1.4 Unprecedented use of intelligence instrumentalized by strategic communication

Rubén Arcos, Cristina Ivan, Ruxandra Buluc


Intelligence and strategic communication do not necessarily appear as complementary activities. In usual circumstances, intelligence activities are governed by two principles “need to know” and “need to share” which are generally restrictive in their scope and mean that intelligence is not disseminated to large audiences, only to those with direct interests in it. However, intelligence services have become more transparent with the public in recent years as part of a two-folded endeavour: on the one hand, civil society requires and is entitled to oversight into intelligence services activities; on the other hand, intelligence products, when communicated in a timely manner to a wider civilian audience, may inform them and thus build their resilience to possible future disinformation attempts.
The present section focuses on the evolutions regarding the strategic communication of intelligence assessments and the role they can play in framing the public debate and understanding of unfolding security-related events. To this end, the section investigates the innovative use of strategic intelligence communications in information operations that have been carried out by some actors, such as the UK Ministry of Defence, during the war in Ukraine. The novelty of this communication model has been to open to public knowledge an important part of the information available to the intelligence agencies, with the aim of counteracting disinformation carried out by the Russian Federation.

Main research questions addressed

● What changes have occurred in the communication of European intelligence services due to the war in Ukraine?
● What new forms of communication are being used to “intelligence as influence”?
● These strategies will be effective to counteract the disinformation and propaganda, as instruments of information warfare? 

Communicating intelligence proactively

Before and after the Russian aggression in Ukraine, Western intelligence services and government officials have developed the (uncommon) practice of communicating intelligence to the press, stakeholders, and the public, including by proactively sharing intelligence about Putin's plans for aggression.

The intelligence disclosure campaign started in November 2021, when Ukraine warned of the Russian troop deployment on its eastern border. This was confirmed by American intelligence which counted almost 100,000 troops amassed there. Ukraine intelligence also published the first map with possible attack directions. In December, Washington Post also published such a map as well as an estimate for the US intelligence community stating that Putin would gather 175,000 troops on the border and then invade at the beginning of 2022. In January 2022, the White House Press Secretary publicly stated that Russia was planning a false-flag operation, an attack against Russian-speaking Ukrainians in the eastern part of the country, allegedly carried out by the Ukrainians, and thus Russia would provide itself with a reason to invade. (By making it public, this false-flag operation was cancelled). At the end of January, the British Foreign Office stated that Russia wanted to establish a puppet regime in Kiev after toppling the current one. In mid-February, an American official gave the date for the invasion as February, 16. When this did not occur, the Russians claimed to withdraw their troops from the border, only to be publicly refuted by British and American intelligence which clearly stated that troops were still being amassed at the order, at that moment numbering approximately 150,000. On 11 February, Jake Sullivan, the US national security advisor, warned “that a Russian invasion of Ukraine could come before the conclusion of the Winter Olympics on Feb. 20”. In the week before the invasion, chief of UK Defence Intelligence, Gen Hockenhull, also published a map on Twitter predicting the Russian invasion. He did not make the decision lightly, but as he believed "It's important to get the truth out before the lies come," On February 23, the US transmitted a message to Ukrainian president Volodymyr Zelensky that the Russian would invade in less than 48 hours.

On 24 February 2022, President Biden remarked:

For weeks, for weeks, we have been warning that this would happen, and now, it's unfolding largely as we predicted […] We have been transparent with the world. We've shared declassified evidence about Russia's plans and cyberattacks and false pretexts so that there could be no confusion or cover-up about what Putin was doing.
The BBC’s security correspondent, Gordon Corera, in an article on how Western intelligence agencies shared intelligence with the public during and after the months preceding February 24th, 2022, wrote: “traditionally, it is the job of a spy to keep secrets - but as the invasion of Ukraine loomed, Western intelligence officials made the unusual decision to tell the world what they knew” (BBC, 9 April 2022).

These public intelligence briefings have allowed, on the one hand, for Western states to help to prepare, train, equip Ukraine in the run-up to the invasion, thus increasing their response and resilience capabilities; on the other hand, public disclosures through the mainstream media, social media have prevented Russia from taking the initiative in setting the narrative for the invasion, and have prepared Western public opinion for what was to happen, which in turn led to an unprecedented public solidarity with Ukraine, for supplying military aid to Ukraine, for sanctions imposed on Russia.

As Abdalla et al (2022) explain, this public disclosure of intelligence in the period before and after the invasion of Ukraine signals that the traditional secretive and elusive nature of intelligence production, dissemination and usage has changed dramatically. Intelligence has now become a powerful instrument in politics and diplomacy and its new role needs to be analysed to understand both its strong points as well as the potential weaknesses it entails. Moreover, as the researchers point out, the way intelligence has been instrumentalised both before and after the Russian invasion has led to reinvigorated trust in a branch of intelligence (whose notorious failures had previously affected the perception on all intelligence): strategic warning intelligence. The process of making intelligence more transparent to the general public is fostered and complemented by transformations and development of technologies and availability of open source intelligence, which allows for public figures to reveal, discuss, warn of Russia’s intentions in Ukraine and its preparations in the run-up to the invasion.

In an analysis on the public use of intelligence has had on the war in Ukraine, Riemer (2022) assesses the implications it has at three levels: political, strategic and tactical.
a) Political level – the revelations of the invasion before it actually occurred allowed for the narrative to be clear, casting Putin and Russia as the aggressor and Ukraine as a victim. This helped form unified support for Ukraine.
b) Strategic level – The revelations did not stop Russia from invading Ukraine.
c) Tactical level – Russian confidence was undermined by the constant exposure of their covert operations, of their troop locations, causing them to cancel or reroute certain missions, which lowers morale and efficiency.  

Counteracting disinformation and propaganda as instruments of information warfare

Another advantage of using intelligence briefings in strategic communication is that they can help counter the misinformation, disinformation and propaganda that are generally associated with a war. They reflect “a balanced picture of the state of the fighting and its consequences in a way that enables level-headed and calculated decision making” (Riemer, 2022). Russian aggressions in Ukraine also triggered the release of military “intelligence updates” by the UK Ministry of Defence through its Twitter account. (See: Figure 1. and Figure 2.). 

Figure 1. Intelligence map Source: @DefenceHQ

Figure 1. Intelligence map Source: @DefenceHQ

Figure 2. Intelligence update. Source: @DefenceHQ

Figure 2. Intelligence update. Source: @DefenceHQ

Intelligence made public has assisted Western powers in setting the stage and framing the ways in which audiences would perceive and interpret the Russian invasion.

Abdalla et al (2022) explain that the steps taken to provide the public with what would have once been considered classified information can be defined as prebuttal, meant to develop resilience to possible disinformation attempts, by making the public aware of the truth before the disinformation has the time to spread. Thus, the truth becomes the first thing people know, and it is very difficult to change their perceptions and beliefs once they are formed. However, in a conflict situation, prebuttal requires “rapid declassification of intelligence” (Abdalla et al 2022) so that it can be made public on all media in a timely and relevant fashion. Thus the media is bombarded with the truth, with information that can be verified, which is measurable and tangible, supported by real time data. Abdalla et al (2022) further point out the fact that the prebuttal campaign was successful in this case because the events that were forecast actually came true, and consequently, it revitalized the view of strategic warning intelligence. But they also recommend caution when releasing intelligence assessments to the public, for two reasons: (1) if the reports are low confidence and they do not come true, then prebuttal would turn into only another form of propaganda that would undermine trust in intelligence once more; (2) revealing too much information, although it might deter some Russian actions, could also harm sources.

This decision of the West of sharing intelligence with stakeholders and the public happens in a security environment where the Russian Federation and other actors have been making use of the instruments of information warfare like disinformation and propaganda to justify their actions and create confusion about their intentions before the aggression. The EU understood early on that prebuttal is not a sufficient means of countering the effects of Russian propaganda and disinformation. Therefore, The European Parliament condemned “the use of information warfare by Russian authorities, state media and proxies to create division with denigrating content and false narratives about the EU, NATO and Ukraine, with the aim of creating plausible deniability for the Russian atrocities” (European Parliament 2022: point 31). The Council Decision (CFSP) 2022/351 of 1 March 2022 “concerning restrictive measures in view of Russia’s actions destabilizing the situation in Ukraine” forbade operators to broadcast content by RT and Sputnik, “including through transmission or distribution by any means such as cable, satellite, IP-TV, internet service providers, internet video-sharing platforms or applications, whether new or pre-installed” and suspended broadcasting licenses previously granted. On 27 July 2022, the Court of Justice of the European Union dismissed an appeal of RT France against the Council Decision, which alleged infringement “the rights of the defence, freedom of expression and information, the right to conduct a business, and the principle of non-discrimination on grounds of nationality” (Court of Justice of the European Union 2022). Among other reasons, the Court in Luxemburg argued that:

after examining the different items of evidence adduced by the Council, finds that these constituted a sufficiently concrete, precise and consistent body of evidence capable of demonstrating that, first, RT France actively supported, prior to the adoption of the contested acts, the policy of destabilisation and aggression conducted by the Russian Federation towards Ukraine, which ultimately resulted in a large-scale military offensive, and, second, RT France broadcast, in particular, information justifying the military aggression against Ukraine, capable of constituting a significant and direct threat to the Union’s public order and security (Court of Justice of the European Union 2022).

The intelligence sharing campaign designed to get the truth out to the public as efficiently as possible is still ongoing in the war in Ukraine, and we may notice changes as Russia adapts to its modus operandi. However, the decision of sharing intelligence with trusted journalists and, more broadly, disseminating, through social media channels, intelligence assessments-like tweets responds to the willingness of providing the public with trusted information to critically address information flows across social media platforms (Ivan, Chiru, Arcos 2021).

The importance, relevance and positive effects that the use of intelligence for strategic communication has had cannot be understated. At the same time this fact stresses the importance of strategic communications in our digital era and in warfare, particularly when strategic communications are informed by intelligence about hostile actors’ intentions and provides forewarning to the public. As a concept, Intelligence-led PR underlines how intelligence supports the planning, implementation, and evaluation of strategic communications (Arcos 2016). Simultaneously, the overabundance of information, opinions, malicious content in the digital information environment requires an analysis function on public communications conducted by adversaries and the audiences they target through specific channels and means.

The use of OSINT in strategic communication

The war in Ukraine has proven the power that OSINT collected by citizens can have in two directions:
(1) providing real-time information for the armed forces with respect to where the enemy is located. Smith-Boyle (2022) enumerates how OSINT allowed Ukrainian forces to attack Russian forces in real time: by tracking Russian troops and their movements, by using satellite images to pinpoint where Russian will attack, by having access to unencrypted radio waves and cell phones to listen to the Russians conversations, including their locations and plans; by following social media posts from both Ukrainians and Russians to get a real sense of what the situation is like on the ground. Her conclusion is that “these advantages provided by OSINT have allowed Ukraine to challenge Russia's stronger, larger, and more technically advanced military” (Smith-Boyle, 2022).
(2) creating an image of what the situation on the ground is really like for both internal and international audiences. OSINT thus becomes an integral part of the information cycle in modern warfare, as many strategists have noticed that the war in Ukraine is the first one that takes place in real time, both on the battlefield and in the online environment. Thus, as previously mentioned, Russian false flag operations have been thwarted and international support for Ukraine has risen. Moreover, OSINT has allowed the world to witness directly how the Russian military attacked civilians, causing massive casualties and destruction in civilian populated areas. Smith-Boyle (2022) provides an example of how Russian claims with respect to the events in Bucha (that the victims were not Ukrainian, but Russian casualties that the Ukrainians used to stage the scene in order to claim that the Russians perpetrated crimes against humanity) was discredited using satellite images and facial recognition software, thus opening the door for OSINT to support future war crime trials.
In addition to increasing international support for Ukraine, OSINT has also increased support for the fight against Russia among Ukrainian citizens. OSINT has revealed failures of the Russian military and successes of the Ukrainians, giving Ukrainians more hope that they can fight the Russian military off. Morale and the Ukrainian national identity have been strengthened as a result, thus making the fight against the Russians that much stronger. As Ford (2022) explains, “The Ukrainian Armed Forces can then direct remote fire onto the targets that civilians have identified,” while also highlighting the need to double check the targets from other intelligence sources. Along the same lines, Karalis (2022) emphasizes that “the wide use of smartphones among Ukraine’s population effectively means millions of civilians are armed with sensors, something extremely hard for the Russian army to prevent. By exploiting this capability, Ukrainian forces have altered the traditional kill chain and outsourced parts of it to civilians reporting Russian movements, thereby building a more extensive and resilient network.” The conclusion is that OSINT is an invaluable tool for the collection of information from the most various sources, and it has also led to the democratization of the intelligence cycle, but it has its limitations and it should be used collaboratively with other means of verifying the information. Even more so, in a disinformation context. State institutions cannot take for granted the information that becomes available in open sources, as disinformation agents can intentionally use channels that OSINT is usually collected from in order to infect the intelligence cycle with malignant information.
Therefore, OSINT can help transform the intelligence collection and distribution process in the war in Ukraine, but it also needs to be used carefully, with due attention paid to its risks and limitations. Moreover, as far as future uses of intelligence in strategic communication, it can be noted that the transparent, public approach has led to a better and enhanced public understanding of the security evolutions, which expands beyond the scope of the Russian-Ukrainian war. Any future, potentially critical, security evolution could benefit from an assessment of the need and role of intelligence communicated strategically, based on the three levels previously mentioned (political, strategic and tactical), in order to determine how much intelligence and to what end could be shared.  

Future challenges

The fight against disinformation in the past decade has brought forth an intensified use of intelligence in the public domain. Policy makers have increasingly used intelligence-evidenced communications to raise awareness on security risks correlated to the spread of disinformation, especially in the online environment. This is not an entirely new phenomenon.

As Huw Dylan and Thomas J. Maguire observe, “the increasingly frequent use of intelligence in the public domain by policy makers” is an intriguing development observed at the dawns of the Russian invasion of Ukraine which signals an evolutionary rather than a revolutionary development (Huw and Maguire 2022, 3). The two authors distinguish the use of intelligence in communication, according to both the nature of information communicated (which can be raw or finished), and to its purpose. And here, one needs to make the distinction between (1) communication of intelligence aimed to enhance awareness, consolidate resilience and solidify trust in the intelligence body issuing the communication, which is primarily a type of communication aimed at internal audience, and (2) communication of intelligence aimed to influence external audience, in an attempt to create a strategic advantage. Last but not least, the two authors mention deceptive deployment of intelligence communication which makes use of fabricated and misleading information to confuse and deceive, something which we have previously analysed in our discussion of disinformation. An illustrative example is that of “Russia disseminated fabricated intelligence following the downing of Malaysia Airlines Flight 17 over Ukraine with the aim of diverting the blame for that outrage from itself” (Huw and Maguire 2022, 6).

The reasons behind using intelligence communication may include the need to gain support for the audience for own initiatives, to act preemptively and deter an enemy by letting him know you are aware of his actions and whereabouts or simply to increase resilience in the audience that is in this way made aware and forewarn as to disinformation tactics of adversarial states. All of the above-mentioned objectives have been incorporated in state strategic communication in the past and have intensified in the past decade with the aim to broaden public understanding of the risks incurred with the use of social media and AI in microtargeting audiences and spreading disinformation.

Riemer (2022) also explains that public disclosure of intelligence may pose risks to the sources of that intelligence as well as to the methods used to analyse it. Technology may be inadvertently made public and available even to the enemy, human sources may become compromised and even put in danger, which could lead to future difficulties in acquiring such sources.

Huw and Maguire (2022) also look at the strategic vulnerabilities that disclosing intelligence could bring about. Once the target becomes aware, they might change their modus operandi, adapt so that their weakness is hidden, and secure their information and communications. Moreover, it could eliminate the grey zone necessary to plan and carry out operations, the flexibility and adaptation that such operations presuppose, since the intelligence pertaining to them would be public, and hence any deviation from the public plan could be considered a failure. The short term gains might cause long term, strategic vulnerabilities. 

Case study 1 - Examples of disinformation in the euvsdisinfo database

The EUvsDisinfo database contains over 300 cases of disinformation on MH17. A distinctive feature of the history of lies in this case are the attempts to create “alternative versions” of the tragedy. (MH17: Seven Years of Lying and Denying n.d.)

According to people who were collecting corpses after the crash, a large share of the corpses were “not fresh” – people had died several days earlier.

A source in Russia’s Federal Air Transport Agency, requesting to be anonymous, has told the Interfax news agency that the target of the Ukrainian missile might have been the aircraft of the President of Russia. According to the source, the Russian “Air Force One” and the Malaysian Boeing met at a point and flew in the same air corridor 

On 19 July 2014, two days after the disaster, a Twitter account belonging to a certain “Carlos, a Spanish dispatcher” working for air traffic control at Kyiv Airport, claimed that two Ukrainian fighter jets had downed the aircraft. The fact that such a person did not work for Ukrainian air traffic control was established very quickly and the Twitter account was deleted. Still, RT Spanish carried out an interview with an individual claiming to be Carlos. The identity of the individual was also quickly established – a Spanish citizen residing in Romania. The story fell apart as a hoax. Yet, it is frequently referred to by pro-Kremlin sources as “proof” of Ukrainian involvement

In 2018, Russia’s largest newspaper, Komsomolskaya Pravda, attempted to advance yet another “version”, According to Komsomolskaya Pravda, the disaster occurred because of a bomb on board. The claim above on a bomb hidden on board the aircraft suggests that the tragedy was beneficial to Ukraine and, hence, following the principle of “Cui Bono” – who benefits – that Ukraine is the perpetrator. The shooting down of MH17 was a scheme to discredit Russia – a false flag operation.

Case study 2 - Examples of disinformation in the EUvsDisinfo database 

At the beginning of the Russian invasion in Ukraine, another false flag operation was aimed at convincing internal and external audience that the Russian Army captured public health laboratories in which secret biological experiments were conducted with UE funding

US biolabs in Ukraine are aimed at reducing Russia's gene pool. It has long been known what these Pentagon biolabs in Ukraine were doing. They grew pathogenic microbes to infect humans, everything was done with the Russian gene pool in mind. We know that about 30 Pentagon biolaboratories were dispersed in different cities on Ukrainian territory with different specialisations, but with one goal: to cheaply and angrily destroy the central enemy and its allies.

The US did indeed work in the creation of biological weapons in Ukraine. Russia, who has been denouncing this for a long time, delivered real documents and material evidence confirming this criminal activity to countries signatories of the Convention on Biological Weapons in a summit that took place on 5-9 September at the request of Moscow. None of the delegations doubted of the authenticity of the evidences presented by Russia.

1. Abdalla, N. S., Davies, P. H. J., Gustafson, K., Lomas, D., Wagner, S. (2022) Intelligence and the War in Ukraine: Part 1 - War on the Rocks
2. Arcos, Rubén. "Public Relations Strategic Intelligence: Intelligence Analysis, Communication and Influence." Public Relations Review42, no. 2 (2016): 264-270. https://doi.org/10.1016/j.pubrev.2015.08.003
3. Council of the EU. 2022. Council Decision (CFSP) 2022/351 of 1 March 2022 amending Decision 2014/512/CFSP concerning restrictive measures in view of Russia’s actions destabilising the situation in Ukraine, https://eur-lex.europa.eu/eli/dec/2022/351.
4. Cristina Ivan, Irena Chiru & Rubén Arcos (2021) A whole of society intelligence approach: critical reassessment of the tools and means used to counter information warfare in the digital age, Intelligence and National Security, 36:4, 495-511, DOI: 10.1080/02684527.2021.1893072
5. European Parliament (2022). European Parliament resolution of 1 March 2022 on the Russian aggression against Ukraine (2022/2564(RSP)). https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52022IP0052&from=GA.
6. Ford, M. (2022) The Smartphone as Weapon part 2: the targeting cycle in Ukraine, available at: (99+) The Smartphone as Weapon part 2: the targeting cycle in Ukraine | Matthew Ford - Academia.edu
7. Huw Dylan & Thomas J. Maguire (2022) Secret Intelligence and Public Diplomacy in the Ukraine War, Survival, 64:4, 33-74, DOI: 10.1080/00396338.2022.2103257
8. Huw, D., Maguire, Th. (2022) Why are governments sharing intelligence on the Ukraine war with the public and what are the risks? (theconversation.com)
9. Karalis, M. (2022) Open-source intelligence in Ukraine: Asset or liability? Available at Open-source intelligence in Ukraine: Asset or liability? | Chatham House – International Affairs Think Tank
10. Ofek Riemer (2022) Intelligence and the War in Ukraine: The Limited Power of Public Disclosure | INSS
11. Smith-Boyle, V. (2022) How OSINT Has Shaped the War in Ukraine | ASP American Security Project
12. OSINT in Ukraine: civilians in the kill chain and the information space - Global Defence Technology | Issue 137 | October 2022 (nridigital.com)
13. Ukraine war: Predicting Russia's next step in Ukraine - BBC News 

Co-funded by European Commission Erasmus+
University of Malta
University Rey Juan Carlos
Logo New Strategy Center

Project: DOMINOES Digital cOMpetences INformatiOn EcoSystem  ID: 2021-1-RO01-KA220-HED-000031158
The European Commission’s support for the production of this publication does not constitute an endorsement of the contents, which reflect the views only of the authors, and the Commission cannot be held responsible for any use which may be made of the information contained therein.

Ivan, Cristina; Chiru, Irena; Buluc, Ruxandra; Radu, Aitana; Anghel, Alexandra; Stoian-Iordache, Valentin; Arcos, Rubén; Arribas, Cristina M.; Ćuća, Ana; Ganatra, Kanchi; Gertrudix, Manuel; Modh, Ketan; Nastasiu, Cătălina. (2023). HANDBOOK on Identifying and Countering Disinformation. DOMINOES Project https://doi.org/10.5281/zenodo.7893952