(Not) Behind Enemy Lines II: Fighting Russia’s War in Ukraine

In Part II of the series, analyst Sean Crowley discusses the historical facts surrounding Russia’s activity in Ukraine including a look at first-hand testimonials, Russian intelligence activity, and the possibility of state-sponsored terrorism tactics.

Russia’s activity in Ukraine is well-documented, but Western media often overlooks the details indicative of sinister tactics that are likely being employed. Regular Russian military units, pouring into Ukraine from all over Russia and even units stationed abroad, are only the tip of the spear. Behind the scenes, the Ukrainian Security Service has arrested large numbers of Russian spies to purge Poroshenko’s government of outside influence, and even stopped a number of terrorist attacks allegedly sponsored by the FSB.



In June and July 2014, the Ukrainian armed forces scored a series of victories against pro-Russian separatist movements in the country’s eastern Donbas region, liberating a number of cities, including Slavyansk and Kramatorsk, in the process. Troops encircled rebel-held Donetsk, cutting off its ability to communicate with Luhansk, also under rebel control; the Ukrainian military’s efforts reduced separatist-controlled territory to three-fourths its original size. By August, a total Ukrainian military victory seemed all but imminent. 

Russia had a significant active-duty military presence in Ukraine at the time, namely in the form of commandos, but the prospect of a victory for Kiev encouraged Russia to escalate its military involvement in Donbas to previously unseen levels.

The Russian parliament had previously approved the use of military force in Ukraine on 1 March 2014. What followed was the seizure of Ukraine’s Crimean peninsula by a combined rapid-reaction force of Russian paratroopers, marines, and other special operations forces (spetsnaz). Crimean residents referred to them as the “little green men” because of the EMR (edinaya maskirovochnaya rascvetka; universal camouflage pattern) uniforms they wore.  

Following the annexation, fighting broke out after the emergence of a separatist movement that sought to integrate the country’s eastern Donetsk and Luhansk republics into the Russian Federation. Around the same time, “little green men” infiltrated Donbas. Accounts differ as to when spetsnaz first entered the region, but the earliest reports indicate they were held in reserve until May 2014. At that time, the 45th Guards Spetsnaz (reconnaissance) Regiment of the Airborne Troops (Vozdushno-desantnye voyska; VDV or Air-landing Forces) reportedly assisted separatists in seizing the Donetsk Airport. Throughout the summer of 2014, Russian forces in Donbas consisted of a few hundred spetsnaz training both local separatist fighters and Russian “volunteers.” Russia quickly found itself more reliant on the volunteers than the native Donbas fighters to sustain its insurrection; many of the original pro-Russian demonstrations in Donbas actually consisted of Russian volunteers.

Ukrainian advances in June and July prompted the Russians to launch artillery barrages from their own soil to halt the Kievan forces. This tactic has since become a permanent facet of Russian military strategy in Donbas. During this time, Russia’s involvement with the Donbas separatists entered the international spotlight in a dramatic manner.

The Donbas rebels have received a substantial amount of weapons systems from Russia, including the 9K37 Buk M1 (NATO reporting name: SA-11 “Gadfly”) surface-to-air missile (SAM). Officers from Russia’s Main Intelligence Directorate (Glavnoye razvedyvatel'noye upravleniye; GRU) reportedly discussed delivering this system to the separatists prior to 17 July 2014. On that day at 16:21, reports indicate that a separatist forward observer ordered fellow fighters to fire such a missile at an overhead aircraft. The aircraft, which the rebels most likely mistook for an Antonov or Ilyushin military transport plane, was Malaysian Airlines Flight MH17. Though Russia vehemently denies any involvement in the aircraft’s downing, subsequent Western investigations confirmed that an SA-11 shot down flight MH17. The incident galvanized the international community to levy sanctions against Russia for its involvement.

11 August 2014 saw the first deployment of conventional Russian military forces on Ukrainian soil. Divided into several battalion tactical groups (BTGs) with approximately 1,000 personnel each, Russian forces pushed back the 4,000-strong Ukrainian offensive. The summer-autumn offensive was a mammoth mobilization effort for the Russian military; only two of Russia’s ten field armies – the 35th and 5th Red Banner – did not commit troops to this phase of the conflict. On 15 August, separatist leader Aleksandr Zakharchenko boasted of Russia’s role in breaking the Ukrainian counter-offensive, claiming “they were inserted [into eastern Ukraine] at the most critical moment.” The fighting supposedly involved 1,200 of his own fighters trained in Russia, along with Russian military units backed by over 150 armored vehicles to include tanks, armored infantry fighting vehicles (AIFVs), and armored personnel carriers (APCs).  

In late 2014 peace talks between Russian president Vladimir Putin and Ukrainian president Petro Poroshenko in Minsk, Belarus, deescalated the conflict and Russian troops began to pull out of Donbas. Those that remained moved to the rear of the frontlines to carry out logistical support and long-range artillery strikes. The ceasefire, however, did not stop Russia from sending equipment into Donbas and conducting operations. In December, the Donetsk Airport fell to pro-Russian forces.

The next phase took place between late 2014 and February 2015 when Russian forces reintroduced several battalions and spetsnaz units. These troops relieved exhausted separatist forces, capturing the strategic railway hub of Debaltseve and swaths of territory. The fighting led to another ceasefire, dubbed Minsk II, this one more favorable to Moscow than Kiev. It went into effect on 15 February, three days after the fall of Debaltseve. Since April 2015, violence has continuously escalated.

The Russian government claims that its military is not involved, but large amounts of reporting suggest the opposite. According to these reports, Russian forces are often required to achieve victory in combat because separatist fighters are often unable to do so.

Below the surface, spies, hackers, and saboteurs all under apparent Russian influence or control support the separatists in a shadow war. Russian generals lead training for rebel forces, and equipment never officially exported from Russia mysteriously appears Ukraine. It is through Moscow’s manpower, training, and equipment that the separatist movement is able to remain active at all.


Tip of the Spear

The intervention in Donbas constitutes an immense mobilization effort for the Russian military. Participation in the conflict includes military units from as far away as Vladivostok and the Kuril Islands. During the summer/autumn and winter offensives, seven of Russia’s ten field armies (the 2nd Guards, 6th, 20th, 49th, 41st, 36th, and 29th Field Armies) had to mobilize all maneuver units under their commands.

Domestic Russian military units are not the only source of the troops pouring into Ukraine. In January 2015 the 201st Russian Military Base in Tajikistan sent troops to the Ukrainian border. The 102nd Russian Military Base in Armenia has not sent troops to Donbas, though all units within its parent command, the 58th Field Army, have served there at some time. Russian forces in Donbas operate under two separate commands: the northern operational area includes pro-Russian elements in Debaltseve, Donetsk, Luhansk, and the overall central area of rebel-controlled territory while the southern operational area covers Russian and separatist forces operating near Mariupol, a key industrial center and seaport.

The periods between the Minsk ceasefires have seen smaller numbers of Russian troops in Donbas, likely because Russia wanted to avoid disrupting the negotiations and to encourage the West to lift sanctions. The post-ceasefire military presence usually consists of several hundred trainers instructing the rebels on how to hold territory, operate sophisticated Russian military hardware such as anti-air (AA) missiles and electronic weapons normally operated by Russian soldiers, and manage an alternative chain of command. According to the United States Ambassador to the North Atlantic Treaty Organization (NATO) Douglas Lute, the trainers consist mainly of spetsnaz personnel and intelligence operatives in both uniform and civilian attire. The aforementioned alternative chain of command, according to Ambassador Lute, refers to a Russian-controlled command structure that parallels the separatist command; the Kremlin does not have sole control over the separatists, but is maneuvering towards it. Pro-Russian volunteers remain in Donbas, and reports indicate that conventional forces still maintain a presence in Donbas albeit on a much smaller scale. Instead of using BTGs from a single brigade or division, Russia uses ad hoc formations composed of different units. According to a recently released Ukrainian security service report there are 15 BTGs inside Ukraine, totaling 8,960 Russian soldiers as well as a supporting force of around 33,400 separatist fighters.


Stories from the Front

Interviews conducted with both pro-Russian separatists and even active-duty Russian soldiers indicate that it is the Russian military and not the separatists that serves as the most effective pro-Kremlin fighting force in Donbas. Russian forces reportedly spearhead major offensives in Donbas that call for disciplined, well-trained troops and then withdraw before their presence becomes highly conspicuous. Meanwhile, separatist fighters more often man checkpoints and serve as the public face of the conflict; Russian troops consider them “cannon fodder.” Though Moscow has tried to keep its military involvement in Ukraine a secret, the rebels often speak openly of Russian involvement, thanking their comrades for assisting them in battles that they otherwise could not have won.

Nowhere was this relationship more apparent than during the battle for Debaltseve in February 2015. Dmitriy Sapozhnikov, a former spetsnaz operator in the Russian Interior Ministry (Ministerstvo Vnutrennikh Del; MVD), was among the separatist fighters who fought during the Debaltseve siege. In October 2014, Sapozhnikov joined a militia in league with the Donetsk People’s Republic (Donétskaya Naródnaya Respúblika; DPR or DNR), where he led a DNR special operations unit consisting primarily of pro-Russian volunteers during the battle for Debaltseve. Unable to hold out after securing a major road, Sapozhnikov publicly credited Russian armor from Buryatia (a region in Siberia near the Russo-Mongolian border) with rescuing his unit and then moving forward to take the city.

Indeed, Siberian Buryats – more Asiatic than Slavic in appearance – made up a significant portion of the two Russian military units involved in the Debaltseve siege: the 5th Separate Tank Battalion from Ulan-Ude and the 37th Motorized Infantry Brigade from Kyakhta. Dorji Batomunkuev, a 20-year old contract soldier in the 5th Separate Tank Battalion, was among the Buryat soldiers deployed to Debaltseve; much of the information on Russian military involvement in Debaltseve comes from his account to the Russian opposition newspaper Novaya Gazeta (New Gazette). Batomunkuev told journalists that his unit trained for three months at a camp near the Russo-Ukrainian border called Kuzminsky before they deployed to Donbas. The Russian commanders did not tell the soldiers that their objective was to capture Debaltseve, merely to “shoot to kill anything that moves” (Russian and separatist forces, however, often wear white armbands to identify themselves and avoid friendly fire incidents). 

The Russian tank battalion deployed to Debaltseve included 300 men and 31 tanks divided into three companies with 10 tanks each (the 31st tank most likely served in a headquarters capacity). In contrast, separatist fighters taking part in the siege made up less than ten percent of the attacking elements. The Russian forces’ orders were to help separatists reinforce a “kettle” (Russian military slang for encircling a large number of trapped hostiles). During the battle, Batomunkuev reported that his unit employed a “carousel” tactic in which three or four T-72 tanks bombarded the enemy from afar until they depleted their ammunition and another set of tanks moved in replace them. Using these tactics, the Russian military managed to capture Debaltseve in a relatively short timeframe compared to the rebels, who had been attempting to take it for weeks.

Despite the apparent coordination seen during Debaltseve, accounts vary as to how cooperative the relationship between the Russians and the separatists actually is. Sapozhnikov says, “All operations, especially large-scale ones, are led by Russian officers and generals. They develop plans together with our commanders and then we fulfill them.” While reports confirm there are Russian generals serving in Donbas, some evidence suggests they have limited control. Batomunkuev claims that although Russia attempts to coordinate with the rebels, the cooperation often does not work both ways. He tells of one instance where his tank almost fired on a separatist technical (a civilian vehicle converted for combat use) because the operators failed to properly identify themselves. Speaking of the rebels’ combat performance, Batomunkuev states, “There is no coordination, no leaders, no battle command. It’s all disjointed.” Rebels often show a reluctance to attack while Russian military personnel, with their more rigid command structure, often have no choice but to follow their commanders’ orders. Russia is likely using the trainers in Donbas to turn the separatist militias into a proxy army, a force it can more easily control.


Cloak and Dagger

Russia’s intelligence agencies are undoubtedly playing an active role in the Donbas conflict, and the Poroshenko government is dedicating significant resources towards their expulsion. A number of GRU agents and assets have been arrested recently for actions ranging from stealing state secrets to smuggling truckloads of weapons across the Russia-Ukraine border. Diplomatic status does not protect Russian spies, as arrests go as high as the naval attaché in Kiev. 

The Russian intelligence services’ activities in Ukraine also include direct action and sabotage. The Ukrainian security services arrested Larisa “Tereza” Chubarova, an officer in the DNR’s own “state security ministry,” who, according to other arrested sources, received weapons and explosives from the Russian Federal Security Service (Federal'naya sluzhba bezopasnosti Rossiyskoy Federatsii; FSB).

As per Russia’s hybrid warfare strategy, its intelligence activities extend to the cyber realm. Reports indicate that Russian hackers, either working directly for or affiliated with state security services, routinely lure Ukrainian personnel with spear phishing attacks designed to grant remote access to Ukrainian military and security service servers. Stolen information concerns combat intelligence such as the number of Ukrainian troops in reconnaissance battalions, equipment in their arsenals, and rebel leaders they seek. Targeted agencies include the Ukrainian military, counterintelligence and border patrol agencies, and local police.

After Kiev and independent investigators suggested in September 2014 that the hackers were affiliated with the Russian security services, the attackers changed their software to avoid detection. Cyber-attacks also appear to stop during the ceasefires; experts claim this indicates that the hackers actually believe themselves to be participating in the conflict as opposed to merely collecting intelligence, an activity that often continues beyond lulls in conflict. Experts also believe that the hackers could use the “lure documents” to disseminate false orders to the Ukrainian military. Jason Lewis, a cyber-security expert with the Lookingglass security firm which has been studying these attacks, states that people very often do not think twice before opening a document that appears legitimate, a technique known as social engineering.


Continued in Part III


Photo Courtesy of Wikimedia Commons