While Russia’s physical war against Ukraine continues, so too has the Russian information war intensified as the country seeks to shift international and domestic framing of the invasion. In a recent assessment, MIT Technology Review noted the scale of the propaganda war appeared to have eclipsed the scale of the cyberwar in Ukraine. While Russia has tried to control, confuse, and derail the narrative around the war with Ukraine by employing their usual influence strategy, Ukraine has succeeded in countering Russian information operations by taking a novel approach to competition in online spaces. Online campaigns framing the Ukrainian people as resilient, humorous, and heroic, all while naming and shaming Russian disinformation, appear to have successfully swung the pendulum of international support and solidarity in favor of Ukraine. The ways in which the information war has unfolded during Russia’s invasion of Ukraine and its subsequent impact on the physical realities of the war mark a new era of conflict. In an increasingly digitally connected world, information operations have become an expected and essential element of warfare, which will continue to shape conflicts yet to come.
Russian Information Warfare Tactics
Russia’s information operations efforts leading up to and during the invasion of Ukraine followed an expected pattern of behavior, based on tactics employed in previous Russian information operations against Ukraine and other target countries. Russian influence efforts have historically sought to weaken or destabilize targets, either by exacerbating social and political cleavages and thereby inflaming tensions, or by sowing confusion and chaos in the information environment. Often, these operations succeed by casting doubt about what is real and what is not – because if the truth is not clear, it can be hard for competitors to take action in response to a crisis. During the invasion of Ukraine, Russian narratives sought to confuse international and domestic communities by purporting a host of unusual grievances against Ukraine – that their government had been overrun by radical elements and neo-Nazis; that the Ukrainian government was corrupt; and that Ukrainian forces had been committing atrocities against ethnic Russians and civillians in separatist territories.
In an effort to shape the story around the invasion, Russia has employed several routine tactics to spread disinformation in multiple languages across digital platforms (some of these tactics have been previously detailed at length in CSIS’s publication on Russian and Chinese state influence operations entitled Influence and Escalation). In the lead up to the invasion and during the war, Russia has employed the use of false flag operations—a tactic in which a malicious actor seeks to shift blame for an atrocity or hostile action to another actor by fabricating stories or manufacturing evidence of their involvement. In the weeks ahead of Russia’s invasion, the White House asserted that U.S. intelligence indicated Russia was preparing a false flag operation accusing Ukrainian forces of committing violence against civilians in the Donbas, to be accompanied by a video showcasing graphic images of corpses and wounded individuals.
In support of this observation, during Blackbird.AI’s investigation of Twitter Russian language conversations mentioning Ukraine and conflict-related terminology from February 1 to March 1, 2022, the Blackbird team noted that anonymous accounts circulated several narratives asserting Ukrainian forces were acting aggressively against the people of the Donbas region. These claims have been refuted by Ukrainian officials, OSINT investigators, and other experts.
In the earliest period of the dataset from February 1 to 7, the Blackbird team detected higher than normal levels of anomalous activity – a term which refers to content that circulates online in an atypical way and can be indicative of an information campaign. Of these anomalous posts, many were published by Russian media and anonymous accounts, some of which asserted an affiliation with Donbas separatist forces. These accounts purported that Ukrainian forces were seeking to “solve the problem of the Donbas by force,” and were amassing troops along the line of contact between separatist-controlled territory and Ukrainian government-controlled territory in preparation for military action to take back these areas. Accounts also asserted Ukrainian forces were shelling residential areas, cutting off water and electricity, and otherwise exacerbating problems in the region.
From February 22 to March 1, Blackbird.AI noted similarly higher than normal levels of anomalous activity. Among the posts flagged as anomalous, pro-Russia accounts circulated the narrative that the war in Ukraine had started eight years ago in 2014 when, to quote one account: “the democratically elected Ukrainian government was overthrown by Obama in an illegal coup and replaced with an anti-Russian regime that would go on to commit daily war crimes against ethnic Russians in Donbas.” These accounts did not provide any evidence or verification of their claims.
Russian accounts also coordinated to flood the zone in their online campaigns. This refers to a method in which accounts flood social media with false information, spam, or unrelated news in order to drown out critical commentary or coverage of events that could cast the actor in a negative light. In an example surfaced in Blackbird.AI’s investigation, from February 26 to 27 pro-Russia Twitter accounts attempted to flood the hashtag #НетВойне (#NoWar) with pro-Russia support; this included spinning up the pro-Russian forces hashtag #ДаПобеде (#YesVictory) for use in direct competition to the anti-war hashtag. These efforts were quickly overtaken when pro-Ukraine accounts across Twitter flooded out the #YesVictory hashtag with condemnations of Russia, Putin, and the invasion.
Pro-Russia narratives were also amplified through the use of bot networks. Using this tactic, bot accounts shared and interacted with pro-Russia narratives across social media to expand the reach of these narratives and to get pro-Russia narratives trending, likely to create the illusion of widespread support. The Blackbird team noted several instances of pro-Russia bot-like accounts retweeting narratives in an attempt to amplify them. According to Blackbird’s data, from February 1 to 22, several bot-like users on Twitter amplified narratives that NATO and/or Kyiv were planning aggressive acts to take back Crimea or separatist-held territory. These accounts also amplified narratives that the U.S. and/or NATO were deliberately trying to drag Russia into conflict with Europe in order to impose harsher sanctions than were currently politically acceptable, or as a pretext to move NATO into Ukraine and closer to Russian borders. Certain bot-like accounts also amplified narratives claiming that Ukrainian forces were committing genocide in the Donbas region.
In the data from February 22 to March 1, which covers the outbreak of war, bot-like accounts circulating pro-Russia narratives began to more heavily focus on amplifying posts asserting that Ukrainian forces had been committing atrocities against the people of the Donbas region for the past eight years. Additionally, during the aforementioned hashtag war that occurred from February 26 to 27, bot-like accounts also frequently retweeted posts promoting the pro-Russia #YesVictory hashtag.
Pro-Russia narratives were also promoted through amplification via state-run media outlets, public officials, and other public figures. Russia frequently employs the use of official sources to broadcast state positions and grant legitimacy to unverified claims. This often includes the involvement of state-run media outlets, which share statements from Putin and other government leaders, general news, as well as disinformation in order to grant it credibility. Public officials—such as members of the cabinet, diplomats, and other formal representatives of the state—and other public figures also circulate these narratives via their personal official accounts for the same purpose. In one example, EU vs. Disinfo reports that on March 1, two Russian Foreign Ministry websites hosted an explicit and violent video purporting to show the “genocide” that Ukrainian forces were waging against the people of the Donbas region. Russian diplomatic accounts across social media then also shared the video, employing the new hashtag #DonbassTragedy and posting in multiple languages. Claims of Ukrainian forces deliberately targeting civilians in the Donbas have been repeatedly debunked by independent Russian media; additionally, Donbas conflict data from the UNHCR and the OSCE Special Monitoring Mission to Ukraine does not support these claims, as EU vs. Disinfo reports.
During the current war with Ukraine, evidence suggests that pro-Russia accounts might also be publishing false information in demoralization campaigns against Ukraine. In one potential example on February 27, Twitter accounts began circulating news that the mayor of Kyiv announced the capital was encircled by Russian forces. Several verified accounts—including European and American public figures—retweeted the news. Later, the mayor of Kyiv released a statement in which he denied saying that the city had been encircled. While the leaking of this false information regarding Kyiv’s encirclement cannot be attributed to any specific actor, experts in Russian influence operations note Russian actors have employed this demoralization tactic in the past.
Officially adopted Russian state positions regarding Ukraine also employ the use of specialized language and framing to distance themselves from responsibility and portray the current situation in a way that is more favorable to Russian interests. In their framing of the current war, Putin, Russian leadership, and the state media apparatus have referred to the invasion as a “special military operation” and a “denazification” and “demilitarization” effort to liberate Ukraine from a corrupt power structure. In Blackbird’s monitoring of online conversations related to the war, accounts circulating pro-Russia narratives on Twitter began using this specialized phrasing more and more frequently after the invasion began on 24 February, including frequent use of Russian language terms and hashtags such as “genocide”, “#NoNazism”, “fascists”, and “Banderites” (a reference to a faction of right-wing Ukrainian nationalists).
Ukrainian Response to Russian Information Warfare
In contrast to the Russian campaign—which stuck closely to a time-tested model of Russian information operations strategy—the Ukrainian response saw a shift in strategy as the war unfolded. Since Russia’s seizure of Crimea in 2014, Russia has consistently targeted Ukraine through information operations, giving Ukrainian leadership extensive time to develop counter-disinformation efforts. While Ukraine employed the use of some familiar tactics, Russia’s invasion led Ukraine to employ a few novel strategies against these operations that ultimately met the world stage with great success.
Ukraine has continued to name and shame false information about the invasion as it arises and, when possible, directly attribute these narratives to malicious actors. During the current war, Ukrainian officials have published videos on social media naming what they refer to as “fakes,” as in the previous example of the Kyiv mayor stating that he had never said that Kyiv was encircled. Additionally, President Volodymyr Zelensky has also refuted statements and actions attributed to him, including that he had fled the country to Poland and had possibly been killed by Russian forces.
In the past, Ukrainian officials have also strongly favored deplatforming to address disinformation. In February 2021, Zelensky announced his administration would ban three Ukrainian media outlets—112 Ukraine, ZIK, and NewsOne—known for spreading misleading and false information. After Russia’s invasion, Ukrainian officials called on Facebook to ban Russian access entirely, arguing that Russian actors have been prolific in spreading disinformation across the platform and have targeted countries beyond Ukraine in past operations. Facebook ultimately denied this request, arguing that cutting off access for the whole country would “silence important expression” for Russian citizens amid the ongoing war.
In Blackbird.AI’s analysis of Twitter conversations around Ukraine, impending conflict, and the subsequent outbreak of war, from February 1 to 22 pro-Ukraine accounts primarily focused on calling out and questioning pro-Russia narratives circulating on Twitter. During the first week of the reporting period, these accounts most often provided basic fact-checks and coverage of developments, such as circulating information and evidence of Russian troops amassed on the border, coverage of diplomatic talks, and refutation (corroborated by OSINT evidence) of claims that Ukrainian forces were committing atrocities in the Donbas region. These accounts also circulated responses to Putin’s public statements regarding concerns around impending NATO aggression and militarization of Ukraine. In one popular rebuttal, an account asserted NATO’s expansion to Estonia did not elicit the same response from Russia, despite the fact Estonia also borders Russia and NATO has had a presence there for almost 20 years.
Ukraine’s strategy in countering Russian disinformation shifted when the Russian invasion became a reality. Through the employment of new tactics as necessitated by war, Ukrainian official accounts, state media, citizen accounts, and supporters were ultimately able to present an overarching “feel-good” counter-narrative that firmly centered Putin as the villain of the story and the Ukrainian people and leadership as heroes overcoming unspeakable and seemingly insurmountable hardship. Memes shared across social media—including one in which a Ukrainian man hauls a Russian tank away with a tractor, and another in which a man slowly and calmly walks a mine allegedly planted by Russian forces on a bridge into the woods as a cigarette hangs from his mouth—added a humorous element to the narrative that gave these stories virality, regardless of whether or not these memes accurately depicted the context of the war in Ukraine.
Ukrainian accounts—including those of officials, state organizations, and regular citizens—amplified stories with strong emotional pull, utilizing images and videos of injuries, bombings of residential areas, children killed, people and their pets hiding out in bunkers and in metro stations; as well as depictions of ordinary people joining the war effort, such as couples getting imromptu married and fighting for their cities together, fathers parting with their children at the train station while they stayed behind to fight, and so on. Some of these stories were further amplified on social media by Ukrainian officials, including President Zelensky and Foreign Minister Dmytro Kuleba, who added personal touches in the form of sarcasm, further emotional appeals, debunking of rumors and false information, and firm calls to action.
Blackbird’s investigation of data from February 22 to March 1 indicated that pro-Ukraine narratives on Twitter garnered significantly more engagement and shares than their pro-Russia counterparts, indicating generally higher levels of support for Ukrainian narratives. The pro-Ukraine narratives for this time period invoked emotion much more than was evident in the earlier time period of the dataset from February 1 to 21. For instance, several accounts posted variations of an excerpt of a Zelensky speech in which he stated: “We just want our children to live. Sixteen children died, and Putin will continue to claim that only military facilities are being attacked? Where are our children, in what military factories do they work? What missiles? Maybe they are driving tanks? You killed 16 children.” Similar posts circulated with coverage—including videos and photos—of Russian forces’ attacks on residential areas and resources essential to the survival of local civilian populations.
Counter-narratives identified in the Blackbird data also directly confronted and flipped Russian narratives on their head, as in the case of one post—since deleted—which asked “Wild denazification in Ukraine is carried out by Vladimir Putin: Russian troops raze cities with predominantly Russian inhabitants from the face of the earth and kill Russian people. Who is the Nazi here?”. Several high engagement pro-Ukraine and/or anti-war hashtags also drove conversation, including #StandWithUkraine, #IStandWithUkraine, #StopRussia, and #UkraineUnderAttack.
Notably, both pro-Russia narratives and pro-Ukraine narratives employed appeals to emotion. However, while Russian narratives primarily attempted to stoke fears and anxieties, Ukrainian counter-narratives more often highlighted the positive—elevating stories of hope, courage, sacrifice, and resilience in the face of an existential threat to the nation—which ultimately resonated more with international audiences. Additionally, given widespread global access to social media, the rise of professional and hobby OSINT researchers in the past decade, and a large, diverse domestic and international media presence in Ukraine, Russia has been fighting an uphill battle to obfuscate the reality of the war in Ukraine.
Information Warfare and the New Normal of Modern Conflict
Russian efforts to prime the information environment ahead of the invasion can be viewed as an attempt to justify the war to the domestic audience and to disrupt the response of Ukrainian allies. Russian disinformation campaigns often seek to confuse, disorient, and overwhelm foreign audiences, making it difficult to determine truth from fiction. In this way, these campaigns can result in apathy and inertia from Russia’s purported competitors in responding to developments. Russia’s efforts to prime the information space failed this time, however – in part due to the Ukrainian response, but also partly due to the unique approach that the U.S. took in addressing the invasion ahead of its commencement. In rapidly declassifying and sharing U.S. intelligence about the impending invasion, a healthy skepticism of anti-Ukraine narratives circulating online made it harder for Russian narratives to permeate the digital environment, leading to quick and resound dismissals among international audiences. Once the invasion was underway, Ukraine’s allies were in some ways prepared for it, having been warned ahead of time an invasion was imminent and had likely been months in the making, meaning international condemnation was swifter than it otherwise might have been.
Additionally, effective counter-messaging by the Ukrainian government rallied a groundswell of international support. Meanwhile, the international community’s response against the Russian invasion has been rapid and unprecedented, with strict sanctions devastating the Russian economy, resulting in Russian entities being blocked from SWIFT, the freezing and/or seizing of Russian assets abroad, bans on many Russian imports, and the exit of many major global companies from Russian operations, among other things. Additionally, many countries have also banned Russian aircraft from their airspace, and Russia’s major flagship airline, Aeroflot, announced on March 5 the company would be suspending all international flights, further isolating Russia from the rest of the world.
Russian leadership also clearly understands the danger of the shifting tide of narratives against them. In the days since Russia launched its invasion and global sentiment has overwhelmingly favored Ukraine, Russia has moved quickly to lock down and censor the domestic information environment. On March 1, Russia’s general prosecutor ordered the state censorship arm Rozkomnadzor to block the broadcasts and websites of Ekho Moskvy and Dozhd TV, the country’s two sole long-standing major independent broadcasters. On March 4, Roskomnadzor officially announced Russia would block Facebook and Twitter access, claiming the platforms were “violating the rights and freedoms of Russian nationals.” Around the same time, Putin signed a law making the publishing of what the government calls “false information” about the “special military operation” illegal – essentially banning media outlets from publishing accounts of the war that differed from those of military officials. It is more likely, however, that Russian leadership seeks to insulate the domestic audience from access to external media, perspectives, and coverage of Ukraine, in order to prevent widespread homegrown backlash against the war.
Information warfare will continue to play an integral role in the future of conflict. The battle for narrative control can affect the way that war develops and external support for the cause, as has been seen during Russia’s war with Ukraine. Counter-disinformation efforts have the power to shape action and response early on in these conflicts. As these high-stakes battles to control the narrative become the new normal of modern conflict, monitoring and early assessment of narratives will become essential in mitigating harmful impact. Blackbird.AI continues to monitor the ongoing war in Ukraine to identify and expose disruptive narratives and influence strategies. Through the tracking of emergent and potentially destructive narratives, Blackbird seeks to contribute to the defense of digital integrity as this becomes an essential concern in future conflicts to come.
