Ukrainian Election Task Force—exposing foreign interference in Ukraine's election

Western democracies are under threat from outside meddling, and Ukraine is the testing ground for this interference. Russian President Vladimir Putin’s persistent efforts to influence the domestic politics of his neighbors and countries well beyond Russia’s borders have posed enormous challenges in Europe and across the Atlantic.

From the fabricated “Lisa” case in Germany and the “loan” for Marine Le Pen in France, to the Russian security service hacks in the United States and the support for Catalan independence in Spain, Moscow has used a variety of means to prop up candidates and to weaken Western governments. The Russian Federation first tested many of these strategies and techniques in Ukraine.

More than any other country, Ukraine has been the unwanted recipient of Moscow’s attention, particularly during the past five years. The Kremlin has sought to place a pliable client in command in Kyiv and block Ukraine’s Euro-Atlantic aspirations, including by pressuring the previous Ukrainian leadership against signing. It has done so through its insistence that Ukraine walk away from the Deep and Comprehensive Free Trade Agreement with the European Union (EU). Putin interfered in Ukraine’s last elections in 2014, seized and illegally annexed Crimea by military action in 2014, and then launched a military campaign to stir destabilization in the Donbas.

The March 2019 presidential election will be a pivotal event in Ukraine’s history. The result will impact Ukraine’s ability to defend itself in the Donbas against Russian aggression and will influence Ukraine’s progress on reform and on maintaining a path toward closer association with the West. It is likely that Moscow will intervene once again in the vote. For the Kremlin, the perceived stakes are high. Putin may try to tilt the election in favor of a candidate whom he thinks might yield to Kremlin pressure, cutting a deal in the Donbas, relenting on Crimea, and moving toward a policy of accommodation. Accordingly, the Kremlin is very likely to continue, and even increase, its interference in Ukraine’s internal affairs, if not just for the sake of a single candidate, then to widen existing fractures in Ukrainian society.

Russia may not be the only country to try influencing Ukraine’s elections. The past year has witnessed efforts by the government in Budapest to use the issue of Hungarian-minority language rights to put pressure on Ukraine in the EU and NATO.¹ That government may also find the election a tempting opportunity, especially given the increasingly close ties between the Orbán government and the Kremlin.

Accordingly, the Kremlin is very likely to continue, and even increase, its interference in Ukraine’s internal affairs.

Putin’s “little green men” during the annexation of the Crimean peninsula. Photo credit: Anton Holoborodko /Wikicommons

The threat to Ukraine’s election

The Kremlin is likely to use the full spectrum of its capabilities in the run-up to Ukraine’s election. This will start with its still-heavy “media” presence in the east and center of Ukraine and will not be limited to its state-run media. The Kremlin may push a variety of content on social media and find sympathetic outlets. Moscow may also use its formidable cyber capabilities to hack into the campaign operations of candidates it does not like and to try to shut down major installations—including, but not limited to, electricity grids, phone networks, and airport control systems—in order to suggest that the authorities are not in control, and to undermine the integrity of the electoral count. As it did in 2014, it may also try again to sabotage Ukraine’s election and voting system.

Moscow may also resort to more forceful measures. In 2015, it tried to orchestrate the emergence of the People’s Republics in Odesa and Bessarabia through the activation of its agents in the Ukrainian security services and in pro-Kremlin groups. Thanks to the timely work of Ukraine’s National Security Services (SBU), the effort was thwarted. Similar efforts to sow disorder cannot be ruled out in the months before the election.

There have additionally been a number of unexplained assassinations, of Ukrainian security officials, in Kyiv and other cities, who had operated successfully in the Donbas war. More of this is also to be expected. In the wake of the recent alleged poisoning in England of former Russian spy Sergei Skripal—and the 2004 alleged poisoning of Ukrainian presidential candidate Viktor Yushchenko—it is possible that Moscow may return to this deadly option as well.

The West must also reckon with the last major tool in Moscow’s hybrid war arsenal: the use of its military. This might involve the continued or additional concentration of major conventional forces on Ukraine’s border, or interference with Ukrainian shipping, particularly in the Sea of Azov. It might entail ratcheting up of additional firing across the line of contact in the Donbas or launching of a new offensive by the Russian proxy commanders.

A rapid-response team

The Victor Pinchuk Foundation, and the Transatlantic Commission on Election Integrity have established a Ukrainian Election Task Force. Working with other Ukrainian institutions—StopFake, the Ukraine Crisis Media Center, and the Razumkov Center—the three partners are creating a rapid-response team with the ability to monitor, evaluate, and disclose the full range of foreign subversive activities in Ukraine, and to propose suitable responses.

David J. Kramer, a former US assistant secretary of state, will lead the Task Force, which includes a distinguished group of experts and practitioners. The Task Force will focus on interference in the form of disinformation coming from outside forces, cyber operations, and kinetic operations. Jakub Kalensky, Atlantic Council senior fellow and former disinformation lead at the EU’s East StratCom Task Force, will lead the disinformation team. His Ukrainian colleagues will be experts at StopFake.org and the Ukraine Crisis Media Center. The cyber team will work under Laura Galante, senior fellow at the Atlantic Council, and will include two Ukrainian experts. The Razumkov Center, with Oleksiy Melnyk in the lead, will monitor kinetic activities.

Alongside the Task Force, the Atlantic Council’s Digital Forensic Research Lab’s (DFRLab) active monitoring mission, under the direction of Graham Brookie, will provide its unique expertise to the Response Team’s efforts. Using innovative open-source research methodologies, they will provide real-time monitoring and analysis of the information environment in advance of and during the elections. Findings will be released as publicly accessible reports serving to inform the public conversation around the election and repudiating disinformation attempts in real-time. This analysis ranges from traditional fact checking to more advanced analysis of inauthentic, automated, and coordinated behavior attempting to influence narratives both online and in traditional media. This is a proven model that the Atlantic Council has developed over the last two years, including successful monitoring missions of elections in Brazil, France, Germany, Italy, Macedonia, Mexico, the United States, and beyond.

The Task Force will produce a variety of content detailing the major points of foreign interference in Ukraine’s elections. By mid-December, the Task Force will launch an online dashboard providing a real-time index of efforts to interfere in Ukraine’s democratic process. The Task Force will also arrange conferences in 2019 on the subject of foreign interference in Ukraine’s elections in Brussels, Washington, and Kyiv. Task Force partners will also hold meetings with senior officials in Berlin, Brussels, and Washington to make sure that this issue receives the attention it deserves.

By Ukraine, for Ukraine

The upcoming elections in Ukraine are for Ukrainians to decide, not outside forces. Any efforts designed to influence and/or undermine the integrity of the elections would constitute an attack on Ukraine and would require a response from the international community. Such efforts must be exposed. Ukrainians deserve the right to choose their own leaders free of outside influence and interference, especially after having twice in a decade, in 2004 and again in 2013-14, demanded better from their leaders, the second time at significant cost. By exposing Kremlin interference as it occurs in the run up to March 2019, the Atlantic Council and its partners hope to provide Ukrainians with the necessary tools to check outside efforts to influence their vote, to establish the facts, and to cast their ballots for a better future for Ukraine.

Seeking the truth—combating narratives of Kremlin disinformation

main directions since its inception: discrediting the Ukrainian state and whitewashing or hiding Russian activities in Ukraine. The Kremlin derives most of its content from both of these topics. It is also worth noting that the Kremlin constantly created content that fell into either one of these two larger narratives and contextualized these current events from its own point of view.

In addition to these proactive disinformation narratives, which try to influence the perception of future actions and events, one can also identify reactive narratives that try to change the perception of past events. The international community has fresh in its memory the deception campaign around the poisoning of the Skripals; Ukraine has seen exactly the same pattern of spreading multiple conflicting disinformation stories already in 2014, including after the downing of Malaysia Airlines flight 17 (MH17) that killed 298 people.

Over the years, the Kremlin has demonstrated an ability to quickly adapt to a changing situation and adjust their propaganda messages. While their grand narratives remain mostly the same, they take different shades and forms.

Research has found that Kremlin-backed media has particularly focused on several topics in its attempts to spread disinformation in Ukraine:² Maidan was a coup d’état and the current authorities are illegitimate;³ Ukraine is on the verge of collapse;⁴ Internally displaced persons are not welcome in other regions of the country;⁵ Ukraine’s armed forces and volunteer battalions have violated the laws of war;⁶ NATO troops are fighting in the Donbas;⁷ Crimea has gained international recognition as Russian territory;⁸ EU-Ukraine cooperation does not tangibly benefit Ukraine;⁹ the West has “Ukraine fatigue” and is tired of Ukraine and its alleged lack of progress;¹⁰ and Ukrainian armed forces shot down MH17.¹¹

In the first years of the war, the narrative of Ukraine falling into a civil war clearly dominated Kremlin-backed content. In 2014, a significant amount of all news stories about Ukraine were about the alleged civil war and, as Kremlin propagandists claimed, its impact on domestic politics. This was done with a clear purpose of creating a smokescreen that would hide the real war—the Kremlin’s invasion—and its violation of Ukraine’s sovereignty and territorial integrity.

Another popular narrative has been that Ukraine is a “failed state.” Since the significant decrease of the violence in the Donbas, dating from the second half of 2015, Kremlin authors have begun to reorient the focus of their content toward the domestic politics of Ukraine, with the aim of portraying Ukraine as a chaotic, unglued, and hopelessly corrupt failed state.

Changes in Kremlin disinformation narratives can be tied to the levels of violence on the frontlines in the Donbas. *Photo credit: Sasha Maksymenko / Wikimedia Commons*

The use of these two narratives reflects a clear connection with the situation in eastern Ukraine. During periods of calm on the frontlines of the Donbas, the Kremlin uses its disinformation resources to demoralize Ukrainians about the “failures” of their authorities.¹² As violence returns to Ukraine’s east, Kremlin disinformation sources return to the “civil war” narrative, diverting attention from Russia’s role in the conflict.¹³

These Kremlin narratives sow distrust and division within Ukraine—and there has been a greater tendency to focus on creating disinformation directed at exacerbating Ukraine’s internal divisions. The Kremlin has shifted its focus from attempting to disguise its own involvement in the Donbas to trying to exploit Ukraine’s current problems to divide the population. The Kremlin is not only trying to hide its own crimes, but trying to distract, disrupt, and destabilize Ukraine from the inside, using disinformation as one of its primary tools.

The Kremlin attentively follows Ukraine’s internal developments and reacts very swiftly, proving it is able to provide more than just premeditated content, allowing the Kremlin to project its own point of view across Ukraine, in real time. One of the clearest examples was Russian media’s reaction to the expected creation of an independent church in Ukraine. This step would be harmful to Russia’s position in the Orthodox world and would greatly limit its influence over Ukrainians. The disinformation campaign about the Ukrainian independent church is overarching—criticizing the actors involved and questioning the legitimacy of the process, and featuring media provocations that create the anticipation of violence.¹⁴ Also, Russian media are trying to drive the public discourse by introducing topics that require other actors to react, framing the entire debate.¹⁵ The destabilization of Ukraine’s information ecosystem has been a priority for years and remains high on the Kremlin’s agenda.

As Ukraine enters its first election season since the Revolution of Dignity, there is no reason to believe that the Kremlin can resist the temptation to use its information sources, disinformation network, and pro-Kremlin proxies to spread disinformation about Ukrainian internal affairs with the explicit aim of influencing the election result and undermining the democratic process.

An overview of cyber activity targeting Ukraine: 2014–2018

Since 2014, Ukraine has been the victim of real, damaging cyberattacks attributed to the Russian government. Three major incidents illustrate the recent aggressive activity taken by Russian actors over the past five years: the 2014 network exploitation of Ukraine’s Central Election Commission, the destructive 2015 and 2016 attacks on Ukraine’s power grid, and the NotPetya attack, which debilitated Ukrainian and global corporations’ operations in summer 2017. The 2019 presidential election will likely serve as yet another flashpoint for Russian influence and interference in the cyber domains.

In 2014, months before Ukraine’s last presidential election, a pro-Russian hacking group called CyberBerkut destroyed key vote-tallying system files and leaked private emails and administrator documentation from Ukraine’s Central Election Commission (CEC). After restoring its systems, the CEC faced another wave of malicious activity leading up to election day. The CEC programs to monitor voter turnout and tally votes were shut down for twenty hours by the deletion of key files, while the CEC’s website was compromised, so that it displayed former Right Sector leader Dmytro Yarosh as the winner.¹⁶

The first known power-grid outage caused by a network attack occurred in Ukraine in 2015; it happened again in 2016, with blackouts caused both times. The group behind the attack is known by a variety of monikers, including Sandworm and Telebots. The malware it used to conduct attacks on the power grid, and on other Ukrainian targets like the railways, has been referred to as Black Energy, Crash Override, and Industroyer.¹⁷

In October 2018, the security firm ESET linked the group and its malware to the devastating 2017 NotPetya operation.¹⁸ This operation used a vulnerability previously exploited by the US National Security Agency in Microsoft’s operating system, called Eternal Blue, that was leaked publicly in spring 2017. The group delivered the exploit to Ukrainian and international companies doing business in Ukraine by hijacking the servers of an oft-used Ukrainian tax software called ME.doc.¹⁹ The damage to the networks of the Ukrainian government and financial sector was severe. In 2017 and 2018, numerous governments—including the United States, the United Kingdom, and Ukraine—publicly attributed the NotPetya attack to the Russian military.²⁰

As the 2019 presidential election approaches, the Kremlin will likely intensify efforts to meddle in the election and undermine its legitimacy, as well as deploy operations that sow chaos and strike at Ukrainians’ sense of security and safety. Given the Russian government’s past cyber operations, which targeted Ukraine from 2014–2017, state-sponsored cyber operations will likely compromise networks that deal directly with vote tallying and result presentation, exploit civil and financial-sector institutions, and technically manipulate media outlets and campaigns’ digital efforts.

The evolution of Kremlin kinetic operations in Ukraine

The role of the Russian military in the Crimea annexation campaign in February–March 2014 has already been studied and described in detail. Even Putin publicly admitted that Russia had a role after denying the obvious.²¹ He also disclosed one of the new tactics the Russian military tested in Crimea: using local civilians as human shields and as proxy fighters.²²

Russia’s military involvement in the Donbas has also been observed and documented, but has still not been legally recognized as an act of military aggression.²³ As for the evidence of Russia’s culpability in the Donbas, there are numerous official and independent sources, which regularly track its presence and ongoing material support through the use of video, photo, and even material evidence.²⁴ These open- and closed-source investigative efforts continued to compile proof of the Kremlin’s involvement in the Donbas, particularly in the aftermath of the MH17 investigation.²⁵

Today, military power remains one of the most effective instruments in the toolbox of Russian hybrid warfare.

Moscow has also used nuclear bluster as a tool in Ukraine. Putin and a number of other prominent figures have voiced Russia’s readiness to deliver a retaliatory, or even a preventive, nuclear strike—a position outlined in Russia’s military doctrine.²⁶

In 2018, Russia further exacerbated tensions by creating and enforcing a blockade of Ukraine’s ports in the East, along the Azov Sea coast. This effort seems to be directly aimed at influencing the outcome of ballots cast in next year’s election, by attempting to stoke economic and societal tensions in the region’s main industrial cities that rely on the Azov Sea.

During the last four years, Russia significantly expanded its land, air, and naval presence in Crimea, and reinforced and expanded the presence of its forces located in close proximity to Ukraine’s borders. The two army corps (armed formations in Donetsk and Luhansk) should also be considered part of the Russian forward military presence, as there are substantial political and military links between the de-facto authorities and Moscow. The Kremlin has also sought to put forces on Ukraine’s northern border, by seeking to establish a military base in Belarus. Belarus President Alexander Lukashenko has thus far refused this request.

Moscow is expected to use kinetic means to influence Ukraine’s March 2019 election by maintaining the low-intensity conflict in the Donbas; continuing and increasing acts of sabotage and terrorism, such as assassinations of public figures and high-ranking officers, attacks on military depots, and interference against critical civilian infrastructure; unilaterally escalating or de-escalating the conflict, with or without any warning; and reinforcing and maintaining a significant military presence and activity near Ukraine’s borders and along the Black Sea and Azov Sea coasts.

DOWNLOAD PDF

Issue briefs and reports

Fast Thinking

New Atlanticist

Inflection Points

UkraineAlert

MENASource

Econographics