence capabilities. One might conclude that the warning should have been obvious, as Russia’s build-up took place in plain sight. But while detecting capabilities — personnel, equipment, infrastructure — is relatively straightforward, assessing intent is not. For the latter, the warning analyst must look for and recognize actions that the adversary would not otherwise take unless they intended to invade.
Assessments from the Western powers provided stark reading, coming on top of Russian military exercises in 2021. In April, Russia conducted a “surprise check” of its southern and western fronts, in response to supposedly aggressive moves by the United States and NATO allies, sparking fears that conflict was likely. “We’re now seeing the largest concentration of Russian forces on Ukraine’s borders since 2014,” Secretary of State Antony Blinken told a meeting at NATO headquarters, leading President Joe Biden to reaffirm U.S. commitments to Ukraine. At the time, analysts suggested the numbers of Russian troops exceeded the numbers involved in the 2014 annexation of Crimea, with Ukrainian sources suggesting as many as 80,000 troops.
Analysts were also fully aware of the Zapad-21 exercise, one of a rolling series of training exercises rotating across Russia’s four main military districts each year. Zapad-2021 illustrated Russia’s longer-term goal of integrating Belarusian forces into Russian-led structures. It took place against a backdrop of tensions between Russia and NATO, and Moscow’s own efforts to reinforce security interests in Belarus after failed pro-democracy protests in August 2020. Though the figures involved in Zapad-21 were grossly inflated — Russia even suggesting up to 200,000 troops participated — the exercises gave warning about the position of Belarus in any future conflict.
Though Moscow’s ultimate intentions were unclear, Western intelligence officials were fully aware of the military build-up. Intelligence briefings seen by the Washington Post in December 2021 showed that U.S. officials believed that Russia had deployed 70,000 troops, and would be capable of deploying up to 175,000 troops along the Ukrainian border, comprising 100 battalion tactical groups and capable of an offensive in early 2022. Despite the build-up, the deployments were, officials said, designed to “obfuscate intentions and to create uncertainty.” This intelligence picture formed the basis of Blinken’s warning to Russian Foreign Minister Sergei Lavrov during talks in Copenhagen that Russia would face “serious consequences” if an invasion took place.
UK officials became increasingly concerned about the prospect of an invasion around the same time, as key or high-profile units deployed for Zapad-21 did not redeploy back to their home locations, but rather remained in Belarus, along with large ammunition stockpiles. Satellite imagery revealed the gradual build-up of Russian troops and, crucially, the deployment of supporting units needed to sustain an invasion. U.S. officials were also concerned about the distribution of medical supplies, while Estonia’s foreign intelligence service (Välisluureamet) pointed to large-scale operations. “In our assessment, the Russian Armed Forces are ready to embark on a full-scale military operation against Ukraine from the second half of February,” said their annual report. “Once military readiness has been achieved, only a political decision is required to launch the operation.” Estonian estimates suggested there were upwards of 150,000 troops, deploying from across Russia’s military districts. “This is,” officials concluded, “the single largest military build-up by Russia in the past 30 years.”
Nonetheless, there were differences across NATO allies. Speaking to journalists in March, France’s Chief of the Defense Staff Thierry Burkhard suggested that a Russian invasion was “part of the options” in 2021. Indeed, French officials maintained that any attack, if likely, would be delayed pending “favorable weather conditions,” disagreeing with U.S. and U.K. counterparts over the likely outcome. “The Americans said that the Russians were going to attack,” said Burkhard. “Our services thought rather than the conquest of Ukraine would have a monstrous cost and that the Russians had other options.” Burkhard has suggested that French military intelligence only came round to the view that an attack was imminent having received intelligence from NATO allies the evening before the attack. In March, it was reported that Gen. Eric Vidaud, director of military intelligence, would leave his post prematurely, sources citing “insufficient” briefing on the Russian threat to Ukraine. French officials were not alone in underestimating the danger. Security sources told Der Spiegel that the head of Germany’s BND, Bruno Kahl, had to be rescued by a hastily arranged special forces mission, having been in Ukraine for scheduled talks when the invasion started.
Projecting one’s own reasoning into the mind of the adversary is a common analytical error. Indeed, the French may yet be proved right in that the invasion has already come at a “monstrous cost” to the Russians, at least to contemporary European eyes. In this case, the French failed to understand what costs the adversary was willing to take to achieve their aims. The values and concerns of Western governments — economies, jobs, trade, public well-being, popularity, and re-electability — are perhaps not as relevant to Russia’s often-unchallenged strategic calculus. Putin has been far less concerned with civil society and human costs — a common characteristic of authoritarian leadership.
France was not alone in this regard. Armed with British and American assessments in addition to those of his own staff, an intelligence advisor close to Zelensky said that he believed Putin was bluffing until D-Day. He expected Putin would achieve his goals without invading. Zelensky’s approval rating was low, and the political situation was unstable. Why should Russia strike now? Why not wait? Ukrainian advisers fell prey to two critical failings, the first of which was a hesitance to believe that Putin might invade, contrary to good sense. Additionally, this may also have been down to Kyiv’s goals of not causing panic – something Zelensky had said pre-invasion. The second, more cautionary failing was that Kyiv had “anchored” — fixated — on one specific indication of the imminent intent to invade. This indicator was orders for certain tactical preparations that the Ukrainians considered essential for a successful invasion, but which never materialized before Feb. 24. Unfortunately, just because Ukraine would not be so stupid as to launch an operation without such measures, did not mean Russia wouldn’t do so. Thankfully, this anchoring did not undermine Ukraine’s defensive strategy. Perhaps this was a case of hoping for the best while preparing for the worst. If so, it displays a very solid understanding of the interaction between intelligence and planning by the Ukrainian high command, which we discuss in part 2 of this article.
Western analysts may have fallen subject to some analytical pathology in predicting — not unlike the Russians — that Ukraine would fall quickly to the Russian invasion. As some U.S. officials passed to journalists, “a Russian invasion could overwhelm Ukraine’s military relatively quickly, although Moscow might find it difficult to sustain an occupation and cope with a potential insurgency.” They went on to add that an invasion, “would leave 25,000 to 50,000 civilians dead, along with 5,000 to 25,000 Ukrainian soldiers and 3,000 to 10,000 Russian ones. It could also trigger a refugee flood of one to five million people, mainly into Poland.” Perhaps still stinging from the rapid collapse of Afghanistan to the Taliban, there may have been some reluctance to be optimistic about Ukraine’s chances. Still, London and Washington moved to bolster Ukraine’s defenses quickly — and this support made a significant difference in both the physical capacity of Ukraine’s forces and their morale. The estimates on casualties and displaced persons are within the margin of error provided by U.S. officials. In this case, it would be unfair to say Western estimates of the chances of Ukrainian resistance constitute an intelligence failure. This is the paradox of intelligence warning: if analysts warn of a dire event, and this prompts state action which averts it, was the initial estimate wrong? No. The differences in intelligence assessments from Ukraine and various NATO allies highlight the precarious nature of strategic warning.
Warning
The timing of an attack is always difficult to forecast. On the one hand, intelligence officials are always wary of when to warn. A warning threshold that is too low will cause future warnings to fall on deaf ears. If the warning threshold is too high, the intelligence may no longer be actionable. On the other side, the final decision to attack can be made in a relatively short space of time. “Once troops are in a position to go,” wrote Grabo, “orders to attack usually need to be issued no more than a few hours ahead.” It is a conclusion backed up by a report by U.K. intelligence official Douglas Nicoll, who, in the 1980s, was asked to look at strategic warning. As Nicoll concluded, “The essential point to note is that while planning, preparation, and training may last for up to a year from the initial order to the armed forces to prepare, the period of readying, mobilization, and deployment of forces may be quite short.”
The problem has always been assessing when states will attack, an issue illustrated by the history of the Joint Intelligence Committee. This becomes more complicated when trying to understand the intentions of autocratic leaders such as Vladimir Putin. Did Putin hope to wage a diplomatic war of nerves against Ukraine and the West? Would Moscow carry out a limited operation, or pursue maximalist goals for the whole of Ukraine? And when would it all happen?
Despite the build-up of Russian forces, U.S. officials kept an open mind on whether a decision had been made to invade. In December, following a visit by CIA Director Bill Burns to Moscow, White House national security advisor Jake Sullivan reiterated that the intelligence showed that, “[Putin] had not yet made a decision,” even if analysts believed “the Russian government is giving serious consideration and operational planning to such an exercise” — a view that remained dominant into January. Just under a week before the invasion, President Biden said he was “convinced” an attack would take place in the “coming days.” The U.S. intelligence community’s assessment that Putin wouldn’t decide until the last minute was certainly an accurate one, the invasion surprising some NATO allies and even members of the Russian government and armed forces. Blinken himself called off talks with Lavrov two days before the invasion, following Russian recognition of the separatist regions.
Is Prebuttal a Success?
If the warning intelligence success is, essentially, an adept application of methods and techniques a century in the making, the “prebuttal” strategy deployed against Russian disinformation and prevarication represents a significant innovation. Any credible prebuttal effort was going to require carefully thought out but rapid declassification of intelligence for timely publication. Such a campaign aims to bombard the media space with truth — visible, measurable, even tangible data and analysis about the Russian buildup and military campaign. Historically, governments have always declassified sanitized intelligence to support policy decisions or offer alternatives, although the scale and speed of this effort are remarkable. The campaign follows a classic model: it is grounded in truth, it repeats a theme from different angles, and it is well-timed and geared toward a specific objective.
The Ukraine case saw — and continues to see — extensive reference to intelligence in public. This January, the United States preempted Russian moves by publishing information on Russian subversion. “Russia has directed its intelligence services to recruit current and former Ukrainian government officials to prepare to take over the government of Ukraine,” reported Blinken, “and to control Ukraine’s critical infrastructure with an occupying Russian force,” a message reinforced by an intelligence-led statement from U.K. Foreign Secretary Liz Truss.
Shortly before Russia’s invasion, the U.K. Chief of Defence Intelligence Lt. Gen. Sir Jim Hockenhull told journalists, “We have not seen evidence that Russia has withdrawn forces from Ukraine’s borders. Contrary to their claims, Russia continues to build up military capabilities near Ukraine.” U.K. Ministry of Defence communications, using information supplied by Defence Intelligence, tweeted likely avenues of attack — lines that proved to be correct.
The publication of intelligence should not be overplayed, despite its current hype. Moscow may have been forced to respond to intelligence releases, yet the release of information by governments should never, and can never, be seen as part of a strategy to deter an assault. Officials and policymakers also need to be careful with what they release for several reasons. Firstly, the prebuttal approach was successful because the events that officials forecasted came true. Domestically, the reputation of U.S. and U.K. intelligence has been restored after the Iraq fiasco. Recently, however, released assessments have been based on medium to low confidence. As one official said, “It doesn’t have to be solid intelligence when we talk about it. It’s more important to get out ahead of them — Putin specifically — before they do something.” Releasing statements that may turn out to be untrue could impair future use of prebuttal, as it could undermine the trust that has been carefully built up. In other words, releasing low confidence assessments to keep up with Russia’s information games would be counterproductive, and reduce the release of intelligence to mere propaganda. Secondly, preempting Russia might be an important goal, yet revealing information can be just as dangerous, however well disguised the actual source is. Prebuttal remains an important tool, yet source protection will always be paramount.
So What?
Historically, intelligence success often came in lockstep with secrecy. More than any other event in the last fifty years, the Russian invasion of Ukraine drives home the degree to which this is no longer true. In his seminal study of intelligence success and failure, Erik Dahl observed that for intelligence to be useful it should be both precise and actionable. As he noted, “precise tactical intelligence, and strong policymaker receptivity toward intelligence — are necessary for the prevention of a surprise attack.” The public awareness of warning intelligence is littered with horror stories of failures of precision, actionability, and receptivity. The current crisis stands apart as a moment when all three of these requirements for effective warning meshed almost seamlessly. The quality and timeliness of the assessments did not, of course, deter Putin’s cloistered siloviki coterie enough to prevent the war. But it did give time to prepare across a range of military and political fronts, to marshal alliances and partnerships, and allowed both Ukraine and the Western powers to go into the current crisis forearmed because they were forewarned.
Another important insight offered by Dahl is that it is as important to learn from intelligence success as from failure, juxtaposing and interrogating both in concert. There will be a temptation, in the wake of the current crisis, to take the warning success of the Ukraine invasion for granted because that’s how it ought to work. In fact, the recent warning success warrants just as exhaustive and revelatory a post-mortem as the worst warning failures, in order to glean every single lesson and insight that can help prepare us for the next crisis, even the next war. Because they will come, sooner or later.
Dr. Neveen Shaaban Abdalla is a lecturer in international relations (defense and intelligence) at Brunel University London. Dr. Abdalla specializes in terrorism and counterterrorism and security in the Middle East and North Africa.
Prof. Philip H.J. Davies is the director of the Brunel University Centre for Intelligence and Security Studies. Professor Davies has written extensively on U.K. and U.S. intelligence, joint intelligence doctrine, and counterintelligence.
Dr. Kristian Gustafson is a reader in Intelligence & War. Dr. Gustafson is deputy director of the Brunel Centre for Intelligence & Security Studies and has conducted consultancy and advisory work for the MOD’s Development, Concepts and Doctrine Centre, including an integral role in developing U.K. Joint Intelligence Doctrine.
Dr. Dan Lomas is a lecturer in Intelligence and Security Studies at Brunel University London. He specializes in contemporary U.K. intelligence and is currently co-editing a history of U.K. intelligence reviews for Edinburgh University Press.
Dr. Steven Wagner is a senior lecturer in international security at Brunel University London. Dr. Wagner is a historian of intelligence, security, empire, and the modern Middle East.
Part II of this article will deal with the other side of the equation: the apparent failure of Russian intelligence to assess the likely course of their offensives into Ukraine. As well, it will show how the Russians likely made grave errors in planning their operation, and how intelligence from the Ukrainian government, its citizens, and Western governments has helped tip the balance in Ukraine’s favor. It has also confirmed a change or rebalancing in the locus of intelligence power in war from secret toward open-source intelligence.
Image: Staff Sgt. Jared Denton
