Intelligence the key to understanding Russia’s intentions.
By Philip Ingram MBE
Last week U.S. national security advisor Jake Sullivan said that the U.S. is not certain that Putin has made a final decision to invade Ukraine. But “it may well happen soon.” Ben Wallace the UK Secretary of State for Defence told The Sunday Times that “Russia invading Ukraine is “highly likely” and warned that the military presence on the border has now reached such a size that they could “launch an offensive at any time”.” Wallace has cancelled a planned long weekend holiday!
The question on everyone’s lips is how, how could we know what Russia is going to do? The only way to answer that question is through intelligence and the overriding caveat is that intelligence is not an exact science. However, there are certain indicators that would point more to an invasion than a bluff and it is these I will explore in more detail.
So how do we know what is going on at the moment? I examine the intelligence gathering effort in more detail in my blog here: https://greyharemedia.com/russia-and-ukraine-an-intelligence-goldmine/ However, there are a few things I want to pull out to set that background to this analysis. The first is how do we know there are over 100,000 troops with the right equipment to invade Ukraine?
The first thing is Open-Source Intelligence or OSINT. Russia has declared it is carrying out manoeuvres in Belarus, in training areas around the Ukrainian border, in the Black Sea so we have definitively from the Russian Government that they are doing something. Next, we have what is being posted on special media; videos of convoys, trains full of equipment, soldiers leaving their home bases and more.
What must be considered with anything from open source is it could be being posted deliberately to mislead. Sun Tzu the infamous Chinese 6th century general and philosopher said in his book the Art of War, “All warfare is based on deception. Hence, when we are able to attack, we must seem unable; when using our forces, we must appear inactive; when we are near, we must make the enemy believe we are far away; when far away, we must make him believe we are near.” The Russians have a doctrine called маскировка (maskirovka) which is all about ‘masking’ or deception and is central to all they do; they follow the philosophy laid down by Sun Tzu.
Analysis of the vehicle and aircraft types, badges on soldiers’ uniforms, vehicle registrations and symbols can identify units and therefore where they are coming form, geo-referencing the imagery and from that, by comparing with historical data, if this is usual activity. Alongside that, private social media posts by Russian military personnel will be looked at for indicators. Again, маскировка (maskirovka) must be considered.
This OSINT will be fused with imagery intelligence from satellites and Measurement and Signature Intelligence (MASINT) gathered from Satellites, Drones and Fixed Wing Aircraft flying along the borders, staring into Russia and Belarus with specialist radars. These radars can see anything in the open including equipment hidden in forests and or under camouflage nets and their numbers can be counted regularly to see and changes. It can also be used to identify what types of equipment there are and that in turn will indicate the unit or formation. The same radars can track convoys and trains moving in real time, distinguishing military equipment from civilian traffic. Other sensors can see if equipment has moved recently and how long ago often being able to identify where it has moved to.
What is key here is identifying what formations are where and what they are doing? So, if the deployment is being billed as just training on home territory, are all the formations and units participating in that training, what are the ones with the best levels of training and the best equipment’s doing as not every unit or formation is equal? What is happening to the unit and formations logistic tails as they move and train and do those logistic tails match what is a norm for practice manoeuvres or are they larger? (You would not use as much ammunition on manoeuvres as you would need for operations, or as many medical facilities, or as many spare parts for armoured vehicles, so are these natures pre dumped and if so, where?).
Next will be looking at supporting units and formations, communications networks, air defence, air support and artillery as well as Intelligence, surveillance, and reconnaissance (ISR) capabilities. The questions are what has been deployed to where and with what? For purely manoeuvres you do not need large numbers of live anti-aircraft missiles, or the artillery ammunition stocks you would need for offensive operations, or the same balance of ISR assets or the communications networks needed to control multi levels of ground offensive capabilities, and integrate it with air support, ISR feeds and logistic networks over the same geographical footprints.
Satellites, RC135, JSTARS and Global Hawk and other surveillance platforms will be hoovering up all of the information needed to work all of this out. Networks need to be tested, comms checked, radars positioned and tested, aircraft systems checked. No matter how good your comms plans are at suppressing emissions, you can never supress them all. Each emission is an indicator!
Air capability will play an important role, for manoeuvres you need a lot less than you would need for offensive operations and different types and certainly different weapons. Numbers and types will be critical. The first thing any Russian offensive operation would want to do is SEAD, suppression of enemy air defence (AD), i.e. destroy Ukraine’s ability to track and shoot down Russia’s aircraft so Ukrainian air assets could be targeted and then ground offensives begin.
SEAD would be carried out through a combination of Special Forces, Attack Helicopter, indirect fire usually from long range missiles and specialist SEAD aircraft as well as ground based and air based Electronic Warfare (jamming) capabilities. Where are the assets needed to do this and how ready are they and what are they equipped with?
These capabilities would need to ensure safe corridors to all Ukrainian air assets and ground formations were safely opened, so even if there were a geographically limited invasion of Ukraine, AD and air assets across the whole country would have to be targeted. It would be highly unusual for these assets to be grouped and deployed in sufficient numbers just for manoeuvres.
Alongside all of these physical indicators, communications will be being listened to, whether that is over military communications means or civilian means, the technology to intercept and often decode exists. This will give a clear understanding of the quality of military communications, readiness of units and formations and some will give indications of intent. However, communications can also be used for маскировка (maskirovka).
Adding another layer on top of this are the Human intelligence (HUMINT) assets, at the strategic level running agents into the decision-making organisations in Moscow, military command headquarters and elsewhere and at the more tactical level, people reporting what is going on on the ground. Good HUMINT assets can get a real understanding of thinking and intent but getting good HUMINT agents with the right access is a massive challenge.
What must be considered at all times is that lovely word маскировка (maskirovka) – it could all be a huge expensive bluff, we have to remember that during the Second World War in preparation for D Day the allies had Operation Fortitude where amongst other things they created a fake army with a real commander, fake tanks, fake aircraft, fake radio transmissions, and fake spies with fake plans delivered to the Germans in a novel way through Operation Mincemeat. We knew what the Germans were looking for and provided it to them. The Russians know what we are looking for. That is partially why the intelligence game is very complex.
However, the subtle military indicators, with the sophisticated collection capabilities we have today compared to what existed during WW2 will give a much clearer picture of readiness and intent. This is what our politicians are being briefed and for them to order citizen’s out of the country and for the Defence Secretary to cancel his personal holiday, the indications supplest an invasion is more likely than not.
I have examined the why and what the possible objectives could be in another blog here: https://greyharemedia.com/what-is-driving-putins-thinking-on-ukraine/. My conclusions today remain as they were when I wrote that. There are so many other possible indicators such as status and loading of Russian Naval vessels, the defensive posture of the Kaliningrad Oblast and around Russian Naval bases in Syria, the Northern, Baltic, and Pacific fleet bases, but to examine them all would be a book. We are seeing one of the most dangerous, complex political and military events in Europe since the Cold War or even before that.
Philip INGRAM MBE is a former Colonel in British Military Intelligence and was a senior military planner, he is available for comment.
As the crisis between Russia, Ukraine and the West continues to deepen and speculation over a potential conflict, and its scope, grows, what is clear is President Putin has given the West an unprecedented opportunity for intelligence gathering at so many different levels.
What has been noticeable on the many open-source aircraft monitoring platforms are the airborne intelligence gathering platforms that have been bracketing Ukraine, Russia and Belarus from Poland, the Baltics, inside Ukraine and from the Black Sea, hoovering up information from different sources and turning it into intelligence.
There hasn’t been an opportunity since the Cold War for the deployment of large formations of Russian Ground Troops, configured for a large-scale warfighting operation to be looked at and examined in so many different ways. So, what is likely to be going on and what will we know?
The first caveat is that I have to be more generic that I would like to but within the intelligence game there are only so many ways to gather information whether through the use of humans or through exploitation of the electromagnetic spectrum. The actual capability of many if not all of the collection platforms being targeted at the Russian build up remain highly classified and my analysis is therefore speculative but from a position of knowledge having overseen many operations to monitor large formation deployments of Russian style formations.
There is a real alphabet soup of intelligence techniques that will be targeted against Russia, and each will be hoovering up vast amounts of information, processing it into a specific brand of intelligence that will then be fused together to provide all source intelligence thereby building a much better and clearer picture as to what is going on.
I do have to caveat that when a sensor picks something up it means it has happened, i.e. it is history and intelligence is all about looking at what has happened in order to predict what will happen. Predicating the future is never an exact science and if fraught with potential misinterpretations; especially when the opposition know what you are doing and are therefore actively trying to deceive you.
So, what are the aircraft doing and what can they see from so far away from the Russian border? Essentially, they are carrying out 3 types of intelligence gathering, SIGINT, ELINT and MASINT.
Signals Intelligence (SIGINT) will be listening to all of the broadcast communications between military units, formations, headquarters and bases, looking at the frequencies used, the networks that are operational and what is being said in the messages. This will have the ability to conform the order of battle, i.e., what formations with what kit are deployed and, as the units and formations practice their communications, it will give the intelligence specialists a lot of material to decrypt, confirm previous knowledge and prepare wider indicators and warnings for certain activities.
Electronic Intelligence (ELINT) will be monitoring all of the Radar and other emitters operating in support of Russian activity. It will be looking at what they use to find and track targets and what weapon systems could be used supported by the radars. It will also be looking at the control mechanisms for weapon systems. The very act of flying aircraft, and in the case of the HMS Queen Elizabeth deployment, sailing a warship along the Ukrainian Coast, will stimulate a lot of electronic activity. The ELINT Sensors will hoover all of that activity up and use it to make sense of what systems are being used, but also use it to understand how to disrupt those systems if needed.
Next comes MASINT – Measurement and Signature Intelligence, and this is where the operational and tactical magic happens when monitoring large ground-based formations. vehicles are effectively lumps of metal and they emit different heat and radar signatures to natural surroundings and even buildings. MASINT can be used to monitor what is where, what has moved and give indication on what could be happening. It takes a long time to prepare Armoured formations for operations and they must prepare for specific formations as they advance, all of this data can be picked up utilising a number of techniques when applied to MASINT sensors. This message the Russians will know well, as they have their own capabilities, nothing is hidden, no matter how many camouflage nets there are over it, the only real secret is how much can be seen and how far away?
As platforms are flying, they will be stimulating activity on the ground in response, stimulating reports being sent up chains of command, sent to military and political masters and these reports relate to activity we know about, because we will have caused it. These reports will be targeted by more strategic collection capabilities to identify how they are processed and sent and therefore identify potential vulnerabilities in the systems used to process them and the mechanisms of their transmission. This information is vital in allowing newer responses through cyber to be brought to bear if necessary.
It is the good old tactic espoused by General Rupert Smith during the first Gulf War, when he said, “If the pond is still, don’t be afraid to thrown in a pebble and watch how the waves promulgate.” This is exactly the same tactic used in June 2020 when HMS Defender sailed along the Crimean Coast and for the whole of the HMQ Queen Elizabeth task force deployment, watching those who were watching it, was invaluable.
Of course, the airborne assets will be complementing what the space-based assets are monitoring and being used to complete the picture from 2 other critical intelligence disciplines. The first being HUMINT, at a strategic level the national agencies of many countries will be trying to find out what is going on inside the Russian Political, military, and operational headquarters and working to get a handle on the wider intent of President Putin and the real capability of the military forces deployed.
It is almost certain Ukraine will have HUMINT assets targeting the Russian formations deployed close to its borders looking at the orders of battle and the levels of preparations. However, one of the most valuable resources is the huge amount of Open-Source material that is circulating on various social media platforms. There are hundreds of pictures and videos of Russian equipment being moved towards the borders, pictures of training and troops putting personal pictures onto social media. This Open Source Intelligence (OSINT) is invaluable and colours in or targets much of the information and intelligence gathered from more classified sensors.
So, what is likely to happen? That is anyone’s guess at this point, but there are certain factors that come to bear. Putin won’t want the full might of the international community to come to put pressure on his fragile economy, but he must be seen to do something for his domestic audience and for the massive deployment to seem ‘legitimate.’ He seems to like the NATO Kosovo scenario of going to protect an element of the local population, but to do that he needs to escalate the crisis to the international community before he can think of going, else he needs to de-escalate his preparations in the eyes of the Russian public.
The sorts of potential indicators and warnings of a potential move could include:
Increasing domestic rhetoric suggesting Western Interference
Increased international rhetoric accusing the west of interference
Increasing Rhetoric around ethnic Russians being targeted
Rhetoric around Ukrainian incursion into Russia
Increased Belarus activity on Polish border with refugees
Ukraine Cyber attack
Global Cyber attack
Russian Black Sea fleet deployed
Elements of the Russian Med Fleet deployed
Elements of the Russian Northern Fleet Deployed
‘Manufactured’ terrorist activity both against Ethnic Russians but also inside Russia itself – bombs in Moscow / Airliner Shot Down?
However, if he does, he will have limited objectives the worst-case scenario could be annexing a large part of Eastern Ukraine where the majority Russian Speakers live. He is likely to calculate this as being just under the threshold of a very robust Western intervention as the last thing Putin could afford is a conflict with the West and he knows this, but emotionally he wants all of Ukraine. He could easily de-escalate but indicators of that will be domestically focused rhetoric regarding meeting Russias objectives and capitulation by the West in some way. We live in interesting times and the robustness of our political leaders will likely be tested to their fullest extent.
A potential Op Plan schematic for a limited Russian Invasion is:
As the situation develops, further blogs will drill into the detail of what we are seeing but the author can be contacted at any time and details are available on the Contact Us Page. Philip Ingram MBE is a former Colonel in British Military Intelligence.
Why have global leaders from the 5 eyes countries started to blame Iran for shooting down Ukrainian airline flight PS752, a Boeing 737-800 from Tehran on Thursday? How would they know not having access to the on the ground investigation? Philip Ingram MBE a former Colonel in British Military Intelligence explains the science behind the intelligence, MASINT.
Talking about the crash, Justin Trudeau, the Canadian Prime Minister, said in a news conference in Ottawa in Canada on Thursday “We have intelligence from multiple sources, including our allies and our own intelligence. The evidence indicates the plane was shot down by an Iranian surface-to-air missile.”
Before that, CBS News in the US said, “U.S. intelligence picked up signals of a radar being turned on, sources told CBS News.”
The UK’s Daily Mail said, “US intelligence says the Boeing 737 was tracked by satellite data which showed the plane airborne for two minutes before detecting the heat signatures of two surface-to-air missiles.
That was quickly followed by an explosion, officials say, before infrared emissions from the plane showed it burning as it crashed to the ground.”
US President Donald Trump said, ‘It was flying in a pretty rough neighbourhood. Somebody could have made a mistake,’ and went on to tell reporters at the White House on Thursday. ‘I have a feeling that something very terrible happened, very devastating.’
The official Iranian line remains the aircraft suffered mechanical failure, so what is the truth and how can we believe reports from unnamed ‘intelligence sources’ that to the nay-sayers will smack of what the Russians love to call – маскировка (maskirovka) or masking. This is “Fake News” in Donald Trump’s vocabulary, at a time when accurately apportioning blame is critical in the international powerplay and need to de-escalate an unfolding crisis.
It was fascinating that CBS first quoted the unnamed intelligence source describing what had been seen from satellites, most of the intelligence derived from satellites is classified at a level of above TOP SECRET simply because the US doesn’t want the world to know what it sees.
The quotes in the press allow me to introduce the little-known world of what is called MASINT, or Measurement and Signature Intelligence, again a discipline where little is released because of the sensitivities of capabilities. However, the science around what has been mentioned is relatively straight forward and it is that science that gives a degree of certainty as to what has happened.
According to US intelligence publications, “Measurement and Signature Intelligence (MASINT) is technically derived intelligence (excluding traditional imagery (IMINT) and signal intelligence (SIGINT) which when collected, processed, and analysed, results in intelligence that detects, tracks, identifies, or describes the signatures (distinctive characteristics) of fixed or dynamic target sources. MASINT includes the advanced processing and exploitation of data derived from IMINT and SIGINT collection sources. MASINT sensors include, but are not limited to, radar, optical, infrared, acoustic, nuclear, radiation detection, spetroradiometric, and seismic systems as well as gas, liquid, and solid material sampling systems.”
From the reporting we have 2 signatures that have been analysed. The first is the “signals of a radar being turned on.” There is no one radar signature that does everything for everyone, different radars are designed to carry out different task, for example a long-range air traffic control radar will use a particular frequency to look out long distances, will rotate relatively slowly looking for objects a long way away and all around it. Radar uses a radio wave frequency and then analyses how that bounces off a particular object as it moves, using what is called the doppler shift, to work out how that object is moving and where it is relative to the Radar.
There are 3 signatures that are examined with Radars to identify their purpose and unique signature, every type of radar has a unique fingerprint of signals. These are the frequency of the signal it transmits and the way that transmission is coded, what is called the PRF, or pulse repetition frequency, and the rotation (including speed of rotation, if any) of the radar transmitter, some Radars are fixed and some, like those you see at airports, rotate. Putting all 3 together you can easily classify a radar as “Air Defence, fire control associated with TOR M-1 (SA15),” and rule in or out what the radar is usually used for, i.e. If it is a search radar or a fire control radar.
The second signature is more interesting. The quote that, “satellite data which showed the plane airborne for two minutes before detecting the heat signatures of two surface-to-air missiles. That was quickly followed by an explosion, officials say, before infrared emissions from the plane showed it burning as it crashed to the ground.” This tells us a lot.
It mentions heat signatures and infra-red signatures, simplifying the science behind these terms they are effectively the same but hide the detail within those phrases. It is widely reported in scientific journals how astronomers can tell the make-up of a star or the atmosphere around a planet by looking at the different light signatures received by the Hubble, other space or ground based optical or wide spectrum telescopes. That is looking billions of miles into space and examining the minutest electro magnetic signatures received. Infra-Red, is merely an electromagnetic signature.
When you burn coal on a home fire it gives off a different heat signature to burning wood or when the fire brigade is using their thermal cameras, through temperature differentials they can see the seat of a fire and in some cases if there are accelerants feeding it.
It is the same with a missile launch, compared to a rocket launch, compared with an explosion. The spectrum of visible and infra-red radiation detected is different for a solid rocket motor, liquid propelled rocket or an explosive substance going off and these are vastly different to a fuel or oil fire in an engine. For the geeks amongst you the energy released with the breaking of molecular bonds in the fuel or explosive compounds is different depending on the way the molecule breaks down and the excitement of different elections in atoms as they move between different valence levels. Apologies, my degree was in Applied Science from the Royal Military College of Science, and apologies to my old professors for the inaccuracy caused by oversimplification.
If scientists can use these techniques to work out what is happening billions of miles away, it is reasonable to believe that satellites a few hundred miles into space can detect the same and the intelligence analysts make the same conclusions that scientists can. In addition, a rocket, propelling a warhead to a target will ‘burn’, give an Infra-Red signature for a lot longer than an explosive incident that lasts a fraction of a second and then burning debris will have yet another different Infra-Red signature. Again, this is all part of MASINT. The Lockheed Martin Space Based Infra-Red Surveillance programme (SBIRS) provides the US with such a capability.
Putting all of this together is not a rapid task when it comes to properly identifying a system, putting it together in a way you can release information outside the classifications used with the systems deployed is a challenge. The science is in the public domain, the claims are in the public domain, putting both together is a naturally logical process and this is how I can be confident that the claims made by Justin Trudeau, reinforced by Boris Johnson, initially reported by CBS and now others, are probably true.
This can easily be reinforced by the suspicions raised when the pilots didn’t transmit a MAYDAY, they were probably incapacitated or killed in the missile explosion, the aircraft was new and had been inspected 2 days beforehand reducing the probability of mechanical failure, the crew were experienced and the Iranians have cleared the crash site before international inspectors could get there. Additional intelligence from SIGINT transmission around the time of the incident will probably tell more if, as is likely, Western intelligence can and has intercepted them. I am more certain than not by a large degree that this was a shoot down and almost certainly accidental. The only positive is that it could cause Iran to rethink the need a spectacular event as a revenge for the killing of Soleimani, at the very least in the short term.
Philip Ingram MBE is a former Colonel in British Military Intelligence and has studied the science behind many different systems at The Royal Military College of Science bot at degree and masters level. He remains available for comment.